What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Discussion

Malware Domain Blocklist - archive

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Post #1 last edited
FYI…

DNS-BH – Malware Domain Blocklist
- http://www.malwaredomains.com/
March 10, 2010 - "250+ Fraud, neosploit, Domains, zeus, exploit domains to block…"

- http://www.malwaredomains.com/wordpress/?page_id=2
The DNS-BH project creates and maintains a listing of domains that are known to be used to propagate malware and spyware. This project creates the Bind and Windows zone files required to serve fake replies to localhost for any requests to these, thus preventing many spyware installs and reporting.

This list is also available in AdBlock and ISA Format…"

To install the AdblockPlus extension in Firefox, click here:
- https://addons.mozilla.org/en-US/firefox/addon/1865

- http://www.youtube.com/watch?v=oNvb2SjVjjI

Blocking malicious sites with Adblock Plus
- http://adblockplus.org/blog/blocking-malic…th-adblock-plus
"… another layer of protection…"
Scroll down to: "… click here to subscribe to the list in Adblock Plus…" and click on the link - click OK to the popup for "Add subscription" - done.
___

- http://news.cnet.com/8301-27080_3-10466753-245.html
"WhitePages.com has stopped ad networks from delivering ads to its site after they were found to contain fake antivirus malware…"

:ph34r:

FYI…

- http://www.malwaredomains.com/wordpress/?p=880
March 13, 2010 - "151 new domains from www.malwareurl.com, malc0de.com, ddanchev.blogspot.com, safeweb.norton.com and others"

:ph34r:

FYI…

- http://www.malwaredomains.com/wordpress/?p=886
March 17, 2010 - "217 new domains associated with rogue antivirus, fastflux, trojan, iframes, botnets, etc. Souces include secuboxlabs.fr, malwaredomainlist.com, ddanchev.blogspot.com…"

:ph34r:

FYI…

- http://www.malwaredomains.com/wordpress/?p=889
March 20, 2010 - "201 new domains to block. Sources include ddanchev.blogspot.com, blogs.paretologic.com, support.clean-mx.de…"

:ph34r:

FYI…

- http://www.malwaredomains.com/wordpress/?p=892
March 24, 2010 - "160 new domains flagged as drive-by downloads, scareware, zeus, and harmful by malc0de.com, jsunpack.jeek.org, malwareint.blogspot.com and others…"

:ph34r:

FYI…

- http://www.malwaredomains.com/wordpress/?p=896
March 27, 2010 - "173 new domains to add to your shunlist and blocklist… Sources: www.malwareurl.com, malc0de.com, phil-secu.over-blog.net and others.."

:ph34r:

FYI…

Blackhole DNS Update – 196 new domains
- http://www.malwaredomains.com/wordpress/?p=901
March 30, 2010 - "Sources include securehomenetwork.blogspot.com, zeustracker.abuse.ch, ddanchev.blogspot.com…"

:ph34r:

FYI…

- http://www.malwaredomains.com/wordpress/?p=909
April 5, 2010 - "… 300 new domains have been added. Sources: support.clean-mx.de, www.freepcsecurity.co.uk, www.malwareurl.com, and others…"

:ph34r:

FYI…

- http://www.malwaredomains.com/wordpress/?p=911
April 8, 2010 - "Added 210 koobface domains and 53 other domains associated with malicious activity. Sources: www.malwareurl.com, www.malwaredomainlist.com, secuboxlabs.fr, and others…"

:ph34r:

FYI…

- http://www.malwaredomains.com/wordpress/?p=919
April 11, 2010 - "230 domains to add to your malware blocklist or malware domain sinkhole…"

:ph34r:

FYI…

- http://www.malwaredomains.com/wordpress/?p=924
April 14, 2010 - "261 domains to block or redirect to your sinkhole. Sources include malc0de.com, support.clean-mx.de, and secuboxlabs.fr…"

:ph34r:

