# This file contains configuration for using the dnsbl module with
# the DroneBL DNSBL. See https://dronebl.org/ for more information on
# DroneBL.

<dnsbl name="DroneBL"
       domain="dnsbl.dronebl.org"
       type="record"
       records="3,5,6,7,8,9,10,11,13,14,15,16,17,19"
       action="zline"
       duration="7d"
       reason="You are listed in DroneBL: %reason%. Please visit https://dronebl.org/lookup?ip=%ip%&amp;network=%network.url% for more information.">

<dnsblreply name="DroneBL"
            reply="1"
            description="Testing">

<dnsblreply name="DroneBL"
            reply="2"
            description="Sample data used for heuristical analysis">

<dnsblreply name="DroneBL"
            reply="3"
            description="IRC spam drone (litmus/sdbot/fyle)">

<dnsblreply name="DroneBL"
            reply="5"
            description="Bottler">

<dnsblreply name="DroneBL"
            reply="6"
            description="Unknown worm or spambot">

<dnsblreply name="DroneBL"
            reply="7"
            description="DDoS drone">

<dnsblreply name="DroneBL"
            reply="8"
            description="Open SOCKS proxy">

<dnsblreply name="DroneBL"
            reply="9"
            description="Open HTTP proxy">

<dnsblreply name="DroneBL"
            reply="10"
            description="Proxychain">

<dnsblreply name="DroneBL"
            reply="11"
            description="Webpage proxy">

<dnsblreply name="DroneBL"
            reply="12"
            description="Open DNS resolver">

<dnsblreply name="DroneBL"
            reply="13"
            description="Automated dictionary attack">

<dnsblreply name="DroneBL"
            reply="14"
            description="Open WINGATE proxy">

<dnsblreply name="DroneBL"
            reply="15"
            description="Compromised router / gateway">

<dnsblreply name="DroneBL"
            reply="16"
            description="Autorooting worm">

<dnsblreply name="DroneBL"
            reply="17"
            description="Automatically determined botnet IP">

<dnsblreply name="DroneBL"
            reply="18"
            description="Possibly compromised DNS/MX type hostname detected on IRC">

<dnsblreply name="DroneBL"
            reply="19"
            description="Abused VPN service">

<dnsblreply name="DroneBL"
            reply="255"
            description="Uncategorized threat">