☰

Scam Site Blocker

Block potential windows and mac scam sites

目前为 2018-11-07 提交的版本。查看 最新版本。

  1. // ==UserScript==
  2. // @name         Scam Site Blocker
  3. // @namespace    blockWinScamSites
  4. // @version      2.3
  5. // @description  Block potential windows and mac scam sites
  6. // @author       Kai Krause <kaikrause95@gmail.com>
  7. // @include      *
  8. // @grant        GM_setValue
  9. // @grant        GM_getValue
  10. // @run-at       document-start
  11. // ==/UserScript==
  12.  
  13. // do not run on these excluded websites
  14. var exclusions = ["microsoft.com", "apple.com", "github.com", "greasyfork.org", "wikipedia.org", "reddit.com", "google.com", "live.com", "mozilla.org", "youtube.com", "facebook.com", "twitter.com", "mcafee.com", "mcafeesecure.com", "mcafeemobilesecurity.com"];
  15. var currentURL = location.hostname.split(".");
  16. currentURL = currentURL[currentURL.length-2] + "." + currentURL[currentURL.length-1]
  17. if (exclusions.indexOf(currentURL) > -1) return;
  18.  
  19. // Time since the page has started to load
  20. var timer = Date.now();
  21. // Helper function to understand elapsed time
  22. function elapsedTime(timer, num) {
  23. 	var currentTime = Date.now();
  24. 	var difference = (currentTime - timer) / 1000;
  25. 	if (difference > num) {
  26. 		return true;
  27. 	}
  28. 	else {
  29. 		return false;
  30. 	}
  31. }
  32.  
  33. // Whether to block the page
  34. var shouldBlockPage = false;
  35.  
  36. function main() {
  37. 	if (shouldBlockPage) return;
  38.  
  39. 	// Products and keywords that are normally used in headers
  40. 	var products = ["microsoft", "windows", "apple", "mac", "chrome", "firefox", "android", "ios", "internet explorer", "mcafee antivirus", "itunes"];
  41. 	var keywords = ["error", "security", "warning", "official", "support", "hotline", "virus", "infected", "infection", "blocked", "alert", "notification"];
  42.  
  43. 	// Get the page's title
  44. 	var title = document.title.toLowerCase();
  45. 	var titleWords = title.split(" ");
  46.  
  47. 	// Loop whether a product and keywords exist together
  48. 	// Only perform this check if the title length is under a certain number of words, to prevent news articles and other website false positives
  49. 	if (titleWords.length <= 5) {
  50. 		for (let i = 0; i < products.length; i++) {
  51. 			if (title.includes(products[i].toLowerCase())) {
  52. 				for (let x = 0; x < keywords.length; x++) {
  53. 					if (title.includes(keywords[x].toLowerCase())) {
  54. 						console.log("Blocked by title keyword: " + keywords[x]);
  55. 						shouldBlockPage = true;
  56. 					}
  57. 				}
  58. 			}
  59. 		}
  60. 	}
  61.  
  62. 	// If the page hasn't been blocked, use flags until a decision is made
  63. 	var redFlags = 0;
  64.  
  65. 	// If the page title is related to a product, flag it
  66. 	for (let i = 0; i < products.length; i++) {
  67. 		if (title.includes(products[i].toLowerCase())) {
  68. 			redFlags++;
  69. 		}
  70. 	}
  71.  
  72. 	// after a second, if the title hasn't updated, flag it
  73. 	if (elapsedTime(timer, 1)) {
  74. 		if (title.includes(location.hostname) || title === "") {
  75. 			redFlags++;
  76. 		}
  77. 	}
  78.  
  79. 	// flag IP addresses that do not resolve to domain names
  80. 	if (location.hostname.match(/\d+\.\d+\.\d+\.\d+/)) {
  81. 		redFlags++;
  82. 	}
  83.  
  84. 	// flag bad (free) website hosts
  85. 	var badHosts = ["000webhost", "googleapi", "cloudfront", "amazonaws"];
  86. 	for (let i = 0; i < badHosts.length; i++) {
  87. 		if (location.hostname.includes(badHosts[i].toLowerCase())) {
  88. 			redFlags++;
  89. 		}
  90. 	}
  91.  
  92. 	// flag bad domain TLDs
  93. 	// TODO: consider subdomain.websitename.tld (eg. for .us and .in.net particularly)
  94. 	var badTLDs = [".pw", ".site", ".club", ".gq", ".cf", ".us", ".xyz", ".bid", ".ga", ".ml", ".tk", ".in.net", ".win", ".info", ".icu", ".ru", ".live"];
  95. 	var domainTLDCount = (location.hostname.match(/\./g) || []).length;
  96. 	if (domainTLDCount === 1) {
  97. 		for (let i = 0; i < badTLDs.length; i++) {
  98. 			if (location.hostname.endsWith(badTLDs[i].toLowerCase())) {
  99. 				redFlags++;
  100. 			}
  101. 		}
  102. 	}
  103.  
