MalwareDomainsBlocklists - archived updates

MalwareDomains updated - 2010.12.03...

FYI...

144 domains added
- http://www.malwaredomains.com/wordpress/?p=1453
December 3rd, 2010 - "artro c&c domains, spyeye domains, some rogue domains, and lots of google safebrowsing domains. Sources include safebrowsing.clients.google.com, spyeyetracker.abuse.ch, amada.abuse.ch and others..."

:fear:
 
Last edited:
MalwareDomains updated - 2010.12.14...

FYI...

Malicious javascript, torpig, spyeye domains
- http://www.malwaredomains.com/wordpress/?p=1486
December 14th, 2010 - "domains containing malicious javascript. Domains associated with spyeye, artro or mebroot. A short but important list. Sources include spyeyetracker.abuse.ch, blog.dynamoo.com, www.cs.ucsb.edu/~marc..."

long lived malware domains ...
- http://www.malwaredomains.com/wordpress/?p=1491
December 14th, 2010 - "... Of these 1185 domains, 569, or 48% were deemed as still “worthy” of being kept on the DNS-BH blocklist. That’s 569 harmful domains which were active for over four months. Another analysis occurred in Dec 2010. Of the 569 remaining domains, 150 or 26% were delisted — which means that 74% continued to be associated with badness. There are over 380 domains which have been listed for over a year. Data is here: http://www.malwaredomains.com/files/long_lived_malware_domains_analysis.txt
One observation – there are no rogue security domains on this list."

:fear:
 
Last edited:
ISC urgent blocks ...

FYI...

Urgent Block: NoS.fileave[dot]com and dota2trailer[dot]tk
- http://www.malwaredomains.com/wordpress/?p=1537
January 6th, 2011 - "From the Internet Storm Center*: "dota2trailer .tk claims to have a video trailer for the new Dota 2 game but instead installs a keylogger to steal credentials from gamers… Looking at the code on the site it does try to use java to download “hxxp://NoS. fileave. com/CamPlug.exe” These sites will be blocked on tonight’s update but you shouldn’t wait…"

Fake Game Demo website
* http://isc.sans.edu/diary.html?storyid=10228
Last Updated: 2011-01-06 21:10:19 UTC - "... VirusTotal's url check* didn't show -any- known maliciousness associated with that url..."
* http://www.virustotal.com/url-scan/report.html?id=c6b23afaa80fb96f096cb9b9e6a25012-1294334566
Submission date: 2011-01-06 18:22:46 (UTC)
Antivirus report: View downloaded file analysis
Webscan result: 0/6 (0.0%)
[ Firefox Clean site, G-Data Clean site, Google Safebrowsing Clean site, Opera Clean site, ParetoLogic Clean site, Phishtank Clean site ]
- http://www.virustotal.com/file-scan...2dae38c8a72fe10d25eec53de5189c54bf-1294358709
File name: CamPlug.exe
Submission date: 2011-01-07 00:05:09 (UTC)
Result: 2/43 (4.7%)

1) http://www.mywot.com/en/scorecard/nos.fileave.com
Spam - 1
2) http://www.mywot.com/en/scorecard/dota2trailer.tk
Spam - 1 / Browser exploit - 2

:fear::fear:
 
Last edited:
MalwareDomains updated - 2011.01.06...

FYI...

rogue, geinimi, torpig, android malware sites
- http://www.malwaredomains.com/wordpress/?p=1544
January 6th, 2011 - "Domains associated with piracy, android malware, rogue security,artro, and other stuff you don’t want you or your user’s browser visiting or contacting. Source include securehomenetworks.blogspot.com, vxvault.siri-urz.net/URL_List.php, secuboxlabs.fr..."

:fear:
 
MalwareDomains updated - 2011.01.26...

FYI...

iframe, gumblar, rogue and other malicious domains
- http://www.malwaredomains.com/wordpress/?p=1586
January 26th, 2011 - "Malicious domains associated with zeus, rogue security, gumblar and other nastiness. Sources include securehomenetworks.blogspot.com, blog.unmaskparasites.com, www.shadowserver.org..."

:fear:
 
MalwareDomains updated - 2011.01.29...

FYI...

exploit, gumblar, neosploit, zeus domains
- http://www.malwaredomains.com/wordpress/?p=1590
January 29th, 2011 - "Domains associated with gumblar, zeus, neosploit, spyeye and other exploits and trojan badness. Sources include www3.malekal.com, blog.unmarkparasites, viralerts.com..."

- http://www.malwaredomains.com/wordpress/?p=1597
January 31st, 2011 - "Last night’s “justdomains” file seems to have been corrupted… We just replaced it with a new one..."

:fear:
 
Last edited:
You must log in or register to reply here.
Back
Top