DNS-BH – Malware Domain Blocklist

rogue security sites, fake porntube, asprox, and more. Sources: sunbeltblog.blogspot.com, www.threatexpert.com, malwaredatabase.net, and others:

0query .name	ahomepagepark .com
12cfm .tv	asecurenotification .com
2redir .co .uk	brassnuts-brassbolts .com
30area .ru	columnacafenegro .com
34java .in	decomarmolcuenca .es
4log-in .ru	defendmycreditunion .org
53refer .ru	danacompany .ru
74path .gs	ddellywwear .com
75main .jp	easyconsultingltd .com
a311 .ru	fauteuils-massage .fr
ahleinaks .ru	fincaschicote .com
bordak .izi .su	folder7 .be
ang42 .ru	free-6-fuck .info
apps59 .us	freedom2mind .cn
comtaple .net	garagentore-frawia .de
asembli .com	granadapadel .com
bilbobalbo .biz	granjasdongil .com .mx
bitmaker .us	hallenfussballfestival .de
counthum .info	internet-systems .info
cxdgl .com	howtoiexplorer .com
burjuyam .net	ietoolsupdate .com
chk06 .ru	mobilecontact .com
d3m00n .net	momoelectronic .com
daka .hr	moviendola .com
deltauk .info	neisen .ema .lv
dmatca6 .org	netcfg9 .ru
domain12 .net	nitro-zmei .cn
domain31 .ru	noisedetection .cn
driver95 .ru	protectiontoolbars .com
drudka .info	scdesktopicons .com
ecapeskcab .com	whyisdnserror .com
ejeg .biz	lastchronicle .com
errghr .ru	mailzz .net
irq0 .mn	mazahacka .org
geoteam .sk	medialibsms .com
gerosname .cn	jorgelopezdj .com
gonzoltd .com	labelfreak .com
good412 .com	lang42 .ru
greatzus .net	gaudihouse .com
handballfondi .it	jhgpq .com
iliili .zslogs .info	jngrn .biz
indiborge .tv

---

Contact us if you want to help us keep the Malware Blocklist current.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format
spywaredomains.zones file is in BIND format
Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

rogue antivirus sites, asprox, trojans, and other nasties. Sources: ddanchev.blogspot.com, ddanchev.blogspot.com, hosts-file.net, and others:

av2010 .net	righthandup .org
livesoftsupport .com	rocktheads .com
lopiures3713 .com	mistikotitatuipologisti .com
servposte .net	sabpolies .com
spoti .us	sanaltahrip .org
megatradetds0 .com	secureclick1 .com
megsrdomain .cn	seopharmacy .com
minnesparere .com	medicineonlinestore .com
rsspnet .ru	simplefreedns .com
mjkm .ru	sittinghereona .com
mobposte .net	slrvip .com
mode85 .cc	smenposte .us
ssl63 .name	softwaretitle .com
mypharmshop .com	sornor .biz
nameself .com	spbpolveni .us
nebattoti .com	megantivirus2009 .com
nefrti .com	spyware-buy .com
nevpost .com	spywareinvader .com
ninjtz .com	pcprivacycleanerpro .com
nmli .ru	passwordinspector .com
nslposte .net	oczyszczaczkomputerza .com
sslid8 .bz	online-malwarescanner .com
okla .ru	sslpostedll .com
tfsol .org	prettyblondywoman .com
sslnet6 .ws	sslweb9 .us
sslcom6 .tk	startdedicated .com
ospetroglifos .com	startwarez .com
page73 .be	onine-antivirus-09 .com
stub12 .mobi	multibrand-shop .com
suvcnt .com	t-online .hu
pctv4me .com	onlinexpsecurity .com
pctv4u .com	the-format .cn
peposte .us	totaltorture .com
pharmacy-eur .com	pharmacyeshop .com
trap17 .com	reparateurdesysteme .com
picaposte .net	trustedpaymenssite .com
pljfo .com	uk-web-hosting-services .net
podavanda .cn	ultimate-anti-virus .com
popadprovider .com	un-secret .com
postecit .com	unitycard .net
posteonline .us	x-muiste .com
postepsoe .com	winupdates-server .com
uzrwvzfe .com	vadino .com
prevedmarketing .com	vcdrwyia .com
qualitypictures .net	videovideoiditenah .com
r2d2adverising .com	virtualbambiland .com
regtime .net	volchara .cn
reinviadati .us	xp-antispyware-2009 .com
traffalo .com	xp-as-2009 .com
revohosting .com	web-checkout1 .com
uusee .com	web-help247 .com
sslput3 .cc	xp-antispyware2009 .com
vrtjl .com	xpantispyware-2009 .com
vtrs .us	yourgamblingzone .com
xuixui .net	youpornzztube .com
xxxgra .biz	xpas2009 .com
xpprotector .net	zappinads .com
yjytuv .net

---

Contact us if you want to help us keep the Malware Blocklist current.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format
spywaredomains.zones file is in BIND format
Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

 A bunch of asprox domains, some trojans, and other nasties. Sources include www.abuse.ch, ddanchev.blogspot.com, www.matchent.com:

