mirror of
https://github.com/DandelionSprout/adfilt.git
synced 2026-10-01 22:04:51 +01:00
I grew tired of the emoji diamonds
And also there were a grand total of 3 legit .tk domains in the entire territory of Tokelau.
This commit is contained in:
Imre Kristoffer Eilertsen
@@ -1,53 +1,53 @@
|
||||
[Adblock Plus 3.2]
|
||||
! Title: 💊 Dandelion Sprout's Anti-Malware List
|
||||
! Version: 09July2019v1-Beta
|
||||
! Version: 11July2019v1-Beta
|
||||
! Expires: 5 days
|
||||
! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.
|
||||
! For more information, details, helpful tools, and other lists that I've made, visit https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english
|
||||
|
||||
! 🔶 Country domains
|
||||
! ——— Country domains ———
|
||||
! You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you.
|
||||
! Tokelau
|
||||
||.tk^$doc,domain=~coolcmd.tk|~budterence.tk|~intr0.tk|~google.tk|~transportnews.tk|~unicorncardlist.tk|~c0d3c.tk|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
||.tk^$doc,domain=~coolcmd.tk|~budterence.tk|~intr0.tk|~google.tk|~transportnews.tk|~unicorncardlist.tk|~c0d3c.tk|~anonytext.tk|~tokelau-info.tk|~fakaofo.tk|~nukunonu.tk|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
! Gabon
|
||||
||.ga^$doc,domain=~google.ga|~filtri-dns.ga|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
||.ga^$doc,domain=~google.ga|~filtri-dns.ga|~anpigabon.ga|~dgdi.ga|~voitures.ga|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
! Mali
|
||||
||.ml^$doc,domain=~google.ml|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
||.ml^$doc,domain=~google.ml|~mobili.ml|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
! Equatorial Guinea
|
||||
||.gq^$doc,domain=~deimos.gq|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
||.gq^$doc,domain=~deimos.gq|~inege.gq|~tvgelive.gq|~comprarcarros.gq|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
! Central African Republic
|
||||
||.cf^$doc,domain=~1hos.cf|~intr0.cf|~ivoid.cf|~domainvoider.cf|~google.cf|~rths.cf|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
||.cf^$doc,domain=~1hos.cf|~intr0.cf|~ivoid.cf|~domainvoider.cf|~google.cf|~rths.cf|~voitures.cf|~assembleenationale-rca.cf|~cps-rca.cf|~acap.cf|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers.
|
||||
|
||||
! 🔶 Topical domains
|
||||
! ——— Topical domains ———
|
||||
! These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent.
|
||||
! Presumably fake loans
|
||||
||.loan^$doc,domain=~ Warning displayed due to: It's a topical domain whose sites have an unusally big chance of being fraudulent.
|
||||
||.agency^$doc,domain=~ Warning displayed due to: It's a topical domain whose sites have an unusally big chance of being fraudulent.
|
||||
|
||||
! 🔶 Attempted removal of Google search result entries that lead to the above top-level domains (Advanced adblockers only)
|
||||
google.*##.rc:has(a[href*=".tk/"]:not([href*="coolcmd.tk"]):not([href*="budterence.tk"]):not([href*="intr0.tk"]):not([href*="google.tk"]):not([href*="transportnews.tk"]):not([href*="unicorncardlist.tk"]):not([href*="c0d3c.tk"]))
|
||||
google.*##.rc:has(a[href*=".ga/"]:not([href*="google.ga"]):not([href*="filtri-dns.ga"]))
|
||||
google.*##.rc:has(a[href*=".ml/"]:not([href*="google.ml"]))
|
||||
google.*##.rc:has(a[href*=".gq/"]:not([href*="deimos.gq"]))
|
||||
google.*##.rc:has(a[href*=".cf/"]:not([href*="1hos.cf"]):not([href*="intr0.cf"]):not([href*="ivoid.cf"]):not([href*="domainvoider.cf"]):not([href*="google.cf"]):not([href*="rths.cf"]))
|
||||
! ——— Attempted removal of Google search result entries that lead to the above top-level domains (Advanced adblockers only) ———
|
||||
google.*##.rc:has(a[href*=".tk/"]:not([href*="coolcmd.tk"]):not([href*="budterence.tk"]):not([href*="intr0.tk"]):not([href*="google.tk"]):not([href*="transportnews.tk"]):not([href*="unicorncardlist.tk"]):not([href*="c0d3c.tk"]):not([href*="anonytext.tk"]):not([href*="tokelau-info.tk"]):not([href*="fakaofo.tk"]):not([href*="nukunonu.tk"]))
|
||||
google.*##.rc:has(a[href*=".ga/"]:not([href*="google.ga"]):not([href*="filtri-dns.ga"]):not([href*="anpigabon.ga"]):not([href*="dgdi.ga"]):not([href*="voitures.ga"]))
|
||||
google.*##.rc:has(a[href*=".ml/"]:not([href*="google.ml"]):not([href*="mobili.ml"]))
|
||||
google.*##.rc:has(a[href*=".gq/"]:not([href*="deimos.gq"]):not([href*="inege.gq"]):not([href*="tvgelive.gq"]):not([href*="comprarcarros.gq"]))
|
||||
google.*##.rc:has(a[href*=".cf/"]:not([href*="1hos.cf"]):not([href*="intr0.cf"]):not([href*="ivoid.cf"]):not([href*="domainvoider.cf"]):not([href*="google.cf"]):not([href*="rths.cf"]):not([href*="voitures.cf"]):not([href*="assembleenationale-rca.cf"]):not([href*="cps-rca.cf"]):not([href*="acap.cf"]))
|
||||
google.*##.rc:has(a[href*=".loan/"])
|
||||
google.*##.rc:has(a[href*=".agency/"])
|
||||
|
||||
! 🔶 You know those ultra-fraudulent websites who clutter up Google searches, who have some seemingly random ".php?" values in their URLs? These entries should remove some of them.
