# Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version)
# Version: 13July2020v2-Beta
# Expires: 5 days
# Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.

# ——— Country domains ———
# You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you.
# Tokelau

# Gabon

# Mali

# Equatorial Guinea

# Central African Republic

# Palau


# ——— Topical domains ———
# These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent.
# Presumably fake loans






# ——— Attempted removal of Google search result entries that lead to the above top-level domains (Advanced adblockers only) ———

# ——— You know those ultra-fraudulent websites who clutter up Google searches, who have some seemingly random ".php?" values in their URLs? These entries should remove some of them. ———

# ——— For Google Mobile ———

# ——— Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks") ———
adblock.gjtech.net
spam404bl.com
109.201.135.46
hufilter.hu
fredfiber.no
securemecca.com
1hos.cf
1hosts.cf
everythingisnt.com
vin-plastiks.com
adblock-listefr.com
intr0.cf

# ——— Old tech-related domains that have fallen into the hands of questionable new owners. ———
# To log in to TP-Link routers, use tplinkwifi.net instead.
tplinklogin.net
tplinkextender.net
ublock.org
138.68.252.54

# ——— IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. ———
funeducation.com
iq-research.info
iq-test-online.org
iq-test.co.uk
iqtest.co.uk
iqtest.com
iqtestnow.org
iqtestonline24.com
test-iq.org
officialiqtests.com

# ——— Old Linux-related domains that have been snapped up for ads, adware, and/or malware. ———
# How these links still remain in Unetbootin, is anyone's guess.
dreamlinux.com.br
dreamlinux.net
dreamlinux.info
104.24.117.74
104.24.116.74
[2606:4700:30::6818:754a]
[2606:4700:30::6818:744a]
hacktolive.org
mandriva.com

# ——— ReImagePlus links (Also added to "uBlock Filters - Badware Risks") ———


# ——— ScanUtilities links ———

# ——— Driver Easy links ———

# ——— Slimware DriverUpdate links ———

# ——— Driverpack Online links (Accidentally also fixed in EasyPrivacy and «AdGuard Mobile Ads») ———
google-analytics.com

# ——— SpyHunter links ———

# ——— Sites that fraudulently claim you've won a new phone ———



# ——— Banner for "MSN New Tab" ———

# ——— Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) ———
# If you're in a situation where you need to torrent something, such as for hard-to-buy or region-locked games, or games that you own for consoles that lack accessible rip tools, you can at least try to use sites that have legit downloads with the actual game files.
gamecopyworld.com
coolrom.com
freeroms.com
portalroms.com
romsmania.com
loveroms.com
portableroms.com

# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
afobal.cl
alvoportas.com.br
blogerjijer.pw
bright.su
domnicpeter.in.net
dzitech.net
fadzulani.com
hotelavalon.org
hruner.com
interlogistics.com.vn
ivansaru.418.com1.ru
jangasm.org
kesikelyaf.com
luenhinpearl.com
ns511849.ip-192-99-19.net
ns513726.ip-192-99-148.net
panel.vargakragard.se
prtscrinsertcn.net
sanyai-love.rmu.ac.th
servmill.com
ssl.sinergycosmetics.com
telefonfiyatlari.org
update.rifugiopontese.it
vodahelp.sytes.net
nikey.cn
witkey.com

# ——— Truly extraordinarily cases of sites so bad that it counts as malware that directly affects human brains ———
incels.co

# ——— Browser extension store entries for notoriously poor or malicious adblocker forks ———
# Note: Currently the entries only work properly on AdGuard for Windows/Mac, due to what seems to be limitations placed on browser extensions.
# Chrome Web Store
# Mozilla Add-ons
# Homepages
adblock.biz
the1adblocker.com

# ——— Wrong suffixes of legitimate sites ———
dwarffortresswiki.com
103.224.212.249
speedtest.com

# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
ppc.netnet44.net
tncrun.net
54.174.156.141
lucretius-ada.com
tango-deg.com
ezekiel-sam.com
franciscus-ful.com
hippolyte-hag.com
india-abc.com
leontius-eli.com
loukianos-euk.com
mohini-ger.com
nethaneel-has.com
ortrun-adi.com
paramonos-oha.com
paula-secundinus.com
photios-raj.com
proserpina-zeb.com
ieronimus-kay.com
fredagty.com
lordagty.com
madagty.com
onsdagty.com
zeroredirect5.com
54.209.22.226
54.91.125.197
52.202.53.245
35.175.38.64
35.168.147.213
34.230.160.215
3.226.8.132
3.216.243.46
maowaotodowoo.net
# Source: demonoid.pw
veremund-hon.com
# Source: desidert.no
collectfasttracks.com
# Source: vn-zoom.com
ttnrd.com
54.152.245.247
35.172.40.232
3.90.125.85

# ——— Found in random witness reports online ———
deviuser.com

# ——— Malicious domains found in videogame manuals ———
acclaimsports.com
acclaimmaxsports.com
hip-games.com
thq.com.au
gp32.com

# ——— Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
# Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
unofficialtwrp.com
androidweblog.com
hardreset.info

# ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———


version.bind
pizzaseo.com
version.server



# ——— Zero-width spaces/hyphens in lookalike domains ———



# ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ———
0.168.192.in-addr.arpa
1.168.192.in-addr.arpa

# ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ———
githubus.com
githubu.com
githu.com
rawgithub.com
awgithub.com
wgithub.com
githubuser.com
rgithub.com

# ——— Usually used by various groups who buy old domains and display illicit ads on them ———



# ——— User-submitted entries ———
imgvieweriri.com

# Japanese scam



