Malware Domain Blocklist updated...

[AplusWebMaster]

FYI...

DNS-BH – Malware Domain Blocklist
- http://www.malwaredomains.com/

- http://www.malwaredomains.com/wordpress/?page_id=2
"The DNS-BH project creates and maintains a listing of domains that are known to be used to propagate malware and spyware. This project creates the Bind and Windows zone files required to serve fake replies to localhost for any requests to these, thus preventing many spyware installs and reporting.

This list is also available in AdBlock and ISA Format..."

To install the AdblockPlus extension in Firefox, click here:
- https://addons.mozilla.org/en-US/firefox/addon/1865

- http://www.youtube.com/watch?v=oNvb2SjVjjI

Blocking malicious sites with Adblock Plus
- http://adblockplus.org/blog/blocking-malicious-sites-with-adblock-plus
"... another layer of protection..."
Scroll down to: "... click here to subscribe to the list in Adblock Plus..." and click on the link - click OK to the popup for "Add subscription" - done.

:fear:

[AplusWebMaster]

FYI...

BH-DNS Update: 125 New Domains
- http://www.malwaredomains.com/wordpress/?p=2603
April 15th, 2012 - "Added 125 new domains associated with scams, trojans, mebroot, etc. Sources include exposure.iseclab.org, threatexpert.com, malwareurl.com..."

:fear:

[AplusWebMaster]

FYI...

hostexploit.com top bad hosts – 2012 Q1
- http://www.malwaredomains.com/wordpress/?p=2612
April 18th, 2012 - "We added our 'friends' nikjju . com and best-antiviruu.de .lv and also listed domains from ISP’s or hosting services listed on hostexploit.com‘s Q1 report on the top bad hosts*. To round things out, we also added domains flagged by sucuri as having malicious javascript or iframes..."
* http://hostexploit.com/
___

Top 3 AS listed at Hostexploit:

Diagnostic page for AS16138 (INTERIA.PL)
- http://google.com/safebrowsing/diagnostic?site=AS:16138
"... 1580 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2012-04-19, and the last time suspicious content was found was on 2012-04-19... Over the past 90 days, we found 21 site(s) on this network.. that appeared to function as intermediaries for the infection of 25 other site(s)... this network has hosted sites that have distributed malicious software in the past 90 days. We found 22 site(s), including... that infected 28 other site(s)..."
> http://sitevet.com/db/asn/AS16138

Diagnostic page for AS47583 (HOSTING)
- http://google.com/safebrowsing/diagnostic?site=AS:47583
"... 1303 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2012-04-19, and the last time suspicious content was found was on 2012-04-18... Over the past 90 days, we found 110 site(s) on this network... that appeared to function as intermediaries for the infection of 934 other site(s)... this network has hosted sites that have distributed malicious software in the past 90 days. We found 151 site(s)... that infected 1164 other site(s)..."
> http://sitevet.com/db/asn/AS47583

Diagnostic page for AS33182 (DIMENOC)
- http://google.com/safebrowsing/diagnostic?site=AS:33182
"... 1966 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2012-04-19, and the last time suspicious content was found was on 2012-04-19... Over the past 90 days, we found 44 site(s)... that appeared to function as intermediaries for the infection of 65 other site(s)... this network has hosted sites that have distributed malicious software in the past 90 days. We found 87 site(s)... that infected 160 other site(s)..."
> http://sitevet.com/db/asn/AS33182

:fear::fear:

[AplusWebMaster]

FYI...

Fake-AV, exploit, malvertising domains
- http://www.malwaredomains.com/wordpress/?p=2616
April 21st, 2012 - "Added 124 domains associated with rogue/fake AV, malvertising, exploits, etc. Sources include hosts-file.net, emergingthreats.net, urlvoid.com..."

:fear:

[AplusWebMaster]

FYI...

Small Update – 4/27
- http://www.malwaredomains.com/wordpress/?p=2635
April 28th, 2012 - "... Added a couple of dozen malvertising, zeus, palevo and other harmful domains on 4/27..."

:fear:

[AplusWebMaster]

FYI...

malvertising, malicious js, bugat domains
- http://www.malwaredomains.com/wordpress/?p=2653
April 29th, 2012 - "Added 137 domains associated with google safebrowsing, malvertising, malicious javascript, etc. Sources include exposure.iseclab.org, safebrowsing.clients.google.com, stopmalvertising.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

bhexploitkit, htaccess, iframes, trojans...
- http://www.malwaredomains.com/wordpress/?p=2660
May 4th, 2012 - "Added 110 domains associated with htaccess redirects, malicious iframes, trojans, etc. sources include malwaredomainlist.com, safebrowsing.clients.google.com, jsunpack.jeek.org..."

:fear::fear:

[AplusWebMaster]

FYI...

Exploit Domains, iframes, malvertising
- http://www.malwaredomains.com/wordpress/?p=2663
May 6th, 2012 - "Added over 140 domains associated with exploits, malvertising, ransom/rogues, and of course zeus, etc. Sources: mwis.ru, vxvault.siri-urz.net, vxvault.siri-urz.ne..."

:fear: :spider:

[AplusWebMaster]

FYI...

sql injection, htaccess, malicious js domains
- http://www.malwaredomains.com/wordpress/?p=2673
May 13th, 2012 - "Added domains associated with htaccess redirection, sql injection, iframes, etc..."

:fear:

[AplusWebMaster]

FYI...

BH Exploit Kit, malvertising, cridex domains
- http://www.malwaredomains.com/wordpress/?p=2676
May 17th, 2012 - "Added almost 150 domains associated with Black Hole Exploits, malvertising, cridex, etc. Sources: mwis.ru, zeustracker.abuse.ch, exposure.iseclab.org and several others..."

:fear:

[AplusWebMaster]

FYI...

htaccess redirects, malicious javascript, trojans
- http://www.malwaredomains.com/wordpress/?p=2684
May 22nd, 2012 - "Added 137 domains associated with htaccess redirects, malvertising, iframes, trojans, etc. Sources: exposure.iseclab.org, threatexpert.com, zeustracker, sucuri.net, and others..."

:fear::fear:

[AplusWebMaster]

FYI...

Java Exploits, malicious advertising, SutraTDS
- http://www.malwaredomains.com/wordpress/?p=2691
May 26th, 2012 - "Added over 100 domains associated with malvertising, java exploits, htaccess redirects. Sources include hosts-file.net, mwis.ru, sucuri.net..."

:fear:

[AplusWebMaster]

FYI...

Flamer, htaccess, botnet, malspam domains...
- http://www.malwaredomains.com/wordpress/?p=2705
June 1st, 2012 - "Added over 140 malicious domains associated with flamer, htaccess redirects, malspam etc. Sources include spamhaus.org, malwareurl.com, malware-control.com and many others..."

:fear::fear:

[AplusWebMaster]

FYI...

BH Exploit, citadel, malspam, Tinba domains...
- http://www.malwaredomains.com/wordpress/?p=2714
June 4th, 2012 - "Added over 140 domains associated with Tinba, pornmocup, back hold exploits, etc. Sources include exposure.iseclab.org, c-apture.blogspot.com, hosts-file.net, malware-control.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

malvertising, malicious javascript, trojans...
- http://www.malwaredomains.com/wordpress/?p=2732
June 13th, 2012 - "Added over 140 domains associated with trojans, sql injection, malvertising, etc. Sources include xylibox.com, safebrowsing.clients.google.com, blog.dynamoo.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

zeroaccess, malspam, blackhole exploit domains
- http://www.malwaredomains.com/wordpress/?p=2735
June 17th, 2012 - "Added domains associated with bh exploits, malicious spam, zeroaccess and other trojans. Sources include labs.sucuri.net, hosts-file.net, blog.dynamoo.com..."

:fear::fear:

[AplusWebMaster]

FYI...

runforestrun, iceix, rogues, malvertising, malspam domains...
- http://www.malwaredomains.com/wordpress/?p=2749
June 25th, 2012 - "Two recent updates, adding over 230 domains associated with “RunForestRun, IceIX, Malicious Spam, Malicious Advertising, etc. Sources include malwaredomainlist.com, isc.sans.org, hosts-file.net and many more..."

:fear::fear:

[AplusWebMaster]

FYI...

Runforestrun update
- http://www.malwaredomains.com/wordpress/?p=2758
June 26th, 2012 - "Old versions of Plesk store passwords in clear text
-> http://blog.unmaskparasites.com/2012/06/26/millions-of-website-passwords-stored-in-plain-text-in-plesk-panel/
There is a remote SQL vulnerability that has been found in old versions of Plesk allowing attackers to exploit those passwords.
-> http://kb.parallels.com/en/113321
Combine these two together and what do you get, malware of course.
Plesk Vulnerability Leading to Malware
>> http://blog.sucuri.net/2012/06/plesk-vulnerability-leading-to-malware.html
Runforestrun and Pseudo Random Domains
- http://blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/
Run, Forest! (Update) – block 95.211.27.206
- https://isc.sans.edu/diary/Run+Forest+Update+/13561
We’ve added a bunch of these domains but you should check the resources above, as well as new IP addresses to block."

:fear::fear:

[AplusWebMaster]

FYI...

BH Exploit Kit, Run Forest Run, fariet domains
- http://www.malwaredomains.com/wordpress/?p=2760
June 28th, 2012 - "A small but important update with some fariet, run forest run, bh exploit kit domains. Sources include blog.eset.com, microsoft.com, blog.urlvoid.com and others..."

:fear:

[AplusWebMaster]

FYI...

iframes, Pontoeb, scam domains
- http://www.malwaredomains.com/wordpress/?p=2771
July 4th, 2012 - "Added over 100 domains associated with Pontoeb, scams, malicious iframes, etc. Sources: spamhaus.org, vxvault.siri-urz.net, sucuri.net and others..."

:fear:

[AplusWebMaster]

FYI...

246 malicious domains added...
- http://www.malwaredomains.com/wordpress/?p=2783
July 10th, 2012 - "A very large update consisting of 246 domains associated with malvertising, iframes, black hole exploits, etc. Sources include malwaredomainlist.com, sucuri.net, dynamoo.com..."

:fear::fear::spider:

[AplusWebMaster]

FYI...

RunForestRun, malspam, malvertising Domains
- http://www.malwaredomains.com/wordpress/?p=2788
July 12th, 2012 - "Added 150 domains (runforestrun, malspam, malvertising)."

:fear:

[AplusWebMaster]

FYI...

Relisted Domains ...
- http://www.malwaredomains.com/wordpress/?p=2791
July 16th, 2012 - "Just went through a bunch of older domains and relisted almost 50 of them. Or do the bad guys wait and “lay low” with their domain until “the coast is clear” and once google safebrowsing delists them, they once again use the domain to serve up malware (Whack-a-Mole)? Do they have google APIs and check daily to see if their domain is delisted?... It’s like fast-flux except the time frame is months instead of minutes.:

:fear: :sad:

[AplusWebMaster]

FYI...

DNS-BH Updates: 7.19 and 7.21
- http://www.malwaredomains.com/wordpress/?p=2794
July 22nd, 2012 - "Been remiss about mentioning updates on 7.19 and 7.21. Please update your blocklists/sinkhole..."

:fear::fear:

[AplusWebMaster]

FYI...

IntelliDownload (stopmalvertising.com)
- http://www.malwaredomains.com/wordpress/?p=2797
July 23rd, 2012 - "... article about IntelliDownload*...
* http://stopmalvertising.com/malware-reports/intellidownload-hijacks-ads-and-spies-on-your-internet-browsing.html
Jul 20, 2012 - "... it doesn’t disclose that it will hijack advertisements on several major websites and replace them with ads from oadsrv .com, scrape your Facebook data, spy on your browser session and report every move you make on the web back to chango .com ..."

Please study the domains listed in the article and take appropriate action (the domains have -not- yet been added to this blocklist)."

:fear: :mad:

[AplusWebMaster]

FYI...