23html .ca	fluxmarketing .net
30plusbill .com	fluxnewsletter .net
34hit .us	fluxpay .com
37id .tv	fluxpay .net
38lang .tk	form64 .tk
47sid .co .uk	ftp5 .name
4stream .tw	fulldownloadcrack .info
6func .gs	furely .ru
7func .ca	fuxads .com
7get .tv	gavai-pegc9 .ws
7hex .in	gdi24 .tw
7stat .in	get31 .us
84type .net	giftsforzips .com
8frame .in	go93 .name
8host .jp	gradul .ru
9hostid .cc	grtsg .us
9store .ca	hedym .ru
acthkqyzex .com	hex72 .me
anti-virus-pro .org	hit12 .tv
antispyalerts .com	hiwmjqsn .com
artella .biz	hnjzluwh .com
baran-eblan .info	host15 .tw
bcrrfwygup .net	hosting-4 .ru
bdydcketn .com	hq-pharmacy1 .com
bestrezult .com	hq-pharmacy2 .com
bestsearch3 .com	http76 .bz
blyapizdets .info	ilookgoodpale .com
c88a .cn	inac .com
cid74 .in	internetserviceteam .com
dnsba .com	inviadati .com
fluxbucks .net	jjwky .us
dsredirection .com	joksh .ru
dsxc .ru	justfree .com
kexlup .ru	do-scan-progress .com
ecotopo .com .au	keyclubs .cn
edatamedic .com	klanklan .in
edgmdxtr .com	lipobpolvean .net
errordigger .com	extremeintelligencesoftware .com
everif4sale .org	flucksbucks .net
everifcyber .org	fluxads .net
everifforsale .com	fluxadvertising .net
extrabilling .com	fluxbuck .net
listaz .ru	fluxbucks .com
fluxbux .com	fluxezine .net
filerd .com	easyvideoaccess .com
flucksbuck .com	festplattenreiniger .com
flucksbuck .net

---

Contact us if you want to help us keep the Malware Blocklist current.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format
spywaredomains.zones file is in BIND format
Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

over 70 asprox, rogue security, and other malware sites to add.  Sources: www.matchent.com, www.malwaredomainlist.com, www.siteadvisor.com, and others:

3ntdll .tv	drv68 .tk
4driver .cc	drv9 .mobi
4object .ws	dwnld1 .com
52exe .us	e-antiviruspro .com
5netmsg .cc	eantivirus-payment .com
5offset .bz	nochanceforvirus .com
6domain .bz	nocompromaat .com
7driver .be	almostgayvideo .com
7import .tv	antimalware2009 .com
7ntio .mobi	antimalwareguardpro .com
8encode .be	antispyware .com
8event .ca	bestantivirusscan .com
adwarekiller .net	bestdownloadsoft .com
adwrss .com	evidenceeraserpro .com
alianzaviva .net	ggoocom .com
obj8 .name	google-counter .net
oem61 .co .uk	pcprivacycleaner .com
ole17 .net	pcturbopro .com
pcantispy .com	protectdownloads .com
bar-moscow .ru	securedownloadcenter .com
html3 .tk	spaentri .com
http8 .us	spywareguard .com
icmp5 .bz	inet9 .name
ide72 .ws	meyolev .com
doc62 .name	mitroces .com
doc63 .name	neopingoo .org
drmyy .cn	nesco-online .co .uk
edit7 .us	nesco-online .eu
edit84 .in	bestguardownload .com
ekerberos .com	digipayments-soft .com
en-us3 .us	storageguardsoft .com
en-us9 .tw	vassariumbig .com
err7 .asia	virusremover2008 .com
err83 .mobi	zeprod .ru
esthost .eu	hit15 .mobi
host8 .asia

---

Contact us if you want to help us keep the Malware Blocklist current.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format
spywaredomains.zones file is in BIND format
Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

60+ rogue antivirus, fake security sites, asprox domains.

Sources: sunbeltblog.blogspot.com, ddanchev.blogspot.com, shadowserver.org, and others:

0scanner .com	homesecuresite .com
1o0o1 .com	hotfreexxx .info
anti-spyware11 .com	hotmovies69 .com
anti-spyware4 .com	ienewbar .com
anti-spyware8 .com	ilizium .com
anti-virus-xp .net	km31539 .keymachine .de
krasotki .cn	antimalwarewarrior2009 .com
antispywareinc .org	mega-drugstore .net
antivirus-buy1 .com	mega1search .com
antivirus-cs1 .com	mentoe .ru
antivirus-cs14 .com	mfads .com
antivirus-cs15 .com	mheop .ru
antivirus-cs4 .com	newwmpupdate .com
antivirus-cs5 .com	online-sex-video .com
antivirus-cs8 .com	openmenow .com
ytgw123 .cn	personalantispy .com
seooss .info	pestsweeper .com
bestbloggin .com	pormce .ru
bestbookblog .com	qwertypages .com
besthostdot .com	ratedcontentsite .com
bettasearch .com	realpicmov .com
charitymob .com	secureharley .com
clearcontentsite .com	antivirusfulldefence .com
clearpornurlssite .com	spysoap .com
cnnworld .org	uncensored-p0rn .info
ctiry .ru	ungds .com
deryv .ru	uniqueadult .com
dnserrorview .com	upgrade-your-software .com
euroclubinfo .com	viagrageneric .org
freeantivirus-online .com	west-video-ass .info
xenbv .ru	wmpware .com
yrhfn .com	antivirus2008exp .com

---

Contact us if you want to help us keep the Malware Blocklist current.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format
spywaredomains.zones file is in BIND format
Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

The Internet Storm Center has two important articles:

1. 10 signs you might be compromised, and don’t even know it

2. ASPROX mutant

The asprox domain – ytgw123 (dot) cn is injected using a via a cookie.

