DNS-BH – Malware Domain Blocklist

dajia789 (dot) com	himan (dot) opendns (dot) be
ieatironx (dot) weedns (dot) com	ko (dot) dd (dot) blueline (dot) be
mymusicband (dot) weedns (dot) com	mymusics (dot) dnip (dot) net
myphone3 (dot) dnip (dot) net	myphonenumber (dot) weedns (dot) com
xphon3 (dot) opendns (dot) be	pvgadget (dot) com
quinquecahue (dot) com	removal-tool (dot) com
p4n33123e (dot) dd (dot) blueline (dot) be

Help fight spyware: Join the Spyware Listening Post!

Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files

BOOT file is in MS DNS format
spywaredomains.zones file is in BIND Server format
domains.txt file is the complete list along with original reference

A nice resource to learn more about spam is spamtrackers. Their wiki is extremely informative and updated several times a day.

DISOG has a list of over 400 pharmacy related sites, many of which are using 5 minute TTL’s with multiple A records (characteristic of fast-flux). A local copy is  here.

Added the following domains:

alwaysproxy2 (dot) info	getanews (dot) info
goldwindos2000 (dot) com	jornalmomento (dot) com (dot) br
key32 (dot) com	mail (dot) lightsut (dot) com
p2passion (dot) com	pheedo (dot) com
q83000 (dot) com	regfixit (dot) com
registrycleanerxp (dot) com	rimvoyeur (dot) ru
sogou (dot) com	theinstalls (dot) com
theinstalls (dot) net	xbytex (dot) com (dot) ar
xxxy (dot) info

Help fight spyware: Join the Spyware Listening Post!

Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files

BOOT file is in MS DNS format
spywaredomains.zones file is in BIND Server format
domains.txt file is the complete list along with original reference

Matt at Emergingthreats.net reports that www (dot) theinstalls (dot) net is a “one stop” spyware downloader. He’s created some new snort signatures to detect it. Domain will be added on the next update, but you may not wish to wait…

Added the following:

0fish (dot) cn	1.ads555 (dot) com
171817 (dot) com	1987324 (dot) com
34portal (dot) cn	123.wwwwool (dot) cn
6njaga (dot) com	akamahi (dot) net
b8591 (dot) com	brbody (dot) info
newbieadguide (dot) com	performanceoptimizer (dot) com
polanddreams (dot) com	stlinx (dot) info
thetechnorati (dot) com	vozemiliogaranon (dot) com
webmovies-a (dot) com	websoft-b (dot) com
xakepy (dot) cn

Help fight spyware: Join the Spyware Listening Post!

Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files

BOOT file is in MS DNS format
spywaredomains.zones file is in BIND Server format
domains.txt file is the complete list along with original reference

Removed ya.ru and sytes.net.

ya.ru seems to be a search engine that malware uses in some way. It is showing up in some sandboxes.

sytes.net seems to be dynamic dns company.

If anyone has any more info about the above domains, please contact me.

Note: A lot of malware uses dynamic dns and forwarders. To avoid being placed on any blacklists (such as this one), please consider registering your own domain.

Webhelper has recently updated his CoolWebSearch Master List. All CoolWebSearch domains will be removed and recertified in the coming weeks.

Domains to block (DO NOT VISIT):

31joy.com	3332210.net
333292.com	33391.net
99391.net	alwaysproxy.info
antispywareboss.com	ibank-halifax.com
lt8818.com	nadnadzzz.info
pasengewood.com	we168.org

Help fight spyware: Join the Spyware Listening Post!

Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files

BOOT file is in MS DNS format
spywaredomains.zones file is in BIND Server format
domains.txt file is the complete list along with original reference