Java Exploit domains, trojans, rogues
- http://www.malwaredomains.com/wordpress/?p=2800
July 25th, 2012 - "A small but important update containing domains associated with Java exploits, rogue antivirus, trojans, and other malicious domains you don’t want visiting your computer or network. Sources include mwis.ru, malwaredomainlist.com, and urlquery.net..."
___

- https://blogs.technet.com/b/mmpc/archive/2012/07/25/how-to-protect-yourself-from-java-based-malware.aspx?Redirected=true
25 Jul 2012 - "The last few months we have seen a drastic increase in Java-based malware abusing the CVE-2012-0507* AtomicReferenceArray type-confusion vulnerability. In addition to that, a few weeks ago, a new Java vulnerability was found (CVE-2012-1723)**; it is also a type-confusion vulnerability. The attack abusing this new vulnerability is also very active... The most effective measure against these vulnerabilities is -updating- your Java installation. To check the version of JRE your browser is running, visit following link:
http://www.java.com/en/download/installed.jsp ..."

* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0507 - 10.0 (HIGH)
** http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1723 - 10.0 (HIGH)

:fear:

[AplusWebMaster]

FYI...

RunForestRun DGA Update (update your Domain Blocklist) ...
- http://www.malwaredomains.com/wordpress/?p=2805
July 26th, 2012 in 0day, New Domains
> http://blog.unmaskparasites.com/2012/07/26/runforestrun-now-encrypts-legitimate-js-files/
26 Jul 12 - "... a quick recap of the RunForestRun attack: It began in mid-June and infected many servers with Plesk Panel since then. Hackers used Plesk’s File Manager to inject malicious code (mainly) at the bottom of .js files..."

"RunForestRun has changed the domain generating algorithm (DGA), and now uses waw.pl subdomains (instead of .ru) in malicious URLs."

:sad: :mad: :fear:

[AplusWebMaster]

FYI...

RunForestRun DGA Domains
- http://www.malwaredomains.com/wordpress/?p=2811
July 28th, 2012 - "Added over 200 RunForestRun Domains listed at blog.unmaskparasites.com."

:fear::fear:

[AplusWebMaster]

FYI...

DNS-BH Aug3 Update – relisted domains
- http://www.malwaredomains.com/wordpress/?p=2813
August 3rd, 2012 - "Added 203 domains – domains were at one time delisted but are once again associated with malware..."

:fear::fear:

[AplusWebMaster]

FYI...

Domains and IPs to Block ASAP
- http://www.malwaredomains.com/wordpress/?p=2825
August 9th, 2012 in 0day, sql injection - "Two posts from the Internet Storm Center:
> https://isc.sans.edu/diary.html?storyid=13864
SQL Injection Lilupophilupop style – Lists about a dozen domains you should immediately add to your blocklists plus more in Dynamoos blog*.
> https://isc.sans.edu/diary.html?storyid=13861
Zeus/Citadel variant causing issues in the Netherlands – Follow the links and block those IP addresses ..."

* http://blog.dynamoo.com/2012/08/more-malware-sites-to-block-on.html

:fear: :mad::mad:

[AplusWebMaster]

FYI...

More sites to block...
- http://blog.dynamoo.com/2012/08/even-more-malware-sites-to-block-on.html
13 August 2012 - "More evil sites to block on 194.28.115.150 (Specialist ISP*) following on from these:
idi42nga .rr.nu, kprud89entia .rr.nu, hin66gof .rr.nu, iste03dengi .rr.nu, hing30emplo .rr.nu,
ize84dso .rr.nu, ind42icat .rr.nu, lack33andw .rr.nu"
* http://blog.dynamoo.com/2012/08/yet-more-malware-sites-to-block-on.html
10 August 2012 - "... blocking access to 91.211.200.0/22 and 194.28.112.0/22 (Specialist ISP) plus -all- .rr.nu domains would be even better."

> http://blog.dynamoo.com/2012/08/scan-from-xerox-workcentre-pro-spam.html
13 August 2012 - "..."46.51.218.71 (Amazon, Ireland)
71.89.140.153 (Cloudaccess.net, US)
203.80.16.81 (Myren, Malaysia)
Blocking access to these IPs will prevent other malicious sites on the same servers from being a problem..."

Something evil on 178.63.195.128/26
- http://blog.dynamoo.com/2012/08/something-evil-on-1786319512826.html
13 August 2012 - "The IP address range 178.63.195.128/26 nominally belongs to grey hat host Hetzner in Germany, although it has been reallocated to a registrant in Israel. This block recently came up as the source for a ZeroAccess infection picked up from 178.63.195.170. A look at the 178.63.195.128/26 range (178.63.195.128 - 178.63.195.191) shows several suspicious websites with domains apparently generated by DoItQuick (more info here*). Most of the domains are too new to have any reputation, although given the live distribution of malware and the randomly chosen names then they are unlikely to be doing anything nice... quite a lot of suspect sites have recently been moved from this range to point at 127.0.0.1 instead, a common trick when malcious domains needs to be pointed somewhere else quickly.
The registrant for this block is:
inetnum: 178.63.195.128 - 178.63.195.191
address: RUSSIAN FEDERATION
178.63.195.163...
178.63.195.167...
178.63.195.168...
178.63.195.170...
178.63.195.171..."
* https://krebsonsecurity.com/2012/07/service-secures-domains-for-black-deeds/

:mad::mad::mad:

[AplusWebMaster]

FYI...

"Federal Tax" spam...
- http://blog.dynamoo.com/2012/08/federal-tax-spam-wireframegleeinfo.html
14 August 2012 - "... tax-themed spam leads to malware...

Date: Tue, 14 Aug 2012 15:21:33 +0200
From: "Internal Revenue Service" [alerts@irs.gov]
Subject: Rejected Federal Tax transfer
Your Tax payment (ID: 38969777924999), recently sent from your checking account was returned by the The Electronic Federal Tax Payment System.
Rejected Tax transaction
Tax Transaction ID: 38969777924999
Return Reason See details in the report below
Tax Transaction Report tax_report_38969777924999.doc (Microsoft Word Document) ...

... malicious payload... hosted on 78.87.123.114 (CYTA, Greece) which has been seen several times lately and should be blocked if you can."
___

"We can not charge your credit card" spam...
- http://blog.dynamoo.com/2012/08/we-can-not-charge-your-credit-card-spam.html
14 August 2012 - "... spam pretends to be from Amazon. Or UPS. Or perhaps both. Anyway, it leads to malware...

Date: Tue, 14 Aug 2012 05:26:05 +0200
From: "ups" [mail@ups.com]
Subject: We can not charge your credit card
Attachments: Amazon_Invoice.htm
Your Account | Help
Your credit card was blocked.
We tried to withdraw money from your credit card, but your bank decline it. In the attachment you will be found a invoice from your last order. Please pay this invoice as soon as possible...

The attachment Amazon_Invoice.htm is malicious and it attempts to download a malicious script... hosted on the following IPs (which have all been used for malware distribution several times):
190.120.228.92
199.71.212.78
203.80.16.81 ..."

:mad::mad:

[AplusWebMaster]

FYI...

Outgoing network traffic & Malicious Activity
- http://www.malwaredomains.com/wordpress/?p=2831
August 23rd, 2012 - "SANs* has a nice write-up about analyzing outgoing network traffic to identify malicious activity. They list a bunch of ip blocklists and IP reputation sources.
(We’ve also had two updates since the last post**, busy at $Jobs...)"

* https://isc.sans.edu/diary.html?storyid=13963#comment

** http://www.malwaredomains.com/wordpress/?p=2829
August 14th, 2012

Also see: http://www.malwaredomainlist.com/mdl.php

Latest update: August 23, 2012 2:50 AM
- http://mirror2.malwaredomains.com/files/

:fear::fear:

[AplusWebMaster]

FYI...

DNS-BH Update – 104 new domains
- http://www.malwaredomains.com/wordpress/?p=2833
August 27th, 2012 - "Added 104 new domains from hosts-file.net, safebrowsing.clients.google.com, avgthreatlabs.com and others..."

:fear:

[AplusWebMaster]

FYI...

Java 0-Day Domains, BH Exploit Kit Domains, other malicious domains
- http://www.malwaredomains.com/wordpress/?p=2837
August 28th, 2012 - "Added domains associated with the Java 0-day, Blackhole Exploit Kit, and other badness. Sources include labs.sucuri.net, blog.fireeye.com, spamhaus.org..."

:fear::fear:

[AplusWebMaster]

FYI...

Java 0-day, Black Hole Exploits, and other malicious domains...
- http://www.malwaredomains.com/wordpress/?p=2843
September 3rd, 2012 - "... Updates on August 29th and Sept 1st contained domains associated with the Java 0-day, Black Hole Exploits, and other malicious domains (another today @ 1:12 PM*)... Sources include safebrowsing.clients.google.com, scumware.org, blog.dynamoo.com and others..."
* http://mirror2.malwaredomains.com/files/

:fear:

[AplusWebMaster]

FYI...

java exploit domains, rouge antivirus, malspam domains...
- http://www.malwaredomains.com/wordpress/?p=2852
September 8th, 2012 - "Added 101 new domains associated with Java exploits, malicious spam, sutratds, fake antivirus, etc. Sources include emergingthreats.net, google.com/safebrowsing, blog.dynamoo.com..."

:fear::fear:

[AplusWebMaster]

FYI...

Several Sept Updates
- http://www.malwaredomains.com/wordpress/?p=2862
September 16th, 2012 - "... Recent updates added domains associated with the Java 0day, Black Hole Exploits, etc. All sources are listed in our domain.txt file*..."
* http://dns-bh.sagadc.org/domains.txt

:fear::fear:

[AplusWebMaster]

FYI...

Nitro, malspam, risky domains ...
- http://www.malwaredomains.com/wordpress/?p=2866
September 23rd, 2012 - "Added domains associated with Nitro, malspam, etc. Sources include safebrowsing.google.com, symantec.com, zeustracker.abuse.ch, blog.dynamoo.com, zataz.com, hosts-file.net..."

:fear::fear:

[AplusWebMaster]

FYI...

Site delistings - Blocklist correction ...
- http://www.malwaredomains.com/wordpress/?p=2871
September 25th, 2012 - "artconcoction.com has been delisted and will be removed on the next update. There is also a (big) mistake in the zone file, don’t wait for an update on our end; please -remove- safebrowsing.clients.google.com* from your zone files ASAP."

* NOTE to AdBlock Plus users: Un-check it in the AdBlock Plus Filter Preference listing.

:fear::fear:

[AplusWebMaster]

FYI...

malvertising, Black Hole Exploit Kit domains
- http://www.malwaredomains.com/wordpress/?p=2873
September 26th, 2012 - "Added a bunch of domains associated with exploit kits, malvertising, and other badness. Sources include binrand.com, mwis.ru, vxvault.siri-urz.net..."

:fear::fear:

[AplusWebMaster]

FYI...

140 exploit, driveby, malicious domains
- http://www.malwaredomains.com/wordpress/?p=2876
September 28th, 2012 - "Added 140 domains associated with drivebys, exploits, etc. Sources include wepawet.iseclab.org, urlvoid.com, sucuri.net, and others..."

:fear:

[AplusWebMaster]

FYI...

250+ Domains...
- http://www.malwaredomains.com/wordpress/?p=2880
October 2nd, 2012 - "Added over 250 domains — iframes, malicious spam, attack sites, etc. Sources: blog.dynamoo.com, safebrowsing.clients.google.com, blog.sucuri.net. etc..."

:fear::fear:

[AplusWebMaster]

FYI...

Sinowal, Sirefef, redkit domains, blackhole, downadup domains
- http://www.malwaredomains.com/wordpress/?p=2885
October 5th, 2012 - "Added 151 domains associated with down adup, blackhole exploits, red kit, sinowal, etc. Sources include threatexpert.com, mwis.ru, safebrowsing.clients.google.com..."

:fear::fear:

[AplusWebMaster]

FYI...

downadup, iframes, torpig malicious spam domains added
- http://www.malwaredomains.com/wordpress/?p=2889
October 8th, 2012 - "Added 167 domains associated with iframe injection, malspam, torpig, DownAdUp, etc. Sources include threatexpert.com, labs.sucuri.net, blog.dynamoo.com..."

