# Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version)
# Version: 23July2021v3-Beta
# Expires: 5 days
# Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.

# ——— Bad top-level domains ———
# You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you.
# Tokelau

# Gabon

# Mali

# Equatorial Guinea

# Central African Republic

# Palau

# International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent.







# ——— Attempted removal of Google search result entries that lead to the above top-level domains (Advanced adblockers only) ———

# ——— You know those ultra-fraudulent auto-generated things that clutter up Google searches? These entries should remove some of them. ———

# ——— For Google Mobile ———

# ——— Old dead tech-related domains ———
# Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them.
adblock.gjtech.net
spam404bl.com
109.201.135.46
hufilter.hu
fredfiber.no
securemecca.com
1hos.cf
1hosts.cf
everythingisnt.com
vin-plastiks.com
adblock-listefr.com
intr0.cf
njabl.org
dutchmega.nl
juvander.net
ssl.bblck.me
# Malicious domains found in videogame manuals and title screens
acclaimsports.com
acclaimmaxsports.com
hip-games.com
thq.com.au
gp32.com
kidnkid.com
b-shooter.com
100-9.com
cuttherope.ie
oldgames.4all.cc
# Dead router connection URİs
# To log in to TP-Link routers, use tplinkwifi.net instead.
tplinklogin.net
tplinkextender.net
# Old Linux-related domains
# How these links still remain in Unetbootin, is anyone's guess.
dreamlinux.com.br
dreamlinux.net
dreamlinux.info
hacktolive.org
mandriva.com
# Fraudulent browser extensions
ublock.org
138.68.252.54
useragentswitch.com
dev-nano.com

# ——— IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. ———
funeducation.com
iq-research.info
iq-test.co.uk
iqtest.co.uk
iqtest.com
iqtestnow.org
iqtestonline24.com
test-iq.org
officialiqtests.com

# ——— Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware ———
# ¤¤¤ ReImagePlus (Also added to "uBlock Filters - Badware Risks") ¤¤¤

# ¤¤¤ ScanUtilities ¤¤¤
# ¤¤¤ Driver Easy ¤¤¤
# ¤¤¤ Slimware DriverUpdate ¤¤¤
# ¤¤¤ Driverpack Online (Accidentally also fixed in EasyPrivacy and «AdGuard Mobile Ads») ¤¤¤
google-analytics.com
# ¤¤¤ SpyHunter links ¤¤¤
# ¤¤¤ Restoro  ¤¤¤
# ¤¤¤ "Driver" download sites that instead download PUP tools ¤¤¤
driver-soft.com

# Common scam domain patterns









# ——— Banner for "MSN New Tab" ———

# ——— Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) ———
# If you're in a situation where you need to torrent something, such as for hard-to-buy or region-locked games, or games that you own for consoles that lack accessible rip tools, you can at least try to use sites that have legit downloads with the actual game files.
coolrom.com
freeroms.com
portalroms.com
romsmania.com
loveroms.com
portableroms.com

# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
afobal.cl
alvoportas.com.br
blogerjijer.pw
bright.su
domnicpeter.in.net
dzitech.net
fadzulani.com
hruner.com
interlogistics.com.vn
ivansaru.418.com1.ru
jangasm.org
kesikelyaf.com
ns511849.ip-192-99-19.net
ns513726.ip-192-99-148.net
panel.vargakragard.se
servmill.com
ssl.sinergycosmetics.com
telefonfiyatlari.org
update.rifugiopontese.it
vodahelp.sytes.net
witkey.com

# ——— Browser extension store entries for notoriously poor or malicious adblocker forks ———
# Note: Currently the entries only work properly on AdGuard for Windows/Mac, due to what seems to be limitations placed on browser extensions.

