updateable objects 'Known Active Attackers'

[LazarusG]

Hi,

A customer asked about a Checkpoint equivalent to Palo Alto EDLS, a colleague found there is an updateable object called 'Known Active Attackers' However we cant find much on it and the hyperlink on the object only links to the updateable obects SK;

sk131852 - Updatable Objects

Do we know who maintains or manages this list or if there is any more detail about it anywhere?

It sounds ideal if its a live, actionable managed list.

Thanks

Ian

[simonemantovani]

Hello

the object could be directly manage by the Check Point ThreatCloud team (this is the information I have acquired, but I'm still checking); you can view the content by accessing the gateway, all the updatable objects are store under this directory: /opt/CPshrd-R81.20/database/downloads/ONLINE_SERVICES/1.0/, you should see some directories like this case:

total 28
drwx------ 3 admin root 4096 Oct 12 18:58 121026153703
drwx------ 3 admin root 4096 Oct 13 00:58 121026213639
drwx------ 3 admin root 4096 Oct 13 06:58 131026033518
-rw-rw---- 1 admin root 113 Oct 13 10:03 Update_Status.dat
-rw-rw---- 1 admin root 111 Oct 13 06:58 last_revision.xml
-rw-rw---- 1 admin root 111 Oct 13 06:58 last_revision_old.xml
drwx------ 3 admin root 26 Aug 19 2025 tmp
-rw-rw---- 1 admin root 41 Oct 13 06:58 tmp_revisions_order.txt

enter into the last created dir, in my case 131026033518, you'll see several .C files, open the file suspicious.C, this is the content of the updatable object "Know Active Attackers".

[LazarusG]

Thank you - I couldnt see anything for the object in that dir when I added it to my rulebase. Without any documentation its difficult to recommend anyone uses it - but a colleague found they could expand some detail with this command;

[Expert@R82_ClusterXL2:0]# dynamic_objects -uo "Known Active Attackers"

object name: Known Active Attackers
range 0 : 38.54.88.201 38.54.88.201
range 1 : 38.54.107.167 38.54.107.167
range 2 : 38.60.157.139 38.60.157.139
range 3 : 45.61.136.173 45.61.136.173
range 4 : 45.63.104.106 45.63.104.106
range 5 : 45.76.26.42 45.76.26.42
range 6 : 45.77.149.152 45.77.149.152
range 7 : 64.176.228.109 64.176.228.109
range 8 : 66.42.99.200 66.42.99.200
range 9 : 139.28.37.250 139.28.37.250
range 10 : 144.208.127.134 144.208.127.134
range 11 : 144.208.127.155 144.208.127.155
range 12 : 146.71.81.184 146.71.81.184
range 13 : 151.241.99.207 151.241.99.207
range 14 : 151.241.99.233 151.241.99.233
range 15 : 158.62.198.182 158.62.198.182
range 16 : 158.247.195.147 158.247.195.147
range 17 : 162.33.177.101 162.33.177.101
range 18 : 192.142.10.99 192.142.10.99
range 19 : 194.213.18.137 194.213.18.137
range 20 : 208.123.119.167 208.123.119.167
range 21 : 209.182.225.136 209.182.225.136

Looking for domains for 'Known Active Attackers' and its children objects:

The updatable object Known Active Attackers does not contain any domains (object is enforced by IP addresses only)

Operation completed successfully

Could be a very nice feature if its developed and documented.