{"id":737,"date":"2021-01-16T20:09:56","date_gmt":"2021-01-16T19:09:56","guid":{"rendered":"http:\/\/www.antynet.pl\/?p=737"},"modified":"2022-01-25T21:39:58","modified_gmt":"2022-01-25T20:39:58","slug":"pihole-regexp","status":"publish","type":"post","link":"https:\/\/www.antynet.pl\/index.php\/2021\/01\/16\/pihole-regexp\/","title":{"rendered":"Pihole – regexp"},"content":{"rendered":"\n\n[et_pb_section admin_label=”section”]\n\t\t\t[et_pb_row admin_label=”row”]\n\t\t\t\t[et_pb_column type=”4_4″][et_pb_text admin_label=”Text”]\"\"\r\n\r\nJe\u015bli kto\u015b korzysta z PiHole to podaj\u0119 swoje regexp<\/i>.\r\n\r\n \r\n\r\nOpracowane na podstawie w\u0142asnych analiz ruchu itp. \r\n\r\nDomeny wy\u0142apane w ruchu ISP Debacom Zabrze:\r\n[0-9a-za-z]{13-18}\\.tickets\r\n[0-9a-za-z]{13-18}\\.blackfriday\r\nv1\\.[a-uw-z]{7}\\.ru\r\nv[12]{1}\\.[a-uw-z]{7}\\.ru\r\n[b-y]{12}\\.pw\r\n[0-9a-za-z]{13-18}\\.feedback\r\n[0-9a-za-z]{13-18}\\.org\r\n[0-9a-za-z]{13-18}\\.hosting\r\n[0-9a-za-z]{13-18}\\.org\r\n[0-9a-za-z]{13-18}\\.cloudfront.net\r\n[0-9]{10}\\.rsc.cdn77.org\r\n\r\n \r\n\r\nKilka domen 3-go rz\u0119du u rejestrator\u00f3w, kt\u00f3rzy nie kontroluj\u0105 swoich klient\u00f3w i zezwalaj\u0105 na szybkie dynamiczne rejestrowanie domen:\r\n
[0-9a-za-z]{13-18}\\.mooo.com\r\n[0-9a-za-z]{13-18}\\.chikenkiller.com\r\n[0-9a-za-z]{13-18}\\.us.to\r\n[0-9a-za-z]{13-18}\\.strangled.net\r\n[0-9a-za-z]{13-18}\\.ignorelist.com\r\n[0-9a-za-z]{13-18}\\.uk.to\r\n[0-9a-za-z]{13-18}\\.crabdance.com\r\n[0-9a-za-z]{13-18}\\.info.tm\r\n[0-9a-za-z]{13-18}\\.jumpingcrab.com\r\n[0-9a-za-z]{13-18}\\.twilightparadox.com\r\n[0-9a-za-z]{13-18}\\.biz.tm\r\n[0-9a-za-z]{13-18}\\.continent.kz\r\n[0-9a-za-z]{13-18}\\.az.lt<\/pre>\r\n\r\nDomeny, kt\u00f3re w wi\u0119kszo\u015bci to malware itp. Dodaje tylko te kt\u00f3re maj\u0105 wi\u0119cej jak 10 znak\u00f3w. Powinno to zmniejszy\u0107 false positive.\r\n\r\n[0-9a-za-z]{10-18}\\.fail\r\n[0-9a-za-z]{10-18}\\.viajes\r\n[0-9a-za-z]{10-18}\\.exposed\r\n[0-9a-za-z]{10-18}\\.fit\r\n[0-9a-za-z]{10-18}\\.work\r\n[0-9a-za-z]{10-18}\\.london\r\n[0-9a-za-z]{10-18}\\.surf\r\n[0-9a-za-z]{10-18}\\.date\r\n[0-9a-za-z]{10-18}\\.asia\r\n[0-9a-za-z]{10-18}\\.life\r\n[0-9a-za-z]{10-18}\\.cam[\/et_pb_text][\/et_pb_column]\n\t\t\t[\/et_pb_row]\n\t\t[\/et_pb_section]\n\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":739,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"\"\"\r\n\r\nJe\u015bli kto\u015b korzysta z PiHole to podaj\u0119 swoje regexp<\/i>.\r\n\r\n \r\n\r\nOpracowane na podstawie w\u0142asnych analiz ruchu itp. \r\n\r\nDomeny wy\u0142apane w ruchu ISP Debacom Zabrze:\r\n[0-9a-za-z]{13-18}.tickets\r\n[0-9a-za-z]{13-18}.blackfriday\r\nv1.[a-uw-z]{7}.ru\r\nv[12]{1}.[a-uw-z]{7}.ru\r\n[b-y]{12}.pw\r\n[0-9a-za-z]{13-18}.feedback\r\n[0-9a-za-z]{13-18}.org\r\n[0-9a-za-z]{13-18}.hosting\r\n[0-9a-za-z]{13-18}.org\r\n[0-9a-za-z]{13-18}.cloudfront.net\r\n[0-9]{10}.rsc.cdn77.org\r\n\r\n \r\n\r\nKilka domen 3-go rz\u0119du u rejestrator\u00f3w, kt\u00f3rzy nie kontroluj\u0105 swoich klient\u00f3w i zezwalaj\u0105 na szybkie dynamiczne rejestrowanie domen:\r\n
[0-9a-za-z]{13-18}.mooo.com\r\n[0-9a-za-z]{13-18}.chikenkiller.com\r\n[0-9a-za-z]{13-18}.us.to\r\n[0-9a-za-z]{13-18}.strangled.net\r\n[0-9a-za-z]{13-18}.ignorelist.com\r\n[0-9a-za-z]{13-18}.uk.to\r\n[0-9a-za-z]{13-18}.crabdance.com\r\n[0-9a-za-z]{13-18}.info.tm\r\n[0-9a-za-z]{13-18}.jumpingcrab.com\r\n[0-9a-za-z]{13-18}.twilightparadox.com\r\n[0-9a-za-z]{13-18}.biz.tm\r\n[0-9a-za-z]{13-18}.continent.kz\r\n[0-9a-za-z]{13-18}.az.lt<\/pre>\r\n\r\nDomeny, kt\u00f3re w wi\u0119kszo\u015bci to malware itp. Dodaje tylko te kt\u00f3re maj\u0105 wi\u0119cej jak 10 znak\u00f3w. Powinno to zmniejszy\u0107 false positive.\r\n\r\n[0-9a-za-z]{10-18}.fail\r\n[0-9a-za-z]{10-18}.viajes\r\n[0-9a-za-z]{10-18}.exposed\r\n[0-9a-za-z]{10-18}.fit\r\n[0-9a-za-z]{10-18}.work\r\n[0-9a-za-z]{10-18}.london\r\n[0-9a-za-z]{10-18}.surf\r\n[0-9a-za-z]{10-18}.date\r\n[0-9a-za-z]{10-18}.asia\r\n[0-9a-za-z]{10-18}.life\r\n[0-9a-za-z]{10-18}.cam","_et_gb_content_width":"","footnotes":""},"categories":[4,3],"tags":[],"class_list":["post-737","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sciaga-admina","category-uslugi"],"_links":{"self":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/737","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/comments?post=737"}],"version-history":[{"count":9,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/737\/revisions"}],"predecessor-version":[{"id":813,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/737\/revisions\/813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/media\/739"}],"wp:attachment":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/media?parent=737"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/categories?post=737"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/tags?post=737"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}