DNS-BH – Malware Domain Blocklist

Old versions of Plesk store passwords in clear text
->   http://blog.unmaskparasites.com/2012/06/26/millions-of-website-passwords-stored-in-plain-text-in-plesk-panel/

There is  a remote  SQL vulnerability that has been found in old versions of Plesk allowing attackers to exploit those
passwords.
-> http://kb.parallels.com/en/113321

Combine these two together and what do you get, malware of course.

Plesk Vulnerability Leading to Malware
http://blog.sucuri.net/2012/06/plesk-vulnerability-leading-to-malware.html

Runforestrun and Pseudo Random Domains
http://blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/

Run, Forest! (Update) – block 95.211.27.206

https://isc.sans.edu/diary/Run+Forest+Update+/13561

We’ve added a bunch of these domains but you should check the resources above, as well as new IP addresses to block.

(Thanks to Jack W. for keeping us up-to-date on these developments.)

Added over 100 domains associated with malvertising, java exploits, htaccess redirects…  Sources include hosts-file.net, www.mwis.ru, sucuri.net (all sources are listed in our domain.txt file.)

Compressed files are located at: http://www.malware-domains.com (full zone files, note the dash)  and http://dns-bh.sagadc.org/.  We also have a mirror dedicated to research and Open Source Projects – contact us for details. NO ZONE FILES ARE LOCATED ON THIS SITE.

Added over 140 domains associated with exploits, malvertising, ransom/rogues, and of course zeus, etc. Sources:www.mwis.ru, vxvault.siri-urz.net, vxvault.siri-urz.net (all sources are listed in our domain.txt file.)

Compressed files are located at: http://www.malware-domains.com (full zone files, note the dash)  and http://dns-bh.sagadc.org/.  We also have a mirror dedicated to research and Open Source Projects – contact us for details. NO ZONE FILES ARE LOCATED ON THIS SITE.

Added over 250 domains linked to flashback, phishing, malvertising, etc. Sources include www.threatexpert.com, private correspondence, contagiodump.blogspot.com and others. Please update your blocklists/sinkhole  and follow  our Terms of Use.

Reminder: the main site does not contain any zone files. Only download files from one our our download mirrors.

Added 164 domains associated with trojan activity, cybercriminals, hiloti, etc.  Sources include iseclab.org, amada.abuse.ch, www.spamhaus.org and others (all sources are listed in our domain.txt file.)

Compressed files are located at: http://www.malware-domains.com (full zone files, note the dash)  and http://dns-bh.sagadc.org/.  We also have a mirror dedicated to research and Open Source Projects – contact us for details.

Old Added over 200 domains (on the 13th, sorry about the late post) associated with pornmocup, black hole exploits. sakura, crimepack, etc. Sources include hosts-file.net, www.malwareurl.com, c-apt-ure.blogspot.com and others (all sources are listed in our domain.txt file.)

Compressed files are located at: http://www.malware-domains.com (full zone files, note the dash)  and http://dns-bh.sagadc.org/.  We also have a mirror dedicated to research and Open Source Projects – contact us for details.

Added over 170 domains associated with exploits, htaccess redirects, malicious iframes, malicious javascript and other badness. Sources include exposure.iseclab.org, amada.abuse.ch, hosts-file.net and others (every source is  listed in the domains.txt file). Please update your blocklists/sinkhole  and follow  our Terms of Use.

Reminder: the main site does not contain any zone files. Please download files from one our our download mirrors

109 new domains added.  Associated with Carberp, IceX, malvertising, sinowal, Zeus, etc. Sources: zeustracker.abuse.ch, spamhaus.org, urlquery.net, google safebrowsing and other (every source is  listed in the domains.txt file)

Compressed files are located at: http://www.malware-domains.com (full zone files, note the dash)  and http://dns-bh.sagadc.org/.  We also have a mirror dedicated to research and Open Source Projects – contact us for details.

Please give it a try and let us know…

Added 200+ domains associated with the usual exploits, trojans, malvertising, etc. Sources include wepawet.iseclab.org, hosts-file.net, abuse.ch (every source is  listed in the domains.txt file). Please update your blocklists/sinkhole  and follow  our Terms of Use.