Closed dnmTX closed 3 years ago
This is a 96 domain intersection with our base list.
$ ghosts --intersection -c https://www.threatcrowd.org/feeds/domains.txt
----------------------------------------
Base hosts file summary:
----------------------------------------
Location: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
Domains: 66,393
Bytes: 2.0 MB
----------------------------------------
----------------------------------------
Compared hosts file summary:
----------------------------------------
Location: https://www.threatcrowd.org/feeds/domains.txt
Domains: 3,465
Bytes: 55 kB
----------------------------------------
intersection: [1empiredirect.com ad-noise.net ad-void.com adblade.com adsbizsimple.com adservicestats.com advancing-technology.com afkarehroshan.com amazinggreentechshop.com arabtechmessenger.net ato.mx avidnewssource.com aynachatsrv.com bazandegan.com brittlefilet.com business-made-fun.com businessdealsblog.com businessdirectnessource.com businessedgeadvance.com cdn.krxd.net charging-technology.com charmedno1.com coffeehausblog.com cpx.to cqcounter.com cribdare2no.com customerscreensavers.com damavandkuh.com darakht.com dowelsobject.com downloadmpplayer.com eclkmpsa.com etahub.com exacttarget.com fnlpic.com following-technology.com forgotten-deals.com foroushi.net functional-business.com gar-tech.com ghalibaft.com globalnetworkanalys.com goldadpremium.com goodbizez.com gowin7.com gumgum.com havakhosh.com honarkhabar.com honarkhaneh.net housedman.com industry-deals.com islamicmarketing.net linkbucks.com listennewsnetwork.com log.kuwo.cn lsassoc.com mashinkhabar.com meevehdar.com melding-technology.com merrymilkfoods.com mimicrice.com mnet-ad.net monster-ads.net nickleplatedads.com noticiasftpsrv.com nowruzbakher.com owlsr.us parkingcrew.net parskabab.com phoneysoap.com pixel-geo.prfct.co platads.com poponclick.com posed2shade.com puhtml.com quickupdateserv.com quik-serv.com rampagegramar.com rapidlyserv.com rehabretie.com roshanavar.com rubriccrumb.com selective-business.com selfpwn.org sendfwd.com serv-load.com sherkatkonandeh.com sherkhundi.com skippyfile.com slayinglance.com speedynewsclips.com spotscenered.info streamate.com successful-marketing-now.com suddenplot.com sync-eu.exe.bid]
Intersection: 96 domains
Nominally this is a 2.7% intersection ratio, which seems a bit low.
But it purports to be a malware list, so that's probably closer to an OK ratio โ purely gut feel about that.
Still though, how does a small list outpoint a larger curated consensus list by about 37:1? Are we collectively that bad on the malware front? Seems doubtful.
The intersection as a readable list.
1empiredirect.com
ad-noise.net
ad-void.com
adblade.com
adsbizsimple.com
adservicestats.com
advancing-technology.com
afkarehroshan.com
amazinggreentechshop.com
arabtechmessenger.net
ato.mx
avidnewssource.com
aynachatsrv.com
bazandegan.com
brittlefilet.com
business-made-fun.com
businessdealsblog.com
businessdirectnessource.com
businessedgeadvance.com
cdn.krxd.net
charging-technology.com
charmedno1.com
coffeehausblog.com
cpx.to
cqcounter.com
cribdare2no.com
customerscreensavers.com
damavandkuh.com
darakht.com
dowelsobject.com
downloadmpplayer.com
eclkmpsa.com
etahub.com
exacttarget.com
fnlpic.com
following-technology.com
forgotten-deals.com
foroushi.net
functional-business.com
gar-tech.com
ghalibaft.com
globalnetworkanalys.com
goldadpremium.com
goodbizez.com
gowin7.com
gumgum.com
havakhosh.com
honarkhabar.com
honarkhaneh.net
housedman.com
industry-deals.com
islamicmarketing.net
linkbucks.com
listennewsnetwork.com
log.kuwo.cn
lsassoc.com
mashinkhabar.com
meevehdar.com
melding-technology.com
merrymilkfoods.com
mimicrice.com
mnet-ad.net
monster-ads.net
nickleplatedads.com
noticiasftpsrv.com
nowruzbakher.com
owlsr.us
parkingcrew.net
parskabab.com
phoneysoap.com
pixel-geo.prfct.co
platads.com
poponclick.com
posed2shade.com
puhtml.com
quickupdateserv.com
quik-serv.com
rampagegramar.com
rapidlyserv.com
rehabretie.com
roshanavar.com
rubriccrumb.com
selective-business.com
selfpwn.org
sendfwd.com
serv-load.com
sherkatkonandeh.com
sherkhundi.com
skippyfile.com
slayinglance.com
speedynewsclips.com
spotscenered.info
streamate.com
successful-marketing-now.com
suddenplot.com
sync-eu.exe.bid
Per https://threatcrowd.blogspot.com/2016/02/crowdsourced-feeds-from-threatcrowd.html the data is licensed
I'm totally willing to concede that our list is far better at advertising, privacy and tracking than we are at malware protection.
And malware is off-the-scale in terms of better safe than sorry.
To me, it looks like the way this list works is people searching for a domain on the main website threatcrowd.org
and then voting in the section "Is this malicious?". Surely there are safeguards about how many votes are required before something is added/removed from the list, but it looks to be a wholly 'crowd sourced' list vs. curated. Perhaps I'm misunderstanding and there is a manual process behind the scenes.
These feeds are not a substitute for the scale of auto-extracted command and control domains or the quality of some commercially provided feeds. But crowd-sourcing does go some way towards the quick sharing of threat intelligence between the community. 1
(emphasis mine)
Perhaps @threatcrowd over at https://github.com/AlienVault-OTX/ApiV2 would like the chime in
Thanks Daniel @lightswitch05 that's some great input you're providing here.
info -> we removed it from nextdns as it is no longer up to date
we removed it from nextdns as it is no longer up to date
You are NOT a member or associated in any way to NextDNS so please...spare us all that.... No one here is even close to be impressed by you so far...if ever โ
Nobody ever said they were part of nextdns; I'm saying that I know this list since I had it included in the threat intelligence section.
Source -> https://github.com/nextdns/metadata/issues/136
PS -> I don't care about your personal aspects
PS1 -> there are a lot of FP like aruba.it (italian hosting provider)
PS2 -> Now Threatcrowd is Alienvault (but there's no any domain list)
Hey thatโs correct that list is no longer updated. If youโre looking at blocking malware domains, Iโd suggest you take a look at https://github.com/Neo23x0/signature-base/tree/master/threatintel
@threatcrowd thanks for the prompt response ๐
Steve @StevenBlack i'm closing this. Reopen if needed.
It's a small,community driven malware list. PROS: Frequently updated(info is a bit outdated,would recommend monitoring first) As of today,intersection: 94 domains only
CONS: Might be a pain to report false-positives,if any. No License present
https://www.threatcrowd.org/feeds/domains.txt
Steve @StevenBlack your call ๐