starred/adfilt
1
0
Fork 0
mirror of https://github.com/DandelionSprout/adfilt.git synced 2026-10-04 14:31:07 +01:00
Code Issues Packages Projects Releases 4 Wiki Activity

Update Dandelion Sprout's Anti-Malware List.txt

Browse Source 
Tests with uBO 1.62.1b0 seemed to fully support this syntax.
This commit is contained in:
Imre Eilertsen
2025-02-09 22:31:27 +01:00
committed by GitHub
parent 4fa90ca3cd
commit 1f3d8d4125
1 changed files with 142 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dandelion Sprout's Anti-Malware List.txt
+142 -142
View File
@@ -1,6 +1,6 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List
! Version: 07February2025v2
! Version: 09February2025v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -397,7 +397,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"])
||wix.cm^$doc,domain=~malware-typo-squatter-of-wix.com
||199.59.243.222^$doc
*$all,ipaddress=199.59.243.222
|http://ww01.$doc,domain=~very-very-extremely-frequently-used-in-malware-redirections.*
|http://ww01.$doc,domain=~very_very_extremely_frequently_used_in_malware_redirections.*
||14d.us^$all,~inline-font,domain=~malware-redirection-and-also-you-were-very-likely-looking-for-1d4.us
||173.208.96.42^$all,~inline-font
*$all,ipaddress=173.208.96.42
@@ -510,7 +510,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"])
||proserpina-zeb.com^$all,~inline-font
||lordagty.com^$doc
||madagty.com^$doc
||zeroredirect5.com^$doc,domain=~malware-redirection-trains.*
||zeroredirect5.com^$doc,domain=~malware_redirection_trains.*
||54.209.22.226^$doc
*$all,ipaddress=54.209.22.226
||54.91.125.197^$doc
@@ -529,7 +529,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"])
*$all,ipaddress=3.216.243.46
||roamingclicks.com^$all,~inline-font
! Source: desidertNO
||collectfasttracks.com^$all,~inline-font,domain=~malware-redirection-trains.*
||collectfasttracks.com^$all,~inline-font,domain=~malware_redirection_trains.*
! Source: vn-zoomCOM
||ttnrd.com^$all,~inline-font
||amanda.*.com^$doc
@@ -544,9 +544,9 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"])
||3.90.125.85^$doc
*$all,ipaddress=3.90.125.85
! Various ex-affiliate links at www•zombooru•com
||track.vcdc.com^$all,~inline-font,domain=~malware-redirection-trains.*
||track.tkbo.com^$all,~inline-font,domain=~malware-redirection-trains.*
||track.traffic.club^$all,~inline-font,domain=~malware-redirection-trains.*
||track.vcdc.com^$all,~inline-font,domain=~malware_redirection_trains.*
||track.tkbo.com^$all,~inline-font,domain=~malware_redirection_trains.*
||track.traffic.club^$all,~inline-font,domain=~malware_redirection_trains.*
||lasvegas-vacations.net^$doc
||ndsplitter.com^$doc
||ns1.trafficclub.com^$all,~inline-font
@@ -576,9 +576,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! Adblock Plus list maintainer weekly reports
||pinoy-offers.com^
||googleboost.xyz^$doc
||bemobtracks.com^$doc,popup,domain=~malware-redirection-trains.*
||bemobtrk.com^$doc,popup,domain=~malware-redirection-trains.*
||bemobpath.com^$doc,popup,domain=~malware-redirection-trains.*
||bemobtracks.com^$doc,popup,domain=~malware_redirection_trains.*
||bemobtrk.com^$doc,popup,domain=~malware_redirection_trains.*
||bemobpath.com^$doc,popup,domain=~malware_redirection_trains.*
||couponbybox.com^$doc
||newpage.in^$doc
/mcaf04/*=$doc
@@ -3446,7 +3446,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||zfirst-news.com^$all,~inline-font
||zmp3-online.com^$all,~inline-font
||zmusic-online.com^$all,~inline-font
||zredir.com^$all,~inline-font,domain=~malware-redirection-trains.*
||zredir.com^$all,~inline-font,domain=~malware_redirection_trains.*
||178.128.142.109^$doc
*$all,ipaddress=178.128.142.109
||findmedia.biz^$all,~inline-font
@@ -3523,8 +3523,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! https://github.com/DandelionSprout/adfilt/issues/188
||gogle.net^$all,~inline-font
||extragifis.site^$all,~inline-font
||best-prizes-202*.com^$doc,domain=~malware-site.*
||all-best-prize-202*.com^$doc,domain=~malware-site.*
||best-prizes-202*.com^$doc,domain=~malware_site.*
||all-best-prize-202*.com^$doc,domain=~malware_site.*
||captcharesolving-universe.com^$all,~inline-font
||captcharesolver.com^$all,~inline-font
||instantfwding.com^$all,~inline-font
@@ -3532,8 +3532,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||gamesex.fun^$all,~inline-font
||goldprize.xyz^$all,~inline-font
||kmip.net^$all,~inline-font
||0redirc.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirekted.com^$all,~inline-font,domain=~malware-redirection-trains.*
||0redirc.com^$all,~inline-font,domain=~malware_redirection_trains.*
||redirekted.com^$all,~inline-font,domain=~malware_redirection_trains.*
||rebiraert.com^$all,~inline-font
||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$all,~inline-font
||5.8.34.26^$doc
