<?php
-// $Id: spam.ini.php,v 1.173 2007/10/13 01:25:05 henoheno Exp $
+// $Id: spam.ini.php,v 1.196 2009/12/13 14:29:02 henoheno Exp $
// Spam-related setting
// NOTE FOR ADMINISTRATORS:
// 'pre': Before the other filters/checkers
$blocklist['pre'] = array(
'goodhost' => FALSE,
+// 'official/dev' => FALSE,
);
// 'list': Normal list
$blocklist['list'] = array(
'A-1' => TRUE, // General redirection services
//'A-2' => TRUE, // Dynamic DNS, Dynamic IP services, ...
- 'B-1' => TRUE, // Web spaces
+ 'B-1' => TRUE, // Web N.M spaces
'B-2' => TRUE, // Jacked contents, something implanted
'C' => TRUE, // Exclusive spam domains
//'D' => TRUE, // "Third party in good faith"s
// --------------------------------------------------
+// Ignorance list
$blocklist['goodhost'] = array(
- // Sample setting of ignorance list
-
'IANA-examples' => '#^(?:.*\.)?example\.(?:com|net|org)$#',
+);
+$blocklist['official/dev'] = array(
// PukiWiki-official/dev specific
- //'pukiwiki.sourceforge.jp',
- //'pukiwiki.org', // Temporary
- //'.logue.tk', // Well-known PukiWiki heavy user, Logue (Paid *.tk domain, Expire on 2008-12-01)
- //'.nyaa.tk', // (Paid *.tk domain, Expire on 2008-05-19)
- //'.wanwan.tk', // (Paid *.tk domain, Expire on 2008-04-21) by nyaa.tk
- //'emasaka.blog65.fc2.com', // Text-to-Impress converter
- //'ifastnet.com', // Server hosting
- //'threefortune.ifastnet.com', // Server hosting
- //'sirakaba.s21.xrea.com', // Ratbeta, known as PukiWiki hacker
- // Yours
- //''
- //''
- //''
-
+ 'pukiwiki.sourceforge.jp',
+ '.nyaa.tk', // (Paid *.tk domain, Expire on 2008-05-19)
+ '.wanwan.tk', // (Paid *.tk domain, Expire on 2008-04-21) by nyaa.tk
+ 'emasaka.blog65.fc2.com', // Text-to-Impress converter
+ 'ifastnet.com', // Server hosting
+ 'threefortune.ifastnet.com', // Server hosting
+ 'sirakaba.s21.xrea.com', // Ratbeta, known as PukiWiki hacker
+ 'desperadoes.biz', // YEAR OF THE CAT, PukiWiki skin designer
);
+
// --------------------------------------------------
// A: Sample setting of
// Existing URI redirection or masking services
// smcurl.com
// "Idiots were using smcURL to shrink URLs and
// send them out via spam."
+ // symy.jp
+ // "One or more users are using our URL redirect
+ // service for spam/botnet.
+ // So we closed this service."
// tinyclick.com
// "...stop offering it's free services because
// too many people were taking advantage of it"
'*.ovp.pl',
'*.6-6-6.pl',
),
+ 'babelfish.altavista.com', ///babelfish/trurl_pagecontent
'amoo.org',
'web.archive.org', ///web/2
'Arzy.net' => array( // "(c) 2007 www.arzy.net", by urladmin at zvxr.com, DNS arzy.net
'athomebiz.com',
'aukcje1.pl',
'beam.to',
+ '*.bebo.com',
'beermapping.com',
'besturl.in',
'bhomiyo.com', ///en.xliterate/ 64.209.134.9(web137.discountasp.net) by piyush at arborindia.com
'biglnk.com',
'bingr.com',
+ 'bit.ly',
'bittyurl.com',
'*.bizz.cc',
'*.blo.pl',
'iat.net', // 74.208.58.130 by Tony Carter
'ibm.com', ///links (Correct it)
'*.iceglow.com',
+ 'internetadresi.com' => array (
+ 'rxbuycheap.com',
+ 'rxcheapwestern.com',
+ ),
'go.id-tv.info', // 77.232.68.138(77-232-68-138.static.servage.net) by Max Million (max at id-tv.info)
'Ideas para Nuevos Mercados SL' => array(
// NOTE: 'i4nm.com' by 'Ideas para Nuevos Mercados SL' (i4nm at i4nm.com)
'linkezy.com',
'linkfrog.net',
'linkook.com',
+ 'linkyme.com',
'linkzip.net',
'lispurl.com',
'lnk.in',
'palurl.com',
'*.paulding.net',
'phpfaber.org',
+ 'pygmyurl.com',
'pnope.com',
'prettylink.com',
'PROXID.net' => array( // also xRelay.net
'*.site.tc',
'*.societe.st',
),
+ 'qqa.jp',
'qrl.jp',
'qurl.net',
'qwer.org',
'rio.st',
'rlink.org',
'*.rmcinfo.fr',
+ 'roo.to', // Seems closed, says "bye-bye"
'rubyurl.com',
'*.runboard.com',
'runurl.com',
'SURL.DK' => array('surl.dk'), // main page is: s-url.dk
'surl.se',
'surl.ws',
- 'symy.jp',
'tdurl.com',
'tighturl.com',
'tiniuri.com',
'*.toolbot.com',
'*.torontonian.com',
'trimurl.com',
- 'ttu.cc',
+ //'ttu.cc', // Seems closed
'turl.jp',
'*.tz4.com',
'U.TO' => array( // ns *.1004web.com, 1004web.com is owned by Moon Jae Bark (utomaster at gmail.com) = u.to master
'*.ever.to',
'*.mini.to',
),
+ 'u-go.to',
'uchinoko.in',
'Ulimit.com' => array(
'*.be.tf',
'*.unixlover.com',
'*.zik.mu',
),
+ 'urltea.com',
'*.uni.cc',
'UNONIC.com' => array(
'*.at.tf', // AlpenNIC
$blocklist['B-1'] = array(
- // B-1: Web spaces
+ // B-1: Web N.M spaces (N > 0, M >= 0)
//
// Messages from forerunners:
// activefreehost.com
//
'*.0000host.com', // 68.178.200.154, ns *.3-hosting.net
'*.007ihost.com', // 195.242.99.199(s199.softwarelibre.nl)
+ '*.007webpro.com', // by richord at ientry.com
'*.00bp.com', // 74.86.20.224(layeredpanel.com -> 195.242.99.195) by admin at 1kay.com
+ '*.0buckhost.com', // by tycho at e-lab.nl
'0Catch.com related' => array(
'*.0catch.com', // 209.63.57.4 by Sam Parkinson (sam at 0catch.com), also zerocatch.com
- // 209.63.57.10(www1.0catch.com) by dan at 0catch.com, ns *.0catch.com
+ // 209.63.57.10(www1.0catch.com) by owner at 100megswebhosting.com, ns *.0catch.com
+ '*.100megsfree5.com',
+
+ // 209.63.57.10(*snip*) by dan at 0catch.com, ns *.0catch.com
'*.100freemb.com', // by Danny Ashworth
+ '*.easyfreehosting.com',
'*.exactpages.com',
'*.fcpages.com',
'*.wtcsites.com',
- // 209.63.57.10(www1.0catch.com) by domains at netgears.com, ns *.0catch.com
+ // 209.63.57.10(*snip*) by domains at netgears.com, ns *.0catch.com
'*.741.com',
'*.freecities.com',
'*.freesite.org',
'*.freewebsitehosting.com',
'*.jvl.com',
- // 209.63.57.10(www1.0catch.com) by luke at dcpages.com, ns *.0catch.com
+ // 209.63.57.10(*snip*) by luke at dcpages.com, ns *.0catch.com
'*.freespaceusa.com',
'*.usafreespace.com',
- // 209.63.57.10(www1.0catch.com) by rickybrown at usa.com, ns *.0catch.com
+ // 209.63.57.10(*snip*) by rickybrown at usa.com, ns *.0catch.com
'*.dex1.com',
'*.questh.com',
- // 209.63.57.10(www1.0catch.com), ns *.0catch.com