  104. 	// Get all inline script tags, and check whether they contain obfuscated JS techniques, and flag them
  105. 	var scripts = document.getElementsByTagName(script);
  106. 	for (let i = 0; i < scripts.length; i++) {
  107. 		var script = scripts[i].innerText;
  108. 		if (script.includes("eval(")) redFlags++;
  109. 		if (script.includes("unescape(")) redFlags++;
  110. 		if (script.includes("fromCharCode(") || script.includes("charCodeAt(")) redFlags++;
  111. 		var numberOfEncodedSigns = (script.match(/%/g) || []).length;
  112. 		if (numberOfEncodedSigns >= 50) redFlags++;
  113. 		if (script.includes("document.documentElement.requestFullscreen") || script.includes("document.documentElement.mozRequestFullScreen")) redFlags++;
  114. 	}
  115.  
  116. 	// Block the page if there are too many red flags
  117. 	if (redFlags >= 3) {
  118. 		console.log("Blocked by red flags");
  119. 		shouldBlockPage = true;
  120. 	}
  121.  
  122. 	// TODO: Create multiple phrase arrays with differing weights, and possibly implement levenstein distance, and arrays of definite collocations
  123. 	// Scan the page for commonly used phrases
  124. 	var phrases = ["alert from microsoft", "windows computer is infected", "microsoft windows warning", "your computer was locked", "this computer is blocked", "your computer is blocked", "your computer has been blocked", "your computer has been infected", "your computer has alerted us", "call microsoft toll free", "windows has detected", "your system detected", "please call microsoft", "ransomware virus has infected your system", "trying to steal financial information", "information is being stolen", "removal process over the phone", "prevent your computer from being disabled", "pornographic spyware", "malicious virus", "malicious malware", "mac os is infected", "if you leave your mac os will remain damaged", "if you leave this site your mac os will remain damaged", "phishing/spyware were found on your mac", "banking information are at risk", "if you close this page, your computer access will be disabled", "your computer access will be disabled to prevent further damage", "call us within the next 5 minutes to prevent your computer from being disabled", "enter windows registration key to unblock", "do not close this window and restart your computer", "your computer's registration key is unblocked", "has been blocked under instructions of a competent us government authority", "under this url is an offence in law", "contact microsoft engineer", "do not ignore this important warning", "suspicious activity detected on your ip address", "due to harmful virus installed in your computer", "contact microsoft helpline to reactivate your computer", "this window is sending virus over the internet", "is hacked or used from undefined location", "your system detected some unusual activity", "it might harm your computer data and track your financial activities", "there is a system file missing due to some harmfull virus", "debug malware error, system failure", "the following data may be compromised", "do not ignore this critical alert", "your computer access will be disabled to prevent further damage to our network", "our engineers can guide you through the phone removal process", "microsoft security tollfree", "error # dt00X02", "error # dt00X2", "contact_microsoft_support", "system_protect - protect_error", "to secure your data and windows system click here", "windows operating system alert", "windows & internet browser updates are needed to patch new security flaws and / or fix bugs in the system", "rdn/yahlover.worm!", "apple security breach!", "your device is being targeted right now", "call apple support (toll-free)", "use this phone number to connect apple technical support", "ios security crash", "error #748b-12", "stop transferring your personal data and photos!", "you close this page, your computer access will be disabled", "for avoid further damage to our network", "our computer has alerted us that it was infected", "learn more about safe browsing get information about", "windows was blocked due to questionable activity", "please stop or restart your computer", "the pre-scan found possible traces of", "your system is at risk of irreversible damage", "scanning and cleaning is advised to prevent further system damage", "microsoft warning alert", "microsoft warning  alert", "mal1cious p0rn0graphic", "error #0x80072ee7", "your system data has been compromized", "hackers may track your financial activities and get access to your personal files on this system", "this virus is sending your confidential information", "error number #278D5", "we will be forced to disable your computer", "your computer is in critical state", "your iphone has been locked", "has been locked due to detected illegal activity", "immediately call apple support to unlock", "we couldn't activate windows", "ios security crash", "windows is asking for authentication", "call microsoft help desk", "technicians can guide you through the whole process over the phone", "contact our certified windows technicians", "your windows computer is at high risk", "windows security has detected", "the latest software, scan your system, and prevent your files from being deleted", "windows malware detected", "malware detected\/hard drive problem", "do not open internet browser for your security issue", "contact technicians at tollfree helpline", "someone is trying to steal your banking details", "drive safety delete in starting in", "call google chrome", "your information (for example, passwords, messages, and credit cards) have been stolen", "experienced technicians can help you activate", "technicians will access your computer 100% securely", "remotely activate your AV protection for you", "download your active subscription", "lot of antivirus software’s is available in the market", "keeps your computer protected in very a simple way", "in almost all the latest microsoft operating systems", "data in your computer are always on the verge of risk", "we analyze different errors and then we resolve them", "[OS_NAME] の問題を修復する方法"];
  125.  
