From 1141208f0f31033a62f60c3c682a43a44890ff36 Mon Sep 17 00:00:00 2001 From: Imre Eilertsen Date: Fri, 27 Mar 2026 02:37:20 +0100 Subject: [PATCH] Added circa 186 entries. --- Dandelion Sprout's Anti-Malware List.txt | 209 +++++++++++++++++++++-- 1 file changed, 196 insertions(+), 13 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 87120d473..52ab40a9d 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 24March2026v1 +! Version: 27March2026v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -301,10 +301,10 @@ exefiles.com##.panel:has([href*="/en/recommended/winthruster/"]) exefiles.com##.row:has(a[href*="/recommended/"]) ! Common scam domain patterns -/^https?://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live).*$/$1p,doc -/^https?:\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}.*$/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top +/^(https?|tcp)://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live).*$/$1p,doc +/^(https?|tcp):\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}.*$/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top ! https://github•com/AdguardTeam/AdguardFilters/issues/58737 -/^https?:\/\/(?:www\.)?[-0-9a-z]{14,}\.(?:biz|fun|live)\/[a-zA-Z]{10,}\.php$/$doc,domain=biz|fun|live +/^(https?|tcp):\/\/(?:www\.)?[-0-9a-z]{14,}\.(?:biz|fun|live)\/[a-zA-Z]{10,}\.php$/$doc,domain=biz|fun|live ! ——— Banner for "MSN New Tab" ——— msn.com##.irisbanner @@ -887,9 +887,9 @@ $all,ipaddress=/^192\.243\.61\.[12]?\d?\d$/ /scan-update-and-protect-your-browser.html$doc ! https://github.com/AdguardTeam/AdguardFilters/issues/61755 ! https://github.com/AdguardTeam/AdguardFilters/issues/61743 -/^(https?://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$doc,popup +/^((https?|tcp)://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$doc,popup ! https://github.com/easylist/easylist/issues/6111 -/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$doc +/^(https?|tcp)://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$doc ||best202*-games-web1.com^$all ||bigkick.biz^$all ||findmedia.biz^$all @@ -934,14 +934,14 @@ $all,ipaddress=167.99.249.47 ! https://maldita•es/malditobulo/2020/11/18/no-no-es-cierto-que-amancio-ortega-haya-invertido-100-millones-en-bitcoin-revolution-es-una-web-falsa/ ||starpowders.github.io^ ! https://github.com/AdguardTeam/AdguardFilters/issues/69611 -/^https?://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/.*)?$/ +/^(https?|tcp)://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/.*)?$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/71721 ! https://github.com/AdguardTeam/AdguardFilters/issues/71369 ! https://github.com/AdguardTeam/AdguardFilters/issues/73623 ! https://github.com/AdguardTeam/AdguardFilters/issues/73627 -/^https?://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/.*)?$/ +/^(https?|tcp)://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/.*)?$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/73133 -/^(https?://)?\d\d?\.[a-z0-9-]{1,}\.biz(/.*)?$/$doc +/^((https?|tcp)://)?\d\d?\.[a-z0-9-]{1,}\.biz(/.*)?$/$doc ! https://github.com/DandelionSprout/adfilt/discussions/163#discussioncomment-428333 /bitcoinrevolution/lp.php^$doc ! https://github.com/DandelionSprout/adfilt/issues/188 @@ -1773,8 +1773,7 @@ $all,ipaddress=91.240.118.172 $all,ipaddress=198.199.120.251 ||198.199.120.251^$all ! https://www•telia•no/kundeservice/mobil/malware-flubot-android/ -!+ NOT_OPTIMIZED -/^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/$doc +/^(https?|tcp)://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/$doc ! A Discord conversation I had about Throneful ||datings-club.life^$all ||findsexy.life^$all @@ -11155,6 +11154,190 @@ $all,ipaddress=94.156.232.201 ||trackmedia.site^$all ||trkepcs.com^$all ||xcvnerui.pro^$all +! https://www•tjekdet•dk/fup-og-spam/pas-paa-falske-beskeder-fra-dao-rammer-danmark +||as-dao.icu^$all +||dao-as.cc^$all +||dao-as.com^$all +||dao-as.vip^$all +||dao-as.xyz^$all +||dao-asdk.cc^$all +||dao-asdk.vip^$all +||dao-ase.cc^$all +||dao-ase.vip^$all +||dao-asen.bond^$all +||dao-asi.cc^$all +||dao-asi.vip^$all +||dao-asiiv.icu^$all +||dao-asioiiv.icu^$all +||dao-asl.vip^$all +||dao-aso.cc^$all +||dao-asoi.icu^$all +||dao-asoiiv.icu^$all +||dao-asr.cc^$all +||dao-asr.vip^$all +||dao-ass.cc^$all +||dao-ass.vip^$all +||dao-assion.icu^$all +||dao-asuui.icu^$all +||dao-asvisu.icu^$all +||dao-post.icu^$all +||daoao.icu^$all +||daoas-en.bond^$all +||daoasa.cyou^$all +||daoasa.sbs^$all +||daoiiox.icu^$all +||daoios.icu^$all +||daoipost.icu^$all +||daonevt.com^$all +||daoosi.icu^$all +||daopakke.sbs^$all +||daopst.icu^$all +||daosa.cyou^$all +||daosa.shop^$all +||daosviz.com^$all +||daoteams.com^$all +||daovisx.com^$all +||daoxo.bond^$all +||dpd-sio.icu^$all +||pakke.click^$all +||postuin.bond^$all +||daobo.bond^$all +||daodo.bond^$all +||daoicom.bond^$all +||aecopetrol.qpon^$all +||araskargo-tr.bond^$all +||araskargotr.bond^$all +||asxczmv.click^$all +||autostrade.cfd^$all +||autostrade.cyou^$all +||autostrade.sbs^$all +||autostrade.shop^$all +||bahrain-bh.love^$all +||cimb2.one^$all +||claroiso.cc^$all +||commodits.shop^$all +||commoditys.store^$all +||dhl-com.bond^$all +||dhl-commx.^$all +||dhl-commx.bond^$all +||dhlse.icu^$all +||dhlse.sbs^$all +||dhlse.shop^$all +||dpd-aco.icu^$all +||dpd-cis.icu^$all +||dpd-com.bond^$all +||dpd-cv.icu^$all +||dpd-sa.icu^$all +||dpd-verfolge.cc^$all +||dpd-voi.icu^$all +||dpdatd.cyou^$all +||dpdatd.icu^$all +||dpdatd.shop^$all +||dpdcom.bond^$all +||dpdcz.my.id^$all +||dpddp.cyou^$all +||dpddpd.biz.id^$all +||dpddpd.sbs^$all +||dpdias.bond^$all +||dpdopd.cyou^$all +||dpdopd.icu^$all +||dpdopd.sbs^$all +||dpdopd.shop^$all +||dpdpd.cyou^$all +||dpdpd.icu^$all +||dpdpd.sbs^$all +||dpdpd.shop^$all +||dpdsdd.cfd^$all +||dpdsdd.cyou^$all +||dpdsdd.icu^$all +||dpdsdd.sbs^$all +||dpdsdd.shop^$all +||dpdsn.cyou^$all +||dpdsn.icu^$all +||dpdsn.sbs^$all +||dpdsn.shop^$all +||dpdspd.cfd^$all +||dpdspd.cyou^$all +||dpdspd.icu^$all +||dpdspd.sbs^$all +||dpdspd.shop^$all +||dpduio.bond^$all +||dpdzp.bond^$all +||egh.me^$all +||egyptpoat.cc^$all +||egyptposc.cc^$all +||egyptposz.cc^$all +||egyptpoxu.cc^$all +||egyptpoxy.cc^$all +||egyptpsto.cc^$all +||ezdrivema-com-vip.bond^$all +||ezdrivema-com.bond^$all +||ezdrivemia-com.bond^$all +||fancourier-ro.icu^$all +||finessa.icu^$all +||finlands.icu^$all +||fullcopec-cil.bond^$all +||gdexpiress.co^$all +||ghana-post.bond^$all +||ghanapost.my.id^$all +||gls-group-eu.bond^$all +||glssi.biz.id^$all +||glsso.biz.id^$all +||glsso.my.id^$all +||ieb.me^$all +||itale-post.com^$all +||italy-poste.biz.id^$all +||italy-poste.my.id^$all +||italy-posti.info^$all +||itaypostin.bond^$all +||jt-egpaeso-eg.cc^$all +||jt-egpreso-ey.cc^$all +||jt-egypost-ey.cc^$all +||kgm-*.bond^$all +||kgm-govv.icu^$all +||kgm-gv.icu^$all +||kgmei.bond^$all +||kgmg-ovtr.bond^$all +||kgmgiov.bond^$all +||kgmgiovtr.bond^$all +||kgmgo*.bond^$all +||kgmic.bond^$all +||kgmim.bond^$all +||kgmit.bond^$all +||magenta-at.help^$all +||maybank2u.mom^$all +||maybank2u.web.id^$all +||plpost.icu^$all +||poschat.asia^$all +||postahe.biz.id^$all +||santander.wikaba.com^$all +||seurac.bond^$all +||seurnu.bond^$all +||t-mobiile-*.bond^$all +||t-mobile-*.bond^$all +||telceleslareds.dubya.net^$all +||telceleslareds.mynetav.net^$all +||telceleslareds.trickip.net^$all +||tigo-gt.love^$all +||tigo-onisu.icu^$all +||tigosv.mrbonus.com^$all +||tigosv.toythieves.com^$all +||trpttgovqs.icu^$all +||very-wonderful.shop^$all +!#if !env_firefox +||43.157.122.86^$all +||43.157.46.83^$all +||43.164.196.209^$all +||88.255.216.16^$all +/((https?|tcp)://)?204\.194\.54\.\d{1,3}([:/].*)?$/$all +!#endif +!#if env_firefox +$all,ipaddress=43.157.122.86 +$all,ipaddress=43.157.46.83 +$all,ipaddress=43.164.196.209 +$all,ipaddress=88.255.216.16 +$all,ipaddress=204.194.54.* +!#endif ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -11352,7 +11535,7 @@ toorgle.net##.join ||yjwtolgjjeky.com^$all ||zdicbpujzjps.com^$all !#if !ext_ublock -/^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/$doc +/^((https?|tcp)://)?192\.243\.59\.\d{1,3}(/.*)?$/$doc !#endif ! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ! Googling Aksel Hennie (Results for prior week) in late July 2021 @@ -11678,7 +11861,7 @@ $all,ipaddress=95.214.26.78 ||wirexapp.africa.com^$all ! Google results for «SodaStream site:no cranberry» -/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware_redirection_results.* +/^(https?|tcp)://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware_redirection_results.* ||adservice.google.*/ddm/clk/$doc,domain=~malware_redirection_results.* /ad_click/q?&url=$doc,domain=~malware_redirection_results.* ! Laughably blatant fraud site