@@ -3778,7 +3778,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||mediagetplus.com^$all,~inline-font
||mgmgmg.com^$all,~inline-font
||temp74.com^$all,~inline-font
||trackwebclick.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trackwebclick.com^$all,~inline-font,domain=~malware_redirection_trains.*
||23.111.31.137^$doc
*$all,ipaddress=23.111.31.137
||23.111.88.207^$doc
@@ -3806,7 +3806,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||apsolutamente.com^$all,~inline-font
||renewal-software-update.com^$all,~inline-font
||pushmeup.art^$all,~inline-font
||trc.*.co^$doc,domain=~malware-redirection-trains.*
||trc.*.co^$doc,domain=~malware_redirection_trains.*
||artofads.co^$doc
||pc-my-protection.xyz^$all,~inline-font
||beta-news.org^$doc
@@ -3967,9 +3967,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||data-px.services^$doc
||newsvot.com^$doc
||adalgard-wol.com^$all,~inline-font
||trkk4.com^$doc,domain=~malware-redirection-trains.*
||trkk4.com^$doc,domain=~malware_redirection_trains.*
||secure-access-*.gate23.xyz^$doc
||hosting-redirect.com^$doc,domain=~malware-redirection-trains.*
||hosting-redirect.com^$doc,domain=~malware_redirection_trains.*
||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^$doc
! https://github.com/DandelionSprout/adfilt/pull/289
||gogles.com^$all,~inline-font
@@ -4178,7 +4178,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||welcomejohncena.pro^$all,~inline-font
||security-scanner.xyz^$all,~inline-font
! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md
&url_bnm_redirect=$all,~inline-font,domain=~malware-redirection-trains.*
&url_bnm_redirect=$all,~inline-font,domain=~malware_redirection_trains.*
/mcafeedirect.jsp$all,domain=~mcafee.com
/beep.mp3^$domain=xyz|club|pro
!!!?next_url=$doc,popup (https://github.com/AdguardTeam/AdguardFilters/issues/108072#issuecomment-1021534226)
@@ -4274,7 +4274,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||delicate-tame-angora.glitch.me^$all,~inline-font
||secureinvoice.glitch.me^$all,~inline-font
||holy-ruddy-brace.glitch.me^$all,~inline-font
||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware-redirection-trains.*
||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware_redirection_trains.*
||instafollow.glitch.me^$all,~inline-font
||loving-discovered-swordfish.glitch.me^$all,~inline-font
||aquamarine-cotton-impala.glitch.me^$all,~inline-font
@@ -4520,7 +4520,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||sites.google.com/view/groundworkssolutions/^$all,~inline-font
||sites.google.com/mytv/maintenance^$all,~inline-font
! https://github.com/AdguardTeam/AdguardFilters/issues/111970
/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$doc,popup,domain=~malware-redirection-trains.*
/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$doc,popup,domain=~malware_redirection_trains.*
! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
||pccrackworld.com^$all,~inline-font
||calsign.xyz^$all,~inline-font
@@ -4582,18 +4582,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||installiq.com^$all,~inline-font
||specgoal.com^$all,~inline-font
||sandhyapi.online^$all,~inline-font
/trk2/*?lddomain=$doc,domain=~very-likely-a-malware-redirection.*
||rtbrvdirect.com^$all,~inline-font,domain=~malware-redirection-trains.*
/trk2/*?lddomain=$doc,domain=~very_likely_a_malware_redirection.*
||rtbrvdirect.com^$all,~inline-font,domain=~malware_redirection_trains.*
||goprotectpc.com^$all,~inline-font
||cpmrevdirect.com^$doc,domain=~malware-redirection-trains.*
||rtbverdirect.com^$doc,domain=~malware-redirection-trains.*
||cpmrevdirect.com^$doc,domain=~malware_redirection_trains.*
||rtbverdirect.com^$doc,domain=~malware_redirection_trains.*
||fsalfrwdr.com^$doc
||cpmvrdirect.com^$doc,domain=~malware-redirection-trains.*
||fadverdirect.com^$doc,domain=~malware-redirection-trains.*
||cpmrvdirect.com^$doc,domain=~malware-redirection-trains.*
||rtbrevdirect.com^$doc,domain=~malware-redirection-trains.*
||rtbvrdirect.com^$doc,domain=~malware-redirection-trains.*
||cpmverdirect.com^$doc,domain=~malware-redirection-trains.*
||cpmvrdirect.com^$doc,domain=~malware_redirection_trains.*
||fadverdirect.com^$doc,domain=~malware_redirection_trains.*
||cpmrvdirect.com^$doc,domain=~malware_redirection_trains.*
||rtbrevdirect.com^$doc,domain=~malware_redirection_trains.*
||rtbvrdirect.com^$doc,domain=~malware_redirection_trains.*
||cpmverdirect.com^$doc,domain=~malware_redirection_trains.*
||15.197.244.48^$doc
*$all,ipaddress=15.197.244.48
||96.47.230.67^$doc
@@ -4617,12 +4617,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
://179.60.146.$doc
!#endif
! https://github.com/AdguardTeam/AdguardFilters/issues/121544
||trafredirtds.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trafredirtds.com^$all,~inline-font,domain=~malware_redirection_trains.*