+ // 209.63.57.10(*snip*), ns *.0catch.com
'*.00freehost.com', // by David Mccall (superjeeves at yahoo.com)
'*.012webpages.com', // by support at 0catch.com
'*.150m.com',
'*.20me.com',
),
'*.100foros.com',
+ '*.101freehost.com',
'*.12gbfree.com', // 75.126.176.194 by ashphama at yahoo.com
'20six Weblog Services' => array(
'.20six.nl', // by 20six weblog services (postmaster at 20six.nl)
'*.blogandorra.com',
'*.blogangola.com',
'*.blogaruba.com',
+ '*.blogaustria.at',
),
'*.blog.com.es',
'*.blog.hr',
'.cute.cd', // by Yuya Fukuda (count at kit.hi-ho.ne.jp), ns *.2style.jp, *.2style.net
),
'*.canalblog.com', // 195.137.184.103 by dns-admin at pinacolaweb.com
+ '*.cdnhost.cn', // 125.65.112.8, 125.65.112.9, 125.91.1.71 "Content Delivery Network" related? by cc at 51web.cn, seems malware hosting. ns *.dnsfamily.com, no official index.html
'*.chueca.com',
'city-forum.com',
+ '*.clicdev.com',
'*.craigslist.org',
'concepts-mall.com',
'*.conforums.com', // by Roger Sutton (rogersutton at cox.net)
'connectedy.com', // 66.132.45.227(camilla.jtlnet.com) by astrader at insight.rr.com
'counterhit.de',
+ '*.createblog.com',
'*.createforum.net',
'*.creatuforo.com', // by Desafio Internet S.L. (david at soluwol.com)
'*.createmybb.com',
'del.icio.us',
'*.devil.it',
'*.diaryland.com',
+ 'diigo.com', ///user/
'digg.com',
'digstock.com',
'domains at galaxywave.net' => array(
'*.ekiwi.de',
'*.eamped.com', // Admin by Joe Hayes (joe_h_31028 at yahoo.com)
'.easyfreeforum.com', // by XT Store Sas, Luca Lo Bascio (marketing at atomicshop.it)
+ '*.easyjournal.com',
'*.ebloggy.com',
'enunblog.com',
'*.epinoy.com',
'*.free-25.de',
'*.free-bb.com',
'Free-Blog-Hosting.com' => array(
- 'free-blog-hosting.com', // by Robert Vigil (ridgecrestdomains at yahoo.com), ns *.phpwebhosting.com
- 'cheap-web-hosting-411.com', // by Robert Vigil, ns *.thisismyserver.net
- 'blog-tonite.com', // ns *.phpwebhosting.com
- 'blogznow.com', // ns *.phpwebhosting.com
- 'myblogstreet.com', // by Robert Vigil, ns *.phpwebhosting.com
- 'blogbeam.com', // by Robert Vigil, ns *.phpwebhosting.com
+ '*.free-blog-hosting.com', // by Robert Vigil (ridgecrestdomains at yahoo.com), ns *.phpwebhosting.com
+ '*.blog-tonite.com', // ns *.phpwebhosting.com
+ '*.blogznow.com', // ns *.phpwebhosting.com
+ '*.myblogstreet.com', // by Robert Vigil, ns *.phpwebhosting.com
+ '*.blogbeam.com', // by Robert Vigil, ns *.phpwebhosting.com
),
'*.free-forums.org', // 209.62.43.2(ev1s-209-62-43-2.ev1servers.net) by Teodor Turbatu (tteo at zappmobile.ro)
'free-guestbook.net',
'*.free-site-host.com', // by CGM-Electronics (chris at cgm-electronics.com)
'freebb.nl',
'*.freeclans.de',
+ '*.freehostplace.com', // by contact at keepclear.co.uk
'*.freelinuxhost.com', // by 100webspace.com
'*.nofeehost.com',
'*.freehyperspace.com',
'freewebsfarms.com',
),
'*.freewebspace.net.au',
+ 'freewebtown.com',
'*.freemyforum.com', // by messahost at gmail.com
'freepowerboards.com',
'*.freepowerboards.com',
'*.30mb.com', // 207.210.82.74(cpanel.90megs.com) by 30MB Online (63681 at whois.gkg.net), introduced as one alternative of 90megs.com
'*.90megs.com', // 207.210.82.75 by Get Better Hosting (admin at getbetterhosting.com)
),
+ '*.gexxe.com',
'*.goodboard.de',
'gossiping.net',
'*.greatnuke.com',
'Google.com' => array(
'*.blogspot.com',
'docs.google.com',
+ '*.googlegroups.com', ///web/
'*.googlepages.com',
'groups-beta.google.com',
+ 'groups.google.*', ///group/ Seems widely distributed
+ //'groups.google.ca', 'groups.google.com', 'groups.google.co.uk',
+ //'groups.google.de', 'groups.google.es', 'groups.google.fr',
+ //'groups.google.it', ...
),
'guestbook.at',
'club.giovani.it',
'*.joolo.com',
'*.journalscape.com',
'*.justfree.com',
- '*.blog.kataweb.it',
+ 'kataweb.it' => array( // kata-redir.kataweb.it
+ '*.blog.kataweb.it',
+ '*.repubblica.it',
+ ),
'*.kaixo.com', // blogs.kaixo.com, blogak.kaixo.com
'*.kokoom.com',
'koolpages.com',
'*.kostenlose-foren.org',
'*.ksiegagosci.info',
+ 'LaCoctelera.com' => array(
+ 'lacoctelera.com', // by alberto at the-cocktail.com
+ 'espacioblog.com', // by dominios at ferca.com
+ ),
'Lide.cz' => array(
'*.lide.cz',
'*.sblog.cz',
),
+ '*.lioru.com',
'limmon.net',
+ 'linkinn.com',
'lipstick.com', // 208.96.53.70(customer-reverse-entry.*) by domain_admin at advancemags.com
'listible.com', ///list/
'Livedoor.com' => array(
),
'mojklc.com',
'*.mundoforo.com',
+ '*.money-host.com',
'MonForum.com' => array(
'*.monforum.com',
'*.monforum.fr',
'.aim.to',
'.djmp.jp',
'.nihongourl.nu',
+ '.url.sh', // Says SmarTrans
'.urljp.com',
'.www1.to',
'.www2.to',
'*.wizhoo.com', // by Comp U Door (sales at comp-u-door.com)
'*.wmjblogs.ru',
'*.wordpress.com',
- '.wsboards.com', // by Chris Breen (Cbween at gmail.com)
+ //'.wsboards.com', // Noticed this site had been removed due to spam
'xeboards.com', // by Brian Shea (bshea at xeservers.com)
'*.xforum.se',
'xfreeforum.com',
'*.your-websites.net',
'*.web-space.ws',
),
+
+
+ '*.heliohost.org', // by ashoat at gmail.com
+ 'X10Hosting.com' => array(
+ // by support at clockworkcomputers.com
+ '*.x10hosting.com',
+ '*.elementfx.com',
+ '*.exofire.net',
+ '*.pcriot.com',
+ ),
+ '.zendurl.com', // by ajcar1992 at gmail.com
);
// --------------------------------------------------
'alwanforthearts.org',
'*.anchor.net.au',
'anewme.org',
+ 'arcrockett.com', ///golf/excel/
+ 'arisedesign.net', //Portfolio/d981/
'internetyfamilia.asturiastelecentros.com',
+ 'ballblair.com', ///images/thumbs/
'Ball State University' => array('web.bsu.edu'),
'btofaq.net', ///v3/forum
'blepharospasm.org',
+ 'brettforrest.com', // 72.10.43.226 by brettforrest at hotmail.com, ns *.mediatemple.net
'nyweb.bowlnfun.dk',
'*.buzznet.com',
+ 'Carroll College' => array(
+ 'carroll.edu', ///boards/
+ ),
'*.canberra.net.au',
'castus.com',
'Case Western Reserve University' => array('case.edu'),
'ceval.de',
'chaco.gov.ar',
