starred/adfilt
1
0
Fork 0
mirror of https://github.com/DandelionSprout/adfilt.git synced 2026-09-24 15:10:17 +01:00
Code Issues Packages Projects Releases 4 Wiki Activity

Added circa 186 entries.

Browse Source
This commit is contained in:
Imre Eilertsen
2026-03-27 02:37:20 +01:00
committed by GitHub
parent a66b162a6e
commit 1141208f0f
1 changed files with 196 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dandelion Sprout's Anti-Malware List.txt
+196 -13
View File
@@ -1,6 +1,6 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List
! Version: 24March2026v1
! Version: 27March2026v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -301,10 +301,10 @@ exefiles.com##.panel:has([href*="/en/recommended/winthruster/"])
exefiles.com##.row:has(a[href*="/recommended/"])
! Common scam domain patterns
/^https?://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live).*$/$1p,doc
/^https?:\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}.*$/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top
/^(https?|tcp)://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live).*$/$1p,doc
/^(https?|tcp):\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}.*$/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top
! https://github•com/AdguardTeam/AdguardFilters/issues/58737
/^https?:\/\/(?:www\.)?[-0-9a-z]{14,}\.(?:biz|fun|live)\/[a-zA-Z]{10,}\.php$/$doc,domain=biz|fun|live
/^(https?|tcp):\/\/(?:www\.)?[-0-9a-z]{14,}\.(?:biz|fun|live)\/[a-zA-Z]{10,}\.php$/$doc,domain=biz|fun|live
! ——— Banner for "MSN New Tab" ———
msn.com##.irisbanner
@@ -887,9 +887,9 @@ $all,ipaddress=/^192\.243\.61\.[12]?\d?\d$/
/scan-update-and-protect-your-browser.html$doc
! https://github.com/AdguardTeam/AdguardFilters/issues/61755
! https://github.com/AdguardTeam/AdguardFilters/issues/61743
/^(https?://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$doc,popup
/^((https?|tcp)://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$doc,popup
! https://github.com/easylist/easylist/issues/6111
/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$doc
/^(https?|tcp)://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$doc
||best202*-games-web1.com^$all
||bigkick.biz^$all
||findmedia.biz^$all
@@ -934,14 +934,14 @@ $all,ipaddress=167.99.249.47
! https://maldita•es/malditobulo/2020/11/18/no-no-es-cierto-que-amancio-ortega-haya-invertido-100-millones-en-bitcoin-revolution-es-una-web-falsa/
||starpowders.github.io^
! https://github.com/AdguardTeam/AdguardFilters/issues/69611
/^https?://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/.*)?$/
/^(https?|tcp)://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/.*)?$/
! https://github.com/AdguardTeam/AdguardFilters/issues/71721
! https://github.com/AdguardTeam/AdguardFilters/issues/71369
! https://github.com/AdguardTeam/AdguardFilters/issues/73623
! https://github.com/AdguardTeam/AdguardFilters/issues/73627
/^https?://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/.*)?$/
/^(https?|tcp)://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/.*)?$/
! https://github.com/AdguardTeam/AdguardFilters/issues/73133
/^(https?://)?\d\d?\.[a-z0-9-]{1,}\.biz(/.*)?$/$doc
/^((https?|tcp)://)?\d\d?\.[a-z0-9-]{1,}\.biz(/.*)?$/$doc
! https://github.com/DandelionSprout/adfilt/discussions/163#discussioncomment-428333
/bitcoinrevolution/lp.php^$doc
! https://github.com/DandelionSprout/adfilt/issues/188
@@ -1773,8 +1773,7 @@ $all,ipaddress=91.240.118.172
$all,ipaddress=198.199.120.251
||198.199.120.251^$all
! https://www•telia•no/kundeservice/mobil/malware-flubot-android/
!+ NOT_OPTIMIZED
/^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/$doc
/^(https?|tcp)://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/$doc
! A Discord conversation I had about Throneful
||datings-club.life^$all
||findsexy.life^$all
@@ -11155,6 +11154,190 @@ $all,ipaddress=94.156.232.201
||trackmedia.site^$all
||trkepcs.com^$all
||xcvnerui.pro^$all
! https://www•tjekdet•dk/fup-og-spam/pas-paa-falske-beskeder-fra-dao-rammer-danmark
||as-dao.icu^$all
||dao-as.cc^$all
||dao-as.com^$all
||dao-as.vip^$all
||dao-as.xyz^$all
||dao-asdk.cc^$all
||dao-asdk.vip^$all
||dao-ase.cc^$all
||dao-ase.vip^$all
||dao-asen.bond^$all
||dao-asi.cc^$all
||dao-asi.vip^$all
||dao-asiiv.icu^$all
||dao-asioiiv.icu^$all
||dao-asl.vip^$all
||dao-aso.cc^$all
||dao-asoi.icu^$all
||dao-asoiiv.icu^$all
||dao-asr.cc^$all
