From 2a108c358ac0c32caa25a5cb71c63eb5f43bde35 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Tue, 19 Apr 2016 13:16:38 +0200
Subject: [PATCH] Public-dns warning list

---
 lists/public-dns/list.json | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 lists/public-dns/list.json

diff --git a/lists/public-dns/list.json b/lists/public-dns/list.json
new file mode 100644
index 0000000..70f1229
--- /dev/null
+++ b/lists/public-dns/list.json
@@ -0,0 +1,17 @@
+{
+  "name": "List of known public DNS resolvers",
+  "description": "Event contains one or more public DNS resolvers as attribute with an IDS flag set",
+  "matching_attributes": [
+    "ip-src",
+    "ip-dst"
+  ],
+  "list": [
+    "8.8.8.8",
+    "8.8.4.4",
+    "208.67.222.222",
+    "208.67.220.220",
+    "195.46.39.39",
+    "195.46.39.40"
+  ]
+}
+