From 1f3d8d412555abbf6550be4daa63ba5372380e55 Mon Sep 17 00:00:00 2001 From: Imre Eilertsen Date: Sun, 9 Feb 2025 22:31:27 +0100 Subject: [PATCH] Update Dandelion Sprout's Anti-Malware List.txt Tests with uBO 1.62.1b0 seemed to fully support this syntax. --- Dandelion Sprout's Anti-Malware List.txt | 284 +++++++++++------------ 1 file changed, 142 insertions(+), 142 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index c9f7a4e10..72bb2f82b 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 07February2025v2 +! Version: 09February2025v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -397,7 +397,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||wix.cm^$doc,domain=~malware-typo-squatter-of-wix.com ||199.59.243.222^$doc *$all,ipaddress=199.59.243.222 -|http://ww01.$doc,domain=~very-very-extremely-frequently-used-in-malware-redirections.* +|http://ww01.$doc,domain=~very_very_extremely_frequently_used_in_malware_redirections.* ||14d.us^$all,~inline-font,domain=~malware-redirection-and-also-you-were-very-likely-looking-for-1d4.us ||173.208.96.42^$all,~inline-font *$all,ipaddress=173.208.96.42 @@ -510,7 +510,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||proserpina-zeb.com^$all,~inline-font ||lordagty.com^$doc ||madagty.com^$doc -||zeroredirect5.com^$doc,domain=~malware-redirection-trains.* +||zeroredirect5.com^$doc,domain=~malware_redirection_trains.* ||54.209.22.226^$doc *$all,ipaddress=54.209.22.226 ||54.91.125.197^$doc @@ -529,7 +529,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) *$all,ipaddress=3.216.243.46 ||roamingclicks.com^$all,~inline-font ! Source: desidertNO -||collectfasttracks.com^$all,~inline-font,domain=~malware-redirection-trains.* +||collectfasttracks.com^$all,~inline-font,domain=~malware_redirection_trains.* ! Source: vn-zoomCOM ||ttnrd.com^$all,~inline-font ||amanda.*.com^$doc @@ -544,9 +544,9 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||3.90.125.85^$doc *$all,ipaddress=3.90.125.85 ! Various ex-affiliate links at www•zombooru•com -||track.vcdc.com^$all,~inline-font,domain=~malware-redirection-trains.* -||track.tkbo.com^$all,~inline-font,domain=~malware-redirection-trains.* -||track.traffic.club^$all,~inline-font,domain=~malware-redirection-trains.* +||track.vcdc.com^$all,~inline-font,domain=~malware_redirection_trains.* +||track.tkbo.com^$all,~inline-font,domain=~malware_redirection_trains.* +||track.traffic.club^$all,~inline-font,domain=~malware_redirection_trains.* ||lasvegas-vacations.net^$doc ||ndsplitter.com^$doc ||ns1.trafficclub.com^$all,~inline-font @@ -576,9 +576,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! Adblock Plus list maintainer weekly reports ||pinoy-offers.com^ ||googleboost.xyz^$doc -||bemobtracks.com^$doc,popup,domain=~malware-redirection-trains.* -||bemobtrk.com^$doc,popup,domain=~malware-redirection-trains.* -||bemobpath.com^$doc,popup,domain=~malware-redirection-trains.* +||bemobtracks.com^$doc,popup,domain=~malware_redirection_trains.* +||bemobtrk.com^$doc,popup,domain=~malware_redirection_trains.* +||bemobpath.com^$doc,popup,domain=~malware_redirection_trains.* ||couponbybox.com^$doc ||newpage.in^$doc /mcaf04/*=$doc @@ -3446,7 +3446,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zfirst-news.com^$all,~inline-font ||zmp3-online.com^$all,~inline-font ||zmusic-online.com^$all,~inline-font -||zredir.com^$all,~inline-font,domain=~malware-redirection-trains.* +||zredir.com^$all,~inline-font,domain=~malware_redirection_trains.* ||178.128.142.109^$doc *$all,ipaddress=178.128.142.109 ||findmedia.biz^$all,~inline-font @@ -3523,8 +3523,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/issues/188 ||gogle.net^$all,~inline-font ||extragifis.site^$all,~inline-font -||best-prizes-202*.com^$doc,domain=~malware-site.* -||all-best-prize-202*.com^$doc,domain=~malware-site.* +||best-prizes-202*.com^$doc,domain=~malware_site.* +||all-best-prize-202*.com^$doc,domain=~malware_site.* ||captcharesolving-universe.com^$all,~inline-font ||captcharesolver.com^$all,~inline-font ||instantfwding.com^$all,~inline-font @@ -3532,8 +3532,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||gamesex.fun^$all,~inline-font ||goldprize.xyz^$all,~inline-font ||kmip.net^$all,~inline-font -||0redirc.com^$all,~inline-font,domain=~malware-redirection-trains.* -||redirekted.com^$all,~inline-font,domain=~malware-redirection-trains.* +||0redirc.com^$all,~inline-font,domain=~malware_redirection_trains.* +||redirekted.com^$all,~inline-font,domain=~malware_redirection_trains.* ||rebiraert.com^$all,~inline-font ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$all,~inline-font ||5.8.34.26^$doc @@ -3778,7 +3778,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||mediagetplus.com^$all,~inline-font ||mgmgmg.com^$all,~inline-font ||temp74.com^$all,~inline-font -||trackwebclick.com^$all,~inline-font,domain=~malware-redirection-trains.