Skip to main content

↘ Benefits of donating from OpenBLD

· One min read
Yevgeniy Goncharov
Maintainer of OpenBLD.net

Introduction

In the realm of OpenBLD.net DNS, we're excited to introduce OpenBLD+ mode, a feature designed to take our and your experience to the next level.

Powered by Your Support: Our project thrives thanks to the support of users like you. Today you have the opportunity to subscribe for just $3+ and, in return, gain access to a host of exclusive benefits:

  • Enhanced Website Delivery Speed: Enjoy faster website/domain delivery to OpenBLD.net DNS users.
  • Company Logo or Nickname on Project Site: Showcase your company's logo or your nickname on our project site with a link to your website or social profile.
  • Unlimited Access for Dedicated IPs: Benefit from unlimited access for dedicated IPs.
  • Personal Support: Receive assistance in investigating cybersecurity incidents.
  • Have Questions or Suggestions? We're all ears. Feel free to reach out to us Contacts with any questions or suggestions you may have.

Unlock a World of Benefits with OpenBLD+ and elevate our and your online experience.

Join us today!

↘ Blocking SMiShing in Kazakhstan

· 2 min read
Yevgeniy Goncharov
Maintainer of OpenBLD.net

Introduction

The rise of phishing activities has taken the top spot in attacks targeting end-users and organizations. Among the various forms of phishing attacks, there's one known as "SMiShing" attacks, which target users through SMS messages.

SMiShing Attacks

Today, we've noticed a SMiShing campaign in Kazakhstan, where a seemingly innocent link leads to a fake website that mimics the KazPost website, the official postal service of Kazakhstan. Several indicators set this apart:

  • The sender's country code
  • The target website
  • The fact that the package was never ordered

SMiShing Attacks

The provided link directs users to a phishing page designed to imitate post.kz, the official website of the postal service in Kazakhstan.

Recommendation

We strongly advise against responding to such SMS messages. If you have any doubts or concerns, it's best to contact your nearest post office to clarify the details, especially if you did not order a package that coincides with the SMS.

Taking Action

Rest assured that we've promptly added this resource to our shared blocklists and locked it within the OpenBLD DNS system. Your online safety is our top priority.

Conclusion: In these times of increasing digital threats, let's remain vigilant and protect ourselves and our online experiences. Together with OpenBLD.net DNS, we can strive for a safer online environment. Peace ✌️

↘ Blocking Google Ads Spreads

· One min read
Yevgeniy Goncharov
Maintainer of OpenBLD.net

Today I discovered a new malicious company that spreads through of Google Ads side...

Google Ads Spreads

In short - "Sponsored" link redirects to malicious site, and boom 💥 I felt "OpenBLD" effect!

OpenBLD.net DNS blocked for me browser-hijacking app which was distributed with Google Ads which named asxg4ken... Wow 💣, very unexpected and nice as I usually try to be more careful when surfing the internet.

What is xg4ken and how to removal

Be safe with free and OpenBLD.net DNS 🤜🤛️️️️️️

↘ OpenBLD.net Growth in Q2 2023

· 2 min read
Yevgeniy Goncharov
Maintainer of OpenBLD.net

Introduction

In the ever-evolving OpenBLD ecosystem, the second quarter of 2023 has witnessed remarkable growth and some exciting changes. OpenBLD.net, the service committed to minimizing the internet noise caused by advertising and tracking, has evolved to introduce cutting-edge features like Anycast/GeoDNS, DNS-over-HTTPS, and DNS-over-TLS.

New Features

This evolution has brought forth two new services: Adaptive (ADA) and Strict (RIC), which are set to replace A-BLD and BLD. But what sets them apart? It's time to find out.

Testing Phase

I've been testing these new services for over two weeks now, and I must say, they are impressive. For all OpenBLD users, I encourage you to give them a try. Here's how you can make the switch:

  • For DNS-over-HTTPS (DoH), replace https://a-bld.sys-adm.in/dns-query with https://ada.openbld.net/dns-query

  • For DNS-over-TLS (DoT), switch from a-bld.sys-adm.in to ada.openbld.net

  • For DNS-over-HTTPS (DoH), replace https://bld.sys-adm.in/dns-query with https://ric.openbld.net/dns-query

  • For DNS-over-TLS (DoT), switch from bld.sys-adm.in to ric.openbld.net

In a week or two, A-BLD will be fully merged with ADA, ceasing to exist as we know it. One server (109.234.39.72) will be replaced by another (46.151.29.15) for faster and more efficient service. Don't wait; start your testing today!

Acknowledgments

All of this growth and development would not have been possible without the incredible support we've received this year. OpenBLD is grateful for the backing from the following organizations:

Special thanks to the Kazakhstan-based hosting providers Unihost.kz and GOhost.kz for their support and collaboration 🤜️️️️️️🤛️️️️️️

Join Us

You, too, can contribute to this open service aimed at filtering malicious content. Reach out to us with Contacts page to be part of our mission.

OpenBLD.net is growing, evolving, and making the Internet a better place for everyone. Join us in this exciting journey! 🚀

↘ Blocking Aurora Stealer

· 2 min read
Yevgeniy Goncharov
Maintainer of OpenBLD.net

Malvertising seems to be enjoying a renaissance as of late, whether it is from ads on search engine results pages or via popular websites. Because browsers are more secure today than they were 5 or 10 years ago, the attacks that we are seeing all involve some form of social engineering.

A threat actor is using malicious ads to redirect users to what looks like a Windows security update. The scheme is very well designed as it relies on the web browser to display a full screen animation that very much resembles what you'd expect from Microsoft...

Fake system update drops Aurora stealer via Invalid Printer loader

A Few days ago, Malwarebytes tread intelligence team discovered a new campaign that uses a fake Windows update to drop the Aurora stealer. The attack starts with a malvertising chain that redirects users to a website displaying a fake Windows update page. The page is designed to look like the real thing, with a full screen animation that very much resembles what you'd expect from Microsoft.

tip

After discovering and researching the IoC from the article, all compromised domains were added to OpenBLD.net DNSBL 🎉

Part of lists you can download from Cactusd 🌵 repository.