From ba55c0675df20a89a452162216af4b6a8e06ce5c Mon Sep 17 00:00:00 2001
From: William Heimbigner <william.heimbigner@gmail.com>
Date: Tue, 25 Mar 2008 17:05:22 +0000
Subject: Added dnsbl analysis, better sql, better rules, fixed some commands

---
 config-default/dnsbl.xml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 config-default/dnsbl.xml

(limited to 'config-default/dnsbl.xml')

diff --git a/config-default/dnsbl.xml b/config-default/dnsbl.xml
new file mode 100644
index 0000000..f4f51a3
--- /dev/null
+++ b/config-default/dnsbl.xml
@@ -0,0 +1,23 @@
+<dnsbl>
+  <query id="rbl.efnetrbl.org">
+    <response id="127.0.0.1">Open proxy</response>
+    <response id="127.0.0.2">Trojan spreader</response>
+    <response id="127.0.0.3">Trojan infected client</response>
+    <response id="127.0.0.4">TOR exit server</response>
+    <response id="127.0.0.5">Drones / Flooding</response>
+  </query>
+  <query id="dnsbl.dronebl.org">
+    <response id="127.0.0.1">Testing data</response>
+    <response id="127.0.0.2">Sample</response>
+    <response id="127.0.0.3">IRC Drone</response>
+    <response id="127.0.0.4">Tor</response>
+    <response id="127.0.0.5">Bottler</response>
+    <response id="127.0.0.6">Unknown spambot or drone</response>
+    <response id="127.0.0.7">DDOS drone</response> 
+    <response id="127.0.0.8">SOCKS proxy</response> 
+    <response id="127.0.0.9">HTTP proxy</response> 
+    <response id="127.0.0.10">ProxyChain</response> 
+    <response id="127.0.0.11">MediaDefender crap</response> 
+    <response id="127.0.0.255">Unknown</response>
+  </query>
+</dnsbl>
-- 
cgit v1.2.3