Slashdot Mirror

← Back to Domains

Domain: shadowserver.org

Stories and comments across the archive that link to shadowserver.org.

Comments · 37

  1. Re:Sorry by LordLimecat · · Score: 1 · on ANTVR - China's Answer To Oculus Rift Is Raising Funds

    http://www.symantec.com/threat...

    US is number 2: how can that be explained? If you look, its dominated by the Rustock botnet, which is operated from..... McColo, in Russia.

    Look at botnet operator country-of-origin, and time and again it is eastern europe and China.

    http://www.team-cymru.org/Read...
    According to this report, most Botnet C&C's seem to be located in China, and / or on a .cn TLD. US features prominently mostly because dot-com is such a popular TLD, and is technically a US one-- but that hardly indicates presence in the US. Using a dot-CN domain, on the other hand, almost certainly indicates geographic location in China, which is reflected in their graphs.

    EDIT: However--- I will say that here:
    https://www.shadowserver.org/w...
    Gives me pause for thought. If those stats are accurate, the US has more C&Cs than I realized.

  2. Re:NSA Walks a Fine Line by dweller_below · · Score: 1 · on Schneier: Break Up the NSA
    But, for the last 10 years, the NSA has not walked the line at all. If the NSA could evenly balance the equities issue: https://www.schneier.com/blog/..., then there would less problems. But, now, there is no balance. The NSA takes many actions that demonstrate that their drive to Attack has suppressed their duty to Defend. They include:
    1. 1) BULLRUN - http://en.wikipedia.org/wiki/B...
    2. 2) The exploit marketplace is greatly enhanced by the activities of the NSA. This marketplace drives the creation of new exploit. It threatens us all. The NSA never publishes an exploit. Instead, they purchase exploit. Again and again. Many times, they are purchasing exploit they already own, because they don't want to reveal what they own. It is inevitable that they frequently purchase info on exploit that they create. The exploit marketplace would collapse, if the NSA, CyberCommand and their consultants would just stop buying. The exploit marketplace would vanish, if the NSA freely disclosed a fraction (say 30%) of their exploits every year.
    3. 3) Large networks of Bots can only exist at the sufferance of the NSA. Again, if the NSA wished, they could easily, trivially track the C&C of the large criminal Bots. Then they could be dismantled using the ShadowServer's infrastructure: https://www.shadowserver.org/w... Instead, it appears the NSA is maintaining the existence of the Bots for it own reasons.
    4. 4) The lack of malware Epidemiology. The NSA could publish accurate statistics on incidence of malware. Again, the NSA is in a unique position to track the dissemination and activity of malware. With those stats, we could make accurate determinations of the effectiveness of different security measures. With accurate Epidemiology, we can move defense from superstition to science. Instead, it appears the NSA doesn't want effective defense.
    5. 5) Spoofed DoS packets on the internet can only exist because the NSA tolerates them. If the NSA wished, they could easily, trivially identify all the sources of Spoofed packets. The NSA has enough listening points they can track a stream of spoofed packets back to it's source. Then those sources would be identified, fixed/shunned, and eliminated. Instead, it appears the NSA maintains those sources as cover for their own activities.

    That is why Schneier is advocating the breakup of the NSA. We must remove the equities debate from their hands. One part will be driven by offense, the other by defense. And Offense will stop being able to suppress Defense.

  3. No sensational headlines? by hAckz0r · · Score: 3, Interesting · on New IE Remote Code Execution Vulnerability Discovered
    That because the threat has changed. Now it's about botnets and making a long term profit, not just scaring people senseless. If the botnet is not completely stealth then it is not successful, and dies an early death. The current set of botnets are almost military grade software, out there waiting for the highest bidders line of work. The problem has not gone away, its just gone underground where only the most talented admins can even find or track them.

    .
    Botnet Command and Control map:
    https://www.shadowserver.org/wiki/pmwiki.php/Stats/BotnetMaps#botnet

  4. Re:ClamAV, Open Source Antivirus by rbrausse · · Score: 1 · on Is Your Antivirus Made By the Chinese Government?

    But ClamAV is one of the worst engines out there.

    I see this claim all the time, and I always have to wonder: what evidence is there for this claim?

    okay, according to Shadowserver somewhere in the middle

    If one need's an antivirus tool (it would be a fair point to call all of them snake oil) use a package with a higher detection rate.

    Really? Please name a few, or even just one, that a) are open source, b) don't consume resources like the machine is some dedicated virus scanning box and c) can easily be integrated to any mail server (at a minimum they have to not require a GUI and run on Linux/BSD).

    a) only clam, I wasn't aware that open source is a prerequisite for using software
    b)/c) I used trendmicro on mail gateways, usable without X11 and with a quite small resource foot print

  5. HOSTS files are superior to AdBlock &/or DNS a by Anonymous Coward · · Score: 0 · on 4chan Has Been DDOSed

    This one's JUST FOR YOU, clone (disprove every single one of its points, as ,b>you failed badly here before on this very same note -> http://slashdot.org/comments.pl?sid=1755714&cid=33353946 AND, for your trolling me as AC here today http://slashdot.org/comments.pl?sid=1922942&cid=34687498 , and YOU FAILED LARGE on your end clone, with a bogus script that didn't work and I had to correct it for you here today after you worked DAYS on it no less, & I had to tell you how/where/when/why it failed, which you corrected for, lol, per MY suggestions no less), so here we go:

    ---

    20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/

  6. Thanks 4 answer: I asked the question... apk by Anonymous Coward · · Score: 0 · on Carrier Trick To Save IPv4 Could Help Spammers

    ""IP Reputation" systems are basically a step beyond DNSBLs (which only consider things as white vs black). There is a decent explanation in Wikipedia's Sender's IP verification section of their E-mail authentication article" - by Khopesh (112447) on Saturday December 18, @01:54PM (#34601326) Homepage

    Thanks - that's to BOTH yourself, and SuricouRavenn, who also replied here in regards to "IP Reputation" & what it is (I have a message for SuricouRavenn here also -> http://yro.slashdot.org/comments.pl?sid=1903798&cid=34559886 regarding Windows Defender/Microsoft Security Essentials) - thank you!

