From 02890a17c827b5ff60b15ca1974d9fdde9f120c5 Mon Sep 17 00:00:00 2001 From: Imre Eilertsen Date: Sat, 26 Apr 2025 10:27:36 +0200 Subject: [PATCH] Fix #1128 --- .../AntiMalwareABP.txt | 43 ++++++++----------- .../AntiMalwareAdGuard.txt | 43 +++++++------------ .../AntiMalwareAdGuardHome.txt | 38 ++++++---------- .../AntiMalwareDomains.txt | 27 ++++++------ .../AntiMalwareHosts.txt | 27 ++++++------ .../AntiMalwarePrivoxy.action | 36 ++++++---------- .../AntiMalwareTPL.tpl | 38 ++++++---------- ...out's and other adblocker lists' IPs.ipset | 3 ++ 8 files changed, 103 insertions(+), 152 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index 74a9d257f..4217fe5e6 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox) -! Version: 18April2025v1 +! Version: 25April2025v3 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -566,17 +566,7 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||discorde-nitre.xyz^ ||discorde-nitre.xyz^$popup -! ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ——— -||netnet44.net^ -||netnet44.net^$popup -||amanda.*.net^ -||sarah.*.net^ -||pamela.*.net^ -||jessica.*.net^ -||katie.*.net^ -||emily.*.net^ -||54.174.156.141^ - +! ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— ||lucretius-ada.com^ ||lucretius-ada.com^$popup ||hippolyte-hag.com^ @@ -619,20 +609,6 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ! Source: desidertNO ||collectfasttracks.com^ ||collectfasttracks.com^$popup -! Source: vn-zoomCOM -||ttnrd.com^ -||ttnrd.com^$popup -||amanda.*.com^ -||katie.*.com^ -||briana.*.com^ -||sarah.*.com^ -||pamela.*.com^ -||54.152.245.247^ - -||35.172.40.232^ - -||3.90.125.85^ - ! Various ex-affiliate links at www•zombooru•com ||track.vcdc.com^ ||track.vcdc.com^$popup @@ -52456,6 +52432,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] +! https://github.com/DandelionSprout/adfilt/issues/1129 +||password-internal.com^ +||password-internal.com^$popup ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -63654,6 +63633,18 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||zui.app^$popup ||zurc2.com^ ||zurc2.com^$popup +! Sites linked to by GitHub spambots who create fake issue reports +||modernvison.com^ +! https://github.com/DandelionSprout/adfilt/issues/1128 de facto +||casino-lite.net^ +||googleapis.info^ +||netnet33.net^ +||netnet33.net^$popup +||netnet44.net^ +||netnet44.net^$popup +||odintara.com^ +||54.174.156.141^ + ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^ diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 85c6f177f..10e5599e1 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 18April2025v1 +! Version: 25April2025v3 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -497,17 +497,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ! https://scammer•info/t/discord-nitro-scam-25/87887 ||discorde-nitre.xyz^$all,~inline-font,domain=~fake-malware-version-of-discordapp.com -! ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ——— -||netnet44.net^$all -||amanda.*.net^$document -||sarah.*.net^$document -||pamela.*.net^$document -||jessica.*.net^$document -||katie.*.net^$document -||emily.*.net^$document -||54.174.156.141^$document -!+ PLATFORM(windows, mac, android) -54.174.156.141$network +! ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— ||lucretius-ada.com^$all ||hippolyte-hag.com^$all ||india-abc.com^$all @@ -547,22 +537,6 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||roamingclicks.com^$all ! Source: desidertNO ||collectfasttracks.com^$all,~inline-font,domain=~malware_redirection_trains.* -! Source: vn-zoomCOM -||ttnrd.com^$all -||amanda.*.com^$document -||katie.*.com^$document -||briana.*.com^$document -||sarah.*.com^$document -||pamela.*.com^$document -||54.152.245.247^$document -!+ PLATFORM(windows, mac, android) -54.152.245.247$network -||35.172.40.232^$document -!+ PLATFORM(windows, mac, android) -35.172.40.232$network -||3.90.125.85^$document -!+ PLATFORM(windows, mac, android) -3.90.125.85$network ! Various ex-affiliate links at www•zombooru•com ||track.vcdc.com^$all,~inline-font,domain=~malware_redirection_trains.* ||track.tkbo.com^$all,~inline-font,domain=~malware_redirection_trains.