|
||||
! ——— You know those ultra-fraudulent websites who clutter up Google searches, who have some seemingly random ".php?" values in their URLs? These entries should remove some of them. ———
|
||||
google.*##.rc:has(a[href*=".php?xxx="])
|
||||
|
||||
! 🔶 For Google Mobile
|
||||
! ——— For Google Mobile ———
|
||||
! Note for Firefox on Android users: I strongly recommend the use of https://addons.mozilla.org/firefox/addon/google-search-fixer/ for use on Firefox for Android, thus the entries are written for the Chrome version of Google Mobile.
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".tk/"]:not([href*="coolcmd.tk"]):not([href*="budterence.tk"]):not([href*="intr0.tk"]):not([href*="google.tk"]):not([href*="transportnews.tk"]):not([href*="unicorncardlist.tk"]):not([href*="c0d3c.tk"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".ga/"]:not([href*="google.ga"]):not([href*="filtri-dns.ga"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".ml/"]:not([href*="google.ml"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".gq/"]:not([href*="deimos.gq"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".cf/"]:not([href*="1hos.cf"]):not([href*="intr0.cf"]):not([href*="ivoid.cf"]):not([href*="domainvoider.cf"]):not([href*="google.cf"]):not([href*="rths.cf"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".tk/"]:not([href*="coolcmd.tk"]):not([href*="budterence.tk"]):not([href*="intr0.tk"]):not([href*="google.tk"]):not([href*="transportnews.tk"]):not([href*="unicorncardlist.tk"]):not([href*="c0d3c.tk"]):not([href*="anonytext.tk"]):not([href*="tokelau-info.tk"]):not([href*="fakaofo.tk"]):not([href*="nukunonu.tk"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".ga/"]:not([href*="google.ga"]):not([href*="filtri-dns.ga"]):not([href*="anpigabon.ga"]):not([href*="dgdi.ga"]):not([href*="voitures.ga"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".ml/"]:not([href*="google.ml"]):not([href*="mobili.ml"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".gq/"]:not([href*="deimos.gq"]):not([href*="inege.gq"]):not([href*="tvgelive.gq"]):not([href*="comprarcarros.gq"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".cf/"]:not([href*="1hos.cf"]):not([href*="intr0.cf"]):not([href*="ivoid.cf"]):not([href*="domainvoider.cf"]):not([href*="google.cf"]):not([href*="rths.cf"]):not([href*="voitures.cf"]):not([href*="assembleenationale-rca.cf"]):not([href*="cps-rca.cf"]):not([href*="acap.cf"]))
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".loan/"])
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".agency/"])
|
||||
google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".php?xxx="])
|
||||
|
||||
! 🔶 Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks", except for startshop.no)
|
||||
! ——— Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks", except for startshop.no) ———
|
||||
||adblock.gjtech.net^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers.
|
||||
||spam404bl.com^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers.
|
||||
||hufilter.hu^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers.
|
||||
@@ -55,13 +55,13 @@ google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".php?xx
|
||||
||startshop.no^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. And also the cashback service's owners took their remaining money and ran.
|
||||
||securemecca.com^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers.
|
||||
|
||||
! 🔶 Old tech-related domains that have fallen into the hands of questionable new owners.
|
||||
! ——— Old tech-related domains that have fallen into the hands of questionable new owners. ———
|
||||
! To log in to TP-Link routers, use tplinkwifi.net instead.
|
||||
||tplinklogin.net^$doc,domain=~ Warning displayed due to: TP-Link embarrasingly losing the rights to that router login domain; and it may have been snapped up by malware pushers. Please try tplinkwifi.net instead.
|
||||
||tplinkextender.net^$doc,domain=~ Warning displayed due to: TP-Link embarrasingly losing the rights to that router login domain; and it has been snapped up by malware pushers. Please try tplinkwifi.net instead.
|
||||
||ublock.org^$doc,domain=~ Warning displayed due to: It playing on its old similarities with uBlock Origin to solicit large donations for limited work effort.
|
||||
|
||||
! 🔶 IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results.
|
||||
! ——— IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. ———
|
||||
||funeducation.com^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result.
|
||||
||iq-research.info^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result.
|
||||
||iq-test-online.org^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result.
|
||||
@@ -73,7 +73,7 @@ google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".php?xx
|
||||
||test-iq.org^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result.
|
||||
||officialiqtests.com^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result.
|
||||
|
||||
! 🔶 Old Linux-related domains that have been snapped up for ads, adware, and/or malware.
|
||||
! ——— Old Linux-related domains that have been snapped up for ads, adware, and/or malware. ———
|
||||
! How these links still remain in Unetbootin, is anyone's guess.
|
||||
||dreamlinux.com.br^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers.
|
||||
||dreamlinux.net^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers.
|
||||
@@ -81,7 +81,7 @@ google.*##div[data-hveid]:has(:scope > div > div > a[onmousedown][href*=".php?xx
|
||||
||hacktolive.org^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers.
|
||||
||mandriva.com^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers.
|
||||
|
||||
! 🔶 ReImagePlus links (Also added to "uBlock Filters - Badware Risks")
|
||||
! ——— ReImagePlus links (Also added to "uBlock Filters - Badware Risks") ———
|
||||
! https://windowsreport.com/extend-windows-laptop-battery-life/
|
||||
windowsreport.com##.code-block
|
||||
! https://appuals.com/fix-error-0x800701e3-on-windows-7-8-1-10/
|
||||
@@ -99,12 +99,12 @@ thewindowsclub.com#?#.entry-content > div > strong:-abp-contains(find & fix Wind
|
||||
majorgeeks.com#?#b:-abp-has(a[target^="reimage"])
|
||||
||www.majorgeeks.com/images/icons/red_icon_18x17px.png$image
|
||||
|
||||
! 🔶 ScanUtilities links
|
||||
! ——— ScanUtilities links ———
|
||||
! https://www.bynarycodes.com/fix-windows-10-update-error-0x80070006/
|
||||
bynarycodes.com##div[class^="bynar-content_"]
|
||||
bynarycodes.com#?#.panel:-abp-contains(a[href*="scanutilities.com"])
|
||||
|
||||
! 🔶 Driver Easy links
|
||||
! ——— Driver Easy links ———
|
||||
! https://www.drivereasy.com/knowledge/fix-critical-service-failed-blue-screen-error-on-windows-10/
|
||||
drivereasy.com#?#.pakb-content ol:-abp-contains(Download and install Driver Easy)
|
||||
drivereasy.com#?#.pakb-content p:-abp-contains(Driver Easy)
|
||||
@@ -124,11 +124,11 @@ drivereasy.com#?#.pakb-content li:-abp-has(a:-abp-contains(Update drivers with D
|
||||
! https://www.drivereasy.com/knowledge/solved-this-display-does-not-support-hdcp/
|
||||
drivereasy.com#?#.pakb-content p:-abp-contains(click Update All)
|
||||
|
||||
! 🔶 Slimware DriverUpdate
|
||||
! ——— Slimware DriverUpdate ———
|
||||
! https://forums.windowscentral.com/
|
||||
forums.windowscentral.com###navbar_notice_33
|
||||
|
||||
! 🔶 Sites that fraudulently claim you've won a new phone
|
||||
! ——— Sites that fraudulently claim you've won a new phone ———
|
||||
||app*.bigbigabum*.live^$doc,domain=~ Warning displayed due to: Fraudulently claims you've won a new phone.
|
||||
||mobile*.harddayforal*.life^$doc,domain=~ Warning displayed due to: Fraudulently claims you've won a new phone.
|
||||
||reward*.harddayforal*.icu^$doc,domain=~ Warning displayed due to: Fraudulently claims you've won a new phone.
|
||||
@@ -136,10 +136,10 @@ forums.windowscentral.com###navbar_notice_33
|
||||
||sweeps*.whoisyourd*.live^$doc,domain=~ Warning displayed due to: Fraudulently claims you've won a new phone.
|
||||
||apps*.wtflife*.life^$doc,domain=~ Warning displayed due to: Fraudulently claims you've won a new phone.
|
||||
|
||||
! 🔶 Banner for "MSN New Tab"
|
||||
! ——— Banner for "MSN New Tab" ———
|
||||
msn.com##.irisbanner
|
||||
|
||||
! 🔶 Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files)
|
||||
! ——— Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) ———
|
||||
! If you're in a situation where you need to torrent something, such as for hard-to-buy or region-locked games, or games that you own for consoles that lack accessible rip tools, you can at least try to use sites that have legit downloads with the actual game files.
|
||||
||gamecopyworld.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files.
|
||||
||coolrom.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files.
|
||||
@@ -149,7 +149,7 @@ msn.com##.irisbanner
|
||||
||loveroms.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files.
|
||||
||portableroms.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files.
|
||||
|
||||
! 🔶 Entries from "abuse.ch ZeuS Blocklist", which was discontinued on the 8th of July 2019.
|
||||
! ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
|
||||
||afobal.cl$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019.
|
||||
||alvoportas.com.br$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019.
|
||||
||blogerjijer.pw$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019.
|
||||
|
||||
Reference in New Issue
Block a user