+ 'chasingrainbowsaustralia.com', ///geometry/
'codespeak.net',
'Colorado School of Mines' => array('ticc.mines.edu'),
'*.colourware.co.uk',
'delayedreaction.org',
'deproduction.org',
'dc503.org',
+ 'dialadeck.com', ///images/
'dre-centro.pt',
'Duke University' => array('devel.linux.duke.edu'),
'*.esen.edu.sv',
'forums.drumcore.com',
'dundeeunited.org',
'energyglass.com.ua',
+ 'equitas.com.au', ///images/mim3/, no index.html
'exclusivehotels.com',
'info.ems-rfid.com',
+ 'fairyfunkyard.com', ///images_files/files/
'farrowhosting.com', // by Paul Farrow (postmaster at farrowcomputing.com)
'fbwloc.com',
'.fhmcsa.org.au',
'Harvard Law School' => array('blogs.law.harvard.edu'),
'helpiammoving.com',
'homepage-dienste.com',
+ '*.hostistry.com', // by support at hostistry.com, hostistry at gmail.com
'Howard University' => array('networks.howard.edu'),
'hullandhull.com',
'Huntington University' => array('huntington.edu'),
'huskerink.com',
'.hyba.info',
+ 'ideas4you.com', ///photos/
'inda.org',
'*.indymedia.org', // by abdecom at riseup.net
'instantbulletin.com',
'skkustp.itgozone.com', // hidden JavaScript
'jazz2online.com',
'.jloo.org',
+ '.juegohq.com', // 62.37.117.18(*.static.abi.uni2.es) by admin at juegohq.com, gamble
+ 'kjon.com',
'Kazan State University' => array(
'dir.kzn.ru',
'sys.kcn.ru',
'Loyola Marymount University' => array('lmu.edu'),
'forum.lixium.fr',
'macfaq.net',
+ 'macvirus.org', ///board/
'me4x4.com',
'microbial-ecology.net',
'minsterscouts.org',
'hlc.ncat.edu',
),
'placetobe.org',
+ 'Naropa University' => array(
+ 'naropa.edu', ///forum/
+ ),
'users.nethit.pl',
'nightclubvip.net',
'njbodybuilding.com',
'nlen.org',
+ 'North Carolina School of Science and Mathematics' => array(
+ 'neverland.ncssm.edu', ///include/web/forum/
+ 'grid.ncssm.edu', ///ncssm_grid/
+ ),
'Sacred Heart Catholic Primary School' => array('sacredheartpymble.nsw.edu.au'),
+ 'ofcourseimright.com', ///cgi-bin/roundup/calsify/
'offtextbooks.com',
'ofimatika.com',
+ 'olympiafoto.com', ///images/
'omakase-net', // iframe
'omikudzi.ru',
'openchemist.net',
'preform.dk',
'privatforum.de',
'publicityhound.net',
+ 'puppylinux.net', ///news/content/counter/pages/
'qea.com',
'rbkdesign.com',
'rehoboth.com',
'ryanclark.org',
'*.reallifelog.com',
'rkphunt.com',
+ 'rso-csp.org', ///bulletins/
'.saasmar.ru', // Jacked. iframe to banep.info on root, etc
'sapphireblue.com',
'saskchamber.com',
'savevoorhees.org',
+ 'sdhmalenovice.cz', //galerie/
'selikoff.net',
'serbisyopilipino.org',
'setbb.com',
'tuathadedannan.org',
'txgotg.com',
'tzaneen.co.za',
+ 'ugeavisen.com', ///style/
'forums.ugo.com',
'whole.cs.unibo.it',
'The University of North Dakota' => array(
'University of California' => array('classes.design.ucla.edu'),
'University of Nebraska Lincoln' => array('ftp.ianr.unl.edu'),
'University of Northern Colorado' => array('unco.edu'),
+ 'University of North Carolina' => array(
+ 'elm.cis.uncw.edu' ///testBoinc/
+ ),
'University of Toronto' => array(
'environment.utoronto.ca',
'grail.oise.utoronto.ca',
'utsc.utoronto.ca',
),
+ 'University of Wisconsin' => array(
+ 'einstein.phys.uwm.edu'
+ ),
'urgentclick.com',
'vacant.org.uk',
'Villa Julie College' => array('www4.vjc.edu'),
'.xthost.info', // by Michael Renz (dhost at mykuhl.de)
'Yahoo.com' => array(
'blog.360.yahoo.com',
- '*.groups.yahoo.com'
+ '*.groups.yahoo.com', ///group/ * = es, finance, fr, games, lauch, ...
),
'yasushi.site.ne.jp', // One of mixedmedia.net'
'youthpeer.org',
'.camdoors.info', // by Sergey
'.chatdoors.info', // by Sergey
- '.lebedi.info', // by Pronin
- '.loshad.info', // by Pronin
- '.porosenok.info', // by Pronin
- '.indyushonok.info', // by Pronin
- '.kotyonok.info', // by Pronin
- '.kozlyonok.info', // by Pronin
- '.magnoliya.info', // by Pronin
- '.svinka.info', // by Pronin
- '.svinya.info', // by Pronin
- '.zherebyonok.info', // 89.149.206.225 by Pronin
+ // 89.149.206.225 by Pronin
+ '.dorozhka.info',
+ '.kolonochka.info',
+ '.knizhechka.info',
+ '.krantik.info',
+ '.lebedi.info',
+ '.loshad.info',
+ '.pechenka.info',
+ '.porosenok.info',
+ '.indyushonok.info',
+ '.kotyonok.info',
+ '.kozlyonok.info',
+ '.magnoliya.info',
+ '.svinka.info',
+ '.svinya.info',
+ '.televizorchik.info',
+ '.tumbochka.info',
+ '.zherebyonok.info',
'.medvezhonok.org', // 89.149.206.225 "BucksoGen 1.2b"
'aakin at yandex.ru' => array(
// 89.149.206.225(*.internetserviceteam.com) by Baer
'.entirestar.com',
+ '.joppperl.info',
+ '.onlinedrugsdirect.com',
+ '.pilkazen.info',
'.superbuycheap.com',
+ '.supersmartdrugs.com',
+ '.thecheappillspharmacy.com',
'.topdircet.com',
),
'newblog9 at gmail.com' => array( // by jiuhatu kou
'.fateback.com',
'.undonet.com',
'.yoll.net',
+ '.sinfree.net', // 216.65.1.201 by LiquidNet Ltd. (support at propersupport.com), redirect to www.japan.jp
// 50webs.com // 64.72.112.10
// dns2.50webs.com // 64.72.112.11
'.wifuj.com',
'.xijyt.com',
'.zuqyn.com',
+
+ '.mosugy.com',
),
'jakaj ay hotmail.com' => array( // 66.232.113.46, the same approach and timing of clickx at bk.ru
'.hitsearching.info',
// 66.232.120.98(host.radiantdomain.com => 71.6.196.202 => fc6196202.aspadmin.net)
'.ligiwa.com',
+
+ '.mubeho.com',
),
'ice--man at mail.ru related' => array(
// 74.50.97.198 by andrey, the same approach and timing of clickx at bk.ru
'.bovorup.cn',
'.litotar.cn',
'.nihydec.cn',
-
+
// 66.232.112.175 by bing-32 at ftunez.org
'.lasyxy.cn',
+ // by bing-65 at ftunez.org
+ '.coxyvuk.cn', // 66.232.120.111(non-existent)
+ '.comygyx.cn', // 66.232.120.112(non-existent)
+ '.gyqalec.cn', // 66.232.120.114(non-existent)
+ '.paluwir.cn', // 66.232.120.114(non-existent)
+ '.qunonid.cn', // 66.232.120.114(*snip*)
+ '.qupyvin.cn', // 66.232.120.115(non-existent)
+ '.ririjyz.cn', // 66.232.120.111(*snip*)
+ '.saralar.cn', // 66.232.120.113(non-existent)
+ '.vawomyl.cn', // 66.232.120.115(non-existent)
+
// 69.46.23.48 by clarkson-34 at ftunez.org
