09 Novembre 2008 Changes (HHH) ------------------------------ 1. Action: Added *PERSONAL* BannerBank.ru rule Added: BadNetworks[i++] = "195.161.119.0, 255.255.255.0"; // PRIVUS BBRU Reason: They only run from 195.161.119.193 ... 195.161.119.250 but they have the whole 8 bits so I really would rather thwart anything else that may come my way. 2. Action: Added THIRD xiti rule. I think we have them all now. Added: BadNetworks[i++] = "130.117.119.0, 255.255.255.0"; // xiti.com_3 Reason: Complete the rule set 3. Action: Expanded SPAMMER rule From: BadNetworks[i++] = "8.14.98.4, 255.255.255.255"; // SPAM To: BadNetworks[i++] = "8.14.98.0, 255.255.255.0"; // SPAM Reason: They came along and started using 8.14.98.3. I can see where this is heading so I whapped them all. 4. Action: Expanded SPAMMER rule From: BadNetworks[i++] = "208.53.17.254, 255.255.255.255"; // SPAM To: BadNetworks[i++] = "208.53.17.0, 255.255.255.0"; // SPAM Reason: Wouldn't you know it - they did the same thing here. Up until now they always used the given IP. But since they started using 208.53.17.253, and the fact that they own the entire 208.53.17.0 ... 208.53.17.255 address space - I AM BLOCKING IT! 5. Action: Stopping more SPAM Added: BadNetworks[i++] = "69.93.12.164, 255.255.255.255"; // SPAM Reason: This doesn't bode well. They are now taking to doing one-off IP addresses, this time from ThePlanet.com. The URL was middlingfollows.net/vip/2575/hhhobbit@comcast.net 6. Action: Upgraded porn rule From: BadNetworks[i++] = "78.108.177.0, 255.255.255.0"; // PRIVUS PORN 2008-09-14 To: BadNetworks[i++] = "78.108.177.0, 255.255.255.0"; // PORN 013 Reason: Stopped tubemarines.com. We will just have to see what hosts are good in this range the hard way I guess. 7. Action: "HOT" bypass rule Added: GoodDomains[i++] = ".hosts-file.net"; Reason: Technically this should NOT be needed. However, along with rlwpx.free.fr they should be given a free hand. I do NOT want to be accused of denying access to ANY of the filter sites. 8. Action: *.vstaet.com DNSWCD (DNS Wild Card Domain) Added: BadDomains[i++] = ".vstaet.info"; // DNS-WCD Reason: A cursory look for it in a search engine reveals that how they are most used is with something like man-wrist-watch.vstaet.com or adult-video.vstaet.com which may as well be anthing-i-want.vstaet.com . The only way you can block all of them is this way. 9. Action: Park IP addresses Added: BadNetworks[i++] = "208.73.210.32, 255.255.255.255"; // PARK-IP BadNetworks[i++] = "208.87.33.150, 255.255.255.255"; // PARK-IP Reason: Rodney requested them. I don't have any reason for blocking them myself but since he wants them that is fine. Now there ARE other PARK services that do something wrong and in that case, I can see a good reason for SOME PARK services when they do something abusive. 10. Action: MASSIVE REMOVAL OF PORN RULES Removed: GoodDomains[i++] = "virginmedia.com"; GoodDomains[i++] = "virginmega.fr"; ------------------------------------------------ BadNetworks[i++] = "64.255.172.50, 255.255.255.255"; // PORN 008 BadNetworks[i++] = "66.116.125.150, 255.255.255.255"; // PORN 009 BadNetworks[i++] = "72.232.116.0, 255.255.255.0"; // PORN 002 BadNetworks[i++] = "78.108.177.0, 255.255.255.0"; // PORN 013 BadNetworks[i++] = "80.77.85.0, 255.255.255.0"; // PORN 001 BadNetworks[i++] = "85.255.121.176, 