A quick search on google  (hxxp://www.google.com/search?q=ytgw123 – don’t click on any results!) reports New York Methodist Hospital, quicklogic, and others are infected.

Domain will be added on the next update, but you  should not wait.

Sources: www.malwaredomainlist.com, www.abuse.ch, sunbeltblog.blogspot.com, www.threatexpert.com, and others.

5foot .org	ieprogramming .com
anti-virus-xp .com	internet-defenses .com
asafetysite .com	life-tablets .cn
av-xp2008 .com	linksondesktop .com
belgius .net	lobanabucks .cn
bhtoesp .com	mediamswares .com
brbg .ru	dadsplace .com .au
cfohello .com .au	mncpssa .org
yanndex .su	moreaccess4me .com
druzg .ru	movsdlls .com
ogjtu .com	mp3dowl .com
errordnsurl .com	ebatkopatnax .ru
evilbots .net	phpnet77 .com
fstat .cn	sobalyaki .net
gfbwd .com	stabroom .cn
mgaazz .com	toolbarunit .com
ha2000 .co .uk	utevox .site90 .com
iebdesp .biz	waysofsecurity .com
yfrresp .com	gmail-security .com

---

Contact us if you want to help us keep the Malware Blocklist current.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format
spywaredomains.zones file is in BIND format
Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

Some asprox, zlob, fake security pages, rogue antivirus domains to add to your blocklist.

Sources:  www.matchent.com, sunbeltblog.blogspot.com, www.dynamoo.com, and others.

---

32ddk .name	homesiteurls .com
3confirm .ws	hqsextube08 .com
3cookie .tv	ierenewals .com
4ssl .bz	int3rn3t-d3f3ns3s .com
4ssl .ws	mnbenio .ru
51com .ru	mnicbre .ru
5jsp .bz	movsdevices .com
64crypt .cc	pkseio .ru
6usa .us	protectnotice .com
73comm .asia	prt3ctionactiv3scan .com
7confirm .gs	secure4 .cc
9control .tk	securealertbar .com
aabb1122 .com	add-block-plus .net
ssl81 .in	eantivirus-payments .com
asp1tw .com	total-secure2009 .com
bank7 .name	urlsofdnserrors .com
conf68 .mobi	user9 .bz
vtg43 .ru	vassariumpromo .com
eufnt .com	vjccc .com
ss11qn .cn	fastshortcuts .com
xbstw .com	wmptools .com

---

Contact us if you want to help us keep the Malware Blocklist current.Domains.txt file is the complete list along with original reference.

Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files

BOOT file is in MS DNS format
spywaredomains.zones file is in BIND format
Also available in AdBlock, ISA, and MaraDNS formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

rogue antivirus domains, asprox, sql injection domains. Sources: malwaredatabase.net, www.emergingthreats.net, www.matchent.com, www.threatexpert.com, and more.

2bank .su	com62 .gen .in
2online .su	dll82 .biz
5asp .su	do18 .mobi
5aspx .ws	enhancedie .com
5bank .su	ex6 .ru
5cfm .cc	getoutdoors .net .au
64asp .ru	hfnvp .com
7asp .su	id92 .bz
800mg .cn	jjyyzmj .cn
8aspx .su	jsp25 .mobi
8com .name	jsp27 .co .uk
aijingru .com	jsp51 .mobi
juc8 .ru	amistypedurl .com
antivironline .com	linkfordesktop .com
zmjjjyy .cn	antivirus-xp-08 .net
asp24 .su	classicmediapl .com
asp28 .eu	observesecure .com
asp62 .biz	pagesuploader .net
asp62 .mobi	prtectionactivescan .com
aspx12 .su	santa-inbox .com
aspx46 .com	smart-antivirus2009v2buy .com
aspx56 .biz	smartantivirus-2009v2buy .com
aspx8 .biz	smartantivirus2009v2-buy .com
bank19 .mobi	smartantivirus2009v2 .com
check9 .biz	smartantivirusv2 .com
locm .ru	spyrix .ru
com45 .su	spyware-quickscan-2008 .com
com51 .su	sweathomepage .com
com52 .co .uk	turkonz .com
net83 .ru	yuiqd .com
gcodecadult2008-17 .com	codec-portal08 .com

---

Contact us if you want to help us keep the Malware Blocklist current.domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format
spywaredomains.zones file is in BIND formatAlso available in AdBlock and ISA formats!
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…