A simple bash script to automate downloading the snort "Testing IP Block List". The extra steps are due to an 'accept' button on the web page.

snort_ip_block_list.sh

#!/bin/bash
set -euo pipefail

# By using this script you are accepting the terms on the Snort/Cisco/Talos website.
# https://snort.org/downloads/ip-block-list/terms

COOKIEJAR=$(mktemp /tmp/snort_cookie.XXXXXX)
ACCEPT_PAGE=$(mktemp /tmp/snort_accept.XXXXXX)
LIST_URL="https://snort.org/downloads/ip-block-list"

# Location to save the final downloaded list
SAVEFILE="/tmp/snort_ip_block_list.txt"

# Automatically clean up on exit
trap 'rm -f "$COOKIEJAR" "$ACCEPT_PAGE"' EXIT

mkdir -p "$(dirname "$SAVEFILE")"

UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0 Safari/537.36"

echo "[+] Fetching accept terms page..."
curl -sSL --http1.1 --compressed -c "$COOKIEJAR" -b "$COOKIEJAR" \
  -A "$UA" "$LIST_URL/terms" -o "$ACCEPT_PAGE"

# Extract CSRF authenticity_token
TOKEN=$(grep -oP '(?<=name="authenticity_token" value=")[^"]+' "$ACCEPT_PAGE" || true)
if [ -z "$TOKEN" ]; then
  TOKEN=$(grep -oP '(?<=meta name="csrf-token" content=")[^"]+' "$ACCEPT_PAGE" || true)
fi

if [ -z "$TOKEN" ]; then
  echo "[!] Could not extract authenticity_token. Saved page at $ACCEPT_PAGE"
  exit 1
fi

echo "[+] Submitting acceptance form..."
curl -sSL --http1.1 --compressed \
  -A "$UA" -e "$LIST_URL/terms" -b "$COOKIEJAR" -c "$COOKIEJAR" \
  -X POST "$LIST_URL/accept-terms" \
  --data-urlencode "authenticity_token=$TOKEN" \
  --data "commit=Accept" \
  -o /dev/null

echo "[+] Downloading IP block list..."
curl -sSL --http1.1 --compressed \
  -A "$UA" -b "$COOKIEJAR" -L "$LIST_URL" -o "$SAVEFILE"

if [ ! -s "$SAVEFILE" ]; then
  echo "[!] Download failed or file empty."
  exit 1
fi

echo "[✓] Download complete: $SAVEFILE ($(wc -c < "$SAVEFILE") bytes)"