  126. 	// Get page content
  127. 	var page = "";
  128. 	if (document.head) page += document.head.innerText.toLowerCase();
  129. 	if (document.body) page += document.body.innerText.toLowerCase();
  130.  
  131. 	// Detect phrases
  132. 	for (let i = 0; i < phrases.length; i++) {
  133. 		if (page.indexOf(phrases[i].toLowerCase()) > -1) {
  134. 			console.log("Blocked by page phrasing: " + phrases[i]);
  135. 			shouldBlockPage = true;
  136. 		}
  137. 	}
  138. }
  139.  
  140. // Block the page, by clearing its content and replacing it
  141. var finishedBlocking = false;
  142. function blockPage() {
  143. 	if (shouldBlockPage && !finishedBlocking) {
  144. 		// Stop page from loading further
  145. 		window.stop();
  146. 		// Clear the header
  147. 		document.getElementsByTagName('head')[0].innerHTML = "<title>" + document.title + "</title>";
  148. 		// Rewrite the body
  149. 		if (!document.body) {
  150. 			setTimeout(() => {
  151. 				document.body = document.createElement("body");
  152. 			}, 0);
  153. 		}
  154. 		document.body.innerHTML = "<center><h2>Suspicious Site Blocked by <a href='#' id='authorlink' style='color:#FFFFFF;'><u>Scam Site Blocker</u></a></h2><br /></center>";
  155. 		document.body.innerHTML += "<center>This website may be operated by scammers. Go back or close this page.<br /><br /></center>";
  156. 		document.body.innerHTML += "<center>If you think this is an error, confirm the website address before ignoring this warning.<br /><br /></center>";
  157. 		document.body.innerHTML += "<center><button id='ignorePage'>Ignore Warning</button></center>";
  158. 		document.body.style.fontSize = "18px";
  159. 		document.body.style.color = "#FFFFFF";
  160. 		document.body.style.backgroundColor = "#99000F";
  161. 		document.getElementById("ignorePage").style.padding = "6px";
  162. 		document.getElementById("authorlink").addEventListener("click", openAuthorPage);
  163. 		document.getElementById("ignorePage").addEventListener("click", ignorePage);
  164. 		// Rewrite problematic JS functions
  165. 		resetFullscreen();
  166. 		document.write = null;
  167. 		document.body.appendChild = null;
  168. 		window.onbeforeunload = null;
  169. 		window.eval = null;
  170. 		window.alert = null;
  171. 		if (window.jQuery) $ = null;
  172. 		// Finished
  173. 		finishedBlocking = true;
  174. 	}
  175. }
  176.  
  177. function resetFullscreen() {
  178. 	setTimeout(() => {
  179. 		// Override fullscreen functions
  180. 		var elem = document.documentElement;
  181. 		if (elem.requestFullscreen) {
  182. 			elem.requestFullscreen = null;
  183. 		} else if (elem.mozRequestFullScreen) { /* Firefox */
  184. 			elem.mozRequestFullScreen = null;
  185. 		} else if (elem.webkitRequestFullscreen) { /* Chrome, Safari and Opera */
  186. 			elem.webkitRequestFullscreen = null;
  187. 		} else if (elem.msRequestFullscreen) { /* IE/Edge */
  188. 			elem.msRequestFullscreen = null;
  189. 		}
  190. 		// Exit fullscreen
  191. 		if (document.exitFullscreen) {
  192. 			document.exitFullscreen();
  193. 		} else if (document.mozCancelFullScreen) { /* Firefox */
  194. 			document.mozCancelFullScreen();
  195. 		} else if (document.webkitExitFullscreen) { /* Chrome, Safari and Opera */
  196. 			document.webkitExitFullscreen();
  197. 		} else if (document.msExitFullscreen) { /* IE/Edge */
  198. 			document.msExitFullscreen();
  199. 		}
  200. 	}, 100);
  201. }
  202.  
  203. // open greasyfork page
  204. function openAuthorPage() {
  205. 	window.open("https://greasyfork.org/en/scripts/373815-scam-site-blocker", "_blank");
  206. }
  207.  
  208. // ignore pages by domain name, handled via GM storage
  209. function ignorePage() {
  210. 	if (GM_setValue) {
  211. 		GM_setValue(location.hostname, "ignored");
  212. 		location.reload();
  213. 	}
  214. }
  215.  
  216. // check if page is ignored
  217. var isPageIgnored = GM_getValue(location.hostname);
  218.  
  219. // run code blocks
  220. var runTime = Date.now();
  221. if (isPageIgnored !== "ignored") {
  222. 	var interval = setInterval(function() {
  223. 		main();
  224. 		blockPage();
  225. 		// Remove interval if page has been blocked, or, the script has run for longer than 3 seconds
  226. 		if(shouldBlockPage || (Date.now() - runTime) / 1000 >= 3) {
  227. 			return clearInterval(interval);
  228. 		}
  229. 	}, 4);
  230. }