255.255.255.254"; // PORN 003 BadNetworks[i++] = "195.10.6.0, 255.255.255.0"; // PORN 004 BadNetworks[i++] = "195.56.77.0, 255.255.255.0"; // PORN 012 --- SPAM IPS --- BadNetworks[i++] = "69.50.255.254, 255.255.255.255"; // SPAM BadNetworks[i++] = "69.64.155.119, 255.255.255.255"; // SPAM BadNetworks[i++] = "69.64.155.120, 255.255.255.252"; // SPAM BadNetworks[i++] = "69.64.155.128, 255.255.255.252"; // SPAM BadNetworks[i++] = "69.64.155.136, 255.255.255.255"; // SPAM BadNetworks[i++] = "69.93.12.164, 255.255.255.255"; // SPAM --- THESE ARE NOW PARK IP ADDRESSES --- ------------------------------------------------ BadDomains[i++] = ".bangbros1.com"; BadDomains[i++] = ".blogbugs.org"; BadDomains[i++] = ".blogtur.com"; BadDomains[i++] = ".clearblogsonline.com"; BadDomains[i++] = ".da.ru"; BadDomains[i++] = ".ddfdn.biz"; BadDomains[i++] = ".free.fr"; // YOUR CHOICE BadDomains[i++] = ".hitfarm.com"; (REMOVED EVERYWHERE - GONE?) BadDomains[i++] = ".justcounter.com"; (REMOVED EVERYWHERE - GONE?) BadDomains[i++] = ".lop.com"; (REMOVED EVERYWHERE) BadDomains[i++] = ".mtree.com"; (REMOVED EVERYWHERE - BLOCKED NOTHING) BadDomains[i++] = ".sexsearch.com"; (REMOVED EVERYWHERE - BLOCKED NOTHING) BadDomains[i++] = ".streamray.com"; (REMOVED EVERYWHERE - BLOCKED NOTHING) BadDomains[i++] = ".teracent.net"; BadDomains[i++] = ".trackalyzer.com"; (REMOVED EVERYWHERE - ONLY ONE BLOCK) BadDomains[i++] = ".vstaet.info"; // DNSWCD (REMOVED EVERYWHERE - BLOCKED NOTHING) All of the previous removed everywhere may have aliases now. It is just that there were no blocks since more than a year ago for most of them. ------------------------------------------------ BadURL_Parts[i++] = "amateur"; BadURL_Parts[i++] = "amatrice"; BadURL_Parts[i++] = "amatuer"; BadURL_Parts[i++] = "amatur"; BadURL_Parts[i++] = "analsex"; BadURL_Parts[i++] = "[^blmprsvw]ass[^eiou]"; // VOTRE CHOIX BadURL_Parts[i++] = "backdoor"; BadURL_Parts[i++] = "backseat"; BadURL_Parts[i++] = "banned"; BadURL_Parts[i++] = "bang-bus"; BadURL_Parts[i++] = "bangbus"; BadURL_Parts[i++] = "bange"; BadURL_Parts[i++] = "banging"; BadURL_Parts[i++] = "bareback"; BadURL_Parts[i++] = "barely-legal"; BadURL_Parts[i++] = "barelylegal"; BadURL_Parts[i++] = "bbw"; BadURL_Parts[i++] = "bdsm"; BadURL_Parts[i++] = "beastial"; BadURL_Parts[i++] = "beauties"; BadURL_Parts[i++] = "beaver"; BadURL_Parts[i++] = "belle"; BadURL_Parts[i++] = "bestial"; BadURL_Parts[i++] = "bikini"; BadURL_Parts[i++] = "bisex"; BadURL_Parts[i++] = "bitch"; BadURL_Parts[i++] = "bizar"; BadURL_Parts[i++] = "bizzar"; BadURL_Parts[i++] = "blonde"; BadURL_Parts[i++] = "boner"; BadURL_Parts[i++] = "breast"; BadURL_Parts[i++] = "bukkake"; BadURL_Parts[i++] = "busty"; BadURL_Parts[i++] = "centerfold"; BadURL_Parts[i++] = "chaude"; BadURL_Parts[i++] = "cheating"; BadURL_Parts[i++] = "chicas"; BadURL_Parts[i++] = "chicos"; BadURL_Parts[i++] = "chik"; BadURL_Parts[i++] = "chix"; BadURL_Parts[i++] = "chubby"; BadURL_Parts[i++] = "clit"; BadURL_Parts[i++] = "coeds"; BadURL_Parts[i++] = "crazy"; BadURL_Parts[i++] = "creampie"; BadURL_Parts[i++] = "culotte"; BadURL_Parts[i++] = "cunt"; BadURL_Parts[i++] = "dating"; (most covered by our new ".cn" rule) BadURL_Parts[i++] = "deepthroat"; BadURL_Parts[i++] = "desire"; BadURL_Parts[i++] = "dicks"; BadURL_Parts[i++] = "dildo"; BadURL_Parts[i++] = "dreamgirl"; BadURL_Parts[i++] = "drunk"; BadURL_Parts[i++] = "dykes"; BadURL_Parts[i++] = "ebony"; BadURL_Parts[i++] = "ejacula"; BadURL_Parts[i++] = "erection"; BadURL_Parts[i++] = "escorts"; BadURL_Parts[i++] = "exotic"; BadURL_Parts[i++] = "explicit"; BadURL_Parts[i++] = "exploited"; BadURL_Parts[i++] = "exposed"; BadURL_Parts[i++] = "facial"; BadURL_Parts[i++] = "famosas"; BadURL_Parts[i++] = "fantas"; BadURL_Parts[i++] = "fellatio"; BadURL_Parts[i++] = "females"; BadURL_Parts[i++] = "femdom"; BadURL_Parts[i++] = "femme"; BadURL_Parts[i++] = "fetiche"; BadURL_Parts[i++] = "fetisch"; BadURL_Parts[i++] = "fetish"; BadURL_Parts[i++] = "fingering"; BadURL_Parts[i++] = "fisting"; BadURL_Parts[i++] = "flasher"; BadURL_Parts[i++] = "flashing"; BadURL_Parts[i++] = "flesh"; BadURL_Parts[i++] = "forbidden"; BadURL_Parts[i++] = "foxy"; BadURL_Parts[i++] = "ftv"; BadURL_Parts[i++] = "galeri"; BadURL_Parts[i++] = "galls"; BadURL_Parts[i++] = "gang-bang"; BadURL_Parts[i++] = "gangbang"; BadURL_Parts[i++] = "geile"; BadURL_Parts[i++] = "geisha"; BadURL_Parts[i++] = "girlfriend"; BadURL_Parts[i++] = "gloryhole"; BadURL_Parts[i++] = "goddess"; BadURL_Parts[i++] = "goldenshower"; BadURL_Parts[i++] = "grannie"; BadURL_Parts[i++] = "granny"; BadURL_Parts[i++] = "groupsex"; BadURL_Parts[i++] = "gyn[(e|o)]"; BadURL_Parts[i++] = "hairy"; BadURL_Parts[i++] = "handjob"; BadURL_Parts[i++] = "hardon"; BadURL_Parts[i++] = "heterosex"; BadURL_Parts[i++] = "hidden-cam"; BadURL_Parts[i++] = "hiddencam"; BadURL_Parts[i++] = "hirsute"; BadURL_Parts[i++] = "homos"; BadURL_Parts[i++] = "honeys"; BadURL_Parts[i++] = "hooker"; BadURL_Parts[i++] = "hooter"; BadURL_Parts[i++] = "horney"; BadURL_Parts[i++] = "horny"; BadURL_Parts[i++] = "hottie"; BadURL_Parts[i++] = "hotty"; BadURL_Parts[i++] = "[^c]hunk"; BadURL_Parts[i++] = "huren"; BadURL_Parts[i++] = "huss[(i|y)]"; BadURL_Parts[i++] = "hustler"; BadURL_Parts[i++] = "innocent"; BadURL_Parts[i++] = "interacial"; BadURL_Parts[i++] = "intercourse"; BadURL_Parts[i++] = "interracial"; BadURL_Parts[i++] = "intimate"; BadURL_Parts[i++] = "jackoff"; BadURL_Parts[i++] = "jeune"; BadURL_Parts[i++] = "jiz"; BadURL_Parts[i++] = "joven"; BadURL_Parts[i++] = "juicy"; BadURL_Parts[i++] = "junge"; BadURL_Parts[i++] = "karup"; BadURL_Parts[i++] = "kinky"; BadURL_Parts[i++] = "lesbo"; BadURL_Parts[i++] = "libertine"; BadURL_Parts[i++] = "libido"; BadURL_Parts[i++] = "licking"; BadURL_Parts[i++] = "lingerie"; BadURL_Parts[i++] = "livecam"; BadURL_Parts[i++] = "luscious"; BadURL_Parts[i++] = "maitresse"; BadURL_Parts[i++] = "masterbat"; BadURL_Parts[i++] = "masturba"; BadURL_Parts[i++] = "mistress"; BadURL_Parts[i++] = "models"; BadURL_Parts[i++] = "mouth-ful"; BadURL_Parts[i++] = "mouthful"; BadURL_Parts[i++] = "muff"; BadURL_Parts[i++] = "mujeres"; BadURL_Parts[i++] = "mysex"; BadURL_Parts[i++] = "nackt"; BadURL_Parts[i++] = "naughty"; BadURL_Parts[i++] = "nipple"; BadURL_Parts[i++] = "nookie"; BadURL_Parts[i++] = "nudie"; BadURL_Parts[i++] = "nudis"; BadURL_Parts[i++] = "nudit"; BadURL_Parts[i++] = "nylon"; BadURL_Parts[i++] = "nymph"; BadURL_Parts[i++] = "obgyn"; BadURL_Parts[i++] = "orgasm"; BadURL_Parts[i++] = "p0rn"; BadURL_Parts[i++] = "pantie"; BadURL_Parts[i++] = "panty"; BadURL_Parts[i++] = "pecker"; BadURL_Parts[i++] = "peeing"; BadURL_Parts[i++] = "penetration