    I do MUCH THE SAME as a DNSBL, albeit locally... via custom HOSTS files - here is why (long read, but detailed & I think you MAY find it, informative, possibly):

    ---

    20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/

  7. Easy to beat with a custom HOSTS file by Anonymous Coward · · Score: -1 · on Spamhaus Under DDoS Over Wikileaks.info

    "1) Russian criminals have control over the wikileaks.org and wikileaks.info domains and are distributing malware. The current real wikileaks website is wikileaks.ch." - by Anthony Mouse (1927662) on Saturday December 18, @08:04PM (#34603730)

    ping wikileaks.ch IS YOUR FRIEND!

    Enter the result of that into your custom HOSTS file (Windows: %WinDir%\system32\drivers\etc OR on LINUX: root/etc OR ON ANDROID PHONES: by mounting the system mountpoint first, w/ read + WRITE ability, & then using the SDK tool ADB to PUSH the new HOSTS file into the etc folder there, overwriting the stock-oem model)

    E.G.-> (from MY "ping" result, that would go into a HOSTS file for this):

    178.21.20.9 wikileaks.ch

    PUT THAT INTO YOUR CUSTOM HOSTS FILE (after pinging wikileaks.ch, because the IP address you come up with MAY be different than that which I come up with here).

    That's doing a "whitelisting" in your HOSTS file, w/ the proper IPAddress - to - HOST/DOMAINName resolution, so you reach that site (and, you avoid DNS request log tracking in doing so also, bonus, because you NEVER USE THE ISP/BSP (or other) DNS server, period).

    ---

    "2) Spamhaus has been telling people about (1). 3) The Russian criminals are now retaliating by using their botnets to DDoS Spamhaus under the flag of AnonOps." - by Anthony Mouse (1927662) on Saturday December 18, @08:04PM (#34603730)

    Hey - They're easy to beat too (Russian criminals), & also by using a HOSTS file...

    Albeit, this time, NOT FOR WHITELISTING A SITE, but, rather for "blacklisting" the sites/servers they use or redirect you to, for loading malware onto your systems!

    (Between that, & using NoScript or turning off javascript period, you ARE PROTECTED (you really only need it for database accesses when you come down to it, to do "real things" (not playtime stuff, or eyecandy) usually, after all)).

    APK

    P.S.=> Reputable, reliable, & regularly updated sources for blacklisting data for a HOSTS file are as follows:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/
    http://hosts-file.net/?s=Download
    https://zeustracker.abuse.ch/monitor.php?filter=online
    Spybot "Search & Destroy" IMMUNIZE feature (fortifies HOSTS files with KNOWN bad servers blocked)

    And yes: Even SLASHDOT &/or The Register help!

    (Via articles on security (when the source articles they use are "detailed" that is, & list the servers/sites involved in attempting to bushwhack others online that is... not ALL do!)).

    2 examples thereof in the past I have used, & noted it there, are/were:

    http://it.slashdot.org/comments.pl?sid=1898692&cid=34473398

  8. HOSTS files are superior to AdBlock &/or DNS a by Anonymous Coward · · Score: -1 · on Should Wikipedia Just Accept Ads Already?

    20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/
    http://hosts-file.net/?s=Download
    https://zeustracker.abuse.ch/monitor.php?filter=online
    Spybot "Search & Destroy" IMMUNIZE feature (fortifies HOSTS files with KNOWN bad servers blocked)

    And yes: Even SLASHDOT &/or The Register help!

    (Via articles on security (when the source articles they use are "detailed" that is, & list the servers/sites involved in attempting to bushwhack others online that is... not ALL do!)).

    2 examples thereof in the past I have used, & noted it there, are/were:

    http://it.slashdot.org/comments.pl?sid=1898692&cid=34473398

  9. HOSTS files are superior to AdBlock &/or DNS by Anonymous Coward · · Score: 0 · on Should Wikipedia Just Accept Ads Already?

    20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/
    http://hosts-file.net/?s=Download
    https://zeustracker.abuse.ch/monitor.php?filter=online
    Spybot "Search & Destroy" IMMUNIZE feature (fortifies HOSTS files with KNOWN bad servers blocked)

    And yes: Even SLASHDOT &/or The Register help!

    (Via articles on security (when the source articles they use are "detailed" that is, & list the servers/sites involved in attempting to bushwhack others online that is... not ALL do!)).

    2 examples thereof in the past I have used, & noted it there, are/were:

    http://it.slashdot.org/comments.pl?sid=1898692&cid=34473398

  10. HOSTS files are superior to AdBlock & DNS even by Anonymous Coward · · Score: 0, Insightful · on Should Wikipedia Just Accept Ads Already?

