From 10f4eb4b4c6d41f50d971faf98ea46e80440f1d3 Mon Sep 17 00:00:00 2001 From: Kenneth Hendricks <50819541+kenhendricks00@users.noreply.github.com> Date: Sat, 24 May 2025 15:33:52 -0400 Subject: [PATCH] Add filterlists-reasons.json with explanations for unsafe sites (#26) I'm working on implementing reason tooltips for unsafe site warnings in the FMHY SafeGuard browser extension. The goal is to help users understand why a site is flagged without needing to visit https://fmhy.net/unsafesites or dig through wiki pages. This JSON file includes unsafe domains with short reasons and evidence links (Reddit, VirusTotal, Rentry, etc.) for quick reference or integration. I figured it might be useful for others too, so I'm submitting it here in case the filterlist wants to host it. All entries are sourced from FMHY resources and related malware reports. Feel free to review and verify that the reasons and links are accurate. --- filterlists-reasons.json | 106 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 106 insertions(+) create mode 100644 filterlists-reasons.json diff --git a/filterlists-reasons.json b/filterlists-reasons.json new file mode 100644 index 0000000..7593495 --- /dev/null +++ b/filterlists-reasons.json @@ -0,0 +1,106 @@ +{ + "igg-games.com": "Highly distrusted for doxxing another site's owner and allowing click hijack ads - https://i.ibb.co/3sHJb6R/image.png", + "igg-games.cc": "Highly distrusted for doxxing another site's owner and allowing click hijack ads - https://i.ibb.co/kBVkW7s/image.png", + "bluemediafile.online": "Unsafe clone site", + "bluemediafile.sbs": "Unsafe clone site", + "bluemediafile.site": "Unsafe clone site", + "bluemediafiles.com": "Unsafe clone site", + "bluemediafiles.eu": "Unsafe clone site", + "bluemediafiles.homes": "Unsafe clone site", + "bluemediafiles.xyz": "Unsafe clone site", + "bluemediastorage.online": "Unsafe clone site", + "bluemediaurls.lol": "Unsafe clone site", + "oceanofgames.com": "Caught with malware multiple times - https://www.virustotal.com/gui/url/7d81b3e83c4b4728b73ba462b17c296a", + "oceansofgamess.com": "Caught with malware multiple times (related clone)", + "oceantogames.com": "Caught with malware multiple times (related clone)", + "oceanofgamesu.com": "Caught with malware multiple times (related clone)", + "oceanofapks.com": "Caught with malware multiple times (related clone)", + "oceanofgame.cc": "Caught with malware multiple times (related clone)", + "blackboxrepacke.com": "Fake BlackBox Repacks, contain malware - https://rentry.org/pgames#untrusted-uploaders", + "crackingpatching.com": "Caught with malware - https://redd.it/qy6z3c", + "crackingpatching.org": "Caught with malware - https://redd.it/qy6z3c", + "cracked-games.org": "Caught with malware - https://rentry.org/pgames#untrusted-uploaders", + "www.wifi4games.com": "Caught with malware - https://rentry.org/pgames#untrusted-uploaders", + "wifi4games.com": "Caught with malware - https://rentry.org/pgames#untrusted-uploaders", + "wifi4games.net": "Caught with malware - https://rentry.org/pgames#untrusted-uploaders", + "gamefabrique.com": "IGG uploads + adware installers - https://rentry.co/GameFabrique_Adware", + "gamefabrique.ru": "IGG uploads + adware installers - https://rentry.co/GameFabrique_Adware", + "steamunlocked.net": "IGG / NosTeam uploads + very