PfBlockerNG v2.0 w/DNSBL



  • Great work sir! I'm looking forward to this release. Will there be any special instructions for upgrading?



  • Guess I will hold off manually editing the INC file then to add DNSBL :)
    Any ETA on this new version?

    THANKS!!!



  • Great. Thanks!



  • ETA is as soon as the Dev's validate the package, package has been submitted… Yeah!!!!! :)

    https://github.com/pfsense/pfsense-packages/pull/1174



  • @wcrowder:

    ETA is as soon as the Dev's validate the package, package has been submitted… Yeah!!!!! :)

    https://github.com/pfsense/pfsense-packages/pull/1174

    HOLY Poop!!! 23 changed files  with 8,591 additions and 5,267 deletions Total re-write? :D



  • Looking forward to this release!
    Keep up the good work mate. Awesome!  8)


  • Moderator

    @mygeeknc:

    Great work sir! I'm looking forward to this release. Will there be any special instructions for upgrading?

    There should be no concerns in migrating to pfBNG v2.0 from the existing v1.10.

    pfSense has two types of DNS Services

    • DNS Forwarder

    • DNS Resolver

    If you plan on using the DNSBL feature, you will need to use the DNS Resolver for your DNS queries, the DNS Forwarder is not an option for DNSBL. Its probably best to ensure that the DNS Resolver is working before using DNSBL.

    The DNS Resolver is developed by NLnet Labs and is named 'Unbound'. It is a validating, recursive and caching DNS resolver.  https://www.unbound.net/index.html

    Some recommendations:

    • The DNS Resolver can also be used in 'Forwardering mode'; however its best to not use this 'Forwarding mode' and keep it in 'resolver mode' as this will query the Root DNS servers for the DNS queries instead of relying on an ISPs DNS etc…

    • If you use the 'DNS Resolver Forwarder mode', only configure 'DNSSEC' if the configured DNS servers support DNSSEC. The enabling of 'DNSSEC' to harden your DNS security is highly recommended.

    • Disable the two "DHCP registrations" checkboxes, unless you really require those options.

    Here is a good primer about the DNS Resolver (Unbound) https://calomel.org/unbound_dns.html



  • @BBcan177:

    If you plan on using the DNSBL feature, you will need to use the DNS Resolver for your DNS queries, the DNS Forwarder is not an option for DNSBL. Its probably best to ensure that the

    I'm using the Bind package instead of Unbound.  Will V2.0 support that or is it hard coded to use only Unbound?  If it only supports Unbound, is it possible to support Bind in the future?


  • Banned

    @gsiemon:

    I'm using the Bind package instead of Unbound.  Will V2.0 support that

    No.



  • You doin a great job! I appreciate it and many others do so as well. It is a leightweight alternative to squid when it comes to ad-blocking.
    I was allowed ot participate in the beta test program and the DNSBL feature is my favourite. Minor issues have been ironed out with the latest upgdates so it for sure feels ready to be released.



  • @fraglord:

    You doin a great job! I appreciate it and many others do so as well. It is a leightweight alternative to squid when it comes to ad-blocking.
    I was allowed ot participate in the beta test program and the DNSBL feature is my favourite. Minor issues have been ironed out with the latest upgdates so it for sure feels ready to be released.

    Same here, it was a pleasure to help BBcan177. Hopefully I wasn't too much of a pain :D



  • yup the beta one works really nice :)
    Running my own DNS server and not from my ISP/google/ etc
    so dnsbl is really nice on it also. Keep it up BBcan



  • This has been merged, it'll be live in the package repo within at most ~15 minutes of the time of this post.

    I largely relied on all your reports here for testing, only checking that the basics function and there isn't anything malicious, or grossly wrong at a glance. If there are issues, BBCan, please follow up with pull requests and I'll make sure one of us gets them merged promptly. Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

    Thanks BBCan!


  • Banned

    @cmb:

    Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

    Done, all works pretty well (as before). :D


  • Moderator

    @cmb:

    This has been merged, it'll be live in the package repo within at most ~15 minutes of the time of this post.

    I largely relied on all your reports here for testing, only checking that the basics function and there isn't anything malicious, or grossly wrong at a glance. If there are issues, BBCan, please follow up with pull requests and I'll make sure one of us gets them merged promptly. Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

    Thanks BBCan!

    Thanks Chris!  :)



  • Package update succeeded on the second reinstall from v1.10, after ~11 min. on an Alix pfSense 2.2.5 (ro). Thank you BBcan :)

    Update: I followed BBcan's instructions below for starting DNSBL and that worked too. Excellent extension.


