Adserver:

ad.ir.ru

Added, Thanks

Adserver:

ad1.emule-project.org

Hi r00ted,

225979 hostnames, never thought that the Hosts Manager could hold that many. I never tried such a hight count, good to know that the program can hold that many hostnames, I was kinda afraid to encounter a 134 000 limit somewhere. Thanks for letting me know

Kim

Yea, I havent found any issues The only "slow" part is loading up. In that time though I can throw in a load of laundry or what not

Too bad UltraEdit isn't open-sourced That editor is blazing fast.

Thanks MaKaVeLi,

ad1.emule-project.org
www.ad1.emule-project.org

both added

Kim

Adserver:

ads.khokolate.com

Thanks MaKaVeLi, added.

Kim

I was unexpectedly redirected to this ad page when visiting lyrics site tonsoflyrics.com:

s3.filehandler.biz

Thanks Samurai V, added

Kim

Adservers:

web3.cigaraficionado.com
ads.iwangmedia.com
seattle.eham.net

Rogue spyware apps:

www.adwarepatrol.com
adwarepatrol.com
www.xspyware.net
xspyware.net

Added, thanks MaKaVeLi.

Kim

Reported on isc.sans.org as a greeting card scam:

www.bluemountain.com
bluemountain.com

This one wasn't reported as a greeting card scam but I don't think it would hurt to block it:

games.bluemountain.com

This one should be blocked to as they host the images for bluemountain.com and if you go to their site it's just useless text:

www.imgag.com
imgag.com

This is another link from bluemountain.com I got from using the View Page Info in Mozilla Firefox. It just leads to a blank page. Don't think it would hurt to block it:

agbmcom.112.2o7.net

I got this one the same way as the above one but it leads me to a 403 Forbidden page:

ag.eprize.net

These sites either redirect you to already blocked sites or the search results lead to already blocked sites:

www.googl.com
googl.com
www.bgoogle.com
bgoogle.com
www.hgoogle.com
hgoogle.com

Looks like a Google scam site:

www.ggoogle.com
ggoogle.com

Thanks MaKaVeLi, added.

Kim

Rogue spyware apps:

www.prospywareremover.com
prospywareremover.com
www.noadware.com--e.com
noadware.com--e.com
www.wwwadawear.com
wwwadawear.com
www.free-spyware-scan.org
free-spyware-scan.org
www.spybotfinder.com
spybotfinder.com
www.the-spyware-zone.com
the-spyware-zone.com
www.digitalreservoir.com
digitalreservoir.com
www.free-spyware.net
free-spyware.net
www.spyware-control.com
spyware-control.com
www.computerspywarecheck.com
computerspywarecheck.com
www.compare-spyware.com
compare-spyware.com
www.spywareremoval.ws
spywareremoval.ws
www.ridadware.org
ridadware.org
www.elimiware.com
elimiware.com
www.nomorespyware.net
nomorespyware.net
www.123-spyware-remover.com
123-spyware-remover.com
www.spyware-adware-removal.net
spyware-adware-removal.net
www.spytoaster.com
spytoaster.com
www.spywareno.com
spywareno.com
www.3bsoftware.com
3bsoftware.com
www.softwaredoctor.com
softwaredoctor.com

Clickbank websites:

ridadware.noadware.hop.clickbank.net
goose1888.noadware.hop.clickbank.net
goose1888.errornuker.hop.clickbank.net
goose1888.microa2.hop.clickbank.net
goose1888.trekblue8.hop.clickbank.net
goose1888.bugdoctor.hop.clickbank.net
host4net.bugdoctor.hop.clickbank.net
ejseinc.trekblue8.hop.clickbank.net
ejseinc.noadware.hop.clickbank.net
ejseinc.xoftspy.hop.clickbank.net
ejseinc.microa2.hop.clickbank.net
ejseinc.spywarerem.hop.clickbank.net
ejseinc.microa.hop.clickbank.net
ejseinc.adalert.hop.clickbank.net
ejseinc.apatrol.hop.clickbank.net
ejseinc.sdestroy.hop.clickbank.net
ejseinc.arsenal99.hop.clickbank.net
ejseinc.spyferret.hop.clickbank.net
ejseinc.sremoval.hop.clickbank.net
ejseinc.aremover.hop.clickbank.net
ejseinc.axxel.hop.clickbank.net
ejseinc.spyhound.hop.clickbank.net
cb571.noadware.hop.clickbank.net

