Repository navigation
v1.3.8 - (October 24, 2026)
- MINOR: Added another option to the feeds menu (2) and enabled functionality from the AbuseIPDB
Reputation provider. Upon enabling (and signing up for another API key!), this service will scan
true positives identified by your feed lists if they are found on your conntrack, DNS and dropbear
connections, and provide you with additional intelligence about the IP in question. This info is
added to various on-screen interfaces, logs and email alerts. Thanks to @SomewhereOverTheRainbow
for this suggestion!
- PATCH: Built in better logic to detect if an AMTM autoupdate replaced the script, and will now
restart the script automatically if it finds a newer version in /jffs/scripts.
- PATCH: Small corrections to Entware detection logic.
- PATCH: Changed some of the curl timeout values based on some feedback from @BobWadd
- PATCH: Small revisions to the #2 Feeds & API menu, and changed some of the layout along with how
the logic works for enabling a feed/reputation service that requires an API. Thanks @JB_1366!
- PATCH: This version fixes the change that abuse.ch put into place these last few days where they
are now requiring an API key for their URLhaus list, available via API. The good news here is
that you can use the same exact API key you have for ThreatFox. Thanks to @ankhazam for bringing
this up!
- PATCH: Revamped some of the stats, giving a bit more info on what is downloaded, deduped and
used in the end, and making sure this all matches what goes into the log files. I know it can be
a bit confusing as I'm parsing large json files down to only its usable items, like ThreatFox
going from 40K lines down to 4K usable items.