# Chrome Web Store
# Mozilla Add-ons
# Homepages
adblock.biz
the1adblocker.com
otih-oith.us.to

# ——— Wrong TLDs of legitimate sites ———
ubuntu.org
dwarffortresswiki.com
103.224.212.249
speedtest.com
kelkoogroup.net

# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
ppc.netnet44.net
tncrun.net
54.174.156.141
lucretius-ada.com
tango-deg.com
ezekiel-sam.com
franciscus-ful.com
hippolyte-hag.com
india-abc.com
leontius-eli.com
mohini-ger.com
nethaneel-has.com
ortrun-adi.com
paramonos-oha.com
paula-secundinus.com
photios-raj.com
proserpina-zeb.com
ieronimus-kay.com
fredagty.com
lordagty.com
madagty.com
onsdagty.com
zeroredirect5.com
54.209.22.226
54.91.125.197
52.202.53.245
35.175.38.64
35.168.147.213
34.230.160.215
3.226.8.132
3.216.243.46
roamingclicks.com
# Source: demonoid.pw
veremund-hon.com
# Source: desidert.no
collectfasttracks.com
# Source: vn-zoom.com
ttnrd.com
54.152.245.247
35.172.40.232
3.90.125.85
# Various ex-affiliate links at www.zombooru.com
track.vcdc.com
track.tkbo.com
track.traffic.club
lasvegas-vacations.net
ndsplitter.com
ns1.trafficclub.com
satcom1.co.uk
splitter.microxml.net
94.130.185.237
94.130.186.231
144.76.0.242
144.76.1.130
195.201.92.254
forgoprokick.icu

# ——— Found in random witness reports online ———
# Adblock Plus list maintainer weekly reports
pinoy-offers.com
googleboost.xyz
bemobtracks.com
bemobtrk.com
bemobpath.com
couponbybox.com
34.204.214.165
54.85.113.62
54.205.83.61
54.210.193.115
[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1]
deviuser.com


watch-video.net
code-zp.com
code-zp1.com
fres-news.com
news-code.com
video18plus.com
workerz-news.com
zfirst-news.com
zgetnews.com
zmp3-online.com
zmusic-online.com
zredir.com
178.128.142.109
findmedia.biz
addclicker.biz
allnews24.live
backtonews.biz
bagclick.biz
basemedia.me
bigdate.biz
bigkick.biz
blackfr1dayz.com
blackname.biz
changerss.me
dailyapp.me
dbimedia.me
freeclick.club
freeclick.me
freshe.me
futuramas.biz
getcontent24.com
goodcode.me
greennews.club
klickmode.biz
lastmedia.me
mediabasket.club
namedia.club
newmode.biz
newscart.club
newsgate.biz
newshooter.me
newstuber.me
read2day.me
read4you.me
redmdeia.biz
sunchannel.me
sunfeed.me
trynews.me
uptodater.net
virnews.club
vviewpoint.biz
westnews24.com


134.209.136.174
whiteclick.biz
dreamnews.biz
getcoder.me
gonews2.com
mediadate.net
newscode.me
newzmaker.me
picmedia.biz
redads.biz
skymedia7.me
startmode.biz
texterra.me
worldtxt.club
62.210.6.153
62.210.7.209
62.210.9.92
62.210.11.203
ilo134ulih.com
192.243.59.12
192.243.59.13
192.243.59.20
hooligapps.com
theonlygames.com
notified-today.com
antivirus-update.com
article-sharer.com
greatstuffalways.com
new-message.cc
new-message.co
new-message.email
new-message.today
new-notification.live
new-notifications.live
notified-today.com
notified-today.live
notified-today.xyz
stay-notified.com
stay-notified.xyz
trend-articles.com
167.99.249.47
es-celebrar.com
spainrealty.info
auctionsdirectory.info
moderncomputer.net
version.gratis
starpowders.github.io