* @@ -27340,6 +27314,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] *$ipaddress=172.240.41.32 *$ipaddress=172.240.41.64 *$ipaddress=172.240.41.96 +! https://github.com/DandelionSprout/adfilt/issues/1129 +||password-internal.com^$all ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -33144,6 +33120,17 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||zqytu.club^$all ||zui.app^$all ||zurc2.com^$all +! Sites linked to by GitHub spambots who create fake issue reports +||modernvison.com^$document +! https://github.com/DandelionSprout/adfilt/issues/1128 de facto +||casino-lite.net^$document +||googleapis.info^$document +||netnet33.net^$all +||netnet44.net^$all +||odintara.com^$document +||54.174.156.141^$document +!+ PLATFORM(windows, mac, android) +54.174.156.141$network ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^$all diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index d0bae6731..02d1eb1c4 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22) -! Version: 18April2025v1 +! Version: 25April2025v3 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -287,16 +287,7 @@ ! https://scammer•info/t/discord-nitro-scam-25/87887 -! ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ——— -||netnet44.net^ -||amanda.*.net^ -||sarah.*.net^ -||pamela.*.net^ -||jessica.*.net^ -||katie.*.net^ -||emily.*.net^ -54.174.156.141 - +! ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— ||lucretius-ada.com^ ||hippolyte-hag.com^ ||india-abc.com^ @@ -328,19 +319,6 @@ ||roamingclicks.com^ ! Source: desidertNO -! Source: vn-zoomCOM -||ttnrd.com^ -||amanda.*.com^ -||katie.*.com^ -||briana.*.com^ -||sarah.*.com^ -||pamela.*.com^ -54.152.245.247 - -35.172.40.232 - -3.90.125.85 - ! Various ex-affiliate links at www•zombooru•com @@ -26771,6 +26749,8 @@ +! https://github.com/DandelionSprout/adfilt/issues/1129 +||password-internal.com^ ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -32506,6 +32486,16 @@ ||zqytu.club^ ||zui.app^ ||zurc2.com^ +! Sites linked to by GitHub spambots who create fake issue reports +||modernvison.com^ +! https://github.com/DandelionSprout/adfilt/issues/1128 de facto +||casino-lite.net^ +||googleapis.info^ +||netnet33.net^ +||netnet44.net^ +||odintara.com^ +54.174.156.141 + ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^ diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index ac5b20fd4..c2a260148 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 18April2025v1 +# Version: 25April2025v3 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway. @@ -358,10 +358,7 @@ githubt.com # https://scammer•info/t/discord-nitro-scam-25/87887 discorde-nitre.xyz -# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ——— -netnet44.net -54.174.156.141 - +# ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— lucretius-ada.com hippolyte-hag.com india-abc.com @@ -393,14 +390,6 @@ zeroredirect5.com roamingclicks.com # Source: desidertNO collectfasttracks.com -# Source: vn-zoomCOM -ttnrd.com -54.152.245.247 - -35.172.40.232 - -3.90.125.85 - # Various ex-affiliate links at www•zombooru•com track.vcdc.com track.tkbo.com @@ -26802,6 +26791,8 @@ zzamawwinr.com +# https://github.com/DandelionSprout/adfilt/issues/1129 +password-internal.com # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -32527,6 +32518,16 @@ zoo.care zqytu.club zui.app zurc2.com +# Sites linked to by GitHub spambots who create fake issue reports +modernvison.com +# https://github.com/DandelionSprout/adfilt/issues/1128 de facto +casino-lite.net +googleapis.info +netnet33.net +netnet44.net +odintara.com +54.174.156.141 + # ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— 0network.com diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 0874f7d2b..d0b8da59b 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version) -# Version: 18April2025v1 +# Version: 25April2025v3 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Users of Pi-Hole FTL 5.22 and later, and of AdGuard Home, are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven. @@ -307,10 +307,7 @@ # https://scammer•info/t/discord-nitro-scam-25/87887 127.0.0.1 discorde-nitre.xyz -# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ——— -127.0.0.1 netnet44.net -127.0.0.1 54.174.156.141 - +# ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— 127.0.0.1 lucretius-ada.com 127.0.0.1 hippolyte-hag.com 127.0.0.1 india-abc.com @@ -342,14 +339,6 @@ 127.0.0.1 roamingclicks.com # Source: desidertNO 127.0.0.1 collectfasttracks.com -# Source: vn-zoomCOM -127.0.0.1 ttnrd.com www.ttnrd.com amanda.ttnrd.com katie.ttnrd.com briana.ttnrd.com sarah.ttnrd.com pamela.ttnrd.com -127.0.0.1 54.152.245.247 - -127.0.0.1 35.172.40.232 - -127.0.0.1 3.90.125.85 - # Various ex-affiliate links at www•zombooru•com 127.0.0.1 track.vcdc.com 127.0.0.1 track.tkbo.com @@ -26751,6 +26740,8 @@ +# https://github.com/DandelionSprout/adfilt/issues/1129 +127.0.0.1 password-internal.com # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -32472,6 +32463,16 @@ 127.0.0.1 zqytu.club 127.0.0.1 zui.app 127.0.0.1 zurc2.com +# Sites linked to by GitHub spambots who create fake issue reports +127.0.0.1 modernvison.com +# https://github.com/DandelionSprout/adfilt/issues/1128 de facto +127.0.0.1 casino-lite.net +127.0.0.1 googleapis.info +127.0.0.1 netnet33.net +127.0.0.1 netnet44.net +127.0.0.1 odintara.com +127.0.0.1 54.174.156.141 + # ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— 127.0.0.1 0network.com diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 6bc1a6b53..4604330d5 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 18April2025v1-Deprecated +# Version: 25April2025v3-Deprecated # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -254,16 +254,7 @@ .discorde-nitre.xyz {+block} -# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ——— -.netnet44.net -.amanda.*.net -.sarah.*.net -.pamela.*.net -.jessica.*.net -.katie.*.net -.emily.*.net -.54.174.156.141 - +# ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— .lucretius-ada.com .hippolyte-hag.com .india-abc.com @@ -295,19 +286,6 @@ .roamingclicks.com # Source: desidertNO .collectfasttracks.com -# Source: vn-zoomCOM -.ttnrd.com -.amanda.*.com -.katie.*.com -.briana.*.com -.sarah.*.com -.pamela.*.com -.54.152.245.247 - -.35.172.40.232 - -.3.90.125.85 - # Various ex-affiliate links at www•zombooru•com .track.vcdc.com .track.tkbo.com @@ -26412,6 +26390,7 @@ +.password-internal.com {+block} # ——— Standard malware that I stumbled upon on my own ——— @@ -32101,6 +32080,15 @@ .zqytu.club .zui.app .zurc2.com +# Sites linked to by GitHub spambots who create fake issue reports +.modernvison.com +.casino-lite.net +.googleapis.info +.netnet33.net +.netnet44.net +.odintara.com +.54.174.156.141 + .0network.com .100conversions.com diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 8e6a4a520..97c6b3ef6 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 18April2025v1-Deprecated +# Version: 25April2025v3-Deprecated : expires = 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -327,16 +327,7 @@ msFilterList # https://scammer•info/t/discord-nitro-scam-25/87887 -d discorde-nitre.xyz -# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ——— --d netnet44.net - - - - - - --d 54.174.156.141 - +# ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— -d lucretius-ada.com -d hippolyte-hag.com -d india-abc.com @@ -368,19 +359,6 @@ msFilterList -d roamingclicks.com # Source: desidertNO -d collectfasttracks.com -# Source: vn-zoomCOM --d ttnrd.com - - - - - --d 54.152.245.247 - --d 35.172.40.232 - --d 3.90.125.85 - # Various ex-affiliate links at www•zombooru•com -d track.vcdc.com -d track.tkbo.com @@ -26775,6 +26753,8 @@ icrosoft.com.chrome. +# https://github.com/DandelionSprout/adfilt/issues/1129 +-d password-internal.com # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -32495,6 +32475,16 @@ ed.br ?q=artstation- -d zqytu.club -d zui.app -d zurc2.com +# Sites linked to by GitHub spambots who create fake issue reports +-d modernvison.com +# https://github.com/DandelionSprout/adfilt/issues/1128/de/facto +-d casino-lite.net +-d googleapis.info +-d netnet33.net +-d netnet44.net +-d odintara.com +-d 54.174.156.141 + # ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter/——— -d 0network.com diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset index 6ba1e32cd..c21614d2f 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset @@ -378,6 +378,9 @@ [2600:1f18:43d1:2a02:c3bd:35f3:da0a:4041] [2600:1f18:43d1:2a02:c6f9:e151:e2e1:732d] [2600:1f1c:57F:b502:dd8:9588:11e6:282] +172.240.41.32 +172.240.41.64 +172.240.41.96 194.226.139.121 194.226.139.7 95.181.157.36