{
  "version": 1,
  "namespace": "crowdsec",
  "description": "Crowdsec IP address classifications and behaviors taxonomy.",
  "predicates": [
    {
      "value": "behavior",
      "expanded": "Behavior",
      "description": "Attack categories and behaviors associated with an IP address.",
      "uuid": "0cfd7bf3-b44b-545c-a8fd-0fff9beacc58"
    },
    {
      "value": "false-positive",
      "expanded": "False positive",
      "description": "Defines whether an IP address is a known false positive.",
      "uuid": "1dbf83ca-b5f1-562b-8bee-a2bea30a8006"
    },
    {
      "value": "classification",
      "expanded": "Classification",
      "description": "Category associated to an IP address.",
      "uuid": "48b411c0-b7a0-5751-9bbc-8079e4d40ce7"
    }
  ],
  "values": [
    {
      "predicate": "behavior",
      "entry": [
        {
          "value": "database-bruteforce",
          "expanded": "Database Bruteforce",
          "description": "IP has been reported for performing brute force on databases.",
          "uuid": "c44ee91e-2b19-5d78-8d5d-59c9d3ffdcfe"
        },
        {
          "value": "ftp-bruteforce",
          "expanded": "FTP Bruteforce",
          "description": "IP has been reported for performing brute force on FTP services.",
          "uuid": "5a8189b8-31c1-5577-b175-bc12904a4b64"
        },
        {
          "value": "generic-exploit",
          "expanded": "Exploitation attempt",
          "description": "IP has been reported trying to exploit known vulnerability/CVE on unspecified protocol.",
          "uuid": "4878b418-2055-5999-b488-3d09fcca24fb"
        },
        {
          "value": "http-bruteforce",
          "expanded": "HTTP Bruteforce",
          "description": "IP has been reported for performing a HTTP brute force attack (either generic http probing or applicative related brute force).",
          "uuid": "95ee7708-8086-5a2b-a4dd-df1278f00f81"
        },
        {
          "value": "http-crawl",
          "expanded": "HTTP Crawl",
          "description": "IP has been reported for performing aggressive crawling of web applications.",
          "uuid": "ba65e9f8-8bee-5964-a93f-b3ceb8123846"
        },
        {
          "value": "http-exploit",
          "expanded": "HTTP Exploit",
          "description": "IP has been reported for attempting to exploit a vulnerability in a web application.",
          "uuid": "1bf5892a-d2ce-5915-83e7-d45df67b4302"
        },
        {
          "value": "http-scan",
          "expanded": "HTTP Scan",
          "description": "IP has been reported for performing actions related to HTTP vulnerability scanning and discovery.",
          "uuid": "ce89c535-57f5-57b3-9f47-1576253db3bb"
        },
        {
          "value": "http-spam",
          "expanded": "Web form spam",
          "description": "IP has been reported trying to perform spam via web forms/forums.",
          "uuid": "e47bc51b-a9d7-5fbf-920c-52c51a0e1fc8"
        },
        {
          "value": "iot-bruteforce",
          "expanded": "IOT Bruteforce",
          "description": "IP has been reported for performing brute force on IOT management interfaces.",
          "uuid": "45d76983-4286-5b1e-960c-f849fea73e96"
        },
        {
          "value": "ldap-bruteforce",
          "expanded": "LDAP Bruteforce",
          "description": "IP has been reported for performing brute force on ldap services.",
          "uuid": "5cd9eca1-926e-5f62-901c-632bf8aece77"
        },
        {
          "value": "pop3/imap-bruteforce",
          "expanded": "POP3/IMAP Bruteforce",
          "description": "IP has been reported for performing a POP3/IMAP brute force attack.",
          "uuid": "f3700148-be8c-53a8-ae46-00581416c578"
        },
        {
          "value": "sip-bruteforce",
          "expanded": "SIP Bruteforce",
          "description": "IP has been reported for performing a SIP (VOIP) brute force attack.",
          "uuid": "4e695daa-889e-5c17-8e29-723523ee2df1"
        },
        {
          "value": "smb-bruteforce",
          "expanded": "SMB Bruteforce",
          "description": "IP has been reported for performing brute force on samba services.",
          "uuid": "e9b8ca39-5112-5b9a-82a1-b0bea9327a9a"
        },
        {
          "value": "smtp-spam",
          "expanded": "SMTP spam",
          "description": "IP has been reported trying to perform spam SMTP service.",
          "uuid": "2ab8924c-2be7-53b8-b0b8-d909cca63bc9"
        },
        {
          "value": "ssh-bruteforce",
          "expanded": "SSH Bruteforce",
          "description": "IP has been reported for performing brute force on ssh services.",
          "uuid": "83ebbf72-7b89-5292-9a13-162d0eb6b97c"
        },
        {
          "value": "tcp-scan",
          "expanded": "TCP Scan",
