clean mx's daily dirt

Malware Related > Malicious Domains

(1/606) > >>

cleanmx:
Hi @all

update 20th Aug.2009 new as parameter
update 26th Aug.2009 new md5 parameter
update 16th Feb.2010 rss-feed for malware (see bottom of this posting...)
update 5th Apr.2010 new query interface on each viruses.php and phishing.php page
update 27th May 2010 contributors list update

I start now a new thread posting all urls (Rfi's and malware) detect by our managed anti-spam Service http://www.clean-mx.de.

you may query our database online @ any time, but please not every microsecond...

http://support.clean-mx.de/clean-mx/viruses?response=alive

or you may checkout either by xml or csv

http://support.clean-mx.de/clean-mx/xmlviruses?format=xml&response=alive this will dump all active entries currently aprox. 4200 ...
http://support.clean-mx.de/clean-mx/xmlviruses?format=csv&response=alive

for only getting urls *not* yet in malwaredomainlist specifiy &sub=!sub4
example:
http://support.clean-mx.de/clean-mx/xmlviruses?format=xml&fields=id,scanner,virusname,email,url&sub=!sub4&response=alive for all entries not in malwaredomainlist

or

http://support.clean-mx.de/clean-mx/xmlviruses?format=xml&fields=id,scanner,virusname,email,url&sub=sub4&response=alive&sort=first%20asc for all entries from malwaredomainlist still active sort by oldest first

List of contributers:

sub1=clean-mx.de
sub2=volunteers
sub3=google malware
sub4=malwaredomainlist.com
sub5=Project Glastopf(honeypot...)
>>>>>> sub6=malwareurl.com Suspended feed <<<<<<<<<<<<<<
sub7=own RFI's from netpilot.net hosting platform
sub8=malwarepatrol.com
sub9=malekal.com
sub10=Paretologic.com
sub11=RFI's from Host europe
sub12=jsunpack
sub13=secuboxlabs.fr
sub14=malc0de.com
sub15=vxvault.siri-urz.net
list of scanners:

avira
clamav
trendmicro
undef

You may specify a parameter &fields to control output of xml and csv

for all three databases at clean-mx xml or csv query options are:

you may invoke: (xmlsviruses|xmlphishing|xmlportals)

http://support.clean-mx.de/clean-mx/xmlviruses?response=alive&format=xml&fields=review,url
for only getting active urls with reviewed ip and url

note: &format=csv will give you a csv list (1-st line are column
headers...) & format=xml will give you xml stuff...

fields maybe in any order seperated by ",":

line
id
firsttime
lasttime
first
last
scanner -- only for xmlsviruses and xmlportals
virusname -- only for xmlsviruses and xmlportals
url
recent
response
ip
as
review
domain
country
source
email
inetnum
netname
descr
ns1
ns2
ns3
ns4
ns5

Query parameters may be:

id
delta -- only id's greater delta value .. if you remeber your last high id you may query this in delate on your next vist..
scanner -- only for xmlsviruses and xmlportals
virusname -- only for xmlviruses or xmlportals
url
md5
recent
response
ip
as
review
domain
country
source
email
inetnum
netname
descr
ns1
ns2
ns3
ns4
ns5
nsx -- any nameserver out of ns1...ns5

sort option may be any of these obove fields either asc or desc

example: &sort=url%20desc or &sort=firstseen%20asc

update 16th Feb.2010 rss-feed for malware

complete list:
http://support.clean-mx.de/clean-mx/rss?scope=viruses

only as or email or country or region:

--- Code: ---http://support.clean-mx.de/clean-mx/rss?scope=viruses&as=AS#####
http://support.clean-mx.de/clean-mx/rss?scope=viruses&email=email@example.com
http://support.clean-mx.de/clean-mx/rss?scope=viruses&country=de
http://support.clean-mx.de/clean-mx/rss?scope=viruses&source=RIPE | ARIN|LACNIC|AFRINIC|APNIC

--- End code ---

-- gerhard

CM_MWR:
Dont think anyone was angry, simple as....

I dont have much use for rfi material, orac on the other hand has this odd fetish for those things, I myself just like the meat and taters only. ;)

I guess for you, this is your daily something and maybe I was out of line for saying anything, for that I apologize, spec in the end, as long as the urls somehow point to malware thats all that really matters.

Navigation

[0] Message Index

[#] Next page

Go to full version