Feed

Lots of Rogue Antivirus, Scareware, Exploit domains

Posted on November 4th, 2009 in 0day,exploit,New Domains,rogue antivirus by dglosser

Sources include www.tech-linkblog.com, www.malwaredomainlist.com, isc.sans.org:

agag44 .com activate-antivirus .com
agenturadomov .cz advanced-virus-remover-2010 .com
aletcenter .com angelsinuniform .com
amr .kz antimalware-software .org
amusecity .com aplikapublicidad .es
ar-global .com avprotectioncenter .com
asyouwishwed .biz best-anti-virus6 .com
av-pro-2010 .com bestremoverpro .com
a-vpro21 .com bestscanonline .info
bikingrealtor .net browsersecurityaddon .com
bolcsvolgyi .hu bulgaristanuniversiteleri .org
casghnamia .com cartoon-sex-links .com
cashnzamia .com checkonlinenow .info
chaikrman .com checkonlineonline .info
chrisexpo .com checkonlinesite .info
colaran .com checkonlinestore .info
corclan .com checkonlinetoday .info
cpattwinterp .com checkwindowsupdate .com
cw .ubru .ac .th cyberstrongstore .com
downloadavr7 .com detect-spyware1 .com
errtz .cn detect-spyware3 .com
filmkolik .net detect-spyware5 .com
fotothhi .be detect-spyware7 .com
freemaniya .cn detect-spyware9 .com
gateshis .cn driverupdatesystem .com
greattubesusa .com foro .gamesquality .com
hana .nef-i .co .kr freecheckonline .info
htaqua .ru freescanonline .info
i1st .co .cc good-antispyware7 .com
inkkak .cn good-antispyware8 .com
johnson .co .th google-analystisks .us
kamunyugi .cn hannabarbera .com .br
kcr-net .de haydikaradenize .com
kill-virusa .com ibdf-deutschland .de
kill-viruse .com internetprotectectionscan .com
lakyrnikcup .cz jatulintarhan .net
lifeecond .com kathrynmetcalf .com
livebmx .ru kingofbelgrade .com
malware-url .com leucodistrofia .es
markokaldur .com liveantivirusproscanner .com
mcsdp .com lou-ferrigno .info
mefa .ws magnoliamails .com
misterplasma .be melstra-techniek .nl
mnogotrafika .cn mifconsulting .net
mobydickrock .ru multiairservice .com
mybestline .cn mycheckonline .info
myrussia .kz mycomputerupdate01 .com
norrtulls .se mycomputerupdate5 .com
o0w0o .com newcheckonline .info
ocscanner .com onlinesecurityscanv15 .com
oeysymbol .com ozguvenplastik .com
ogis .se paty88 .xpg .com .br
olight-usa .com red-devil-sport-club .gymdb .com
oracleoledb .cn removespyware-7 .com
osguard-pro .com removespywarev1 .com
pifesecond .com removespywarev3 .com
psgtech72 .com sejoong .tourskorea .com
quaoegame .com steps-ironcup .com
scottstuart .org stockbuzzindia .com
secmodify .com storefront .vacuformstore .com
sensor .ws stortfordaircadets .org .uk
siva4kids .org sunkenlibrary .org
sksolvesborg .se thailocal .sru .ac .th
softveteran .com thalassapromotion .eu
spin-nds .de thefeedwater .com
stoned-ip .com topantimalwarescan5 .com
success-biz .com tophotpc-check .com
tapiroten .info top-scanner11 .com
top-scanner2 .com transmarecuador .com
top-scanner9 .com ujcar .deva .rdsnet .ro
uakegame .com unsecurewebsites .com
uchikawa .ne .jp updatesystem00 .com
wbavv .com usepetrol2earn .com
winscanner11 .com utka3medrdosubor .com
winscanner16 .com virus-detect08 .com
xcorp .net .cn werkgruppe-donau .de
yondental .co .kr windesktopdefender .com
ytdb .ru yourpicturehoster .com
zoolanalizer .cn

The malware blocklists here are provided for free as part of the fight against malware.