'.bumora.cn',
'.byxite.cn',
'.xizity.cn',
'.xuxusa.cn',
+ // by entretov-28 at ftunez.org
+ '.hotejen.cn', // 66.232.120.111(*snip*)
+ '.kyhadat.cn', // 66.232.120.115(*snip*)
+
// 69.46.23.48 by entretov-32 at ftunez.org
'.cihuji.cn',
'.deqyve.cn',
'.dozoda.cn',
'.nemipu.cn',
+ // entretov-84 at ftunez.org
+ '.muruvun.cn', // 66.232.120.114(*snip*)
+ '.favulol.cn', // 66.232.120.115(*snip*)
+ '.tixuqyx.cn', // 66.232.120.111(*snip*)
+
// 69.46.23.48 by jeremy-57 at ftunez.org
'.duzele.cn',
'.figede.cn',
'.wotyqo.cn',
'.xudoli.cn',
+ // by entretov-28 at ftunez.org
+ '.xevavuv.cn', // 66.232.120.113(*snip*)
+
+ // by entretov-37 at ftunez.org
+ '.sadyroz.cn', // 66.232.120.114(*snip*)
+ '.zedutox.cn', // 66.232.120.112(non-existent)
+
// 66.232.112.175 by entretov-86 at ftunez.org
'.faweji.cn',
'.jypaci.cn',
'.qiwysu.cn',
'.tutysy.cn',
+ // by oker-74 at ftunez.org
+ '.navufol.cn',
+
+ // by oker-97 at ftunez.org
+ '.dohakot.cn', // 66.232.127.126(yourbusiness.ME-127.com)
+ '.mesyvuc.cn', // 66.232.120.111(*snip*)
+ '.nyjyzup.cn', // 66.232.127.126(*snip*)
+ '.qagibit.cn', // 66.232.120.114(*snip*)
+ '.rovazaw.cn', // 66.232.120.112(*snip*)
+ '.tozojug.cn', // 66.232.120.111(*snip*)
+ '.xywataw.cn', // 66.232.120.112(*snip*)
+
+ // by polet-20 at ftunez.org
+ '.mopoxon.cn', // 66.232.127.126(*snip*)
+
// 66.232.112.175 by sabrosky-49 at ftunez.org
'.gywiqe.cn',
'.jotapo.cn',
'.jywixa.cn',
- // '69.46.23.48 by sabrosky-60 at ftunez.org
+ // 69.46.23.48 by sabrosky-60 at ftunez.org
'.bawegap.cn',
'.buremyl.cn',
'.cilybut.cn',
'.jytame.cn',
'.wygete.cn',
),
+ '74.50.97.*' => array(
+ '.kaqeje.com', // 74.50.97.51(non-existent) by abuse-here at inbox.ru
+ '.cumimo.com', // 74.50.97.51(non-existent) by olga at ike.com
+ '.kaxavo.com', // 74.50.97.52(non-existent) by gunter at ftunez.org
+ '.hoheru.com', // 74.50.97.52(non-existent) by gunter at ftunez.org
+ '.tyqoti.com', // 74.50.97.52(non-existent) by anna at hotmail.com
+ '.fupopu.com', // 74.50.97.53(non-existent) by abuse-here at inbox.ru
+ '.poxupo.com', // 74.50.97.53(non-existent) by inna at gmail.com
+ '.kuluvo.com', // 74.50.97.53(non-existent) by gunter at ftunez.org
+ '.wugoba.com', // 74.50.97.53(non-existent) by abuse-here at inbox.ru
+ '.civuhe.com', // 74.50.97.54(non-existent) by olga at ike.com
+ '.zasuly.com', // 74.50.97.54(non-existent) by olga at ike.com
+ '.liwowu.com', // 74.50.97.54(non-existent) by abuse-here at inbox.ru
+ '.vobime.com', // 74.50.97.55(non-existent) by inna at gmail.com
+ '.nyrive.com', // 74.50.97.55(non-existent) by anna at hotmail.com
+ '.hehepu.com', // 74.50.99.245(non-existent) by abuse-here at inbox.ru
+ '.bynute.com', // 74.50.99.245(non-existent) by abuse-here at inbox.ru
+
+ '.sevimy.com', // 66.232.124.12(time-out) by inna at gmail.com
+ '.gapubo.com', // 66.232.124.12(time-out) by gunter at ftunez.org
+ '.vejoku.com', // 66.232.124.12(time-out) by olga at ike.com
+ '.qysahu.com', // 66.232.124.12(time-out) by abuse-here at inbox.ru
+ '.hidolu.com', // 66.232.124.13(time-out) by inna at gmail.com
+ '.tetace.com', // 66.232.124.13(time-out) by gunter at ftunez.org
+ '.vuxilu.com', // 66.232.124.13(time-out) by olga at ike.com
+ '.teboca.com', // 66.232.124.13(time-out) by olga at ike.com
+ '.dizive.com', // 66.232.124.14(time-out) by olga at ike.com
+ '.peduxe.com', // 66.232.124.14(time-out) by gunter at ftunez.org
+ '.sybyna.com', // 66.232.124.14(time-out) by gunter at ftunez.org
+ '.bepofe.com', // 66.232.124.15(time-out) by anna at hotmail.com
+ '.kuloja.com', // 66.232.124.15(time-out) by gunter at ftunez.org
+ '.tetadu.com', // 66.232.124.15(time-out) by inna at gmail.com
+ '.qilato.com', // 66.232.124.15(time-out) by inna at gmail.com
+ '.lobimi.com', // 66.232.124.16(time-out) by olga at ike.com
+ '.tazuwe.com', // 66.232.124.16(time-out) by olga at ike.com
+ '.pihufo.com', // 66.232.124.16(time-out) by olga at ike.com
+ '.decewa.com', // 66.232.124.16(time-out) by gunter at ftunez.org
+
+ '.lynymu.com', // 206.51.226.194(time-out) by abuse-here at inbox.ru
+ '.saciqo.com', // 206.51.226.194(time-out) by olga at ike.com
+ '.zalajy.com', // 206.51.226.194(time-out) by inna at gmail.com
+ '.hisimy.com', // 206.51.226.194(time-out) by inna at gmail.com
+ '.qysowe.com', // 206.51.226.194(time-out) by olga at ike.com
+ ),
'nijeoi at hotmai.com' => array(
// 66.232.126.74 by Nicol Makerson, the same approach and timing _and IP_ of clickx at bk.ru
'.bowij.com',
// 66.232.97.246(host4.blazegalaxy.com => 71.6.196.202)
'.pufeqa.com',
+
+ '.xehymi.com',
),
'niichka at hotmail.com' => array(
// 66.232.113.44, the same approach and IP of clickx at bk.ru
'.tedstate.info', // "Free Web Hosting"
'.giftsee.com',
),
+ 'admin at pertol.info' => array(
+ // 81.0.195.189 "Free Web Hosting"
+ '.laparka.cn',
+ '.mirlos.cn',
+ '.oldmoms.cn',
+
+ // 217.11.233.64(timed-out)
+ '.ejmpep.cn', // by admin at pertol.info
+ '.ytere.cn', // by admin at x2t.com
+
+ '.pertol.info', // 72.232.246.202(*.static.reverse.ltdomains.com) by partner at pornography-world.com
+ '.pornography-world.com', // 72.232.246.205(*.static.reverse.ltdomains.com) by admin at pornography-world.com, ns *.pertol.info
+
+ // 209.67.218.106(*.static.reverse.ltdomains.com) by partner at pornography-world.com, ns *.peraonline.info
+ '.new-greece-travel.com',
+ '.peraonline.info',
+
+ '.barkman.cn',
+ ),
+
'aofa at vip.163.com' => array(
'.bdjyw.net', // by gaoyun, infected images, iframe to 5944.net's VBScript
'.5944.net',
'.wfe7nv.org',
'.xyr99yx.org',
),
- '203.171.230.39' => array( // registrar bizcn.com, iframe + cursor
+ '203.171.230.39' => array(
+ // by 51shell at 163.com
+ '.amatou-fc2.com',
+
+ // registrar bizcn.com, iframe + cursor
'.playonlinenc.com',
'.playboss-jp.com',
),
'.govnosaklo.info',
'.muflon.info',
'.termitnik.info',
+ '.tugosos.info', // 206.53.51.77(www.bmezine.com -> ..)
