Missing some generate scripts

[sustefil]

Hi guys,

I wondered whether it would be possible to provide some more generate scripts to the repo.

For example the google-gmail-sending-ips list has a "date" version, so I assume you already have the generate script.

Thanks in advance.

[adulau]

Good question. I find that the way the get the records, it's use the SPF records (which a kind of recursive maze at Google).

adulau@dobbertin:~$ dig -t TXT _netblocks4.google.com +short
"v=spf1 ip4:74.114.24.0/21 ip4:136.112.0.0/12 ip4:172.217.224.0/19 ip4:208.81.188.0/22 ~all"
adulau@dobbertin:~$ dig -t TXT _netblocks.google.com +short
"v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all"
adulau@dobbertin:~$ dig -t TXT _netblocks2.google.com +short
"v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"
adulau@dobbertin:~$ dig -t TXT _netblocks3.google.com +short
"v=spf1 ip4:172.217.0.0/19 ip4:172.217.32.0/20 ip4:172.217.128.0/19 ip4:172.217.160.0/20 ip4:172.217.192.0/19 ip4:172.253.56.0/21 ip4:172.253.112.0/20 ip4:108.177.96.0/19 ip4:35.191.0.0/16 ip4:130.211.0.0/22 ~all"

It seems to match the current warning list.

[sustefil]

Good :)

Another lists of this kind would be:

List of known Ovh Cluster IP List of known Office 365 Attack Simulator used for phishing awareness campaigns List of known Akamai IP ranges LIST OF KNOWN GOOGLEBOT IP RANGES

Thanks

[adulau]

We might update the warning list for format to add the source url as providers tend to change those very often...

[sustefil]

That would be nice, to provide the source for the warning lists (e.g. in description), I could create some of the generate scripts and contribute them to the repo :)

Some of the WL where the source (and the generate script) is missing:

LIST OF KNOWN BANK DOMAINS LIST OF KNOWN GOOGLE DOMAINS LIST OF KNOWN OFFICE 365 ATTACK SIMULATOR USED FOR PHISHING AWARENESS CAMPAIGNS LIST OF KNOWN OFFICE 365 URLS AND IP ADDRESS RANGES LIST OF KNOWN OFFICE 365 IP ADDRESS RANGES IN CHINA LIST OF KNOWN SINKHOLES LIST OF KNOWN AKAMAI IP RANGES LIST OF KNOWN DOMAINS USED BY AUTOMATED MALWARE ANALYSIS SERVICES & SECURITY VENDORS LIST OF KNOWN MICROSOFT DOMAINS LIST OF KNOWN SECURITY PROVIDERS/VENDORS BLOG DOMAIN LIST OF KNOWN URL SHORTENERS DOMAINS