:443 in domain name of hosts/win10/spy.txt

[rgctoo]

Jan 27 18:54:20 xxx named[21230]: redir2null.zone:16: telemetry.appex.bing.net**:443**: bad owner name (check-names)
Jan 27 18:54:20 xxx named[21230]: zone telemetry.appex.bing.net:443/IN: loading from master file redir2null.zone failed: bad owner name (check-names)
Jan 27 18:54:20 xxx named[21230]: zone telemetry.appex.bing.net:443/IN: not loaded due to errors.
---------------------
btw: a small contribution
----------------------
#!/bin/bash
#######################################
## cvHosts2Bind+Snort.sh
#######################################
# small script to convert hosts-files
# to BIND-DNS zones and SNORT rules
#######################################
for sf in `find data/hosts -name spy.txt`;do
  sed -ne '/^0\.0\.0\.0/s/^0\.0\.0\.0 //p' $sf
done|sort -u >MS-SpyDomains.txt

sed -ne 's@\(.*$\)@zone "\1" {type master; file "redir2null.zone";};@p' MS-SpyDomains.txt >MS-SpyDomains.zones

let SID=1000501
for DOM in `grep -v '^#' MS-SpyDomains.txt` ;do
  echo -n 'alert udp $HOME_NET any -> any 53 (msg:"WSB: MS Spy DNS lookup for '$DOM'"; content:"'
  until [ "$DOM" == "$dom" ];do
    dom=${DOM%%.*}; DOM=${DOM#*.}
    printf "|%02x|$dom" ${#dom}
  done
  echo '|00|"; offset:12;fast_pattern; nocase; threshold: type limit, track by_src, seconds 60, count 1; classtype:policy-violation; sid:'$SID'; rev:1;)'
  let SID++
done >MS-SpyDomains.rules
----------------------------------------
---------- redir2null.zone ----------
; This zone will kill all traffic to a listed domain
;
$TTL    86400   ; one day
@       IN      SOA     ns.xxx.bogus. xxx.bogus. (
                          1
                          28800   ; refresh  8 hours
                          7200    ; retry    2 hours
                          864000  ; expire  10 days
                          86400 ) ; min ttl  1 day
                NS      ns.xxx.bogus.
                A	0.0.0.0
*       IN      A       0.0.0.0

[crazy-max]

Hi @rgctoo, can you reformat your issue, it's pretty ugly 🙃
And also give some explanations. Thanks

[Atavic]

Apparently he got error:
telemetry.appex.bing.net**:443**: bad owner name (check-names)... not loaded

He then gives a small contribution script:

#!/bin/bash
#######################################
## cvHosts2Bind+Snort.sh
#######################################
# small script to convert hosts-files
# to BIND-DNS zones and SNORT rules
#######################################
for sf in `find data/hosts -name spy.txt`;do
  sed -ne '/^0\.0\.0\.0/s/^0\.0\.0\.0 //p' $sf
done|sort -u >MS-SpyDomains.txt

sed -ne 's@\(.*$\)@zone "\1" {type master; file "redir2null.zone";};@p' MS-SpyDomains.txt >MS-SpyDomains.zones

let SID=1000501
for DOM in `grep -v '^#' MS-SpyDomains.txt` ;do
  echo -n 'alert udp $HOME_NET any -> any 53 (msg:"WSB: MS Spy DNS lookup for '$DOM'"; content:"'
  until [ "$DOM" == "$dom" ];do
    dom=${DOM%%.*}; DOM=${DOM#*.}
    printf "|%02x|$dom" ${#dom}
  done
  echo '|00|"; offset:12;fast_pattern; nocase; threshold: type limit, track by_src, seconds 60, count 1; classtype:policy-violation; sid:'$SID'; rev:1;)'
  let SID++
done >MS-SpyDomains.rules

named (Bind executable) got the aforementioned error while reading redir2null.zone

[Atavic]

telemetry.appex.bing.net443

I meant to expose the error in bold, but I failed. He gets :443 appended but he doesn't need it.

[crazy-max]

@rgctoo This entry has been removed