Skip to content

Jarelllama's Scam Blocklist #7

@jarelllama

Description

@jarelllama

Hi, I'm the maintainer of Jarelllama's Scam Blocklist, a blocklist for newly created scam and phishing domains automatically retrieved daily using Google Search API, automated NRD detection, and other public sources.

I see you're the main maintainer of dnslow.me and that NRDs are already blocked there. I will admit the large majority of my blocklist are malicious NRDs, however, the blocklist still offers cumulative domains automatically retrieved from various publically available sources such as scamadviser.com (no closed/paid sources are used for legal reasons)

Here is the list of currently integrated sources used for the automated retrieval:

Google Search (using the Custom Search JSON API)
Regex matching for malicious NRDs
aa419.org
dnstwist matching for malicious NRDs
guntab.com
petscams.com
scam.directory
scamadviser.com
stopgunscams.com

These are the formats the blocklist is currently in:

Format Syntax
Adblock Plus ||scam.com^
Dnsmasq local=/scam.com/
Unbound local-zone: "scam.com." always_nxdomain
Wildcard Asterisk *.scam.com
Wildcard Domains scam.com

Taken from my README, this is the current filtering process:

  • The domains collated from all sources are filtered against an actively maintained whitelist (scam reporting sites, forums, vetted stores, etc.)
  • The domains are checked against the Tranco Top Sites Ranking for potential false positives which are then vetted manually
  • Common subdomains like 'www' are stripped to make use of wildcard matching for all other subdomains. The list of subdomains checked for can be viewed here: subdomains.txt
  • Only domains are included in the blocklist; IP addresses are manually checked for resolving DNS records and URLs are stripped down to their domains
  • Entries that require manual verification/intervention are sent in a Telegram notification for fast remediations

Dead domains and parked domains are automatically removed daily as well. More about the blocklist's retrieval and filtering process can be found in the README.

Please do let me know your thoughts!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions