The lists HARD uses to spot scam websites.
HARD keeps two lists: websites known to steal passwords or money, and browser add-ons known to spy on you. If you open one of those sites, or have one of those add-ons, HARD warns you.
On this page
What’s on them
- Scam websites
- Loading…
- Dangerous add-ons
- Loading…
- Software releases
- Loading…
- Updated
- Loading…
The checking happens on your own computer. HARD never sees which sites you visit.
Where they come from
We don’t make these up. They come from groups that track scams full-time, and we combine them:
- Phishing.Database
- Scam websites, reported by the public.
- CERT Polska
- Poland’s government cyber team.
- The Block List Project
- A volunteer-run list of scam websites.
- chrome-mal-ids
- Dangerous add-ons, from The Privacy Commons Institute (shared under CC BY 4.0).
- Wladimir Palant
- Dangerous add-ons found by the security researcher.
Real sites are never blocked
Public lists sometimes include real websites by mistake. One of them had gravatar.com and pastebin.com on it. So we always take out:
- the websites of companies scammers pretend to be, like Google, PayPal and the banks;
- the 100,000 most popular websites.
If a scam page sits on a big service anyone can use, like Amazon’s file storage, we warn about that one page, not the whole service.
Spotted a real site on the list, or a scam that isn’t? Tell us.
For developers
The lists are at hard.fyi/lists/v1/. The manifest gives each file’s SHA-256 and every source’s licence, and it’s signed (ECDSA P-256) so nobody can change the lists on the way to you. To check the signature:
curl -sO https://hard.fyi/lists/v1/manifest.json -sO https://hard.fyi/lists/v1/manifest.sig -sO https://hard.fyi/lists/v1/key.pem
node -e "const c=require('crypto'),f=require('fs');console.log(c.verify('sha256',f.readFileSync('manifest.json'),{key:f.readFileSync('key.pem'),dsaEncoding:'ieee-p1363'},Buffer.from(f.readFileSync('manifest.sig','utf8'),'base64')))"It prints true. The extension does the same check before it uses a list.
versions.json lists every security release HARD tracks, product by product: how a device tells which version it has, the newest version on each line, and for each release how many flaws it fixes and which were already used in attacks. It’s what the HARD apps check what’s installed against, and the same facts as Updates.