# Blacklist DNS alerting

**URL:** <https://community.zeek.org/t/blacklist-dns-alerting/2269>\
**Category:** Zeek\
**Created:** [March 21, 2012, 4:34pm UTC](https://community.zeek.org/t/blacklist-dns-alerting/2269 "2012-03-21T16:34:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bob\_Rotsted](https://avatars.discourse-cdn.com/v4/letter/b/85e7bf/32.png) [@Bob\_Rotsted](https://community.zeek.org/u/Bob_Rotsted)\
**Post date:** [March 21, 2012, 4:34pm UTC](https://community.zeek.org/t/blacklist-dns-alerting/2269/1 "2012-03-21T16:34:49Z")

</div>

Hello all,

I recently spun up my first Bro instance and I'm trying to find the most  
elegant way to alert any time there is a query for a particular set of  
malicious domains (ex.  
[https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist](https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist)) .

Would this be best accomplished with a signature? Would I be better off  
writing a hook for Bro's core DNS script?

Any input will be greatly appreciated,

Bob

---

<div class="post-metadata">

**Author:** ![Lou\_RUPPERT](https://avatars.discourse-cdn.com/v4/letter/l/a587f6/32.png) [@Lou\_RUPPERT](https://community.zeek.org/u/Lou_RUPPERT)\
**Post date:** [March 21, 2012, 4:46pm UTC](https://community.zeek.org/t/blacklist-dns-alerting/2269/2 "2012-03-21T16:46:22Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

> Hello all,
> 
> I recently spun up my first Bro instance and I'm trying to find the most  
> elegant way to alert any time there is a query for a particular set of  
> malicious domains (ex.  
> [https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist](https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist)) .
> 
> Would this be best accomplished with a signature? Would I be better off  
> writing a hook for Bro's core DNS script?
> 
> Any input will be greatly appreciated,

I do it with a simple hook based on the 1.5.x DNS code. I then use a  
perl script to parse a list of domains into a data structure this can  
use. Lines in the output of that script look like this:

redef DNS::hostile\_domain\_list += { "torpig-sinkhole.org",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"riaa.com",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"mpaa.org",  
};

And the bro hook code looks like this:

module DNS;

export {  
const hostile\_domain\_list: set[string] &redef;  
const okay\_to\_lookup\_hostile\_domains: set[addr] &redef;  
}

redef okay\_to\_lookup\_hostile\_domains = { 192.168.1.1, 192.168.1.2, };

redef enum Notice::Type += {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DNS\_Malicious\_Domain  
};

function second\_level\_domain(name: string): string  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local split\_on\_dots = split(name, /\./);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local num\_dots = length(split\_on\_dots);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( num\_dots \<= 1 )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return name;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return fmt("%s.%s", split\_on\_dots[num\_dots-1],  
split\_on\_dots[num\_dots]);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

event dns\_request(c: connection, msg: dns\_msg, query: string, qtype:  
count, qcla  
ss: count) &priority=0  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (c$id$orig\_h !in okay\_to\_lookup\_hostile\_domains)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (second\_level\_domain(query) in hostile\_domain\_list)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local message=fmt("Test: Malware domain %s",query);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NOTICE([$note=DNS\_Malicious\_Domain,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$msg=message,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$conn=c]);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/blacklist-dns-alerting/2269/3 "2022-05-06T15:40:16Z")

</div>