However, it i’s time to pay hosting costs once again….

Please help to keep this site free! Donate whatever you can,  all donations go to hosting and infrastructure costs.

Also, yearly sponsorships are available.  Full acknowledgement, an icon, and link back to your site will be placed in the left sidebar.


Read this page if you want to report a false positive.

Domains.txt file is the complete list along with original reference.
New: Justdomains contains list of only the domain names.
Updates are located at http://www.malwaredomains.com/updates.
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format. spywaredomains.zones file is in BIND format.
Also Available in AdBlock, ISA, and MaraDNS formats.
Now a trusted source on the WOT-the Web of Trust!

Used by SURBL, MOREnet, and others…

Urgent Additions: google-analystisks .us & thefeedwater. com

Posted on November 3rd, 2009 in 0day,exploit,New Domains by dglosser

From http://isc.sans.org/diary.html?storyid=7519:

Block google-analystisks .us and thefeedwater. com ASAP.

List has  been updated….

240+ zeus, phishing, malicious domains

Posted on November 3rd, 2009 in New Domains,Phishing,zeus by dglosser

Over 240 zeus, phishing, harmful domains added. Sources include ddanchev.blogspot.com, antiphishing.reasonables.com, zeustracker.abuse.ch:

22ger .cn ogurchik .cn
33hrf .cn podzemje .cn
iark .net tj1fiil .com
judns .net tj1fiil .net
lnxwy .com woonhae .com
ololii .eu yy1azsva .eu
ololiw .eu yy1azsvq .eu
ololiy .eu yy1azsvz .eu
ololiz .eu yyy1asvf .eu
ukliit .cn yyy1azsy .eu
yh1qab .eu yyy1azvg .eu
yh1qak .eu yyy1zsve .eu
yh1qal .eu bichalina .cn
yh1qao .eu buzizoo2 .com
yh1qaz .eu gerrahawa .eu
6arada .net gerrahowa .eu
dilokqv .eu gerrakawa .eu
gld111b .ws gerrakowa .eu
h1erfae .eu gerralowa .eu
h1erfai .eu gerraoowa .eu
h1erfaj .eu gerrasasa .eu
h1erfaq .eu gerrasase .eu
h1erfar .eu gerrasasq .eu
h1erfat .eu greenhead .cn
h1erfau .eu hulasoftz .cn
h1erfaw .eu immikiut1 .cz
h1erfay .eu keysiolo .net
hewj .co .cc ll7ll .com .es
ij1tli .net longulen .net
j1t1iil .eu nyuy12qwf .eu
lj1tli .com nyuy12qwg .eu
lj1tli .net nyuy12qws .eu
lj1tll .com ololii .co .uk
lj1tll .net ololiw .co .uk
ltlil1 .com ololiy .co .uk
ltlil1 .net ololiz .co .uk
milki1a .co rrref1aaz .eu
milki1a .me rrref1akz .eu
milki1e .me rrref1ykz .eu
milki1g .me rrrefjokz .eu
milki1i .co thecowrd .com
milki1l .co tuttakto .com
milki1y .me yandex .co .cc
n111sae .eu yh1qab .me .uk
n111sak .eu yh1qak .co .uk
n111sap .eu yh1qak .me .uk
n111say .eu yh1qal .co .uk
n111saz .eu yh1qao .co .uk
nniuji1 .eu yh1qao .me .uk
nniujih .eu yh1qaz .me .uk
nniujo1 .eu bbttyak .co .uk
nniukif .eu bbttyam .co .uk
nniukih .eu bbttyam .me .uk
nniukik .eu bbttyap .co .uk
nniukiw .eu bbttyap .me .uk
nniukiz .eu bbttyaz .co .uk
nniuxih .eu bbttyaz .me .uk
nniuxiw .eu bubenchik .net
pouikib .eu megicpatt .com