),
'84.252.148.80' => array( // 84.252.148.80(heimdall.mchost.ru)
'.acronis-true-image.info',
'.pharmacyonlinenet.com', // 216.195.51.59, hidden JavaScript
'.ringtonecooler.com', // 217.11.233.34
),
- 'dfym at dfym.cn' => array( // by chen jinian (dfym at dfym.cn)
- '.okwit.com', // 220.166.64.44
- '.sakerver.com', // 220.166.64.194
- '.motewiki.net', // 220.166.64.194
+ 'dfym at dfym.cn' => array(
+ // ANI, JavaScript, iframe
+
+ // 220.166.64.44 by chen jinian (dfym at dfym.cn)
+ '.okwit.com',
+ '.sakerver.com',
+ '.motewiki.net',
+
+ '.caremoon.net', // 221.10.254.63 by abc00623 at 163.com, Admin by dfym, ns *.myhostadmin.net
+
+ '.8568985.com', // 61.139.126.10 by liaojiaying88 at sina.com, Admin by dfym, ns *.myhostadmin.net
+
+ // 61.139.126.47, by guoyongdan at 126.com, Tech by dfym, ns *.myhostadmin.net
+ '.bbtv-chat.com',
+ '.ketubatle.com',
+ '.playonlanei.com',
+ '.rmtfcne.com',
+
),
'mkiyle at gmail.com' => array( // by Mihelich (mkiyle at gmail.com)
'.findcraft.info', // 209.8.28.11(209-8-28-11.pccwglobal.net)
'.xjvbunksa.cn', // 217.20.112.102(*snip*)
// by roschem at sedns.info
'.ilzelqvmoa.cn', // 84.16.243.170(*.fixshell.com -> Non-existent)
+ // by op at sedns.info
+ '.bumfn.cn',
+ '.csmlu.cn',
+ '.epcwi.cn',
+ '.krwzn.cn',
+ '.lkvcp.cn',
+ '.mvmkh.cn',
+ '.nwpeg.cn',
+ '.rnqol.cn',
+ '.tyuaf.cn',
+ '.ucysa.cn',
+ '.vhyom.cn',
+ '.wtstu.cn',
+ '.zslxr.cn',
),
'gilvcta sy jilbertsbram.com' => array(
// 206.53.51.126
'.pimpcupid.com', // 89.149.226.111(*.internetserviceteam.com)
),
'hosan by front.ru' => array(
- '.online-freesearch.com', // 206.53.51.155
- '.carsprojects.com', // 206.53.51.159
- '.sport-brands.com', // 206.53.51.167
- '.choosefinest.com', // 206.53.51.157
+ '.salihome.info', // 206.53.51.155(non-existent)
+ '.online-freesearch.com', // 206.53.51.155
+ '.choosefinest.com', // 206.53.51.157
+ '.carsprojects.com', // 206.53.51.159
+ '.sport-brands.com', // 206.53.51.167
'.online-pharmaceutics.com', // 206.53.51.168
),
'89.248.107.118' => array( // "Canadian Pharmacy" 89.248.107.118(non-existent)
+ '.canadians-health.com', // by andreyletov at yahoo.com
'.cialischeap.info',
'.superrv.info',
),
- '74.50.97.*' => array(
- '.kaqeje.com', // 74.50.97.51(non-existent) by abuse-here at inbox.ru
- '.cumimo.com', // 74.50.97.51(non-existent) by olga at ike.com
- '.kaxavo.com', // 74.50.97.52(non-existent) by gunter at ftunez.org
- '.hoheru.com', // 74.50.97.52(non-existent) by gunter at ftunez.org
- '.tyqoti.com', // 74.50.97.52(non-existent) by anna at hotmail.com
- '.fupopu.com', // 74.50.97.53(non-existent) by abuse-here at inbox.ru
- '.poxupo.com', // 74.50.97.53(non-existent) by inna at gmail.com
- '.kuluvo.com', // 74.50.97.53(non-existent) by gunter at ftunez.org
- '.wugoba.com', // 74.50.97.53(non-existent) by abuse-here at inbox.ru
- '.civuhe.com', // 74.50.97.54(non-existent) by olga at ike.com
- '.zasuly.com', // 74.50.97.54(non-existent) by olga at ike.com
- '.liwowu.com', // 74.50.97.54(non-existent) by abuse-here at inbox.ru
- '.vobime.com', // 74.50.97.55(non-existent) by inna at gmail.com
- '.nyrive.com', // 74.50.97.55(non-existent) by anna at hotmail.com
- '.hehepu.com', // 74.50.99.245(non-existent) by abuse-here at inbox.ru
- '.bynute.com', // 74.50.99.245(non-existent) by abuse-here at inbox.ru
-
- '.sevimy.com', // 66.232.124.12(time-out) by inna at gmail.com
- '.gapubo.com', // 66.232.124.12(time-out) by gunter at ftunez.org
- '.vejoku.com', // 66.232.124.12(time-out) by olga at ike.com
- '.qysahu.com', // 66.232.124.12(time-out) by abuse-here at inbox.ru
- '.hidolu.com', // 66.232.124.13(time-out) by inna at gmail.com
- '.tetace.com', // 66.232.124.13(time-out) by gunter at ftunez.org
- '.vuxilu.com', // 66.232.124.13(time-out) by olga at ike.com
- '.teboca.com', // 66.232.124.13(time-out) by olga at ike.com
- '.dizive.com', // 66.232.124.14(time-out) by olga at ike.com
- '.peduxe.com', // 66.232.124.14(time-out) by gunter at ftunez.org
- '.sybyna.com', // 66.232.124.14(time-out) by gunter at ftunez.org
- '.bepofe.com', // 66.232.124.15(time-out) by anna at hotmail.com
- '.kuloja.com', // 66.232.124.15(time-out) by gunter at ftunez.org
- '.tetadu.com', // 66.232.124.15(time-out) by inna at gmail.com
- '.qilato.com', // 66.232.124.15(time-out) by inna at gmail.com
- '.lobimi.com', // 66.232.124.16(time-out) by olga at ike.com
- '.tazuwe.com', // 66.232.124.16(time-out) by olga at ike.com
- '.pihufo.com', // 66.232.124.16(time-out) by olga at ike.com
- '.decewa.com', // 66.232.124.16(time-out) by gunter at ftunez.org
-
- '.lynymu.com', // 206.51.226.194(time-out) by abuse-here at inbox.ru
- '.saciqo.com', // 206.51.226.194(time-out) by olga at ike.com
- '.zalajy.com', // 206.51.226.194(time-out) by inna at gmail.com
- '.hisimy.com', // 206.51.226.194(time-out) by inna at gmail.com
- '.qysowe.com', // 206.51.226.194(time-out) by olga at ike.com
- ),
'zinerit4 at gmail.com' => array( // 69.46.29.149(hv37.steephost.com => 72.232.191.50 ...)
+ '.hatbi.com',
+ '.justrty.com',
'.kol2you.com',
'.kolplanet.com',
+ '.myrty.com',
+ '.officialrty.com',
'.pbaol.com',
'.planetkol.com',
),
'.abra2.com', // by domain at anondns.org
'.abra3.com', // by domain at anondns.org
),
+ 'topdomainz at gmail.com' => array(
+ // 217.73.201.237 , ns *.parked.ru
+ '.aboutgoogleearth.info', // IP timed-out, ns *.aboutgoogleearth.info
+ '.aboutgooglegroup.info',
+ '.aboutgoogleimage.info',
+ '.aboutgooglemail.info',
+ '.aboutgooglemap.info',
+ '.aboutgooglenews.info',
+ '.aboutgooglevideo.info',
+ '.bestgoogleearth.info',
+ '.magicgoogleearth.info',
+ '.magicgooglemap.info',
+ '.magicgooglevideo.info',
+
+ // 84.16.251.248(*.internetserviceteam.com), ns *.aboutgoogleearth.info
+ '.slajzer.info',
+ '.tonoscelular.info',
+ '.tonosmotorola.info',
+ ),
+ 'Anderson at extra.by' => array(
+ // Encoded JavaScript
+
+ // 84.16.235.84(ns2.rrbone-dns.net -> non-existent) ns *.5upp.info
+ '.4cat.info', // by Anderson at extra.by, ns *.9upp.info
+ '.6dir.info',
+ '.8dir.info',
+ '.9dir.info',
+ '.2pro.info',
+ '.5pro.info', // by Anderson at extra.by, ns *.9upp.info
+ '.6pro.info',
+ '.7pro.info',
+ '.8pro.info',
+ '.9pro.info',
+ '.5sms.info',
+ '.6sms.info',
+ '.8sms.info',
+ '.9sms.info',
+ '.1upp.info',
+ '.2upp.info',
+ '.3upp.info',
+ '.4upp.info',
+ '.5upp.info',
+ '.6upp.info',
+ '.7upp.info',
+ '.8upp.info',
+ '.9upp.info', // 89.149.208.23(*.internetserviceteam.com) by Anderson at extra.by, ns *.9upp.info
+ '.2vip.info', // by Anderson at extra.by
+ '.4vip.info',
+ '.5vip.info',
+ '.6vip.info',
+ '.7vip.info',
+ '.8vip.info', // ns *.9upp.info
+ '.9vip.info',
+
+ // 89.149.208.23(*.internetserviceteam.com) by evdesign at gmail.com, ns *.9upp.info
+ '.w3rar.info',
+ '.w3sex.info',
+ '.w3zip.info',
+ '.w3in.info',
+ '.w3out.info',
+ ),
+ 'zorkin87 at mail.ru' => array(
+ // 66.232.112.242(hv78.steephost.com -> 72.232.191.50 -> *.steephost.com)
+ '.ruqore.com',
+ '.goxama.com',
+ '.cazebi.com',
+ '.fukeqa.com',
+ '.fydoge.com',
+ '.jukaly.com',
+ '.jumoga.com',
+ '.jumuxo.com',
+ '.tyriva.com',
+ '.vudyho.com'
+ ),
+ 'jessicaeagloff at yahoo.co.uk' => array(
+ '.pilltrade.com', // 91.196.219.81(non-existent) by jessicaeagloff at yahoo.co.uk, ns *.rxrxrxrx.com
+ '.rxrxrxrx.com', // IP not allocated by postmaster at cialischoice.com
+ '.cialischoice.com', // 81.29.249.88(non-existent) by postmaster at cialischoice.com, ns *.rxp-hosting.com
+ '.rxp-hosting.com', // IP not allocated by jessicaeagloff at yahoo.co.uk
+ ),
+ 'qbbs at xinoffice.com' => array(
+ // ns *.name-services.com
+ '.lingage.com', // 8.15.231.118
+ '.puksins.com', // IP not allocated now
+ ),
+ 'advertolog at gmail.com' =>
+ // 81.0.250.86(network.upl.cz => non-existent) or
+ // 217.11.233.27
+ '#^(?:.*\.)?download-mp3-music-0(?:[0-2][0-9]|30)\.cn$#', // 001-030
+ 'contact at aboutdomain.com' => array(
+ '.lopieur0.com', // Not match but used
+ '.lopieur1.com', // Not match but used
+ '.lopieur2.com', // 209.62.21.228(*.ev1servers.net => non-existent) by contact at aboutdomain.com
+ ),
+ 'info at cash4wm.biz related' => array(
+ // 84.16.233.12(*.internetserviceteam.com)
+ '.newsblogforu.com',
+
+ // 84.16.235.141()
+ '.informator4you.com',
+
+ // 84.16.240.68(*.internetserviceteam.com)
+ '.absolute-best-site.com',
+ '.new-blog-for-you.com',
+
+ // 84.16.240.69(*.internetserviceteam.com)
+ '.best-sport-blog.com',
+ '.big-internet-site.com',
+ '.brendsite.com',
+ '.my-news-blog.com',
+
+ // 84.16.242.123(*.internetserviceteam.com)
+ '.best-news-blog.com',
+ '.site-with-content.com',
+
+ // The same method with info at cash4wm.biz
+ '.coolnews-4u.com', // 217.20.123.122(*.internetserviceteam.com),
+ '.bestnews-4u.com', // 84.16.227.135(*.internetserviceteam.com)
+ '.big-site-news.com', // 84.16.243.168(*.fixshell.com -> non-existent)
+ '.good-news-4u.info', // 89.149.196.72(mendoi.fansubs.omni-forums.net -> ..)