:fear::fear:

[AplusWebMaster]

FYI...

work-at-home scam, kuluoz, trojan domains
- http://www.malwaredomains.com/wordpress/?p=2895
October 12th, 2012 - "A bunch of work-at-home, fraud, scam domains added in addition to the usual black hole exploit kit, trojan, and other malicious domains. Sources include malwareurl.com, emergingthreats.net, malwaredomainlist.com..."

:fear:

[AplusWebMaster]

FYI...

176 new domains added
- http://www.malwaredomains.com/wordpress/?p=2905
November 3rd, 2012 - "... Added 176 new domains associated with malspam, malicious redirections, exploits, etc. Sources include hosts-file.net, safebrowsing.clients.google.com, blog.dynamoo.com..."

:fear:

[AplusWebMaster]

FYI...

Big Update – 286 Domains
- http://www.malwaredomains.com/wordpress/?p=2909
November 6th, 2012 - "Added 286 domains from zeustracker.abuse.ch, urlvoid.com, dshield.org, safebrowisng.clients.google.com..."

:fear: :fear:

[AplusWebMaster]

FYI...

113 new domains added
- http://www.malwaredomains.com/wordpress/?p=2914
November 10th, 2012 - "Added 113 new domains (onescan,malspam, pharma) listed at blog.dynamoo.com, dshield.org, support.clean-mx.com and others..."

:fear:

[AplusWebMaster]

FYI...

156 New Rogue, Unsafe, Suspicious Domains
- http://www.malwaredomains.com/wordpress/?p=2919
November 12th, 2012 - "Added 156 new domains from dshield.org, hosts-file.net, urlvoid.com and other sources..."

:fear:

[AplusWebMaster]

FYI...

127 New Malicious Domains
- http://www.malwaredomains.com/wordpress/?p=2921
November 17th, 2012 - "Added 127 new malicious domains from wepawet.iseclab.org, dshield.org, vxvault.siri-urz.net and others..."

:fear:

[AplusWebMaster]

FYI...

Big Update: 211 Serenity Exploit Kit, Malspam, Malicious Domains
- http://www.malwaredomains.com/wordpress/?p=2925
November 20th, 2012 - "Added 211 domains associated with Serenity Exploit Kit, malicious spam,etc from dshield.org, blog.dynamoo.com, malwaremustdie.blogspot.com..."

21,000 (!) JS/RunForestRun/PseudoRandom Domains
- http://www.malwaredomains.com/wordpress/?p=2929
November 21st, 2012 - "The algorithm for creating Pseudo Random RunForestRun domains has been published by malwarereports.blogspot.com (http://malwarereports.blogspot.com) . Full list of domains (21000!) is located here*."
* http://pastebin.com/k3k7ibvJ

:fear::fear:

[AplusWebMaster]

FYI...

DNS-BH - Malware Domain Blocklist
Another big update: 207 domains
- 1 day ago
> received from RSS feed
"207 domains added (iframes, htaccess redirections and other harmful domains) from malwaremustdie.blogspot.com, dshield.org, labs.sucuri.net, etc..."
(Cannot access site - "under constant attack" [DDoS] ...)
Mirror site still available for updates dtd. Nov 22, 2012...

:mad::fear:

[AplusWebMaster]

FYI...

Nov 25 Update: 233 New Domains
> received from RSS feed
"Added 223 suspicious, harmful domains originally referenced in malwaredomainlist.com, safebrowsing.clients.google.com, blog.dynamoo.com and others..."
(Cannot access site - "under constant attack" [DDoS] ...)
"The server at malwaredomains.com is taking too long to respond."
Mirror site still available for updates dtd. Nov 25, 2012...

:fear::fear:

[AplusWebMaster]

FYI...

Another large update – 187 domains
- http://www.malwaredomains.com/?p=2941
November 28th, 2012 - "Add -187- exploit kit, malicious, koobface domains originally listed on ddanchev.blogspot.com, avgthreatlabs.com, dshield.org and other sources..."

:fear:

[AplusWebMaster]

FYI...

exploit special – over 240 domains added
- http://www.malwaredomains.com/?p=2945
December 2nd, 2012 - "Added over 240 domains flagged as coolexploitkit, Nuclearexploitkit, bhexploitkit along with the usual array of malicious domains originally listed at mwis.ru, kahusecurity.com, malwaredomainlist.com..."

:fear::fear:

[AplusWebMaster]

FYI...

malspam, zeus, iceix domains
- http://www.malwaredomains.com/?p=2949
December 5th, 2012 - "Added -116- domains associated with malspam. zeus, iceix, etc. Sources: malwaredomainlist.com, blog.dynamoo.com, vxvault.siri-urz.net and others..."

:fear::fear:

[AplusWebMaster]

FYI...

Over 320 Domains Added
- http://www.malwaredomains.com/?p=2952
December 9th, 2012 - "Added over -320- Domains. Please update your blocklists..."

Joomla (and WordPress) Bulk Exploit ongoing
- http://www.malwaredomains.com/?p=2955
December 10th, 2012 - "Sans reports* that there is an ongoing bulk Joomla and WordPress exploit, complete with iframes pointing to Fake AV. If anyone has seen a published list of the FQDN’s involved in this, please let us know so we can add those domains here."
* https://isc.sans.edu/diary.html?storyid=14677
Last Updated: 2012-12-10 23:17:33 UTC - "... reports and discussion around many Joomla (and some WordPress) sites exploited and hosting IFRAMES pointing to bad places. We'll get to the downloaded in a second, but the interesting thing to note is that it doesn't seem to be a scanner exploiting one vulnerability but some tool that's basically firing a bunch of Joomla and Wordpress exploits at a given server and hoping something hits. We'd like PCAPs or weblogs if you're seeing something similar in your environment. Right now it seems the biggest pain is around Joomla users, particularly with extensions which greatly increase the vulnerability footprint and the one thing helping WordPress is the really nice feature of 1-button upgrades (and upgrades which don't tend to break your website). The IFRAMES seem to have rapidly changing FQDN's* that it is using but the common element is /nightend.cgi?8. Two of the bad IPs that seem to be frequent offenders are 78.157.192.72 and 108.174.52.38. Ultimately it pulls FakeAV software to do it's badness. Mediation is your typical advice, make sure all your software is up-to-date and kept that way on a regular basis. If you have weblogs (particularly verbose ones), I would be interested in seeing them..."
* Fully Qualified Domain Name

Joomla sites misused to deploy malware
- http://h-online.com/-1766841
12 Dec 2012 - "... Joomla site administrators should be sure to check whether they installed the Joomla Content Editor at some point in the past; if they have, they should update it to the current version JCE 2.3.1*. Those who have found an old version should also check any JavaScript files for suspicious iFrames. A quick overview is available via the
find . -print0 -name \*.js | xargs -0 grep -i iframe
command line instruction. This instruction doesn't cover variants in which the iFrame tag is assembled at a later stage via script code, but none of the infected sites that are known to heise Security include such variants. The injected PHP backdoor can often be found at /images/stories/story.php."
* http://www.joomlacontenteditor.net/news/item/jce-231-released

:fear: :mad:

[AplusWebMaster]

FYI...

142 malspam, iframe, joomla exploit, malicious domains
- http://www.malwaredomains.com/?p=2963
December 11th, 2012 - "Added -142- domains associated with malspam, iframe/joomla exploit. Sources include safebrowsing.clients.google.com, blog.dynamoo.com, labs.sucuri.net..."

:fear:

[AplusWebMaster]

FYI...

247 kelihos, runforestrun domains
- http://www.malwaredomains.com/?p=2972
December 14th, 2012 - "247 domains (kelihos, runforestrun and others) were added. Sources include abuse.ch, malwaremustdie.blogspot.com..."
___

citadel, zeus, harmful domains
- http://www.malwaredomains.com/?p=2979
December 16th, 2012 - "Added -189- domains associated with citadel, zeus and other badness. Sources include zeustracker.abuse.ch, spamhaus.org, malwaredomainlist.com, safeweb.norton.com..."

:fear:

[AplusWebMaster]

FYI...

Lots of Malspam Domains
- http://www.malwaredomains.com/?p=2982
December 21st, 2012 - "Added over 150 domains, mainly malicious spam domains from blog.dynamoo.com..."

:fear::fear:

[AplusWebMaster]

FYI...

Large Update – almost 300 domains
- http://www.malwaredomains.com/?p=2986
December 23rd, 2012 - "Added almost -300- domains associated with malicious spam, harmful “safebrowsing” domains, iframes and redirections. Sources include safebrowsing.clients.google.com, labs.sucuri.net, blog.dynamoo.com..."

:fear::fear:

[AplusWebMaster]

FYI...

Huge Update – almost 1000 domains (!)
- http://www.malwaredomains.com/?p=2992
December 26th, 2012 - "Added almost 1000 malicious spam domains from dynamoo’s blog*..."
* http://blog.dynamoo.com/

:fear::fear::fear:

[AplusWebMaster]

FYI...

bhexploitkit, scam, bredolab, malicious iframes
- http://www.malwaredomains.com/?p=2995
December 29th, 2012 - "Added over -230- domains associated with bredolab, blackhole exploit kit, coolexploitkit, nuclearexploitkit, etc. Sources include mwis.ru, safebrowsing.clients.google.com, urlquery.net..."

:fear::fear:

[AplusWebMaster]

FYI...

Lots of malspam and other harmful domains
- http://www.malwaredomains.com/?p=3009
January 2nd, 2013 - "Added 318 domains, mainly from dynamoo.com and safebrowsing.clients.google.com..."

:fear:

[AplusWebMaster]

FYI...

Lots of malspam domains
- http://www.malwaredomains.com/?p=3012
January 5th, 2013 - "Added over -120- domains, mainly malicious spam listed blog.dynamoo.com and other harmful domains listed at vxvault.siri-urz.net and other reputable web sites..."

:fear::fear:

[AplusWebMaster]

FYI...

iframes, redirections, other harmful domains
- http://www.malwaredomains.com/?p=3017
January 8th, 2013 - "Added 185 domains associated with iframes, htaccess redirects, etc..."

:fear:

[AplusWebMaster]

FYI...

TinyBanker, moneymule, exploit domains
- http://www.malwaredomains.com/?p=3021
January 10th, 2013 - "Added over -200- malicious domains (exploit, moneymule, tiny banker, etc) originally listed at ddanchev.blogspot.com, virustracker.info, hosts-file.net, and others..."

:fear::fear:

[AplusWebMaster]

FYI...

bamital, zeroaccess, malspam domains
- http://www.malwaredomains.com/?p=3025
January 12th, 2013 - "Added -440- domains associated with zeroaccess, bamital and malicious spam from virustracker.info and blog.dynamoo.com..."

:fear::fear:

[AplusWebMaster]

FYI...

Over 360 domains added
- http://www.malwaredomains.com/?p=3028
January 15th, 2013 - "Over 360 domains added, mainly multibanker and domains flagged by google safebrowsing..."

:fear::fear:

[AplusWebMaster]

FYI...

gameover zeus domains
- http://www.malwaredomains.com/?p=3032
January 17th, 2013 - "Added -275- domains, mainly zeus_gameover domains from virustracker.info..."

:fear::fear:

[AplusWebMaster]

FYI...

Three Updates – January 18, 20 & 25th…
- http://www.malwaredomains.com/?p=3036
January 26th, 2013 - "Been late on updating this blog. The update on January 18 was -239- domains. January 20th’s update was -233- domains, and the update on January 25th was of -269- domains..."

:fear::fear: :sad:

[AplusWebMaster]

FYI...

iframes, malspam, zbot, g01pack, malvertising domains
- http://www.malwaredomains.com/?p=3051
February 3rd, 2013 - "Added 150+ domains associated with g01pack, malvertising, zbot, spyeye, malspam, etc. Sources include blog.dynamoo.com, urlquery.net, scumware.org and others..."

:fear:

[AplusWebMaster]

FYI...

116 suspicious, malicious domains
- http://www.malwaredomains.com/?p=3058
February 4th, 2013 - "Added 116 domains from blog.dynamoo.com, dshield.org, vxvault.siri-urz.net and others..."

:fear:

[AplusWebMaster]

FYI...

Feb 6, 8, 10 updates
- http://www.malwaredomains.com/?p=3064
February 12th, 2013 - "Feb 6 – 171 new domains added, Feb 8 – 146 new domains added, Feb 10 – 202 new domains added..."

:fear::fear::fear:

[AplusWebMaster]

FYI...

225 Malspam Domains
- http://www.malwaredomains.com/?p=3069
February 13th, 2013 - "Added 225 malicious spam domains from Dynamoo’s awesome blog ( http://blog.dynamoo.com/ )..."

:fear:

[AplusWebMaster]

FYI...

175 new domains
- http://www.malwaredomains.com/?p=3073
February 16th, 2013 - "Added 175 new domains from blog.dynamoo.com, riskanalytics.com, and safebrowsing.clients.google.com..."

:fear:

[AplusWebMaster]

FYI...

CritXPack, zeus, expiro domains
- http://www.malwaredomains.com/?p=3079
February 19th, 2013 - "Added 190+ domains associated with zeus/gameover, expiro_z, CritXPack and other badness. Sources include virustracker.info, hosts-file.net, blog.dynamoo.com and others..."

:fear:

[AplusWebMaster]

FYI...

Malicious iframe domains
- http://www.malwaredomains.com/?p=3087
February 22nd, 2013 - "... two important updates –363- domains added on 2/20 and another -220- added on 2/21 (lots of the malicious iframe domains)..."

:fear::fear:

[AplusWebMaster]

FYI...

146 domains added
- http://www.malwaredomains.com/?p=3094
February 26th, 2013 - "Added 146 domains from malwarepatrol.net, malwareurls.joxeankoret.com, virustracker.info and other sources..."

:fear::fear:

[AplusWebMaster]

FYI...

apt, infostealer, zeus domains added
- http://www.malwaredomains.com/?p=3097
March 1st, 2013 - "Added 200+ domains associated with infostealer/shiz, zeus/gameover, apt domains from mandiant’s intel report. Sources include virustracker.info, intelreport.mandiant.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

230 comment-crew, iframes, bhek domains added
- http://www.malwaredomains.com/?p=3104
March 6th, 2013 - "Added 230 comment crew, iframes, bhek, malspam domains. Sources include blog.dynamoo.com, labs.sucuri.net, symantec.com..."

:fear:

[AplusWebMaster]

FYI...

175+ kelihos and trojan domains
- http://www.malwaredomains.com/?p=3108
March 8th, 2013 - "Added over 175 domains associated with kelihos and other trojans... we added the ones still flagged as malicious by google safebrowsing. Sources: lavasoft.com, deependresearch.org, symantec.com..."

:fear::fear:

[AplusWebMaster]

FYI...

100+ cridex domains added
- http://www.malwaredomains.com/?p=3112
March 11th, 2013 - "Added about 100 cridex domains and another 50 or so associated with other badness. Sources include malwaredomainlist.com, gfisoftware.tumblr.com*, safebrowsing.clients.google.com, blog.dynamoo.com..."

* SPAM screenshots/IPs/URLs to be blocked: http://gfisoftware.tumblr.com/

:fear::fear:

[AplusWebMaster]

FYI...

330 domains added (malspam, bhek…)
- http://www.malwaredomains.com/?p=3118
March 13th, 2013 - "Added -330- new Black Hole, malspam, malicious domains. Sources: riskanalytics.com, riskanalytics.com..."

:fear:

[AplusWebMaster]

FYI...

132 BHEK, APT1, Exploit Domains Added
- http://www.malwaredomains.com/?p=3127
March 15th, 2013 - "Added -132- BHEK, APT1, Exploit domains. Sources include zeustracker.abuse.ch, mwis.ru, safebrowsing.clients.google.com and others..."

:fear:

[AplusWebMaster]

FYI...

citadel, ru:8080, travnet domains...
- http://www.malwaredomains.com/?p=3131
March 18th, 2013 - "Added -159- citadel, ru:8080, travnet domains. Sources: blog.dynamoo.com, blogs.mcafee.com, surfright.nl..."

:fear:

[AplusWebMaster]

FYI...

277 domains added
- http://www.malwaredomains.com/?p=3134
March 21st, 2013 - "Added 277 malspam, phishing and other harmful domains. Sources: riskanalytics.com, safebrowsing.clients.google.com, blog.dynamoo.com and others ..."

:fear:

[AplusWebMaster]

FYI...

apt, citadel, malspam, redirection domains
- http://www.malwaredomains.com/?p=3137
March 24th, 2013 - "Added 200+ domains associated with apt, citadel, malspam, and htaccess redirection. Sources include spamhaus.org, scumware.org, labs.sucuri.net and others..."

:fear:

[AplusWebMaster]

FYI...

Added 175 BHEK, APT, Malspam domains
- http://www.malwaredomains.com/?p=3141
March 28th, 2013 - "Added 175 domains associated with APTs, Malspam, BHEK, etc. Sources: vxvault.siri-urz.net, safebrowsing.clients.google.com, blog.dynamoo.com…"

:fear:

[AplusWebMaster]

FYI...

Added 235 malvertising, malspam, suspicious domains
- http://www.malwaredomains.com/?p=3144
March 30th, 2013 - "Added 235 malvertising, malspam, suspicious domains. Sources: safebrowsing.clients.google.com, blog.dynamoo.com, wepawet.cs.ucsb.edu..."

:fear::fear:

[AplusWebMaster]

FYI...

Huge update – 3000 Zeus domains
- http://www.malwaredomains.com/?p=3153
April 2nd, 2013 - "Added 3000+ ZeuS_Gameover domains listed at virustracker.info. Please update your blocklist..."

:fear::fear:

[AplusWebMaster]

FYI...

487 domains added
- http://www.malwaredomains.com/?p=3158
April 5th, 2013 - "... added 487 new domains from malwareurls.joxeankoret.com and emergingthreats.net..."

:fear:

[AplusWebMaster]

FYI...

malspam, bhek domains
- http://www.malwaredomains.com/?p=3161
April 8th, 2013 - "101 malspam, malicious & bhek domains added..."

:fear::fear:

[AplusWebMaster]

FYI...

citadel, drive-by, Krypt, malvertising, malspam domains…
- http://www.malwaredomains.com/?p=3164
April 12th, 2013 - "Added 102 domains associated with Trojan-Krypt, zeus, malspam, malvertising, citadel… Sources include blog.dynamoo.com, hosts-file.net, mwis.ru and many others..."

:fear:

[AplusWebMaster]

FYI...

Two Updates – 218 New Domains
- http://www.malwaredomains.com/?p=3168
April 16th, 2013 - "Two updates added -218- iframe, redirections, malspam, malvertising domains. Sources: safebrowsing.clients.google.com, labs.sucuri.net, vxvault.siri-urz.net and others..."

:fear::fear:

[AplusWebMaster]

FYI...

Added 400+ domains (4/18 & 4/21). New update in progress.
- http://www.malwaredomains.com/?p=3175
April 22nd, 2013 - "Added 400+ domains 4/18 and 4/21 updates..."

:fear:

[AplusWebMaster]

FYI...

iframes, kelihos, malvertising domains
- http://www.malwaredomains.com/?p=3178
April 25th, 2013 - "Added 121 iframes, kelihos, malvertising, redirection domains from blog.dynamoo.com, labs.sucuri.net..."

:fear:

[AplusWebMaster]

FYI...

Over 550 Domains added
- http://www.malwaredomains.com/?p=3187
May 2nd, 2013 - "... Added 98 domains on 4/26 , 218 domains on 4/27, and 235 domains on 4/30. Malspam, Malvertising, Cdorked, etc..."

:fear::fear:

[AplusWebMaster]

FYI...

155 Zeus, malspam, NAIKON.A domains
- http://www.malwaredomains.com/?p=3191
May 4th, 2013 - "Added 155 domains associated with malicious spam, Zeus, Naikon.A, malicious advertising banners. Sources include zeustracker.abuse.ch, blog.dynamoo.com, blog.trendmicro.com..."

:fear::fear:

[AplusWebMaster]

FYI...

174 Zeus, Mariposa, Harmful Domains
- http://www.malwaredomains.com/?p=3196
May 5th, 2013 - "Added 174 Zeus, Mariposa, safebrowsing domains. Sources: zeustracker.abuse.ch, labs.alienvault.com, ics-cert.us-cert.gov and others..."

:fear::fear:

[AplusWebMaster]

FYI...

malspam, iframe, typosquatting, malvertising domains
- http://www.malwaredomains.com/?p=3204
May 10th, 2013 - "... 98 rogue, malspam, typosquatting, malvertising domains. Sources: isc.sans.edu, blog.dynamoo.com, urlquery.net, blog.sucuri.net..."

:fear:

[AplusWebMaster]

FYI...

Added 167 malspam, iframe, redkit domains
- http://www.malwaredomains.com/?p=3210
May 11th, 2013 - "Added 167 Red Kit, Malicious Spam, iframe domains. Sources include
dynamoo.com (of course), urlquery.net, siteinspector.comodo.com..."

:fear:

[AplusWebMaster]

FYI...

279 Zeus domains added
- http://www.malwaredomains.com/?p=3214
May 14th, 2013 - "Added 279 Zeus domains from zeustracker.abuse.ch..."

:fear::fear:

[AplusWebMaster]

FYI...

SutraTDS, iframe, malvertising,malspam domains
- http://www.malwaredomains.com/?p=3217
May 17th, 2013 - "Added -111- SutraTDS, iframe, malvertising, malspam domains from blog.dynamoo.com, urlquery.net, and some private sources..."

:fear:

[AplusWebMaster]

FYI...

147 pushdo, malvertising, malicious js, iframe domains added
- http://www.malwaredomains.com/?p=3222
May 19th, 2013 - "Added 147 domains associated with malicious javascript, iframes, pushdo, etc. Sources include safebrowsing.clients.google.com, sucuri.net, secureworks.com..."

:fear:

[AplusWebMaster]

FYI...

Redkit, Carberp, facebook scam domains
- http://www.malwaredomains.com/?p=3233
May 22nd, 2013 - "Added 171 Redkit, Carberp, malspam, malicious domains. Sources include urlquery.net, siteinspector.comodo.com, blog.dynamoo.com..."

:fear:

[AplusWebMaster]

FYI...

73 malicious domains ...
- http://www.malwaredomains.com/?p=3245
May 25th, 2013 - "Added 73 malicious domains from siteinspector.comodo.com and safebrowsing.clients.google.com..."

:fear:

[AplusWebMaster]

FYI...

334 domains added ...
- http://www.malwaredomains.com/?p=3249
May 27th, 2013 - "... added 334 domains on 5/27. Fake Flash Player, Rogue, iframes, malspam, c2 etc from siteinspector.comodo.com, threattrack.tumblr.com, urlquery.net and others..."

:fear:

[AplusWebMaster]

FYI...

SutraTDS, malspam, malvertising domains
- http://www.malwaredomains.com/?p=3253
May 30th, 2013 - "Added 121 domains associated with SutraTDS, malicious spam, malicious banner ads. Sources include www.google.com/safebrowsing/diagnostic, vxvault.siri-urz.net, threattrack.tumblr.com..."

:fear:

[AplusWebMaster]

FYI...

redkit, iframe, citadel domains
- http://www.malwaredomains.com/?p=3257
June 4th, 2013 - "Added 80 domains (botnet, citadel, redkit, iframe) from deependresearch.org, siteinspector.comodo.com, malwaremustdie.blogspot.com..."

:fear::fear:

[AplusWebMaster]

FYI...

iframes, malvertising, medfos, net-traveler domains
- http://www.malwaredomains.com/?p=3263
June 7th, 2013 - "Added domains associated with iframes, scrinject, zeus, malvertising, medfos, net-traveler. Sources include hosts-file.net, siteinspector.comodo.com, emergingthreats.net, scumware.org and several others..."

:fear:

[AplusWebMaster]

FYI...

BHEKv2, Neutrino, keyboy malvertising domains…
- http://www.malwaredomains.com/?p=3273
June 11th, 2013 - "Added 107 new domains from a variety of sources… BHEKv2, malspam, keyboy, Neutrino, malicious banner ads, android trojan domains, and all sorts of badness originally cited at blog.dynamoo.com, community.rapid7.com, urlquery.net, emergingthreats.net and others..."

:fear:

[AplusWebMaster]

FYI...

bhek, malvertising, phishing domains
- http://www.malwaredomains.com/?p=3277
June 13th, 2013 - "100+ harmful domains associated with phishing, malvertising, BHEK. Sources: safebrowsing.clients.google.com, malwaregroup.com, phishtank.com..."

:fear:

[AplusWebMaster]

FYI...

124 iframe, malspam, citadel domains
- http://www.malwaredomains.com/?p=3285
June 16th, 2013 - "124 iframe, malspam, citadel and other harmful domains added from blog.dynamoo.com, zeustracker.abuse.ch, emergingthreats.net and other sources..."

:fear:

[AplusWebMaster]

FYI...

278 domains (multibanker, ramnit, sinowal…)
- http://www.malwaredomains.com/?p=3288
June 20th, 2013 - "Added 278 domains (multibanker, ramnit, sinowal, styx, malicious spam, etc) from virustracker.info, blog.dynamoo.com, safebrowsing.clients.google.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

citadel, zeus, styx, iframe domains
- http://www.malwaredomains.com/?p=3293
June 26th, 2013 - "Huge update of -282- domains associated with Zeus, Citadel, Styx, malicious redirections, iframes, and other badness you don’t want on your network or home computer. Sources: labs.sucuri.net, siteinspector.comodo.com, malwaregroup.com, zeustracker.abuse.ch..."

:fear::fear:

[AplusWebMaster]

FYI...

Malicious Spam, Phishing, Multibanker, Malicious Advertising Domains…
- http://www.malwaredomains.com/?p=3298
June 28th, 2013 - "Added 114 domains associated with Phishing, Malicious Ad Banners, sinowal, multibanker, MalSpam, and other badness from blog.dynamoo.com, safebrowsing.clients.google.com, virustracker.info, phishtank.com..."

Suspension - 61 unique domains used by Blackhole Exploit Kit ("closest" type) Crime Group operated on 80.78.247.114 ...
- http://malwaremustdie.blogspot.com/2013/06/suspension-of-61-unique-domains-used-by.html
June 28, 2013 - "... evidence as per recorded in URLQuery records below:
http://urlquery.net/report.php?id=3356618
http://urlquery.net/report.php?id=3356579
http://urlquery.net/report.php?id=3355901
http://urlquery.net/report.php?id=3352167
http://urlquery.net/report.php?id=3332078 ..."

:fear::fear:

[AplusWebMaster]

FYI...

MoneyMule, Redkit, phishing domains…
- http://www.malwaredomains.com/?p=3305
June 30th, 2013 - "Added -184- domains associated with MoneyMule, Redkit, phishing, neutrino, etc. Sources: malwareurls.joxeankoret.com, siteinspector.comodo.com, urlquery.net and others..."

:fear::fear:

[AplusWebMaster]

FYI...

iframes, malicious javascript, malvertising, redirects
- http://www.malwaredomains.com/?p=3309
July 2nd, 2013 - "Added -137- malicious domains (iframes, malicious js, malvertising, malspam, etc) from labs.sucuri.net, blog.dynamoo.com, safebrowsing.clients.google.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

Malspam, Malvertising, redkit domains
- http://www.malwaredomains.com/?p=3314
July 4th, 2013 - "Added 140+ Malspam, Malvertising, redkit and other malicious domains. Sources include emergingthreats.net, safebrowsing.clients.google.com, blog.dynamoo.com..."

:fear::fear:

[AplusWebMaster]

FYI...

Betabot, Citadel, RedKit, TDS Domains…
- http://www.malwaredomains.com/?p=3318
July 7th, 2013 - "Added domains associated with Betabot, Citadel, SutraTDS, RedKit, iframes. Sources include malwareurls.joxeankoret.com, malc0de.com, vxvault.siri-urz.net, exposedbotnets.com..."

:fear:

[AplusWebMaster]

FYI...

citadel, critx, iframe, malicious js domains..
- http://www.malwaredomains.com/?p=3322
July 10th, 2013 - "Added 255 domains associated with malicious javascript, citadel, critx, iframe and other malicious and unsafe activity..."

:fear::fear:

[AplusWebMaster]

FYI...

153 domains added
- http://www.malwaredomains.com/?p=3325
July 12th, 2013 - "153 domains added from blog.dynamoo.com, malwareurls.joxeankoret.com, urlquery.net and others..."

:fear:

[AplusWebMaster]

FYI...

multibanker, phishing, rogues…
- http://www.malwaredomains.com/?p=3329
July 15th, 2013 - "Added 161 domains associated with rogue antivirus/security/software, phishing, malvertising, etc. Sources include: labs.umbrella.com, virustracker.info, phishtank.com..."

:fear::fear:

[AplusWebMaster]

FYI...

styx, citadel, W32.Sality domains
- http://www.malwaredomains.com/?p=3337
July 23rd, 2013 - "Added 120+ domains (W32.Sality, citadel, bhek, styx, etc) from labs.sucuri.net, safebrowsing.clients.google.com, zeustracker.abuse.ch, etc..."

:fear::fear:

[AplusWebMaster]

FYI...

andromeda, cookiebomb, semra, redkit, pony, iframes…
- http://www.malwaredomains.com/?p=3341
July 26th, 2013 - "Added domains associated with zeus, semra, redkit, pony, andromeda, cookiebomb domains. Sources include: vxvault.siri-urz.net, urlquery.net, cybercrime-tracker.net..."

:fear::fear:

[AplusWebMaster]

FYI...

malspam, exploit, phishing domains
- http://www.malwaredomains.com/?p=3345
July 28th, 2013 - "Lots (192) of malicious spam domains from dynamoo.com and other sources..."

:fear::fear:

[AplusWebMaster]

FYI...

Big Update: 280 domains
- http://www.malwaredomains.com/?p=3359
July 31st, 2013 - "Added 280 domains - iframes, malspam, multibanker, Ramnit, redkit etc from blog.dynamoo.com, malc0de.com, urlquery.net, virustracker.info..."

:fear::fear:

[AplusWebMaster]

FYI...

iframes, multibanker, steelrat domains added
- http://www.malwaredomains.com/?p=3371
August 6th, 2013 - "Added almost 200 domains associated with multibanker, iframes, steelrat, ramnit, etc..."

bhek, dnsamplification, sutratds, trojan domains
- http://www.malwaredomains.com/?p=3367
August 5th, 2013 - "A small but important update of domains associated with DNS Amplification, SutraTDS, BHEK, phishing domains and other badness. Sources: blog.dynamoo.com, dnsamplificationattacks.blogspot.com, safeweb.norton.com, mwis.ru, etc..."

:fear::fear:

[AplusWebMaster]

FYI...

malicious spam, malicious banners…
- http://www.malwaredomains.com/?p=3375
August 12th, 2013 - "Added 105 domains (malicious spam, malicious banners, other badness). Sources: threattrack.tumblr.com, safebrowsing.clients.google.com, blog.webroot.com, blog.dynamoo.com..."

:fear::fear:

[AplusWebMaster]

FYI...

Aug 13 Update- 261 Domains; Aug 15 Update: 110 Domains
- http://www.malwaredomains.com/?p=3379
August 17th, 2013 - "Added 261 Domains on Aug 13 and another 110 on Aug 15…"

:fear::fear:

[AplusWebMaster]

FYI...

269 Domains (cookiebomb, iframes, redkit, etc)
- http://www.malwaredomains.com/?p=3382
August 17th, 2013 - "Added 269 domains associated with iframes, downadup, cookie bomb, redkit, malspam, etc. Sources include dynamoo.com, urlquery.net, threatexpert.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

iframes, redirections, malicious javascript
- http://www.malwaredomains.com/?p=3386
August 20th, 2013 - "Added 200+ domains associated with iframes, malicious javascript, htaccess redirections, rogue pharmacies, etc. Sources: app.webinspector.com, labs.sucuri.net, thenewfr0ntier.blogspot.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

8/23 & 8/25 updates – 190 domains
- http://www.malwaredomains.com/?p=3390
August 26th, 2013 - "Updates on 8/23 and 8/25 — 190 new domains..."

:fear::fear:

[AplusWebMaster]

FYI...

140 unsafe, malspam, malvertising domains added
- http://www.malwaredomains.com/?p=3394
August 29th, 2013 - "Added 140 domains associated with malvertising (malicious ad banners) and other badness. Sources: safebrowsing.clients.google.com, blog.dynamoo.com, app.webinspector.com and others..."

:fear:

[AplusWebMaster]

FYI...

94 new domains
- http://www.malwaredomains.com/?p=3398
September 6th, 2013 - "Added 94 new domains. Sorry for the delay in posting..."

:fear:

[AplusWebMaster]

FYI...

malvertising, malspam – 160 Domains
- http://www.malwaredomains.com/?p=3403
September 9th, 2013 - "Added 160 malspam and malvertising domains from blog.dynamoo.com and bluecoat.com ..."

:fear::fear:

[AplusWebMaster]

FYI...

malvertising, zeus, unsafe domains
- http://www.malwaredomains.com/?p=3408
September 11th, 2013 - "Added 151 domains from zeustracker.abuse.ch, app.webinspector.com and other sources..."

:fear::fear:

[AplusWebMaster]

FYI...

150+ Malvertising Domains
- http://www.malwaredomains.com/?p=3411
September 14th, 2013 - "Added over 150 domains associated with malicious advertising and malicious ad banners..."

:fear::fear:

[AplusWebMaster]

FYI...

phishing. iframes. malvertising. malicious js
- http://www.malwaredomains.com/?p=3417
September 18th, 2013 - "Added 134 domains associated with malicious javascript, malicious iframes, phishing, malicious banners, etc. Sources include: labs.sucuri.net, phishtank.com, app.webinspector.com..."

multibanker, dnsamplification, malvertising domains
- http://www.malwaredomains.com/?p=3414
September 16th, 2013 - "Added 174 domains associated with phishing, multibanker, dnsamplification, malvertising and other badness. Sources: virustracker.info, threattrack.tumblr.com, labs.sucuri.net..."

:fear::fear:

[AplusWebMaster]

FYI...

Huge Update… over 200 malspam & iframe domains
- http://www.malwaredomains.com/?p=3423
September 21st, 2013 - "Added -240- malicious (malspame, iframe) domains from ddanchev.blogspot.com, blog.dynamoo.com, and other sources..."

:fear::fear:

[AplusWebMaster]

FYI...

Malicious Redirects, iframes, botnet domains…
- http://www.malwaredomains.com/?p=3427
September 23rd, 2013 - "Added 115 domains – malicious redirections, c&c, iframes, trojans and other badness. Sources include exposedbotnets.com, fireeye.com, urlquery.net..."

:fear::fear:

[AplusWebMaster]

FYI...

100+ zeus, malvertising, DNS Amplification domains
- http://www.malwaredomains.com/?p=3430
September 26th, 2013 - "Added 107 domains associated with DNSAmplification, malvertising, zeus, phishing and other badware you won’t want on your network or loading in your browser. Sources include dnsamplificationattacks.blogspot.com, zeustracker.abuse.ch..."
___

- https://zeustracker.abuse.ch/blocklist.php?download=badips

:fear:

[AplusWebMaster]

FYI...

Big Update: 229 domains (icefog, XtremeRAT, malvertising, etc)
- http://www.malwaredomains.com/?p=3433
September 28th, 2013 - "Added 229 domains (icefog, RAT, malspam, malvertising, etc). Sources include: blog.dynamoo.com, infosecdailydigest.com, fireeye.com..."

:fear::fear:

[AplusWebMaster]

FYI...

149 new domains (exploitkit, redkit, multibanker,etc)
- http://www.malwaredomains.com/?p=3436
September 30th, 2013 - "Added 149 new domains (exploitkit, redkit, multibanker,etc) from app.webinspector.com, vxvault.siri-urz.net, blog.dynamoo.com and other sources..."

:fear:

[AplusWebMaster]

FYI...

October Updates: 260+ domains
- http://www.malwaredomains.com/?p=3438
October 5th, 2013 - "Two updates so far this month, a total of over 260 domains..."

:fear::fear:

[AplusWebMaster]

FYI...