moststraightmoment-10.live


safe-offers.net

imgvieweriri.com
gogle.net
quatrefeuillepolonaise.xyz
extragifis.site
captcharesolving-universe.com
captcharesolver.com
roaddrinkfun.live
cpmstatsart.com
instantfwding.com
fwdservice.com
gamesex.fun
goldprize.xyz
kmip.net
0redirc.com
redirekted.com
rebiraert.com
trkcrpt.com
cryptoengine24.com
iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
5.8.34.26
5.8.47.3
103.224.182.251
holescontracting.com
doggroomingnews.com
theyardservice.com
bestwaytosearch.com
freescanonline.com
5.79.71.205
5.79.71.225
85.17.31.82
85.17.31.122
178.162.203.202
178.162.203.211
178.162.203.226
178.162.217.107
[2a02:1668:1034::2]
logicalrecord.com
secureportal.online
accbaus.com
aobinternational.com
bbuk.online
chasetrustus.com
cnbprivate.com
emiratenbduae.com
firstbprivatehnwi.com
frny.us
gei-ae.com
securebankapp.online
securemailbox.online
stansteadmanagement.com
66.85.156.85
66.85.156.86
108.170.31.123
108.170.52.156
mysecrethoookup.com
toksearches.xyz
smashapps.net
smashappsearch.com
smashtabsearch.com
srchus.xyz
searchpowerapp.com
searchgeniusapp.com
searchletter.com
searchinggood.com
searchprivacyplus.com
fiterhedthinin.pro
powersmashsearch.com
1clickcnvrtsearch.com
1000-dollar.cash
1000-eur.cash
bokerstars.com
breaking-news.digital
breaking-special.news
cazin0.com
celeb-secret.live
chat-live.video
chat-message.live
chat-notification.online
check-me.online
check-message.live
check-now.online
check-out-this.site
check-the.news
check-these-girls-on.live
check-this-out-now.online
check-this-unread.email
check-this.news
click-it-now.online
click-now-extra-special.online
click-now-on-this.online
click-now-on.me
click-now.services
click-on-this-now.online
click-on-this.art
click-on-this.news
click-on-this.today
click-push.com
click-to-continue.network
click-to-continue.online
click-to-continue.shop
click-to-read.online
click-to-see.live
click-to-watch.live
continue-your.services
cpa-optimizer.online
cpvlabtrk.online
critical-alert.info
financial-message.club
free-coupons.network
free-message.services
free-money-to.shop
get-money-to.shop
get-your.cash
important-update.online
incoming-news.online
leaked-video.live
live-breaking-news.online
live-gossip.online
live-vidoes.club
lp-pressroomvip.online
message-alert.center
message-alert.info
millionaire-club.online
new-incoming.email
new-message.live
new-video.live
online-message.services
p0kerr.com
personal-video.live
presroomvip.online
private-message.live
private-message.online
private-show.live
read-the-news.online
read-this-hot-stuff.today
roulleta.com
secret-video.online
secret-vip.club
service-update.network
show-in-progress.live
social-network.club
special-breaking.news
special-message.online
special-news.online
special-offers.online
special-promotion.online
special-promotions.online
special-test.online
special-update.online
special-updates.live
stop-video.live
the-life-style-magazine.com
urgent-incoming.email
very-important.online
video-call.live
video-change.digital
video-notification.digital
video-started.digital
video-update.digital
watch-this.live
weather-forecast.today
95.168.170.165
213.227.145.147
213.227.149.216
royalmail-bill.com
wow-robotics.xyz
0fx.club
114oo.icu
189027.icu
1xbe.icu
221u7.cyou
2now.cyou
3dworks.club
404p.icu
5x5x5.cyou
64bitss.club
7digits.us
8words.xyz
9gag.uno
a42.buzz
abspl.xyz
b17.monster
badger.uno
c982.link
commv.club
d883.click
deepe.icu
f1racing.icu
f8822.buzz
g8super.monster
g98.monster
google-analytics.buzz
google-analytics.club
google-analytics.cyou
google-analytics.icu
google-analytics.monster
googleanalytics.buzz
googleanalytics.cyou
googleanalytics.monster
googleanalytics.top
googleshopanalytic.icu
googletagmanager.cyou
googletagmanager.top
gstatic.club
gstatic.cyou
hihihi.cyou
intr0.cyou
johndoe.icu
klingon.monster
justinstalledpanel.com
lazyfox.icu
monk.monster
n0ne.cyou
oppen.icu
pens.monster
quicky.cyou
reddys.icu
statanalytic.cyou
streetrac.icu
sub0.monster
tanks.cyou
uoycc.cyou
user42.xyz
vacuum5.club
vdr.monster
wyomng.icu
xfilesx.club
yoyoyo.cyou
zerr.club
albumzips.xyz
aleinvest.xyz
bitminer.ga
camillesanz.com
fblaster.com
googleanalytics.icu
ribinski.us
security.fblaster.com
shopstatanalytics.store
sxamp.uno
sxbet.uno
sxcad.uno
sxdmp.uno
sxerr.uno
sxfnc.uno
sxgear.uno
sxhit.uno
sxint.uno
sxjump.uno
syamoto.club
syberian.club
sycamor.club
sydne.club
syenna.club
syfer.club
sygna.club
syhire.club
syidim.club
syjet.club
5.188.62.36
speedupmypcfree.com
bawarnituruni.com
bonstrumen.me
cendokonlupo.com
dumantrem.com
faratresmugil.com
flomongteren.com
gedinetuwus.com
ikitrenesturi.com
interestmy.tech
jelmakunfun.com
jimukgremen.com
juwarnatumb.com
kabihintujun.com
kerinenmuluk.com
kijamblondo.com
kilatyunes.com
kompuyinok.com
kontrene.com
kulakantumur.com
kulinocompany.com
lekartrenes.com
logotiips.com
loprentalyunu.com
manaweruhe.com
manufakyutun.com
opratunijawer.com
pandawateplok.com
plontokan.com
remuniyambis.com
retromycomps.com
satrunekulo.com
smlvturenms.me
terapklentune.com
turahbuycomp.com
turijoglod.com
tyunipolar.com
yambrokno.com
yummycompt.com
baystlotor.com
kulinomobon.com
lateralliffee.com
makleryuki.com
okleremen.com
pinee1.com
untilkawan.com
salviamugwort.space
samamerigoaldridge.site
samarialucienquinn.casa
samarknape.uno
samukatorok.space
sandraglebova.space
sanyaimmink.icu
sareeellereypenland.casa
savinareinwaldsteffen.site
scarlettlaycatherina.site
shannonmanfredoctave.site
shaynefrancklynwynne.site
zorinetownspiegelman.casa
ssielearning.com
canhila.tk
paymetconfirm.com
fasteasyupdates.com
buyer-remindment.com
payreminament.com
webservicesamazin.com
taskremindment.com
paymentadvisry.com
jeromfastsolutions.com
insiderushings.com
woltelorda.xyz
www.woltelorda.xyz
vahodedian.xyz
ndintynarc.xyz
onaddavyly.xyz
69.49.231.244
vid.me
5starhdporn.com

