MALWARE BLOCKER: Smart passive interception, targeted DOM blockading, heuristic analysis, mutation patrol, and session bypass support.
// ==UserScript==
// @name CogTech Malware Blocker (CogShield)
// @namespace https://tampermonkey.net
// @version 10.3
// @description MALWARE BLOCKER: Smart passive interception, targeted DOM blockading, heuristic analysis, mutation patrol, and session bypass support.
// @author Phil 🥹👍 and CogTech
// @license MIT
// @match *://*/*
// @grant unsafeWindow
// @grant GM_addStyle
// @grant GM_xmlhttpRequest
// @grant GM_setValue
// @grant GM_getValue
// @run-at document-start
// ==/UserScript==
(function () {
'use strict';
var currentHost = window.location.hostname.toLowerCase();
// Honor session bypass if user explicitly chose to proceed on a flagged domain
if (sessionStorage.getItem('cogshield_bypass_' + currentHost) === 'true') {
return;
}
// ═══════════════════════════════════════════════════════════════════
// PHASE 0: CORE WHITELIST & GLOBAL HEURISTICS
// ═══════════════════════════════════════════════════════════════════
var TRUSTED_DOMAINS = new Set([
'scratch.mit.edu', 'turbowarp.org',
'google.com', 'google.com.au', 'google.co.uk', 'google.ca',
'googleapis.com', 'googleusercontent.com', 'gstatic.com', 'googletagmanager.com',
'doubleclick.net', 'google-analytics.com', 'fonts.googleapis.com', 'ajax.googleapis.com',
'accounts.google.com', 'classroom.google.com',
'bing.com', 'duckduckgo.com', 'yahoo.com', 'baidu.com',
'facebook.com', 'fbcdn.net', 'twitter.com', 'x.com', 't.co',
'instagram.com', 'cdninstagram.com', 'linkedin.com', 'licdn.com',
'reddit.com', 'redd.it', 'redditmedia.com', 'redditstatic.com',
'tiktok.com', 'tiktokcdn.com', 'snapchat.com', 'discord.com',
'discordapp.com', 'discordapp.net', 'twitch.tv', 'jtvnw.net',
'youtube.com', 'youtu.be', 'ytimg.com', 'googlevideo.com', 'vimeo.com', 'vimeocdn.com',
'microsoft.com', 'office.com', 'microsoftonline.com', 'live.com', 'outlook.com',
'azure.com', 'azureedge.net', 'msn.com', 'windows.com', 'xbox.com',
'apple.com', 'icloud.com', 'mzstatic.com', 'aaplimg.com',
'amazon.com', 'amazon.com.au', 'amazon.co.uk', 'amazonaws.com', 'aws.amazon.com', 'cloudfront.net',
'cloudflare.com', 'cdnjs.cloudflare.com', 'jsdelivr.net', 'unpkg.com',
'bootstrapcdn.com', 'jquery.com', 'code.jquery.com', 'fastly.net', 'akamaized.net', 'akamai.com',
'github.com', 'githubusercontent.com', 'githubassets.com', 'gitlab.com',
'stackoverflow.com', 'stackexchange.com', 'npmjs.com', 'nodejs.org', 'python.org', 'mozilla.org',
'stripe.com', 'js.stripe.com', 'q.stripe.com', 'stripe.network',
'paypal.com', 'paypalobjects.com', 'braintreepayments.com', 'squareup.com', 'adyen.com',
'wikipedia.org', 'wikimedia.org', 'bbc.com', 'bbc.co.uk', 'cnn.com', 'nytimes.com', 'theguardian.com', 'reuters.com',
'auth0.com', 'okta.com', 'onelogin.com',
'sentry.io', 'segment.com', 'mixpanel.com', 'hotjar.com',
'shopify.com', 'shopifycdn.com', 'ebay.com', 'etsy.com',
]);
var BLOCKED_DOMAINS = new Set();
var BLOCK_REASONS = {};
function isTrustedDomain(hostname) {
if (!hostname) return false;
var parts = hostname.toLowerCase().split('.');
for (var i = 0; i < parts.length - 1; i++) {
if (TRUSTED_DOMAINS.has(parts.slice(i).join('.'))) return true;
}
return false;
}
function checkHeuristics(hostname) {
if (!hostname) return false;