pouikic .eu tt1qwaq .co .uk
pouikie .eu tt1qwaq .me .uk
pouikif .eu tt1qwar .co .uk
pouikig .eu tt1qwar .me .uk
pouikir .eu tt1qwat .co .uk
pouikis .eu tt1qwat .me .uk
pouikit .eu tygerah .co .uk
pouikiv .eu tygerak .co .uk
pouikiw .eu tygeraw .co .uk
pouikix .eu tygeraz .co .uk
pouikiy .eu armadaneo .info
rodjer .com bbttyak .org .uk
saaasak .eu easder1g .co .uk
saaasav .eu easder1l .co .uk
tj1fiil .tc easder1m .co .uk
tt1qwa1 .eu fluousness .net
tt1qwa1 .me limon4ik .co .cc
tt1qwae .eu mailzippo .info
tt1qwae .me nytre4rt .co .uk
tt1qwaq .eu nytre4ru .co .uk
tt1qwar .eu qwecvgfjk .info
tt1qwat .eu yag0yag0 .co .cc
tygerah .eu yhaqwe1a .co .uk
tygerak .eu yhaqwe1q .co .uk
tygeraw .eu yhaqwe1r .co .uk
ujihkei .eu yhaqwi1g .co .uk
ujihkni .eu yhaqwi1h .co .uk
ujihkui .eu yhaqwi1l .co .uk
bbbboom .com yhaqwi1m .co .uk
edilokqf .eu yhaqwi1p .co .uk
edilokqi .eu dietcoaches .com
edilokqm .eu dontstop185 .net
edilokqn .eu fut763jrs4l .com
edilokqr .eu happykinder .org
edilokqs .eu mateoarriba .com
edilokqu .eu nyuy12qwa .co .uk
edilokqx .eu nyuy12qwf .co .uk
filatok .com nyuy12qwg .co .uk
heiiikok .eu nyuy12qws .co .uk
heiiikoy .eu nyuy12qwz .co .uk
heiiikul .eu redstars .ax3 .net
heiiikum .eu subaruservice .cn
heiiikuv .eu wildbunchwtf .com
heiiikuy .eu yhhherasde .co .uk
i1st .net .cn yhhherasdp .co .uk
idllsit .com yhhheraski .co .uk
j1t1iil .com newmoon-movie .net
j1t1iil .net ontvertenchio .org
nyuh1awa .eu probrosikanet .org
nyuh1awb .eu yhhheraskog .co .uk
nyuh1awc .eu yhhheraskol .co .uk
nyuh1awd .eu yhhheraskoy .co .uk
nyuh1awe .eu 00002009 .zapto .org
nyuh1awf .eu yourskinonline .com
nyuh1awg .eu zzzz .ellmada .co .cc
nyuh1awh .eu kripakripchampion .ru
nyuh1awm .eu windows-update210 .com
nyuh1awn .eu agoravai11 .tempsite .ws
nyuh1aws .eu streammediastorage .com
nyuh1awt .eu ushenkohuivolosatiy .ru
nyuh1awv .eu opengl17 .freehostia .com
nyuh1awx .eu sisters-try-strapon .com
nyuh1awz .eu

The blocklists here are provided for free as part of the fight against malware.

However, it i’s time to pay hosting costs once again….

Please help to keep this site free!  Donate whatever you can,  all donations go to hosting and infrastructure costs.

Also, yearly sponsorships are available.  Full acknowledgement, an icon, and link back to your site will be placed in the left sidebar.


Read this page if you want to report a false positive.

Domains.txt file is the complete list along with original reference.
New: Justdomains contains list of only the domain names.
Updates are located at http://www.malwaredomains.com/updates.
The full files are located at: http://www.malwaredomains.com/files
BOOT file is in MS DNS format. spywaredomains.zones file is in BIND format.
Also Available in AdBlock, ISA, and MaraDNS formats.
Now a trusted source on the WOT-the Web of Trust!

Used by SURBL, MOREnet, and others…