feat(dns filter): add ThreatFox C2 and malware domains as a default list

New category c2: abuse.ch ThreatFox's host file (~30,000 botnet C2 and payload domains reported in the last days), on by default beside URLhaus malware. Existing configs keep their categories; only a fresh 'dns filter on' or 'filter add c2' turns it on, and 'dns filter update' fetches it like the others.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: ralyodio

README.md

@@ -2147,7 +2147,7 @@ names that exist only to advertise, track, mine or phish, before a connection is
 ever opened. Nothing is filtered until you ask for it.
 
 ```sh
-moshcode dns filter on             # ads, malware, phishing, mining
+moshcode dns filter on             # ads, malware, c2, phishing, mining
 moshcode dns filter update         # fetch the lists — nothing downloads on its own
 moshcode dns filter                # what is on, and what it has blocked
 moshcode dns filter test ads.example.com   # would this be blocked, and by which rule
@@ -2158,6 +2158,7 @@ moshcode dns filter allow news.example     # never block it, whatever any list s
 |---|---|
 | `ads` | ads and trackers — StevenBlack unified, on by default |
 | `malware` | hosts serving malware — URLhaus, on by default |
+| `c2` | botnet command-and-control and payload domains — ThreatFox, on by default |
 | `phishing` | Phishing Army, on by default |
 | `mining` | in-browser cryptominers, on by default |
 | `adult` `gambling` `social` `fakenews` | opt in by name with `filter add <list>` |

src/dns-filter.mjs

@@ -55,6 +55,13 @@ export const FILTER_CATALOG = [
     url: "https://urlhaus.abuse.ch/downloads/hostfile/",
     note: "URLhaus, abuse.ch — hosts serving malware payloads right now",
   },
+  {
+    id: "c2",
+    title: "Botnet C2 and malware hosts",
+    format: "hosts",
+    url: "https://threatfox.abuse.ch/downloads/hostfile/",
+    note: "ThreatFox, abuse.ch — command-and-control and payload domains reported in the last days",
+  },
   {
     id: "phishing",
     title: "Phishing",
@@ -102,11 +109,11 @@ export const FILTER_CATALOG = [
 export const CATALOG_BY_ID = new Map(FILTER_CATALOG.map((entry) => [entry.id, entry]));
 
 /**
- * What `filter on` turns on when told nothing else: the four categories that
+ * What `filter on` turns on when told nothing else: the five categories that
  * block things nobody asks for. Everything that blocks content a person might
  * actually want — adult, gambling, social, fakenews — is opt-in by name.
  */
-export const DEFAULT_CATEGORIES = ["ads", "malware", "phishing", "mining"];
+export const DEFAULT_CATEGORIES = ["ads", "malware", "c2", "phishing", "mining"];
 
 /**
  * How a blocked name is answered.

test/dns-filter-cli.test.mjs

@@ -55,7 +55,7 @@ test("`on` writes the default categories and names the ones never fetched", asyn
   const dir = await tempDir(t);
   const { code, text } = await run(["on"], dir);
   assert.equal(code, 0);
-  assert.match(text, /filtering on — ads, malware, phishing, mining/);
+  assert.match(text, /filtering on — ads, malware, c2, phishing, mining/);
   // The state that would otherwise read as protection.
   assert.match(text, /never been fetched/);
   assert.match(text, /moshcode dns filter update/);
@@ -93,7 +93,7 @@ test("`off` keeps the lists and the rules", async (t) => {
   const config = await readConfig(dir);
   assert.equal(config.enabled, false);
   assert.deepEqual(config.block, ["tracker.example"]);
-  assert.deepEqual(config.categories, ["ads", "malware", "phishing", "mining"]);
+  assert.deepEqual(config.categories, ["ads", "malware", "c2", "phishing", "mining"]);
 });
 
 test("an unknown mode or list is refused rather than half-applied", async (t) => {