I wanted to raise awareness about a potential issue with the Abuse.ch ThreatFox IOC Unbound DNS blocklist, which is currently referenced in OPNsense.
Current configuration: The Unbound blocklists.conf (https://github.com/opnsense/core/blob/stable/26.7/src/opnsense/service/templates/OPNsense/Unbound/core/blocklists.conf) points to this URL:
https://threatfox.abuse.ch/downloads/hostfile
The issue: Visiting threatfox.abuse.ch/export reveals that Abuse.ch now requires users to register and obtain an Auth-Key before being able to download the host file (domains-only version). This represents a change in how their feeds are distributed.
Timeline: Based on the Internet Archive, this change appears to have occurred sometime between January and February 2026. You can verify this here: https://web.archive.org/web/20260107104855/https://threatfox.abuse.ch/export/ (https://web.archive.org/web/20260107104855/https://threatfox.abuse.ch/export/)
Impact & Next Steps: This change means that automated OPNsense blocklist updates may soon fail. It would be helpful to know if the maintainers are aware of this and if they are planning to transition to authenticated access.
If anyone has any additional information that I might have missed, please share it 🙂
Let's hope that the situation remains unchanged. Their communication on the subject is a bit lacking.
That being said, if that takes effect, they will probably be removed and users will need to use the custom blocklist option, where they would provide the URL, including their key.