From 39be561ea0e9f27b5f6df584396eed4440b613a9 Mon Sep 17 00:00:00 2001 From: Imre Eilertsen Date: Mon, 30 Sep 2024 04:44:53 +0200 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 670 ++++++++++++++---- .../AntiMalwareAdGuard.txt | 414 ++++++++++- .../AntiMalwareAdGuardHome.txt | 414 ++++++++++- .../AntiMalwareDomains.txt | 416 ++++++++++- .../AntiMalwareHosts.txt | 416 ++++++++++- .../AntiMalwarePrivoxy.action | 551 ++++++++++++-- .../AntiMalwareTPL.tpl | 414 ++++++++++- 7 files changed, 3082 insertions(+), 213 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index ddd368454..9ddeef23e 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,10 +1,9 @@ [Adblock Plus 3.13] -! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus and AdBlock) -! Version: 21September2024v1 +! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox) +! Version: 30September2024v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists -! (Note to self, only applicable to uBO: When 1.59.1 goes stable, implement "*$ipaddress=(...),all" for the IP addresses, alongside the previous syntaxing as the case is for AdGuard Browser Extension.) ! Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#-english ! As of June 2023, Pi-Hole FTL ≥5.22 users should rather use https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, which is a ||-type list version designed specifically for DNS tools. @@ -89,6 +88,7 @@ www.google.com,google.ac,google.ad,google.ae,google.af,google.ag,google.al,googl ||adblock.gjtech.net^ ||spam404bl.com^ ||109.201.135.46^ + ||fredfiber.no^ ||securemecca.com^ @@ -131,6 +131,7 @@ www.google.com,google.ac,google.ad,google.ae,google.af,google.ag,google.al,googl ! Fraudulent browser extensions ||ublock.org^ ||138.68.252.54^ + ||useragentswitch.com^ ||useragentswitch.com^$popup ||dev-nano.com^ @@ -449,150 +450,159 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ! ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— ||ubuntu.org^$domain=~you-were-likely-looking-for-ubuntu.com ||103.224.212.249^ + ||speedtest.com^$domain=~you-were-likely-looking-for-speedtest.net ||snapchat.cm^$domain=~malware-typo-squatter-of-snapchat.com ||facebook.cm^$domain=~malware-typo-squatter-of-facebook.com ||wix.cm^$domain=~malware-typo-squatter-of-wix.com ||199.59.243.222^ + |http://ww01.$domain=~very-very-extremely-frequently-used-in-malware-redirections.* ||14d.us^ -||14d.us^$popup,~inline-font,domain=~malware-redirection-and-also-you-were-very-likely-looking-for-1d4.us +||14d.us^$popup ||173.208.96.42^ ||173.208.96.42^$popup + ||173.208.96.43^ ||173.208.96.43^$popup + ||173.208.96.44^ ||173.208.96.44^$popup + ||173.208.96.45^ ||173.208.96.45^$popup + ||173.208.96.46^ ||173.208.96.46^$popup + ||213.227.149.208^ ||213.227.149.208^$popup + ||213.227.149.211^ ||213.227.149.211^$popup + ||ddscordapp. -||ddscordapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||ddscordapp.$popup ||diicordapp. -||diicordapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||diicordapp.$popup ||disccrdapp. -||disccrdapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||disccrdapp.$popup ||dissordapp. -||dissordapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||dissordapp.$popup ||discorrapp. -||discorrapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discorrapp.$popup ||discordaap. -||discordaap.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordaap.$popup ||discordapp.cam^ -||discordapp.cam^$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordapp.cam^$popup ||discordap.com^ -||discordap.com^$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordap.com^$popup ! https://github.com/DevSpen/links/blob/master/src/links.txt /^(.*\.|.*://)?d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*$/ -/^(.*\.|.*://)?d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*$/$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +/^(.*\.|.*://)?d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*$/$popup /^(.*\.|.*://)?d[il]sc(or|ro)ds?-?n[il]tro[.-].*$/ -/^(.*\.|.*://)?d[il]sc(or|ro)ds?-?n[il]tro[.-].*$/$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +/^(.*\.|.*://)?d[il]sc(or|ro)ds?-?n[il]tro[.-].*$/$popup ||discord-nltro. -||discord-nltro.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discord-nltro.$popup ||discord-app. -||discord-app.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discord-app.$popup ||discord-promo* -||discord-promo*$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discord-promo*$popup ||dlscord. -||dlscord.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||dlscord.$popup ||dlscord-app. -||dlscord-app.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||dlscord-app.$popup /^(.*\.|.*://)?gifts?-?discord\..*$/ -/^(.*\.|.*://)?gifts?-?discord\..*$/$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +/^(.*\.|.*://)?gifts?-?discord\..*$/$popup ||steamcommin*,domain=~likely-a-fake-malware-version-of-steamcommunity.com ||steamcommm* -||steamcommm*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommm*$popup ||steamcommn* -||steamcommn*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommn*$popup ||steamcommunet* -||steamcommunet*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunet*$popup ||steamcommunitty. -||steamcommunitty.$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunitty.$popup ||steamcommunnity. -||steamcommunnity.$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunnity.$popup ||steamcommunty. -||steamcommunty.$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunty.$popup ||steamcommuu* -||steamcommuu*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommuu*$popup ||steamcommyn* -||steamcommyn*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommyn*$popup ||steamcomnu* -||steamcomnu*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomnu*$popup ||steamcomrn* -||steamcomrn*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomrn*$popup ||steamconnu*,domain=~likely-a-fake-malware-version-of-steamcommunity.com ||steancomm*,domain=~likely-a-fake-malware-version-of-steamcommunity.com ||steanncomu* -||steanncomu*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steanncomu*$popup ||discord-glft. -||discord-glft.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-glft.$popup ||discordnitrogift* -||discordnitrogift*$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordnitrogift*$popup ||gift-nitro. -||gift-nitro.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||gift-nitro.$popup ||free-discordnitro. ||free-discordnitro.$popup ||freediscordnitro. ||freediscordnitro.$popup /^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup /^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ /^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup ||discord*.gifts^ -||discord*.gifts^$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord*.gifts^$popup ||discord-give. -||discord-give.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-give.$popup ||discord-nitro-gift. -||discord-nitro-gift.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-nitro-gift.$popup ||discord-nitro. -||discord-nitro.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-nitro.$popup ||discord-nitros. -||discord-nitros.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-nitros.$popup ||discord.foundation^ -||discord.foundation^$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord.foundation^$popup ||discordnitro-steam. -||discordnitro-steam.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordnitro-steam.$popup ||discordxgift. -||discordxgift.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordxgift.$popup ||discordxnitro. -||discordxnitro.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordxnitro.$popup ||discrod.ru^ -||discrod.ru^$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discrod.ru^$popup ||nitro*.gift^ -||nitro*.gift^$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||nitro*.gift^$popup ||nitro*.gifts^ -||nitro*.gifts^$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||nitro*.gifts^$popup ||sleanmconmunltiy.ru^ -||sleanmconmunltiy.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||sleanmconmunltiy.ru^$popup ||staemcommunty.ru^ -||staemcommunty.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||staemcommunty.ru^$popup ||steamcomiunity.com^ -||steamcomiunity.com^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomiunity.com^$popup ||steamcommunillty.com^ -||steamcommunillty.com^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunillty.com^$popup ||steamcommunjty.ru^ -||steamcommunjty.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunjty.ru^$popup ||steamcommunlity.ru^ -||steamcommunlity.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunlity.ru^$popup ||steamcomnnuity.com^ -||steamcomnnuity.com^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomnnuity.com^$popup ||steamconmunyty.ru^ -||steamconmunyty.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamconmunyty.ru^$popup ||steamconunity.ru^ -||steamconunity.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamconunity.ru^$popup ||steamcumunity.ru^ -||steamcumunity.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcumunity.ru^$popup ||steanmconynnuytiy. -||steanmconynnuytiy.$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steanmconynnuytiy.$popup ||stearncommynity.ru^ -||stearncommynity.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||stearncommynity.ru^$popup ||githubus.com^$domain=~you-were-likely-looking-for-githubusercontent.com ||githubu.com^$domain=~you-were-likely-looking-for-githubusercontent.com ||githu.com^$domain=~you-were-likely-looking-for-github.com @@ -602,7 +612,7 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||githubt.com^$domain=~you-were-likely-looking-for-githubusercontent.com ! https://scammer•info/t/discord-nitro-scam-25/87887 ||discorde-nitre.xyz^ -||discorde-nitre.xyz^$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discorde-nitre.xyz^$popup ! ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ——— ||netnet44.net^ @@ -616,6 +626,7 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||katie.*.net^ ||emily.*.net^ ||54.174.156.141^ + ||lucretius-ada.com^ ||lucretius-ada.com^$popup ||hippolyte-hag.com^ @@ -638,18 +649,26 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||madagty.com^ ||zeroredirect5.com^$domain=~malware-redirection-trains.* ||54.209.22.226^ + ||54.91.125.197^ + ||52.202.53.245^ + ||35.175.38.64^ + ||35.168.147.213^ + ||34.230.160.215^ + ||3.226.8.132^ + ||3.216.243.46^ + ||roamingclicks.com^ ||roamingclicks.com^$popup ! Source: desidert•no ||collectfasttracks.com^ -||collectfasttracks.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||collectfasttracks.com^$popup ! Source: vn-zoom•com ||ttnrd.com^ ||ttnrd.com^$popup @@ -659,15 +678,18 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||sarah.*.com^ ||pamela.*.com^ ||54.152.245.247^ + ||35.172.40.232^ + ||3.90.125.85^ + ! Various ex-affiliate links at www•zombooru•com ||track.vcdc.com^ -||track.vcdc.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||track.vcdc.com^$popup ||track.tkbo.com^ -||track.tkbo.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||track.tkbo.com^$popup ||track.traffic.club^ -||track.traffic.club^$popup,~inline-font,domain=~malware-redirection-trains.* +||track.traffic.club^$popup ||lasvegas-vacations.net^ ||ndsplitter.com^ ||ns1.trafficclub.com^ @@ -675,10 +697,15 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||satcom1.co.uk^ ||splitter.microxml.net^ ||94.130.185.237^ + ||94.130.186.231^ + ||144.76.0.242^ + ||144.76.1.130^ + ||195.201.92.254^ + zombooru.com##a[href$="ttp://www.boorufurry.com/"] zombooru.com##a[href$="ttp://www.analbooru.com/"] zombooru.com##a[href$="ttp://www.hard55.com"] @@ -692,7 +719,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||inbluson.com^ ||inbluson.com^$popup ||bemobtrcks.com^ -||bemobtrcks.