DNS-BH – Malware Domain Blocklist

Source: malekal.com:

293029553 .metago .cn
1tvv .com	3872-3 .yandex2 .cn
a .sw-ww .ws	416085305 .yandex2 .cn
ascopr .net	559565 .metago .cn
avel-m .ru	alink .belstom .ru
azocolz8 .ru	analgize-google .cn
bidwm .info	autolugojana .ro
cashpopup .org	bevabo .site90 .com
comrus .net	business-informs .com
crossred .cn	centerifart .cn
doheth .co .uk	chtest .gooanal .net
durudik6 .cn	crazycraberz .org
dxline .cn	darksidespeed .com
ebanuzza .biz	domainworksite .com
erstesips .com	dornaboret .com
f9i .org	findslocate .com
farus56 .cn	google-anallytics .cn
finkolios .com	hostverify .net
funikuler .cn	imagefolder .us
gamberro .cn	imsmerchantsolutions .site90 .net
gamunkul .com	intervidds .com
ge92 .net	jixeta .site90 .com
gimnow .org	libra .gooanal .net
gt .metago .cn	live-counter .net
hopendaso .com	meteor .gooanal .net
hostingmd2 .cn	mnogodenegdljamenja .name
inject .in	mol4un .firnop .cn
ipaguide .com	mysexydreams .net
ipredator .ru	newjetdevice .com
janen .net	news .gooanal .net
jio1a .biz	newslentarss .ru
jordans0 .cn	newtechwork .com
justurgon .com	obfuscated .spb .ru
keystar .name	pager .site50 .net
kraspa .com	php4php .xtreemhost .com
l2manual .su	plebania .sitehost .pl
lookfor010 .cn	pups .irishset .net
lovekills .ru	romsoftware .cn
nerogiena .com	skycolder .com
nessecur .net	soveroste .com
o6ls .cn	sw .pornwor1d .ru
operative .cc	sweetpornmovie .net
originalcn .cn	telmemobile .org
othok .com	trafficinc .ru
qmems .com .my	tyson .foreturn .net
rbcnew .com	venom .foreturn .net
reddii .ru	veryblomar .com
sexiland .ru	vidzwares .com
skytor .ru	wertionase .com
tobild .cn	wwwhttpinfo .ru
tvbust .com	your-counter .info
unpc .info	youripment .com
vkpleer .com	yoursexportal .org

---

Contact us if you want to help us keep the Malware Domain Blacklist current.
Read this page if you want to report a false positive.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates.
The full files are located at: http://www.malwaredomains.com/files

BOOT file is in MS DNS format.
spywaredomains.zones file is in BIND format.

Also Available in AdBlock, ISA, and MaraDNS formats.
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

Lots of domains associated with Conficker, Waledac,  and fake antivirus removal sites.  A few domains associated with sql injection.  Neuter them all.  Thanks to     www.scanw.com/blog, ddanchev.blogspot.com, www.shadowserver.org, and others for providing this information:

