FiltersHeroes / KAD

Filtry do uBlocka Origin i AdGuarda, chroniące przed różnymi zagrożeniami w polskiej sieci, takimi jak wirusy, fałszywe sklepy i subskrypcje SMS.
https://kadantiscam.netlify.app/
Creative Commons Attribution Share Alike 4.0 International
56 stars 8 forks source link

Invalid domains: `*.001com` #2301

Closed mook closed 1 year ago

mook commented 1 year ago

Hello there! I noticed that there are some domains in the list that end with .001com; as far as I know, that's not a valid TLD.

They were originally added in https://github.com/FiltersHeroes/KADhosts/commit/75a08f1c0668c234d70695eee8013ac0e96f71d0 and include:

ggewgwegwe.001com
hehreerh.001com
hrerheerhher.001com
hrhererhtng.001com
www.ggewgwegwe.001com
www.hehreerh.001com
www.hrerheerhher.001com
www.hrhererhtng.001com

(All of those domains looks like somebody just smashed their keyboard. They appear to have been originally added to KAD at https://github.com/FiltersHeroes/KAD/commit/bf72935ebebbc8780cf4f85293ec88e4eafc7a6e)

Apologies, I can't read Polish and it's possible that they're there intentionally; if that's the case, please directly close this issue, thanks!

krystian3w commented 1 year ago

We do not yet have a mechanism to check the public suffix (https://publicsuffix.org/list/public_suffix_list.dat) automatically of external lists copied to KAD (in Bash/Python) - at last check before add to file/list. In the past, we had a tool to check the whois of a domain, but with 2,000 records to check manually, these entries may not catch our eye - currently requires listing the Gitlab repository as an open source project with unlimited CI time, so as not to abuse the Github server or someone's home Internet.

For my part, I can manually remove, until Hawkeye writes a public suffix check sometime day (I don't see records in https://hole.cert.pl/domains/domains.txt - maybe fastly fixed).


All of those domains looks like somebody just smashed their keyboard

Apparently, Internet criminals random characters did not bother to scam - maybe the domain was used to redirect to a nicer url.

It could also be a mistake with www. simplification in the past:

ggewgwegwe.001www.com
hehreerh.001www.com
hrerheerhher.001www.com
hrhererhtng.001www.com
kjopjpoerhrhe.001www.com
yrehrher.001www.com

Last two are still blacklisted:

3705    ggewgwegwe.001www.com       2020-08-28T20:22:33
4161    hehreerh.001www.com     2020-09-14T18:14:57
4768    hrerheerhher.001www.com     2020-10-13T16:30:11
3706    hrhererhtng.001www.com      2020-08-28T20:22:38
4193    kjopjpoerhrhe.001www.com    2020-09-17T07:03:33
4212    yrehrher.001www.com     2020-09-18T09:40:02
krystian3w commented 1 year ago

Manually done: https://github.com/FiltersHeroes/KAD/commit/c17da514b5c7f7c416270d101f20e46cc1eceb49 + https://github.com/FiltersHeroes/KADhosts/commit/f32dc5349c3090a13f51040fcf3a4707c0a78234

For the future:

github-actions[bot] commented 1 year ago

Ten wątek został automatycznie zablokowany, ponieważ po jego zamknięciu nie było żadnej aktywności. Proszę otworzyć nowe zgłoszenie dla powiązanych problemów.