Oct 6 and Oct 11 Updates – 385 domains
- http://www.malwaredomains.com/?p=3440
October 12th, 2013 - "Oct 6th and 11th updates – over 385 domains..."

:fear:

[AplusWebMaster]

FYI...

BHEK, napolar, dnsamplification, cookiebomb domains
- http://www.malwaredomains.com/?p=3443
October 14th, 2013 - "Added domains associated with a variety of badness (cookiebomb, zeus dropzone, win32/napolar, etc) you want to keep off your corporate or home network. Sources include welivesecurity.com, zeustracker.abuse.ch, dnsamplificationattacks.blogspot.com..."

:fear::fear:

[AplusWebMaster]

FYI...

zeus, sweetorange, malspam domains
- http://www.malwaredomains.com/?p=3445
October 19th, 2013 - "Added -100- domains on 10/18 and -121- on 10/16 associated with Zeus, sweetorange, malicous spam, etc. Sources include urlquery.net, blog.dynamoo.com, zeustracker.abuse.ch and others..."

:fear::fear:

[AplusWebMaster]

FYI...

November Updates – Over 1100 malicious domains
- http://www.malwaredomains.com/?p=3467
November 10th, 2013 - "... We’ve added over 1100 malicious domains this month..."
(More info at the URL above.)

:fear::fear:

[AplusWebMaster]

FYI...

betabot, iframes, malvertising, Capha domains
- http://www.malwaredomains.com/?p=3470
November 14th, 2013 - "Added -242- domains on 11/12 and -253- domains on 11/14 (betabot, iframes, malvertising, Capha, etc) from fireeye.com, google.com/safebrowsing, quttera.com, labs.sucuri.net and others..."

:fear::fear:

[AplusWebMaster]

FYI...

254 New Domains + Updated Dynamic DNS List
- http://www.malwaredomains.com/?p=3472
November 16th, 2013 - "Add -254- domains (malvertising, betabot, Capha and other maliciousness) from hosts-file.net, blog.dynamoo.com, exposedbotnets.com and others..."

:fear:

[AplusWebMaster]

FYI...

iframe, ransom, zeus domains
- http://www.malwaredomains.com/?p=3476
November 20th, 2013 - "Added 117 domains associated with cookiebomb, iframe, ransom, zeus, etc. Sources include zeustracker.abuse.ch, webroot.com, safeweb.norton.com..."

:fear:

[AplusWebMaster]

FYI...

272 New Domains (malvertising, zeus, ransomware,Caphaw…)
- http://www.malwaredomains.com/?p=3479
November 23rd, 2013 - "272 new domains added (Caphaw, g01pack, Citadel, malvertising, zeus, ransomware), and other badness you don’t want anywhere in your network or within your browser..."

:fear::fear:

[AplusWebMaster]

FYI...

190 domains added
- http://www.malwaredomains.com/?p=3483
November 25th, 2013 - "Added 190 domains (zeus, google safebrowsing, etc)..."

:fear:

[AplusWebMaster]

FYI...

zeus, neutrino, google safebrowsing domains
- http://www.malwaredomains.com/?p=3486
November 30th, 2013 - "Added -171- domains flagged as zeus, neutrino, and google safebrowsing. Sources include zeustracker.abuse.ch, urlquery.net, google.com/safebrowsing..."

:fear:

[AplusWebMaster]

FYI...

December Updates
- http://www.malwaredomains.com/?p=3491
December 7th, 2013
12/01 – delisted over 7600 domains
12/04 – added 245 domains
12/06 – added 352 domains

:fear::fear::fear:

[AplusWebMaster]

FYI...

Dec 8 & 12th updates
- http://www.malwaredomains.com/?p=3494
December 14th, 2013
"Dec 8 – added 259 domains
Dec 12 – added 993 (!) domains
Malspam, k3chang, myweb, malspam, zeus, etc. Sources: app.webinspector.com, zeustracker.abuse.ch, blog.dynamoo.com, etc..."

:fear::fear:

[AplusWebMaster]

FYI...

Dec 15 & Dec 19 Updates
- http://www.malwaredomains.com/?p=3497
December 20th, 2013
"Dec 15 – added 178 domains;
Dec 19 – Added 137 domains (botnet, scam, malspam, malvertising, iframes). Sources: app.webinspector.com, blog.dynamoo.com, quttera.com, safebrowsing.clients.google.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

Dec Updates – Added 300+ domains
- http://www.malwaredomains.com/?p=3501
December 31, 2013
12/22 – added 87 domains
12/25 – added 245 domains
12/28 – added 56 domains ...
___

- http://www.malwaredomains.com/?p=3504
January 1st, 2014 - "Delisted 9290 domains. Please update your blocklists..."

:fear: :fear:

[AplusWebMaster]

FYI...

zeus, malvertising, sutratds domains
- http://www.malwaredomains.com/?p=3507
January 4th, 2014 - "Added 140+ domains associated with malvertising, zeus, SutraTDS, and other maliciousness. Sources include nictasoft.com, twitter.com/malekal_morte, exposedbotnets.com and others..."


:fear::fear:

[AplusWebMaster]

FYI...

citadel, botnet, scam, malvertising, magnitude domains
- http://www.malwaredomains.com/?p=3510
January 6th, 2014 - "Added -266- domains associated with malvertising, scams, botnets, magnitude exploit kit, etc. Sources include spamhaus.org, aa419.org, scamfraudalert.org, blog.fox-it.com..."

:fear::fear:

[AplusWebMaster]

FYI...

140+ malvertising & malspam domans
- http://www.malwaredomains.com/?p=3514
January 11th, 2014 - "Added over 140 domains, the majoring associated with malicious spam and malicious ad banners..."

:fear::fear:

[AplusWebMaster]

FYI...

malicious spam domains
- http://www.malwaredomains.com/?p=3517
January 17th, 2014 - "... late on this update. Added domains mainly associated with botnet-spam and malspam..."

:fear:

[AplusWebMaster]

FYI...

158 malicious domains
- http://www.malwaredomains.com/?p=3519
January 18th, 2014 - "Added 158 malicious (phishing, crypolocker, etc) domains. Sources include: google.com/safebrowsing, db.aa419.org, malwareurls.joxeankoret.com..."

:fear::fear:

[AplusWebMaster]

FYI...

botnet, winlock, malspam, botnet domains
- http://www.malwaredomains.com/?p=3521
January 21st, 2014 - "Added -108- domains associated with botnet, winlock, malspam, botnets and other maliciousness. Sources include malwareurls.joxeankoret.com, urlquery.net, exposedbotnets.com ..."

:fear::fear:

[AplusWebMaster]

FYI...

Adding Sinkholed Domains to the List
- http://www.malwaredomains.com/?p=3523
January 22nd, 2014 - "We’ve received several requests to add domains already-sinkholed to this list. We’ve also received other requests to remove a domain as it’s already sinkholed. We’d appreciate any thoughts* on the matter. Thanks."
* http://www.malwaredomains.com/?page_id=13

:scratch:

[AplusWebMaster]

FYI...

250+ malvertising and malspam domains
- http://www.malwaredomains.com/?p=3529
January 24th, 2014 - "Added over -250- malvertising and malspam domains..."

:fear::fear:

[AplusWebMaster]

FYI...

430 domains ...
- http://www.malwaredomains.com/?p=3532
February 1st, 2014 - "Added -430- domains from the usual great sources (malwareurls.joxeankoret.com, zeustracker.abuse.ch, blog.dynamoo.com, etc.) These domains are associated with exploit kits, zeus, redkit, iframes, etc – nothing you’d want your browser to access..."

:fear::fear:

[AplusWebMaster]

FYI...

437 Domains ...
- http://www.malwaredomains.com/?p=3536
February 3rd, 2014 - "Another big update, -437- domains. Sources include: spamhaus.org, malwareurls.joxeankoret.com, nictasoft.com..."

:fear:

[AplusWebMaster]

FYI...

200+ browserlock/ransomware domains added
- http://www.malwaredomains.com/?p=3540
February 6th, 2014 - "Added over 400 domains in total… Over 200 were associated with browserlock, ransomware, browlock, etc..."

:fear::fear:

[AplusWebMaster]

FYI...

ransonware, malicious js, linkup domains
- http://www.malwaredomains.com/?p=3543
February 10th, 2014 - "Huge update of over -550- domains associated with linkup, iframes, malicious javascript, ransonware, etc. Sources include malwaredomainlist.com, totalhash.com, labs.sucuri.net, malwr.com, joxeankoret.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

341 new domains (cryptolocker, asprox, carto, jackPOS, etc)
- http://www.malwaredomains.com/?p=3545
February 13th, 2014 - "Added -341- new domains (cryptolocker, asprox, carto, jackPOS, etc). While some of the domains and C&C servers may have been taken down or sinkholed, adding these domains to your internal DNS server resolving to your own web server will help you identify which of your clients are infected on your local network. Sources include blog.dynamoo.com, community.emc.com, malwareurls.joxeankoret.com, rebsnippets.blogspot.com..."

:fear::fear:

[AplusWebMaster]

FYI...

341 New Domains…
- http://www.malwaredomains.com/?p=3549
February 17th, 2014 - "Added -341- new domains. Please update your blocklist..."

:fear::fear:

[AplusWebMaster]

FYI...

ru8080, Neutrino, Malvertising, AnglerEK domains
- http://www.malwaredomains.com/?p=3551
February 20th, 2014 - "Added -294- domains (malspam, malvertising, Angler Exploit Kit, ru 8080, etc) domains on 2/17 and 2/19. Sources include app.webinspector.com, blog.dynamoo.com, webroot.com..."

:fear::fear:

[AplusWebMaster]

FYI...

Botnet spam, Zeus, BHEK, iframes…
- http://www.malwaredomains.com/?p=3557
February 27th, 2014 - "Added 200 domains on 2/22 and 2/24 associated with Black Hole Exploit Kit, Botnet Spam, malicious iframes, etc..."

:fear:

[AplusWebMaster]

FYI...

March Updates
- http://www.malwaredomains.com/?p=3559
March 16th, 2014
March 2 – 86 domains
March 5 – 65 domains
March 9 – 400 domains
March 15 - 195 domains
March 16 – delisted 5206 domains...

:fear:

[AplusWebMaster]

FYI...

MDB Updates ...
- http://www.malwaredomains.com/?p=3567
April 13th, 2014 - "Been a little behind on posting updates due to HeartBleed. There have been several updates this week (4/11 & 4/13), please updates your blocklists..."

:fear:

[AplusWebMaster]

FYI...

April updates ...
- http://www.malwaredomains.com/?p=3570
April 23rd, 2014
4/16 = 232 domains
4/20 = 155 domains
4/22 = 301 domains

:fear:

[AplusWebMaster]

FYI...

Darkcomet, Poisonivy, DGA domains…
- http://www.malwaredomains.com/?p=3572
April 29th, 2014 - "Added over -700- domains associated with njrat, darkcomet, poisonivy, fake flash installers, and other badness. Sources include gist.github.com/jedisct1, malwareconfig.com, dynamoo.com ..."

:fear::fear:

[AplusWebMaster]

FYI...

May Updates
- http://www.malwaredomains.com/?p=3575
May 11th, 2014
"5/2 – almost 400 domains
5/8 – 247 domains ..."

:fear:

[AplusWebMaster]

FYI...

Fake flash, botnet, malspam domains
- http://www.malwaredomains.com/?p=3577
May 14th, 2014 - "Added 247 domains associated with malicious spam, fake flash, botnets. Sources include google.com/safebrowsing, zeustracker.abuse.ch, spamhaus.org and others..."
___

malspam, zeus, botnet domains…
- http://www.malwaredomains.com/?p=3581
May 15th, 2014 - "Added 179 domains (malspam, zeus, botnet,poisonivy, etc). Sources include malwareconfig.com, blog.dynamoo.com and others..."

:fear:

[AplusWebMaster]

FYI...

260 domains added (poisonivy, darkcomet, cryptolocker, etc)
- http://www.malwaredomains.com/?p=3584
May 20th, 2014 - "Added 260 domains sourced from blog.dynamoo.com, www.spamhaus.org, malwareconfig.com..."

:fear:

[AplusWebMaster]

FYI...

Big Update – 486 domains
- http://www.malwaredomains.com/?p=3588
May 24th, 2014 - "Added -486- domains (darkcomet, poisonivy, njrat, etc) sourced from sophos.com, mwsl.org.cn, malwareconfig.com and others.."

:fear::fear:

[AplusWebMaster]

FYI...

Recent Updates
- http://www.malwaredomains.com/?p=3591
June 6th, 2014
5-30 – 335 domains
6-3 - 168 domains
6-6 – 610 domains
___

mirror1 maintenace
- http://www.malwaredomains.com/?p=3594
June 8th, 2014 - "Update: maintenance is completed."
"Maintenance is being performed on mirror1. It may be sporadically offline or out-of-sync with the other mirrors. We anticipate mirror1 will be fully up-and-running this evening."
___

Almost 4000 domains delisted
- http://www.malwaredomains.com/?p=3598
June 8th, 2014 - "Almost 4000 domains have been delisted – please update your blocklists"

:fear:

[AplusWebMaster]

FYI...

cryptolocker, cryptowall, putter panda, nuclear domains
- http://www.malwaredomains.com/?p=3606
June 13th, 2014 - "Added over 200 domains associated with Nuclear EK. Putter Panda, Cryptolocker, Cryptowall… Sources include blogs.cisco.com, gist.github.com, crowdstrike.com..."

:fear: :spider:

[AplusWebMaster]

FYI...

237 domains added
- http://www.malwaredomains.com/?p=3609
June 17th, 2014 - "Added 237 domains from vrt-blog.snort.org, labs.sucuri.net, gist.github.com and others..."

:fear:

[AplusWebMaster]

FYI...

270 Domains (Etumbot, phishing, tds, fragus, redkit)
- http://www.malwaredomains.com/?p=3612
June 23rd, 2014 - "Added 161 domains on 6/18 and 106 domains on 6/22. Sources include app.webinspector.com, arbornetworks.com, safebrowsing.google.com amd others..."

:fear:

[AplusWebMaster]

FYI...

Recent Updates
- http://www.malwaredomains.com/?p=3617
July 1st, 2014 - "Added 295 domains on 6/24 and 320 domains on 6/27. Please update your blocklists..."
___

mirror2 down for maintenance
- http://www.malwaredomains.com/?p=3624
July 5th, 2014 - "mirror2 is down for maintenance. Please use one of our other mirrors..."

:fear::fear:

[AplusWebMaster]

FYI...

6445 domains removed
- http://www.malwaredomains.com/?p=3626
July 6th, 2014 - "List recertification – 6445 domains removed (this may be why some of the files were out-of-sync). Please update your blocklists..."

:fear:

[AplusWebMaster]

FYI...

Recent Updates: smokeloader, shylock domains added
- http://www.malwaredomains.com/?p=3629
July 13th, 2014
7/09 – 441 domains added
7/12 – 226 domains added
Sources include mwsl.org.cn, malwareurls.joxeankoret.com, gist.github.com/jedisct1, stopmalvertising.com and others...

:fear:

[AplusWebMaster]

FYI...

This week’s updates
- http://www.malwaredomains.com/?p=3632
July 21st, 2014 - "Added about -500- domains (malvertising, fake virus alerts and other maliciousness). Sources include mwsl.org.cn, safebrowsing.clients.google.com, app.webinspector.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

malvertising, fiesta, magnitude, zegost domains
- http://www.malwaredomains.com/?p=3639
July 28th, 2014 - "Added domains associated with Rig EK, Fiesta EK, zegost.b, Nuclear EK, malvertising, and other badness. Sources: malware-traffic-analysis.net, isc.sans.org, google.com/safebrowsing, sitecheck.sucuri.net and others..."

:fear::fear:

[AplusWebMaster]

FYI...

3500 Domains Removed
- http://www.malwaredomains.com/?p=3642
August 23rd, 2014 - "3500 domains have been removed. Please update your files."

:fear:

[AplusWebMaster]

FYI...

160 New Domains
- http://www.malwaredomains.com/?p=3644
August 25th, 2014 - "Added 160 new domains flagged as malicious from mwsl.org.cn, yandex.com, and safebrowsing.clients.google.com..."

:fear:

[AplusWebMaster]

FYI...

MDB updates - 8/26, 8/30
- http://www.malwaredomains.com/?p=3647
August 30th, 2014
8/26 – 383 domains
8/30 – 239 domains (including backoff domains)

:fear:

[AplusWebMaster]

FYI...

MDB - Recent Updates
- http://www.malwaredomains.com/?p=3650
September 8th, 2014
9/3 – 170 domains
9/6 – 412 domains
Please update your blocklists...

:fear:

[AplusWebMaster]

FYI...

9/8 and 9/12 Updates
- http://www.malwaredomains.com/?p=3655
September 13th, 2014 - "Added -258- domains on 9/8 and -348- on 9/12 (malvertising, zeus, phishing etc). Sources include mwsl.org.cn, blog.dynamoo.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

Recent Updates
- http://www.malwaredomains.com/?p=3659
September 20th, 2014 - "Added domains on 9/15 and 9/19 from blog.malwarebytes.org, safebrowsing.google.com, app.webinspector.com and others..."

:fear:

[AplusWebMaster]

FYI...

249 domains (goz, luxnet, poisonivy, blackshades) added
- http://www.malwaredomains.com/?p=3661
September 23rd, 2014 - "Added -249- domains (goz, luxnet, poisonivy, blackshades, etc) added. Sources include osint.bambenekconsulting.com, mwsl.org.cn, malwareconfig.com and others..."

:fear:

[AplusWebMaster]

FYI...

Huge Update – 1789 Domains
- http://www.malwaredomains.com/?p=3663
September 25th, 2014 - "... -1789- domains were added two days ago. Sources: www.spamhaus.org, safebrowsing.google.com, osint.bambenekconsulting.com..."

:fear:

[AplusWebMaster]

FYI...

This weeks updates
- http://www.malwaredomains.com/?p=3665
October 4th, 2014 - "9/27 –221- Domains, 10/3 –120- Domains. Sources include: malware-traffic-analysis.net, mwsl.org.cn, feodotracker.abuse.ch, cybercrime-tracker.net..."

:fear:

[AplusWebMaster]

FYI...

Site Delistings
- http://www.malwaredomains.com/?p=3667
October 10th, 2014 - "... too many false positives and we’ve rolled back the last update. Please update your blocklists ASAP..."

:fear:

[AplusWebMaster]

FYI...

Recent Updates
- http://www.malwaredomains.com/?p=3670
October 17th, 2014
10/13 – 64 domains
10/14 – 195 domains
10/17 – 187 domains
Sources: malwareurls.joxeankoret.com, blog.dynamoo.com, spamhaus.org, app.webinspector.com, cybercrime-tracker.net and others ...

:fear: :mad:

[AplusWebMaster]

FYI...

384 New Domains
- http://www.malwaredomains.com/?p=3673
October 20th, 2014 - "Added -384- domains from safebrowsing.clients.google.com, osint.bambenekconsulting.com, sandbox.1d4.us, cybertracker.malwarehunterteam.com and others..."

- http://mirror1.malwaredomains.com/files/

:fear:

[AplusWebMaster]

FYI...

10/23 update: 422 Domains
- http://www.malwaredomains.com/?p=3675
October 24th, 2014 - "Added 422 domains from mwsl.org.cn, pwnedlist, sophos.com and others..."

:fear:

[AplusWebMaster]

FYI...

Another Big Update: 502 Domains
- http://www.malwaredomains.com/?p=3677
October 26th, 2014 - "Added 502 domains from pwnedlist, nictasoft.com, virustotal.com and others..."

:fear:

[AplusWebMaster]

FYI...

313 New domains added
- http://www.malwaredomains.com/?p=3683
October 28th, 2014 - "Added 313 domains from mwsl.org.cn, spamhaus.org and others..."

:fear:

[AplusWebMaster]

FYI...

False Positive removed
- http://www.malwaredomains.com/?p=3687
October 30th, 2014 - "Please update your blocklist, we’ve corrected and removed a false positive (netflix)..."

- http://mirror1.malwaredomains.com/files/

:fear::fear:

[AplusWebMaster]

FYI...

Recent Updates – almost 1000 domains added
- http://www.malwaredomains.com/?p=3692
November 1st, 2014
10/29 – 650 domains added
10/31 – 359 domains added
Sources: spamhaus.org, blog.malwarebytes.org, pwc.blogs.com, malwareurls.joxeankoret.com., mwsl.org and others...

- http://mirror1.malwaredomains.com/files/

:fear::fear:

[AplusWebMaster]

FYI...

tinba, zeus, goz domains added
- http://www.malwaredomains.com/?p=3694
November 3rd, 2014 - "Added 104 domains (tinba, goz, etc) from zeustracker, trendmicro, bambenekconsulting and others..."

- http://mirror1.malwaredomains.com/files/

:fear::fear:

[AplusWebMaster]

FYI...

rogue pharmacy, fake support and other malicious domains
- http://www.malwaredomains.com/?p=3696
November 5th, 2014 - "Added -133- domains (fake support pages, fake pharmacy pages, malware) from spam404.com, safeweb.norton.com, hosts-file.net and others..."

- http://mirror1.malwaredomains.com/files/

:fear:

[AplusWebMaster]

FYI...

359 New Domains
- http://www.malwaredomains.com/?p=3698
November 6th, 2014 - "Added 359 new malicious domains. Sources: mwsl.org.cn, malwareurls.joxeankoret.com..."

- http://mirror1.malwaredomains.com/files/
8-Nov-2014 01:09

:fear:

[AplusWebMaster]

FYI...

CritX, rovnix, GOZ, wirelurker domains
- http://www.malwaredomains.com/?p=3705
November 9th, 2014 - "Added 119 domains associated with WireLurker, GOZ, CritX, Rovnix and others. Sources include malwareurls.joxeankoret.com, blog.malwarebytes.org, paloaltonetworks.com..."

- http://mirror1.malwaredomains.com/files/
9-Nov-2014 16:26

:fear:

[AplusWebMaster]

FYI...

181 new domains – njrat, fake jobs, malspam
- http://www.malwaredomains.com/?p=3707
Nov 10, 2014 - "Added -181- domains associated with fake jobs, malicious spam, njrat, and other badness. Sources: cybertracker.malwarehunterteam.com, malwareurls.joxeankoret.com, threatglass.com and others..."
___

One Million Conficker DGA Domains …
- http://www.malwaredomains.com/?p=3709
Nov 12, 2014 - "We know Conficker/Downadup is years old, but the sad truth is that many organizations still have machines vulnerable to Conficker. We’ve uploaded Conficker/Downadup A-B-C-D DGA domains for November 2014… Over a million of them(!), called conficker_201411xx.zip (Zip file format only). These domains are NOT added any master list. The files are NOT “set it and forget it”… They need to be cleaned up a bit (for example, of any comments). As with any of our lists, use at your own risk (in this case, especially the risk of false positives or blowing up your DNS server). Sources:
- http://net.cs.uni-bonn.de/wg/cs/applications/containing-conficker/
- https://www.alienvault.com/open-threat-exchange/blog/detecting-malware-domains-by-syntax-heuristics ..."

- http://mirror1.malwaredomains.com/files/
11-Nov-2014 17:15

Conficker Online Check: http://four.cs.uni-bonn.de/fileadmin/user_upload/werner/cfdetector/

:fear:

[AplusWebMaster]

FYI...

485 New Domains (darkhotel, kins, angler, njRat, H-worm)
- http://www.malwaredomains.com/?p=3719
Nov 15th, 2014
Update 11/10 – 162 New Domains
Update 11/14 – 323 New Domains
darkhotel, kins, angler, njRat, H-worm, fake flash
Sources: threatglass.com, mwsl.org.cn, malwarehunterteam.com...

- http://mirror1.malwaredomains.com/files/
___

Huge Update: 1108 Domains
- http://www.malwaredomains.com/?p=3722
Nov 16, 2014 - "This week’s “haul” was a total of 1412 domains.
Last night, we added angler, fiesta, kein, simda, zeus and other types of badness you don’t want visiting your computer or corporate network.
1108 domains... added from pwnedlist, joxeankoret, zeustracker, threatexpert and others..."