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||bemobtrcks.com^$popup ! ——— Found in witness reports online ——— ! Adblock Plus list maintainer weekly reports @@ -705,9 +732,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||newpage.in^ /mcaf04/*= ||34.204.214.165^ + ||54.85.113.62^ + ||54.205.83.61^ + ||54.210.193.115^ + ||[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1]^ ||ailkeyair.com^ ||ailkeyair.com^$popup @@ -810,36 +841,52 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||adblockerapp.com^$popup ||172.255.6.107^ ||172.255.6.107^$popup + ||172.255.6.147^ ||172.255.6.147^$popup + ||172.255.6.219^ ||172.255.6.219^$popup + ||172.255.6.225^ ||172.255.6.225^$popup + ||188.42.129.108^ ||188.42.129.108^$popup + ||188.42.129.116^ ||188.42.129.116^$popup + ||188.42.141.100^ ||188.42.141.100^$popup + ||188.42.141.92^ ||188.42.141.92^$popup + ||23.109.82.144^ ||23.109.82.144^$popup + ||23.109.82.41^ ||23.109.82.41^$popup + ||23.109.82.43^ ||23.109.82.43^$popup + ||23.109.82.65^ ||23.109.82.65^$popup + ||23.109.82.66^ ||23.109.82.66^$popup + ||23.109.87.169^ ||23.109.87.169^$popup + ||23.109.87.207^ ||23.109.87.207^$popup + ||23.109.87.208^ ||23.109.87.208^$popup + ||entwithou.xyz^ ||entwithou.xyz^$popup ||chedstimaarr.pics^ @@ -852,8 +899,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zeikvvbobop.com^$popup ||216.21.13.14^ ||216.21.13.14^$popup + ||216.21.13.15^ ||216.21.13.15^$popup + /^.*\.(xyz|pics)/[a-zA-Z0-9]{130,}$/$script,subdocument,image /^.*\.(cloudfront\.net|xyz|pics)/[a-zA-Z0-9]{20,}/[a-zA-Z0-9]{25,}\+[a-zA-Z0-9+]{90,}$/$script,subdocument,image ||abaphosis.guru^ @@ -7003,8 +7052,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zmusic-online.com^ ||zmusic-online.com^$popup ||zredir.com^ -||zredir.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||zredir.com^$popup ||178.128.142.109^ + ||findmedia.biz^ ||findmedia.biz^$popup ||backtonews.biz^ @@ -7042,6 +7092,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] /^http://\d{1,2}\.[a-z0-9-]{1,}\.(club|me)(/|$)/ /^https://\d{1,2}\.[a-z0-9-]{1,}\.(club|me)(/|$)/ ||134.209.136.174^ + ||whiteclick.biz^ ||whiteclick.biz^$popup ||dreamnews.biz^ @@ -7067,9 +7118,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||worldtxt.club^ ||worldtxt.club^$popup ||62.210.6.153^ + ||62.210.7.209^ + ||62.210.9.92^ + ||62.210.11.203^ + ||ilo134ulih.com^ ||ilo134ulih.com^$popup ||hooligapps.com^ @@ -7090,6 +7145,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||stay-notified.com^ ||stay-notified.xyz^ ||167.99.249.47^ + ! https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ ! https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ ||moderncomputer.net^ @@ -7135,29 +7191,40 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||kmip.net^ ||kmip.net^$popup ||0redirc.com^ -||0redirc.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||0redirc.com^$popup ||redirekted.com^ -||redirekted.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||redirekted.com^$popup ||rebiraert.com^ ||rebiraert.com^$popup ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^ ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$popup ||5.8.34.26^ + ||5.8.47.3^ + ||103.224.182.251^ + ! https://github.com/DandelionSprout/adfilt/issues/193 ||holescontracting.com^ ||holescontracting.com^$popup ||doggroomingnews.com^ ||doggroomingnews.com^$popup ||5.79.71.205^ + ||5.79.71.225^ + ||85.17.31.82^ + ||85.17.31.122^ + ||178.162.203.202^ + ||178.162.203.211^ + ||178.162.203.226^ + ||178.162.217.107^ + ||[2a02:1668:1034::2]^ ! https://github.com/DandelionSprout/adfilt/issues/195 ||logicalrecord.com^ @@ -7180,9 +7247,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||securemailbox.online^ ||securemailbox.online^$popup ||66.85.156.85^ + ||66.85.156.86^ + ||108.170.31.123^ + ||108.170.52.156^ + ! https://github.com/DandelionSprout/adfilt/issues/198 ||mysecrethoookup.com^ ||mysecrethoookup.com^$popup @@ -7281,7 +7352,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||cpa-optimizer.online^ ||cpa-optimizer.online^$popup ||cpvlabtrk.online^ -||cpvlabtrk.online^$popup,~inline-font,domain=~malware-redirection-trains.* +||cpvlabtrk.online^$popup ||critical-alert.info^ ||critical-alert.info^$popup ||financial-message.club^ @@ -7391,8 +7462,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||weather-forecast.today^ ||weather-forecast.today^$popup ||95.168.170.165^ + ||213.227.145.147^ + ||213.227.149.216^ + ! https://twitter•com/adamziaja/status/1252234957679808513 ||wow-robotics.xyz^ ||wow-robotics.xyz^$popup @@ -7420,6 +7494,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||ribinski.us^ ||ribinski.us^$popup ||5.188.62.36^ + ! https://github.com/DandelionSprout/adfilt/issues/223 ||speedupmypcfree.com^ ||speedupmypcfree.com^$popup @@ -7487,6 +7562,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||paymetconfirm.com^ ||paymetconfirm.com^$popup ||69.49.231.244^ + ! https://movsb•0x0•st/users/mia ||vid.me^$third-party ||5starhdporn.com^$frame,third-party @@ -7523,6 +7599,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yzsnw.com^ ||yzsnw.com^$popup ||37.34.176.37^ + ||atvcampingtrips.com^ ||atvcampingtrips.com^$popup ||thegymmum.com^ @@ -7550,20 +7627,26 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||temp74.com^ ||temp74.com^$popup ||trackwebclick.com^ -||trackwebclick.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||trackwebclick.com^$popup ||23.111.31.137^ + ||23.111.88.207^ + ! https://github.com/DandelionSprout/adfilt/issues/254 ||onesafesoftware.com^ ! https://github.com/DandelionSprout/adfilt/issues/257 ||185.158.250.239^ ||185.158.250.239^$popup + ||192.169.69.25^ ||192.169.69.25^$popup + ||212.192.241.72^ ||212.192.241.72^$popup + ||37.0.10.83^ ||37.0.10.83^$popup + ||newstepsco.com^ ||newstepsco.com^$popup ||secure-0*.ddnss.ch^ @@ -7574,7 +7657,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||omnatuor.com^ ||omnatuor.com^$popup ||novitrk1.com^ -||novitrk1.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||novitrk1.com^$popup ||cu27t-evo29lution.xyz^ ||cu27t-evo29lution.xyz^$popup ||sothis-sayers.xyz^ @@ -7610,6 +7693,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://safeweb•norton•com/report/show?url=192•3•110•170 ||192.3.110.170^ ||192.3.110.170^$popup + ! https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ ||socialsearchconverter.com^ ||install.socialsearchconverter.com^ @@ -7669,6 +7753,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection ||91.241.19.38^ ||91.241.19.38^$popup + ! https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection ! https://safeweb•norton•com/report/show?url=telete•in ! https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -7681,10 +7766,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/domain/kiff•tech/relations ! https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection ||45.90.58.90^ + ! https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community ! https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection ||95.85.89.98^ ||95.85.89.98^$popup + ! https://github.com/DandelionSprout/adfilt/issues/267 ||tekhacks.net^ ||tekhacks.net^$popup @@ -7693,40 +7780,54 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !! https://www.virustotal.com/gui/file/da75c85fe037f9ff9ebbbd0b37dd2ff154f5e70a0dc6870286e0d3df6b8f246f/community ||139.28.37.49^ ||139.28.37.49^$popup + !! https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community ||35.194.188.37^ ||35.194.188.37^$popup + !! https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community ||hydro-ca.link^ ||hydro-ca.link^$popup !! https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community ||91.243.121.19^ ||91.243.121.19^$popup + !! https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community ||103.169.90.205^ ||103.169.90.205^$popup + ! https://github.com/DandelionSprout/adfilt/pull/281 ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community ||125.44.43.45^ ||125.44.43.45^$popup + ||182.121.8.240^ ||182.121.8.240^$popup + ||42.235.183.74^ ||42.235.183.74^$popup + ||78.36.32.242^ ||78.36.32.242^$popup + ||115.50.2.119^ ||115.50.2.119^$popup + ||115.50.110.163^ ||115.50.110.163^$popup + ||119.179.84.145^ ||119.179.84.145^$popup + ||188.120.50.98^ ||188.120.50.98^$popup + ||190.238.183.5^ ||190.238.183.5^$popup + ||27.220.253.78^ ||27.220.253.78^$popup + ! https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community ||esetnode32-antiviru.ydns.eu^ ||esetnode32-antiviru.ydns.eu^$popup @@ -7736,6 +7837,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! Relations to the original domain ||192.3.194.242^ ||192.3.194.242^$popup + ||w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu^ ||w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu^$popup ||hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu^ @@ -7757,7 +7859,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||pcspeedup.en.softonic.com^$popup ! Copied from «uBlock Filters - Badware Risks» because it has proven to be a very good entry ||1redirb.com^ -||1redirb.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||1redirb.com^$popup ! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931700117 ||retailproductsusa.com^ ||retailproductsusa.com^$popup @@ -7765,12 +7867,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||cloud-repos.store^$popup ! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931742337 (Initial batch) ||adtrk18.com^ -||adtrk18.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||adtrk18.com^$popup ||jpgtrk.com^ -||jpgtrk.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||jpgtrk.com^$popup ||pnghst.com^$popup ||pshtrk.com^ -||pshtrk.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||pshtrk.com^$popup ||diabasewoodhouse.xyz^ ||displayoptoffers.com^ ||displayoptoffers.com^$popup @@ -7851,119 +7953,173 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/commit/f7f114945c83b339be5cdd848e229680d9918abb#commitcomment-57642875 ||23.94.26.138^ ||23.94.26.138^$popup + ! https://github.com/DandelionSprout/adfilt/pull/298 ! https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community ||205.185.126.200^ ||205.185.126.200^$popup + ! https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community ||185.243.56.167^ ||185.243.56.167^$popup + ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community ||123.10.224.135^ ||123.10.224.135^$popup + ||59.47.187.147^ ||59.47.187.147^$popup + ||39.68.172.210^ ||39.68.172.210^$popup + ||122.192.177.176^ ||122.192.177.176^$popup + ||112.27.124.108^ ||112.27.124.108^$popup + ||123.110.176.246^ ||123.110.176.246^$popup + ||219.155.105.98^ ||219.155.105.98^$popup + ||171.35.161.209^ ||171.35.161.209^$popup + ||60.16.255.36^ ||60.16.255.36^$popup + ||112.30.4.52^ ||112.30.4.52^$popup + ||182.121.191.201^ ||182.121.191.201^$popup + ||121.61.48.170^ ||121.61.48.170^$popup + ||39.81.68.45^ ||39.81.68.45^$popup + ||27.222.220.164^ ||27.222.220.164^$popup + ||113.233.215.135^ ||113.233.215.135^$popup + ||151.77.100.133^ ||151.77.100.133^$popup + ||125.120.13.184^ ||125.120.13.184^$popup + ||120.12.138.133^ ||120.12.138.133^$popup + ||27.194.115.185^ ||27.194.115.185^$popup + ||104.128.199.228^ ||104.128.199.228^$popup + ||183.92.123.145^ ||183.92.123.145^$popup + ||110.89.8.126^ ||110.89.8.126^$popup + ||125.43.211.184^ ||125.43.211.184^$popup + ||1.0.218.230^ ||1.0.218.230^$popup + ||221.208.4.56^ ||221.208.4.56^$popup + ||60.13.60.19^ ||60.13.60.19^$popup + ||171.37.29.87^ ||171.37.29.87^$popup + ||124.91.237.188^ ||124.91.237.188^$popup + ||115.56.137.49^ ||115.56.137.49^$popup + ||115.52.240.69^ ||115.52.240.69^$popup + ||112.252.132.185^ ||112.252.132.185^$popup + ||117.198.240.157^ ||117.198.240.157^$popup + ||42.53.240.249^ ||42.53.240.249^$popup + ||116.179.138.68^ ||116.179.138.68^$popup + ||110.241.119.159^ ||110.241.119.159^$popup + ||115.56.31.133^ ||115.56.31.133^$popup + ||103.19.128.222^ ||103.19.128.222^$popup + ||202.12.80.74^ ||202.12.80.74^$popup + ||61.52.8.62^ ||61.52.8.62^$popup + ||182.122.252.69^ ||182.122.252.69^$popup + ||219.155.26.50^ ||219.155.26.50^$popup + ||120.4.141.185^ ||120.4.141.185^$popup + ||119.102.7.115^ ||119.102.7.115^$popup + ||72.51.127.213^ ||72.51.127.213^$popup + ||111.224.199.91^ ||111.224.199.91^$popup + ||119.250.236.122^ ||119.250.236.122^$popup + ||112.30.110.58^ ||112.30.110.58^$popup + ! https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community ||pcae.de^ ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community ||117.196.49.21^ ||117.196.49.21^$popup + ||115.55.54.234^ ||115.55.54.234^$popup + ||115.52.17.123^ ||115.52.17.123^$popup + ||182.59.69.21^ ||182.59.69.21^$popup + ! https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community ||chip-secured-download.de^ ||chip-secured-download.de^$popup @@ -7993,6 +8149,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations ||160.202.163.100^ ||160.202.163.100^$popup + ! https://www•virustotal•com/gui/ip-address/160•202•163•100/relations ||microsoftkernel.com^ ||microsoftkernel.com^$popup @@ -8012,12 +8169,15 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community ||45.95.169.115^ ||45.95.169.115^$popup + ! https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community ||45.148.120.80^ ||45.148.120.80^$popup + ! https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community ||85.239.33.9^ ||85.239.33.9^$popup + ! Relations to the domain above ||adminsys.serveftp.com^ ||adminsys.serveftp.com^$popup @@ -8050,9 +8210,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0/community ||107.173.176.183^ ||107.173.176.183^$popup + ! https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community ||45.148.120.171^ ||45.148.120.171^$popup + ! https://twitter•com/soranker0/status/1449491402409185283 ://disordgift. ://disordgift.$popup @@ -8066,6 +8228,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-951321929 ||159.148.186.228^ ||159.148.186.228^$popup + ! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains ||yotube.com^ ||yotube.com^$popup @@ -8087,7 +8250,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||news-back.org^$popup ! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md &url_bnm_redirect= -&url_bnm_redirect=$popup,~inline-font,domain=~malware-redirection-trains.* +&url_bnm_redirect=$popup /mcafeedirect.jsp /mcafeedirect.jsp$popup,domain=~mcafee.com /beep.mp3^$domain=xyz|club|pro @@ -8113,69 +8276,101 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community ||39.83.80.247^ ||39.83.80.247^$popup + ||68.197.33.124^ ||68.197.33.124^$popup + ||219.157.21.37^ ||219.157.21.37^$popup + ||182.123.141.17^ ||182.123.141.17^$popup + ||125.47.243.187^ ||125.47.243.187^$popup + ||182.122.196.203^ ||182.122.196.203^$popup + ||182.117.231.182^ ||182.117.231.182^$popup + ||112.31.211.135^ ||112.31.211.135^$popup + ||125.106.63.93^ ||125.106.63.93^$popup + ||115.59.197.46^ ||115.59.197.46^$popup + ||122.159.29.192^ ||122.159.29.192^$popup + ||171.40.0.127^ ||171.40.0.127^$popup + ||171.80.219.160^ ||171.80.219.160^$popup + ||123.10.65.201^ ||123.10.65.201^$popup + ||168.90.205.46^ ||168.90.205.46^$popup + ||125.47.205.109^ ||125.47.205.109^$popup + ||39.80.147.239^ ||39.80.147.239^$popup + ||45.224.171.130^ ||45.224.171.130^$popup + ||45.5.209.75^ ||45.5.209.75^$popup + ||116.17.210.157^ ||116.17.210.157^$popup + ||27.45.103.240^ ||27.45.103.240^$popup + ||110.167.64.171^ ||110.167.64.171^$popup + ||39.81.117.73^ ||39.81.117.73^$popup + ||183.15.90.156^ ||183.15.90.156^$popup + ||119.113.248.74^ ||119.113.248.74^$popup + ||175.0.95.85^ ||175.0.95.85^$popup + ||61.52.99.109^ ||61.52.99.109^$popup + ||222.142.183.194^ ||222.142.183.194^$popup + ||106.86.172.194^ ||106.86.172.194^$popup + ||103.233.216.77^ ||103.233.216.77^$popup + ||183.188.192.55^ ||183.188.192.55^$popup + ! https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community ||198.23.255.14^ ||198.23.255.14^$popup + ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971512075 ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971495248 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/15/1.md#iocs @@ -8188,8 +8383,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||runmodes.com^$popup ||91.121.67.60^ ||91.121.67.60^$popup + ||172.67.186.189^ ||172.67.186.189^$popup + ! https://www•virustotal•com/gui/url/af8f443208f4e86d469549b219fccbeb43b7cae40be5f1b4c4e5083e27fc8111 ||inconclusive-pyrite-grandparent.glitch.me^ ||inconclusive-pyrite-grandparent.glitch.me^$popup @@ -8200,7 +8397,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||holy-ruddy-brace.glitch.me^ ||holy-ruddy-brace.glitch.me^$popup ||instagramcomphoto212paaatrk.glitch.me^ -||instagramcomphoto212paaatrk.glitch.me^$popup,~inline-font,domain=~malware-redirection-trains.* +||instagramcomphoto212paaatrk.glitch.me^$popup ||instafollow.glitch.me^ ||instafollow.glitch.me^$popup ||loving-discovered-swordfish.glitch.me^ @@ -8217,12 +8414,16 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community ||39.65.72.211^ ||39.65.72.211^$popup + ||42.238.151.197^ ||42.238.151.197^$popup + ||27.213.60.53^ ||27.213.60.53^$popup + ||115.56.169.134^ ||115.56.169.134^$popup + ! https://github.com/iam-py-test/investigations/blob/main/2021/11/21/1.md ||yasir252.com^ ||yasir252.com^$popup @@ -8252,9 +8453,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/2b2628a50d3b39b0fa2395d487bf62b00e37cdae847ff76ee58399bbe4e9f7b3/community ||194.87.138.20^ ||194.87.138.20^$popup + ! https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community ||103.167.92.73^ ||103.167.92.73^$popup + ! https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community ||bursakulis.com^ ||bursakulis.com^$popup @@ -8291,20 +8494,28 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8/community ||58.249.74.79^ ||58.249.74.79^$popup + ||27.45.14.109^ ||27.45.14.109^$popup + ||27.40.101.191^ ||27.40.101.191^$popup + ||27.45.119.22^ ||27.45.119.22^$popup + ||27.47.73.159^ ||27.47.73.159^$popup + ||115.204.119.237^ ||115.204.119.237^$popup + ||163.125.31.46^ ||163.125.31.46^$popup + ||163.179.168.44^ ||163.179.168.44^$popup + ! https://github.com/uBlockOrigin/uAssets/pull/10647 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md ||money-mod.com^ @@ -8325,26 +8536,37 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community ||110.89.59.135^ ||110.89.59.135^$popup + ||113.116.89.1^ ||113.116.89.1^$popup + ||119.183.146.191^ ||119.183.146.191^$popup + ||153.3.3.226^ ||153.3.3.226^$popup + ||182.116.104.6^ ||182.116.104.6^$popup + ||60.7.133.200^ ||60.7.133.200^$popup + ||122.6.254.201^ ||122.6.254.201^$popup + ||110.89.11.167^ ||110.89.11.167^$popup + ||171.112.177.90^ ||171.112.177.90^$popup + ||115.194.38.143^ ||115.194.38.143^$popup + ||61.52.79.32^ ||61.52.79.32^$popup + ! https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 ://ups-dk.$denyallow=dk|nu|se|no|fo|gl|ups.com,domain=ups-dk.* ! https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 @@ -8388,6 +8610,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||dundeehills.group^$popup !+ NOT_OPTIMIZED ||132.148.220.142^ + ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 ||chess-progress.ru^ ||ouhastay.net^ @@ -8415,28 +8638,38 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||haxpc.net^$popup ||52.53.243.52^ ||52.53.243.52^$popup + ||34.201.22.10^ ||34.201.22.10^$popup + ! https://scammer.info/t/crypto-scammers-onceagain/85354 ||business.google.com/website/billyandscapedesign^ ||business.google.com/website/billyandscapedesign^$popup ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community ||123.10.225.196^ ||123.10.225.196^$popup + ||122.192.106.84^ ||122.192.106.84^$popup + ||172.88.199.9^ ||172.88.199.9^$popup + ||114.38.176.185^ ||114.38.176.185^$popup + ||61.52.97.35^ ||61.52.97.35^$popup + ||27.206.181.208^ ||27.206.181.208^$popup + ||124.163.130.175^ ||124.163.130.175^$popup + ||118.75.87.102^ ||118.75.87.102^$popup + ! https://github.com/iam-py-test/investigations/blob/main/2021/12/14/1.md ||onemacusa.net^ ||onemacusa.net^$popup @@ -8450,6 +8683,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||download-srvr.xyz^$popup ||134.122.115.190^ ||134.122.115.190^$popup + ||cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com^ ||cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com^$popup ! https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777 @@ -8481,6 +8715,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||ru.com^$popup ||141.8.226.34^ ||141.8.226.34^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/108571 ||ston-app.com^ ||ston-app.com^$popup @@ -8505,6 +8740,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/9d40ae0439ddc594b2cf64e21ad0fdea9bb440524298e3a6bcfcc1fb417f1ed2/relations ||91.240.118.172^ ||91.240.118.172^$popup + ! "Press Allow to continue" ||kuyhaa-mee.com^ ||kuyhaa-mee.com^$popup @@ -8582,6 +8818,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||top3hostngc.xyz^$popup ||198.199.120.251^ ||198.199.120.251^$popup + ! https://www•telia.no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/ @@ -8623,7 +8860,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||cumpussyy.uno^ ||cumpussyy.uno^$popup ||195.201.253.130^ + ||195.201.253.131^ + ! The bottom download button on https://www•sushichop•com/ ||installiq.com^ ||installiq.com^$popup @@ -8633,7 +8872,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sandhyapi.online^$popup /trk2/*?lddomain=,domain=~very-likely-a-malware-redirection.* ||rtbrvdirect.com^ -||rtbrvdirect.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||rtbrvdirect.com^$popup ||goprotectpc.com^ ||goprotectpc.com^$popup ||mybetterck.com^ @@ -8650,10 +8889,15 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||rtbvrdirect.com^$domain=~malware-redirection-trains.* ||cpmverdirect.com^$domain=~malware-redirection-trains.* ||15.197.244.48^ + ||96.47.230.67^ + ||96.47.230.68^ + ||96.47.230.69^ + ||96.47.230.70^ + ! https://securitytrails•com/list/ns/ns1•fastthinkingdns•com ||highercaptcha-settle. ||highercaptcha-settle.$popup @@ -8674,7 +8918,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 ||trafredirtds.com^ -||trafredirtds.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||trafredirtds.com^$popup ||com/landers/iphone*_spin ! https://github.com/AdguardTeam/AdguardFilters/issues/121772 ||pu020ev.com^ @@ -8682,7 +8926,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||kadam.net^ ||kadam.net^$popup ||kdtrk.net^ -||kdtrk.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||kdtrk.net^$popup ||clcpb.net^ ||clcpb.net^$popup ||kadam.ru^ @@ -8724,11 +8968,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||viiyhn.com^ ||viiyhn.com^$popup ||31.220.27.134^ + ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk. ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 ||saferedirects.xyz^ -||saferedirects.xyz^$popup,~inline-font,domain=~malware-redirection-trains.* +||saferedirects.xyz^$popup ||online-guard.com^ ||online-guard.com^$popup /mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=,popup,domain=~fake-site-with-malware.* @@ -9216,13 +9461,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||tov49ro5ep.art^ ||tov49ro5ep.art^$popup ||track2it4.icu^ -||track2it4.icu^$popup,~inline-font,domain=~malware-redirection-trains.* +||track2it4.icu^$popup ||trackerry.com^ -||trackerry.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||trackerry.com^$popup ||trackgdi.com^ -||trackgdi.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||trackgdi.com^$popup ||trckrry.com^ -||trckrry.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||trckrry.com^$popup ||udlwwle.site^ ||udlwwle.site^$popup ||uij5nn-ta.cyou^ @@ -9315,8 +9560,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||85.17.31.152^ ||85.17.31.152^$popup + ||95.211.26.202^ ||95.211.26.202^$popup + ! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 ||bzsx.link^ ||bzsx.link^$popup @@ -9343,8 +9590,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||wznp.link^ ||wznp.link^$popup ||158.247.212.220^ + ||165.227.168.212^ + ! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ ://162.241.115. @@ -9432,6 +9681,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||galantinkoling.com^$popup ||23.81.64.183^ ||23.81.64.183^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/125300 ||zikroarg.com^ ||zikroarg.com^$popup @@ -9768,8 +10018,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||vooculok.com^ ||vooculok.com^$popup ||mobytrks.com^ -||mobytrks.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||mobytrks.com^$popup ||139.45.197.236^ + ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^ ||becovi.com^$popup @@ -9800,8 +10051,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||frescopartito.com^$popup ||motherpipe.net^ ||51.91.66.125^ + ||51.178.76.105^ + ||147.135.253.55^ + ! https://github.com/uBlockOrigin/uAssets/issues/14569 → https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection (https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) ||bnbdeal.net^ ||bnbdeal.net^$popup @@ -9812,7 +10066,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] /^http://imgblaze.net/[a-z0-9]{6}$/$third-party,subdocument ! https://github.com/AdguardTeam/AdguardFilters/issues/131156 ||146.19.169.98^ + ||146.19.169.99^ + ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 /pushredirect/?,domain=~malware-redirection-trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -11398,7 +11654,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||keystonehoops.com^ ||keystonehoops.com^$popup ||keywebtracker.com^ -||keywebtracker.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||keywebtracker.com^$popup ||keywordadvisetoolplus.com^ ||keywordadvisetoolplus.com^$popup ||kickoff.cm^ @@ -13353,6 +13609,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com^$popup ||69.162.80.56^ ||69.162.80.56^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/134903 ||smartlink.name^ ||smartlink.name^$popup @@ -13361,6 +13618,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||giveawaycord. ||giveawaycord.$popup ||162.241.124.200^ + ! https://github.com/AdguardTeam/AdguardFilters/issues/135815 ||adsstar.in^$popup ||clickcafe.in^$popup @@ -13377,6 +13635,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||usanewstoday.club^$popup ||webhostingtips.club^$popup ||157.90.71.190^ + ! https://github.com/AdguardTeam/AdguardFilters/issues/135924 ||abazelfan.com^ ||abazelfan.com^$popup @@ -13469,7 +13728,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||civadsoo.net^ ||civadsoo.net^$popup ||clicktracklink.com^ -||clicktracklink.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||clicktracklink.com^$popup ||comivolo.com^ ||comivolo.com^$popup ||consoupow.com^ @@ -13850,6 +14109,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zoawufoy.net^$popup ||139.45.197.239^ ||139.45.197.239^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub.ument,popup ! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -14245,8 +14505,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zigaahm.icu^ ||zigaahm.icu^$popup ||44.228.230.225^ + ||50.112.124.170^ + ||100.20.104.229^ + ! Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread ||link.sv^$popup ||4.fo^$popup @@ -14254,7 +14517,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||kckb.st^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 -trk.xyz^ --trk.xyz^$popup,~inline-font,domain=~malware-redirection-trains.* +-trk.xyz^$popup ||loadingnow.me^ ||loadingnow.me^$popup ||gsecurecontent.com^ @@ -14264,14 +14527,19 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sapino.net^ ||sapino.net^$popup ||44.236.213.34^ + ||52.24.156.12^ + ||52.25.6.134^ + ||100.20.13.49^ + ! https://github.com/AdguardTeam/AdguardFilters/issues/139667 ||goldmesoil.live^ ||goldmesoil.live^$popup ||51.68.87.229^ ||51.68.87.229^$popup + ||f9dle.skin^ ||f9dle.skin^$popup ||kilpa2017.fi^ @@ -17848,9 +18116,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||webull-download. ||webull-download.$popup ||185.106.94.139^ + ||45.90.109.196^ + ||91.229.23.200^ ||91.229.23.200^$popup + ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1401711872 ! https://github.com/AdguardTeam/AdguardFilters/issues/144514 ||attractbestbonuses.life^ @@ -17971,8 +18242,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||winmacros.life^$popup ||185.155.184.98^ ||185.155.184.98^$popup + ||194.110.247.242^ ||194.110.247.242^$popup + ! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ ||ups-addressed.me^ ||ups-addressed.me^$popup @@ -17981,6 +18254,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||meta-whatsapp.me^ ||meta-whatsapp.me^$popup ||54.219.218.169^ + ! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^ ||0365alert.com^$popup @@ -18842,6 +19116,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yourorderupdate.com^$popup ||64.132.201.92^ ||64.132.201.92^$popup + ! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||acessmygov.online^ ||acessmygov.online^$popup @@ -18882,6 +19157,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||elimef.link^ ||209.141.51.49^ ||209.141.51.49^$popup + ://soekpakke*.blogspot.com^ ://soekpakke*.blogspot.com^$popup ||post-norway.web.app^ @@ -20068,10 +20344,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! Unsuited for wildcarding ||208.88.225.116^ ||208.88.225.116^$popup + ||208.88.225.117^ ||208.88.225.117^$popup + ||208.88.225.119^ ||208.88.225.119^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/144823 !+ NOT_OPTIMIZED ://landings.*_slots/?partner= @@ -20237,7 +20516,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||uthyr-que.com^ ||uthyr-que.com^$popup ||zeroredirect1.com^ -||zeroredirect1.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||zeroredirect1.com^$popup ||zp-dom.com^ ||zp-dom.com^$popup ||redirect.newprogrammatic.click^$domain=~likely-a-malware-redirection.* @@ -20270,12 +20549,16 @@ zombooru.com##a[href$="ttp://www.hard55.com"] /zcvisitor/*?campaignid ||3.231.116.86^ ||3.231.116.86^$popup + ||54.237.193.255^ ||54.237.193.255^$popup + ||3.231.137.120^ ||3.231.137.120^$popup + ||54.204.83.105^ ||54.204.83.105^$popup + ! https://github.com/DandelionSprout/adfilt/issues/808 ! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) ||jonathanbartz.com^ @@ -20311,14 +20594,19 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||i-likefood.co^ ||108.61.242.65^ ||108.61.242.65^$popup + ||146.70.78.43^ ||146.70.78.43^$popup + ||87.120.254.39^ ||87.120.254.39^$popup + ||45.150.108.213^ ||45.150.108.213^$popup + ||92.204.160.240^ ||92.204.160.240^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 /land/*&afftrack=,domain=~likely-a-malware-redirection.* ! Comments on Slack @@ -20626,6 +20914,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||watchuberdevelopedinfo-product.info^$popup ||34.200.46.148^ ||34.200.46.148^$popup + ||abstorick.com^ ||abstorick.com^$popup ||affienness.com^ @@ -20740,6 +21029,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zondeucearixes.com^$popup ||85.17.80.16^ ||85.17.80.16^$popup + ! https://www•adressa.no/nyheter/trondheim/i/Moq2wR/svindlere-kaarer-vinnere-i-konkurranser-gir-en-daarlig-foelelse-aa-forklare-at-dette-bare-er-tull ||sitey.me^ ! https://github.com/AdguardTeam/AdguardFilters/issues/151479 @@ -20897,9 +21187,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||jump-path2.com^ ||jump-path2.com^$popup ||redirect-path1.com^ -||redirect-path1.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||redirect-path1.com^$popup ||redirect-path2.com^ -||redirect-path2.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||redirect-path2.com^$popup ||your-online-casino.com^ ||your-online-casino.com^$popup ||hot-girls-around.com^ @@ -20953,9 +21243,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||pw-show-test.com^ ||pw-show-test.com^$popup ||pwredir-*.com^ -||pwredir-*.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||pwredir-*.com^$popup ||redir-pw*.com^ -||redir-pw*.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||redir-pw*.com^$popup ||rich-people-club.com^ ||rich-people-club.com^$popup ||search-top-videos.com^ @@ -21018,14 +21308,19 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||your-survey-services.com^$popup ||185.246.188.124^ ||185.246.188.124^$popup + ||185.246.188.125^ ||185.246.188.125^$popup + ||194.63.140.103^ ||194.63.140.103^$popup + ||194.63.143.61^ ||194.63.143.61^$popup + ||194.63.143.96^ ||194.63.143.96^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/152945 ||moneystartup.live^ ||moneystartup.live^$popup @@ -21291,7 +21586,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||pclkpackg.xyz^ ||pclkpackg.xyz^$popup ||pclkredrct.xyz^ -||pclkredrct.xyz^$popup,~inline-font,domain=~malware-redirection-trains.* +||pclkredrct.xyz^$popup ||popular-messages.com^ ||popular-messages.com^$popup ||premium-news-for.me^ @@ -21299,7 +21594,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||premium-shops-around.me^ ||premium-shops-around.me^$popup ||pushapitracker.com^ -||pushapitracker.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||pushapitracker.com^$popup ||read-and-reveal.com^ ||read-and-reveal.com^$popup ||read-before-the-rest.com^ @@ -21401,7 +21696,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||trends-celebs.com^ ||trends-celebs.com^$popup ||ts-tracker.me^ -||ts-tracker.me^$popup,~inline-font,domain=~malware-redirection-trains.* +||ts-tracker.me^$popup ||updates-news-magazine.com^ ||updates-news-magazine.com^$popup ||videochatonlinesite.com^ @@ -21440,10 +21735,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zorka-news.com^$popup ||37.48.80.112^ ||37.48.80.112^$popup + ||95.168.170.165^ ||95.168.170.165^$popup + ||213.227.149.216^ ||213.227.149.216^$popup + ! Slack comments ||cojcdn.net^ ||cojcdn.net^$popup @@ -21458,29 +21756,29 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||puredi.net^ ||puredi.net^$popup ||redic.net^ -||redic.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redic.net^$popup ||redic2.net^ -||redic2.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redic2.net^$popup ||redic3.com^ -||redic3.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||redic3.com^$popup ||redic4.com^ -||redic4.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||redic4.com^$popup ||redir2.net^ -||redir2.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redir2.net^$popup ||redir3.net^ -||redir3.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redir3.net^$popup ||redir4.net^ -||redir4.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redir4.net^$popup ||redir5.net^ -||redir5.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redir5.net^$popup ||redir6.net^ -||redir6.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redir6.net^$popup ||redir7.net^ -||redir7.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redir7.net^$popup ||redir8.net^ -||redir8.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redir8.net^$popup ||redir9.net^ -||redir9.net^$popup,~inline-font,domain=~malware-redirection-trains.* +||redir9.net^$popup ||rejco.online^ ||rejco.online^$popup ||rejco2.store^ @@ -21495,8 +21793,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||updateasap.online^$popup ||109.206.168.16^ ||109.206.168.16^$popup + ||109.206.168.17^ ||109.206.168.17^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/155298 ||cadstoppam.live^ ||cadstoppam.live^$popup @@ -21528,6 +21828,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||usedhutsold.live^$popup ||57.128.71.215^ ||57.128.71.215^$popup + /^.*&[a-z]{1,2}=[a-zA-Z0-9]{0,}%[a-zA-Z0-9%]{1000,}$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/155936 ||truanet.com^ @@ -22572,7 +22873,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||rcqmrz.com^ ||rcqmrz.com^$popup ||redirected1.com^ -||redirected1.