-
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathblacklist.txt
81 lines (75 loc) · 4.31 KB
/
blacklist.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
# Testing
(https?:\/\/)?(.+\.)?testinglinktomakesuretheantiphishingbotcandeletemessages\.testonly
# Steam scam links
(https?:\/\/)?(.+\.)?steemit\.com
(https?:\/\/)?(.+\.)?stea?(rn|rm|m)c+[o0](m|rn)+unit+y\.ru
(https?:\/\/)?(.+\.)?steamcornminuty\.\w{2,15}
(https?:\/\/)?(.+\.)?steamcommunityx\.\w{2,15}
# Invalid root level domains for valid (or safe 3rd party) discord domain names
(https?:\/\/)?(.+\.)?discord\.(?!com(\b)|gg(\b)|media(\b)|gift(\b)|gifts(\b)|me(\b)|new(\b)|co(\b))
(https?:\/\/)?(.+\.)?discordapp\.(?!com(\b)|net(\b))
(https?:\/\/)?(.+\.)?discordstatus\.(?!com(\b))
# Valid discord domains with extra characters in the middle
(https?:\/\/)?(.+\.)?d[il17f](sc|cs|s|c)[0o]\w{1,3}r(cl|d)app\.com\b
(https?:\/\/)?(.+\.)?d[il17f](sc|cs|s|c)[0o]\w{1,3}r(cl|d)app\.net\b
# ----
# Invalid discord domains, no matter the root domain
# Above each pattern, there is a human readable explanation of what it should be blocking
# Anything in parentheses like (discord) means we are matching many variations of that word
# Anything in <...> has an explanation of what should be matched
# A "*" means match anything
# ----
## (discord).(gift)
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[o0]+r(cl|[dbt]).{0,10}\.(gift[^s\W]\w{0,15}|gifts\w{1,15})
## (discord)(gift).*
(https?:\/\/)?(.+\.)?d[il17f]+(cs|sc|s|c|c)r?[o0]+r(cl|[dbt])\S{0,2}g[il1]ft[s5]?\.\w{2,15}(\.\w{2,15})?
## (gift)(discord)*.*
(https?:\/\/)?(.+\.)?g[il17f]fts?-?d[il17]+(sc|cs|s|c)[o0]+r?(cl|[db])\w{1,15}\.\w{2,15}(\.\w{2,15})?
## (discord)-*.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)(rc|cr|r|c)?[o0]+(rc|cr|r|c)?(cl|[dbt])\w{0,5}-\w{1,20}\.\w{2,15}(\.\w{2,15})?
## (discord)app.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)ro(cl|[dbt])app\.\w{2,15}(\.\w{2,15})?
## (steam)(discord).*
(https?:\/\/)?(.+\.)?stea(m|n|nn).{0,4}d[il](sc|cs)[o0]r?(cl|[dbt])\.\w{2,15}(\.\w{2,15})?
## (discord)<anything-but-"app"-with-3-letters>.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[o0]+r(cl|[dbt])[^a][^p]{2}\.\w{2,15}(\.\w{2,15})?
## (discord)(nitro).*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[o0]+r(cl|[dbt])s?.{0,5}n[il17]{1,2}t+r[o0]s?\.\w{2,15}(\.\w{2,15})?
## (nitro)*.*
(https?:\/\/)?(.+\.)?n[il17f]t+r[o0]\S{1,15}\.\w{2,15}(\.\w{2,15})?
## (boost)(nitro).*
(https?:\/\/)?(.+\.)?b[o0]+st+-?n[il17f]t+r[o0]\.\w{2,15}(\.\w{2,15})?
## (stellseriesnitro).*
(https?:\/\/)?(.+\.)?stellseriesnitro\.\w{2,15}(\.\w{2,15})?
## <discord-where-second-letter-isn't-i>*.*
(https?:\/\/)?(.+\.)?d[^i].?(sc|cs|s|c)[o0]+r?(cl|[dbt])\w{0,5}\.\w{2,15}(\.\w{2,15})?
## <discord-with-location-of-r-manipulation>*.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)r?[o0]+(cl|[dbt])\w{0,5}\.\w{2,15}(\.\w{2,15})?
## <discord-where-second-to-last-letter-isn't-r>*.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[o0]+[^r](cl|[dbt])\w{0,5}\.\w{2,15}(\.\w{2,15})?
## <discord-with-extra-letter-after-r>.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[0o]r\w(cl|[dbt])\.\w{2,15}(\.\w{2,15})?
## <discord-missing-the-d-at-the-end>.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[0o]r(cl|[btl])\.\w{2,15}(\.\w{2,15})?
## <discord-with-extra-c-after-o>*.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[o0]+cr?(cl|[dbt])\S{0,5}\.\w{2,15}(\.\w{2,15})?
## <discord-with-reversed-"sc">*.*
(https?:\/\/)?(.+\.)?d[il17f]+cs[o0]+r?(cl|[db])\S{0,15}\S{0,5}\.\w{2,15}(\.\w{2,15})?
## <discord-but-"o"-is-another-letter>*.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[^o]r?(cl|[dbt])\S{0,5}\.\w{2,15}(\.\w{2,15})?
## <discord-with-dot-in-the-middle>*.*
(https?:\/\/)?(.+\.)?d[il17f]+s\.c[o0]+r?(cl|[dbt])\S{0,5}\.\w{2,15}(\.\w{2,15})?
## <discord-with-double-c-or-none>*.*
(https?:\/\/)?(.+\.)?d[il17f]+(scc|cs|s|cc)[o0]+r?(cl|[dbt])\S{0,5}\.\w{2,15}(\.\w{2,15})?
## (discord)<anthing-but-s>.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs)[o0]+r?(cl|[db])[^s]\.\w{2,15}(\.\w{2,15})?
## (discord)<random-1-to-2-letters-with-first-letter-not-being-an-s>.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)r?[o0]+r?(cl|[dbt])[^s]\w?\.\w{2,15}(\.\w{2,15})?
## (discord)<random-4-to-5-letters>.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[o0]+r?(cl|[dbt])\w{4,5}\.\w{2,15}(\.\w{2,15})?
## (discord)<random-8-to-15-letters>.*
(https?:\/\/)?(.+\.)?d[il17f]+(sc|cs|s|c)[o0]+r?(cl|[dbt])\w{8,15}\.\w{2,15}(\.\w{2,15})?
# Other links used in discord scams but that do not resemble the discord domain
(https?:\/\/)?(.+\.)?e-giftpremium\.com
# Potentially malicious links unrelated to nitro/discord/steam scams
(https?:\/\/)?(.+\.)?clck\.ru