if (hostname.includes('xn--')) return 'Heuristics (Punycode Phishing)';
var ipRegex = /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/;
if (ipRegex.test(hostname)) {
if (!hostname.startsWith('127.') && !hostname.startsWith('192.168.') && !hostname.startsWith('10.')) {
return 'Heuristics (Suspicious Direct IP)';
}
}
return false;
}
function isDomainBlocked(hostname) {
if (!hostname || isTrustedDomain(hostname)) return false;
var heuristicFlag = checkHeuristics(hostname);
if (heuristicFlag) {
BLOCK_REASONS[hostname] = heuristicFlag;
return true;
}
var parts = hostname.toLowerCase().split('.');
for (var i = 0; i < parts.length - 1; i++) {
if (BLOCKED_DOMAINS.has(parts.slice(i).join('.'))) return true;
}
return false;
}
function extractHostname(url) {
try {
if (!url || url.startsWith('about:') || url.startsWith('data:') || url.startsWith('blob:')) return '';
return new URL(url, window.location.href).hostname.toLowerCase();
} catch (e) { return ''; }
}
function isSuspiciousUrl(url) {
if (!url || url === '' || url === '#') return false;
try {
var u = new URL(url, window.location.href);
if (u.protocol === 'javascript:' || u.protocol === 'data:') return true;
return isDomainBlocked(u.hostname);
} catch (e) {
return /^(javascript|data):/i.test(url);
}
}
var win = (typeof unsafeWindow !== 'undefined') ? unsafeWindow : window;
if (isDomainBlocked(currentHost)) {
showBlockPage(currentHost, BLOCK_REASONS[currentHost] || 'Network Heuristics');
}
// ═══════════════════════════════════════════════════════════════════
// PHASE 1: GLOBAL PASSIVE NETWORK INTERCEPTION
// ═══════════════════════════════════════════════════════════════════
(function interceptNetwork() {
var _origFetch = win.fetch;
try {
win.fetch = function () {
var input = arguments[0];
var url = (typeof input === 'object' && input instanceof Request) ? input.url : String(input);
if (isDomainBlocked(extractHostname(url))) {
console.warn('[CogShield] Blocked fetch request to:', url);
return Promise.reject(new Error('Blocked by CogShield'));
}
return _origFetch.apply(this, arguments);
};
} catch (e) {}
var _origXHROpen = win.XMLHttpRequest.prototype.open;
try {
win.XMLHttpRequest.prototype.open = function (method, url) {
if (url && isDomainBlocked(extractHostname(String(url)))) {
console.warn('[CogShield] Blocked XHR request to:', url);
arguments[1] = 'data:,';
}
return _origXHROpen.apply(this, arguments);
};
} catch (e) {}
var _origWS = win.WebSocket;
if (_origWS) {
win.WebSocket = function(url, protocols) {
if (url && isSuspiciousUrl(String(url))) {
console.warn('[CogShield] Blocked WebSocket connection to:', url);
throw new Error('Blocked by CogShield');
}
return protocols ? new _origWS(url, protocols) : new _origWS(url);
};
win.WebSocket.prototype = _origWS.prototype;
}
var _origBeacon = navigator.sendBeacon;
if (_origBeacon) {
navigator.sendBeacon = function(url, data) {
if (url && isSuspiciousUrl(String(url))) {
console.warn('[CogShield] Blocked sendBeacon telemetry to:', url);
return false;
}
return _origBeacon.apply(this, arguments);
};
}
})();
// ═══════════════════════════════════════════════════════════════════
// PHASE 2: UNIVERSAL MUTATION OBSERVER
// ═══════════════════════════════════════════════════════════════════
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(mutation) {
mutation.addedNodes.forEach(function(node) {
if (node.tagName) {
var tag = node.tagName.toLowerCase();