+ '.super-blog-here.com', // 89.149.247.25, the same IP with iblcqms.cn
+ '.bloginfo4u.info', // 89.149.247.25
+ ),
+ 'kerjy at yahoo.com' => array(
+ '.wibek.com', // 66.232.126.212(hv71.steephost.com -> ..) by boldalex at yahoo.com
+ '.hehik.com', // 66.232.126.213(hv71.steephost.com -> ..) by kerovska at mail.nu
+ '.mynyh.com', // 66.232.126.214(hv71.steephost.com -> ..) by kerjy at yahoo.com
+ '.mabej.com', // 66.232.126.215(hv71.steephost.com -> ..) by jeffy at hotmail.com
+ '.qanom.com', // 66.232.126.216(hv71.steephost.com -> ..) by kerjy at yahoo.com
+ ),
+ 'vme at hotmail.ru' => array(
+ '.seoblack.net', // 216.195.33.112(non-exsistent)
+ '.seoblack.biz', // 216.195.33.113(non-exsistent)
+ ),
+ 'john at hellomyns.info' => array(
+ '.cuhdw.cn', // 217.20.113.27, / nothing
+ '.byouz.cn', // 89.149.247.24, / nothing
+ '.idghc.cn',
+ '.inxrj.cn',
+ '.jqzdf.cn',
+ '.vsxej.cn',
+ '.wkgnr.cn',
+ ),
+ '.CN spam payload' => array(
+ '.i3sa.cn', // by varra6yu4lt8607 at yahoo.com
+ '.bjlzhh.cn', // 210.51.162.236(non-existent) by bjlzhh at 163.com
+ '.iactive.com.cn', // 60.28.204.205(non-existent) by buggd at 263.net
+ '.njss.com.cn', // 219.142.175.25(mail.codeprof.com) by admin at yywt.com
+ '.qimo.com.cn', // 219.235.228.55(non-existent) by baojieshuma at 163.com
+ '.wzhj.com.cn', // 218.244.136.78 by nemesisxue at yahoo.com.cn
+ '.ytbaixin.com.cn', // 210.22.13.42(sym.gdsz.cncnet.net) by ytwqg at 163.com
+ '.tj-008.cn', // 222.35.3.90(non-existent) by dinmo.net at gmail.com
+ '.xglzl.cn', // 60.215.129.74(non-existent) by 148044648 at 163.com
+ '.xixii.cn', // 218.206.72.210(non-existent) by chenzhen8168 at yahoo.com.cn
+ ),
+ 'Time2ns.info' => array(
+ // time2ns.info(84.16.226.58 -> *.internetserviceteam.com), "Fedora Core Test Page" says this is private
+ '.klmnei.cn', // 84.16.243.123(*.internetserviceteam.com) by arsen at time2ns.info(84.16.226.58)
+ '.lumyjugmn.cn', // 89.149.243.225(*.internetserviceteam.com) by kashin at time2ns.info
+ '.uxmrscgdi.cn', // 89.149.247.23(*.internetserviceteam.com) by Bmurphy at itsmyns.info
+ '.iblcqms.cn', // 89.149.247.25(*.internetserviceteam.com) by Gershun at time2ns.info, / not found
+ ),
+ 'Ilovemyns.info' => array(
+ // ilovemyns.info(89.149.247.26 -> *.internetserviceteam.com), "Fedora Core Test Page" says this is private
+ '.aasghwf.cn', // 84.16.243.121(*.internetserviceteam.com) by Shooll at ilovemyns.info
+ ),
+ 'Freehostdns.info' => array(
+ // freehostdns.info(217.20.112.24 -> neviem.kto.sk), "Fedora Core Test Page" says this is private
+ '.qyxswynd.cn', // 89.149.247.26(*.internetserviceteam.com) by margarita at freehostdns.info
+ '.ugivorm.cn', // 217.20.127.219(*.internetserviceteam.com) by Chos at freehostdns.info
+ ),
+ 'Newns4me.info' => array(
+ // newns4me.info(217.20.127.231 -> pls.dont.eat.shit.la), "Fedora Core Test Page" says not public
+ '.lxwxjzpiy.cn', // 217.20.113.27(*.internetserviceteam.com) by Alexan at newns4me.info
+ ),
// C-2: Lonely domains (buddies not found yet)
'.0721-4404.com',
'.0nline-porno.info', // by Timyr (timyr at narod.ru)
+ '.101010.ru', // 72.232.246.178(spirit.intellovations.com -> 207.218.230.66) by gkrg94g at mail.ru, / forbidden
'.1-click-clipart.com', // by Big Resources, Inc. (hostmaster at bigresources.com)
'.19cellar.info', // by Eduardo Guro (boomouse at gmail.com)
'.1gangmu.com', // by gangmutangyaoju (wlmx009 at hotmail.com), Seems physing site for ff11-jp.com
'.1gb.in', // by Sergius Mixman (lancelot.denis at gmail.com)
'.0annie.info',
'.6i6.de',
+ '.77toperrwuter1.info', // by Roman
+ '.99-idea.com', // 202.44.54.48(*.worldinternetworkcorporation.com) by mistercolor at gmail.com, encoded JavaScript
+ '.angioco.com', // 62.37.112.100, gamble
'.advancediet.com', // by Shonta Mojica (hostadmin at advancediet.com)
'.adult-master-club.com', // by Alehander (mazyrkevich at cosmostv.by)
'.adultpersonalsclubs.com', // by Peter (vaspet34 at yahoo.com)
+ '.akalukseree.com', // 202.44.52.54(*.worldinternetworkcorporation.com) by nantachit at yahoo.com, encoded JavaScript
'.akgame.com', // 72.32.79.100 by Howard Ke (gmtbank at gmail.com), rmt & pl
+ '.alasex.info', // 'UcoZ web-services' 216.32.81.234(server.isndns.net) by yx0 at yx0.be
'.alfanetwork.info', // by dante (dantequick at gmail.com)
'.allworlddirect.info', // Forbidden
'.amoreitsex.com',
+ '.angel-live.com', // 61.211.231.181, ns *.netassist.ne.jp, pr to himehime.com
+ '.angelkiss.jp', // 59.106.45.50, pr to himehime.com and chatwalker.com
'.approved-medication.com', // 208.109.181.53(p3slh079.shr.phx3.secureserver.net)
'.areahomeinfo.info', // by Andrus (ffastenergy at yahoo.com), republishing articlealley.com
'.areaseo.com', // by Antony Carpito (xcentr at lycos.com)
+ '.ascotstationers.com', // 89.149.228.164(*.internetserviceteam.com) by hoopeer at gmail.com
'.auto-car-cheap.org',
'.banep.info', // by Mihailov Dmitriy (marokogadro at yahoo.com), iframe to this site
'.baurish.info',
+ '.bernardtomic21.info', // by filboj at hotmail.com
'.bestop.name',
'.betmmo.com', // 63.223.98.182 by Huang Qiang (liuxing-wushi at hotmail.com), pl
'.bestrademark.info', // by victoria (niko16d at yahoo.com), redirect to majordomo.ru
'.bestshopfinder.info',
'.blogest.org', // 203.116.63.68 by Bobby.R.Kightlinger at pookmail.com, / seems blank
'.bookblogsite.org', // 217.11.233.58 by Eugene.E.Mather at mailinator.com
+ '.brisbanedecking.com', // 61.14.187.244(orion.websiteactive.com) by jgstubb at bigpond.net.au, / nothing
'.businessplace.biz', // by Grenchenko Ivan Petrovich (eurogogi at yandex.ru)
+ '.buyshaliflute.com', // 70.84.133.34(epsilon.websiteactive.com) by bigwave3000 at ozemail.com.au
'.capital2u.info', // by Delbert.A.Henry at dodgeit.com
'.casa-olympus.com', // "UcoZ WEB-SERVICES"
+ '.cashing-view.com', // 210.188.201.22(sv69.xserver.jp) by kikuchi at money-agent.jp
'.catkittenmagazines.org', // 87.118.97.117
+ '.cdmsolutionsinc.com', // 206.123.100.160 by rpeterson at ricochet.com
+ '.chatwalker.com', // 124.32.230.65
+ '.cosamoza.com', // 216.195.51.62 by travelwins at yahoo.com
'.covertarena.co.uk', // by Wayne Huxtable
'.d999.info', // by Peter Vayner (peter.vayner at inbox.ru)
