From 0ffac500fc9ab9489232ed9d96b66aae62e7febe Mon Sep 17 00:00:00 2001 From: Imre Eilertsen Date: Mon, 22 Sep 2025 22:43:32 +0200 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 23 ++++++++++++++++++- .../AntiMalwareAdGuard.txt | 20 +++++++++++++++- .../AntiMalwareAdGuardHome.txt | 11 ++++++++- .../AntiMalwareDomains.txt | 14 ++++++++++- .../AntiMalwareHosts.txt | 14 ++++++++++- .../AntiMalwarePrivoxy.action | 14 ++++++++++- .../AntiMalwareTPL.tpl | 18 ++++++++++++++- 7 files changed, 107 insertions(+), 7 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index 2af0176c1..01978150c 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox) -! Version: 22September2025v2 +! Version: 22September2025v6 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -41316,6 +41316,21 @@ http://secured21.*.com/|$popup ||52.15.34.25^$popup +! https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware + +||203.188.171.156^ +||203.188.171.156^$popup + + +! https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md +||soft-gets.com^ +||soft-gets.com^$popup +||reaitek.com^ +||reaitek.com^$popup +||fastdomain-uoemathhvq.workers.dev^ +||fastdomain-uoemathhvq.workers.dev^$popup +||dev.ip.organica.tv^ +||dev.ip.organica.tv^$popup ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -54274,6 +54289,12 @@ drvhub.net##.driver-item__install ! Now this one I did not fall for, however. ||gitcoin-passport.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* ||passport-gitcoin.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* +! https://news•ycombinator•com/item?id=45308596 +||gitcoin-developers.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* +||github-foundation.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* +||gitcoin-grants.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* +! https://new•reddit•com/r/CryptoScams/comments/1nlma8m/potential_crypto_phishing_scam_masquerading_as/ +||foundation-github.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^ diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 8e37dc340..b99683151 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 22September2025v2 +! Version: 22September2025v6 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -22492,6 +22492,18 @@ http://secured21.*.com/|$all !#endif !+ PLATFORM(windows, mac, android, cli) 52.15.34.25$network +! https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware +!#if !adguard_app_windows +!+ NOT_PLATFORM(windows, mac, android, cli) +||203.188.171.156^$all +!#endif +!+ PLATFORM(windows, mac, android, cli) +203.188.171.156$network +! https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md +||soft-gets.com^$all +||reaitek.com^$all +||fastdomain-uoemathhvq.workers.dev^$all +||dev.ip.organica.tv^$all ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -29721,6 +29733,12 @@ drvhub.net##.driver-item__install ! Now this one I did not fall for, however. ||gitcoin-passport.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* ||passport-gitcoin.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* +! https://news•ycombinator•com/item?id=45308596 +||gitcoin-developers.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* +||github-foundation.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* +||gitcoin-grants.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* +! https://new•reddit•com/r/CryptoScams/comments/1nlma8m/potential_crypto_phishing_scam_masquerading_as/ +||foundation-github.$all,domain=~blatant_scammers_who_have_no_actual_relations_with_github_whatsoever.* ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^$all diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index cdd89112b..73e2dd62c 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22) -! Version: 22September2025v2 +! Version: 22September2025v6 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -20195,6 +20195,13 @@ http://secured21.*.com/| ||filinnetirt.com^ ||freshsubz.com^ 52.15.34.25 +! https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware +203.188.171.156 +! https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md +||soft-gets.com^ +||reaitek.com^ +||fastdomain-uoemathhvq.workers.dev^ +||dev.ip.organica.tv^ ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 ||downloadprovider.me^ @@ -26502,6 +26509,8 @@ http://secured21.*.com/| ! I myself managed to fall for their scam, to the tune of the low-3-digits of Euros. ||divingshop.nl^$denyallow=bank_transaction_scammers.* ! Now this one I did not fall for, however. +! https://news•ycombinator•com/item?id=45308596 +! https://new•reddit•com/r/CryptoScams/comments/1nlma8m/potential_crypto_phishing_scam_masquerading_as/ ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^ ||100conversions.com^ diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 15e252052..1ba1abc43 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 22September2025v3 +# Version: 22September2025v6 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway. @@ -21557,6 +21557,16 @@ freshsubz.com 52.15.34.25 +# https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware + +203.188.171.156 + + +# https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md +soft-gets.com +reaitek.com +fastdomain-uoemathhvq.workers.dev +dev.ip.organica.tv # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -28405,6 +28415,8 @@ passport-gitcoin.com gitcoin-developers.com github-foundation.com gitcoin-grants.com +# https://new•reddit•com/r/CryptoScams/comments/1nlma8m/potential_crypto_phishing_scam_masquerading_as/ +foundation-github.com # ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— 0network.com diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index bde100800..33926fa2e 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version) -# Version: 22September2025v3 +# Version: 22September2025v6 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Users of Pi-Hole FTL 5.22 and later, and of AdGuard Home, are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven. @@ -21508,6 +21508,16 @@ 127.0.0.1 52.15.34.25 +# https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware + +127.0.0.1 203.188.171.156 + + +# https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md +127.0.0.1 soft-gets.com +127.0.0.1 reaitek.com +127.0.0.1 fastdomain-uoemathhvq.workers.dev +127.0.0.1 dev.ip.organica.tv # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -28352,6 +28362,8 @@ 127.0.0.1 gitcoin-developers.com 127.0.0.1 github-foundation.com 127.0.0.1 gitcoin-grants.com +# https://new•reddit•com/r/CryptoScams/comments/1nlma8m/potential_crypto_phishing_scam_masquerading_as/ +127.0.0.1 foundation-github.com # ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— 127.0.0.1 0network.com diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 1f2089cb2..fda3fb890 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 22September2025v2-Deprecated +# Version: 22September2025v6-Deprecated # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -21181,6 +21181,14 @@ +.203.188.171.156 + + +.soft-gets.com +.reaitek.com +.fastdomain-uoemathhvq.workers.dev +.dev.ip.organica.tv + {+block} # ——— Standard malware that I stumbled upon on my own ——— .downloadprovider.me @@ -27990,6 +27998,10 @@ # Now this one I did not fall for, however. .gitcoin-passport. .passport-gitcoin. +.gitcoin-developers. +.github-foundation. +.gitcoin-grants. +.foundation-github. .0network.com .100conversions.com diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 6427e9413..37b6bd28b 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 22September2025v2-Deprecated +# Version: 22September2025v6-Deprecated : expires = 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -21556,6 +21556,16 @@ http://secured21.*.com/ -d 52.15.34.25 +# https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware + +-d 203.188.171.156 + + +# https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md +-d soft-gets.com +-d reaitek.com +-d fastdomain-uoemathhvq.workers.dev +-d dev.ip.organica.tv # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -28398,6 +28408,12 @@ ed.br ?q=artstation- # Now this one I did not fall for, however. -d gitcoin-passport. -d passport-gitcoin. +# https://news•ycombinator•com/item?id=45308596 +-d gitcoin-developers. +-d github-foundation. +-d gitcoin-grants. +# https://new•reddit•com/r/CryptoScams/comments/1nlma8m/potential_crypto_phishing_scam_masquerading_as/ +-d foundation-github. # ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter/——— -d 0network.com