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||redirected1.com^$popup ||rfduik.com^ ||rfduik.com^$popup ||rgitpv.com^ @@ -22993,24 +23294,34 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zzrgab.com^$popup ||37.1.223.231^ ||37.1.223.231^$popup + ||139.45.197.167^ ||139.45.197.167^$popup + ||139.45.197.245^ ||139.45.197.245^$popup + ||159.223.137.164^ ||159.223.137.164^$popup + ||185.56.234.205^ ||185.56.234.205^$popup + ||192.243.58.97^ ||192.243.58.97^$popup + ||192.243.58.98^ ||192.243.58.98^$popup + ||192.243.58.123^ ||192.243.58.123^$popup + ||192.243.58.124^ ||192.243.58.124^$popup + ||192.243.58.125^ ||192.243.58.125^$popup + ||[2a02:b48:207:1::2]^ ||[2a02:b48:207:1::2]^$popup ||[2a02:b48:207:1::3]^ @@ -23664,7 +23975,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||searchexcellent.com^ ||searchexcellent.com^$popup ||searchingredirect.com^ -||searchingredirect.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||searchingredirect.com^$popup ||searchinquire.com^ ||searchinquire.com^$popup ||searchsimilars.com^ @@ -23763,10 +24074,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||ztomy.com^$popup ||5.45.123.44^ ||5.45.123.44^$popup + ||69.16.230.226^ ||69.16.230.226^$popup + ||208.91.196.46^ ||208.91.196.46^$popup + /page/bouncy.php? /page/bouncy.php?$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/158316 @@ -32916,6 +33230,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||wmptengate.com^$popup ||93.93.51.223^ ||93.93.51.223^$popup + ||livejasmin.com/*&origin= ! https://github.com/AdguardTeam/AdguardFilters/issues/161364 ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) @@ -32992,7 +33307,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||cloud-network.online^ ||cloud-network.online^$popup ||cmcmdirrect.com^ -||cmcmdirrect.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||cmcmdirrect.com^$popup ||coltersaidas.com^ ||coltersaidas.com^$popup ||com-96-hours.com^ @@ -33242,7 +33557,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||qc1.site^ ||qc1.site^$popup ||redirect2url.com^ -||redirect2url.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||redirect2url.com^$popup ||revoiut-cy.com^ ||revoiut-cy.com^$popup ||revoke.money^ @@ -33415,6 +33730,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||reschedule-delivery.ups.com. ||103.174.102.240^ ||103.174.102.240^$popup + ! https://github.com/libre-tube/LibreTube/issues/4409 ||libretube.app^ ||libretube.app^$popup @@ -33663,17 +33979,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||204.44.92.187 ||204.44.92.187$popup ://ap-trk. -://ap-trk.$popup,~inline-font,domain=~malware-redirection-trains.* +://ap-trk.$popup ://cw-trk. -://cw-trk.$popup,~inline-font,domain=~malware-redirection-trains.* +://cw-trk.$popup ://cw-trak. -://cw-trak.$popup,~inline-font,domain=~malware-redirection-trains.* +://cw-trak.$popup ://ktraks. -://ktraks.$popup,~inline-font,domain=~malware-redirection-trains.* +://ktraks.$popup ://flow-clck. -://flow-clck.$popup,~inline-font,domain=~malware-redirection-trains.* +://flow-clck.$popup ://apps-trk. -://apps-trk.$popup,~inline-font,domain=~malware-redirection-trains.* +://apps-trk.$popup ! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103 ||betzykrisesenter.no^ ||citra2010oslo.no^ @@ -33695,6 +34011,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||monetrizer*.$popup ||38.180.96.244^ ||38.180.96.244^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/172569 ||acareewityjh.com^ ||acareewityjh.com^$popup @@ -34366,8 +34683,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yvaluationiamcur.com^$popup ||34.195.224.242^ ||34.195.224.242^$popup + ||54.225.185.110^ ||54.225.185.110^$popup + &lp=not_robot_ &lp=not_robot_$popup ||githubtalentcommunity. @@ -34387,6 +34706,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||pochta-ru.com^$popup ||91.202.233.143^ ||91.202.233.143^$popup + ! Based on a tip from my secretary ||0842-3231-4323-4243-2344-1333-0595-3453-6439-7-3235-03928-2348.name^ ||0842-3231-4323-4243-2344-1333-0595-3453-6439-7-3235-03928-2348.name^$popup @@ -35096,6 +35416,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||trafficredirectchain.com^$popup ||108.62.157.10^ ||108.62.157.10^$popup + ! https://github.com/AdguardTeam/FiltersRegistry/issues/925 ! https://github.com/AdguardTeam/FiltersRegistry/pull/927 ||avito.avito.avito. @@ -35121,24 +35442,34 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/179170 ||172.240.108.68^ ||172.240.108.68^$popup + ||172.240.108.76^ ||172.240.108.76^$popup + ||172.240.108.84^ ||172.240.108.84^$popup + ||172.240.127.234^ ||172.240.127.234^$popup + ||172.240.253.132^ ||172.240.253.132^$popup + ||192.243.59.12^ ||192.243.59.12^$popup + ||192.243.59.13^ ||192.243.59.13^$popup + ||192.243.59.20^ ||192.243.59.20^$popup + ||192.243.61.225^ ||192.243.61.225^$popup + ||192.243.61.227^ ||192.243.61.227^$popup + ||0sntp7dnrr.com^ ||0sntp7dnrr.com^$popup ||0x01n2ptpuz3.com^ @@ -41094,6 +41425,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/181966 ||167.71.252.38^ ||167.71.252.38^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/183432 ||100carbures.com^ ||100carbures.com^$popup @@ -43312,12 +43644,16 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zymstr.com^$popup ||185.149.120.161^ ||185.149.120.161^$popup + ||185.149.120.163^ ||185.149.120.163^$popup + ||185.149.120.173^ ||185.149.120.173^$popup + ||185.149.120.175^ ||185.149.120.175^$popup + ! https://github.com/AdguardTeam/AdguardFilters/issues/184671 ||2rlive.com^ ||2rlive.com^$popup @@ -43643,6 +43979,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zircontahafuz.com^$popup ||185.149.120.173^ ||185.149.120.173^$popup + ! https://sol•no/81812194/ / https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-10360231 ||02helpinfo.com^ ||02helpinfo.com^$popup @@ -44620,43 +44957,63 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||youweb-bpm.com^$popup ||45.202.32.3^ ||45.202.32.3^$popup + ||45.8.92.138^ ||45.8.92.138^$popup + ||79.133.46.252^ ||79.133.46.252^$popup + ||82.147.85.156^ ||82.147.85.156^$popup + ||91.212.166.16^ ||91.212.166.16^$popup + ||94.156.64.129^ ||94.156.64.129^$popup + ||94.232.249.61^ ||94.232.249.61^$popup + ||94.232.249.69^ ||94.232.249.69^$popup + ||94.232.249.75^ ||94.232.249.75^$popup + ||94.232.249.235^ ||94.232.249.235^$popup + ||176.111.174.118^ ||176.111.174.118^$popup + ||176.113.115.191^ ||176.113.115.191^$popup + ||191.96.224.140^ ||191.96.224.140^$popup + ||193.124.185.42^ ||193.124.185.42^$popup + ||193.143.1.45^ ||193.143.1.45^$popup + ||193.143.1.214^ ||193.143.1.214^$popup + ||193.143.1.217^ ||193.143.1.217^$popup + ||208.91.189.203^ ||208.91.189.203^$popup + ://193.143.1.* +! https://github.com/AdguardTeam/AdguardFilters/issues/189905 +/?nw=1&tb=false&cw= ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -47900,9 +48257,12 @@ toorgle.net##.join ||zzdb5p4upiug.com^ ||zzdb5p4upiug.com^$popup ||192.243.59.12^ + ||192.243.59.13^ + ||192.243.59.20^ + /^(https?://)?192\.243\.59\.\d{1,3}($|/)/ ! rule34hentai.net when uBlock Filters and AdGuard Base are turned off @@ -47958,13 +48318,17 @@ toorgle.net##.join ||194.226.139.121^ ||194.226.139.121^$popup + ||194.226.139.7^ ||194.226.139.7^$popup + ||95.181.157.36^ ||95.181.157.36^$popup + ||95.181.172.204^ ||95.181.172.204^$popup + ://194.226.139. ! AS209813 (https://github.com/AdguardTeam/AdguardFilters/issues/114618#issuecomment-1100702530; currently specific to tools that support CIDR blocking) ://5.8.67. @@ -49158,6 +49522,7 @@ toorgle.net##.join ||abnegationbanquet.com^ ||abnegationbanquet.com^$popup ||192.243.61.225^ + ! https://twitter•com/medicinehelp/status/1550250932394409985 ! https://securitytrails•com/list/ip/147•135•16•27 ||2spendless. @@ -49215,6 +49580,7 @@ toorgle.net##.join ||medicinecoupons.xyz^ ||medicinehelp.news^ ||147.135.16.27^ + ! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^ ! Spambot posts on Tumblr (19/09/2022) @@ -49226,9 +49592,9 @@ tumblr.com#?#div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://b apkfab.com##.tip-extension ! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022) ||xxlmag.com/redirect^ -||xxlmag.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* +||xxlmag.com/redirect^$popup ||ultimateclassicrock.com/redirect^ -||ultimateclassicrock.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* +||ultimateclassicrock.com/redirect^$popup ||2y68554.cyou^ ||2y68554.cyou^$popup ||1pwk1j.cyou^ @@ -49236,17 +49602,18 @@ apkfab.com##.tip-extension ||986.group^ ||986.group^$popup ||185.87.148.199^ + ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) ||imaot.co.il/ContentArea/BannerClick^ ||imaot.co.il/ContentArea/BannerClick^$popup ||q1065.fm/redirect^ -||q1065.fm/redirect^$popup,~inline-font,domain=~malware-redirection-results.* +||q1065.fm/redirect^$popup ||wobm.com/redirect^ -||wobm.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* +||wobm.com/redirect^$popup ||us105fm.com/redirect^ -||us105fm.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* +||us105fm.com/redirect^$popup ||wnbf.com/redirect^ -||wnbf.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* +||wnbf.com/redirect^$popup ||ynxqoc2.cyou^ ||ynxqoc2.cyou^$popup ||resurrectionlinks.online^ @@ -49258,10 +49625,11 @@ apkfab.com##.tip-extension ||zh1653.com^ ||zh1653.com^$popup ||45.136.49.35^ + ||semex.com/popurl.cgi^ -||semex.com/popurl.cgi^$popup,~inline-font,domain=~malware-redirection-results.* +||semex.com/popurl.cgi^$popup ||pharmanimal.com/catalog/redirect.php^ -||pharmanimal.com/catalog/redirect.php^$popup,~inline-font,domain=~malware-redirection-results.* +||pharmanimal.com/catalog/redirect.php^$popup ! Browsing around for Tajik newssites ||arhernot.live^ ||arhernot.live^$popup @@ -49365,14 +49733,19 @@ apkfab.com##.tip-extension ||onlymetsure.live^$popup ||51.91.211.94^ ||51.91.211.94^$popup + ||162.19.71.16^ ||162.19.71.16^$popup + ||146.59.240.191^ ||146.59.240.191^$popup + ||54.37.5.34^ ||54.37.5.34^$popup + ||54.36.118.105^ ||54.36.118.105^$popup + ! Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt ||highlandnews.com^ ||highlandnews.com^$popup @@ -49381,7 +49754,7 @@ apkfab.com##.tip-extension ||diverseflowlink.com^ ||diverseflowlink.com^$popup ||redirectedflow.com^ -||redirectedflow.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||redirectedflow.com^$popup ||pcbasicstrength.com^ ||pcbasicstrength.com^$popup ||conceptualizefact.com^ @@ -49426,6 +49799,7 @@ apkfab.com##.tip-extension ||pcnetworkdefense.com^$popup ||159.89.10.102^ ||159.89.10.102^$popup + ! Other ||foxsportnetwork.com^ ||foxsportnetwork.com^$popup @@ -49465,6 +49839,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||carpiesi.com^$popup ||104.206.252.90^ ||104.206.252.90^$popup + ! https://github.com/blocklistproject/Lists/issues/933 ||jNKmS0zFuEh.click^ ||jNKmS0zFuEh.click^$popup @@ -49506,6 +49881,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) ||34.80.59.191^ ||34.80.59.191^$popup + ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 |http://www6.$domain=~often-used-in-malware-redirections.* |http://www1.*&kw,domain=~often-used-in-malware-redirections.* @@ -49518,17 +49894,29 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||wh40kart.im^ ||wh40kart.im^$popup ||45.33.2.79^ + ||45.33.18.44^ + ||45.33.20.235^ + ||45.33.23.183^ + ||45.33.30.197^ + ||45.56.79.23^ + ||45.79.19.196^ + ||72.14.178.174^ + ||72.14.185.43^ + ||96.126.123.244^ + ||173.255.194.134^ + ||198.58.118.167^ + ! https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ ||123chance.net^ ||123chance.net^$popup @@ -49609,7 +49997,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||awesomewinners.net^ ||awesomewinners.net^$popup ||b2ztrk.com^ -||b2ztrk.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||b2ztrk.com^$popup ||beastgadget.net^ ||beastgadget.net^$popup ||beastoffer.net^ @@ -50275,7 +50663,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||yasdoodl.com^ ||yasdoodl.com^$popup ||ym3trk.com^ -||ym3trk.com^$popup,~inline-font,domain=~malware-redirection-trains.* +||ym3trk.com^$popup ||youwanthis.com^ ||youwanthis.com^$popup ||zebramode.com^ @@ -50284,16 +50672,22 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||zebraoffers.net^$popup ||34.117.199.78^ ||34.117.199.78^$popup + ||94.237.103.119^ ||94.237.103.119^$popup + ||94.237.84.54^ ||94.237.84.54^$popup + ||94.237.93.242^ ||94.237.93.242^$popup + ||94.237.99.118^ ||94.237.99.118^$popup + ||139.45.197.249^ ||139.45.197.249^$popup + ! https://dnpedia•com/tlds/topm•php bizarrely listing "anahitagirted•uno" as the 622th most visited domain worldwide ||acorusinfield.life^ ||acorusinfield.life^$popup @@ -51072,18 +51466,25 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] *butikksoslo.com^ ||196.196.153.151^ ||196.196.153.151^$popup + ||158.222.7.116^ ||158.222.7.116^$popup + ||196.245.152.139^ ||196.245.152.139^$popup + ||165.231.251.197^ ||165.231.251.197^$popup + ||196.242.16.29^ ||196.242.16.29^$popup + ||165.231.4.90^ ||165.231.4.90^$popup + ||158.222.7.83^ ||158.222.7.83^$popup + ! Spam on W.I.T.C.H. and Winx text search results tumblr.com#?#div[tabindex][style]:has(a[href*="tinyurl."]:has-text(_1+8_)) tumblr.com#?#div[tabindex][style]:has(a[href*="://cutt.ly/"]) @@ -51208,6 +51609,7 @@ tumblr.com#?#div[tabindex][style]:has(a[href*="://cutt.ly/"]) ||zoll-pakete-support.com^$popup ||95.214.26.78^ ||95.214.26.78^$popup + ! Overly dedicated E-mail spammers ||wirexapp.africa.com^ ||wirexapp.africa.com^$popup @@ -51223,7 +51625,9 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat ||deltacorriher.best^ ||deltacorriher.best^$popup ||104.21.82.132^$popup + ||172.67.158.57^$popup + ||[2606:4700:3030::6815:5284]^$popup ||[2606:4700:3037::ac43:9e39]^$popup ! Google results for «SodaStream site:no cranberry» @@ -51267,8 +51671,10 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat ||slownansuch.info^$popup ||185.155.184.57^ ||185.155.184.57^$popup + ||185.155.186.24^ ||185.155.186.24^$popup + ||usayn.fr^ ||usayn.fr^$popup ||style-js.com^ @@ -51277,6 +51683,7 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat /a.aspx?cid=*&cname=^$popup ||209.74.107.131^ ||209.74.107.131^$popup + ||qidjrsgroup.shop^ ||qidjrsgroup.shop^$popup /flying.asp?cid= @@ -51417,8 +51824,10 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat ||zeirj14ikqwf.com^$popup ||69.172.200.185^ ||69.172.200.185^$popup + ||77.220.214.153^ ||77.220.214.153^$popup + ! More search terms than what can be counted with a supercomputer (11/03/2024) ! Scam E-mails I've got ||googleapis.com/nwfotrac^ @@ -51890,6 +52299,7 @@ www.microsoft.com##a[data-pfns][href*=pac-men] + ! https://github.com/AdguardTeam/AdguardFilters/issues/145513 diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 3deb308c2..2964b388b 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,10 +1,9 @@ ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 21September2024v1 +! Version: 30September2024v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists -! (Note to self, only applicable to uBO: When 1.59.1 goes stable, implement "*$ipaddress=(...),all" for the IP addresses, alongside the previous syntaxing as the case is for AdGuard Browser Extension.) ! Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#-english ! ——— Bad top-level domains ——— @@ -91,6 +90,7 @@ www.google.*##*:has(> * > a[oncontextmenu][href^="https://books.google."]) 109.201.135.46$network !+ NOT_PLATFORM(windows, mac, android) ||109.201.135.46^$all + ||fredfiber.no^$document ||securemecca.com^$document @@ -135,6 +135,7 @@ www.google.*##*:has(> * > a[oncontextmenu][href^="https://books.google."]) 138.68.252.54$network !+ NOT_PLATFORM(windows, mac, android) ||138.68.252.54^$all + ||useragentswitch.com^$all ||dev-nano.com^$all ||adblocker-app.info^$all @@ -441,6 +442,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) 103.224.212.249$network !+ NOT_PLATFORM(windows, mac, android) ||103.224.212.249^$all + ||speedtest.com^$document,domain=~you-were-likely-looking-for-speedtest.net ||snapchat.cm^$document,domain=~malware-typo-squatter-of-snapchat.com ||facebook.cm^$document,domain=~malware-typo-squatter-of-facebook.com @@ -449,36 +451,44 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) 199.59.243.222$network !+ NOT_PLATFORM(windows, mac, android) ||199.59.243.222^$all + |http://ww01.$document,domain=~very-very-extremely-frequently-used-in-malware-redirections.* ||14d.us^$all,~inline-font,domain=~malware-redirection-and-also-you-were-very-likely-looking-for-1d4.us !+ PLATFORM(windows, mac, android) 173.208.96.42$network !+ NOT_PLATFORM(windows, mac, android) ||173.208.96.42^$all + !+ PLATFORM(windows, mac, android) 173.208.96.43$network !+ NOT_PLATFORM(windows, mac, android) ||173.208.96.43^$all + !+ PLATFORM(windows, mac, android) 173.208.96.44$network !+ NOT_PLATFORM(windows, mac, android) ||173.208.96.44^$all + !+ PLATFORM(windows, mac, android) 173.208.96.45$network !+ NOT_PLATFORM(windows, mac, android) ||173.208.96.45^$all + !+ PLATFORM(windows, mac, android) 173.208.96.46$network !+ NOT_PLATFORM(windows, mac, android) ||173.208.96.46^$all + !+ PLATFORM(windows, mac, android) 213.227.149.208$network !+ NOT_PLATFORM(windows, mac, android) ||213.227.149.208^$all + !+ PLATFORM(windows, mac, android) 213.227.149.211$network !+ NOT_PLATFORM(windows, mac, android) ||213.227.149.211^$all + ||ddscordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com ||diicordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com ||disccrdapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com @@ -567,6 +577,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) 54.174.156.141$network !+ NOT_PLATFORM(windows, mac, android) ||54.174.156.141^$all + ||lucretius-ada.com^$all ||hippolyte-hag.com^$all ||india-abc.com^$all @@ -583,34 +594,42 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) 54.209.22.226$network !+ NOT_PLATFORM(windows, mac, android) ||54.209.22.226^$all + !+ PLATFORM(windows, mac, android) 54.91.125.197$network !+ NOT_PLATFORM(windows, mac, android) ||54.91.125.197^$all + !+ PLATFORM(windows, mac, android) 52.202.53.245$network !+ NOT_PLATFORM(windows, mac, android) ||52.202.53.245^$all + !+ PLATFORM(windows, mac, android) 35.175.38.64$network !+ NOT_PLATFORM(windows, mac, android) ||35.175.38.64^$all + !+ PLATFORM(windows, mac, android) 35.168.147.213$network !+ NOT_PLATFORM(windows, mac, android) ||35.168.147.213^$all + !+ PLATFORM(windows, mac, android) 34.230.160.215$network !+ NOT_PLATFORM(windows, mac, android) ||34.230.160.215^$all + !+ PLATFORM(windows, mac, android) 3.226.8.132$network !+ NOT_PLATFORM(windows, mac, android) ||3.226.8.132^$all + !+ PLATFORM(windows, mac, android) 3.216.243.46$network !+ NOT_PLATFORM(windows, mac, android) ||3.216.243.46^$all + ||roamingclicks.com^$all ! Source: desidert•no ||collectfasttracks.com^$all,~inline-font,domain=~malware-redirection-trains.* @@ -625,14 +644,17 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) 54.152.245.247$network !+ NOT_PLATFORM(windows, mac, android) ||54.152.245.247^$all + !+ PLATFORM(windows, mac, android) 35.172.40.232$network !+ NOT_PLATFORM(windows, mac, android) ||35.172.40.232^$all + !+ PLATFORM(windows, mac, android) 3.90.125.85$network !+ NOT_PLATFORM(windows, mac, android) ||3.90.125.85^$all + ! Various ex-affiliate links at www•zombooru•com ||track.vcdc.com^$all,~inline-font,domain=~malware-redirection-trains.* ||track.tkbo.com^$all,~inline-font,domain=~malware-redirection-trains.* @@ -646,22 +668,27 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) 94.130.185.237$network !+ NOT_PLATFORM(windows, mac, android) ||94.130.185.237^$all + !+ PLATFORM(windows, mac, android) 94.130.186.231$network !+ NOT_PLATFORM(windows, mac, android) ||94.130.186.231^$all + !+ PLATFORM(windows, mac, android) 144.76.0.242$network !+ NOT_PLATFORM(windows, mac, android) ||144.76.0.242^$all + !+ PLATFORM(windows, mac, android) 144.76.1.130$network !+ NOT_PLATFORM(windows, mac, android) ||144.76.1.130^$all + !+ PLATFORM(windows, mac, android) 195.201.92.254$network !+ NOT_PLATFORM(windows, mac, android) ||195.201.92.254^$all + zombooru.com##a[href$="ttp://www.boorufurry.com/"] zombooru.com##a[href$="ttp://www.analbooru.com/"] zombooru.com##a[href$="ttp://www.hard55.com"] @@ -687,18 +714,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 34.204.214.165$network !+ NOT_PLATFORM(windows, mac, android) ||34.204.214.165^$all + !+ PLATFORM(windows, mac, android) 54.85.113.62$network !+ NOT_PLATFORM(windows, mac, android) ||54.85.113.62^$all + !+ PLATFORM(windows, mac, android) 54.205.83.61$network !+ NOT_PLATFORM(windows, mac, android) ||54.205.83.61^$all + !+ PLATFORM(windows, mac, android) 54.210.193.115$network !+ NOT_PLATFORM(windows, mac, android) ||54.210.193.115^$all + [2600:1f18:43d1:2a04:ee05:261e:d408:7ba1]$network ||ailkeyair.com^$all ||amulagaudish.cam^$all @@ -754,66 +785,82 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 172.255.6.107$network !+ NOT_PLATFORM(windows, mac, android) ||172.255.6.107^$all + !+ PLATFORM(windows, mac, android) 172.255.6.147$network !+ NOT_PLATFORM(windows, mac, android) ||172.255.6.147^$all + !+ PLATFORM(windows, mac, android) 172.255.6.219$network !+ NOT_PLATFORM(windows, mac, android) ||172.255.6.219^$all + !+ PLATFORM(windows, mac, android) 172.255.6.225$network !+ NOT_PLATFORM(windows, mac, android) ||172.255.6.225^$all + !+ PLATFORM(windows, mac, android) 188.42.129.108$network !+ NOT_PLATFORM(windows, mac, android) ||188.42.129.108^$all + !+ PLATFORM(windows, mac, android) 188.42.129.116$network !+ NOT_PLATFORM(windows, mac, android) ||188.42.129.116^$all + !+ PLATFORM(windows, mac, android) 188.42.141.100$network !+ NOT_PLATFORM(windows, mac, android) ||188.42.141.100^$all + !+ PLATFORM(windows, mac, android) 188.42.141.92$network !+ NOT_PLATFORM(windows, mac, android) ||188.42.141.92^$all + !+ PLATFORM(windows, mac, android) 23.109.82.144$network !+ NOT_PLATFORM(windows, mac, android) ||23.109.82.144^$all + !+ PLATFORM(windows, mac, android) 23.109.82.41$network !+ NOT_PLATFORM(windows, mac, android) ||23.109.82.41^$all + !+ PLATFORM(windows, mac, android) 23.109.82.43$network !+ NOT_PLATFORM(windows, mac, android) ||23.109.82.43^$all + !+ PLATFORM(windows, mac, android) 23.109.82.65$network !+ NOT_PLATFORM(windows, mac, android) ||23.109.82.65^$all + !+ PLATFORM(windows, mac, android) 23.109.82.66$network !+ NOT_PLATFORM(windows, mac, android) ||23.109.82.66^$all + !+ PLATFORM(windows, mac, android) 23.109.87.169$network !+ NOT_PLATFORM(windows, mac, android) ||23.109.87.169^$all + !+ PLATFORM(windows, mac, android) 23.109.87.207$network !+ NOT_PLATFORM(windows, mac, android) ||23.109.87.207^$all + !+ PLATFORM(windows, mac, android) 23.109.87.208$network !+ NOT_PLATFORM(windows, mac, android) ||23.109.87.208^$all + ||entwithou.xyz^$all ||chedstimaarr.pics^$all ||blueoyster.click^$all @@ -823,10 +870,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 216.21.13.14$network !+ NOT_PLATFORM(windows, mac, android) ||216.21.13.14^$all + !+ PLATFORM(windows, mac, android) 216.21.13.15$network !+ NOT_PLATFORM(windows, mac, android) ||216.21.13.15^$all + /^.*\.(xyz|pics)/[a-zA-Z0-9]{130,}\$/$document,script,subdocument,image /^.*\.(cloudfront\.net|xyz|pics)/[a-zA-Z0-9]{20,}/[a-zA-Z0-9]{25,}\+[a-zA-Z0-9+]{90,}\$/$document,script,subdocument,image ||abaphosis.guru^$all @@ -3922,6 +3971,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 178.128.142.109$network !+ NOT_PLATFORM(windows, mac, android) ||178.128.142.109^$all + ||findmedia.biz^$all ||backtonews.biz^$all ||bagclick.biz^$all @@ -3945,6 +3995,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 134.209.136.174$network !+ NOT_PLATFORM(windows, mac, android) ||134.209.136.174^$all + ||whiteclick.biz^$all ||dreamnews.biz^$all ||gonews2.com^$all @@ -3961,18 +4012,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 62.210.6.153$network !+ NOT_PLATFORM(windows, mac, android) ||62.210.6.153^$all + !+ PLATFORM(windows, mac, android) 62.210.7.209$network !+ NOT_PLATFORM(windows, mac, android) ||62.210.7.209^$all + !+ PLATFORM(windows, mac, android) 62.210.9.92$network !+ NOT_PLATFORM(windows, mac, android) ||62.210.9.92^$all + !+ PLATFORM(windows, mac, android) 62.210.11.203$network !+ NOT_PLATFORM(windows, mac, android) ||62.210.11.203^$all + ||ilo134ulih.com^$all ||hooligapps.com^$all ||best202*-games-web1.com^$all @@ -3992,6 +4047,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 167.99.249.47$network !+ NOT_PLATFORM(windows, mac, android) ||167.99.249.47^$all + ! https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ ! https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ ||moderncomputer.net^ @@ -4034,14 +4090,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 5.8.34.26$network !+ NOT_PLATFORM(windows, mac, android) ||5.8.34.26^$all + !+ PLATFORM(windows, mac, android) 5.8.47.3$network !+ NOT_PLATFORM(windows, mac, android) ||5.8.47.3^$all + !+ PLATFORM(windows, mac, android) 103.224.182.251$network !+ NOT_PLATFORM(windows, mac, android) ||103.224.182.251^$all + ! https://github.com/DandelionSprout/adfilt/issues/193 ||holescontracting.com^$all ||doggroomingnews.com^$all @@ -4049,34 +4108,42 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 5.79.71.205$network !+ NOT_PLATFORM(windows, mac, android) ||5.79.71.205^$all + !+ PLATFORM(windows, mac, android) 5.79.71.225$network !+ NOT_PLATFORM(windows, mac, android) ||5.79.71.225^$all + !+ PLATFORM(windows, mac, android) 85.17.31.82$network !+ NOT_PLATFORM(windows, mac, android) ||85.17.31.82^$all + !+ PLATFORM(windows, mac, android) 85.17.31.122$network !+ NOT_PLATFORM(windows, mac, android) ||85.17.31.122^$all + !+ PLATFORM(windows, mac, android) 178.162.203.202$network !+ NOT_PLATFORM(windows, mac, android) ||178.162.203.202^$all + !+ PLATFORM(windows, mac, android) 178.162.203.211$network !+ NOT_PLATFORM(windows, mac, android) ||178.162.203.211^$all + !+ PLATFORM(windows, mac, android) 178.162.203.226$network !+ NOT_PLATFORM(windows, mac, android) ||178.162.203.226^$all + !+ PLATFORM(windows, mac, android) 178.162.217.107$network !+ NOT_PLATFORM(windows, mac, android) ||178.162.217.107^$all + [2a02:1668:1034::2]$network ! https://github.com/DandelionSprout/adfilt/issues/195 ||logicalrecord.com^$all @@ -4093,18 +4160,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 66.85.156.85$network !+ NOT_PLATFORM(windows, mac, android) ||66.85.156.85^$all + !+ PLATFORM(windows, mac, android) 66.85.156.86$network !+ NOT_PLATFORM(windows, mac, android) ||66.85.156.86^$all + !+ PLATFORM(windows, mac, android) 108.170.31.123$network !+ NOT_PLATFORM(windows, mac, android) ||108.170.31.123^$all + !+ PLATFORM(windows, mac, android) 108.170.52.156$network !+ NOT_PLATFORM(windows, mac, android) ||108.170.52.156^$all + ! https://github.com/DandelionSprout/adfilt/issues/198 ||mysecrethoookup.com^$all ! https://www•bleepingcomputer•com/virus-removal/ (18/06/2021) @@ -4214,14 +4285,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 95.168.170.165$network !+ NOT_PLATFORM(windows, mac, android) ||95.168.170.165^$all + !+ PLATFORM(windows, mac, android) 213.227.145.147$network !+ NOT_PLATFORM(windows, mac, android) ||213.227.145.147^$all + !+ PLATFORM(windows, mac, android) 213.227.149.216$network !+ NOT_PLATFORM(windows, mac, android) ||213.227.149.216^$all + ! https://twitter•com/adamziaja/status/1252234957679808513 ||wow-robotics.xyz^$all ! https://blog•sucuri•net/2021/05/woocommerce-credit-card-skimmer•html @@ -4240,6 +4314,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 5.188.62.36$network !+ NOT_PLATFORM(windows, mac, android) ||5.188.62.36^$all + ! https://github.com/DandelionSprout/adfilt/issues/223 ||speedupmypcfree.com^$all ! https://github.com/DandelionSprout/adfilt/issues/224 @@ -4278,6 +4353,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 69.49.231.244$network !+ NOT_PLATFORM(windows, mac, android) ||69.49.231.244^$all + ! https://movsb•0x0•st/users/mia ||vid.me^$third-party ||5starhdporn.com^$frame,third-party @@ -4305,6 +4381,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 37.34.176.37$network !+ NOT_PLATFORM(windows, mac, android) ||37.34.176.37^$all + ||atvcampingtrips.com^$all ||thegymmum.com^$all ||pcspeedcat.com^$all @@ -4324,10 +4401,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 23.111.31.137$network !+ NOT_PLATFORM(windows, mac, android) ||23.111.31.137^$all + !+ PLATFORM(windows, mac, android) 23.111.88.207$network !+ NOT_PLATFORM(windows, mac, android) ||23.111.88.207^$all + ! https://github.com/DandelionSprout/adfilt/issues/254 ||onesafesoftware.com^$document ! https://github.com/DandelionSprout/adfilt/issues/257 @@ -4335,18 +4414,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 185.158.250.239$network !+ NOT_PLATFORM(windows, mac, android) ||185.158.250.239^$all + !+ PLATFORM(windows, mac, android) 192.169.69.25$network !+ NOT_PLATFORM(windows, mac, android) ||192.169.69.25^$all + !+ PLATFORM(windows, mac, android) 212.192.241.72$network !+ NOT_PLATFORM(windows, mac, android) ||212.192.241.72^$all + !+ PLATFORM(windows, mac, android) 37.0.10.83$network !+ NOT_PLATFORM(windows, mac, android) ||37.0.10.83^$all + ||newstepsco.com^$all ||secure-0*.ddnss.ch^$all ||lucdream.com^$document @@ -4380,6 +4463,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 192.3.110.170$network !+ NOT_PLATFORM(windows, mac, android) ||192.3.110.170^$all + ! https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ ||socialsearchconverter.com^$document ||install.socialsearchconverter.com^$all @@ -4421,6 +4505,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 91.241.19.38$network !+ NOT_PLATFORM(windows, mac, android) ||91.241.19.38^$all + ! https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection ! https://safeweb•norton•com/report/show?url=telete•in ! https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -4434,12 +4519,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 45.90.58.90$network !+ NOT_PLATFORM(windows, mac, android) ||45.90.58.90^$all + ! https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community ! https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection !+ PLATFORM(windows, mac, android) 95.85.89.98$network !+ NOT_PLATFORM(windows, mac, android) ||95.85.89.98^$all + ! https://github.com/DandelionSprout/adfilt/issues/267 ||tekhacks.net^$all ||mediafire.com/file/pj9jdm7iznc4d51/tekhacksnet_multi_loader.rar^$document @@ -4449,11 +4536,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 139.28.37.49$network !+ NOT_PLATFORM(windows, mac, android) ||139.28.37.49^$all + !! https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community !+ PLATFORM(windows, mac, android) 35.194.188.37$network !+ NOT_PLATFORM(windows, mac, android) ||35.194.188.37^$all + !! https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community ||hydro-ca.link^$all !! https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community @@ -4461,53 +4550,65 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 91.243.121.19$network !+ NOT_PLATFORM(windows, mac, android) ||91.243.121.19^$all + !! https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community !+ PLATFORM(windows, mac, android) 103.169.90.205$network !+ NOT_PLATFORM(windows, mac, android) ||103.169.90.205^$all + ! https://github.com/DandelionSprout/adfilt/pull/281 ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community !+ PLATFORM(windows, mac, android) 125.44.43.45$network !+ NOT_PLATFORM(windows, mac, android) ||125.44.43.45^$all + !+ PLATFORM(windows, mac, android) 182.121.8.240$network !+ NOT_PLATFORM(windows, mac, android) ||182.121.8.240^$all + !+ PLATFORM(windows, mac, android) 42.235.183.74$network !+ NOT_PLATFORM(windows, mac, android) ||42.235.183.74^$all + !+ PLATFORM(windows, mac, android) 78.36.32.242$network !+ NOT_PLATFORM(windows, mac, android) ||78.36.32.242^$all + !+ PLATFORM(windows, mac, android) 115.50.2.119$network !+ NOT_PLATFORM(windows, mac, android) ||115.50.2.119^$all + !+ PLATFORM(windows, mac, android) 115.50.110.163$network !+ NOT_PLATFORM(windows, mac, android) ||115.50.110.163^$all + !+ PLATFORM(windows, mac, android) 119.179.84.145$network !+ NOT_PLATFORM(windows, mac, android) ||119.179.84.145^$all + !+ PLATFORM(windows, mac, android) 188.120.50.98$network !+ NOT_PLATFORM(windows, mac, android) ||188.120.50.98^$all + !+ PLATFORM(windows, mac, android) 190.238.183.5$network !+ NOT_PLATFORM(windows, mac, android) ||190.238.183.5^$all + !+ PLATFORM(windows, mac, android) 27.220.253.78$network !+ NOT_PLATFORM(windows, mac, android) ||27.220.253.78^$all + ! https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community ||esetnode32-antiviru.ydns.eu^$all ! https://www•joesandbox•com/analysis/486636/0/html#domains @@ -4517,6 +4618,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 192.3.194.242$network !+ NOT_PLATFORM(windows, mac, android) ||192.3.194.242^$all + ||w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu^$all ||hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu^$all ||avira-antivirus.ydns.eu^$all @@ -4595,206 +4697,256 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 23.94.26.138$network !+ NOT_PLATFORM(windows, mac, android) ||23.94.26.138^$all + ! https://github.com/DandelionSprout/adfilt/pull/298 ! https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community !+ PLATFORM(windows, mac, android) 205.185.126.200$network !+ NOT_PLATFORM(windows, mac, android) ||205.185.126.200^$all + ! https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community !+ PLATFORM(windows, mac, android) 185.243.56.167$network !+ NOT_PLATFORM(windows, mac, android) ||185.243.56.167^$all + ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community !+ PLATFORM(windows, mac, android) 123.10.224.135$network !+ NOT_PLATFORM(windows, mac, android) ||123.10.224.135^$all + !+ PLATFORM(windows, mac, android) 59.47.187.147$network !+ NOT_PLATFORM(windows, mac, android) ||59.47.187.147^$all + !+ PLATFORM(windows, mac, android) 39.68.172.210$network !+ NOT_PLATFORM(windows, mac, android) ||39.68.172.210^$all + !+ PLATFORM(windows, mac, android) 122.192.177.176$network !+ NOT_PLATFORM(windows, mac, android) ||122.192.177.176^$all + !+ PLATFORM(windows, mac, android) 112.27.124.108$network !+ NOT_PLATFORM(windows, mac, android) ||112.27.124.108^$all + !+ PLATFORM(windows, mac, android) 123.110.176.246$network !+ NOT_PLATFORM(windows, mac, android) ||123.110.176.246^$all + !+ PLATFORM(windows, mac, android) 219.155.105.98$network !+ NOT_PLATFORM(windows, mac, android) ||219.155.105.98^$all + !+ PLATFORM(windows, mac, android) 171.35.161.209$network !+ NOT_PLATFORM(windows, mac, android) ||171.35.161.209^$all + !+ PLATFORM(windows, mac, android) 60.16.255.36$network !+ NOT_PLATFORM(windows, mac, android) ||60.16.255.36^$all + !+ PLATFORM(windows, mac, android) 112.30.4.52$network !+ NOT_PLATFORM(windows, mac, android) ||112.30.4.52^$all + !+ PLATFORM(windows, mac, android) 182.121.191.201$network !+ NOT_PLATFORM(windows, mac, android) ||182.121.191.201^$all + !+ PLATFORM(windows, mac, android) 121.61.48.170$network !+ NOT_PLATFORM(windows, mac, android) ||121.61.48.170^$all + !+ PLATFORM(windows, mac, android) 39.81.68.45$network !+ NOT_PLATFORM(windows, mac, android) ||39.81.68.45^$all + !+ PLATFORM(windows, mac, android) 27.222.220.164$network !+ NOT_PLATFORM(windows, mac, android) ||27.222.220.164^$all + !+ PLATFORM(windows, mac, android) 113.233.215.135$network !+ NOT_PLATFORM(windows, mac, android) ||113.233.215.135^$all + !+ PLATFORM(windows, mac, android) 151.77.100.133$network !+ NOT_PLATFORM(windows, mac, android) ||151.77.100.133^$all + !+ PLATFORM(windows, mac, android) 125.120.13.184$network !+ NOT_PLATFORM(windows, mac, android) ||125.120.13.184^$all + !+ PLATFORM(windows, mac, android) 120.12.138.133$network !+ NOT_PLATFORM(windows, mac, android) ||120.12.138.133^$all + !