||dao-asr.vip^$all
||dao-ass.cc^$all
||dao-ass.vip^$all
||dao-assion.icu^$all
||dao-asuui.icu^$all
||dao-asvisu.icu^$all
||dao-post.icu^$all
||daoao.icu^$all
||daoas-en.bond^$all
||daoasa.cyou^$all
||daoasa.sbs^$all
||daoiiox.icu^$all
||daoios.icu^$all
||daoipost.icu^$all
||daonevt.com^$all
||daoosi.icu^$all
||daopakke.sbs^$all
||daopst.icu^$all
||daosa.cyou^$all
||daosa.shop^$all
||daosviz.com^$all
||daoteams.com^$all
||daovisx.com^$all
||daoxo.bond^$all
||dpd-sio.icu^$all
||pakke.click^$all
||postuin.bond^$all
||daobo.bond^$all
||daodo.bond^$all
||daoicom.bond^$all
||aecopetrol.qpon^$all
||araskargo-tr.bond^$all
||araskargotr.bond^$all
||asxczmv.click^$all
||autostrade.cfd^$all
||autostrade.cyou^$all
||autostrade.sbs^$all
||autostrade.shop^$all
||bahrain-bh.love^$all
||cimb2.one^$all
||claroiso.cc^$all
||commodits.shop^$all
||commoditys.store^$all
||dhl-com.bond^$all
||dhl-commx.^$all
||dhl-commx.bond^$all
||dhlse.icu^$all
||dhlse.sbs^$all
||dhlse.shop^$all
||dpd-aco.icu^$all
||dpd-cis.icu^$all
||dpd-com.bond^$all
||dpd-cv.icu^$all
||dpd-sa.icu^$all
||dpd-verfolge.cc^$all
||dpd-voi.icu^$all
||dpdatd.cyou^$all
||dpdatd.icu^$all
||dpdatd.shop^$all
||dpdcom.bond^$all
||dpdcz.my.id^$all
||dpddp.cyou^$all
||dpddpd.biz.id^$all
||dpddpd.sbs^$all
||dpdias.bond^$all
||dpdopd.cyou^$all
||dpdopd.icu^$all
||dpdopd.sbs^$all
||dpdopd.shop^$all
||dpdpd.cyou^$all
||dpdpd.icu^$all
||dpdpd.sbs^$all
||dpdpd.shop^$all
||dpdsdd.cfd^$all
||dpdsdd.cyou^$all
||dpdsdd.icu^$all
||dpdsdd.sbs^$all
||dpdsdd.shop^$all
||dpdsn.cyou^$all
||dpdsn.icu^$all
||dpdsn.sbs^$all
||dpdsn.shop^$all
||dpdspd.cfd^$all
||dpdspd.cyou^$all
||dpdspd.icu^$all
||dpdspd.sbs^$all
||dpdspd.shop^$all
||dpduio.bond^$all
||dpdzp.bond^$all
||egh.me^$all
||egyptpoat.cc^$all
||egyptposc.cc^$all
||egyptposz.cc^$all
||egyptpoxu.cc^$all
||egyptpoxy.cc^$all
||egyptpsto.cc^$all
||ezdrivema-com-vip.bond^$all
||ezdrivema-com.bond^$all
||ezdrivemia-com.bond^$all
||fancourier-ro.icu^$all
||finessa.icu^$all
||finlands.icu^$all
||fullcopec-cil.bond^$all
||gdexpiress.co^$all
||ghana-post.bond^$all
||ghanapost.my.id^$all
||gls-group-eu.bond^$all
||glssi.biz.id^$all
||glsso.biz.id^$all
||glsso.my.id^$all
||ieb.me^$all
||itale-post.com^$all
||italy-poste.biz.id^$all
||italy-poste.my.id^$all
||italy-posti.info^$all
||itaypostin.bond^$all
||jt-egpaeso-eg.cc^$all
||jt-egpreso-ey.cc^$all
||jt-egypost-ey.cc^$all
||kgm-*.bond^$all
||kgm-govv.icu^$all
||kgm-gv.icu^$all
||kgmei.bond^$all
||kgmg-ovtr.bond^$all
||kgmgiov.bond^$all
||kgmgiovtr.bond^$all
||kgmgo*.bond^$all
||kgmic.bond^$all
||kgmim.bond^$all
||kgmit.bond^$all
||magenta-at.help^$all
||maybank2u.mom^$all
||maybank2u.web.id^$all
||plpost.icu^$all
||poschat.asia^$all
||postahe.biz.id^$all
||santander.wikaba.com^$all
||seurac.bond^$all
||seurnu.bond^$all
||t-mobiile-*.bond^$all
||t-mobile-*.bond^$all
||telceleslareds.dubya.net^$all
||telceleslareds.mynetav.net^$all
||telceleslareds.trickip.net^$all
||tigo-gt.love^$all
||tigo-onisu.icu^$all
||tigosv.mrbonus.com^$all
||tigosv.toythieves.com^$all
||trpttgovqs.icu^$all
||very-wonderful.shop^$all
!#if !env_firefox
||43.157.122.86^$all
||43.157.46.83^$all
||43.164.196.209^$all
||88.255.216.16^$all
/((https?|tcp)://)?204\.194\.54\.\d{1,3}([:/].*)?$/$all
!#endif
!#if env_firefox
$all,ipaddress=43.157.122.86
$all,ipaddress=43.157.46.83
$all,ipaddress=43.164.196.209
$all,ipaddress=88.255.216.16
$all,ipaddress=204.194.54.*
!#endif
! ——— Standard malware that I stumbled upon on my own ———
! http://www•toorgle•net/results•php?q=fetishkitsch&security=666
@@ -11352,7 +11535,7 @@ toorgle.net##.join
||yjwtolgjjeky.com^$all
||zdicbpujzjps.com^$all
!#if !ext_ublock
/^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/$doc
/^((https?|tcp)://)?192\.243\.59\.\d{1,3}(/.*)?$/$doc
!#endif
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
! Googling Aksel Hennie (Results for prior week) in late July 2021
@@ -11678,7 +11861,7 @@ $all,ipaddress=95.214.26.78
||wirexapp.africa.com^$all
! Google results for «SodaStream site:no cranberry»
/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware_redirection_results.*
/^(https?|tcp)://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware_redirection_results.*
||adservice.google.*/ddm/clk/$doc,domain=~malware_redirection_results.*
/ad_click/q?&url=$doc,domain=~malware_redirection_results.*
! Laughably blatant fraud site