From de10955db097f9007e28a9ab77a3e80184f72347 Mon Sep 17 00:00:00 2001 From: Yongmin Hong Date: Wed, 20 Mar 2024 22:31:53 +0900 Subject: [PATCH 1/8] add domains Signed-off-by: Yongmin Hong --- gafam.json | 91 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 88 insertions(+), 3 deletions(-) diff --git a/gafam.json b/gafam.json index 60691d0..fbfc362 100644 --- a/gafam.json +++ b/gafam.json @@ -19,15 +19,19 @@ "blogger.com", "blogspot.com", "cal.new", + "certificate.transparency.dev", "charlestonroadregistry.com", "chrome.com", "chromebook.com", + "chromeenterprise.google", "chromeexperiments.com", + "chromeos.dev", "chromium.org", "cobalt.dev", "cobrasearch.com", "crashlytics.com", "crisisresponse.google", + "deck.new", "deepmind.com", "design.google", "dialogflow.com", @@ -38,21 +42,30 @@ "domains.google", "doubleclick.com", "doubleclick.net", + "drawing.new", + "drawings.new", "environment.google", "fabric.io", "feedburner.com", + "firebase.io", "firebaseio.com", "fitbit.com", "flutter.dev", "form.new", - "forms.new", + "forms.gle", + "forms.new", "g.co", + "gcr.io", "get.app", "get.dev", "get.page", "getmdl.io", "ggpht.com", + "glide.new", "gmail.com", + "go.dev", + "godoc.org", + "golang.org", "goo.gl", "googl.com", "google", @@ -260,6 +273,7 @@ "googleblog.com", "googledrive.com", "googleearth.com", + "googlegroups.com", "googlehosted.com", "googlemail.com", "googlemaps.com", @@ -278,41 +292,64 @@ "gvt1.com", "gvt2.com", "gvt3.com", + "health.google", "iam.soy", + "jam.new", "kaggle.com", "keep.new", "keyhole.com", "madewithcode.com", + "meet.new", "meeting.new", + "model.new", "nest.com", "nic.google", + "note.new", + "notebook.new", + "notes.new", "panoramio.com", + "pki.goog", + "presentation.new", "pride.google", + "recaptcha.net", "registry.google", "run.app", "safety.google", + "script.new", + "securityreview.new", + "site.new", + "sites.new", "sheet.new", "sheets.new", "slide.new", "slides.new", + "spreadsheet.new", + "spreadsheets.new", "stackdriver.com", "sustainability.google", + "tables.new", "teachfromhome.google", "tenor.com", "thinkwithgoogle.com", + "tv.google", "v8.dev", "virustotal.com", "waymo.com", "waze.com", "web.dev", + "website.new", "wellbeing.google", "whats.new", "withgoogle.com", + "withyoutube.com", "xn--p8j9a0d9c9a.xn--q9jyb4c", "youtu.be", "youtube-nocookie.com", "youtube.com", "youtubeeducation.com", + "youtubegaming.com", + "youtubekids.com", + "yt.be", "ytimg.com" ] }, @@ -320,6 +357,9 @@ "id": "amazon", "domains": [ "a9.com", + "aboutamazon.com", + "acmvalidations.com", + "acmvalidationsaws.com", "aiv-cdn.net", "aiv-delivery.net", "alexa.com", @@ -336,6 +376,7 @@ "amazon.com.mx", "amazon.com.tr", "amazon.de", + "amazon.dev", "amazon.es", "amazon.eu", "amazon.fr", @@ -349,9 +390,14 @@ "amazonaws.cn", "amazonaws.com", "amazonaws.com.cn", + "amazonbusiness.com", "amazonmusic.com", + "amazonpay.com", "amazonservices.com", + "amazonses.com", + "amazontrust.com", "amazonvideo.com", + "amzn.to", "audible.ca", "audible.co.jp", "audible.co.uk", @@ -362,7 +408,9 @@ "audible.fr", "audible.in", "audible.it", + "awseducate.com", "awsstatic.com", + "awstrack.me", "blinkforhome.com", "boxofficemojo.com", "c9.io", @@ -372,6 +420,7 @@ "ext-twitch.tv", "imdb.com", "jtvnw.net", + "kindle.com", "media-amazon.com", "media-imdb.com", "pillpack.com", @@ -404,6 +453,7 @@ "freebasics.org", "giphy.com", "giphy.world", + "hhvm.com", "i.org", "igsonar.net", "instagram.com", @@ -415,9 +465,11 @@ "m.me", "messenger.com", "messengerkids.com", + "meta.com", "oculus.com", "oculusconnect.com", "oculusvr.com", + "oversightboard.com", "sparkar.com", "wa.me", "whatsapp.com", @@ -431,20 +483,26 @@ "id": "apple", "domains": [ "aaplimg.com", + "apple-cloudkit.com", "apple-dns.net", + "apple-mapkit.com", "apple.com", "apple.com.akadns.net", "apple.com.cn", "apple.com.edgekey.net", "apple.com.edgesuite.net", + "apple.map.fastly.net", "apple.news", "apple.pa", "applecard.apple", "applemusic.com", "beatsbydre.com", + "carekit.org", "cdn-apple.com", "cdn-apple.com.akadns.net", "darksky.net", + "edge.apple", + "edge-itunes-apple.com.akadns.net", "ess-apple.com.akadns.net", "gc-apple.com.akadns.net", "gcsis-apple.com.akadns.net", @@ -464,8 +522,10 @@ "nic.beats", "origin-apple.com.akadns.net", "push-apple.com.akadns.net", + "safebrowsing.apple", "shazam.com", - "swift.org" + "swift.org", + "webkit.org" ] }, { @@ -476,22 +536,33 @@ "343industries.com", "a-msedge.net", "appcenter.ms", + "aka.ms", "au-msedge.net", "azure.com", + "azurecontainer.io", "azureedge.net", "azurewebsites.net", "bing.com", "bing.net", "c-msedge.net", + "cloud.microsoft", "cloudapp.net", + "codespace.new", + "codespaces.new", "compulsiongames.com", "dc-msedge.net", + "docs.new", + "dotnet.new", "doublefine.com", + "env.new", + "excel.new", "gfx.ms", + "ghcr.io", "gist.new", "github.com", "github.dev", - "github.map.fastly.net", + "github.new", + "github.map.fastly.net", "githubapp.com", "githubassets.com", "githubusercontent.com", @@ -510,6 +581,7 @@ "microsoft.com.akadns.net", "microsoft.com.edgekey.net", "microsoft.com.nsatc.net", + "microsoft365.com", "microsoftonline.com", "minecraft.net", "mojang.com", @@ -518,8 +590,10 @@ "msauth.net", "msecnd.net", "msedge.net", + "msftauthimages.net", "msftncsi.com", "msn.com", + "nic.microsoft", "ninjatheory.com", "obsidian.net", "office.com", @@ -530,6 +604,9 @@ "outlook.com", "passport.net", "playground-games.com", + "powerpoint.new", + "ppt.new", + "pptx.new", "promoteiq.com", "rare.co.uk", "repo.new", @@ -537,16 +614,24 @@ "sfx.ms", "skype.com", "skypeassets.com", + "status.microsoft", + "streamlit.new", + "sway.new", + "t-msedge.net", + "teams.new", "thecoalitionstudio.com", "trafficmanager.net", "undeadlabs.com", "virtualearth.net", + "vso.new", + "vsonline.new", "windows.com", "windows.com.akadns.net", "windows.net", "windowsazure.com", "windowsupdate.com", "windowupdate.org", + "word.new", "xbox.com", "xboxlive.com", "xoxco.com" From c6a5a770a22e7b63e8f432b3018529c40af545fd Mon Sep 17 00:00:00 2001 From: Yongmin Hong Date: Fri, 22 Mar 2024 20:39:04 +0900 Subject: [PATCH 2/8] add acm-validations.aws Signed-off-by: Yongmin Hong --- gafam.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gafam.json b/gafam.json index fbfc362..0681dd3 100644 --- a/gafam.json +++ b/gafam.json @@ -358,8 +358,9 @@ "domains": [ "a9.com", "aboutamazon.com", + "acm-validations.aws", "acmvalidations.com", - "acmvalidationsaws.com", + "acmvalidationsaws.com", "aiv-cdn.net", "aiv-delivery.net", "alexa.com", From ac8dcb2a65082205c1693bd2d89587a3c1e23aa5 Mon Sep 17 00:00:00 2001 From: Yongmin Hong Date: Fri, 22 Mar 2024 21:03:16 +0900 Subject: [PATCH 3/8] add a2z.com/awsglobalaccelerator.com whois: ns server points to same entry as amazon.com, loaded when opening Prime Video app / seems to be called by Echo devices / docs.aws.amazon.com loads prod.www.docs.aws.a2z.com. awsglobalaccelerator.com loaded when logging in to aws console. Signed-off-by: Yongmin Hong --- gafam.json | 1 + 1 file changed, 1 insertion(+) diff --git a/gafam.json b/gafam.json index 0681dd3..ba8a6bb 100644 --- a/gafam.json +++ b/gafam.json @@ -356,6 +356,7 @@ { "id": "amazon", "domains": [ + "a2z.com", "a9.com", "aboutamazon.com", "acm-validations.aws", From 9d4ec202284d592493f44f72fc423e7a7d046c05 Mon Sep 17 00:00:00 2001 From: Yongmin Hong Date: Tue, 16 Apr 2024 20:25:02 +0900 Subject: [PATCH 4/8] some more domains sources: - https://www.microsoft.com/en-us/msrc/bounty-online-services?rtc=1 - https://bounty.github.com/ - https://bughunters.google.com/about/rules/6625378258649088/google-and-a lphabet-vulnerability-reward-program-vrp-rules - https://security.apple.com/bounty/categories/ - https://hackerone.com/amazonvrp?type=team Signed-off-by: Yongmin Hong --- gafam.json | 34 ++++++++++++++++++++++++++++++++-- 1 file changed, 32 insertions(+), 2 deletions(-) diff --git a/gafam.json b/gafam.json index ba8a6bb..ca2fc01 100644 --- a/gafam.json +++ b/gafam.json @@ -286,6 +286,7 @@ "googleusercontent.com", "googlevideo.com", "googlezip.net", + "granularinsurance.com", "grow.google", "gstatic.com", "gstatic.net", @@ -307,16 +308,19 @@ "note.new", "notebook.new", "notes.new", + "onduo.com", "panoramio.com", "pki.goog", "presentation.new", "pride.google", + "projectbaseline.com", "recaptcha.net", "registry.google", "run.app", "safety.google", "script.new", "securityreview.new", + "signalpath.com", "site.new", "sites.new", "sheet.new", @@ -333,6 +337,7 @@ "thinkwithgoogle.com", "tv.google", "v8.dev", + "verily.com", "virustotal.com", "waymo.com", "waze.com", @@ -369,23 +374,31 @@ "amazon.ae", "amazon.ca", "amazon.care", + "amazon.cl", "amazon.cn", "amazon.co.jp", "amazon.co.uk", + "amazon.co.za", "amazon.com", "amazon.com.au", + "amazon.com.be", "amazon.com.br", + "amazon.com.co", "amazon.com.mx", + "amazon.com.ng", "amazon.com.tr", "amazon.de", "amazon.dev", + "amazon.eg", "amazon.es", "amazon.eu", "amazon.fr", "amazon.in", "amazon.it", "amazon.nl", + "amazon.pl", "amazon.sa", + "amazon.se", "amazon.sg", "amazon.work", "amazonalexa.com", @@ -411,6 +424,7 @@ "audible.in", "audible.it", "awseducate.com", + "awsglobalaccelerator.com", "awsstatic.com", "awstrack.me", "blinkforhome.com", @@ -440,6 +454,7 @@ { "id": "facebook", "domains": [ + "accountkit.com", "cdninstagram.com", "expresswifi.com", "facebook.com", @@ -450,6 +465,7 @@ "fb.gg", "fb.me", "fbcdn.net", + "fbrell.com", "fbsbx.com", "fbwat.ch", "freebasics.org", @@ -465,6 +481,7 @@ "lassovideos.com", "libra.org", "m.me", + "mapillary.com", "messenger.com", "messengerkids.com", "meta.com", @@ -473,6 +490,7 @@ "oculusvr.com", "oversightboard.com", "sparkar.com", + "thefacebook.com", "wa.me", "whatsapp.com", "whatsapp.me", @@ -497,6 +515,7 @@ "apple.news", "apple.pa", "applecard.apple", + "appledownload.map.fastly.net", "applemusic.com", "beatsbydre.com", "carekit.org", @@ -511,6 +530,7 @@ "icloud-content.com", "icloud.com", "icloud.com.akadns.net", + "itunes.com", "itunes-apple.com.akadns.net", "itunes-nocookie.com", "itunes.com.edgekey.net", @@ -537,8 +557,9 @@ "1drv.ms", "343industries.com", "a-msedge.net", - "appcenter.ms", "aka.ms", + "appcenter.ms", + "assets-yammer.com", "au-msedge.net", "azure.com", "azurecontainer.io", @@ -568,15 +589,19 @@ "githubapp.com", "githubassets.com", "githubusercontent.com", + "githubwebhooks.net", "glintinc.com", "hotmail.com", + "inxile.net", "inxile-entertainment.com", "licdn.com", "linkedin.com", "live.com", "live.net", + "livefilestore.com", "liveperson.com", "liveperson.net", + "lync.com", "lynda.com", "microsoft.akadns.net", "microsoft.com", @@ -597,6 +622,8 @@ "msn.com", "nic.microsoft", "ninjatheory.com", + "npmjs.com", + "npmjs.org", "obsidian.net", "office.com", "office.net", @@ -618,7 +645,9 @@ "skypeassets.com", "status.microsoft", "streamlit.new", + "svc.ms", "sway.new", + "sway.com", "t-msedge.net", "teams.new", "thecoalitionstudio.com", @@ -636,7 +665,8 @@ "word.new", "xbox.com", "xboxlive.com", - "xoxco.com" + "xoxco.com", + "yammer.com" ] } ] From 7cfcf8c452211872a13e5ad97cff011df52d8683 Mon Sep 17 00:00:00 2001 From: Yongmin Hong Date: Mon, 22 Apr 2024 23:55:17 +0900 Subject: [PATCH 5/8] new domains Some from my own logs, and some additional belows - https://www.mandiant.com/company/press-releases/google-completes-mandia nt-acquisition Signed-off-by: Yongmin Hong --- gafam.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/gafam.json b/gafam.json index ca2fc01..d5ee97e 100644 --- a/gafam.json +++ b/gafam.json @@ -31,6 +31,7 @@ "cobrasearch.com", "crashlytics.com", "crisisresponse.google", + "dart.dev", "deck.new", "deepmind.com", "design.google", @@ -300,6 +301,7 @@ "keep.new", "keyhole.com", "madewithcode.com", + "mandiant.com", "meet.new", "meeting.new", "model.new", @@ -311,6 +313,7 @@ "onduo.com", "panoramio.com", "pki.goog", + "pkg.dev", "presentation.new", "pride.google", "projectbaseline.com", @@ -364,6 +367,7 @@ "a2z.com", "a9.com", "aboutamazon.com", + "aboutamazon.eu", "acm-validations.aws", "acmvalidations.com", "acmvalidationsaws.com", @@ -371,6 +375,7 @@ "aiv-delivery.net", "alexa.com", "amazon-adsystem.com", + "amazon-corp.com", "amazon.ae", "amazon.ca", "amazon.care", @@ -406,6 +411,7 @@ "amazonaws.com", "amazonaws.com.cn", "amazonbusiness.com", + "amazoncognito.com", "amazonmusic.com", "amazonpay.com", "amazonservices.com", @@ -423,6 +429,7 @@ "audible.fr", "audible.in", "audible.it", + "aws.dev", "awseducate.com", "awsglobalaccelerator.com", "awsstatic.com", @@ -434,6 +441,7 @@ "cloudfront.net", "elasticbeanstalk.com", "ext-twitch.tv", + "fireoscaptiveportal.com", "imdb.com", "jtvnw.net", "kindle.com", @@ -664,7 +672,9 @@ "windowupdate.org", "word.new", "xbox.com", + "xboxab.com", "xboxlive.com", + "xboxlive.com.akadns.net", "xoxco.com", "yammer.com" ] From d1d2e48546e0dc49ff0e0896339ced6cc8a0fb41 Mon Sep 17 00:00:00 2001 From: Yongmin Hong Date: Wed, 24 Apr 2024 19:25:34 +0900 Subject: [PATCH 6/8] add few more domains Some from AWS docs Signed-off-by: Yongmin Hong --- gafam.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/gafam.json b/gafam.json index d5ee97e..607e55f 100644 --- a/gafam.json +++ b/gafam.json @@ -414,11 +414,13 @@ "amazoncognito.com", "amazonmusic.com", "amazonpay.com", + "amazonregistry.com", "amazonservices.com", "amazonses.com", "amazontrust.com", "amazonvideo.com", "amzn.to", + "api.aws", "audible.ca", "audible.co.jp", "audible.co.uk", @@ -449,6 +451,7 @@ "media-imdb.com", "pillpack.com", "primevideo.com", + "repost.aws", "ring.com", "ssl-images-amazon.com", "ttvnw.net", @@ -592,6 +595,7 @@ "gist.new", "github.com", "github.dev", + "github.io", "github.new", "github.map.fastly.net", "githubapp.com", From 09e02bc9d710cad6337fa17537c5091f91a8f4f7 Mon Sep 17 00:00:00 2001 From: Yongmin Hong Date: Fri, 26 Apr 2024 15:47:01 +0900 Subject: [PATCH 7/8] add more domains - https://docs.aws.amazon.com/general/latest/gr/workmail.html - https://opensource.google (list of projects) - sell.amazon.co.kr (one without subdomain redirects to .com, ns record is typical amazon prod records) Signed-off-by: Yongmin Hong --- gafam.json | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/gafam.json b/gafam.json index 607e55f..d0f2cd9 100644 --- a/gafam.json +++ b/gafam.json @@ -12,9 +12,11 @@ "ai.google", "ampproject.org", "android.com", + "angular.io", "app-measurement.com", "appspot.com", "autodraw.com", + "bazel.build", "blog.google", "blogger.com", "blogspot.com", @@ -54,13 +56,17 @@ "flutter.dev", "form.new", "forms.gle", - "forms.new", + "forms.new", + "fuchsia.dev", "g.co", "gcr.io", + "gerritcodereview.com", "get.app", "get.dev", "get.page", + "getintra.org", "getmdl.io", + "getoutline.org", "ggpht.com", "glide.new", "gmail.com", @@ -300,6 +306,7 @@ "kaggle.com", "keep.new", "keyhole.com", + "knative.dev", "madewithcode.com", "mandiant.com", "meet.new", @@ -312,10 +319,12 @@ "notes.new", "onduo.com", "panoramio.com", + "perspectiveapi.com", "pki.goog", "pkg.dev", "presentation.new", "pride.google", + "projectassembler.org", "projectbaseline.com", "recaptcha.net", "registry.google", @@ -326,6 +335,7 @@ "signalpath.com", "site.new", "sites.new", + "skia.org", "sheet.new", "sheets.new", "slide.new", @@ -337,6 +347,7 @@ "tables.new", "teachfromhome.google", "tenor.com", + "tensorflow.org", "thinkwithgoogle.com", "tv.google", "v8.dev", @@ -382,6 +393,7 @@ "amazon.cl", "amazon.cn", "amazon.co.jp", + "amazon.co.kr", "amazon.co.uk", "amazon.co.za", "amazon.com", @@ -400,6 +412,7 @@ "amazon.fr", "amazon.in", "amazon.it", + "amazon.jobs", "amazon.nl", "amazon.pl", "amazon.sa", @@ -412,6 +425,7 @@ "amazonaws.com.cn", "amazonbusiness.com", "amazoncognito.com", + "amazondelivers.jobs", "amazonmusic.com", "amazonpay.com", "amazonregistry.com", @@ -432,6 +446,7 @@ "audible.in", "audible.it", "aws.dev", + "awsapps.com", "awseducate.com", "awsglobalaccelerator.com", "awsstatic.com", @@ -445,6 +460,7 @@ "ext-twitch.tv", "fireoscaptiveportal.com", "imdb.com", + "jobsatamazon.co.uk", "jtvnw.net", "kindle.com", "media-amazon.com", @@ -468,6 +484,7 @@ "accountkit.com", "cdninstagram.com", "expresswifi.com", + "docusaurus.io", "facebook.com", "facebook.net", "facebookblueprint.com", From ad06a01fc393805283e946071e297059f3165e27 Mon Sep 17 00:00:00 2001 From: Yongmin Hong Date: Sat, 27 Apr 2024 15:41:52 +0900 Subject: [PATCH 8/8] add FB open source projects hosted by FB MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From https://opensource.fb.com/projects#filter PyTorch: "As the current maintainers of this site, Facebook’s Cookies Policy applies." Signed-off-by: Yongmin Hong --- gafam.json | 50 +++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/gafam.json b/gafam.json index d0f2cd9..00f6660 100644 --- a/gafam.json +++ b/gafam.json @@ -482,49 +482,97 @@ "id": "facebook", "domains": [ "accountkit.com", + "aihabitat.org", + "ax.dev", + "botorch.org", + "buck2.build", + "cachelib.org", + "captum.ai", "cdninstagram.com", + "classyvision.ai", + "cgsql.dev", + "compilergym.com", + "componentkit.org", "expresswifi.com", "docusaurus.io", + "dotslash-cli.com", "facebook.com", "facebook.net", "facebookblueprint.com", "facebookbrand.com", + "faiss.ai", "fb.com", "fb.gg", "fb.me", "fbcdn.net", + "fbflipper.com", + "fbidb.io", + "fbinfer.com", + "fblitho.com", + "fbredex.com", "fbrell.com", "fbsbx.com", "fbwat.ch", + "flow.org", + "flowtorch.ai", "freebasics.org", + "frescolib.org", "giphy.com", "giphy.world", + "glean.software", "hhvm.com", + "hydra.cc", "i.org", "igsonar.net", + "import-balance.org", + "infima.dev", "instagram.com", "instagram.net", "internet.org", "las.so", "lassovideos.com", + "lexical.dev", "libra.org", + "libspectrum.io", "m.me", + "mariana-tren.ch", "mapillary.com", + "mephisto.ai", "messenger.com", "messengerkids.com", "meta.com", + "metrobundler.dev", + "mmf.sh", + "myrocks.io", "oculus.com", "oculusconnect.com", "oculusvr.com", + "opacus.ai", + "opensfm.org", "oversightboard.com", + "pplbench.org", + "pybowler.io", + "pyre-check.org", + "pyrobot.org", + "pytorch.org", + "pytorchvideo.org", + "react.dev", + "reactnative.dev", + "relay.dev", + "rocksdb.org", + "sapling-scm.com", "sparkar.com", + "stylexjs.com", "thefacebook.com", + "velox-lib.io", "wa.me", "whatsapp.com", "whatsapp.me", "whatsapp.net", + "wit.ai", "wk.pl", - "workplace.com" + "workplace.com", + "yogalayout.dev" ] }, {