    20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/
    http://hosts-file.net/?s=Download
    https://zeustracker.abuse.ch/monitor.php?filter=online
    Spybot "Search & Destroy" IMMUNIZE feature (fortifies HOSTS files with KNOWN bad servers blocked)

    And yes: Even SLASHDOT &/or The Register help!

    (Via articles on security (when the source articles they use are "detailed" that is, & list the servers/sites involved in attempting to bushwhack others online that is... not ALL do!)).

    2 examples thereof in the past I have used, & noted it there, are/were:

    http://it.slashdot.org/comments.pl?sid=1898692&cid=34473398

  11. With a HOSTS file? You don't NEED to do that... by Anonymous Coward · · Score: 0 · on NSS Labs Browser Report Says IE Is the Best, Google Disagrees

    "Reading the report, it sounds like they were just testing the browsers' databases of known malware/phishing sites" - by gman003 (1693318) on Wednesday December 15, @03:51PM (#34565790)

    Per my subject-line above? With a GOOD UP-TO-DATE HOSTS FILE?? You don't even NEED to do that!

    I update mine daily, from these reliable & reputable sources (for blocking out KNOWN bad sites/servers/host-domain names etc.):

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/
    http://hosts-file.net/?s=Download
    https://zeustracker.abuse.ch/monitor.php?filter=online
    Spybot "Search & Destroy" IMMUNIZE feature (fortifies HOSTS files with KNOWN bad servers blocked)

    And yes: Even SLASHDOT &/or The Register help!

    (Via articles on security (when the source articles they use are "detailed" that is, & list the servers/sites involved in attempting to bushwhacker others online that is... not ALL do!)).

    2 examples thereof in the past I have used, & noted it there, are/were:

    http://it.slashdot.org/comments.pl?sid=1898692&cid=34473398
    http://it.slashdot.org/comments.pl?sid=1896216&cid=34458500

    ---

    So, IF/WHEN you have a HOSTS file that has up to date blocking data in it? There's really no real need to do "browser based checks" of URL's, other than for "layered-security" purposes (which isn't a BAD THING TO DO, & it's the "current trend" for better security online).

    Besides: IE, FireFox, and Opera ALL have methods for blocking out known bad sites already:

    ---

    Opera has URLFILTER.INI (Spybot S&D populates this, alongside the Opera community doing updates to it too)

    FireFox has an analog to Opera's filter file (which is what SpyBot S&D populates alongside a HOSTS file too vs. known bad sites)

    IE has "restricted zones"

    ---

    Still - the folks @ MS doing this in IE9 (which I use here)? Not a bad thing at all, for "layered-security"...

    APK

    P.S.=> Even the folks @ WIKIPEDIA aren't against blacklists like HOSTS:

    ---

    PERTINENT QUOTE/EXCERPT (from -> http://www.theregister.co.uk/2010/12/16/wikileaks_mirror_malware_warning_row/ )

    "we are in favour of 'Blacklists', be it for mail servers or websites

    ---

    Why? Well, because they work... especially for layered security online... apk

  12. They can't touch me, & here is HOW/WHY by Anonymous Coward · · Score: 0 · on Researchers Tracking Emerging 'Darkness' Botnet

    From the source article, I obtained their server's domain/hostnames and nameservers, which I now have added to my custom HOSTS file... & blocked out, thus:

    0.0.0.0 greatfull-toolss.ru
    0.0.0.0 ns1.reg.ru
    0.0.0.0 ns2.reg.ru
    0.0.0.0 greatfull.ru
    0.0.0.0 ns1.arbusi-host.net
    0.0.0.0 ns2.arbusi-host.net
    0.0.0.0 hellcomeback.ru

    They're not going to get to ME, because I cannot get to they now... & what I can't touch, I cannot be "burned" by, simple!

    HOSTS as blacklists, work! Some evidences & cases why you may be interested in implementing such protective (and speed gaining features too) measures:

    ---

    15++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via PINGS &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/
    http://hosts-file.net/?s=Download

  13. metrix007 disprove these points then on HOSTS by Anonymous Coward · · Score: 0 · on Chinese DNS Tampering a Real Threat To Outsiders

    "Kid, you have no idea what you're talking about... You are strongly misinformed on several points. I can't be bothered to respond to you, (i.e. feed the troll) because I don't think it would be worth my time. You're obsessed, and not interested in rational discussion - by metrix007 (200091) on Monday December 06, @07:03AM (#34458496)

    Ok, you FINALLY came back in, & NO: I am TRULY interested in "rational discussion", not avoiding it (as you obviously are with your 2 trollish replies here in this thread), so with that said? Disprove each of these 15 points on HOSTS files then:

    15++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via PINGS &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/
    http://hosts-file.net/?s=Download
    https://zeustracker.ab

  14. Thanks for the info.: Why? See inside... apk by Anonymous Coward · · Score: 0 · on Doorways Sneak To Non-Default Ports of Hacked Servers

    Thanks for supplying the bogus domains information. I checked on yourisp.ru, and sure enough - a known bogus malware domain/host name. It's blocked out here now, alongside payment8ltd.net, & how? Here is HOW & WHY:

    15++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via PINGS &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/
    http://hosts-file.net/?s=Download
    https://zeustracker.abuse.ch/monitor.php?filter=online
    Spybot "Search & Destroy" IMMUNIZE feature (fortifies HOSTS files with KNOWN bad servers blocked)

    8.) HOSTS files will allow you to get to sites you like, via hardcoding your favs into a HOSTS file, FAR faster than DNS servers can by FAR (by saving the roundtrip inquiry time to a DNS server & back to you).

    9.) AdBlock & DNS servers are program

  15. I never see their crap. How? Block spammer domains by Anonymous Coward · · Score: 0 · on A Third of World's Spam From One Russian Man

    What blocks off known bogus sites/servers or entire hostnames/domains better than anything (because it's not a program, and because it's just a filter that operates @ the IP Stack level, and covers ALL your webbound programs, plus mine at least gets updated from reputable & reliable sources, daily): a custom HOSTS file.

    You've also already got one, whether you all know it or not, & it's just a matter of either downloading a prebuilt on (sources are below), or filling one in yourself, and yes, they work even vs. spam mail (& better than adblock does, because that only covers browsers it's designed for (maybe 1-3 of them), but not external HTML + script based external email programs, like Outlook Express/FULL Outlook)).

    15++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF...).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via PINGS &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm
    http://someonewhocares.org/hosts/
    http://hostsfile.org/hosts.html
    http://hostsfile.mine.nu/downloads/
    http://hosts-file.net/?s=Download
    https://zeustracker.abuse.ch/monitor.php?filter=online
    Spyb

  16. At least you were "modded up" for HOSTS use... apk by Anonymous Coward · · Score: 0 · on WikiLeaks Moves To Swiss Domain After DNS Takedown

    15++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF...).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via PINGS &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm [mvps.org]
    http://someonewhocares.org/hosts/ [someonewhocares.org]
    http://hostsfile.org/hosts.html [hostsfile.org]
    http://hostsfile.mine.nu/downloads/ [hostsfile.mine.nu]
    http://hosts-file.net/?s=Download
    https://zeustracker.abuse.ch/monitor.php?filter=online
    Spybot "Search & Destroy" IMMUNIZE feature (fortifies HOSTS files with KNOWN bad servers blocked)

    8.) HOSTS files will allow you to get to sites you like, via hardcoding your favs into a HOSTS file, FAR faster than DNS servers can by FAR (by saving the roundtrip inquiry time to a DNS server & back to you).

    9.) AdBlock & DNS servers are programs, and subject to bugs programs can get. Hosts files are merely a filter and not a program, thus not subject to bugs of the nature just discussed.

    10.) Hosts files don't eat up CPU cycles like AdBlock does while it parses a webpages' content, nor as much as a DNS server does while it runs.

    11.) HOSTS files are E

  17. If users understand text files, they do by Anonymous Coward · · Score: 0 · on The Pirate Bay Co-Founder Starting P2P-DNS

    "Or better yet, WTF are host files? Non-techs can sort of understand ABP, as it is an add-on that stops bad or all ads. Host files, no way an average computer user would understand them or utilize them." - by stonewallred (1465497) on Wednesday December 01, @10:40AM (#34404550)

    Take a GOOD solid read (and if still in doubt? Refer to this mvps.org link -> http://www.mvps.org/winhelp2002/hosts.htm (it has a great writeup that's EASILY UNDERSTOOD & very detailed, on HOSTS)) - this will show you how/why HOSTS files are superior to AdBlock or even DNS servers on MANY accounts (and why you ought to use them in combination for the "best in 'layered security'" practices online!

    14 ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK:

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF...).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via PINGS &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/
    http://www.stopbadware.org/home

    REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):

    http://www.mvps.org/winhelp2002/hosts.htm [mvps.org]
    http://someonewhocares.org/hosts/ [someonewhocares.org]
    http://hostsfile.org/hosts.html [hostsfile.org]
    http://hostsfile.mine.nu/downloads/ [hostsfile.mine.nu]

  18. HOSTS files benefits (over AdBlock &/or DNS ev by Anonymous Coward · · Score: 0 · on The Pirate Bay Co-Founder Starting P2P-DNS

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF...).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    4.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via PINGS &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    5.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    6.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    http://ddanchev.blogspot.com/
    https://zeustracker.abuse.ch/monitor.php?filter=online
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/
    http://www.mvps.org/
    http://someonewhocares.org/
    http://hostsfile.mine.nu/hosts0
    http://hosts-file.net/?s=Download
    http://www.stopbadware.org/home

    7.) HOSTS files will allow you to get to sites you like, via hardcoding your favs into a HOSTS file, FAR faster than DNS servers can by FAR (by saving the roundtrip inquiry time to a DNS server & back to you).

    8.) AdBlock is a program, and subject to bugs programs can get. Hosts files are merely a filter and not a program, thus not subject to bugs of the nature just discussed.

    9.) Hosts files don't eat up CPU cycles like AdBlock does while it parses a webpages' content.

    10.) HOSTS files are EASILY user controlled, obtained (for reliable ones -> http://www.mvps.org/winhelp2002/hosts.htm ) & edited too, via texteditors like Windows notepad.exe or Linux nano (etc.)

    11.) You don't have the sourcecode to Adblock. With hosts you don't even need source to control it (edit, update, delete, insert of new entries via a text editor).

    12.) Hosts files are easily secured via using MAC/ACL &/or Read-Only attributes applied.

    13.) AND, LASTLY? SINCE MALWARE GENERALLY HAS TO OPERATE ON WHAT YOU YOURSELF

  19. HOSTS files are superior to AdBlock & how/why by Anonymous Coward · · Score: 0, Redundant · on The Pirate Bay Co-Founder Starting P2P-DNS

    1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF...).

    2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).

    3.) Adblock doesn't protect email programs external to FF, Hosts files do.

    4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).

    4.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw for years now - hosts protect against that via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via PINGS &/or WHOIS though, regularly, so you have the correct IP & it's current)).

    5.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders

    6.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:

    http://ddanchev.blogspot.com/
    https://zeustracker.abuse.ch/monitor.php?filter=online
    http://www.malware.com.br/lists.shtml
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://news.netcraft.com/
    http://www.shadowserver.org/
    http://www.mvps.org/
    http://someonewhocares.org/
    http://hostsfile.mine.nu/hosts0
    http://hosts-file.net/?s=Download
    http://www.stopbadware.org/home

    7.) HOSTS files will allow you to get to sites you like, via hardcoding your favs into a HOSTS file, FAR faster than DNS servers can by FAR (by saving the roundtrip inquiry time to a DNS server & back to you).

    8.) AdBlock is a program, and subject to bugs programs can get. Hosts files are merely a filter and not a program, thus not subject to bugs of the nature just discussed.

    9.) Hosts files don't eat up CPU cycles like AdBlock does while it parses a webpages' content.

    10.) HOSTS files are EASILY user controlled, obtained (for reliable ones -> http://www.mvps.org/winhelp2002/hosts.htm ) & edited too, via texteditors like Windows notepad.exe or Linux nano (etc.)

    11.) You don't have the sourcecode to Adblock. With hosts you don't even need source to control it (edit, update, delete, insert of new entries via a text editor).

    12.) Hosts files are easily secured via using MAC/ACL &/or Read-Only attributes applied.

    13.) AND, LASTLY? SINCE MALWARE GENERALLY HAS TO OPERATE ON WHAT YOU YOURSELF CAN DO (running as limited class/least privlege user, hopefully, OR even as ADMIN/ROOT/SUPERUSER)? HOSTS "LOCK IN" malware too, vs. communicating "back to mama" for orders (provided they have name

  20. Ummmm, yes... apk by Anonymous Coward · · Score: 0 · on US Government Seizes Torrent Search Engine Domain

    "How about if - rather than an FBI warning or whatever - the site is replaced by a clone that sniffs your info or installs trojans?" - by phorm (591458) on Friday November 26, @01:29PM (#34351528) Homepage

    HOSTS can also be used to block KNOWN bad websites that serve up malware:

    http://ddanchev.blogspot.com/
    http://www.malwareurl.com/listing-urls.php?page=1&urls=off&rp=
    http://www.malware.com.br/lists.shtml
    http://securitylabs.websense.com/content/alerts.aspx
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://www.scansafe.com/threat_center/threat_alerts
    http://news.netcraft.com/
    http://www.shadowserver.org/
    https://zeustracker.abuse.ch/monitor.php?filter=online

    Many of those sites have "removal lists" IF a site cleans itself up, or if it just "drops out of site"!

    (The latter I don't trust though, because malware makers "recycle" domainname/hostnames they own, & the RBN (russian business network) though thought 'dead'? Has had it's domain/host names reused by ANOTHER botnet recently!)...

    Thus, I add those sites that are known as serving up malware exploits as BLOCKED in my HOSTS file, and I can't get to them, until they're proven clean (I don't remove ones that just "drop" because they've been shown to get "recycled/reused").

    APK

    P.S.=>

    "And when the server gets bushwhacked instead of the domain, and they move to a new host - but you're still getting the old IP from your hosts file - then what?" - by phorm (591458) on Friday November 26, @01:29PM (#34351528) Homepage

    I again confronted you today on this, as to HOW you were "modded up" here -> http://slashdot.org/comments.pl?sid=1887878&cid=34387450 because I already covered the other part in my initial reply with this statement (as to sites changing IP addresses) requoted, again, below next:

    "& if they change it again? Re-Ping (with a double verifying WHOIS) said site & the TLD that does NOTHING but resolve hosts/domains to their correct IP will give you a correct IP address (provided you're NOT being "man-in-the-middle" attacked) to reinsert into your hosts file to update it..." - by Anonymous Coward on Friday November 26, @12:36PM (#34351132)

    As to verifying IP addresses changing on sites.

    So, if a site also is proven to harbor malware exploits?? A custom HOSTS file is also used to block those out until they are proven CLEAN... get it??

    I don't see HOW/WHY you were modded up, because I cover the 1st point & anyone that knows how to use a HOSTS file knows it can be used to BLOCK OUT BAD SITES/SERVERS THAT SERVE UP EXPLOITS TOO, per the above... apk

  21. I add between 50-2000 new bad sites a day... apk by Anonymous Coward · · Score: 1, Insightful · on State-Sponsored CyberAttacks Expected To Rise

    To a custom hosts file: That tell you anything? It used to only be that many a month years ago prior to I'd say, 2004 or thereabouts...

    Additionally, to so do, I'm still using the same decent sources as well as my own I built up from the same sources since 1997:

    Spybot Search & Destroy's "IMMUNIZE" feature
    http://ddanchev.blogspot.com/
    http://www.malwareurl.com/listing-urls.php?page=1&urls=off&rp=
    http://www.malware.com.br/lists.shtml
    http://securitylabs.websense.com/content/alerts.aspx
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://www.scansafe.com/threat_center/threat_alerts
    http://news.netcraft.com/
    http://www.shadowserver.org/
    https://zeustracker.abuse.ch/monitor.php?filter=online

    Today/Nowadays? It's worse than it was as far as PC's being @ risk online just on sheer numbers of bogus sites or even banner ads that are maliciously scripted in intent. Just on sheer numbers alone.

    APK

    P.S.=> In summation, all I can tell you, from my "POV" of making a hosts file full of known malware or maliciously scripted sites for a LONG time now is, it's gotten worse, & is happening FAR faster than it used to be (more folks understand coding now is why most likely & the tools are simpler/better too), & I've been building up a closing in on 1 million bogus sites based HOSTS file for over 14 or so years now as my basis in fact here is all...

  22. I don't know about 1 million in Q2 2010, but... by Anonymous Coward · · Score: 0 · on One Million Sites Infected With Malware In Q2

    "Web anti malware firm Dasient has published data claiming that more than 1 million Web sites were compromised in the second quarter, 2010 - a sharp increase. *In Sean Connery's James Bond voice* Of course they have." - by AnonymousClown (1788472) on Thursday September 16, @12:25PM (#33600940)

    I don't know about THAT, however? Well - I DO know that my personal custom HOSTS file is nearly @ 1 million absolutely unique entries of known bad sites/servers, and it took me nearly 10++ yrs. now to get it to that # no less!

    I populate it from very reputable & reliable sources listed below:

    ----

    http://ddanchev.blogspot.com/
    http://www.malware.com.br/lists.shtml
    http://securitylabs.websense.com/content/alerts.aspx
    http://www.stopbadware.org/
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://www.scansafe.com/threat_center/threat_alerts
    http://news.netcraft.com/
    http://www.shadowserver.org/
    https://zeustracker.abuse.ch/monitor.php?filter=online
    http://en.wikipedia.org/wiki/Hosts_file
    http://www.mvps.org/
    http://someonewhocares.org/
    http://hostsfile.mine.nu/hosts0
    http://hosts-file.net/?s=Download
    http://www.stopbadware.org/home

    + Spybot "Search & Destroy" IMMUNIZE feature add ons also...

    ----

    In fact, as far as growth this summer alone? It's been more than usual, and last summer last year was the same it seems/iirc too...

    However: Ahem - 1 million++ new known bad sites &/or servers, & in just 1 quarter?

    (Hey, anything's possible, but that's a bit "excessive/steep" imo @ least... still, one never knows! Still, I somehow DOUBT it's that bad out there. Yes, it's bad, but not THAT bad... I don't think so @ least, and I tend to keep pretty steady-eddy tracking of this up (for over 10++ yrs. now @ sites & sources such as those listed above via populating my custom HOSTS file for both added security AND added speed))

    I.E./E.G.-> The # of entries of known bad sites &/or servers in my HOSTS file, which a great deal of came from my sources listed above no less, had grown this year from July 15th 2010 to Sept. 15th 2010 by almost 18,000 entries alone at the tail-end of this summer alone (up to 881, 543++ total entries, & gaining typically between 50-250 more each day).

    It's crazy out there now, but it doesn't affect "me or mine", because I cannot be hurt by that which I cannot enter to get hurt by it, such as a bad website that's malscripted or bears a malware, because that's what HOSTS files do, at least part in the way of security (and more for speed such as adbanner blocking (which also helps security too, because many a banner ad has been found with malicious code in it too the past few years now as well), and site IP-to-URL hardcoding): HOSTS files, if done right, can keep you from getting burned in a bogus kitchen, so-to-speak!

    Still - 1 million++ new known bad sites in just 1 quarter this year 2010? I have trouble with that estimation, in believing it to be blunt about it, & yes, I have been looking at this type of data for quite a long time now (over 10++ yrs. in fact, in making a custom HOSTS file to protect vs. this type of lunacy).

    APK

    P.S.=> Since I

  23. If this is about stopping botnets, malware, etc.? by Anonymous Coward · · Score: 0 · on The Cybersecurity Act of 2009 Passes Senate Panel

    Per my subject-line above. & this quote from the article here on /.:

    "The Cybersecurity Act of 2009 passed a Senate panel, giving the president unprecedented power to issue a nation-wide blackout or restriction on websites without congressional approval" - by Akido37 (1473009) on Tuesday March 30, @10:49AM (#31670706)

    ?

    Well, then from the SOUND of it @ least, I am ALL FOR IT personally!

    Why??

    Well, because online attacks DO go on, & they DO exist, & they DO INTERFERE WITH PEOPLE'S LIVES IN SERIOUS WAYS IS WHY!

    (AND, in many ways, because a LOT goes over "the public internet" people, a lot more than say, slashdot webpages, whether you know it or not)...

    E.G.-> Such as databases' drivers & libs using ports on the net, like:

    ----

    A.) SQLServer = default ports usually used -> 1433/1434/4022/2382/2382/443 (SSL)/135 (RPC) & on both UDP & TCP/IP

    B.) Oracle = default ports usually used -> 66/1521/1525/1526/1527/1529/1571/1575/1630/1748/1754/1808/1809/1830/2481/2482/2483/2484/3872/3891/3938

    C.) IBM DB/2 = default ports usually used -> 523/532/6789/50000/60000 (probably more here, this is the one I am LEAST familiar with, sorry I could not be more "complete" here)

    D.) MySQL = default ports usually used -> 3306 (probably more here too, I am JUST "getting into" this one lately (hey, it's FREE man!!!)

    ----

    (Those tools, as I am sure MOST of you know, are for businesses where YOU yourself do business, which means YOUR MONIES or other life-crucial information, for instance - which again, is a LOT more than & of most likely far greater import than merely the web's HTML data alone you use, while you browse websites, in other words...)

    And, then there are things like POWER PLANTS (which, like it or not, DO conduct things over the public internet), & even life-monitoring devices + security systems.

    SHOULD THE GOV'T. TAKE ACTIVE MEASURES vs. ATTACKS ON THESE THINGS NOTED ABOVE? Hey guys...?? ABSOLUTELY!

    (Especially IF they're being "cyber-attacked", OR, just to prepare for such an event, JUST IN CASE!)

    APK

    P.S.=> See- The past 12 yrs. now or so, I've taken a more than "somewhat" active interest in things 'security-related' online... &, know what sort of "spooks me" (& yes, even shocks me, because of the cultures/nations I see it coming from mainly)?

    CHINA...

    Yes - It really "blows my mind" that a culture w/ more than 5,000++ yrs. of recorded history behind it is showing up, & MORE THAN ANY OTHER NATION BY FAR, in the lists I use to populate my HOSTS file here, & here are the sources (all known & reputable) I typically utilize, so you can check this yourselves (or, perhaps, even USE THEM yourselves for hosts file population to block out known bogus sites &/or servers):

    -----

    http://ddanchev.blogspot.com/
    http://www.malwareurl.com/listing-urls.php?page=1&urls=off&rp=
    http://www.malware.com.br/lists.shtml
    http://securitylabs.websense.com/content/alerts.aspx
    http://blog.fireeye.com/
    http://mtc.sri.com/
    http://www.scansafe.com/threat_center/threat_alerts
    http://news.netcraft.com/
    http://www.shadowserver.org/
    https://zeustracker.abuse.ch/monitor.php?filter=online
    http://en.wikipedia.org/wiki/Hosts_file

  24. $employer is on the target list of pushdo drones by nfsilkey · · Score: 2, Informative · on Botnet Targets Web Sites With Junk SSL Connections

    According to our graphs, our targeted frontend is taking the drone's trashy SSL requests like a champ (reverse-proxies are humming as expected, no inordinate load, etc).

    You too can see if you are on the hitlist: http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20100129

  25. Re:So glad by GaryOlson · · Score: 1 · on Microsoft To Ship Emergency IE Patch
    You forgot the most important part of The Compromise Toolkit: Adobe Reader

    ...malicious PDFs over the last few years and back tracked a number of compromises .... to know this is a huge problem

  26. Why all the paranoia about executable code by gzipped_tar · · Score: 4, Insightful · on PDF Vulnerability Now Exploitable With No Clicking

    One thing I don't understand is the seemingly common paranoia towards "executable code" in the discussions here.

    First, there's no fundamental difference between "code" and "data". It's all binary blob. The .text section in any of your ELF programs is understood as "executable code" by the interpreter (ld.so) but as plain document by objdump. The point is to always interpret the data as how it is intended to be used, and this is hard. This Adobe fiasco is caused by a buffer overflow in the program (which is not even in a function responsible for JavaScript). Buffer overflows are known to be useful for exploits because they allow an attacker to "cheat" the program so that it misinterprets what intended to be document data as executable code. It just happens that the flawed code can be attacked with greater rate of success using JavaScript. (According to this security advisory http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219)

    Second, embedding executable code in a document is not inherently evil or stupid. It's just an idea that can be either utilized or abused, varying from implementation to implementation. I don't like scripting in PDF either but not for the reason of its alleged insecure nature, but because it bloats the file format.

    Just my 2c..

  27. Workaround for Security Hole by Lothsahn · · Score: 0 · on PDF Vulnerability Now Exploitable With No Clicking

    If you're like me and have full Adobe Acrobat installed (Sumatra doesn't fill your needs and you don't own Foxit), there's a very easy way to workaround this security hole until it is fixed. Go to the edit->preferences menu, go to "Javascript" in the menu and uncheck the box that says "Disable Javascript in Adobe"

    This should workaround the problem sufficiently until Adobe releases a patch.

    More information here:
    http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219

  28. The real enviroment? by Anonymous Coward · · Score: 0 · on Against Unknown Viruses, Avira AntiVir the Winner For Now

    This is all good and well, but tests do not reflect the true enviroment and never will. I'd rather follow something like http://www.shadowserver.org/wiki/pmwiki.php?n=Stats.Virus90-DayStats

    The reason I link to the 90 days stats is that it shows consistency. Judging a product using limited dataset is illogical.

  29. Updated info re this sploit... by Fallen+Andy · · Score: 3, Informative · on Adobe Flash Zero-Day Attack Underway
    ShadowServer has updated information on this here.

    See also Symantec Threatcon here

    So it looks as if you have the latest flash plugin (9.0.124) you may be ok.

    Andy

  30. Updated info re this sploit... by Fallen+Andy · · Score: 3, Informative · on Adobe Flash Zero-Day Attack Underway
    ShadowServer has updated information on this here.

    See also Symantec Threatcon here

    So it looks as if you have the latest flash plugin (9.0.124) you may be ok.

    Andy

  31. Re:Accountability by thejynxed · · Score: 1 · on FBI Releases Results of Operation Bot Roast

    Ask and ye shall receive:

    http://blog.washingtonpost.com/securityfix/2006/03 /when_macs_attack.html

    http://lwn.net/Articles/222153/

    http://www.networkworld.com/community3/?q=node/534 4

    http://blogs.securiteam.com/index.php/archives/304

    http://www.shadowserver.org/

    I can continue for pages and pages if you wish. You know, search engines are useful tools at times ;) Now granted, most of it comes from exploits in 3rd-party apps, such as Apache, PHP, SQL, etc. But...knowing this, and how there are botnets running with Apache priviledge levels.....kind of dumps that whole "don't run as root in *nix" argument right into the toilet. As long as people are people, they can be socially-engineered to offer up their passwords for whatever reason (I'm looking at you, OSX users). Relying on a popup password entry box for security is just as silly as allowing a Windows machine to sit un-patched on the internet.

    I am actually quite surprised that more OSes don't have some sort of application firewalling/sandboxing built into them, instead of relying on concepts like UAC or root permissions that are worthless if all it takes to bypass them is someone typing a password into a popup box, clicking Allow (and how many people do we know that use blank or short, all alphabetical passwords, hmmmm?), or running insecure application software that is always accessible via the internet.

  32. Re:Unfortunately, this is not true by ButcherCH · · Score: 1 · on Botnet on Botnet Action

    If you look at some statistics like these http://www.shadowserver.org/wiki/pmwiki.php?n=Stat s.BotCounts it doesn't look like it's going down.

  33. Re:You could always try private sector... by plover · · Score: 1 · on Spam-Bot Intrusion Caught — Now What?
    Shadowserver is a group of security researchers that study malware. They actually encourage people to report new incidences of malware to their anti-virus vendors. I don't know if they accept direct submissions of malware, they're kind of a low-profile group. I think if they took submissions directly in any way, the botherders would probably flood them big time. But I don't know, you can try.

    Note that they don't actually "do anything" to the botnets. They study them and gather information, but they leave the actual response to law enforcement.

  34. The Same Old Bots by madsheep · · Score: 4, Informative · on Two Worm "Families" Make Up Most Botnets

    I have a few comments and one will answer some of the previous questions to some degree.
    First, the majority of these trojans, specifically these are all IRC based. They are very easy to spot, especially in corporate environments. Why? Well because most people do not use IRC while they are at work. Not to mention many companies will have policies against it. This makes intrusion detection for these kinds of bots very easily. Since most of these servers housing the bots are just standard Unreal IRCD (generally hacker-installed) or whatever IRCD undernet/efnet/etc. run on, they are not encrypted. This means when a machine connects, traffic with "NOTICE", "PRIVMSG", "JOIN #" etc is all sent in the clear. There have been snort/bleeding snort rules to look for this type of activity for years and they haven't had to change much. Sure the ports might not always be 6667-6669/7000, but looking for activity like this on a certain port is dumb to do anyway.

    A simple analysis of most IRC traffic should you have real-time peaks or capture logs will tell you pretty quick if it's malicious. If you see a nick change to XP|24249429 or USA|2942949 and it joins a channel called #owned with a topic of .scan 10.0.0.0/8 then there's a pretty good chance the machine in question is an infected bot and most likely with one of the aforementioned variants. Now most home users won't have insight into this type of activity. And funny enough there's not much "big brother" by way of ISPs caring much for this. Unless reported to them they most likely won't do anything. Even then they still might not do anything. http://www.shadowserver.org/ keeps a list of good/responsive ISPs. This might be more in the case of a malicious host housing an IRCD, but that's beside the point.

    Now finally these two are quite popular. Why? Well it has been said already. The source for them is our there and they are readily available. People frequently update and modify them to avoid AV detection. Hell, many people don't update and modify them. So many people are running without [updated] AV that it doesn't seem to matter much. If you notice how most people get infected, it's the same old thing. IM worm, e-mail worm, malicious website, or a scan for the 2 year old dcom exploit. Every time some new IE/Firefox/etc vulnerability is released, someone quickly makes it download their trojan.

    These variants have been around for years. Luckily the people using them are pretty dumb. It's just a matter of time before worms/viruses/etc turn to web-based (not IRC) and encryption as the norm.

  35. Tiny detail concerning shadowserver world map... by Anonymous Coward · · Score: 0 · on Bot Infestations Reach Nearly 1.2M

    It's bit outdated. http://www.shadowserver.org/wiki/uploads/Stats/cci p.jpg
    Let's play the game "find name missing/new countries (sorted by alphabet)".

    A) Afganistan
    B) Bosnia
    C) Croatia
    ...

  36. Re:Spam is just the symptom... by iangoldby · · Score: 1 · on Spam Volume Jumps 35% In November

    I'd like to know how to report a botnet. I've been to ShadowServer but (a) you have to register to report and (b) they only seem to be interested in the Command-and-Control servers.

    I have a list of IP addresses and times of attempts to exploit a mail form with a mail injection attack. It seems to me that the owners of most bot machines would be completely unaware of what is happening, and therefore might even be grateful to be told that there is a problem.

    But we need an automated system for submitting IP addresses (and time and date of attack in case it is a dynamic IP address so that it can still be traced to an individual computer). The system would look up who is responsible for the network containing that IP address and ultimately send an email to the best-placed person to get the computer cleaned up.

    (Yes, I do know about WHOIS.)

  37. Re:info on botnets by Anonymous Coward · · Score: 2, Informative · on Meet the Botnet Hunters

    Shadowserver have started something akin to what you're looking for.