slow file host - https://i.ibb.co/VgW2ymY/YUnRNpN.png", + "game-repack.site": "Fake download buttons - https://i.ibb.co/tqZSG9M/image.png", + "pirate-bays.net": "Pirate Bay proxy/clone - https://rentry.org/pgames#pirate-bay-proxies", + "piratebayproxy.net": "Pirate Bay proxy/clone - https://rentry.org/pgames#pirate-bay-proxies", + "thepiratebay3.co": "Pirate Bay proxy/clone - https://rentry.org/pgames#pirate-bay-proxies", + "thepiratebay10.info": "Pirate Bay proxy/clone - https://rentry.org/pgames#pirate-bay-proxies", + "tpb.party": "Pirate Bay proxy/clone - https://rentry.org/pgames#pirate-bay-proxies", + "pirateproxy.live": "Pirate Bay proxy/clone - https://rentry.org/pgames#pirate-bay-proxies", + "pirateproxylive.org": "Pirate Bay proxy/clone - https://rentry.org/pgames#pirate-bay-proxies", + "wpadmngr.com": "Popup ad domain linked to Pirate Bay clones - https://forums.malwarebytes.com/topic/236768-pirate-bay-ads-virus/", + "iconcardinal.com": "Popup ad domain linked to Pirate Bay clones - https://forums.malwarebytes.com/topic/236768-pirate-bay-ads-virus/", + "fitgirl-repack.site": "Fake FitGirl repack site - https://rentry.co/FakeFitgirlwebsites", + "fitgirl-repack.com": "Fake FitGirl repack site - https://rentry.co/FakeFitgirlwebsites", + "fitgirlrepacks.org": "Fake FitGirl repack site - https://rentry.co/FakeFitgirlwebsites", + "fitgirl-repacks.website": "Fake FitGirl repack site - https://rentry.co/FakeFitgirlwebsites", + "fitgirlrepack.games": "Fake FitGirl repack site - https://rentry.co/FakeFitgirlwebsites", + "getintopc.com": "Caught with malware - https://www.virustotal.com/gui/file/5af9e89a7bfcfcae1c75de6acb7194b667d13776b61e79ea8aeab95f0af76bc7", + "getintomac.net": "Caught with malware - https://www.virustotal.com/gui/file/5af9e89a7bfcfcae1c75de6acb7194b667d13776b61e79ea8aeab95f0af76bc7", + "karanpc.com": "Caught with malware multiple times", + "filecr.com": "Caught with malware - https://pastebin.com/ky5KMGz2", + "ftuapps.io": "Caught with malware - https://redd.it/120xk62", + "farlad.com": "Caught with malware - https://redd.it/120xk62", + "s0ft4pc.com": "Caught with malware", + "portable4pc.com": "Caught with malware", + "crackingcity.com": "Caught with malware - https://tria.ge/241021-kfvhhsydpl/behavioral1", + "haxnode.net": "Caught with malware - https://rentry.org/scurvy_malware", + "themicrotech.net": "Caught with malware - https://tria.ge/250116-qxj11atmdl", + "softgozar.com": "Caught with malware - https://tria.ge/250116-ra8aravjfr", + "patoghu.com": "Caught with malware - https://tria.ge/250116-rrdsgavjbs", + "asandownload.ir": "Caught with malware - https://tria.ge/250117-gac5havkaj/", + "mainrepo.org": "Caught with malware - https://rentry.co/zu3i6", + "mrepo.org": "Caught with malware - https://rentry.co/zu3i6", + "yasdl.com": "Uploaded malware", + "allpcworld.com": "Uploaded malware (KMS Matrix)", + "rsload.net": "Uploaded malware - https://i.ibb.co/QXrCfqQ/Untitled.png", + "taiwebs.com": "Uploaded infected apps - https://pastebin.com/nPjVKYM9", + "pesktop.com": "Caught with malware - https://tria.ge/250116-nwnxfszkdq", + "appnee.com": "Not very careful with uploads, has multiple unsafe activators - https://i.imgur.com/ZwjYBfr.png", + "store.app-valley.vip": "History of ddos attacks - https://github.com/fmhy/edit/pull/307", + "app-valley.vip": "History