Introducing Malware Domains Filter

[Lanik]

Recently I've been working with Wladimir to host the malware domains filter. It just went live: http://adblockplus.org/blog/blocking-ma ... block-plus
This filter can be downloaded from the filter subscription page: http://adblockplus.org/en/subscriptions (its towards the bottom).
Below are some excerpts from the article:

So now Adblock Plus users can add a subscription with slightly over 40000 filters that will block access to the known malicious domains. It is the first time I tried Adblock Plus with so many filters, and the good news is: the slowdown during browsing is in the area of single-digit millisecond numbers, that’s not noticeable. The bad news: loading/saving the list still takes a while (noticeable as browser startup/shutdown delay). In Firefox 2 this took around 20 seconds which is why I recommend against using this subscription there. The big surprise was Firefox 3, there the delay is only 3-4 seconds. Congratulations to everybody who helped optimizing JavaScript, the results are really incredible!

PLEASE NOTE:

WARNING: Do NOT subscribe to this list with Firefox 2! It will only be sufficiently fast in Firefox 3, and even then you have to accept 3-4 seconds delay at browser startup and shutdown. It won’t cause noticeable delays during browsing however.

Emphasis is mine.

This filter is maintained by the folks over at http://www.malwaredomains.com all we're doing is converting it to a format ABP can understand. Thanks to Wladimir for providing the script which downloads it and coverts it. Also big thanks for helping working out the bugs.

[rick752]

Nice Lanik and Wladimir.

That IS a big list. I'll have to put that on the EasyList page for suggested additional subscriptions.

[Ares2]

Bad start for the list here: 2nd site I opened after adding the list was the Flagfox Forum -> blocked by *.servehttp.com/ . The guy(s) making the list probably didn't know that this is some kind of shared hosting domain. Anyway, FP reported and now continue testing.

[rick752]

That's a bummer. I hope they fix that. I just started using FlagFox and I like it.

[Lanik]

Bad start for the list here: 2nd site I opened after adding the list was the Flagfox Forum -> blocked by *.servehttp.com/ . The guy(s) making the list probably didn't know that this is some kind of shared hosting domain. Anyway, FP reported and now continue testing.

You should tell them to bring their forum over here I got nice and comfy server space for them.

The dev is hosting it from his back yard, me thinks I should donate him a domain, what is that now days $10 for a year.

[Wladimir Palant]

Actually, I don't think it is a false positive. servehttp.com is just an alias for no-ip.com - you can put just about anything under that domain which is wide open for abuse of course. This makes it only logical that various no-ip aliases landed in the malware list. It is inconsistent however - while no-ip.biz. no-ip.org and servehttp.com are entirely blocked, for bounceme.net, dyndns.org or myftp.biz only certain subdomains are on the list.

[rick752]

Sounds like there is a possibility that some whitelisting may be necessary, I take it?

[Wladimir Palant]

Ok, here is what I got: malwaredomains.com will only blacklist entire no-ip domains if the malware subdomains of those get too many. Since the no-ip service is so great for spreading malware, this policy can only get stricter (e.g. by blacklisting all no-ip domains by default). If it were only for flagfox, we could simply add an exception rule for it and forget about it - but unfortunately there are quite a few valuable services running from no-ip. So question is whether we want to have a whitelist for malware domains and who should maintain it then. Alternatively we can leave that up to the users.