* +||trackwebclick.com^$all,~inline-font,domain=~malware_redirection_trains.* ||23.111.31.137^$doc *$all,ipaddress=23.111.31.137 ||23.111.88.207^$doc @@ -3806,7 +3806,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||apsolutamente.com^$all,~inline-font ||renewal-software-update.com^$all,~inline-font ||pushmeup.art^$all,~inline-font -||trc.*.co^$doc,domain=~malware-redirection-trains.* +||trc.*.co^$doc,domain=~malware_redirection_trains.* ||artofads.co^$doc ||pc-my-protection.xyz^$all,~inline-font ||beta-news.org^$doc @@ -3967,9 +3967,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||data-px.services^$doc ||newsvot.com^$doc ||adalgard-wol.com^$all,~inline-font -||trkk4.com^$doc,domain=~malware-redirection-trains.* +||trkk4.com^$doc,domain=~malware_redirection_trains.* ||secure-access-*.gate23.xyz^$doc -||hosting-redirect.com^$doc,domain=~malware-redirection-trains.* +||hosting-redirect.com^$doc,domain=~malware_redirection_trains.* ||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^$doc ! https://github.com/DandelionSprout/adfilt/pull/289 ||gogles.com^$all,~inline-font @@ -4178,7 +4178,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||welcomejohncena.pro^$all,~inline-font ||security-scanner.xyz^$all,~inline-font ! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md -&url_bnm_redirect=$all,~inline-font,domain=~malware-redirection-trains.* +&url_bnm_redirect=$all,~inline-font,domain=~malware_redirection_trains.* /mcafeedirect.jsp$all,domain=~mcafee.com /beep.mp3^$domain=xyz|club|pro !!!?next_url=$doc,popup (https://github.com/AdguardTeam/AdguardFilters/issues/108072#issuecomment-1021534226) @@ -4274,7 +4274,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||delicate-tame-angora.glitch.me^$all,~inline-font ||secureinvoice.glitch.me^$all,~inline-font ||holy-ruddy-brace.glitch.me^$all,~inline-font -||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware-redirection-trains.* +||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware_redirection_trains.* ||instafollow.glitch.me^$all,~inline-font ||loving-discovered-swordfish.glitch.me^$all,~inline-font ||aquamarine-cotton-impala.glitch.me^$all,~inline-font @@ -4520,7 +4520,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sites.google.com/view/groundworkssolutions/^$all,~inline-font ||sites.google.com/mytv/maintenance^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 -/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$doc,popup,domain=~malware-redirection-trains.* +/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$doc,popup,domain=~malware_redirection_trains.* ! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^$all,~inline-font ||calsign.xyz^$all,~inline-font @@ -4582,18 +4582,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||installiq.com^$all,~inline-font ||specgoal.com^$all,~inline-font ||sandhyapi.online^$all,~inline-font -/trk2/*?lddomain=$doc,domain=~very-likely-a-malware-redirection.* -||rtbrvdirect.com^$all,~inline-font,domain=~malware-redirection-trains.* +/trk2/*?lddomain=$doc,domain=~very_likely_a_malware_redirection.* +||rtbrvdirect.com^$all,~inline-font,domain=~malware_redirection_trains.* ||goprotectpc.com^$all,~inline-font -||cpmrevdirect.com^$doc,domain=~malware-redirection-trains.* -||rtbverdirect.com^$doc,domain=~malware-redirection-trains.* +||cpmrevdirect.com^$doc,domain=~malware_redirection_trains.* +||rtbverdirect.com^$doc,domain=~malware_redirection_trains.* ||fsalfrwdr.com^$doc -||cpmvrdirect.com^$doc,domain=~malware-redirection-trains.* -||fadverdirect.com^$doc,domain=~malware-redirection-trains.* -||cpmrvdirect.com^$doc,domain=~malware-redirection-trains.* -||rtbrevdirect.com^$doc,domain=~malware-redirection-trains.* -||rtbvrdirect.com^$doc,domain=~malware-redirection-trains.* -||cpmverdirect.com^$doc,domain=~malware-redirection-trains.* +||cpmvrdirect.com^$doc,domain=~malware_redirection_trains.* +||fadverdirect.com^$doc,domain=~malware_redirection_trains.* +||cpmrvdirect.com^$doc,domain=~malware_redirection_trains.* +||rtbrevdirect.com^$doc,domain=~malware_redirection_trains.* +||rtbvrdirect.com^$doc,domain=~malware_redirection_trains.* +||cpmverdirect.com^$doc,domain=~malware_redirection_trains.* ||15.197.244.48^$doc *$all,ipaddress=15.197.244.48 ||96.47.230.67^$doc @@ -4617,12 +4617,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ://179.60.146.$doc !#endif ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 -||trafredirtds.com^$all,~inline-font,domain=~malware-redirection-trains.* +||trafredirtds.com^$all,~inline-font,domain=~malware_redirection_trains.* ||com/landers/iphone*_spin$doc ! https://github.com/AdguardTeam/AdguardFilters/issues/121772 ||pu020ev.com^$all,~inline-font ||kadam.net^$all,~inline-font -||kdtrk.net^$all,~inline-font,domain=~malware-redirection-trains.