||com/landers/iphone*_spin$doc
! https://github.com/AdguardTeam/AdguardFilters/issues/121772
||pu020ev.com^$all,~inline-font
||kadam.net^$all,~inline-font
||kdtrk.net^$all,~inline-font,domain=~malware-redirection-trains.*
||kdtrk.net^$all,~inline-font,domain=~malware_redirection_trains.*
||clcpb.net^$all,~inline-font
||kadxin.net^$all,~inline-font
||kdmrqw.com^$all,~inline-font
@@ -4643,9 +4643,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! https://github.com/AdguardTeam/AdguardFilters/issues/122757
://adbrbk.$doc
! https://github.com/AdguardTeam/AdguardFilters/issues/123544
||saferedirects.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
||saferedirects.xyz^$all,~inline-font,domain=~malware_redirection_trains.*
||online-guard.com^$all,~inline-font
/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$doc,popup,domain=~fake-site-with-malware.*
/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$doc,popup,domain=~fake_site_with_malware.*
! https://twitter•com/iam_py_test/status/1545164642346930176
||amazon-security-info.lnk.to^$all,~inline-font
! https://github.com/AdguardTeam/AdguardFilters/issues/123968
@@ -4889,10 +4889,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||tlkn45ssg.cyou^$all,~inline-font
||toprefgtbvatv.com^$all,~inline-font
||tov49ro5ep.art^$all,~inline-font
||track2it4.icu^$all,~inline-font,domain=~malware-redirection-trains.*
||trackerry.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trackgdi.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trckrry.com^$all,~inline-font,domain=~malware-redirection-trains.*
||track2it4.icu^$all,~inline-font,domain=~malware_redirection_trains.*
||trackerry.com^$all,~inline-font,domain=~malware_redirection_trains.*
||trackgdi.com^$all,~inline-font,domain=~malware_redirection_trains.*
||trckrry.com^$all,~inline-font,domain=~malware_redirection_trains.*
||udlwwle.site^$all,~inline-font
||uij5nn-ta.cyou^$all,~inline-font
||uqujzco.xyz^$all,~inline-font
@@ -5092,7 +5092,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||146.19.169.99^$doc
*$all,ipaddress=146.19.169.99
! https://github.com/AdguardTeam/AdguardFilters/issues/132079
/pushredirect/?$doc,domain=~malware-redirection-trains.*
/pushredirect/?$doc,domain=~malware_redirection_trains.*
! https://github.com/AdguardTeam/AdguardFilters/issues/134355
||1000girl.com^$all,~inline-font
||1000islandsinfo.com^$all,~inline-font
@@ -5883,7 +5883,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||keyrug.com^$all,~inline-font
||keysschools.net^$all,~inline-font
||keystonehoops.com^$all,~inline-font
||keywebtracker.com^$all,~inline-font,domain=~malware-redirection-trains.*
||keywebtracker.com^$all,~inline-font,domain=~malware_redirection_trains.*
||keywordadvisetoolplus.com^$all,~inline-font
||kickoff.cm^$all,~inline-font
||kindfirls.com^$all,~inline-font
@@ -6890,7 +6890,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||beskittyan.com^$all,~inline-font
||bigsport.today^$all,~inline-font
||cadbitff.com^$all,~inline-font
||clicktracklink.com^$all,~inline-font,domain=~malware-redirection-trains.*
||clicktracklink.com^$all,~inline-font,domain=~malware_redirection_trains.*
||comivolo.com^$all,~inline-font
||davaifoa.com^$all,~inline-font
||dodurantom.com^$all,~inline-font
@@ -7152,7 +7152,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||4.fo^$doc,popup
||kckb.st^$all,~inline-font
! https://github.com/AdguardTeam/AdguardFilters/issues/139106
-trk.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
-trk.xyz^$all,~inline-font,domain=~malware_redirection_trains.*
||loadingnow.me^$all,~inline-font
||gsecurecontent.com^$all,~inline-font
||pressizer.net^$all,~inline-font
@@ -9771,9 +9771,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||thor-pom.com^$all,~inline-font
||thutm-bru.com^$all,~inline-font
||uthyr-que.com^$all,~inline-font
||zeroredirect1.com^$all,~inline-font,domain=~malware-redirection-trains.*
||zeroredirect1.com^$all,~inline-font,domain=~malware_redirection_trains.*
||zp-dom.com^$all,~inline-font
||redirect.newprogrammatic.click^$doc,domain=~likely-a-malware-redirection.*
||redirect.newprogrammatic.click^$doc,domain=~likely_a_malware_redirection.*
||arcad-hoh.com^$all,~inline-font
||eadri-fnr.com^$all,~inline-font
||gerhi-psv.com^$all,~inline-font
@@ -9825,7 +9825,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||92.204.160.240^$all,~inline-font
*$all,ipaddress=92.204.160.240
! https://github.com/AdguardTeam/AdguardFilters/issues/148560
/land/*&afftrack=$doc,domain=~likely-a-malware-redirection.*
/land/*&afftrack=$doc,domain=~likely_a_malware_redirection.*
! Comments on Slack
||boot-upextremelyquickinfo-product.info^$all,~inline-font
||boot-upextremelyswiftinfo-product.info^$all,~inline-font
@@ -10113,7 +10113,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||horny-neighbour.com^$all,~inline-font
||hornygirlsinapp.com^$all,~inline-font
||jump-path2.com^$all,~inline-font
||redirect-path2.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirect-path2.com^$all,~inline-font,domain=~malware_redirection_trains.*
||your-online-casino.com^$all,~inline-font
||hot-girls-around.com^$all,~inline-font
||how2-become-rich.com^$all,~inline-font
@@ -10139,8 +10139,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||pw-show-ad.com^$all,~inline-font
||pw-show-main.com^$all,~inline-font
||pw-show-test.com^$all,~inline-font
||pwredir-*.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redir-pw*.com^$all,~inline-font,domain=~malware-redirection-trains.*
||pwredir-*.com^$all,~inline-font,domain=~malware_redirection_trains.*
||redir-pw*.com^$all,~inline-font,domain=~malware_redirection_trains.*
||rich-people-club.com^$all,~inline-font
||search-top-videos.com^$all,~inline-font
||secret-casino-site.com^$all,~inline-font
@@ -10512,11 +10512,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||online-notifications.com^$all,~inline-font
||openthenotification.com^$all,~inline-font
||pclkpackg.xyz^$all,~inline-font
||pclkredrct.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
||pclkredrct.xyz^$all,~inline-font,domain=~malware_redirection_trains.*
||popular-messages.com^$all,~inline-font
||premium-news-for.me^$all,~inline-font
||premium-shops-around.me^$all,~inline-font
||pushapitracker.com^$all,~inline-font,domain=~malware-redirection-trains.*
||pushapitracker.com^$all,~inline-font,domain=~malware_redirection_trains.*
||read-and-reveal.com^$all,~inline-font
||read-before-the-rest.com^$all,~inline-font
||read-new-post.com^$all,~inline-font
@@ -10566,7 +10566,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||trending-celeb-news.com^$all,~inline-font
||trending-gossip.com^$all,~inline-font
||trends-celebs.com^$all,~inline-font
||ts-tracker.me^$all,~inline-font,domain=~malware-redirection-trains.*
||ts-tracker.me^$all,~inline-font,domain=~malware_redirection_trains.*
||updates-news-magazine.com^$all,~inline-font
||videochatonlinesite.com^$all,~inline-font
||viralvidoes-buzz-blog.com^$all,~inline-font
@@ -10592,18 +10592,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||collecl.cc^$all,~inline-font
||defre.net^$all,~inline-font
||puredi.net^$all,~inline-font
||redic.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redic2.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redic3.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redic4.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redir2.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir3.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir4.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir5.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir6.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir7.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir8.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir9.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redic.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redic2.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redic3.com^$all,~inline-font,domain=~malware_redirection_trains.*
||redic4.com^$all,~inline-font,domain=~malware_redirection_trains.*
||redir2.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir3.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir4.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir5.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir6.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir7.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir8.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir9.net^$all,~inline-font,domain=~malware_redirection_trains.*
||rejco.online^$all,~inline-font
||spinwincas.online^$all,~inline-font
||tapore.net^$all,~inline-font
@@ -10867,7 +10867,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||glaingoo.xyz^$all,~inline-font
||glefeesh.net^$all,~inline-font
||gliceebe.xyz^$all,~inline-font
||go.redirected*/click?^$doc,popup,domain=~malware-redirection-trains.*
||go.redirected*/click?^$doc,popup,domain=~malware_redirection_trains.*
||goldfishka-casino.xyz^$all,~inline-font
||gousauhu.xyz^$all,~inline-font
||gphyvg.com^$all,~inline-font
@@ -11133,7 +11133,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||rahfnq.com^$all,~inline-font
||raybhi.com^$all,~inline-font
||rcqmrz.com^$all,~inline-font
||redirected1.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirected1.com^$all,~inline-font,domain=~malware_redirection_trains.*
||rfduik.com^$all,~inline-font
||rgitpv.com^$all,~inline-font
||riaeqd.com^$all,~inline-font
@@ -11676,7 +11676,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||searchassured.com^$all,~inline-font
||searchequivalents.com^$all,~inline-font