  • Moderator

    Here are some basic instructions to get started with DNSBL.

    1. Open the pfBNG "DNSBL" Tab:

    (Use the defaults unless you have a need to use otherwise)
    Enter the DNSBL VIP as 10.10.10.1
    Enter the DNSBL Listening Port as 8081
    Enter the DNSBL SSL Listening port as 8443
    Select the DNSBL Listening Interface as Lan

    For the DNSBL Firewall Rule select all of the LAN subnets that access the DNS Resolver.
    Ensure that all Devices that use the DNS Resolver, have the Resolver as its only DNS setting for DNSBL to function properly.

    DNSBL IP Firewall Rule Settings:
    Select Deny outbound or as per your requirements
    select Enable logging

    Alexa  (is optional, you can skip this until later if you wish)
    Select Top 1K
    Select the TLD Inclusions as ca,co,com,io,me,net,org or as required.

    In the Custom List you may enter any domain you wish to Whitelist.

    Save your settings

    1. Open the "DNSBL Feeds" Tab:

    Create a new DNSBL Alias

    Enter DNS Group Name as ADs
    Enter Description as DNSBL ADverts

    DNSBL:

    Enter the Header/Label and Source URL as follows:
    (Use copy/paste as plain text for the URL)

    Format Auto and State ON

    yoyo
    http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext

    hpHosts_ads
    http://hosts-file.net/ad_servers.txt

    Adaway
    https://adaway.org/hosts.txt

    Cameleon
    http://sysctl.org/cameleon/hosts

    Select List Action as Unbound
    Select Update Frequency as Once a day

    Alexa:
    Do not enable the Alexa Whitelist for this ADverts based alias, as Alexa also posts the top ADvert servers. So using Alexa whitelist, will interfere with ADvert Blocking.

    Add any other domains that you wish to block in the Custom List.

    Save your settings

    1. Open the "DNSBL" Tab:

    Click DNSBL Enable checkbox.
    Save your settings

    1. Open the "Update" Tab:

    Select Force Update

    You should now see the DNSBL Feeds being downloaded and parsed. Once that is complete, goto the Dashboard, and confirm that the widget is populated correctly.

    1. Goto the pfBlockerNG "Alerts" Tab:

    Any domain that is blocked will be reported here. For HTTPS alerts, the SRC IP and URL are not captured due to Browser security measures.

    As a test, goto www.aol.com  and www.yahoo.com  and see some alerts populate.

    There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.



  • @cmb:

    I largely relied on all your reports here for testing, only checking that the basics function and there isn't anything malicious, or grossly wrong at a glance.
    ...
    Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

    Thanks BBCan!

    uninstalled test 77 DEV and installed 2.0 from official on 2 boxes v2.2.4 & v2.2.5

    At first look it was ok, up and running but I see that I have to manual start service```
    dnsbl pfBlockerNG DNSBL Web Server

    This service not running after update is something that I had before when beta testing on all boxes.


  • I also update from dev to 2.0, it work properly, a powerful package

    Thanks! BBcan177



  • @cmb:

    Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

    Thanks BBCan!

    Done, ran the standard tests, all good. Thanks for all the work BB!



  • Work like a charm, Thanks! For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.



  • @pfcode:

    Work like a charm, Thanks! For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.

    I had this also, second time worked fine
    prior, i was on the latest build of PFB 1.x


  • Moderator

    Looks like I have a file caching issue with the download function. I will get that resolved asap and add the relevant download code directly to the install code.



  • Installed and configured with DNSBL, all went smoothly and working flawlessly since.

    Great package by great people ! Many thanks BBcan177



  • After months of testing I just installed pfBlockerNG 2.0 from official repository, everything is ok.
    Thanks BBCan, ottimo lavoro amico mio!



  • @pfcode:

    For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.

    Ditto. Worked on 2nd try.

    I setup DNSBL per the instructions above, and it looks like everything is worked as advertised. Great work!

    Jason



  • Excellent!!!

    Confirmed also: second try (simply reinstalled package after first update attempt)

    Really great job. Where can I donate?



  • Installed, It stopped at the same place as most others, being lazy I refreshed which reinstalled it again :D (3 less clicks than packages/reinstall/confirm) :P

    Working GREAT! Gonna enable DNSBL for INBOUND Monday (using Alias) :)


  • Moderator

    Here is a PR to fix the Installation issue being reported…

    https://github.com/pfsense/pfsense-packages/pull/1189

    Once this is merged, if anyone has similar issues, please report back. Thanks!



  • If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver



  • Thanks BBcan177, and everyone that made this package possible. Great jpb.

    @fraglord:

    If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver

    Can you elaborate? I have multi-wan and forwarding disabled and everything works.



  • Latest PR merged.



  • @BBcan177:

    There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

    Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate? I'd like to thank you, you have no idea I've been trying to block ads on my wireless devices and had been trying to do this on an Asus RT-68U (AP mode)  with both tomato and merlin and was having issues.  PfBlockerNG 2.0 has solved this issue for me, I no longer have to mess around with the Asus router and don't have to worry bout getting ads on my sons ipad/pc. I added a feed from http://winhelp2002.mvps.org/hosts.htm would this work for host files as well? In the log it does seem to have downloaded the .txt file (see attached screenshot)  Thanks  again  BBcan177 for your work!



  • Moderator

    Here are more DNSBL Feeds that can be used in pfBlockerNG.
    (Copy and paste URLS as plain text)

    1. Create a new alias for these.
      These are not necessarily ADvert domains. So I named mine "Malicious"

    hpHosts
    http://hosts-file.net/download/hosts.zip

    SWC
    http://someonewhocares.org/hosts/hosts

    spam404
    https://spam404bl.com/blacklist.txt
    https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt

    malc0de
    https://malc0de.com/bl/BOOT

    MDS (use 'Flex' state)
    https://mirror1.malwaredomains.com/files/justdomains

    MVPS
    http://winhelp2002.mvps.org/hosts.txt

    MDL
    http://www.malwaredomainlist.com/hostslist/hosts.txt

    Discontinued
    GJTech
    http://adblock.gjtech.net/?format=unix-hosts

    dShield_SD  (They also have a conservative list available)
    https://www.dshield.org/feeds/suspiciousdomains_High.txt

    Zeus
    https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

    1. These two feeds post full URLs, so there can be some more false positives.
      Create a new Alias, and use Alexa as a recommendation.

    PhishTank
    https://data.phishtank.com/data/online-valid.csv.bz2

    OpenPhish
    https://www.openphish.com/feed.txt

    MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
    https://lists.malwarepatrol.net

    1. This is a feed that I manage (as time permits)
      MS_2
      https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

    2. Use this in its own Alias:

    BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al…)
    http://osint.bambenekconsulting.com/feeds/dga-feed.gz

    BBC_C2
    http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

    1. Use this feed in its own alias as it is updated more frequently.
      So you can update it more often than once per day.

    hpHosts_partial
    http://hosts-file.net/hphosts-partial.asp

    If users find other feeds, please post back so that others may benefit also.
    Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.



  • @BBcan177:

    Here are some basic instructions to get started with DNSBL.

    1. Open the pfBNG "DNSBL" Tab:

    (Use the defaults unless you have a need to use otherwise)
    Enter the DNSBL VIP as 10.10.10.1
    Enter the DNSBL Listening Port as 8081
    Enter the DNSBL SSL Listening port as 8443
    Select the DNSBL Listening Interface as Lan

    For the DNSBL Firewall Rule select all of the LAN subnets that access the DNS Resolver.
    Ensure that all Devices that use the DNS Resolver, have the Resolver as its only DNS setting for DNSBL to function properly.

    DNSBL IP Firewall Rule Settings:
    Select Deny outbound or as per your requirements
    select Enable logging

    Alexa  (is optional, you can skip this until later if you wish)
    Select Top 1K
    Select the TLD Inclusions as ca,co,com,io,me,net,org or as required.

    In the Custom List you may enter any domain you wish to Whitelist.

    Save your settings

    1. Open the "DNSBL Feeds" Tab:

    Create a new DNSBL Alias

    Enter DNS Group Name as ADs
    Enter Description as DNSBL ADverts

    DNSBL:

    Enter the Header/Label and Source URL as follows:
    (Use copy/paste as plain text for the URL)

    Format Auto and State ON

    yoyo
    http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext

    hpHosts_ads
    http://hosts-file.net/ad_servers.txt

    Adaway
    https://adaway.org/hosts.txt

    Cameleon
    http://sysctl.org/cameleon/hosts

    Select List Action as Unbound
    Select Update Frequency as Once a day

    Alexa:
    Do not enable the Alexa Whitelist for this ADverts based alias, as Alexa also posts the top ADvert servers. So using Alexa whitelist, will interfere with ADvert Blocking.

    Add any other domains that you wish to block in the Custom List.

    Save your settings

    1. Open the "DNSBL" Tab:

    Click DNSBL Enable checkbox.
    Save your settings

    1. Open the "Update" Tab:

    Select Force Update

    You should now see the DNSBL Feeds being downloaded and parsed. Once that is complete, goto the Dashboard, and confirm that the widget is populated correctly.

    1. Goto the pfBlockerNG "Alerts" Tab:

    Any domain that is blocked will be reported here. For HTTPS alerts, the SRC IP and URL are not captured due to Browser security measures.

    As a test, goto www.aol.com  and www.yahoo.com  and see some alerts populate.

    There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

    Have been using the beta code for some time and noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter.

    popcash.net
    www.popcash.net
    outbrain.com
    www.outbrain.com
    onclickads.net
    www.onclickads.net
    googleadservices.com
    www.googleadservices.com
    adcash.com
    www.adcash.com
    popads.net
    www.popads.net
    
    

    To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.


  • Moderator

    @Dpain:

    @BBcan177:

    There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

    Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate?

    Thanks  again  BBcan177 for your work!

    I could use a lifetime pfSense Gold subscription… :) But I think all developers should get that as a bonus :)

    My email is at the bottom of the pfBNG general tab.



  • @BBcan177:

    @Dpain:

    @BBcan177:

    There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

    Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate?

    Thanks  again  BBcan177 for your work!

    I could use a lifetime pfSense Gold subscription… :) But I think all developers should get that as a bonus :)

    My email is at the bottom of the pfBNG general tab.

    :o lifetime ?  That would be $99 x how many ever years you have left  ;D :P  so is the email there attached to a paypal account? Not sure if donation talk is allowed on forum if not, I apologize mods. Also , It does seem to be working for host files from http://winhelp2002.mvps.org/hosts.htm Thanks!



  • Can you elaborate? I have multi-wan and forwarding disabled and everything works.

    If you enable forwarding mode then a foward-zone named "." is created as well as some forward-addr entries with the DNS servers you sepcified system->general setup.
    Default behavior of unbound is to query the Root servers. But if you have a multi-WAN configuration and need to specifiy a different DNS server for each WAN(gateway) you need forwarding mode to be enabled. So yeah, works without forwarding mode for some multi-WAN configs that are fine with just the Root servers.



  • BBCan177,
    Any problems running your list import script on PFB 2.0?



  • Few things I found out while beta testing V2

    • First rule is take your time and be patient. Adding to may rules at once will casue alot of blocks you may or may not way. Wildcards are not supported, or wanted in most cases. For example adding google.com does not filter all the hosts for the domain, need to add each host that is being blocked to the filter lists
    • Make sure to double check ASN's, especially for large companies that have acquired other companies, more than one ASN might exist
      *** Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed,  em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload.  They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.
    • Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum.  I added all my hosts host to unbound statically as a work around
    • I wanted to have my allow rules > pfb block rules > my block rules > my per interface rules.  Did this by enabling "Floating Rules" and using "pfb_pass/match  | pfsense pass/match |  pfb_block/reject"
    • If you have WIFI make sure to enable "DNSBL Firewall Rule" and select both LAN and WIFI or the NAT: Port Forward rule for 10.10.10.1 is not setup correctly.  If you don't change this setting things still work but everything runs slow over wifi.
    • Make sure to whitelist all the DNSBL sites FQDN via an allow aliases, some IPv4 block-lists include the IP space the DNSBL are found in
    • DBSBL is basicly a man in the middle for DNS so any site that is block but running https will create warrnings. Depending on how the brower is setup it might just ignore or not display the error.  CTRL+SHIFT+I on both Chrome and Firebox will bring up dev panel where you can see which pages are not loading. Chrome will show an error, Firefox will show a red slash throught the lock icon.
    • Noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter. To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.
    popcash.net
    www.popcash.net
    cdn.popcash.net
    outbrain.com
    www.outbrain.com
    onclickads.net
    www.onclickads.net
    googleadservices.com
    www.googleadservices.com
    adcash.com
    www.adcash.com
    popads.net
    www.popads.net
    popmyads.com
    www.popmyads.com
    
    
    • List of domains added to DNSBL Custom Domain Suppression to stop them from being blocked
    
    goo.gl
    google.com
    www.google.com
    mail.google.com
    docs.google.com
    sites.google.com
    fonts.googleapis.com
    cache.google.com
    clients.google.com
    clients0.google.com
    clients1.google.com
    clients2.google.com
    clients3.google.com
    clients4.google.com
    clients5.google.com
    clients6.google.com
    clients7.google.com
    clients8.google.com
    clients9.google.com
    www.maxmind.com
    s3.amazonaws.com
    fls-na.amazon.com
    login.live.com
    redis.io
    pgl.yoyo.org
    someonewhocares.org
    www.thingamajob.com
    winhelp2002.mvps.org
    hosts-file.net
    www.hosts-file.net
    adaway.org
    sysctl.org
    adblock.gjtech.net
    www.dshield.org
    malwaredomainlist.com
    malwaredomains.com
    bambenekconsulting.com
    malwarepatrol.net
    zeustracker.abuse.ch
    malc0de.com
    curl.haxx.se
    dl.dropboxusercontent.com
    whois.cymru.com
    github.com
    collector-cdn.github.com
    pivotal.github.com
    cloud.github.com
    raw.githubusercontent.com
    raw.github.com
    stopforumspam.com
    www.stopforumspam.com
    sourceforge.net
    www.sourceforge.net
    iweb.dl.sourceforge.net
    chase.com
    www.chase.com
    mint.com
    www.mint.com
    americanexpress.com
    www.americanexpress.com
    online.americanexpress.com
    linuxquestions.org
    www.linuxquestions.org
    optimizely.com
    www.optimizely.com
    api.optimizely.com
    cdn.optimizely.com
    cdn2.optimizely.com
    cdn3.optimizely.com
    slashdot.org
    www.slashdot.org
    ebay.com
    www.ebay.com
    rover.ebay.com
    srx.main.ebayrtm.com
    openbl.org
    www.openbl.org
    www.us.openbl.org
    delta.com
    www.delta.com
    aa.com
    www.aa.com
    cruisesonly.com
    www.cruisesonly.com
    ripe.net
    www.ripe.net
    weather.com
    www.weather.com
    lacnic.net
    www.lacnic.net
    tvrage.com
    services.tvrage.com
    www.tvrage.com
    publicbt.com
    device.maxmind.com
    www.boingo.com
    xda-developers.com
    www.xda-developers.com
    forum.xda-developers.com
    opengapps.org
    download.mono-project.com
    
    
    • Ads DNS Group

    • Update Frequency: Once a Day

    • Enable Alexa Whitelist: NOT Enabled

    • Add Custom Block List noted above

    
    http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintextoup	yoyo
    http://hosts-file.net/ad_servers.txt							hphosts_ats
    https://adaway.org/hosts.txt								adaway
    http://sysctl.org/cameleon/hosts							syctrl
    http://adblock.gjtech.net/?format=unix-hosts						gjtech
    
    
    • Privacy Fraud DNS Group

    • Update Frequency: Once a Day

    • Enable Alexa Whitelist: Enabled

    
    https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt			disconnect_basic
    http://hosts-file.net/fsa.txt								hphost_fsa
    http://hosts-file.net/hjk.txt								hphost_hjk
    http://hosts-file.net/pha.txt								hphost_psh
    https://www.dshield.org/feeds/suspiciousdomains_High.txt				dshield_sdh
    
    
    • Malware Exploit DNS Group

    • Update Frequency: Once a Day

    • Enable Alexa Whitelist: Enabled

    
    https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt			disconnect_malvertising
    http://www.malwaredomainlist.com/hostslist/hosts.txt					malwaredomainlist
    http://mirror1.malwaredomains.com/files/justdomains					malwaredomains			
    https://s3.amazonaws.com/lists.disconnect.me/simple_malware.txt				disconnect_malware
    http://hosts-file.net/emd.txt								hphosts_emd
    http://hosts-file.net/exp.txt								hphosts_exp
    http://hosts-file.net/mmt.txt								hphosts_mmt
    https://lists.malwarepatrol.net/cgi/getfile?receipt=f1442112770&product=8&list=dansguardian malwarepatrol
    https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist			zeustracker
    https://malc0de.com/bl/BOOT								malc0de
    
    
    • SPAM DNS Group

    • Update Frequency: Once a Day

    • Enable Alexa Whitelist: Enabled

    
    http://hosts-file.net/grm.txt								hphost_grm
    http://hosts-file.net/hfs.txt								hphost_hfs
    https://spam404bl.com/blacklist.txt							spam_404
    
    
    • Malicious DNS Group

    • Update Frequency: Once a Day

    • Enable Alexa Whitelist: Enabled

    
    http://hosts-file.net/hphosts-partial.txt						hphost_partial
    http://winhelp2002.mvps.org/hosts.txt							mvps_hosts
    http://someonewhocares.org/hosts/hosts							SomeoneWhoCares
    https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw			BBcan177
    
    
    • BambenekConsulting DNS Group

    • Update Frequency: Once a Day

    • Enable Alexa Whitelist: Enabled

    
    http://osint.bambenekconsulting.com/feeds/dga-feed.gz					bambenek_dga
    http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt				bambenek_c2
    
    

    Thanks
    Tony M.**


Log in to reply