A link I found related to all the sites above:

abc.cb.kount.com

Thanks MaKaVeLi, added

Kim

Adservers:

banners.sexsearch.com
images.mrskincash.com

Added

Kim

http://www.benedelman.org/spyware/investors/

spectrumequity.com
www.spectrumequity.com
usvp.com
www.usvp.com
greylock.com
www.greylock.com
crosslinkcapital.com
www.crosslinkcapital.com
garage.com
www.garage.com
gbn.com
www.gbn.com
investorab.com
www.investorab.com
tcv.com
www.tcv.com
insightpartners.com
www.insightpartners.com
ticc.com
www.ticc.com

Explicit Material---
User be warned-------

dizgi.vps.gen.tr
mevzu.com

shady sites using mpeg.exe extention...i didn't personally DL the file(s), but im guessing they are viruses......trying to fool novice users.

Thanks r00ted, added

Kim

Also any CP or nasty sites might want to be reported to www.iwf.org.uk

combat18.org #British neo-Nazi organization

Here is a list you might like to look at as well .

http://xthost.info/lemonhead/blacklist.txt

Thanks waterboy990,

I'll have a look at them. If you want to use http://xthost.info/lemonhead/blacklist.txt in a hosts file, be aware as it contains a lot of incorrect formats like:

Rogue spyware apps:

www.endadware.com
endadware.com
www.free-spyware-shield.com
free-spyware-shield.com
www.xoftspyremover.com
xoftspyremover.com
www.spyzooka.com
spyzooka.com
www.remove-spyware.shop-for.us
remove-spyware.shop-for.us
www.xoftspy.co.uk
xoftspy.co.uk
www2.palsol.com

Clickbank websites:

john24.microa2.hop.clickbank.net
www.cbmall.com
cbmall.com
www.cbmallclickbankmarketplace.com
cbmallclickbankmarketplace.com
www.cbmall.co.uk
cbmall.co.uk

These sites either redirect you to already blocked sites or the search results lead to already blocked sites:

www.googgle.com
googgle.com
www.googole.com
googole.com
www.goglee.com
goglee.com
www.gggoogle.com
gggoogle.com

I got a spyware/tracking cookie from them even though they say they're closed:

www.revenuepartners.com
revenuepartners.com

Thanks MaKaVeLi, added

Kim

Banner ad and tracking cookie:

www.affiliatecash.de

Thanks Samurai V, added

Kim

This site appears only to serve ads for about.com:

z.about.com

Thanks Samurai V, added.

Kim

Rogue spyware apps:

www.no-adware.info
no-adware.info
www.spywarecleanerdownload2.com
spywarecleanerdownload2.com
www.spyware-blaster-software.com
spyware-blaster-software.com
www.nukerdownloads.com
nukerdownloads.com
www.spy-bot.biz
spy-bot.biz
www.spyware-killer.com
spyware-killer.com
www.spyware.pcwash.com
spyware.pcwash.com

Links point to already blocked sites:

www.pandasoftware.pillowpc.com
pandasoftware.pillowpc.com
www.270k.com
270k.com
www.top5offers.com
top5offers.com
www.dbxml.org
dbxml.org

Thanks MaKaVeLi, added.

Kim

127.0.0.1 amateur.qn.com

looks to be some sort of search site.

asdasd.qn.com is apparently the same site (same IP)
cluster1.hitfarm.com - same IP


Link to static.hitfarm.com in source code - all over the place

64.40.102.44
Reverse IP: Web server hosts 841334 websites
Reverse DNS: cluster1.hitfarm.com

Thx r00ted

Kim

Banner ads:

assets.bravenet.com

Thanks Samurai V, added.

Kim

fasterxp.com
fasterhomepage.com

Both of the above are affiliated with Aurora spyware according to the most recent entry at vitalsecurity.org

Thanks Samurai V, added.