3bomb .com	365zhaosheng .com
51much .com	antispyknight .biz
706sese .cn	antivirus-scan-your-pc .com
allspaces .com	bestantivirusdefence .com
bc-s350 .cn	best-antivirus-defense .com
bengchitt .cn	bestantivirusfastscan .com
bestbarack .com	bestantivirusfastscanner .com
daoye .nm .cn	bestantivirusproscan .com
dbrgf .ru	bestantivirusproscanner .com
dicgdsp .org	best-antivirus-pro-scanner .com
dzxecapiw .info	best-antivirus-protection .com
epwqbyya .com	best-antivirus-scanner .com
expowale .com	bestbaracksite .com
fogzchqe .org	bestobamadirect .com
gkenjj .biz	best-scanner-pc .net
goeasybill .com	cbchyttgqay .biz
gogo2me .net	damnedspyware .com
gpt0 .ru	fastantispywarescan .com
id-rt02 .cz	frankiezfunz .com
iwtrubh .biz	gameproadvance .com
ji88 .com	goldensurvey .com
jobarack .com	goodnewsdigital .com
jvikldgo .net	goodnewsreview .com
kcgxgnny .net	google-analytics .pbtgr .ru
keke03 .cn	googlenations .cn
lijg .ru	googl-status .com
lyhivgkd .org	googol-analisys .com
mefenydz .com	greatbarackguide .com
mfqal .net	greatobamaguide .com
nprzq .biz	greatobamaonline .com
ojzarbw .net	hiromatokoko .biz
pbtgr .ru	internet-antispyware-scan .com
ppkok .cn	internetexamine .com
ppsuite .com	internetprotectedpayments .com
qiweroqw .com	linkworldnews .com
qqqqkkkss .cn	liveantispywarescan .com
rheni .org	live-antispyware-scan .com
rrrrpppkk .cn	live-antiviruspc-scan .com
skyhu .com	nohtingherez .cn
smakata .com	pharmacy-earth .com
syqxvsid .com	premium-advanced-scanner .com
teirkmm .net	proantiviruscomputerscan .com
tejary .net	proantivirusprotection .com
thecountx .net	professional-virus-scan .com
topwale .com	rapidantiviruspcscan .com
ttfabb .com	rapidspywarescanner .com
ukdikl .org	reportradio .com
uzapl .com	securedonlinewebspace .com
vvk5 .cn	securedserverdownload .com
vvk7 .cn	securedupdateupdatesoftware .com
vyuiwltf .com	secure-plus-payments .com
waledirekt .com	softwaresecuredbilling .com
waleonline .com	spacemynews .com
wew2223 .cn	superobamadirect .com
winzxm .com	superobamaonline .com
xskeqrcl .net	thebaracksite .com
xxhdy .net	tyoxnaqjrlu .org
xxztb .org	uqruninkqca .net
yeofa .org	waleprojekt .com
yeynxe .net	wapcitynews .com
yjodeikka .org	worldnewsdot .com
yprpg .biz	worldnewseye .com
ytcqft .com	worldtracknews .com
zzzz6655 .cn

---

Contact us if you want to help us keep the Malware Domain Blacklist current.
Read this page if you want to report a false positive.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates.
The full files are located at: http://www.malwaredomains.com/files

BOOT file is in MS DNS format.
spywaredomains.zones file is in BIND format.

Also Available in AdBlock, ISA, and MaraDNS formats.
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

Note: We added a  comment line in the spywaredomains.zones and BOOT file to denote each addition. Let us know ASAP if this causes a problem.

More  fake antispyware,   exploits, downadup domains to blackhole. Sources include bharath-m-narayan.blogspot.com,    www.threatexpert.com, www.malwaredomainlist.com, and especially www.f-secure.com:

4mcmeta4v .cn	ahryafujpb .com
969696 .ru	apleprodr .com
bdhgvjht .com	av10antivir .com
dvcd .info	bbflvxif .info
dxfvdadx .net	bhbapvilqc .net
eonud .com	cdmusnla .info
ezgcs .com	cntradeshop .com
ezivhnbt .com	dbralauno .com
fc321 .com	ekapharmacy .com
flashya .com	explorerex .com
fripjt .com	ffbnpzthj .info
fwotu .net	frwaqecvqk .info
ggjdty .info	getdownloadmovies .com
hrypbb .info	getlivefootballtv .com
hxvyowd .info	goodboomer .com
ilklkc .net	healthathome18 .cn
iyxuu .net	hhnvxjdms .info
jdnukedc .org	jjydznuzxu .info
kxxqz .net	jrxgtdigb .info
mrrdzwsz .biz	zwedpmoa .info
nmftyate .com	ktfadsqo .info
ocdona .cn	mirxdkbat .com
ocedx .cn .	mkdjqosakje .net
ocegal .cn .	mkfugrbowb .info
ocelect .cn .	nsuzsjrp .info
ocernx .cn .	officerestartupdate .com .
ocextend .cn .	rzowqlvco .com
ocfail .cn .	sp-protect2009 .com
ocfede .cn .	spwprotect2009 .com
oixka .com	spyprotect2009 .com
pitoy .net	spywprotect .com
pvczx .info	spywprotect2009 .com
qbpay .com	steamtubesoftware .com
qowte .com	tqreftcjgzm .info
rofxb .net	vggdbocd .biz
swp2009 .com	vhepxlanj .com
tulux .net	vwmwpcs .info
whtex .com	windowslogonex .com
wvmsa .info	wshazbuck .cn
xzini .com	xhuwvozd .info
zbiqa .com	xjhluwcx .org
zullc .com	ybgcjpnzts .info
jtpigznr .info	yeeollvintx .org

---

---

Contact us if you want to help us keep the Malware Domain Blacklist current.
Read this page if you want to report a false positive.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates

The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format.

spywaredomains.zones file is in BIND format. Also Available in AdBlock, ISA, and MaraDNS formats.
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

Note: We added a  comment line in the spywaredomains.zones and BOOT file to denote each addition. Let us know ASAP if this causes a problem.

More fake codecs, fake antispyware,   and other nasty domains to block. Sources include ddanchev.blogspot.com,     safeweb.norton.com, www.malwaredomainlist.com, and others:

4utraffic .cc	3d-softwareportal .com
aadpw .cn	advancedantivirusscan .com
adteksrv .net	antivir-av-toolz .net
antispyexpert .com	antivirus-secure-scanner .com
anti-vir-toolz .com	av-mc-antivir-checker .com
av-scan-here .net	becollectionoffiles .com
av-scan-soft .net	bestantivirusdefense .com
bobthejoker .info	best-anti-virus-scanner .com
clickandgetfile .com	bestfilesarchive2009 .com
cpi2launo .com	bestmyscanneronilne2 .com
czysgs .com	bestmyscanneronilne3 .com
datainfoplace .com	bestmytubeonilne1 .com
delshikandco .com	bestmytubeonilne2 .com
delshiktds .com	bestmytubeonilne3 .com
download2009exe .com	codecdownload .filesstorage4you .com
downloadexenow .com	crystalfilesarchive .com
dwnld-files .com	downloadallsoft-now .com
dyrzj .com	downloadall-soft-now .com
eastfilm .net	download-files-plus .net
enewwindows .com	downloadfilesportal .com
erhaha2 .cn	downloadfilesservice .com
exefileshere .com	exefileshere2009 .com
exesoftportal .com	extrafilesonlyhere .com
expertcash .com	fast-download-base-free .com
extracoolfiles .com	files-download-arch .net
ezdvdx .com	filesinnet4you2009 .com
fast-xxx-tube .net	filesstorage2009 .com
filesportalhere .com	filesstorage4you .com
har5launo .com	freedownload2009 .com
ifjak .org	freenonline-scanner .com
jetexestorage .com	freenonline-scannera .com
katynude .com	freenonline-scannerw .com
lover-world .name	freepornclips2u .com
netcshow .net	megaporntubesonline .com
pornexearchive .com	my-bestpov-tube .com
pro4scan .com	mybest-pov-tube .com
scan6new .com	pc-anti-virus-scan .com
sextapegirls .net	premiumadvancedscan .com
spcounter .info	privatewebsystemupdate .com
tradingway .net	professional-virus-scanner .com
trustsellers .co .cr	pure-download-new .net
tube-chick .net	quickly-porn-tube .net
tubeger .com	scanner-pc-toolz .net
tube-hu .com	secretfilesstoragehere .com
tube-more-sex .com	softwareportalexefiles .com
uni-tube-911 .com	softwareviewers2009 .com
u-tube-verse .com	stabilityinternetscan .com
vetinc .name	tube-4-free-center .com
viewerarchive .com	tube-free-4-adult .net
virusnuke .com	viewerdownload2009 .com
y6dq .cn	x-filesstorehere .com
zilya-sosal .com	zworksoftware .cn

---

Contact us if you want to help us keep the Malware Domain Blacklist current.
Read this page if you want to report a false positive.

Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates

The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format.

spywaredomains.zones file is in BIND format. Also Available in AdBlock, ISA, and MaraDNS formats.Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

F-Secure has published a list of 1,500 domains used by the Downadup worm here. Many of these domains are not loadings so they have not been added to this list.

However,  for maximum protection, you may wish to consider adding them to your list. We’ve contacted F-Secure to see if they wouldn’t mind if we host a copy of their list in BIND and MS DNS format.

Fake codecs, waledac, fake antispyware, sql injection and other domains to block. Sources include www.dynamoo.com, www.shadowserver.org, www.threatexpert.com, blog.threatfire.com, and others:

368500 .cn	2009download-best-soft .com
5avscan .com	abrakadasbra .cn
argukio .com	antispywaredl .com
av1scan .com	antispyware-freecheck .com
avscan1 .com	antivirusquickscan .com
aznylsf .cn	av-online-scan .org
besttryour .cn	avpaymentpro .com
bm-740 .cn	avproinstall .com
bznylsf .cn	bestmirabella .com
ccswzx3 .cn	best-ps-download-4pc .com
ccswzx9 .cn	codecdownload .viewersoftwarearchive .com
celebsvids .net	createnewsforccn .com
cpdq .com	downloabsecurehere1 .com
dasgdasg .net	downloabsecurehere2 .com
dc21s .com	downloabsecurehere3 .com
directlink8 .cn	downloabsecurehere4 .com
eqw002 .cn	downloadallsoftnow .com
eqw003 .cn	download-allsoftnow .com
eqw004 .cn	downloadallsoft-now .com
eqw006 .cn	downloadall-soft-now .com
eqw008 .cn	download-everything .com
eqw009 .cn	download-files-bak .net
evestars .net	download-fls .com
eznylsf .cn	downloadplayersnews .com
falaliee .cn	download-softarch .com
falaliii .cn	download-top-software .com
falalioo .cn	dwnld-files .com
falaliqq .cn	enemyisraelattack .com
falalitt .cn	eternalgreetingcard .com
fastpcscan .com	exlporernews .com
ffxionlion .com	fast-download-base-free .com
firnop .cn	fastspycheck .com
fun6677 .com	files-upload-21 .com
fznylsf .cn	future-pictures .com
genpayment .com	generalantivirus .com
gznylsf .cn	get-files-4free .net
har5launo .com	get-frsh-files .com
hhj2 .cn	go-downloadz-pc-soft .com
hhj3 .cn	greatmirabellasite .com
hotvidz .info	greetingcardcalendar .com
hryspac .cn	greetingcardgarb .com
hryspah .cn	greetingguide .com
hryspan .cn	greetingsupersite .com
hryspao .cn	hosikurneilivv .cn
hryspap .cn	internetantiviruspro .com
hryspaq .cn	internetsecurityexamine .com
hryspav .cn	israelgazaconflict .com
hznylsf .cn	justchristmasgift .com
ixfree .net	kaipofinancialbusinessinformation .com
iznylsf .cn	lead-protection .com
jetztips .com	lifegreetingcard .com
jhz3launo .com	liveantivirusprotectionscan .com
jym562 .cn	livechristmascard .com
jzll-1 .cn	live-pc-antivirus-scan .com
jzll-2 .cn	liveupdateprotection .com
jzll-4 .cn	macromedia .name
jzll-9 .cn	mirabellamotors .com
jznylsf .cn	mirabellanews .com
kznylsf .cn	mirabellaonline .com
list-black .com	newmediayearguide .com
ln1is .com	newsforusacnn .com
locatedin .com	newyearcardfree .com
myfotolog .us	new-york-images .com
nathangann .com	pc-security-scan .com
rxgsslla .cn	protectedgoclicks .com
rxgsslld .cn	protectedsystemupdates .com
rxgsslll .cn	protectedupdatesystem .com
rxgssllt .cn	protectionliveupdate .com
sav2008 .com	protecton-antivirus-scan .com
sinakis .cn	pure-download-new .net
sllanmb .cn	regedintheclub .info
sllbnmb .cn	secureddownloadserver .com
slldnmb .cn	securedonlinepayments .com
sllinmb .cn	securedupdatetransfer .com
supertds .com	securedwwwclicks .com
sznylsf .cn	securitydeliversystem .com
timefreet .cn	smartcardgreeting .com
tznylsf .cn	soft-4-you-download .net
wrmfwa .cn	spyprotector-pro .com
wrmfwb .cn	startinstalladobe .com
wrmfwc .cn	superyearcard .com
wrmfwd .cn	sys-scanner .com
wrmfwe .cn	systemprotectiondownloads .com
wrmfwf .cn	thelocatelost .com
wrmfwg .cn	themirabelladirect .com
wrmfwi .cn	themirabellaguide .com
wrmfwj .cn	themirabellahome .com
wrmfwn .cn	thewindowsupdate .biz
wrmfwq .cn	top-best-software-area .net
wrmfwt .cn	topgreetingsite .com
wrmfwu .cn	tradingway .net
wrmfwz .cn	traffchecking .com
wxjyb .cn	tube-4you-best .com
wznylsf .cn	update-protection-stats .com
xisps .com	update-software-protection .com
xznylsf .cn	updateyourprotection .com
yznylsf .cn	whereismyclick .cn
zdq004 .cn	winwupdates .cn
zdq005 .cn	worldgreetingcard .com
zdq009 .cn	worldprotectedpayments .com
zdq010 .cn	yourmirabelladirect .com
zgcgsslle .cn	yourregards .com
zgcgssllf .cn

---

Contact us if you want to help us keep the Malware Domain Blacklist current.

Read this page if you want to report a false positive.

Domains.txt file is the complete list along with original reference.