          "description": "IP has been reported for performing TCP port scanning.",
          "uuid": "bc0ca1dc-4378-5f7f-8624-d7784b6170c4"
        },
        {
          "value": "telnet-bruteforce",
          "expanded": "TELNET Bruteforce",
          "description": "IP has been reported for performing brute force on telnet services.",
          "uuid": "ea226db8-ee0a-5163-bc87-831aaa7cb105"
        },
        {
          "value": "vm-management-bruteforce",
          "expanded": "VM Management Bruteforce",
          "description": "IP has been reported for performing brute force on virtual environement management applications.",
          "uuid": "36dcf9cc-2b03-5655-adeb-535b7244407a"
        },
        {
          "value": "windows-bruteforce",
          "expanded": "SMB/RDP bruteforce",
          "description": "IP has been reported for performing brute force on Windows (samba, remote desktop) services.",
          "uuid": "ae535fe0-6a6d-581c-bce3-ac3c211ce4bb"
        }
      ]
    },
    {
      "predicate": "false-positive",
      "entry": [
        {
          "value": "cdn-cloudflare_exit_node",
          "expanded": "Cloudflare CDN",
          "description": "IP is a Cloudflare CDN exit IP and should not be flagged as a threat.",
          "uuid": "e3d6be64-7eed-5538-9a8d-c0a3d463a7b0"
        },
        {
          "value": "cdn-exit_node",
          "expanded": "CDN exit node",
          "description": "IP is a CDN exit IP and should not be flagged as a threat.",
          "uuid": "df03fbc6-1efa-5da8-87d2-ff0f69e2703e"
        },
        {
          "value": "ip-private_range",
          "expanded": "Private IP address range",
          "description": "This IP address is in a private IP range",
          "uuid": "76ccaa8f-3b48-5ccd-8881-f0da53dce9da"
        },
        {
          "value": "msp-scanner",
          "expanded": "Legitimate Scanner",
          "description": "IP belongs to a known 'legitimate' scanner (MSP) and should not be flagged as a threat.",
          "uuid": "f7239ab5-57d4-51b2-bcde-bb05db4569d5"
        },
        {
          "value": "seo-crawler",
          "expanded": "SEO crawler",
          "description": "IP belongs to a known SEO crawler and should not be flagged as a threat.",
          "uuid": "5c52c987-e3b2-51d7-a665-31aaec4d1dac"
        },
        {
          "value": "seo-duckduckbot",
          "expanded": "Duckduckbot SEO crawler",
          "description": "IP belongs to Duckduckbot SEO crawler and should not be flagged as a threat.",
          "uuid": "b8dd4322-b3eb-5383-8498-f0440ba39d89"
        },
        {
          "value": "seo-pinterest",
          "expanded": "Pinterest crawler",
          "description": "IP belongs to Pinterest crawler and should not be flagged as a threat.",
          "uuid": "9f4d7c2f-3c66-549c-9956-ac774e95c564"
        }
      ]
    },
    {
      "predicate": "classification",
      "entry": [
        {
          "value": "community-blocklist",
          "expanded": "CrowdSec Community Blocklist",
          "description": "IP belong to the CrowdSec Community Blocklist",
          "uuid": "bef8e86b-1d80-5123-8dee-5bfb66080db7"
        },
        {
          "value": "profile-insecure_services",
          "expanded": "Dangerous Services Exposed",
          "description": "IP exposes dangerous services (vnc, telnet, rdp), possibly due to a misconfiguration or because it's a honeypot.",
          "uuid": "33e69f1f-9b5c-5820-9325-b15c3d52288d"
        },
        {
          "value": "profile-many_services",
          "expanded": "Many Services Exposed",
          "description": "IP exposes many open port, possibly due to a misconfiguration or because it's a honeypot.",
          "uuid": "f8192756-4b1e-59ec-815d-984b97cae550"
        },
        {
          "value": "proxy-tor",
          "expanded": "TOR exit node",
          "description": "IP is being flagged as a TOR exit node.",
          "uuid": "8db5e7a1-edf0-5843-9ee1-6cd94e03650d"
        },
        {
          "value": "proxy-vpn",
          "expanded": "VPN",
          "description": "IP exposes a VPN service or is being flagged as one.",
          "uuid": "913f77b1-a12c-59f8-83ca-f26a3aba14e7"
        },
        {
          "value": "range-data_center",
          "expanded": "Data Center",
          "description": "IP is known to be hosted in a data center.",
          "uuid": "ac8696b1-404a-5bc3-bd12-84c2f38737ec"
        },
        {
          "value": "scanner-alphastrike",
          "expanded": "Known Security Company",
          "description": "IP belongs to a company that scans internet : AlphaSrike.",
          "uuid": "245ad912-ec94-5407-8b17-46eb7ca2ee44"
        },
        {
          "value": "scanner-binaryedge",
          "expanded": "Known Security Company",
          "description": "IP belongs to a company that scans internet : binaryedge.",
          "uuid": "b588b067-3a4b-523d-b01b-82b661972952"
        },
        {
          "value": "scanner-censys",
          "expanded": "Known Security Company",
          "description": "IP belongs to a company that scans internet : Censys.",
          "uuid": "31104c51-6312-500b-934e-dd40adeeb2b2"
        },
        {
          "value": "scanner-cert.ssi.gouv.fr",
          "expanded": "Known CERT",
          "description": "IP belongs to an entity that scans internet : cert.ssi.gouv.fr.",
          "uuid": "db4aef72-7185-53fc-a373-099054a034cb"
        },
        {
          "value": "scanner-cisa.dhs.gov",
          "expanded": "Known CERT",
          "description": "IP belongs to an entity that scans internet : cisa.dhs.gov.",
          "uuid": "70111b9f-7f03-538b-9913-58c7d40e5fd6"
        },
        {
          "value": "scanner-internet-census",
          "expanded": "Known Security Company",
          "description": "IP belongs to a company that scans internet : internet-census.",
          "uuid": "93d324fc-f2de-5ec8-9c42-3c19635b92ba"
        },
        {
          "value": "scanner-leakix",
          "expanded": "Known Security Company",
          "description": "IP belongs to a company that scans internet : leakix.",
          "uuid": "c8567c19-6277-5590-a916-8f572d4e757f"
        },
        {
          "value": "scanner-legit",
          "expanded": "Legit scanner",
          "description": "IP belongs to a company that scans internet",
          "uuid": "1d05c279-1821-5095-aeb7-da2c6a16759f"
        },
        {
          "value": "scanner-shadowserver.org",
          "expanded": "Known Security Company",
          "description": "IP belongs to an entity that scans internet : www.shadowserver.org.",
          "uuid": "dc8b9c8a-d976-56c9-975f-bd6bccc2e3f1"
        },
        {
          "value": "scanner-shodan",
          "expanded": "Known Security Company",
          "description": "IP belongs to a company that scans internet : Shodan.",
          "uuid": "6c2494e3-6ab7-5b0a-bf0d-46e7a93d3112"
        },
        {
          "value": "scanner-stretchoid",
          "expanded": "Known Security Company",
          "description": "IP belongs to an entity that scans internet : stretchoid.",
          "uuid": "575fd187-3dfd-5198-93d6-866937632c6f"
        },
        {
          "value": "profile-fake_rdns",
          "expanded": "Fake RDNS",
          "description": "IP is using a fake RDNS",
          "uuid": "796a751f-af93-5187-a753-aa07af6d859e"
        },
        {
          "value": "profile-nxdomain",
          "expanded": "NXDOMAIN",
          "description": "RDNS doesn't exist",
          "uuid": "674c1c23-3494-5123-a0d2-5f1995aafb2a"
        },
        {
          "value": "profile-router",
          "expanded": "Router",
          "description": "IP belongs to a router exping services on the internet",
          "uuid": "a2ff1566-19dc-589d-b2b7-7df9a9759269"
        },
        {
          "value": "profile-proxy",
          "expanded": "Proxy",
          "description": "IP exposes services that are commonly used by proxies",
          "uuid": "81dbb257-03b1-5606-b400-a2e9b6cc9743"
        },
        {
          "value": "profile-jupiter-vpn",
          "expanded": "JupiterVPN",
          "description": "IP belongs to a jupiter vpn",
          "uuid": "1e215a7b-5833-5c69-ae6b-3d025846da7c"
        },
        {
          "value": "device-cyberoam",
          "expanded": "Cyberoam",
          "description": "IP belongs to a Cyberoam router",
          "uuid": "a05be643-d1cd-5a6b-a06d-95f031c196b1"
        },
        {
          "value": "device-microtik",
          "expanded": "Mikrotik",
          "description": "IP belongs to a Mikrotik router",
          "uuid": "02260fb7-1f7c-5984-ad9f-734f46030c9a"
        },
        {
          "value": "device-asuswrt",
          "expanded": "AsusWRT",
          "description": "IP belongs to a AsusWRT router",
          "uuid": "3ef8d2a7-15bc-5aa3-86b6-0f3026e6b97c"
        },
        {
          "value": "device-hikvision",
          "expanded": "Hikvision",
          "description": "IP belongs to a Hikvision camera",
          "uuid": "7054053c-43a0-52d2-8b83-33a32f2380d0"
        },
        {
          "value": "device-ipcam",
          "expanded": "IpCamera",
          "description": "IP belongs to a IP camera",
          "uuid": "13c049d4-f5b9-5380-bbda-fe826f3a6eb7"
        },
        {
          "value": "profile-likely_botnet",
          "expanded": "Likely Botnet",
          "description": "IP is likely to belong to a botnet (based on behaviour and/or characteristics)",
          "uuid": "7703beb6-92cf-500c-8210-e28c56a583f6"
        }
      ]
    }
  ],
  "uuid": "3db85e55-2971-52e3-8f88-cddc8e9431bc"
}