* +||kdtrk.net^$all,~inline-font,domain=~malware_redirection_trains.* ||clcpb.net^$all,~inline-font ||kadxin.net^$all,~inline-font ||kdmrqw.com^$all,~inline-font @@ -4643,9 +4643,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk.$doc ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 -||saferedirects.xyz^$all,~inline-font,domain=~malware-redirection-trains.* +||saferedirects.xyz^$all,~inline-font,domain=~malware_redirection_trains.* ||online-guard.com^$all,~inline-font -/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$doc,popup,domain=~fake-site-with-malware.* +/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$doc,popup,domain=~fake_site_with_malware.* ! https://twitter•com/iam_py_test/status/1545164642346930176 ||amazon-security-info.lnk.to^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/123968 @@ -4889,10 +4889,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||tlkn45ssg.cyou^$all,~inline-font ||toprefgtbvatv.com^$all,~inline-font ||tov49ro5ep.art^$all,~inline-font -||track2it4.icu^$all,~inline-font,domain=~malware-redirection-trains.* -||trackerry.com^$all,~inline-font,domain=~malware-redirection-trains.* -||trackgdi.com^$all,~inline-font,domain=~malware-redirection-trains.* -||trckrry.com^$all,~inline-font,domain=~malware-redirection-trains.* +||track2it4.icu^$all,~inline-font,domain=~malware_redirection_trains.* +||trackerry.com^$all,~inline-font,domain=~malware_redirection_trains.* +||trackgdi.com^$all,~inline-font,domain=~malware_redirection_trains.* +||trckrry.com^$all,~inline-font,domain=~malware_redirection_trains.* ||udlwwle.site^$all,~inline-font ||uij5nn-ta.cyou^$all,~inline-font ||uqujzco.xyz^$all,~inline-font @@ -5092,7 +5092,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||146.19.169.99^$doc *$all,ipaddress=146.19.169.99 ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 -/pushredirect/?$doc,domain=~malware-redirection-trains.* +/pushredirect/?$doc,domain=~malware_redirection_trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 ||1000girl.com^$all,~inline-font ||1000islandsinfo.com^$all,~inline-font @@ -5883,7 +5883,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||keyrug.com^$all,~inline-font ||keysschools.net^$all,~inline-font ||keystonehoops.com^$all,~inline-font -||keywebtracker.com^$all,~inline-font,domain=~malware-redirection-trains.* +||keywebtracker.com^$all,~inline-font,domain=~malware_redirection_trains.* ||keywordadvisetoolplus.com^$all,~inline-font ||kickoff.cm^$all,~inline-font ||kindfirls.com^$all,~inline-font @@ -6890,7 +6890,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||beskittyan.com^$all,~inline-font ||bigsport.today^$all,~inline-font ||cadbitff.com^$all,~inline-font -||clicktracklink.com^$all,~inline-font,domain=~malware-redirection-trains.* +||clicktracklink.com^$all,~inline-font,domain=~malware_redirection_trains.* ||comivolo.com^$all,~inline-font ||davaifoa.com^$all,~inline-font ||dodurantom.com^$all,~inline-font @@ -7152,7 +7152,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||4.fo^$doc,popup ||kckb.st^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 --trk.xyz^$all,~inline-font,domain=~malware-redirection-trains.* +-trk.xyz^$all,~inline-font,domain=~malware_redirection_trains.* ||loadingnow.me^$all,~inline-font ||gsecurecontent.com^$all,~inline-font ||pressizer.net^$all,~inline-font @@ -9771,9 +9771,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||thor-pom.com^$all,~inline-font ||thutm-bru.com^$all,~inline-font ||uthyr-que.com^$all,~inline-font -||zeroredirect1.com^$all,~inline-font,domain=~malware-redirection-trains.* +||zeroredirect1.com^$all,~inline-font,domain=~malware_redirection_trains.* ||zp-dom.com^$all,~inline-font -||redirect.newprogrammatic.click^$doc,domain=~likely-a-malware-redirection.* +||redirect.newprogrammatic.click^$doc,domain=~likely_a_malware_redirection.* ||arcad-hoh.com^$all,~inline-font ||eadri-fnr.com^$all,~inline-font ||gerhi-psv.com^$all,~inline-font @@ -9825,7 +9825,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||92.204.160.240^$all,~inline-font *$all,ipaddress=92.204.160.240 ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 -/land/*&afftrack=$doc,domain=~likely-a-malware-redirection.* +/land/*&afftrack=$doc,domain=~likely_a_malware_redirection.* ! Comments on Slack ||boot-upextremelyquickinfo-product.info^$all,~inline-font ||boot-upextremelyswiftinfo-product.info^$all,~inline-font @@ -10113,7 +10113,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||horny-neighbour.com^$all,~inline-font ||hornygirlsinapp.com^$all,~inline-font ||jump-path2.com^$all,~inline-font -||redirect-path2.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirect-path2.com^$all,~inline-font,domain=~malware_redirection_trains.