FYI…

Big Update: gumblar domains, rbn domains, trojan domains and more
- http://www.malwaredomains.com/wordpress/?p=933
April 16, 2010 - "Over 300 domains associated with the RBN, gumblar, trojans, as well as domains associated with fraud. Sources include defintel.blogspot.com, emergingthreats.net, krebsonsecurity.com…"

:ph34r:

FYI…

MalwareDomains updated - 2010.04.19…
- http://www.malwaredomains.com/wordpress/?p=938
April 19, 2010 - "… quick update, mainly of the domains mentioned earlier…
xfgkddya .cn, yesoc .in, yetanotherguitarsite .com, bitapardaz .net, crystaldesignlab .com, excellentblener .ru, binglbalts .com, corpadsinc .com, fourkingssports .com, mauiexperts .com, mauisportsinsider .com, 4238789324 .com"

Urgent additions
- http://www.malwaredomains.com/wordpress/?p=935
April 18, 2010 - "… the following domains are blocked or blacklisted:
binglbalts . com, corpadsinc .com, fourkingssports .com, networkads .net, mainnetsoll .com
sources: http://ddanchev.blogspot.com/2010/04/disse…compromise.html , http://isc.sans.org/diary.html?storyid=8647 ."

:ph34r:

FYI…

Blackhole DNS Update
- http://www.malwaredomains.com/wordpress/?p=940
April 20, 2010 - "Sources: wepawet.cs.ucsb.edu, malc0de.com, jsunpack.jeek.org, ddanchev.blogspot.com and others…"

:ph34r:

FYI…

Many fastflux and rogue domains
- http://www.malwaredomains.com/wordpress/?p=946
April 24, 2010 - "Sources include www.malwareurl.com, www.siteadvisor.com, www.malwaredomainlist.com…"

:ph34r:
Post #5 last edited
FYI…

Important additions…
- http://www.malwaredomains.com/wordpress/?p=955
May 5, 2010 - "…Please block the following ASAP:
thejustb. com
grepad. com
ginopost. com
Sources:
- http://blog.scansafe.com/journal/2010/5/4/…iche-sites.html

- http://isc.sans.org/diary.html?storyid=8740

- http://ddanchev.blogspot.com/2010/05/us-tr…-linked-to.html …"
___

- http://google.com/safebrowsing/diagnostic?site=thejustb.com/
"… suspicious content was found on this site… on 2010-05-04. Malicious software includes 1 exploit(s)…" - Country: UA
- http://google.com/safebrowsing/diagnostic?site=ginopost.com/
"… suspicious content was found on this site… on 2010-04-26. Malicious software includes 6 exploit(s), 5 trojan(s)…" - Country: UA
- http://google.com/safebrowsing/diagnostic?site=grepad.com/
"… suspicious content was found on this site…. on 2010-04-28. Malicious software includes 15 exploit(s), 9 trojan(s)…" - Country: UA

:ph34r: :ph34r:
Post #9 last edited
FYI…

Update: koobface,fastflux,zbot,zeus domains
- http://www.malwaredomains.com/wordpress/?p=976
May 23, 2010 - "Over 250 new domains associated with zbot, zeus,torpig,neosploit, koobface and other maliciousness. Sources include ddanchev.blogspot.com, atlas.arbor.net/summary/fastflux, www.malc0de.com, zeustracker.abuse.ch…"

- http://atlas.arbor.net/summary/fastflux
"… Currently monitoring 226 active fastflux domains…"

- http://www.malwaredomains.com/wordpress/?p=979
May 24, 2010 - "trendsecure.com is incorrectly listed and has been removed. Please remove from your blocklists ASAP."

:ph34r:
Post #14 last edited
FYI…

Urgent Block: credittreport-dot-info Clickjacking Attacks
- http://www.malwaredomains.com/wordpress/?p=1003
June 2, 2010 - "There has been an outbreak of clickjacking attacks on Facebook’s “Like” plugin. The target domain associated with the hidden iframe is credittreport. info. Please block that domain ASAP. Source:
- http://isc.sans.org/diary.html?storyid=8893
Last Updated: 2010-06-02 19:08:01 UTC

:ph34r: :ph34r: