From 9adcb9c4fd0e8cd7a4772cba107aa06abe9ca586 Mon Sep 17 00:00:00 2001 From: Quentin Li Date: Sat, 19 Mar 2022 21:09:02 -0400 Subject: [PATCH 1/2] Update Dandelion Sprout's Anti-Malware List.txt Exclude shucks.top --- Dandelion Sprout's Anti-Malware List.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 17f0c7726..e88fa4023 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.6] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 19March2022v1 +! Version: 19March2022v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -21,7 +21,7 @@ ! Palau ||pw^$doc,domain=~libgen.pw|~petridish.pw|~palaugov.pw|~dpc.pw|~zikrap.pw|~demonoid.pw|~bittor.pw|~buttercup.pw ! Legitimate use is almost non-existent, but has a tiny userbase in Japan -||top^$doc,domain=~corriente.top|~gdtot.top|~nicenature.top|~reminder.top|~magocoro.top|~castlevania.top|~suiten.top +||top^$doc,domain=~corriente.top|~gdtot.top|~nicenature.top|~reminder.top|~magocoro.top|~castlevania.top|~suiten.top|~shucks.top ! International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. ||loan^$doc ||agency^$doc From c9e4a3656cb02d6b5232228b980c378cbd8fee90 Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Sun, 20 Mar 2022 02:19:32 +0100 Subject: [PATCH 2/2] Whitelisting it in search engines as well --- Dandelion Sprout's Anti-Malware List.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index e88fa4023..84264e808 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -41,7 +41,7 @@ www.google.*##.g:has(a[href*=".loan/"]) www.google.*##.g:has(a[href*=".agency/"]) www.google.*##.g:has(a[href*=".gdn/"]) www.google.*##.g:has(a[href*=".bid/"]) -www.google.*##.g:has(a[href*=".top/"]:not([href*="corriente.top"], [href*="gdtot.top"], [href*="nicenature.top"], [href*="reminder.top"], [href*="magocoro.top"], [href*="castlevania.top"], [href*="suiten.top"])) +www.google.*##.g:has(a[href*=".top/"]:not([href*="corriente.top"], [href*="gdtot.top"], [href*="nicenature.top"], [href*="reminder.top"], [href*="magocoro.top"], [href*="castlevania.top"], [href*="suiten.top"], [href*="shucks.top"])) ! ——— You know those ultra-fraudulent auto-generated things that clutter up Google searches? These entries should remove some of them. ——— www.google.*##.g:has(a[href*=".php?xxx="]) @@ -62,7 +62,7 @@ www.google.*##a[oncontextmenu][href*=".loan/"]:upward(2) www.google.*##a[oncontextmenu][href*=".agency/"]:upward(2) www.google.*##a[oncontextmenu][href*=".gdn/"]:upward(2) www.google.*##a[oncontextmenu][href*=".bid/"]:upward(2) -www.google.*##a[oncontextmenu][href*=".top/"]:not([href*="corriente.top"], [href*="gdtot.top"], [href*="nicenature.top"], [href*="reminder.top"], [href*="magocoro.top"], [href*="castlevania.top"], [href*="suiten.top"]):upward(2) +www.google.*##a[oncontextmenu][href*=".top/"]:not([href*="corriente.top"], [href*="gdtot.top"], [href*="nicenature.top"], [href*="reminder.top"], [href*="magocoro.top"], [href*="castlevania.top"], [href*="suiten.top"], [href*="shucks.top"]):upward(2) www.google.*##a[oncontextmenu][href*=".php?xxx="]:upward(2) www.google.*##a[oncontextmenu][href^="https://books.google."]:upward(2) !#endif @@ -78,7 +78,7 @@ duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaf duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".agency"] duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".gdn"] duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".bid"] -duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".top"]:not([data-domain$="corriente.top"], [data-domain$="gdtot.top"], [data-domain$="nicenature.top"], [data-domain$="reminder.top"], [data-domain$="magocoro.top"], [data-domain$="castlevania.top"], [data-domain$="suiten.top"]) +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".top"]:not([data-domain$="corriente.top"], [data-domain$="gdtot.top"], [data-domain$="nicenature.top"], [data-domain$="reminder.top"], [data-domain$="magocoro.top"], [data-domain$="castlevania.top"], [data-domain$="suiten.top"], [data-domain$="shucks.top"]) ! ——— For Bing ——— !!!bing.com##.b_algo:has(a[href*=".tk/"]:not([href*="coolcmd.tk"], [href*="budterence.tk"], [href*="google.tk"], [href*="transportnews.tk"], [href*="c0d3c.tk"], [href*="anonytext.tk"], [href*="tokelau-info.tk"], [href*="fakaofo.tk"], [href*="loljp-wiki.tk"], [href*="ninetail.tk"], [href*="goshujin.tk"], [href*="graph.tk"], [href*="nolfrevival.tk"], [href*="coppersurfer.tk"], [href*="restricted-functions.tk"], [href*="nbd-media.tk"], [href*="bstweaker.tk"], [href*="gotofap.tk"], [href*="somepythonthings.tk"])) @@ -91,7 +91,7 @@ bing.com##.b_algo:has(a[href*=".loan/"]) bing.com##.b_algo:has(a[href*=".agency/"]) bing.com##.b_algo:has(a[href*=".gdn/"]) bing.com##.b_algo:has(a[href*=".bid/"]) -bing.com##.b_algo:has(a[href*=".top/"]:not([href*="corriente.top"], [href*="gdtot.top"], [href*="nicenature.top"], [href*="reminder.top"], [href*="magocoro.top"], [href*="castlevania.top"], [href*="suiten.top"])) +bing.com##.b_algo:has(a[href*=".top/"]:not([href*="corriente.top"], [href*="gdtot.top"], [href*="nicenature.top"], [href*="reminder.top"], [href*="magocoro.top"], [href*="castlevania.top"], [href*="suiten.top"], [href*="shucks.top"])) ! ——— Old dead tech-related domains ——— ! Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them.