DNS-BH – Malware Domain Blocklist

Domains containing exploits, fake antivirus domains, fake e-cards, and other nasties you don’t want visiting you or your user’s browsers. Sources include www.shadowserver.org, isc.sans.org, ilion.blog47.fc2.com, and others:

1ku .cn	slllnmb .cn
252623 .cn	sllmnmb .cn
517wyt .com	sllonmb .cn
633r .com	sllpnmb .cn
927 .bigwww .com	sllqnmb .cn
abcrot .cn	sllrnmb .cn
baiduyuxire .cn	sothink1 .cn
baiduyuxirebn .cn	sothink10 .cn
buxhere .com	sothink2 .cn
c66b .cn	sothink3 .cn
c66d .cn	sothink4 .cn
c66g .cn	sothink5 .cn
cawjb .com	sothink6 .cn
wd2a .cn	sothink7 .cn
cookie7 .cn	sothink8 .cn
cpfthlb .kki .cn	sothink9 .cn
cznutchuei .cn	spyadvanced .com
dmc .hb .cn	spywarecommander .com
dxwyt1 .com	spywaredeluxe .com
entmba .com	spywareremoversite .com
exgif .com	superchristmasday .com
weweif .com	superchristmaslights .com
flippibi .com	chchina-jinpin .com
foggamtwe .com	federalservicesinfo .com
golfinau .com	worldvedrcoo .com
h3hs4 .cn	wrmfwh .cn
iiegf .com	wrmfwl .cn
jcl-0006 .cn	wrmfwo .cn
jcl-0007 .cn	wrmfwp .cn
justbt1 .cn	yourchristmaslights .com
justcctv6 .cn	zjz-001 .com
kkkkppp .cn	zjz-002 .com
mba .beisen .com	zjz-003 .com
mcuve .cn	zjz-004 .com
mm .hacker315 .cn	zjz-aaa .cn
mysteryfcm .co .uk	zjz-bbb .cn
myvirusguardian .com	zjz-ccc .cn
netsecuritybureau .com	zjz-ddd .cn
ok16899 .cn	zjz-eee .cn
pinakola .com	zjz-fff .cn
ptxk .com	zjz-ggg .cn
sllaqsb .cn	sexy-celeb-photos .com
sllbqsb .cn	s .ardoshanghai .com
slldqsb .cn	zziyuan .com
slleqsb .cn	registryadvance .com
sllfqsb .cn	registryassistant .com
sllgqsb .cn	registrydebug .com
sllhqsb .cn	registryfixup .com
slliqsb .cn	repocarfinder .com
sllknmb .cn	reversednscheck .com
zjz-hhh .cn	reverseipsearch .com
zjz-iii .cn

---

Contact us if you want to help us keep the Malware Domain Blocklist current.
Read this page if you want to report a false positive.
Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format. spywaredomains.zones file is in BIND format.Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

Over 3000 domains which have been delisted over the years have been moved to a file called “delisted.txt“.

Over 7000 domains from www.webhelper4u .com and  www.spywareinfo .com, which no longer exist,  have been removed. These domains have been moved to a file called “cws-removed-domains.txt”

Webhelper’s latest list (http://webhelper4u.net/whmembers/index.htm)  will be uploaded in the next update.

The next update will remove all domains referenced bywebhelper4u .com and www.spywareinfo .com as those lists no longer exist.

In addition, sites which have been delisted will be removed from the main domains.txt file and moved to a new “delisted.txt” file.

Then we will load up webhelper’s latest list (http://webhelper4u.net/whmembers/index.htm)

Finally, the list will be resorted the order of which the domains were added.

Lots of rogue antivirus domains, asprox domains, phishing domains, exploit domains, and other domains you don’t want your users visiting. Sources include malwaredomainlist.com, malwaredatabase.net, safeweb.norton.com, dnsbl.abuse.ch, and others.   We appreciate the service these sites are providing:

00119922 com	advertisercash com
18978 com cn	adwarecommander com
240av cn	adwarepatrol com
6680 cc	anotherdnserrorz com
91131 org	antiamenazas com
ach org il	antispamassistant com
addetect com	antispambastion com
adsniffer com	antispamgold com
ave2 cn	antispyadvanced com
ave3 cn	antispyware-scanner-free com
aresdeluxe com	antispywarexp com
adwareplatinum com	antivirusprogramsite com
adwareremover ws	antivirusprotectorsite com
adwaresafety com	antiviruswebsite com
adwaretools com	aresdownloadnow com
alertspy com	av-scan-pc-tools net
bassamtwe com	buymsantispyware2009com
bbs abvc cn	cheapdecember com
bigsellstaff cn	cntotalizator cn
bnmd kz	detectiveadvanced com
clrtemp cz	detectivehound com
cashpopup net	directchristmasgift com
cch2 cn	doctoradwarepro com
ccswzx6 cn	download-all4free com
ccswzx7 cn	download-best-antivirus2010 info
chhuslfffu com	livechristmasgift com
clickomania biz	fronthomepagez com
dft6s kz	msas2009storage com
gfksamtwe com	vidzsolution com
kefjwfev cn	privacy-care com
korienado com	qualitaetips com
lepr info	rec bestrevenue net
light-player net	rikora com
lite-corp com	scan-onlinefreee com
lqir6s2eo com	scanonlinefreee com
mega-player net	newyearclassmates com
membersphoto com	windowsplaeyraddons com
vhxfbwft com	thebestantivirus axspace com
msas2009dl com	online-spyware-detector com
mtno ru	msantispyware2009 com
myspacy biz	myprivatetubes09 net
wmpd ru	netdigitalsecurity com
netisecurity com	pok shopvideofest cn
ttfafa com	soft4youupdat org
nvepe ru	sp2 information com
uhjnxredc com	xhcqxdedc com
wuxiawu com	yourdecember com
pop yandex2 cn

---

Contact us if you want to help us keep the Malware Domain Blocklist current.
Read this page if you want to report a false positive.
Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format. spywaredomains.zones file is in BIND format.  Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

List cleanup continues… 300 domains have been delisted. Please update your files. Diff files are located in the www.malwaredomains.com/files folder.

www.freedownloadsarchive.com has been delisted. Please update your blocklists.

Sources:www.shadowserver.org, www.malwaredomainlist.com,     safebrowsing.clients.google.com, and others. Includes fake codecs, rogue antispyware, ie7 exploit domains, and other bad stuff you want to shun:

helpdown .cn	384756783900 .cn
ho0k .com	4ourtraff .com
iuwei .com	4s3w .cn
jgkdofjggkjlh .com	517891 .cn
karasing .cn	netsecuritytech .com
lianrong .com .cn	6dsoft .cn
lyox-lib .com	7speed .info
mianfei58 .cn	akademikerzeitung .ch
zwzj .com	antispywerepro .com
obfuscated .name	antivirusrapid-scanner .com
egypt-shop .cn	b81 .8800 .org
qs-s .nm .ru	s0ftvvareportal08 .com
c66f .cn	trustedsoftportal2008 .com
c66i .cn	s0ftvvareportal .com
ccol365 .com	cleansoftportal2009 .com
h3x .info	comefood .com
ftalyl .cn	securedownloaddirect .com
ffseik .com	dirty-boy .cn
dingli .net	doubleluck .com .cn
spcounter .info	downloads777 .com
ssy1688 .cn	opkfgpkogokofdg .net
steoo .com	googl-analisys .com
h3x .info	gotest2 .iirs .net
uploadeservers .com	softportalforfun08 .com
ustechservic .com .cn	softportalforfun2008 .com
5traff .cn	softvvareportal08 .com
wieyou .com	softvvareportal2008 .com
yhgames .com	webexperience13 .com

---

Contact us if you want to help us keep the Malware Domain Blocklist current.
Read this page if you want to report a false positive.
Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format. spywaredomains.zones file is in BIND format.Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

shadowserver seems to have the most updated domain list. List seems to be growing, so check their site often. Block those evil domains ASAP!!!

qqqqttrr .cn	09021030408721 .cn
17gamo .com	lookfornewsoftware .com
360avva .akvvv .cn	zlwrnm1 .cn
baidu-du1 .cn	zlwrnm10 .cn
baidu-du2 .cn	zlwrnm11 .cn
baidu-du3 .cn	zlwrnm12 .cn
baidu-du4 .cn	zlwrnm13 .cn
baidu-du5 .cn	zlwrnm14 .cn
baidu-du6 .cn	zlwrnm15 .cn
baidu-du7 .cn	zlwrnm16 .cn
baidu-du8 .cn	zlwrnm17 .cn
baidu-du9 .cn	zlwrnm18 .cn
bbtu01 .cn	zlwrnm19 .cn
bbtu02 .cn	zlwrnm2 .cn
bbtu03 .cn	zlwrnm20 .cn
bbtu04 .cn	zlwrnm3 .cn
bbtu05 .cn	zlwrnm4 .cn
bbtu06 .cn	zlwrnm5 .cn
bbtu07 .cn	zlwrnm6 .cn
fyesn .cn	zlwrnm7 .cn
hhhh8886 .cn	zlwrnm8 .cn
rrrrrrryyy .cn	kukuzhmuku .com

Many domains associated with malware you shouldn’t invite in your network. Some are associated with “0-Day” unpatched microsoft exploits.. Sources include  www.malwaredomainlist.com, xanalysis.blogspot.com, ilion.blog47.fc2.com, www.abuse.ch, and others:

50nb .com	zgynkmv .cn
84ws .cn	zgynkmt .cn
8e9 .net	zx5fxluya .com
ad-adnet .net	zssotke .edu .sk
adk2lev .com	cc4y7 .cn
adnetserver .net	cc4y8 .cn
ameks .net	cc4y9 .cn
avse2 .cn	celebs4you-online .com
baidu-baidudou1 .cn	childrenlaughusual .com
baidu-baidudou2 .cn	cre4 .cn
baidu-baidudou3 .cn	d425 .cn
baidu-baidudou4 .cn	d46g .cn
baidu-baidudou5 .cn	d5d3 .cn
baidu-baidudou6 .cn	do2a .cn
baidu-baidudou7 .cn	doublered .info
baidu-baiduxin1 .cn	download-top-software .net
baidu-baiduxin2 .cn	downloadforupdates .com
baidu-baiduxin3 .cn	dream-ads .eu
baidu-baiduxin4 .cn	empresalda .com
baidu-baiduxin6 .cn	erabl-pict .com
baidu-baiduxin7 .cn	firefox-lab .net
baidu-baiduxin8 .cn	gd3w .cn
baidu-baiduxin9 .cn	gfdsgf333 .com
baidu-baiduyi .cn	gknf21 .net
baidu-baiduzi1 .cn	go-go-cash .com
baidu-baiduzi2 .cn	googlesyndixation .cn
baidu-baiduzi3 .cn	hot-sexpt .com
baidu-baiduzi4 .cn	ico6 .cn
baidu-baiduzi5 .cn	jha2 .cn
baidu-baiduzi6 .cn	jmrlmgg .cn
baidu-baiduzi7 .cn	ko109 .cn
baidu-baiduzi8 .cn	ko113 .cn
baidu-dudouai1 .cn	ko115 .cn
baidu-dudouai10 .cn	mekiller .com
baidu-dudouai2 .cn	mysy8 .com
baidu-dudouai3 .cn	nan7 .cn
baidu-dudouai4 .cn	oiuytr .net
baidu-dudouai5 .cn	pay-per-install .org
baidu-dudouai6 .cn	r43w .cn
baidu-dudouai7 .cn	rzenter .cn
baidu-dudouai8 .cn	schoolswitzerland .com
baidu-dudouai9 .cn	sllwbd1 .cn
bigimagecatalogue .com	sllwbd10 .cn
bizcn .com	sllwbd2 .cn
buyanydream .biz	sllwbd3 .cn
c56f .cn	sllwbd4 .cn
cc4y0 .cn	sllwbd5 .cn
cc4y1 .cn	sllwbd6 .cn
cc4y2 .cn	sllwbd7 .cn
cc4y3 .cn	sllwbd9 .cn
cc4y4 .cn	sllwrnm1 .cn
cc4y5 .cn	sllwrnm10 .cn
cc4y6 .cn	switzerlandgirl .eu
sllwrnm2 .cn	switzerlandpussy .eu
sllwrnm4 .cn	vvexe .com
sllwrnm5 .cn	wwwwyyyyy .cn
sllwrnm6 .cn	zghncsa .cn
sllwrnm7 .cn	zghncsb .cn
sllwrnm8 .cn	zghncsc .cn
sllwrnm9 .cn	zghncsd .cn
zghncsg .cn	zghncse .cn
zghncsh .cn	zghncsf .cn
zghncsi .cn	zghncsx .cn
zghncsj .cn	zghncsy .cn
zghncsk .cn	zghncsz .cn
zghncsl .cn	zgynkma .cn
zghncsm .cn	zgynkmb .cn
zghncsn .cn	zgynkmc .cn
zghncso .cn	zgynkme .cn
zghncsp .cn	zgynkmf .cn
zghncsq .cn	zgynkmg .cn
zghncsr .cn	zgynkmh .cn
zghncss .cn	zgynkmi .cn
zghncst .cn	zgynkmj .cn
zghncsu .cn	zgynkmk .cn
zghncsv .cn	zgynkml .cn
zghncsw .cn	zgynkmm .cn
zgynkmw .cn	zgynkmn .cn
zgynkmx .cn	zgynkmo .cn
zgynkmz .cn	zgynkmp .cn
zlkon .lv	zgynkmq .cn
zoomovies .org	zgynkmr .cn

---

Contact us if you want to help us keep the Malware Domain Blocklist current.
Read this page if you want to report a false positive.
Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format. spywaredomains.zones file is in BIND format.Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…