+ '.dance-ithaca.com', // 203.191.238.22(non-existent) by iichiba at hotmail.com, finance
'.dinmo.cn', // 218.30.96.149 by dinso at 163.com, seo etc. //'.wow-gold.dinmo.cn', // 125.65.76.59, pl
'.dinmoseo.com', // 210.51.168.102(winp2-web-g02.xinnetdns.com) by jianmin911 at 126.com, NS *.xinnetdns.com, seo
+ '.discoverproducts.info',// 216.195.58.37(non-existent) by snarku at gmail.com
'.dlekei.info', // by Maxima Bucaro (webmaster at tts2f.info)
'.dollar4u.info', // by Carla (Carla.J.Merritt at mytrashmail.com), / is blank
'.drug-shop.us', // by Alexandr (matrixpro at mail.ru)
'.drugs-usa.info', // by Edward SanFilippo (Edward.SanFilippo at gmail.com), redirect to activefreehost.com
+ '.dssoaps.com', // 67.15.104.24(pluto.websiteactive.com) by donnabl at iprimus.com.au, encoded JavaScript
+ '.easypharmsite.com', // 75.126.129.229(greatpool.biz => 72.232.198.234 => ) by andrew at pharmacy-inet.com
'.easyshopusa.com', // by riter (riter at nm.ru)
+ '.edjuego.com', // 85.92.70.253(non-existent), gamble
'.edu.ph', // "philippine network foundation inc"
+ '.eec.mn', // 208.109.203.142(*.ip.secureserver.net), encoded JavaScript
'.ex-web.net', // RMT by ex co,ltd (rmt at ex-web.net)
'.extracheapmeds.com', // "freexxxmovies" by John Smith (89 at bite.to)
'.fantasy-handjob-ra.com', // by Hose Pedro (hosepedro at gmail.com)
'.fastppc.info', // by peter conor (fastppc at msn.com)
'.ffxiforums.net', // 204.16.199.105 by Zhang xiaolong (mail at 33986.com), hidden VBScript
- '*.filthserver.com', // sales at onlinemarketingservices.biz
+ '.filthserver.com', // sales at onlinemarketingservices.biz
'.find-stuff.org', // by Alice Freedman (admin at ip-labs.ru), / 404 Not Found
'.firstdrugstorezone.info', // by Goose (boris208 at yandex.ru)
'.free-finding.com', // by Ny hom (nyhom at yahoo.com)
'.freehost5.com', // 75.126.32.184(kosmohost.net), words only
'.freeliveringtones.com', // by Silan (lippe1988 at gmail.com)
'.freemobilephonesworld.info', // by andresid (andresid1 at yandex.ru)
+ '.fwjjjtmrlr.cn', // 217.20.127.232(really.cut3.info -> non-existent) by analog at gamehostingns.info(217.20.113.79)
'.game4enjoy.net', // by huang jinglong (fenlin231 at sina.com)
'.game4egold.com', // by Filus Saifullin (ebay at soft-script.com)
'.goldcoastonlinetutoring.com', // by Robert Tanenbaum (buildbt at lycos.com)
+ '.golden-keys.net', // 89.149.205.146(unknown.vectoral.info) by aktitol at list.ru
'.gomeodc.com', // 125.65.112.49 by wang meili (gannipo at yahoo.com.cn), iframe to vviccd520.com
'.ganecity.com', // by shao tian (huangjinqiang at sina.com)
'.gm-exchange.jp', // 210.188.216.49 RMT
'.hostuju.cz', // ns banan.cz, banan.it
'.hot4buy.org', // by Hot Maker (jot at hot4buy.org)
'.hotscriptonline.info',// by Psy Search (admin at psysearch.com)
+ '.hostzerocost.com', // server failed, by Gokhan Yildirim (gokhany at gmail.com)
'.iinaa.net', // domain at ml.ninja.co.jp, ns *.shinobi.jp
'.incbuy.info', // by Diego T. Murphy (Diego.T.Murphy at incbuy.info)
+ '.informator4you.com', // 84.16.235.141 by info at cash4wm.biz
'.infradoc.com',
'.investorvillage.com', // by natalija puchkova (internet at internet.lv)
'.ismarket.com', // Google-hiding. intercage.com related IP
'.italy-search.org', // by Alex Yablin (zaharov-alex at yandex.ru)
'.itsexosit.net',
'.itxxxit.net',
+ '.hostsy.us', // 217.11.233.21 by Julian.L.Harrington at dodgit.com, / empty, redirection
'.jimmys21.com', // by Klen Kudryavii (telvid at shaw.ca)
'.jimka-mmsa.com', // by Alex Covax (c0vax at mail.ru), seems not used yet
'.joynu.com', // by lei wang (93065 at qq.com), hidden JavaScript
+ '.jsyuanyang.com', // 58.211.0.23(non-existing)
+ '.karasikov.net', // 217.107.217.7(server3.jino.ru -> 217.107.217.17) by pashkanet at list.ru, encoded JavaScript
'.kingtools.de',
'.kymon.org', // by Albert Poire (isupport at yahoo.com), / Forbidden, 70.87.62.252
'.leucainfo.com',
'.library-blogs.net', // by Peter Scott (pscontent at gmail.com)
- '.lingage.com', // by huan bing (qbbs at xinoffice.com)
+ '.lightyearmedia.com', // 216.104.33.66(esc91.midphase.com) by techsupport at midphase.com, encoded JavaScript
'.link-keeper.net', // 210.172.108.236 (257.xrea.com)
'.ls.la', // by Milton McLellan (McLellanMilton at yahoo.com)
+ '.m-sr.net', // 210.175.62.125(non-existent) by luckynets2003 at yahoo.co.jp, ns *.ARK-NET.NE.JP
'.mamaha.info', // by Alex Klimovsky (paganec at gmail.com), seems now constructiong
'.manseekingwomanx.com',// by Bill Peterson (coccooc at fastmail.fm)
+ '.mdjadozone.org', // 64.34.124.103(non-existent) by info at infoconceptlc.com, / blank
'.medicineonlinestore.com', // Alexander Korovin (domains at molddata.md)
'.medpharmaworldguide.com', // by Nick Ivchenkov (signmark at gmail.com), / not found
'.megvideochatlive.info', // Bad seo
'.milfxxxpass.com', // by Morozov Pavlik (rulets at gmail.com)
+ '.mncxvsm.info', // 217.11.233.105, / blank
'.moremu.com', // 205.134.190.12(amateurlog.com) by Magaly Plumley (domains ay moremu.com)
+ '.morfolojna.cn', // 206.53.51.126, by gilserta at jilbertsabram.com, Using web.archive.org
'.myfgj.info', // by Filus (softscript at gmail.com)
'.mujiki.com', // by Mila Contora (ebumsn at ngs.ru)
'.mxsupportmailer.com',
'.next-moneylife.com', // RMT
'.newalandirect.com', // by Alnoor Hirji, ns *.sablehost.com
'.ngfu2.info', // by Tara Lagrant (webmaster at ngfu2.info)
+ '.northwestradiator.com', // 66.206.12.166(caudill.cc -> 63.115.2.1 -> ...) by nwradiator at qwest.net, encoded JavaScript
'.nucked-sex.com', // 203.223.150.222 by lis (noidlis2 at yahoo.com)
'.ok10000.com', // by zipeng hu (ldcs350003 at hotmail.com)
'.olimpmebel.info', // by pol (pauk_life at mail.ru), frame to bettersexmall.com
'.onlinetert.info', // by Jarod Hyde (grigorysch at gmail.com)
'.onlin-casino.com', // by Lomis Konstantinos (businessline3000 at gmx.de)
'.onlineviagra.de',
+ '.oppe.biz', // 81.0.195.241(non-existent) by Nellie.J.Gonzalez at mailinator.com, / blank, redirect to thesuperxxx.com
'.ornit.info', // by Victoria C. Frey (Victoria.C.Frey at pookmail.com)
'.ozomw.info',
'.pahuist.info', // by Yura (yuralg2005 at yandex.ru)
'.portaldiscount.com', // by Mark Tven (bestsaveup at gmail.com)
'.powerlevelingweb.com', // 68.178.211.9 by jun zhang (huanbing at 126.com), pl
'.prama.info', // by Juan.Kang at mytrashmail.com
+ '.privatedns.com', // 209.172.41.50(sebulba.privatedns.com), encoded JavaScript, root of various posts
',pulsar.net', // by TheBuzz Int. (theboss at tfcclion.com)
'.qoclick.net', // by DMITRIY SOLDATENKO
'.quality-teen-porn-photo.com', // by info at densa.info
'.rigame.info', // by debra_jordan07 at yahoo.com
'.rmt-trade.com', // by wang chun (dlxykj at 126.com), rmt
'.roin.info', // by Evgenius (roinse at yandex.ru)
+ '.rpz3zmr75a.com', // 216.188.26.235(park-www.trellian.com, redirects to domainparkltd.com) by hostmaster at domainparkltd.com(216.188.26.235)
+ '.rutewqsfrt10.cn', // 72.36.237.146(*.static.reverse.ltdomains.com) by ferrari by list.ru
'.save-darina.org', // 85.14.36.36 by Plamen Petrov (plamen5rov at yahoo.com)
+ '.search99top.info', // 85.255.118.236 / not found, ns *.f01137d.com, redirect to abosearch.com
'.searchadv.com', // by Jaan Randolph (searchadv at gmail.com)
'.seek-www.com', // by Adam Smit (pingpong at mail.md)
'.sessocities.net', // 66.98.162.20(*.ev1servers.net: Non-existent domain) by info at secureserver3.com
'.sepcn.info', // / not found
'.sslcp.com', // by shufang zhou (info at 6come.com), dns *.hichina.com
'.sticy.info', // by Richard D. Mccall (richardmccall at yahoo.com)
+ '.stordproduksjonslag.no', // 81.27.32.152(wh42.webhuset.no) by helgatun at mail.com, encoded JavaScript
+ '.super-discount.sakura.ne.jp', // 59.106.19.206(www756.sakura.ne.jp), sales
'.superrwm.info', // by Dark Dux (duxdark at yahoo.com)
'.superverizonringtones.com', // by joshua at list.ru
+ '.teriak.cn', // 83.69.224.82(non-existent) by sto_xyev at yahoo.com, / blank
+ '.thebest-penis-enlargement-pills.com', // 209.59.142.226(host.gudzonserver.com) by sergey.xoxlov at gmail.com
'.thehostcity.com', // Domains by Proxy
+ '.thesuperxxx.com', // 81.29.249.27(non-existent)
'.thetinyurl.com', // by Beth J. Carter (Beth.J.Carter at thetinyurl.com), / is blank
'.thetrendy.info', // by Harold (Harold.J.Craft at pookmail.com), / is blank
'.theusapills.com', // by Dr. Zarman (contactus at theusapills.com)
'.tingstock.info', // 209.160.73.65(delta.xocmep.info) "nice day, commander ;)" by Andrey Konkin (konkinnews55 at yahoo.com)
'.topmeds10.com',
+ '.tschofenig.com', // 213.239.234.98(*.clients.your-server.de), port 8080
'.truststorepills.com', // 89.188.113.64(allworldteam.com) by Alexey (admin at myweblogs.net)
'.twabout.com', // by qiu wenbing (qiuwenbing at 126.com), content from l2mpt.net
'.uaro.info', // by Neru Pioner (neru at smtp.ru)
'.unctad.net', // by gfdogfd at lovespb.com
'.vacant.org.uk',
+ '.viagrausaonline.com', // 85.17.52.139(non-existent)
'.vip-get.info', // 203.223.150.222 by Jhon Craig (bartes1992 at mail.ru), / forbidden
'.virtualsystem.de',
'.vdxhost.com',
+ '.vodkaporn.com', // 67.19.116.83(non-existent) by green at gmx.co.uk
'.vviccd520.com', // 202.75.219.217 by kuang zhang (oulingfeng66 at 163.com), encoded JavaScript
'.homes.com.au', // 139.134.5.124 by wongcr at bigpond.net.au, / meanless,
+ '.wbtechs.us', // 68.178.232.100(parkwebwin-v01.prod.mesa1.secureserver.net) by westbabylon at aol.com
'.webnow.biz', // by Hsien I Fan (admin at servcomputing.com)
'.webtools24.net', // by Michael Helminger (info at ishelminger.de)
'.wer3.info', // by Martin Gundel (Martin at mail.com), 404 not found
'.zyguo.info', // ns globoxhost.net
'.zhuyiw.com', // by zhou yuntao (whzyt0122 at sohu.com)
- '.101010.ru', // 72.232.246.178(spirit.intellovations.com -> 207.218.230.66) by gkrg94g at mail.ru, / forbidden
- '.alasex.info', // 'UcoZ web-services' 216.32.81.234(server.isndns.net) by yx0 at yx0.be
- '.golden-keys.net', // 89.149.205.146(unknown.vectoral.info) by aktitol at list.ru
-
- '.chatwalker.com', // 124.32.230.65
- '.angel-live.com', // 61.211.231.181, ns *.netassist.ne.jp, pr to himehime.com
- '.angelkiss.jp', // 59.106.45.50, pr to himehime.com and chatwalker.com
-
- '.morfolojna.cn', // 206.53.51.126, by gilserta at jilbertsabram.com, Using web.archive.org
- '.mncxvsm.info', // 217.11.233.105, / blank
- '.super-discount.sakura.ne.jp', // 59.106.19.206(www756.sakura.ne.jp), sales
- '.privatedns.com', // 209.172.41.50(sebulba.privatedns.com), encoded JavaScript, root of various posts
- '.hostzerocost.com', // server failed, by Gokhan Yildirim (gokhany at gmail.com)
- '.easypharmsite.com', // 75.126.129.229(greatpool.biz => 72.232.198.234 => ) by andrew at pharmacy-inet.com
- '.wbtechs.us', // 68.178.232.100(parkwebwin-v01.prod.mesa1.secureserver.net) by westbabylon at aol.com
- '.discoverproducts.info',// 216.195.58.37(non-existent) by snarku at gmail.com
- '.cosamoza.com', // 216.195.51.62 by travelwins at yahoo.com
-
- '.oppe.biz', // 81.0.195.241(non-existent) by Nellie.J.Gonzalez at mailinator.com, / blank, redirect to thesuperxxx.com
- '.thesuperxxx.com', // 81.29.249.27(non-existent)
-
- // The same approach of 'acua at mail.ru'
- '.iblcqms.cn', // 89.149.247.25(*.internetserviceteam.com) by Gershun at time2ns.info(84.16.226.58 -> *.internetserviceteam.com), / not found
- '.aasghwf.cn', // 84.16.243.121(*.internetserviceteam.com) by Shooll at ilovemyns.info(89.149.247.26 -> *.internetserviceteam.com)
- '.fwjjjtmrlr.cn', // TODO:
- '.klmnei.cn', // TODO:
- '.lumyjugmn.cn', // TODO:
- '.lxwxjzpiy.cn', // TODO:
- '.qyxswynd.cn', // TODO:
- '.ugivorm.cn', // TODO:
- '.uxmrscgdi.cn', // TODO:
// C-3: Not classifiable (information wanted)
//
// E: Sample setting of
// Promoters
// (Affiliates, Hypes, Catalog retailers, Multi-level marketings, Resellers,
- // Ads, Business promotions)
+ // Ads, Business promotions, SEO, etc)
//
// They often promotes near you using blog article, mail-magazines, tools(search engines, blogs, etc), etc.
// Sometimes they may promote each other
'hbb.afl.rakuten.co.jp', ///hsb/ 203.190.60.105 image server?
),
'.sedori-data.com', // 210.188.205.7(sv03.lolipop.jp)
+ '.seozone.jp', // 211.133.134.77(sv27.wadax.ne.jp) by blue_whale20002004 at yahoo.com.cn
'.tool4success.com', // 210.188.201.31(sv70.xserver.jp) by Yukihiro Akada (ml at original-ehon.com)
'tera at kirinn.com' => array( // 59.139.29.234(s240.xrea.com) by Naohsi Terada (tera at kirinn.com)
'.e123.info',
OSDN Git Service