"; BadURL_Parts[i++] = "penis"; BadURL_Parts[i++] = "penthouse"; BadURL_Parts[i++] = "perky"; BadURL_Parts[i++] = "perver"; BadURL_Parts[i++] = "petite"; BadURL_Parts[i++] = "phonesex"; BadURL_Parts[i++] = "playboy"; BadURL_Parts[i++] = "pleasure"; BadURL_Parts[i++] = "plumper"; BadURL_Parts[i++] = "preteen"; BadURL_Parts[i++] = "prostit"; BadURL_Parts[i++] = "pubic"; BadURL_Parts[i++] = "pussie"; BadURL_Parts[i++] = "redhead"; BadURL_Parts[i++] = "redlight"; BadURL_Parts[i++] = "salope"; BadURL_Parts[i++] = "schoolgirl"; BadURL_Parts[i++] = "sexpics"; BadURL_Parts[i++] = "sexshow"; BadURL_Parts[i++] = "sexsite"; BadURL_Parts[i++] = "sextoy"; BadURL_Parts[i++] = "sexworld"; BadURL_Parts[i++] = "shaved"; BadURL_Parts[i++] = "shemale"; BadURL_Parts[i++] = "sinful"; BadURL_Parts[i++] = "slave"; BadURL_Parts[i++] = "smokin"; BadURL_Parts[i++] = "smut"; BadURL_Parts[i++] = "snatch"; BadURL_Parts[i++] = "sodom"; BadURL_Parts[i++] = "softcore"; BadURL_Parts[i++] = "spanking"; BadURL_Parts[i++] = "sperm"; BadURL_Parts[i++] = "spunk"; BadURL_Parts[i++] = "spycam"; BadURL_Parts[i++] = "squirt"; BadURL_Parts[i++] = "starlet"; BadURL_Parts[i++] = "stocking"; BadURL_Parts[i++] = "strapon"; BadURL_Parts[i++] = "stripper"; BadURL_Parts[i++] = "studs"; BadURL_Parts[i++] = "swinger"; BadURL_Parts[i++] = "swinging"; BadURL_Parts[i++] = "taboo"; BadURL_Parts[i++] = "teenage"; BadURL_Parts[i++] = "teengirls"; BadURL_Parts[i++] = "teenie"; BadURL_Parts[i++] = "teens"; BadURL_Parts[i++] = "teeny"; BadURL_Parts[i++] = "teenz"; BadURL_Parts[i++] = "titten"; BadURL_Parts[i++] = "tittie"; BadURL_Parts[i++] = "titts"; BadURL_Parts[i++] = "titty"; BadURL_Parts[i++] = "toilet"; BadURL_Parts[i++] = "topless"; BadURL_Parts[i++] = "torture"; BadURL_Parts[i++] = "totty"; BadURL_Parts[i++] = "tramp"; BadURL_Parts[i++] = "trannie"; BadURL_Parts[i++] = "tranny"; BadURL_Parts[i++] = "transex"; BadURL_Parts[i++] = "transgend"; BadURL_Parts[i++] = "transves"; BadURL_Parts[i++] = "travesti"; BadURL_Parts[i++] = "twat[^ce]"; BadURL_Parts[i++] = "twistys"; BadURL_Parts[i++] = "uncensored"; BadURL_Parts[i++] = "uncut"; BadURL_Parts[i++] = "upskirt"; BadURL_Parts[i++] = "vagina"; BadURL_Parts[i++] = "venus"; BadURL_Parts[i++] = "viagra"; BadURL_Parts[i++] = "vibrator"; BadURL_Parts[i++] = "vierge"; BadURL_Parts[i++] = "vixen"; BadURL_Parts[i++] = "web-cam"; BadURL_Parts[i++] = "webcam"; BadURL_Parts[i++] = "whore"; BadURL_Parts[i++] = "wives"; BadURL_Parts[i++] = "x-rated"; BadURL_Parts[i++] = "xrated"; BadURL_Parts[i++] = "zoosex"; ------------------------------------------------ BadHostParts[i++] = "17"; // VOTRE CHOIX BadHostParts[i++] = "18"; // VOTRE CHOIX BadHostParts[i++] = "877"; BadHostParts[i++] = "900"; BadHostParts[i++] = "qsrch"; (NOT IN MY LOGS) BadHostParts[i++] = "babylon"; BadHostParts[i++] = "beast"; BadHostParts[i++] = "booty"; BadHostParts[i++] = "boys"; BadHostParts[i++] = "boyz"; BadHostParts[i++] = "butt[^eor]"; BadHostParts[i++] = "cheat"; BadHostParts[i++] = "cheerlead"; BadHostParts[i++] = "cherry"; BadHostParts[i++] = "[^nt]dame"; // tdameritrade.com BadHostParts[i++] = "dirt"; BadHostParts[i++] = "donne"; BadHostParts[i++] = "extrem"; BadHostParts[i++] = "fhg"; BadHostParts[i++] = "fille"; BadHostParts[i++] = "finger"; BadHostParts[i++] = "flirt"; BadHostParts[i++] = "friendfinder"; BadHostParts[i++] = "girlz"; BadHostParts[i++] = "[^w]hole"; BadHostParts[i++] = "passion"; BadHostParts[i++] = "peep"; BadHostParts[i++] = "pix"; BadHostParts[i++] = "rencontre"; BadHostParts[i++] = "secret"; BadHostParts[i++] = "single"; BadHostParts[i++] = "sneak"; // PROXY BadHostParts[i++] = "submissi"; BadHostParts[i++] = "tease"; BadHostParts[i++] = "twink"; BadHostParts[i++] = "vegas"; BadHostParts[i++] = "wicked"; ------------------------------------------------ BadURL_WordStarts[i++] = "chest"; BadURL_WordStarts[i++] = "babe[^l]"; BadURL_WordStarts[i++] = "coed"; BadURL_WordStarts[i++] = "escort"; BadURL_WordStarts[i++] = "gals"; BadURL_WordStarts[i++] = "legs"; BadURL_WordStarts[i++] = "oral"; BadURL_WordStarts[i++] = "pee[^nrv]"; BadURL_WordStarts[i++] = "pink"; BadURL_WordStarts[i++] = "rape"; ------------------------------------------------ BadHostWordStarts[i++] = "bang"; BadHostWordStarts[i++] = "boy"; BadHostWordStarts[i++] = "fotos"; BadHostWordStarts[i++] = "lady"; BadHostWordStarts[i++] = "lips"; BadHostWordStarts[i++] = "piss"; BadHostWordStarts[i++] = "strip"; BadHostWordStarts[i++] = "zoo"; // YOUR CHOICE ------------------------------------------------ BadURL_WordEnds[i++] = "butt"; BadURL_WordEnds[i++] = "chest"; BadURL_WordEnds[i++] = "coed"; BadURL_WordEnds[i++] = "escort"; BadURL_WordEnds[i++] = "gals"; BadURL_WordEnds[i++] = "legs"; BadURL_WordEnds[i++] = "[^u]pee"; BadURL_WordEnds[i++] = "pink"; BadURL_WordEnds[i++] = "piss"; BadURL_WordEnds[i++] = "[^cg]rape"; BadURL_WordEnds[i++] = "sexe"; ------------------------------------------------ // BadHostWordEnds[i++] = "bang"; // YOUR CHOICE BadHostWordEnds[i++] = "boy"; BadHostWordEnds[i++] = "fotos"; BadHostWordEnds[i++] = "girlz"; BadHostWordEnds[i++] = "[^c]lips"; BadHostWordEnds[i++] = "lady"; // BadHostWordEnds[i++] = "live"; // YOUR CHOICE ------------------------------------------------ Reason: We have left these rules in the pornproxy.txt file. But for normal usage they aren't needed any more. That does NOT mean we won't have any "porn" rules at all. We will but ONLY if the pattern count is high enough at the MalwareDomainList or I find the term particularly objectionable to my anima (Jung). For dumb males it means I can't explain it but I know it is right (not EVERYTHING is QUANTIFIABLE but all things are QUALIFIABLE): http://www.malwaredomainlist.com/hostslist/hosts.txt If the pattern is significantly high enough, the porn pattern may be included at the HOST level but probably won't be at the URL level unless it was already at the URL level. One false positive can topple these PSEUDO PORN rules from URL to HOST level. In fact I have already moved some from URL to Hosts due to previous false positives (and one of them was deleted anyway): "[^hn]cock" "gay" "huge" "virgin[^im]" "girl" start URL ---> start Host "girl" end URL ---> end Host "girls" end URL ---> end Host "girlz" end URL ---> end Host (ABANDONED - NONE) "girls" HostParts ADDED TO ALL "piss" start URL ---> start Host However, we MUST have at least ONE NON-REGEXP rule per rule-set at the appropriate end. For this reason I will put in "porn" if nothing is left. That may look strange but that is what they are there for. Just make sure no REGEXP goes either before or after the appropriate pattern in each array. I will note a do not