Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Mahesh Sudula]

Why, is Emsi web filtering not enough?

Emsisoft doesnt do well against zero hour phishing hosts..since it relies on black list thats not dynamically updated.
Reasons : As their cloud and user crowd is not that much, so may be the data gathered is not large scale.
Phishing champs like Webroot, Kaspersky, Trend micro, Bit defender have gigantic user database along side huge cloud data sharing from million end points, more over they reliy on multiple tactics in identifying a phishing host than a mere black list.
No wrong on Emsisoft end in my opinion

 

[Moonhorse]

https://crypto4theo.com/

Is this site suspicious?
Found it reading comodo forums
Report for https://crypto4theo.com/ | Web Inspector states it is
VirusTotal Virustotal doesnt

 

[Evjl's Rain]

https://crypto4theo.com/

Is this site suspicious?
Found it reading comodo forums
Report for https://crypto4theo.com/ | Web Inspector states it is
VirusTotal Virustotal doesnt

it's a mining engine. + its main page has coinhive mining script

This page includes a JavaScript/iframe from coinhive.com that is blacklisted by McAfee, see McAfee SiteAdvisor Software – Website Safety Ratings and Secure Search

<script src="https://coinhive.com/lib/coinhive.min.js"

 

[Evjl's Rain]

Why, is Emsi web filtering not enough?

don't know but it's nowhere near the best
according to what I saw, it's like a domain filter, just like your hosts file
if I'm not mistaken, it doesn't have heuristic engine for webfilter

 

[harlan4096]

KTS2020RC:

 

[Evjl's Rain]

Test 24/11/2018
38 links: multiple sources including vxvault (older)

Spoiler: links

https://pastebin.com/g5zD2kQf

chrome 37/38
avira 19/38
comodo 2/38
malwarebytes 25/38
norton 6/38
bitdefender 32/38
WDBP 31/38 - downloaded 12
squidblacklist 10/38

K9 34/38
forticlient 38/38
kaspersky 38/38
Windscribe (ROBERT) 1/38

 

[Decopi]

@Evjl's Rain , thank you for including K9.

Considering that K9 works at system level, and it is not a heavy software (like Kaspersky, FortClient etc)... IMO K9 is the best in its category.

I can't see any add-on/extension contending against K9, not just because K9 works at system level, but also in terms of RAM, CPU, performance in general.

Same logic with antivirus, useless against zero-day virus/malware, and killer system resources.

... K9 + CF CS settings... when less is more...

 

[ForgottenSeer 58943]

Kaspersky and Forticlient will almost always be on top. Both of them have some really nice labs and people working in those labs to keep those lists up to date. Both also pull from a variety of internal sources. Forticlient draws from it's FG IPS and FortiSandbox returns that are in millions of organizations around the world.

 

[Gandalf_The_Grey]

Test 24/11/2018
38 links: multiple sources including vxvault (older)

Spoiler: links

2d73.ru/En_us/Clients_transactions/11_18/
2ndoffice.ph/wp-content/themes/sketch/clip.exe
31.3.230.11/new/jey/jey.exe
51.254.84.55/fear.png.exe
abeautifulyouskincare.com/0325692BYAAN/identity/US/
bemnyc.com/dRqCZbI
canetafixa.com.br/98780ERLMN/BIZ/Business
coloradosyntheticlubricants.com/rJ1.exe
districoperav.icu/neifo/sysm.exe
down.wiremesh-ap.com/xiguaviewer_1122.exe
ecoconstrucciones.com.ar/wp-content/upgrade/doc/En/ACCOUNT/New-Invoice-TI39227-NK-9983
florean.be/wp-content/themes/remy/vcc.exe
ghancommercialbank.com/msn/newclient.exe
gucciai.net/Amadey.exe
ifcjohannesburg.org/JN/jfile.exe
localbusinesspromotion.co.uk/u
luvverly.com/images/default/En/ACCOUNT/Invoice-2907141048-07-16-2018
luyenthitoefl.net/wp-content/uploads/9MS/PAYMENT/Commercial
mindspeak.co/urBsC2H3s
monteglobal.co/monte/monte.exe
montrosecounselingcenter.org/lHw/
nowley-rus.ru/administrator/cache/En_us/Black-Friday
partner.targoapp.ru/En_us/Clients_information/11_18/
perfectionautomotivebexley.flywheelsites.com/US/BlackFriday2018/
potens.ru/1EOUQTEL/ACH/Business/  
psce.org.pk/4GLAVVG/SWIFT/Business/
raidking.com/99931JSF/oamo/US/
romodin.com/9dyHIxA
suryalife.in/0U/biz/Business/
travelcentreny.com/US/BlackFriday2018
trombleoff.com/bin/rig.exe
uninstall-tools.ru/officialclient.exe
vegasports.in/46OPJOBX/SEP/US/
volathailand.com/RvC2xxVB
www.aquastor.ru/7941G/WIRE/US  
www.c2cycle.com/UACS.exe
www.itwss.com/multimedia/Already.exe
www.standart-uk.ru/En_us/Clients_Messages/2018-11/

chrome 37/38
avira 19/38
comodo 2/38
malwarebytes 25/38
norton 6/38
bitdefender 32/38
WDBP 31/38 - downloaded 12
squidblacklist 10/38

K9 34/38
forticlient 38/38
kaspersky 38/38
Windscribe (ROBERT) 1/38

Thanks for testing
You didn't test Microsoft Edge this time?

 

[Evjl's Rain]

Thanks for testing
You didn't test Microsoft Edge this time?

because I'm not interested in Edge browser. Its protection can be covered through windows smartscreen anyway

 

[omidomi]

Updated (after submitted links)
Dr.Web: 34/38
These links Not Detected by Dr.Web:

Spoiler: Not Detected

https://pastebin.com/YBdT9KZ1

 

[amico81]

netcraft will score absolute 0

So netcraft isn't worth to add? that was my Browser Combo with Bitdefender Trafficlight 3.0

 

[Moonhorse]

So netcraft isn't worth to add? that was my Browser Combo with Bitdefender Trafficlight 3.0

Those links are containing malware, and netcraft = phishing protection

Bitdefender is great against both ; phishing & malware, but i would always keep netcraft there

 

[LDogg]

Was such a wise choice to stick with Forticlient, that end result of the test is fantastic!

~LDogg

 

[HarborFront]

So netcraft isn't worth to add? that was my Browser Combo with Bitdefender Trafficlight 3.0

Netcraft is phishing + XSS protection

 

[Brie]

Test 24/11/2018
38 links: multiple sources including vxvault (older)

Spoiler: links

2d73.ru/En_us/Clients_transactions/11_18/
2ndoffice.ph/wp-content/themes/sketch/clip.exe
31.3.230.11/new/jey/jey.exe
51.254.84.55/fear.png.exe
abeautifulyouskincare.com/0325692BYAAN/identity/US/
bemnyc.com/dRqCZbI
canetafixa.com.br/98780ERLMN/BIZ/Business
coloradosyntheticlubricants.com/rJ1.exe
districoperav.icu/neifo/sysm.exe
down.wiremesh-ap.com/xiguaviewer_1122.exe
ecoconstrucciones.com.ar/wp-content/upgrade/doc/En/ACCOUNT/New-Invoice-TI39227-NK-9983
florean.be/wp-content/themes/remy/vcc.exe
ghancommercialbank.com/msn/newclient.exe
gucciai.net/Amadey.exe
ifcjohannesburg.org/JN/jfile.exe
localbusinesspromotion.co.uk/u
luvverly.com/images/default/En/ACCOUNT/Invoice-2907141048-07-16-2018
luyenthitoefl.net/wp-content/uploads/9MS/PAYMENT/Commercial
mindspeak.co/urBsC2H3s
monteglobal.co/monte/monte.exe
montrosecounselingcenter.org/lHw/
nowley-rus.ru/administrator/cache/En_us/Black-Friday
partner.targoapp.ru/En_us/Clients_information/11_18/
perfectionautomotivebexley.flywheelsites.com/US/BlackFriday2018/
potens.ru/1EOUQTEL/ACH/Business/  
psce.org.pk/4GLAVVG/SWIFT/Business/
raidking.com/99931JSF/oamo/US/
romodin.com/9dyHIxA
suryalife.in/0U/biz/Business/
travelcentreny.com/US/BlackFriday2018
trombleoff.com/bin/rig.exe
uninstall-tools.ru/officialclient.exe
vegasports.in/46OPJOBX/SEP/US/
volathailand.com/RvC2xxVB
www.aquastor.ru/7941G/WIRE/US  
www.c2cycle.com/UACS.exe
www.itwss.com/multimedia/Already.exe
www.standart-uk.ru/En_us/Clients_Messages/2018-11/

chrome 37/38
avira 19/38
comodo 2/38
malwarebytes 25/38
norton 6/38
bitdefender 32/38
WDBP 31/38 - downloaded 12
squidblacklist 10/38

K9 34/38
forticlient 38/38
kaspersky 38/38
Windscribe (ROBERT) 1/38

thank you for this. i appreciate it.

 

[FrFc1908]

Any change that you can test the trendmicro toolbar / webfilter? Would love to der how this fares against malicious links!

 

[Evjl's Rain]

Any change that you can test the trendmicro toolbar / webfilter? Would love to der how this fares against malicious links!

could you please share the download link or crx file of that extension for chrome? I'm not able to find any way to install it without installing trend micro suit

 

[Moonhorse]

Apparently comodo online security is named ONLINE SECURITY PRO from now

 

[JiSingh12]

Hi @Evjl's Rain, and everybody else,

quick question, if a adblock filter shows "0 used out of 195,646" which is what my Energized Blu Protection is saying, or "21 used out of 107,788" which is what my adguard base filter/AdGuard English Filter is saying, does that mean all hosts/links within that filter have been covered by something else?

Thanks