of ddos attacks - https://github.com/fmhy/edit/pull/307", + "appvalley-apk.com": "History of ddos attacks - https://github.com/fmhy/edit/pull/307", + "tutubox.io": "History of ddos attacks - https://github.com/fmhy/edit/pull/307", + "cnet.com": "History of adware - https://www.reddit.com/r/software/comments/9s7wyb/whats_the_deal_with_sites_like_cnet_softonic_and/e8mtye9/", + "download.com": "History of adware - https://www.reddit.com/r/software/comments/9s7wyb/whats_the_deal_with_sites_like_cnet_softonic_and/e8mtye9/", + "zdnet.com": "History of adware - https://www.reddit.com/r/software/comments/9s7wyb/whats_the_deal_with_sites_like_cnet_softonic_and/e8mtye9/", + "softonic.com": "History of adware - https://www.reddit.com/r/software/comments/9s7wyb/whats_the_deal_with_sites_like_cnet_softonic_and/e8mtye9/", + "iobit.com": "History of adware and shady products - https://www.malwarebytes.com/blog/detections/pup-iobi", + "thekickasstorrents.com": "Sketchy KickassTorrents clone", + "vstorrent.org": "Caught with malware - https://redd.it/x66rz2", + "utorrent.com": "Known adware - https://www.theverge.com/2015/3/6/8161251/utorrents-secret-bitcoin-miner-adware-malware", + "bittorrent.com": "Known adware", + "bitcomet.com": "Known adware", + "frostwire.com": "Adware - https://www.virustotal.com/gui/file/6a501792717fd86635d80fb258979b823fd53000c6d683904e2fb2407f1706fd", + "bitlord.com": "Known adware", + "1377x.to": "Fake clones exist - https://i.ibb.co/2YHqHmVW/image.png", + "ccleaner.com": "Owned by Avast, it's best to use the built-in Windows tool or BleachBit - https://www.bleachbit.org/", + "tlauncher.org": "Shady business practices - https://redd.it/zmzzrt", + "gshade.org": "Malicious reboot code inserted - https://rentry.co/GShade_notice", + "totalav.com": "Antivirus scam - https://www.malwarebytes.com/blog/detections/pup-optional-totalav", + "pcprotect.com": "Antivirus scam - https://www.malwarebytes.com/blog/detections/pup-optional-pcprotect", + "limewire.com": "Dead brand used for scams", + "downloadly.ir": "Caught distributing crypto miner", + "opera.com": "Poor privacy practices - https://www.kuketz-blog.de/opera-datensendeverhalten-desktop-version-browser-check-teil13/", + "mcafee.com": "Preinstalled Bloatware", + "avast.com": "Known for selling user data", + "avg.com": "Owned by Avast", + "norton.com": "Owned by Avast", + "gendigital.com": "Owned by Avast", + "avira.com": "Owned by Gen Digital", + "bluekik.pro": "History of spam - https://redd.it/12h2v6n / spying - https://rentry.co/tvrnw", + "bluesmods.com": "History of spam - https://redd.it/12h2v6n / spying - https://rentry.co/tvrnw", + "kik.com": "App used by mostly predators / scammers - https://youtu.be/9sPaJxRmIPc", + "github.com/fvision8/fvreleases": "Malicious app that remotely enables TraffMonetizer - https://github.com/fmhy/edit/issues/2835", + "linktr.ee/flixvision": "Malicious app that remotely enables TraffMonetizer - https://github.com/fmhy/edit/issues/2835", + "cyberghostvpn.com": "Owned by adware distributor Kape - https://redd.it/q3lepv", + "zenmate.com": "Owned by adware distributor Kape - https://redd.it/q3lepv", + "expressvpn.com": "Owned by adware distributor Kape - https://redd.it/q3lepv", + "privateinternetaccess.com": "Owned by adware distributor Kape - https://redd.it/q3lepv", +}