move by them. 11. Action: park.funnel.revenuedirect.com.akadns.net IP change From: BadNetworks[i++] = "66.150.161.57, 255.255.255.255"; // PARKFUNNEL BadNetworks[i++] = "69.25.47.164, 255.255.255.255"; // PARKFUNNEL To: BadNetworks[i++] = "66.150.161.44, 255.255.255.255"; // PARKFUNNEL BadNetworks[i++] = "69.25.47.166, 255.255.255.255"; // PARKFUNNEL Reason: The IP address changes and unlike Rodney's PARK IPs. this one bites. But it is JUST a JavaScript exploit - bad enough for inclusion though. 12. Action: new SPAM rule Added: BadNetworks[i++] = "72.5.218.0, 255.255.254.0"; // SPAM Reason: TONS of spam in my email box has links redirecting to hosts at 72.5.218.2 AND the IP WhoIs lookup indicates they have 72.5.218.0 ... 72.5.219.255 inclusive. 13. Action: replaced two big 2o7.net rules with just the one HUGE rule. From: // BadNetworks[i++] = "66.235.128.0, 255.255.224.0"; // 08-09-14 YOUR CHOICE // Covers 66.235.128.0 ... 66.235.159.255 Comment out other rules. BadNetworks[i++] = "66.235.132.0, 255.255.254.0"; // 2008-09-03 BadNetworks[i++] = "66.235.142.0, 255.255.254.0"; // 2008-09-14 To: // Couvertures 66.235.128.0 ... 66.235.159.255 // BadNetworks[i++] = "66.235.132.0, 255.255.254.0"; // 2008-09-03 // BadNetworks[i++] = "66.235.142.0, 255.255.254.0"; // 2008-09-14 BadNetworks[i++] = "66.235.128.0, 255.255.224.0"; // 2008-11-04 Reason: Along came both stats.pgp.com and sstats.pgp.com. The first was okay, but sstats.pgp.com has IP address 066.235.130.208 (66.235.130.208) which as you can see was NOT covered by the existing rules but the extended one. Now the extended one has replaced the smaller rules. I have had no FPs (False Positives) for over two months now. 14. Action: NEW "mature" rule due to Malware Domain List. Added: BadHostParts[i++] = "mature"; Reason: The URL rules probably cover it okay: BadURL_WordStarts[i++] = "mature"; BadURL_WordEnds[i++] = "mature"; But the instant they cause a problem - THEY ARE GONE! I have had problems with them before. You show me just one FALSE positive for either rule and I will remove that rule IMMEDIATELY in proxy.txt / dbgproxy.txt. I also added this rule to the pornproxy.txt file. There are just too many hosts that infect that have this pattern as part of their host name. 09 Novembre 2008 UNresolved False Positives (HHH) ------------------------------------------------- NONE 09 Novembre 2008 RESOLVED False Positives (HHH) ----------------------------------------------- 1. Pattern: "chest" Rules: BadURL_WordStarts[i++] = "chest"; BadURL_WordEnds[i++] = "chest"; Reason: Wed May 16 10:11:41: images.bestbuy.com/BestBuy_US/en_US/images/global\ /features/gigrad_blueshirtchest_2007.jpg THE EASY SOLUTION WOULD BE TO ADD A GoodDomains ".bestbuy.com" RULE. THE PROBLEM IS: hope-chest drawer-chest, chest-of-jewels, treasure-chest, etc. Further, even the efficacy of the rule itself poses no reason to drop the rules from URL to HOST: 44 chest_Parts.txt 5 chest_Starts_and_Ends.txt 33 chest_Passed_All_Rules.txt 82 total Solution: This rule is no longer there except in the pornproxy.txt file. Therefore it is only a problem for people using that file - LET THEM WRESTLE WITH IT! This is NOT the reason for abandoning the pornproxy effort. It was that NOBODY wanted what I had carried the bulk of the work in creating. No need? Then punt to AdLand.