Kim

some random sites to look into:

127.0.0.1 images.de.vu
127.0.0.1 log3.stats24.net
127.0.0.1 cydots.com
127.0.0.1 www.cydots.com
127.0.0.1 www.nostop.cn.ms # _looks_ good, but too good to be true, the downloads are exes (probably viruses)
127.0.0.1 sexyteens.such.info
127.0.0.1 www.keywordexchange.com # - ads at domain-for-sale page
127.0.0.1 stats24.net
127.0.0.1 impch.tradedoubler.com
127.0.0.1 clk.tradedoubler.com
127.0.0.1 www.ilove.ch
127.0.0.1 hstde.tradedoubler.com
127.0.0.1 www.AccessProtect.com
127.0.0.1 www.actionbook.de
127.0.0.1 www.aliasdomains.com
127.0.0.1 www.Alpennic.com
127.0.0.1 www.nic.at.vu
127.0.0.1 www.chatbook.de
127.0.0.1 www.nic.ch.vu
127.0.0.1 www.cydots.com
127.0.0.1 www.nic.de.vu
127.0.0.1 www.duonic.com
127.0.0.1 www.eguestbook.de
127.0.0.1 www.ePreisvergleich.com
127.0.0.1 www.europnic.com
127.0.0.1 www.ezbook.de
127.0.0.1 www.firevista.com
127.0.0.1 www.freenic.at
127.0.0.1 www.HomeNIC.com
127.0.0.1 www.iboox.com
127.0.0.1 www.joynic.com
127.0.0.1 www.lavanic.com
127.0.0.1 www.mediadots.com
127.0.0.1 www.minibook.de
127.0.0.1 www.multiguestbook.com
127.0.0.1 www.MyShoutbox.com
127.0.0.1 www.netguestbook.com
127.0.0.1 www.nic.de.be
127.0.0.1 www.onlineguestbook.de
127.0.0.1 www.openyoo.com
127.0.0.1 preisvergleich.openyoo.com
127.0.0.1 auktionen.openyoo.com
127.0.0.1 verzeichnis.openyoo.com
127.0.0.1 www.popnic.com
127.0.0.1 www.popunder.de
127.0.0.1 www.Safeurl.de
127.0.0.1 www.shoutbox.at
127.0.0.1 www.shoutbox.de
127.0.0.1 www.shoutbox.us
127.0.0.1 www.shoutboxes.com
127.0.0.1 www.smartdots.com
127.0.0.1 www.statistiq.com
127.0.0.1 www.swissnic.com
127.0.0.1 www.tipdots.com
127.0.0.1 www.kurzurl.de
127.0.0.1 www.unonic.com
127.0.0.1 www.VornamenArchiv.de
127.0.0.1 www.safeurl.de
127.0.0.1 www.dereferrer.com
127.0.0.1 clk.tradedoubler.com
127.0.0.1 hstde.tradedoubler.com
127.0.0.1 impch.tradedoubler.com
127.0.0.1 www.toolbar.de
127.0.0.1 www.nic.ch.vu
127.0.0.1 www.teens.com.au.ms # links to fake "movies"/mpeg/mpg that are actually exe (probably virus/trojans
127.0.0.1 www.everytimes.ch.vu

hxxp://66.98.154.168/movie/index.php
hxxp://80.190.246.106/de - could probably be added to the ads-trackers list, it's used in 1 of these webpage pop ups, and no hostname to block
hxxp://209.152.167.106/movie3/download.php?file=21 - is actually an exe, again, would need to be added to the ads-trackers-bad-porn since the link isn't using a host/dns name
hxxp://www.everytimes.ch.vu/sky_ch.html - going here only gives a pop up

with comments (ofc they are ignored).

All of these sites were closely related. Like, I went to one site, got a pop up that linked to another, and such.

Thx r00ted.

I will look them up and sort them out.

Kim

Rogue spyware app:

www.rebrandsoftware.com
rebrandsoftware.com

Redirects you to already blocked sites:

www.adaware.ca
adaware.ca
www.spysweeper.ca
spysweeper.ca
www.hijackthis.ca
hijackthis.ca
www.spybot.ca
spybot.ca

Exploits the name hijackthis:

www.hijackthis.com
hijackthis.com

Banner ad:

links.raptalk.net

Thanks MaKaVeLi, added

Kim

Redirects you to already blocked sites:

www.adewarepro6.com
adewarepro6.com
www.spycatcher.com
spycatcher.com

Rogue spyware apps:

filescan.searchtracks.com
www.fix-your-own-pc.com
fix-your-own-pc.com

Thanks MaKaVeLi, added.

Kim

nat3.bitcomet.org

BitComet likes hitting this domain (as reported by Outpost).

Nslookup points to 222.89.109.212

Thanks r00ted, I'll add it and I think it should block the connection.

Kim

sans.org reported the following site as a malware downloader:

abcnews-go.com

Banner ads:

images.bfast.com

Thanks Samurai V.

abcnews-go.com is a newsite.