build-phishing-domainset.js 2.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293
  1. const tldts = require('tldts');
  2. const { processFilterRules } = require('./lib/parse-filter.js');
  3. const fs = require('fs');
  4. const path = require('path');
  5. const WHITELIST_DOMAIN = new Set([
  6. 'w3s.link',
  7. 'dweb.link',
  8. 'nftstorage.link'
  9. ]);
  10. const BLACK_TLD = Array.from(new Set([
  11. '.xyz',
  12. '.top',
  13. '.win',
  14. '.vip',
  15. '.site',
  16. '.space',
  17. '.online',
  18. '.icu',
  19. '.fun',
  20. '.shop',
  21. '.cool',
  22. '.cyou',
  23. '.id',
  24. '.pro',
  25. '.za.com',
  26. '.sa.com',
  27. '.ltd',
  28. '.group',
  29. '.rest',
  30. '.tech',
  31. '.link',
  32. '.ink',
  33. '.bar',
  34. '.tokyo'
  35. ]));
  36. (async () => {
  37. const domainSet = Array.from(
  38. (
  39. await processFilterRules('https://curbengh.github.io/phishing-filter/phishing-filter-agh.txt')
  40. ).black
  41. );
  42. const domainCountMap = {};
  43. for (let i = 0, len = domainSet.length; i < len; i++) {
  44. const line = domainSet[i];
  45. // starts with #
  46. if (line.charCodeAt(0) === 35) {
  47. continue;
  48. }
  49. if (line.trim().length === 0) {
  50. continue;
  51. }
  52. const domain = line.charCodeAt(0) === 46 ? line.slice(1) : line;
  53. if (domain.length > 19) {
  54. const apexDomain = tldts.getDomain(domain, { allowPrivateDomains: true });
  55. if (apexDomain) {
  56. if (WHITELIST_DOMAIN.has(apexDomain)) {
  57. continue;
  58. }
  59. domainCountMap[apexDomain] ||= 0;
  60. domainCountMap[apexDomain] += 1;
  61. // Add more weight if the domain is long enough
  62. if (domain.length > 45) {
  63. domainCountMap[apexDomain] += 1.5;
  64. } else if (domain.length > 35) {
  65. domainCountMap[apexDomain] += 1;
  66. } else if (domain.length > 30) {
  67. domainCountMap[apexDomain] += 0.5;
  68. }
  69. }
  70. }
  71. }
  72. const results = [];
  73. Object.entries(domainCountMap).forEach(([domain, count]) => {
  74. if (
  75. count >= 5
  76. && BLACK_TLD.some(tld => domain.endsWith(tld))
  77. ) {
  78. results.push('.' + domain);
  79. }
  80. });
  81. const filePath = path.resolve(__dirname, '../List/domainset/reject_phishing.conf');
  82. await fs.promises.writeFile(filePath, results.join('\n') + '\n', 'utf-8');
  83. })();