search

hagezi / dns-blocklists

DNS-Blocklists: For a better internet - keep the internet clean!
GNU General Public License v3.0
4.74k stars 151 forks source link

Fake KMS Activation websites #2954

Closed ghost closed 2 weeks ago

ghost commented 2 weeks ago

Which domain(s) should be blocked?

href.li
kmsauto.uno

Why should these domain(s) be blocked?

These websites deceives users into downloading malware by making them believe they are installing a legitimate Windows activator.

github-actions[bot] commented 2 weeks ago

Thank you, ping @durablenapkin @jarelllama @iam-py-test for checking and possibly including the domain(s).

ghost commented 2 weeks ago

Even though I'm not a professional developer, I suggest adding the following filter:

||*kms*.*pico*.*activator*^

This pattern matches URLs containing the words "kms," "pico," and "activator," which will block all those domains. Almost all of them, if not all of them, are scams, phishing, and malware. @hagezi

iam-py-test commented 2 weeks ago

href.li is not malicious; it is just a URL redirector. For example, https://href.li/?https://iam-py-test.github.io/lookup.html?q=href.li redirects to https://iam-py-test.github.io/lookup.html?q=href.li. According to their website, it is designed to mitigate use of the referer header for tracking

href.li: hide your referrer

Though there are much better mitigations. I have added the other domain. Thank you.