5 ms·
URLhaus: A database of malicious URLs used for malware distribution
- tkzed49 2y agoWho are abuse.ch? Are they well-known? I assume the hosts file could be useful to add to pihole?
- bauruine 2y agoThey seem to be partners of spamhaus. From the recent feed [0] it looks like it's often just IP addresses so you would need to add it to your firewall. [0]: https://urlhaus-api.abuse.ch/v1/urls/recent/ https://urlhaus-api.abuse.ch/v1/urls/recent/
- cess11 2y agoYes, they are fairly well-known. They have been partnering with Spamhaus: https://abuse.ch/blog/abuse-ch-appoints-spamhaus-as-a-licensee/ https://abuse.ch/blog/abuse-ch-appoints-spamhaus-as-a-licens...
- supriyo-biswas 2y agoSometimes popular domains like drive.google.com get added, and at other times some domains are just that popular to reach a TRANCO rank of 20,000, so I generally advice against blocking using sources like URLhaus.
- sambazi 2y agoi generally advise against embedding any blocklists into infrastructure; content policy should be done on clients within reach of the user
- underlines 2y agoabuse.ch is a non-profit, initially private. Working on cyber security issues for 15 years. Mainly focused on botnets and malware. Since 2021, abuse.ch is under the Institute for Cybersecurity and Engineering ICE at Bern University of Applied Sciences. To date the project has been funded entirely from private-sector donations. They have mainly two goals: 1 Research: Research into malware and botnets 2 Open source threat intelligence: indicator of compromise – IOC for the public to prevent threats
- amne 2y agoTo me this looks that for ~90% (eyballed) you just need to tell your browser somehow to stay away from any port other than 80 or 443. If some script/link-rel/src attrib points to a non-http(s) port just pop a warning to confirm you're ok with it. Is there a browser today with this feature? Or go wild to neuter your browser and configure your firewall to allow only dst ports 80 and 443 for mozilla/chrome/edge/etc. Also curious what are the performance implications for adding to your firewall about 2 million IPs or maybe a couple 100k if you're brave to do ranges.
- toast0 2y agoOn performance, it depends a bit. If you're running a stateful firewall, those generally don't evaluate firewall rules for established states, and most of your traffic is to established states, so no big deal. If you're not running a stateful firewall, it's not totally unreasonable to skip the firewall for tcp packets with ACK and not SYN, so again no big deal on those. But http/3 is udp, so no shortcuts there. Afaik, most firewalls have a lookup table available, you'd want to use that, rather than 2 million rules. On FreeBSD, ipfw and pf have lookup tables, ipf calls them pools, but it looks like the same thing. A lookup table for IP addresses is pretty fast, even with 2M entries.
- vladvasiliu 2y ago> But http/3 is udp, so no shortcuts there. Usually stateful firewalls create a "state" for UDP connections, so "shortcuts" are still possible. See, for example, pf: https://www.openbsd.org/faq/pf/filter.html#udpstate https://www.openbsd.org/faq/pf/filter.html#udpstate
- schoen 2y agoCan anyone explain why malware distributors would prefer (or be somehow forced into using) non-default TCP ports?
- VoidWhisperer 2y agoMy (naive) guess is that it makes them slightly less likely to be picked up by scanners like shodan. I'm probably wrong though
- whirlwin 2y agoHow does it keep the records up-to-date? An IP nowadays is highly elastic and can be relocated to different tenants on your cloud provider.
- sambazi 2y agoit was never a good idea, but works somewhat
- svacko 2y agoSurprised to see so much malware served from GitHub domains https://urlhaus.abuse.ch/browse.php?search=github https://urlhaus.abuse.ch/browse.php?search=github
- billwashere 2y agoSee this post on why. https://news.ycombinator.com/item?id=40097818 https://news.ycombinator.com/item?id=40097818
- tomashertus 2y agoIn my day-to-day work, we analyze millions of files every day, and it's well-known and well-utilized detection evasion techniques to host and serve malware from "trusted" websites. It's so widespread that I did extensive research on that issue. There are well-known apps with $Ms in funding and revenue with a plethora of malware hosted on their servers. Some are even used as C2 servers for data exfiltration. I see an increasing number of companies proactively blocking all traffic to those notorious sites to increase overall network security. The outcome of my research was the following: - Disjointed content moderation and cybersecurity departments: Not many companies have content moderation teams equipped to perform malware analysis or make cybersecurity-related decisions (the only company that does an exceptional job in this regard is Meta). - If hosting malware doesn't impact the company's revenue and reputation, the content moderation team has other priorities. - Section 230: Companies will refer to Section 230 when asked about hosting malicious content or scanning the content for potential malware.
- Sephr 2y agoI see a few false positives. It appears that unsigned software is being labeled as malware, and as grayware on some pages. Unsigned software is not malware or 'grayware'. It's not inherently malicious. I'm also seeing coin miners being labeled as malware. They often are, but I'm sure there are misclassificatons along those lines as well in this dataset.
- deleted 2y ago[deleted]
- blueflow 2y agoTheir own waf (?) is messing with the data: https://urlhaus.abuse.ch/browse/tag/mirai/ https://urlhaus.abuse.ch/browse/tag/mirai/ returns "405 banned".
- sharpshadow 2y agoGreat set also for collecting malware.
- deleted 2y ago[deleted]
- EasyMark 2y agoURLs for ublock and others here https://gitlab.com/malware-filter/urlhaus-filter#full-version https://gitlab.com/malware-filter/urlhaus-filter#full-versio...