* ||your-online-casino.com^$all,~inline-font ||hot-girls-around.com^$all,~inline-font ||how2-become-rich.com^$all,~inline-font @@ -10139,8 +10139,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||pw-show-ad.com^$all,~inline-font ||pw-show-main.com^$all,~inline-font ||pw-show-test.com^$all,~inline-font -||pwredir-*.com^$all,~inline-font,domain=~malware-redirection-trains.* -||redir-pw*.com^$all,~inline-font,domain=~malware-redirection-trains.* +||pwredir-*.com^$all,~inline-font,domain=~malware_redirection_trains.* +||redir-pw*.com^$all,~inline-font,domain=~malware_redirection_trains.* ||rich-people-club.com^$all,~inline-font ||search-top-videos.com^$all,~inline-font ||secret-casino-site.com^$all,~inline-font @@ -10512,11 +10512,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||online-notifications.com^$all,~inline-font ||openthenotification.com^$all,~inline-font ||pclkpackg.xyz^$all,~inline-font -||pclkredrct.xyz^$all,~inline-font,domain=~malware-redirection-trains.* +||pclkredrct.xyz^$all,~inline-font,domain=~malware_redirection_trains.* ||popular-messages.com^$all,~inline-font ||premium-news-for.me^$all,~inline-font ||premium-shops-around.me^$all,~inline-font -||pushapitracker.com^$all,~inline-font,domain=~malware-redirection-trains.* +||pushapitracker.com^$all,~inline-font,domain=~malware_redirection_trains.* ||read-and-reveal.com^$all,~inline-font ||read-before-the-rest.com^$all,~inline-font ||read-new-post.com^$all,~inline-font @@ -10566,7 +10566,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||trending-celeb-news.com^$all,~inline-font ||trending-gossip.com^$all,~inline-font ||trends-celebs.com^$all,~inline-font -||ts-tracker.me^$all,~inline-font,domain=~malware-redirection-trains.* +||ts-tracker.me^$all,~inline-font,domain=~malware_redirection_trains.* ||updates-news-magazine.com^$all,~inline-font ||videochatonlinesite.com^$all,~inline-font ||viralvidoes-buzz-blog.com^$all,~inline-font @@ -10592,18 +10592,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||collecl.cc^$all,~inline-font ||defre.net^$all,~inline-font ||puredi.net^$all,~inline-font -||redic.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redic2.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redic3.com^$all,~inline-font,domain=~malware-redirection-trains.* -||redic4.com^$all,~inline-font,domain=~malware-redirection-trains.* -||redir2.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir3.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir4.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir5.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir6.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir7.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir8.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir9.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redic.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redic2.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redic3.com^$all,~inline-font,domain=~malware_redirection_trains.* +||redic4.com^$all,~inline-font,domain=~malware_redirection_trains.* +||redir2.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir3.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir4.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir5.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir6.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir7.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir8.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir9.net^$all,~inline-font,domain=~malware_redirection_trains.* ||rejco.online^$all,~inline-font ||spinwincas.online^$all,~inline-font ||tapore.net^$all,~inline-font @@ -10867,7 +10867,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||glaingoo.xyz^$all,~inline-font ||glefeesh.net^$all,~inline-font ||gliceebe.xyz^$all,~inline-font -||go.redirected*/click?^$doc,popup,domain=~malware-redirection-trains.* +||go.redirected*/click?^$doc,popup,domain=~malware_redirection_trains.* ||goldfishka-casino.xyz^$all,~inline-font ||gousauhu.xyz^$all,~inline-font ||gphyvg.com^$all,~inline-font @@ -11133,7 +11133,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||rahfnq.com^$all,~inline-font ||raybhi.com^$all,~inline-font ||rcqmrz.com^$all,~inline-font -||redirected1.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirected1.com^$all,~inline-font,domain=~malware_redirection_trains.* ||rfduik.com^$all,~inline-font ||rgitpv.com^$all,~inline-font ||riaeqd.com^$all,~inline-font @@ -11676,7 +11676,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||searchassured.com^$all,~inline-font ||searchequivalents.com^$all,~inline-font ||searchexcellent.com^$all,~inline-font -||searchingredirect.com^$all,~inline-font,domain=~malware-redirection-trains.* +||searchingredirect.com^$all,~inline-font,domain=~malware_redirection_trains.* ||searchinquire.com^$all,~inline-font ||searchsimilars.com^$all,~inline-font ||searchstarters.com^$all,~inline-font @@ -15329,7 +15329,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zapdescendant.com^$all,~inline-font ||zapprecisionadmire.com^$all,~inline-font ||zealousstraitcommit.com^$all,~inline-font -://trk.*.run/$document,domain=~very-likely-a-malware-redirection-train.* +://trk.*.run/$document,domain=~very_likely_a_malware_redirection_train.* ! https://github.com/AdguardTeam/AdguardFilters/issues/159157 ||apbbjmp.com^$all,~inline-font ||awbbgate.com^$all,~inline-font @@ -15395,7 +15395,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||charutboll.com^$all,~inline-font ||chaseverifications.com^$all,~inline-font ||cloud-network.online^$all,~inline-font -||cmcmdirrect.com^$all,~inline-font,domain=~malware-redirection-trains.* +||cmcmdirrect.com^$all,~inline-font,domain=~malware_redirection_trains.* ||coltersaidas.com^$all,~inline-font ||com-96-hours.com^$all,~inline-font ||com-96hours.com^$all,~inline-font @@ -15520,7 +15520,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||paywide.cards^$all,~inline-font ||promo-carte-avantages.com^$all,~inline-font ||qc1.site^$all,~inline-font -||redirect2url.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirect2url.com^$all,~inline-font,domain=~malware_redirection_trains.* ||revoiut-cy.com^$all,~inline-font ||revoke.money^$all,~inline-font ||richiediilrimborso.com^$all,~inline-font @@ -15734,12 +15734,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||usqtvc.com$all,~inline-font ||usutnr.top$all,~inline-font ||204.44.92.187$all,~inline-font -://ap-trk.$all,~inline-font,domain=~malware-redirection-trains.* -://cw-trk.$all,~inline-font,domain=~malware-redirection-trains.* -://cw-trak.$all,~inline-font,domain=~malware-redirection-trains.* -://ktraks.$all,~inline-font,domain=~malware-redirection-trains.* -://flow-clck.$all,~inline-font,domain=~malware-redirection-trains.* -://apps-trk.$all,~inline-font,domain=~malware-redirection-trains.* +://ap-trk.$all,~inline-font,domain=~malware_redirection_trains.* +://cw-trk.$all,~inline-font,domain=~malware_redirection_trains.* +://cw-trak.$all,~inline-font,domain=~malware_redirection_trains.* +://ktraks.$all,~inline-font,domain=~malware_redirection_trains.* +://flow-clck.$all,~inline-font,domain=~malware_redirection_trains.* +://apps-trk.$all,~inline-font,domain=~malware_redirection_trains.* ! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103 ||betzykrisesenter.no^$doc ||citra2010oslo.no^$doc @@ -30791,7 +30791,7 @@ toorgle.net##.join ||nickswheels.com^$all,~inline-font ||spizzicopizza.net^$all,~inline-font ! Other -||redirectme.net^$doc,domain=~malware-redirection-trains.* +||redirectme.net^$doc,domain=~malware_redirection_trains.* ||anthargo.com^$doc ! Domains on IPs known to host Discord Nitro spambots ||cabura.loan^$all,~inline-font @@ -31353,8 +31353,8 @@ toorgle.net##.join ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious apkfab.com##.tip-extension ! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022) -||xxlmag.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* -||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* +||xxlmag.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* +||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* ||2y68554.cyou^$all,~inline-font ||1pwk1j.cyou^$all,~inline-font ||986.group^$all,~inline-font @@ -31362,10 +31362,10 @@ apkfab.com##.tip-extension *$all,ipaddress=185.87.148.199 ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) ||imaot.co.il/ContentArea/BannerClick^$all,~inline-font -||q1065.fm/redirect^$all,~inline-font,domain=~malware-redirection-results.* -||wobm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* -||us105fm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* -||wnbf.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* +||q1065.fm/redirect^$all,~inline-font,domain=~malware_redirection_results.* +||wobm.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* +||us105fm.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* +||wnbf.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* ||ynxqoc2.cyou^$all,~inline-font ||resurrectionlinks.online^$all,~inline-font ||canon70x70.site^$all,~inline-font @@ -31373,8 +31373,8 @@ apkfab.com##.tip-extension ||zh1653.com^$all,~inline-font ||45.136.49.35^$doc *$all,ipaddress=45.136.49.35 -||semex.com/popurl.cgi^$all,~inline-font,domain=~malware-redirection-results.* -||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware-redirection-results.* +||semex.com/popurl.cgi^$all,~inline-font,domain=~malware_redirection_results.* +||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware_redirection_results.