collectiveintel/cif-smrt-rules — pull request #9 by delorenzo (2013-06-07 21:30:16+00:00)
Title: added dshield.cfg

[ipascii] is a list of the top 500 source ips in ascii format
[whitelist] is a short list of known-good domains
[suspiciousdomains] is a list of suspicious domains with few false positives

dshield also has a recommended blocklist, but unfortunately the format of the feed is bad.