# ——— Standard malware that I stumbled upon on my own ———
downloadprovider.me
cash93.com
99quickways.com
99trickss.com
a4alig.com
besttrends7.com
bise11th.com
bise12th.com
cash03.com
dollars9.com
eonline1.com
eonline9.com
getbiz3.com
gocash9.com
healthy-with-cancer.com
jobs87.com
jobs500.com
joinweb9.com
money87.com
netpay8.com
profit28.com
profits11.com
slimxketo.com
u2next.com
worknet8.com
works35.com
works79.com
yelp57.com
# Various ex-affiliate links at www.zombooru.com
allowandgo.com
aksuu.ru
allow-space.com
allowandgo.com
clc.zoocenter.ru
clckask.club
clickjump.biz
clickpush.biz
pushland.ru
clicktms.club
push.pipiset.com
push.weo.su
reclick.club
traffsend.me
wwopenclick.club
azhydroxychloroquine.com
wisig.org
confrancisyalgomas.com
chloroquine1st.com
droga5.net
mymvrc.org
webbfenix.com
jueriy.com
amoxycillin1st.com
# The Jerma985 Discord server
crazycrabreedville.com
messium.info
# Various Google searches
# Various search results for 'kelloggs tresor' in Norwegian (30/05/2021)

# PCGamingWiki page references
inside3d.com
viaarena.com

# Fake security sites that think every single domain is a supervirus and which try to make you install PUP (Most commonly SpyHunter)
malwarecleanerpro.com
howtofix.guide
malwaresecure.com
combo-fix.com
regrunreanimator.com
cleanpcinfections.com
defeatpcvirus.com
malware-remove.com

# ——— Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
# Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
unofficialtwrp.com
androidweblog.com
hardreset.info


# ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
# If you use AdGuard Home ≥v0.106.3, I warmly recommend manually pasting these entries into Settings → DNS Settings → Disallowed domains
version.bind
hostname.bind
pizzaseo.com
version.server
id.server
dominiosvision.com
hitnslab.cn
hitnslab.xyz
hitnslab.info
lavrov.in
fe18.ru
1x1.cz


# ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ———
githubus.com
githubu.com
githu.com
rawgithub.com
awgithub.com
wgithub.com
githubuser.com
rgithub.com
githubt.com
githubnt.com

# ——— Usually used by various groups who buy old domains and display illicit ads on them ———



# ——— Spam in comment sections across the internet about "working" from "home" ———

# ——— Upgrades HTTP requests to HTTPS on sites that don't do it automatically ———


# ——— Good sites used to scan domains for malware or ads, and which should/must be allowlisted to avoid having entries in various filterlists interfere with their scanning ———

# ——— Offline-only apps trying to phone home ———



# ——— Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) ———
if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data