Updates are located at http://www.malwaredomains.com/updates

The full files are located at: http://www.malwaredomains.com/files

BOOT file is in MS DNS format.

spywaredomains.zones file is in BIND format.Also Available in AdBlock, ISA, and MaraDNS formats.

Now a trusted source on the WOT-the Web of Trust!

Used by SURBL, MOREnet, and others…

Mostly rogue security domains, but also some domains associated with phishing, fast-flux, trojan and exploits. Source include www.threatexpert.com, malekal.com, www.precisesecurity.com, and others:

47tu .com	783456788839 .cn
5qzone .net	advanced-antivirus-scanner .com
aayears .cn	advancedscanner .com
ab0utblank .biz	antivirus-plus-2009 .com
aiyyw .com	antiviruspro-2009 .com
breakss78jh .cn	antivirus-pro-site .com
cashbotnet .com	anti-virus-secure-scanner .com
cs01 .cz	download-av2010 .info
cs03 .cz	firewallprotector .com
cs07 .cz	freechrismassite .com
dlls-id01 .eu	freechristmassite .com
dxp002 .cn	freechristmasworld .com
fengtianc .cn	freedecember .com
gridgames .info	i-av-sscan2009 .com
handou88 .com	metrpol .webs .com
hbjhejsc .com	microupdate80 .info
ihgcxianj .com	north-host .net
koresh .cn	pc-antispywarescanner .com
lznylsf .cn	pc-security-scanner .com
mdll-it11 .eu	pestguardian .com
nonnamee .com	pestprotector .com
ouwou .cn	poperkiller .com
owz8 .cn	popprotection .com
papampam .net	popupblockersite .com
popwash .com	popup-protection .com
portulote .com	popupprotectionsite .com
proadware .com	pro-antivirus-scan .com
qznylsf .cn	safesharing .com
sw-ww .ws	securitysolutionsnetworks .com
synflood .cn	shangaicons .com
teiri .cn	thedeadpit .com
traffsale .net	totalprotect2009 .com
whitebiz .cn	virusandspywarescaning .com
winesamile .cn	watchnetprotection .com
wuc7 .com

---

Contact us if you want to help us keep the Malware Domain Blacklist current.

Read this page if you want to report a false positive.

Domains.txt file is the complete list along with original reference.

Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format.
spywaredomains.zones file is in BIND format.

Also Available in AdBlock, ISA, and MaraDNS formats.

Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…

Some new years malspam, rogue antivirus, exploit domains, zlob trojans. Sources include: www.threatexpert.com, emergingthreats.net, blog.fireeye.com and others:

0ci .ru	a48574 .angelfire .com
0×90 .devtech .us	blitz2008 .xpg .com .br
100alexa .cn	botz .thedomain .com
118fox .cn	chk7stn .angelfire .com
16868 .org	decemberchristmas .com
1ni8sami .cn	fasterupdate .com
88vcd .com	funnychristmasguide .com
aooooa .cn	hutchinsonkansasnewspapers .net
astrumavr .com	imfromiraq123456 .angelfire .com
astrumavrpro .com	isafeantivir .com
bestyearcard .com	isafeantivirus .com
bojifun .com	isafe-antivirus .com
cardnewyear .com	isafeantiviruspro .com
cnycdw .com	isafeantvirus .com
cznylsf .cn	isaferantivirus .com
fucuzzy .com	itsfatherchristmas .com
holidayxmas .com	keepupsecure .com
jmmbk .cn	mirabellaclub .com
kabanyonok .org	newlifeyearsite .com
kooo546 .com	newlyclickssystem .cn
mirsosoft .com	newyearcardcompany .com
mmnnps .cn	newyearcardonline .com
nmb360 .cn	newyearcardservice .com
olenyonok .org	outerinfonetwork .com
sjxhfa .cn	securedliveclicks .com
tiktikz .com	spxpnt5 .xpg .com .br
vvk2 .cn	sunnyporntube .com
zaychonok .org	virusandspywarescan .com
zubryonok .org	whitewhitechristmas .com
zzrenwu .com	youryearcard .com

---

Contact us if you want to help us keep the Malware Domain Blocklist current.
Read this page if you want to report a false positive.
Domains.txt file is the complete list along with original reference.
Updates are located at http://www.malwaredomains.com/updates
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format. spywaredomains.zones file is in BIND format.Also Available in AdBlock, ISA, and MaraDNS formats.
Now a trusted source on the WOT-the Web of Trust!
Used by SURBL, MOREnet, and others…