if (tag === 'script' || tag === 'iframe' || tag === 'embed' || tag === 'object') {
var targetUrl = node.src || node.data || node.href;
if (targetUrl && isSuspiciousUrl(targetUrl)) {
node.remove();
console.warn('[CogShield] Neutralized malicious node injection:', targetUrl);
}
}
}
});
});
});
document.addEventListener('DOMContentLoaded', function() {
observer.observe(document.documentElement, { childList: true, subtree: true });
});
// ═══════════════════════════════════════════════════════════════════
// PHASE 3: MULTI-FEED THREAT INTELLIGENCE SYNC (V3)
// ═══════════════════════════════════════════════════════════════════
var CACHE_KEY_DOMAINS = 'cogtech_global_domains_v3';
var CACHE_KEY_REASONS = 'cogtech_global_reasons_v3';
var CACHE_KEY_TS = 'cogtech_global_ts_v3';
var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
var BLOCKLIST_SOURCES = [
{ label: 'HaGeZi Multi Pro', url: 'https://raw.githubusercontent.com/hagezi/dns-blocklists/main/hosts/pro.txt', parse: parseHostsFormat },
{ label: 'Steven Black Unified Hosts', url: 'https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts', parse: parseHostsFormat },
{ label: 'URLhaus Malware Domains', url: 'https://urlhaus.abuse.ch/downloads/hostfile/', parse: parseHostsFormat },
{ label: "Dandelion Sprout's Anti-Malware", url: 'https://raw.githubusercontent.com/DandelionSprout/adfilt/refs/heads/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareHosts.txt', parse: parseHostsFormat }
];
function parseHostsFormat(text) {
return text.split('\n').reduce(function (acc, line) {
var trimmed = line.trim();
if (!trimmed || trimmed.charAt(0) === '#') return acc;
var parts = trimmed.split(/\s+/);
if (parts.length >= 2 && (parts[0] === '0.0.0.0' || parts[0] === '127.0.0.1')) {
var d = parts[1].toLowerCase();
if (d && d !== 'localhost' && d !== '0.0.0.0') acc.push(d);
}
return acc;
}, []);
}
function gmFetch(url) {
return new Promise(function (resolve, reject) {
GM_xmlhttpRequest({
method: 'GET', url: url, timeout: 15000,
onload: function (r) { (r.status >= 200 && r.status < 300) ? resolve(r.responseText) : reject(new Error('HTTP ' + r.status)); },
onerror: function () { reject(new Error('Network error')); },
ontimeout: function () { reject(new Error('Timeout')); },
});
});
}
function fetchAllLists() {
var promises = BLOCKLIST_SOURCES.map(function (source) {
return gmFetch(source.url)
.then(function (text) { return { label: source.label, domains: source.parse(text) }; })
.catch(function () { return { label: source.label, domains: [] }; });
});
return Promise.all(promises);
}
function populateAndCache(sourceResults) {
var allDomains = [];
var reasons = {};
sourceResults.forEach(function (result) {
result.domains.forEach(function (d) {
if (!BLOCKED_DOMAINS.has(d)) {
BLOCKED_DOMAINS.add(d);
reasons[d] = result.label;
allDomains.push(d);
}
});
});
Object.assign(BLOCK_REASONS, reasons);
try {
GM_setValue(CACHE_KEY_DOMAINS, JSON.stringify(allDomains));
GM_setValue(CACHE_KEY_REASONS, JSON.stringify(reasons));
GM_setValue(CACHE_KEY_TS, Date.now());
} catch (e) {}
}
try {
var cachedTs = GM_getValue(CACHE_KEY_TS, 0);
if (Date.now() - cachedTs < CACHE_TTL_MS) {
var cachedDomains = JSON.parse(GM_getValue(CACHE_KEY_DOMAINS, '[]'));
var cachedReasons = JSON.parse(GM_getValue(CACHE_KEY_REASONS, '{}'));
cachedDomains.forEach(function (d) { BLOCKED_DOMAINS.add(d); });