* ! Browsing around for Tajik newssites ||arhernot.live^$all,~inline-font ||lifelongkick.live^$all,~inline-font @@ -31440,7 +31440,7 @@ apkfab.com##.tip-extension ||highlandnews.com^$all,~inline-font ||genuinescansupport.com^$all,~inline-font ||diverseflowlink.com^$all,~inline-font -||redirectedflow.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirectedflow.com^$all,~inline-font,domain=~malware_redirection_trains.* ||pcbasicstrength.com^$all,~inline-font ||varietyflow.com^$all,~inline-font ||securecertainflow.com^$all,~inline-font @@ -31513,8 +31513,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||34.80.59.191^$all,~inline-font *$all,ipaddress=34.80.59.191 ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 -|http://www6.$doc,domain=~often-used-in-malware-redirections.* -|http://www1.*&kw$doc,domain=~often-used-in-malware-redirections.* +|http://www6.$doc,domain=~often_used_in_malware_redirections.* +|http://www1.*&kw$doc,domain=~often_used_in_malware_redirections.* ||megabooru.com^$all,~inline-font ||zombooru.com^$all,~inline-font ||kusubooru.com^$all,~inline-font @@ -31581,7 +31581,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||awesomewinner.com^$all,~inline-font ||awesomewinner.net^$all,~inline-font ||awesomewinners.net^$all,~inline-font -||b2ztrk.com^$all,~inline-font,domain=~malware-redirection-trains.* +||b2ztrk.com^$all,~inline-font,domain=~malware_redirection_trains.* ||beastgadget.net^$all,~inline-font ||beastoffer.net^$all,~inline-font ||beastoffrs.com^$all,~inline-font @@ -31901,7 +31901,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||winnerssite.net^$all,~inline-font ||xyzoffer.net^$all,~inline-font ||yasdoodl.com^$all,~inline-font -||ym3trk.com^$all,~inline-font,domain=~malware-redirection-trains.* +||ym3trk.com^$all,~inline-font,domain=~malware_redirection_trains.* ||youwanthis.com^$all,~inline-font ||zebramode.com^$all,~inline-font ||zebraoffers.net^$all,~inline-font @@ -32382,9 +32382,9 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||wirexapp.africa.com^$all ! Google results for «SodaStream site:no cranberry» -/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware-redirection-results.* -||adservice.google.*/ddm/clk/$doc,domain=~malware-redirection-results.* -/ad_click/q?&url=$doc,domain=~malware-redirection-results.* +/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware_redirection_results.* +||adservice.google.*/ddm/clk/$doc,domain=~malware_redirection_results.* +/ad_click/q?&url=$doc,domain=~malware_redirection_results.* ! Laughably blatant fraud site ||cosercosplay.com^$all,~inline-font ! Fraudulent art thefts for money on Google Image Search, e.g. 'cassandra tangled site:tumblr.com suit' @@ -33578,13 +33578,13 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. -||unofficialtwrp.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||androidweblog.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||androidgreek.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||ytechb.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||gadgetstwist.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||gadgetsfarms.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||techorfy.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||unofficialtwrp.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||androidweblog.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||androidgreek.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||ytechb.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||gadgetstwist.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||gadgetsfarms.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||techorfy.com^$doc,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* !#if false ! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ——— @@ -33606,47 +33606,47 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ://ww7.$doc,domain=~ww7.be|~ww7.readsnk.com|~ww7.autotask.net !!!://ww8.$doc,domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com|~ww8.autotask.net (Needed way more whitelistings than I had expected.) ://ww9.$doc,domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br|~ww9.autotask.net -://ww10.$doc,domain=~ww10.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww11.$doc,domain=~ww11.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww12.$doc,domain=~ww12.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww13.$doc,domain=~ww13.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww14.$doc,domain=~ww14.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww15.$doc,domain=~ww15.nl|~ww15.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww16.$doc,domain=~ww16.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww17.$doc,domain=~ww17.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww18.$doc,domain=~ww18.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww19.$doc,domain=~ww19.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww20.$doc,domain=~ww20.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww21.$doc,domain=~ww21.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww22.$doc,domain=~ww22.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww23.$doc,domain=~ww23.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww24.$doc,domain=~ww24.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww25.$doc,domain=~ww25.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww26.$doc,domain=~ww26.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww27.$doc,domain=~ww27.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww28.$doc,domain=~ww28.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww29.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww30.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww31.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww32.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww33.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww34.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww35.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww36.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww37.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww38.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww39.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww40.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww41.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww42.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww43.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww44.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww45.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww46.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww47.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww48.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww49.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww50.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww10.$doc,domain=~ww10.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww11.$doc,domain=~ww11.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww12.$doc,domain=~ww12.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww13.$doc,domain=~ww13.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww14.$doc,domain=~ww14.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww15.$doc,domain=~ww15.nl|~ww15.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww16.$doc,domain=~ww16.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww17.$doc,domain=~ww17.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww18.$doc,domain=~ww18.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww19.$doc,domain=~ww19.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww20.$doc,domain=~ww20.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww21.$doc,domain=~ww21.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww22.$doc,domain=~ww22.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww23.$doc,domain=~ww23.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww24.$doc,domain=~ww24.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww25.$doc,domain=~ww25.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww26.$doc,domain=~ww26.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww27.$doc,domain=~ww27.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww28.$doc,domain=~ww28.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww29.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww30.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww31.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww32.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww33.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww34.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww35.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww36.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww37.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww38.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww39.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww40.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww41.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww42.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww43.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww44.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww45.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww46.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww47.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww48.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww49.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww50.$doc,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* ! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ——— !!!/\\/$doc