:fear:

[AplusWebMaster]

FYI...

915 new malicious domains
- http://www.malwaredomains.com/?p=3726
Nov 20, 2014 - "Added 915 domains (zeus, cryptorbit, atrax and other malicious domains), including some onion domains from emergingthreats, virustotal, virustracker.info and other sources..."

> http://mirror1.malwaredomains.com/files/

650 Domains added, 2184 for the week
- http://www.malwaredomains.com/?p=3729
Nov 23, 2014 - "Weekly total: 2184 domains added. 650 of them were added yesterday (onionduke, cryptolocker, and other potentially harmful and malicious domains you don’t want your browser visiting or your systems querying). Sources: pwnedlist, threatglass.com, sensorstechforum.com and others..."

:fear::fear:

[AplusWebMaster]

FYI...

826 New Domains
- http://www.malwaredomains.com/?p=3731
Nov 24, 2014 - "Added -826- New Domains from labs.sucuri.net. zeustracker, pwnedlist and others..."


:fear::fear:

[AplusWebMaster]

FYI...

Big Update – Over 775 domains
- http://www.malwaredomains.com/?p=3743
Nov 27, 2014 - "Added -778- domains (linuxbot, pwnedlist, malspam, etc) from mwsl.org.cn, deependresearch, dynamoo and others..."

> http://mirror1.malwaredomains.com/files/

:fear::fear:

[AplusWebMaster]

FYI...

Recent Updates
- http://www.malwaredomains.com/?p=3754
December 5th, 2014 - "Recent Updates:
12/1 – 108 domains
12/3 – 421 domains
12/4 – 202 domains ..."

> http://mirror1.malwaredomains.com/files/

:fear::fear:

[AplusWebMaster]

FYI...

1283 domains delisted, 1049 added
- http://www.malwaredomains.com/?p=3756
Dec 8th, 2014 - "... 1283 domains were delisted and -1049- added. Please update your blocklists..."

> http://mirror1.malwaredomains.com/files/

:fear::fear:

[AplusWebMaster]

FYI...

This week’s updates
- http://www.malwaredomains.com/?p=3758
Dec 14th, 2014

12/10 – 347 New Domains

12/12 – 849 New Domains

12/13 – 1193 New Domains

:fear::fear:

[AplusWebMaster]

FYI...

Recent Updates
- http://www.malwaredomains.com/?p=3764
Dec 19, 2014 - "Added about 400 domains on 12/16 -and- 12/18 (fake content, fiesta, rogue pharmacies, Get Rich Quick Scams, fraud, etc). Sources include pwnedlist, safebrowsing.google.com, spam404, threatglass and dynamoo..."
___

Big Update – 710 Domains
- http://www.malwaredomains.com/?p=3774
Dec 20, 2014 - "Added 710 domains from pwnedlist, safeweb, vxvault, and others..."

:fear::fear:

[AplusWebMaster]

FYI...

469 Domains
- http://www.malwaredomains.com/?p=3776
Dec 22, 2014 - "469 domains associated with fraud, zeus, Neurevt, an other malicious behavior. Sources include webinspector, safebrowsing, spamhaus, threatlog and more..."


:fear:

[AplusWebMaster]

FYI...

Over 1000 Domains Added
- http://www.malwaredomains.com/?p=3779
Dec 25, 2014 - "Added more than 1000 domains (APT, Angler Exploit Kit, malspam etc) from pwned, spamhaus, dynamoo and others..."

:fear::fear: :blink:

[AplusWebMaster]

FYI...

405 Phishing, browserlock, Malicious domains…
- http://www.malwaredomains.com/?p=3790
Dec 28, 2014 - "405 domains have been added (phishing, a fake FBI “Browserlock” domain, and other malicious domains you don’t want your browser connecting to). Sources include killmalware.com, blog.dynamoo.com, www.mwsl.org.cn and others..."

:fear::fear:

[AplusWebMaster]

FYI...

Over 700 New Domains
- http://www.malwaredomains.com/?p=3792
Dec 31, 2014 - "Added over 700 domains on 12/28 and 12/29. Please update your blocklists..."

:fear:

[AplusWebMaster]

FYI...

1300 Domains RELISTED ...
- http://www.malwaredomains.com/?p=3794
Jan 2, 2015 - "Over 1300 previously delisted domains were found once again to be rated as malicious by google. Many of these domains “pop up” for a while to spread their “badness”, and then “lie low” under the radar, only to come alive again once delisted. Accordingly, these domains have been relisted, as well as “promoted” to the “immortals” or domains which have been consistently associated with malicious activity..."

:fear::fear:

[AplusWebMaster]

FYI...

Recent Updates
- http://www.malwaredomains.com/?p=3796
Jan 12, 2015
1/4 – 199 Domains
1/7 – 136 Domains
1/9 – 323 Domains
1/10 – 212 Domains

:fear:

[AplusWebMaster]

FYI...

Recent Updates
- http://www.malwaredomains.com/?p=3798
Jan 17, 2015
1/14 – 253 domains added
1/16 – 110 domains added

- http://mirror1.malwaredomains.com/files/
18-Jan-2015

:fear:

[AplusWebMaster]

FYI...

shiotob, scieron, tinba domains
- http://www.malwaredomains.com/?p=3804
Jan 26, 2015 - "Added about 300 domains on 1/24 and 1/25 (shiotob, scieron, tinba and other malicious domains) from johannesbader.ch, google safebrowsing, emergingthreats.net, virustotal and others..."

229 New Domains
- http://www.malwaredomains.com/?p=3802
Jan 23, 2015 - "Added 229 new domains (iframes, forum spam, attack pages) from google safebrowsing, malc0de, and sucuri..."

- http://mirror1.malwaredomains.com/files/

:fear::fear:

[AplusWebMaster]

FYI...

364,000 NewGOZ DGA Domains
- http://www.malwaredomains.com/?p=3808
Jan 31st, 2015 - "I took the code from johannesbader .ch and ran it for all of 2015. The results are here**, the code we used is here***..."
** http://mirror2.malwaredomains.com/files/NewGoz_DGA_2015.zip

*** http://mirror2.malwaredomains.com/files/dga.txt

99 new domains (symmi, google safebrowsing)
- http://www.malwaredomains.com/?p=3806
Jan 28th, 2015 - "Added 99 new domains (symmi, google safebrowsing) from www.google.com/safebrowsing and www.johannesbader.ch..."

> http://mirror2.malwaredomains.com/files/

:fear::fear:

[AplusWebMaster]

FYI...

Recent Updates
- http://www.malwaredomains.com/?p=3812
Feb 7, 2015
2/1 – 799 domains
2/3 – 221 domains
2/6 – 56 domains

:fear::fear:

[AplusWebMaster]

FYI...

malspam, dga, phishing domains
- http://www.malwaredomains.com/?p=3816
Feb 16, 2015 - "We’ve added a few hundred domains between 2/8 & 2/15 from dynamoo, mwsl, safebrowsing, openphish.com, zscaler and others..."

:fear:

[AplusWebMaster]

FYI...

260 malspam domains
- http://www.malwaredomains.com/?p=3821
Feb 19, 2015- "Added 260 malicious spam (malspam) and some plain spam domains. Sources: spamhaus.org, mayhemiclabs.com, blog.dynamoo.com..."

:fear:

[AplusWebMaster]

FYI...

nuclear ek, ramdo, sweet orange domains
- http://www.malwaredomains.com/?p=3829
Feb 25, 2015 - "Added 311 domains (nuclear ek, ramdo, sweet orange, fiesta_ek, cryptowall) from malware-traffic-analysis, securelist, emergingthreats and others..."

:fear:

[AplusWebMaster]

FYI...

necurs, h-worm, njrat domains
- http://www.malwaredomains.com/?p=3831
Feb 26, 2015 - "Added 140 necurs, h-worm, njrat, and other malicious domains..."

:fear:

[AplusWebMaster]

FYI...

117 New Domains (superfish and others)
- http://www.malwaredomains.com/?p=3833
Feb 27th, 2015 - "Added 117 new domains (including a bunch of “superfish” domains)."

:fear:

[AplusWebMaster]

FYI...

369 domains added
- http://www.malwaredomains.com/?p=3837
March 1, 2015 - "Added 369 domains (206 on 2/28 and 163 on 2/27)..."

:fear:

[AplusWebMaster]

FYI...

njrat, phishing, malspam domains
- http://www.malwaredomains.com/?p=3840
Mar 5, 2015 - "Added 162 njrat, malicious spam, phishing and attack domains from blog.dynamoo.com, ybertracker.malwarehunterteam.com, openphish.com and others..."

:fear:

[AplusWebMaster]

FYI...

Huge Update: 1000+ Fraud Domains
- http://www.malwaredomains.com/?p=3842
Mar 7, 2015 - "Added over 1000 fraud domains from spamhaus in addition the usual malvertising, and other malicious domains..."
___

Over 16,000 Domains Delisted
- http://www.malwaredomains.com/?p=3844
Mar 9, 2015 - "We did a pretty massive list recertification, and 16235 domains were delisted. Please update your blocklists...

:fear::fear:

[AplusWebMaster]

FYI...

195 New Domains
- http://www.malwaredomains.com/?p=3849
April 4th, 2015 - "Added 195 domains (cutwail, rig ek, flagged as malicious from google safebrowsing, etc). from spamhaus, sans, safeweb, malcode, etc..."
___

- http://www.malwaredomains.com/?p=3847
April 2nd, 2015
... some recent updates:
3/22 – 394 domains added
3/27 - 1136 domains added
3/29 – 729 domains added
3/31 – 906 domains added

:fear::fear:

[AplusWebMaster]

FYI...

cutwail, dyre, zeus, snowshoe domains
- http://www.malwaredomains.com/?p=3855
April 8th, 2015 - "Recently added over 800 new domains from gist.github.com, spamhaus.org and google safebrowsing..."

:fear::fear:

[AplusWebMaster]

FYI...

snowshoe, rokso, attack pages
- http://www.malwaredomains.com/?p=3857
April 9th, 2015 - "Added 430 domains from spamhaus and google safebrowsing (attack pages, rokso, snowshoe, etc)..."

:fear::fear:

[AplusWebMaster]

FYI...

malvertising, phishing domains
- http://www.malwaredomains.com/?p=3859
April 11th, 2015 - "Added 100 domains associated with malicious ads and phishing..."


:fear::fear:

[AplusWebMaster]

FYI...

244 new domains added (phishing, tinba, dyreza, attack pages)
- http://www.malwaredomains.com/?p=3865
April 13th, 2015 - "Added 244 new domains (attack pages, phishing, tinba) from google safebrowsing, virustotal, phishtank and others..."

:fear:

[AplusWebMaster]

FYI...

cryptowall domains (phishing, malspam, trojan, zeus too)
- http://www.malwaredomains.com/?p=3867
April 14th, 2015 - "Added 258 domains (cryptowall, and some zeus, malicious spam, phishing, and other malicious domains). Sources include malwareurls.joxeankoret.com, mwsl.org.cn, threatexpert, and others.."

:fear::fear:

[AplusWebMaster]

FYI...

Palevo, phishing, and other malicious domains
- http://www.malwaredomains.com/?p=3869
April 17th, 2015 - "Added 180 domains (Palevo C&C, phishing, and other malicious badness) from phishtank, openphish, joxeankoret and others..."
___

243 New Domains
- http://www.malwaredomains.com/?p=3871
April 19th, 2015 - "Added 243 domains from joewein, zeustracker, cybertracker, vxvault and other sources containing domains associated with zeus, Andromeda and other badness your browser or your users computers connecting to or from..."

:fear::fear:

[AplusWebMaster]

FYI...

sofacy, kins, tinba, russiandoll domains
- http://www.malwaredomains.com/?p=3873
April 21st, 2015 - "Added 358 domains associated with sofacy, kins, tinba, russiandoll* and other badness which may be used as an IOC by monitoring your server logs. Sources include pwc.blogs.com, google safebrowsing, spamhaus and others..."

* https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html

:fear::fear: