curben
/
pup-filter
mirror of https://gitlab.com/malware-filter/pup-filter.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
597 Commits 1 Branch 0 Tags 6.6 MiB
Shell 83.4%
JavaScript 16.6%
Go to file
Ming Di Leom 08c291a91f
docs: add new mirrors 
- github pages
- cloudflare pages
- netlify
 		2022-01-09 08:49:42 +00:00
.github/workflows refactor(actions): replicate gitlab ci 2022-01-09 07:39:28 +00:00
src refactor(actions): replicate gitlab ci 2022-01-09 07:39:28 +00:00
.gitignore refactor: deploy filters to gitlab pages 2022-01-08 06:01:13 +00:00
.gitlab-ci.yml chore(ci): rename job 2022-01-09 02:54:57 +00:00
.nvmrc chore(ci): use latest lts of node 2022-01-08 21:48:32 +00:00
LICENSE.md Initial commit 2021-03-31 10:53:42 +00:00
README.md docs: add new mirrors 2022-01-09 08:49:42 +00:00
package.json refactor: deploy filters to gitlab pages 2022-01-08 06:01:13 +00:00

README.md

PUP Domains Blocklist

Edit 2021/01/08: All mirrors' links have been updated. The main download link "curben.gitlab.io/malware-filter/" is not affected.

A blocklist of domains that host potentially unwanted programs (PUP), based on the malware-discoverer. Blocklist is updated twice a day.

There are multiple formats available, refer to the appropriate section according to the program used:

Not sure which format to choose? See Compatibility page.

Check out my other filters:

URL-based

Import the following URL into uBO to subscribe:

included by default in uBO >=1.39.0; to enable, head to "Filter lists" tab, expand "Malware domains" section and tick "PUP URL Blocklist".

Mirrors

URL-based (AdGuard)

Import the following URL into AdGuard browser extension to subscribe:

Mirrors

URL-based (Vivaldi)

Requires Vivaldi Desktop/Android 3.3+, blocking level must be at least "Block Trackers"

Import the following URL into Vivaldi's Tracker Blocking Sources to subscribe:

Mirrors

Domain-based

This blocklist includes domains and IP addresses.

Mirrors

Domain-based (AdGuard Home)

This AdGuard Home-compatible blocklist includes domains and IP addresses.

Mirrors

Hosts-based

This blocklist includes domains only.

Mirrors

Dnsmasq

This blocklist includes domains only.

Install

# Create a new folder to store the blocklist
mkdir -p /usr/local/etc/dnsmasq/

# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/pup-filter-dnsmasq.conf" -o "/usr/local/etc/dnsmasq/pup-filter-dnsmasq.conf"\n' > /etc/cron.daily/pup-filter

# cron job requires execution permission
chmod 755 /etc/cron.daily/pup-filter

# Configure dnsmasq to use the blocklist
printf "\nconf-file=/usr/local/etc/dnsmasq/pup-filter-dnsmasq.conf\n" >> /etc/dnsmasq.conf
Mirrors

BIND

This blocklist includes domains only.

Install

# Create a new folder to store the blocklist
mkdir -p /usr/local/etc/bind/

# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/pup-filter-bind.conf" -o "/usr/local/etc/bind/pup-filter-bind.conf"\n' > /etc/cron.daily/pup-filter

# cron job requires execution permission
chmod 755 /etc/cron.daily/pup-filter

# Configure BIND to use the blocklist
printf '\ninclude "/usr/local/etc/bind/pup-filter-bind.conf";\n' >> /etc/bind/named.conf

Add this to "/etc/bind/null.zone.file" (skip this step if the file already exists):

$TTL    86400   ; one day
@       IN      SOA     ns.nullzone.loc. ns.nullzone.loc. (
               2017102203
                    28800
                     7200
                   864000
                    86400 )
                NS      ns.nullzone.loc.
                A       0.0.0.0
@       IN      A       0.0.0.0
*       IN      A       0.0.0.0

Zone file is derived from here.

Mirrors

Response Policy Zone

This blocklist includes domains only.

Mirrors

Unbound

This blocklist includes domains only.

Install

# Create a new folder to store the blocklist
mkdir -p /usr/local/etc/unbound/

# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/pup-filter-unbound.conf" -o "/usr/local/etc/unbound/pup-filter-unbound.conf"\n' > /etc/cron.daily/pup-filter

# cron job requires execution permission
chmod 755 /etc/cron.daily/pup-filter

# Configure Unbound to use the blocklist
printf '\n  include: "/usr/local/etc/unbound/pup-filter-unbound.conf"\n' >> /etc/unbound/unbound.conf
Mirrors

dnscrypt-proxy

Install

# Create a new folder to store the blocklist
mkdir -p /etc/dnscrypt-proxy/

# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/pup-filter-dnscrypt-blocked-names.txt" -o "/etc/dnscrypt-proxy/pup-filter-dnscrypt-blocked-names.txt"\n' > /etc/cron.daily/pup-filter

# cron job requires execution permission
chmod 755 /etc/cron.daily/pup-filter

Configure dnscrypt-proxy to use the blocklist:

[blocked_names]
+  blocked_names_file = '/etc/dnscrypt-proxy/pup-filter-dnscrypt-blocked-names.txt'
Mirrors

Tracking Protection List (IE)

This blocklist includes domains only.

Mirrors

Snort2

This ruleset includes online URLs only. Not compatible with Snort3.

Install

# Download ruleset
curl -L "https://curben.gitlab.io/malware-filter/pup-filter-snort2.rules" -o "/etc/snort/rules/pup-filter-snort2.rules"

# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/pup-filter-snort2.rules" -o "/etc/snort/rules/pup-filter-snort2.rules"\n' > /etc/cron.daily/pup-filter

# cron job requires execution permission
chmod 755 /etc/cron.daily/pup-filter

# Configure Snort to use the ruleset
printf "\ninclude \$RULE_PATH/pup-filter-snort2.rules\n" >> /etc/snort/snort.conf
Mirrors

Snort3

This ruleset includes online URLs only. Not compatible with Snort2.

Install

# Download ruleset
curl -L "https://curben.gitlab.io/malware-filter/pup-filter-snort3.rules" -o "/etc/snort/rules/pup-filter-snort3.rules"

# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/pup-filter-snort3.rules" -o "/etc/snort/rules/pup-filter-snort3.rules"\n' > /etc/cron.daily/pup-filter

# cron job requires execution permission
chmod 755 /etc/cron.daily/pup-filter

Configure Snort to use the ruleset:

# /etc/snort/snort.lua
ips =
{
  variables = default_variables,
+  include = 'rules/pup-filter-snort3.rules'
}
Mirrors

Suricata

This ruleset includes online URLs only.

Install

# Download ruleset
curl -L "https://curben.gitlab.io/malware-filter/pup-filter-suricata.rules" -o "/etc/suricata/rules/pup-filter-suricata.rules"

# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/pup-filter-suricata.rules" -o "/etc/suricata/rules/pup-filter-suricata.rules"\n' > /etc/cron.daily/pup-filter

# cron job requires execution permission
chmod 755 /etc/cron.daily/pup-filter

Configure Suricata to use the ruleset:

# /etc/suricata/suricata.yaml
rule-files:
  - local.rules
+  - pup-filter-suricata.rules
Mirrors

Issues

This blocklist operates by blocking the whole website, popular websites are excluded from the filters.

Popular websites are as listed in the Umbrella Popularity List (top 1M domains + subdomains), Tranco List (top 1M domains) and this custom list.

If you wish to exclude certain website(s) that you believe is sufficiently well-known, please create an issue or merge request.

This blocklist only accepts new malicious URLs from malware-discoverer.

Cloning

Since the filter is updated frequently, cloning the repo would become slower over time as the revision grows.

Use shallow clone to get the recent revisions only. Getting the last five revisions should be sufficient for a valid MR.

git clone --depth 5 https://gitlab.com/curben/pup-filter.git

License

src/: CC0

filters: Derived from malware-discoverer with Zhouhan Chen's permission

malware-discoverer: All rights reserved by Zhouhan Chen

Tranco List: MIT License

Umbrella Popularity List: Available free of charge by Cisco Umbrella