||searchexcellent.com^$all,~inline-font
||searchingredirect.com^$all,~inline-font,domain=~malware-redirection-trains.*
||searchingredirect.com^$all,~inline-font,domain=~malware_redirection_trains.*
||searchinquire.com^$all,~inline-font
||searchsimilars.com^$all,~inline-font
||searchstarters.com^$all,~inline-font
@@ -15329,7 +15329,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||zapdescendant.com^$all,~inline-font
||zapprecisionadmire.com^$all,~inline-font
||zealousstraitcommit.com^$all,~inline-font
://trk.*.run/$document,domain=~very-likely-a-malware-redirection-train.*
://trk.*.run/$document,domain=~very_likely_a_malware_redirection_train.*
! https://github.com/AdguardTeam/AdguardFilters/issues/159157
||apbbjmp.com^$all,~inline-font
||awbbgate.com^$all,~inline-font
@@ -15395,7 +15395,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||charutboll.com^$all,~inline-font
||chaseverifications.com^$all,~inline-font
||cloud-network.online^$all,~inline-font
||cmcmdirrect.com^$all,~inline-font,domain=~malware-redirection-trains.*
||cmcmdirrect.com^$all,~inline-font,domain=~malware_redirection_trains.*
||coltersaidas.com^$all,~inline-font
||com-96-hours.com^$all,~inline-font
||com-96hours.com^$all,~inline-font
@@ -15520,7 +15520,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||paywide.cards^$all,~inline-font
||promo-carte-avantages.com^$all,~inline-font
||qc1.site^$all,~inline-font
||redirect2url.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirect2url.com^$all,~inline-font,domain=~malware_redirection_trains.*
||revoiut-cy.com^$all,~inline-font
||revoke.money^$all,~inline-font
||richiediilrimborso.com^$all,~inline-font
@@ -15734,12 +15734,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||usqtvc.com$all,~inline-font
||usutnr.top$all,~inline-font
||204.44.92.187$all,~inline-font
://ap-trk.$all,~inline-font,domain=~malware-redirection-trains.*
://cw-trk.$all,~inline-font,domain=~malware-redirection-trains.*
://cw-trak.$all,~inline-font,domain=~malware-redirection-trains.*
://ktraks.$all,~inline-font,domain=~malware-redirection-trains.*
://flow-clck.$all,~inline-font,domain=~malware-redirection-trains.*
://apps-trk.$all,~inline-font,domain=~malware-redirection-trains.*
://ap-trk.$all,~inline-font,domain=~malware_redirection_trains.*
://cw-trk.$all,~inline-font,domain=~malware_redirection_trains.*
://cw-trak.$all,~inline-font,domain=~malware_redirection_trains.*
://ktraks.$all,~inline-font,domain=~malware_redirection_trains.*
://flow-clck.$all,~inline-font,domain=~malware_redirection_trains.*
://apps-trk.$all,~inline-font,domain=~malware_redirection_trains.*
! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103
||betzykrisesenter.no^$doc
||citra2010oslo.no^$doc
@@ -30791,7 +30791,7 @@ toorgle.net##.join
||nickswheels.com^$all,~inline-font
||spizzicopizza.net^$all,~inline-font
! Other
||redirectme.net^$doc,domain=~malware-redirection-trains.*
||redirectme.net^$doc,domain=~malware_redirection_trains.*
||anthargo.com^$doc
! Domains on IPs known to host Discord Nitro spambots
||cabura.loan^$all,~inline-font
@@ -31353,8 +31353,8 @@ toorgle.net##.join
! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
apkfab.com##.tip-extension
! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022)
||xxlmag.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||xxlmag.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||2y68554.cyou^$all,~inline-font
||1pwk1j.cyou^$all,~inline-font
||986.group^$all,~inline-font
@@ -31362,10 +31362,10 @@ apkfab.com##.tip-extension
*$all,ipaddress=185.87.148.199
! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022)
||imaot.co.il/ContentArea/BannerClick^$all,~inline-font
||q1065.fm/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||wobm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||us105fm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||wnbf.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||q1065.fm/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||wobm.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||us105fm.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||wnbf.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||ynxqoc2.cyou^$all,~inline-font
||resurrectionlinks.online^$all,~inline-font
||canon70x70.site^$all,~inline-font
@@ -31373,8 +31373,8 @@ apkfab.com##.tip-extension
||zh1653.com^$all,~inline-font
||45.136.49.35^$doc
*$all,ipaddress=45.136.49.35
||semex.com/popurl.cgi^$all,~inline-font,domain=~malware-redirection-results.*
||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware-redirection-results.*
||semex.com/popurl.cgi^$all,~inline-font,domain=~malware_redirection_results.*
||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware_redirection_results.*
! Browsing around for Tajik newssites
||arhernot.live^$all,~inline-font
||lifelongkick.live^$all,~inline-font
@@ -31440,7 +31440,7 @@ apkfab.com##.tip-extension
||highlandnews.com^$all,~inline-font
||genuinescansupport.com^$all,~inline-font
||diverseflowlink.com^$all,~inline-font
||redirectedflow.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirectedflow.com^$all,~inline-font,domain=~malware_redirection_trains.*
||pcbasicstrength.com^$all,~inline-font
||varietyflow.com^$all,~inline-font
||securecertainflow.com^$all,~inline-font
@@ -31513,8 +31513,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||34.80.59.191^$all,~inline-font
*$all,ipaddress=34.80.59.191
! Various domains on https://securitytrails•com/list/ip/72•14•178•174
|http://www6.$doc,domain=~often-used-in-malware-redirections.*
|http://www1.*&kw$doc,domain=~often-used-in-malware-redirections.*
|http://www6.$doc,domain=~often_used_in_malware_redirections.*
|http://www1.*&kw$doc,domain=~often_used_in_malware_redirections.*
||megabooru.com^$all,~inline-font
||zombooru.com^$all,~inline-font
||kusubooru.com^$all,~inline-font
@@ -31581,7 +31581,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||awesomewinner.com^$all,~inline-font
||awesomewinner.net^$all,~inline-font
||awesomewinners.net^$all,~inline-font
||b2ztrk.com^$all,~inline-font,domain=~malware-redirection-trains.*
||b2ztrk.com^$all,~inline-font,domain=~malware_redirection_trains.*
||beastgadget.net^$all,~inline-font
||beastoffer.net^$all,~inline-font
||beastoffrs.com^$all,~inline-font
@@ -31901,7 +31901,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||winnerssite.net^$all,~inline-font
||xyzoffer.net^$all,~inline-font
||yasdoodl.com^$all,~inline-font
||ym3trk.com^$all,~inline-font,domain=~malware-redirection-trains.*
||ym3trk.com^$all,~inline-font,domain=~malware_redirection_trains.*
||youwanthis.com^$all,~inline-font
||zebramode.com^$all,~inline-font
||zebraoffers.net^$all,~inline-font
@@ -32382,9 +32382,9 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||wirexapp.africa.com^$all
! Google results for «SodaStream site:no cranberry»
/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware-redirection-results.*
||adservice.google.*/ddm/clk/$doc,domain=~malware-redirection-results.*
/ad_click/q?&url=$doc,domain=~malware-redirection-results.*
/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware_redirection_results.*
||adservice.google.*/ddm/clk/$doc,domain=~malware_redirection_results.*
/ad_click/q?&url=$doc,domain=~malware_redirection_results.*
! Laughably blatant fraud site
||cosercosplay.com^$all,~inline-font
! Fraudulent art thefts for money on Google Image Search, e.g. 'cassandra tangled site:tumblr.com suit'
@@ -33578,13 +33578,13 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr
! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
||unofficialtwrp.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidweblog.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidgreek.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||ytechb.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetstwist.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetsfarms.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||techorfy.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||unofficialtwrp.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||androidweblog.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||androidgreek.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||ytechb.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||gadgetstwist.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||gadgetsfarms.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||techorfy.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
!#if false
! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
@@ -33606,47 +33606,47 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr
://ww7.$doc,domain=~ww7.be|~ww7.readsnk.com|~ww7.autotask.net
!!!://ww8.$doc,domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com|~ww8.autotask.net (Needed way more whitelistings than I had expected.)
://ww9.$doc,domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br|~ww9.autotask.net
://ww10.$doc,domain=~ww10.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww11.$doc,domain=~ww11.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww12.$doc,domain=~ww12.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww13.$doc,domain=~ww13.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww14.$doc,domain=~ww14.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww15.$doc,domain=~ww15.nl|~ww15.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww16.$doc,domain=~ww16.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww17.$doc,domain=~ww17.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww18.$doc,domain=~ww18.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww19.$doc,domain=~ww19.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww20.$doc,domain=~ww20.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww21.$doc,domain=~ww21.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww22.$doc,domain=~ww22.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww23.$doc,domain=~ww23.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww24.$doc,domain=~ww24.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww25.$doc,domain=~ww25.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww26.$doc,domain=~ww26.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww27.$doc,domain=~ww27.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww28.$doc,domain=~ww28.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww29.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww30.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww31.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww32.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww33.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww34.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww35.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww36.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww37.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww38.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww39.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww40.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww41.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww42.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww43.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww44.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww45.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww46.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww47.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww48.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww49.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww50.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww10.$doc,domain=~ww10.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww11.$doc,domain=~ww11.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww12.$doc,domain=~ww12.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww13.$doc,domain=~ww13.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww14.$doc,domain=~ww14.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww15.$doc,domain=~ww15.nl|~ww15.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww16.$doc,domain=~ww16.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww17.$doc,domain=~ww17.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww18.$doc,domain=~ww18.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww19.$doc,domain=~ww19.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww20.$doc,domain=~ww20.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww21.$doc,domain=~ww21.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww22.$doc,domain=~ww22.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww23.$doc,domain=~ww23.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww24.$doc,domain=~ww24.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww25.$doc,domain=~ww25.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww26.$doc,domain=~ww26.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww27.$doc,domain=~ww27.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww28.$doc,domain=~ww28.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww29.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww30.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww31.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww32.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww33.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww34.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww35.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww36.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww37.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww38.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww39.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww40.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww41.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww42.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww43.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww44.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww45.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww46.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww47.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww48.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww49.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww50.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ———
!!!/\\/$doc