Object.assign(BLOCK_REASONS, cachedReasons);
if (isDomainBlocked(currentHost)) {
showBlockPage(currentHost, BLOCK_REASONS[currentHost]);
}
fetchAllLists().then(function (results) {
BLOCKED_DOMAINS.clear();
populateAndCache(results);
if (isDomainBlocked(currentHost)) {
showBlockPage(currentHost, BLOCK_REASONS[currentHost]);
}
});
} else {
fetchAllLists().then(function (results) {
populateAndCache(results);
if (isDomainBlocked(currentHost)) {
showBlockPage(currentHost, BLOCK_REASONS[currentHost]);
}
});
}
} catch (e) {}
// ═══════════════════════════════════════════════════════════════════
// PHASE 4: HIGH-SECURITY BLOCK PAGE WITH BYPASS SUPPORT
// ═══════════════════════════════════════════════════════════════════
function showBlockPage(blockedHost, caughtByList) {
window.stop();
var html = '<!DOCTYPE html>' +
'<html lang="en"><head>' +
'<meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1">' +
'<title>Connection blocked — CogShield</title>' +
'<style>' +
'*{margin:0;padding:0;box-sizing:border-box}' +
'body{min-height:100vh;display:flex;align-items:center;justify-content:center;background:#050508;font-family:system-ui,sans-serif;color:#e2e8f0}' +
'.card{background:#0f0f17;border:1px solid #3f0000;border-radius:12px;padding:52px 48px;max-width:540px;width:90%;text-align:center;box-shadow:0 10px 80px rgba(220,38,38,.25)}' +
'.domain{font-size:18px;font-family:monospace;font-weight:600;color:#ff6b6b;background:#1a0505;border:1px dashed #7f1d1d;border-radius:6px;padding:12px 20px;display:inline-block;margin:20px 0;word-break:break-all}' +
'.btn-container{display:flex;gap:16px;justify-content:center;margin-top:24px}' +
'.btn{padding:14px 24px;color:#fff;border:none;border-radius:6px;font-size:14px;font-weight:bold;cursor:pointer;text-transform:uppercase;letter-spacing:1px;transition:0.2s}' +
'.btn-primary{background:linear-gradient(135deg,#7f1d1d,#dc2626);}' +
'.btn-primary:hover{box-shadow:0 0 20px rgba(220,38,38,.5)}' +
'.btn-secondary{background:transparent;border:1px solid #7f1d1d;color:#fca5a5;}' +
'.btn-secondary:hover{background:#2a0808;}' +
'</style></head><body>' +
'<div class="card">' +
'<div style="font-size:64px;margin-bottom:10px">🛑</div>' +
'<h1 style="color:#f87171">Connection blocked</h1>' +
'<div class="domain">' + escapeHtml(blockedHost) + '</div>' +
'<p style="color:#94a3b8;line-height:1.5">CogShield intercepted a malicious request and terminated the connection to protect your browser.</p>' +
'<div style="margin:20px 0;font-size:13px;color:#fca5a5;background:#2a0808;padding:8px;border-radius:4px">Source: ' + escapeHtml(caughtByList || 'Global Blocklist') + '</div>' +
'<div class="btn-container">' +
'<button class="btn btn-primary" onclick="history.back()">Go Back</button>' +
'<button class="btn btn-secondary" onclick="bypassBlock()">Proceed (Unsafe)</button>' +
'</div>' +
'</div>' +
'<script>' +
'function bypassBlock() {' +
'sessionStorage.setItem("cogshield_bypass_" + "' + escapeHtml(blockedHost) + '", "true");' +
'location.reload();' +
'}' +
'</script>' +
'</body></html>';
try {
document.open();
document.write(html);
document.close();
} catch (e) {
document.documentElement.innerHTML = html;
}
throw new Error('CogShield Blocked Navigation');
}
function escapeHtml(str) {
return String(str).replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"');
}
})();