+ PLATFORM(windows, mac, android) 27.194.115.185$network !+ NOT_PLATFORM(windows, mac, android) ||27.194.115.185^$all + !+ PLATFORM(windows, mac, android) 104.128.199.228$network !+ NOT_PLATFORM(windows, mac, android) ||104.128.199.228^$all + !+ PLATFORM(windows, mac, android) 183.92.123.145$network !+ NOT_PLATFORM(windows, mac, android) ||183.92.123.145^$all + !+ PLATFORM(windows, mac, android) 110.89.8.126$network !+ NOT_PLATFORM(windows, mac, android) ||110.89.8.126^$all + !+ PLATFORM(windows, mac, android) 125.43.211.184$network !+ NOT_PLATFORM(windows, mac, android) ||125.43.211.184^$all + !+ PLATFORM(windows, mac, android) 1.0.218.230$network !+ NOT_PLATFORM(windows, mac, android) ||1.0.218.230^$all + !+ PLATFORM(windows, mac, android) 221.208.4.56$network !+ NOT_PLATFORM(windows, mac, android) ||221.208.4.56^$all + !+ PLATFORM(windows, mac, android) 60.13.60.19$network !+ NOT_PLATFORM(windows, mac, android) ||60.13.60.19^$all + !+ PLATFORM(windows, mac, android) 171.37.29.87$network !+ NOT_PLATFORM(windows, mac, android) ||171.37.29.87^$all + !+ PLATFORM(windows, mac, android) 124.91.237.188$network !+ NOT_PLATFORM(windows, mac, android) ||124.91.237.188^$all + !+ PLATFORM(windows, mac, android) 115.56.137.49$network !+ NOT_PLATFORM(windows, mac, android) ||115.56.137.49^$all + !+ PLATFORM(windows, mac, android) 115.52.240.69$network !+ NOT_PLATFORM(windows, mac, android) ||115.52.240.69^$all + !+ PLATFORM(windows, mac, android) 112.252.132.185$network !+ NOT_PLATFORM(windows, mac, android) ||112.252.132.185^$all + !+ PLATFORM(windows, mac, android) 117.198.240.157$network !+ NOT_PLATFORM(windows, mac, android) ||117.198.240.157^$all + !+ PLATFORM(windows, mac, android) 42.53.240.249$network !+ NOT_PLATFORM(windows, mac, android) ||42.53.240.249^$all + !+ PLATFORM(windows, mac, android) 116.179.138.68$network !+ NOT_PLATFORM(windows, mac, android) ||116.179.138.68^$all + !+ PLATFORM(windows, mac, android) 110.241.119.159$network !+ NOT_PLATFORM(windows, mac, android) ||110.241.119.159^$all + !+ PLATFORM(windows, mac, android) 115.56.31.133$network !+ NOT_PLATFORM(windows, mac, android) ||115.56.31.133^$all + !+ PLATFORM(windows, mac, android) 103.19.128.222$network !+ NOT_PLATFORM(windows, mac, android) ||103.19.128.222^$all + !+ PLATFORM(windows, mac, android) 202.12.80.74$network !+ NOT_PLATFORM(windows, mac, android) ||202.12.80.74^$all + !+ PLATFORM(windows, mac, android) 61.52.8.62$network !+ NOT_PLATFORM(windows, mac, android) ||61.52.8.62^$all + !+ PLATFORM(windows, mac, android) 182.122.252.69$network !+ NOT_PLATFORM(windows, mac, android) ||182.122.252.69^$all + !+ PLATFORM(windows, mac, android) 219.155.26.50$network !+ NOT_PLATFORM(windows, mac, android) ||219.155.26.50^$all + !+ PLATFORM(windows, mac, android) 120.4.141.185$network !+ NOT_PLATFORM(windows, mac, android) ||120.4.141.185^$all + !+ PLATFORM(windows, mac, android) 119.102.7.115$network !+ NOT_PLATFORM(windows, mac, android) ||119.102.7.115^$all + !+ PLATFORM(windows, mac, android) 72.51.127.213$network !+ NOT_PLATFORM(windows, mac, android) ||72.51.127.213^$all + !+ PLATFORM(windows, mac, android) 111.224.199.91$network !+ NOT_PLATFORM(windows, mac, android) ||111.224.199.91^$all + !+ PLATFORM(windows, mac, android) 119.250.236.122$network !+ NOT_PLATFORM(windows, mac, android) ||119.250.236.122^$all + !+ PLATFORM(windows, mac, android) 112.30.110.58$network !+ NOT_PLATFORM(windows, mac, android) ||112.30.110.58^$all + ! https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community ||pcae.de^$document ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community @@ -4802,18 +4954,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 117.196.49.21$network !+ NOT_PLATFORM(windows, mac, android) ||117.196.49.21^$all + !+ PLATFORM(windows, mac, android) 115.55.54.234$network !+ NOT_PLATFORM(windows, mac, android) ||115.55.54.234^$all + !+ PLATFORM(windows, mac, android) 115.52.17.123$network !+ NOT_PLATFORM(windows, mac, android) ||115.52.17.123^$all + !+ PLATFORM(windows, mac, android) 182.59.69.21$network !+ NOT_PLATFORM(windows, mac, android) ||182.59.69.21^$all + ! https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community ||chip-secured-download.de^$all ! https://www•virustotal•com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb @@ -4840,6 +4996,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 160.202.163.100$network !+ NOT_PLATFORM(windows, mac, android) ||160.202.163.100^$all + ! https://www•virustotal•com/gui/ip-address/160•202•163•100/relations ||microsoftkernel.com^$all ||microsofthk.com^$all @@ -4856,16 +5013,19 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 45.95.169.115$network !+ NOT_PLATFORM(windows, mac, android) ||45.95.169.115^$all + ! https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community !+ PLATFORM(windows, mac, android) 45.148.120.80$network !+ NOT_PLATFORM(windows, mac, android) ||45.148.120.80^$all + ! https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community !+ PLATFORM(windows, mac, android) 85.239.33.9$network !+ NOT_PLATFORM(windows, mac, android) ||85.239.33.9^$all + ! Relations to the domain above ||adminsys.serveftp.com^$all ||amazbaidu.serveftp.com^$all @@ -4886,11 +5046,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 107.173.176.183$network !+ NOT_PLATFORM(windows, mac, android) ||107.173.176.183^$all + ! https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community !+ PLATFORM(windows, mac, android) 45.148.120.171$network !+ NOT_PLATFORM(windows, mac, android) ||45.148.120.171^$all + ! https://twitter•com/soranker0/status/1449491402409185283 ://disordgift.$all ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-950330114 @@ -4904,6 +5066,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 159.148.186.228$network !+ NOT_PLATFORM(windows, mac, android) ||159.148.186.228^$all + ! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains ||yotube.com^$all ||r-tb.com^$all @@ -4935,131 +5098,163 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 39.83.80.247$network !+ NOT_PLATFORM(windows, mac, android) ||39.83.80.247^$all + !+ PLATFORM(windows, mac, android) 68.197.33.124$network !+ NOT_PLATFORM(windows, mac, android) ||68.197.33.124^$all + !+ PLATFORM(windows, mac, android) 219.157.21.37$network !+ NOT_PLATFORM(windows, mac, android) ||219.157.21.37^$all + !+ PLATFORM(windows, mac, android) 182.123.141.17$network !+ NOT_PLATFORM(windows, mac, android) ||182.123.141.17^$all + !+ PLATFORM(windows, mac, android) 125.47.243.187$network !+ NOT_PLATFORM(windows, mac, android) ||125.47.243.187^$all + !+ PLATFORM(windows, mac, android) 182.122.196.203$network !+ NOT_PLATFORM(windows, mac, android) ||182.122.196.203^$all + !+ PLATFORM(windows, mac, android) 182.117.231.182$network !+ NOT_PLATFORM(windows, mac, android) ||182.117.231.182^$all + !+ PLATFORM(windows, mac, android) 112.31.211.135$network !+ NOT_PLATFORM(windows, mac, android) ||112.31.211.135^$all + !+ PLATFORM(windows, mac, android) 125.106.63.93$network !+ NOT_PLATFORM(windows, mac, android) ||125.106.63.93^$all + !+ PLATFORM(windows, mac, android) 115.59.197.46$network !+ NOT_PLATFORM(windows, mac, android) ||115.59.197.46^$all + !+ PLATFORM(windows, mac, android) 122.159.29.192$network !+ NOT_PLATFORM(windows, mac, android) ||122.159.29.192^$all + !+ PLATFORM(windows, mac, android) 171.40.0.127$network !+ NOT_PLATFORM(windows, mac, android) ||171.40.0.127^$all + !+ PLATFORM(windows, mac, android) 171.80.219.160$network !+ NOT_PLATFORM(windows, mac, android) ||171.80.219.160^$all + !+ PLATFORM(windows, mac, android) 123.10.65.201$network !+ NOT_PLATFORM(windows, mac, android) ||123.10.65.201^$all + !+ PLATFORM(windows, mac, android) 168.90.205.46$network !+ NOT_PLATFORM(windows, mac, android) ||168.90.205.46^$all + !+ PLATFORM(windows, mac, android) 125.47.205.109$network !+ NOT_PLATFORM(windows, mac, android) ||125.47.205.109^$all + !+ PLATFORM(windows, mac, android) 39.80.147.239$network !+ NOT_PLATFORM(windows, mac, android) ||39.80.147.239^$all + !+ PLATFORM(windows, mac, android) 45.224.171.130$network !+ NOT_PLATFORM(windows, mac, android) ||45.224.171.130^$all + !+ PLATFORM(windows, mac, android) 45.5.209.75$network !+ NOT_PLATFORM(windows, mac, android) ||45.5.209.75^$all + !+ PLATFORM(windows, mac, android) 116.17.210.157$network !+ NOT_PLATFORM(windows, mac, android) ||116.17.210.157^$all + !+ PLATFORM(windows, mac, android) 27.45.103.240$network !+ NOT_PLATFORM(windows, mac, android) ||27.45.103.240^$all + !+ PLATFORM(windows, mac, android) 110.167.64.171$network !+ NOT_PLATFORM(windows, mac, android) ||110.167.64.171^$all + !+ PLATFORM(windows, mac, android) 39.81.117.73$network !+ NOT_PLATFORM(windows, mac, android) ||39.81.117.73^$all + !+ PLATFORM(windows, mac, android) 183.15.90.156$network !+ NOT_PLATFORM(windows, mac, android) ||183.15.90.156^$all + !+ PLATFORM(windows, mac, android) 119.113.248.74$network !+ NOT_PLATFORM(windows, mac, android) ||119.113.248.74^$all + !+ PLATFORM(windows, mac, android) 175.0.95.85$network !+ NOT_PLATFORM(windows, mac, android) ||175.0.95.85^$all + !+ PLATFORM(windows, mac, android) 61.52.99.109$network !+ NOT_PLATFORM(windows, mac, android) ||61.52.99.109^$all + !+ PLATFORM(windows, mac, android) 222.142.183.194$network !+ NOT_PLATFORM(windows, mac, android) ||222.142.183.194^$all + !+ PLATFORM(windows, mac, android) 106.86.172.194$network !+ NOT_PLATFORM(windows, mac, android) ||106.86.172.194^$all + !+ PLATFORM(windows, mac, android) 103.233.216.77$network !+ NOT_PLATFORM(windows, mac, android) ||103.233.216.77^$all + !+ PLATFORM(windows, mac, android) 183.188.192.55$network !+ NOT_PLATFORM(windows, mac, android) ||183.188.192.55^$all + ! https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community !+ PLATFORM(windows, mac, android) 198.23.255.14$network !+ NOT_PLATFORM(windows, mac, android) ||198.23.255.14^$all + ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971512075 ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971495248 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/15/1.md#iocs @@ -5071,10 +5266,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 91.121.67.60$network !+ NOT_PLATFORM(windows, mac, android) ||91.121.67.60^$all + !+ PLATFORM(windows, mac, android) 172.67.186.189$network !+ NOT_PLATFORM(windows, mac, android) ||172.67.186.189^$all + ! https://www•virustotal•com/gui/url/af8f443208f4e86d469549b219fccbeb43b7cae40be5f1b4c4e5083e27fc8111 ||inconclusive-pyrite-grandparent.glitch.me^$all ||delicate-tame-angora.glitch.me^$all @@ -5093,18 +5290,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 39.65.72.211$network !+ NOT_PLATFORM(windows, mac, android) ||39.65.72.211^$all + !+ PLATFORM(windows, mac, android) 42.238.151.197$network !+ NOT_PLATFORM(windows, mac, android) ||42.238.151.197^$all + !+ PLATFORM(windows, mac, android) 27.213.60.53$network !+ NOT_PLATFORM(windows, mac, android) ||27.213.60.53^$all + !+ PLATFORM(windows, mac, android) 115.56.169.134$network !+ NOT_PLATFORM(windows, mac, android) ||115.56.169.134^$all + ! https://github.com/iam-py-test/investigations/blob/main/2021/11/21/1.md ||yasir252.com^$all ||safelink.kadal.club^$document @@ -5128,11 +5329,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 194.87.138.20$network !+ NOT_PLATFORM(windows, mac, android) ||194.87.138.20^$all + ! https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community !+ PLATFORM(windows, mac, android) 103.167.92.73$network !+ NOT_PLATFORM(windows, mac, android) ||103.167.92.73^$all + ! https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community ||bursakulis.com^$all ! https://www•virustotal•com/gui/url/b333c49efa4d399e65c5e2d96a905b380acbca58a3e3052b7bd7cfcb3e0e81ee @@ -5162,34 +5365,42 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 58.249.74.79$network !+ NOT_PLATFORM(windows, mac, android) ||58.249.74.79^$all + !+ PLATFORM(windows, mac, android) 27.45.14.109$network !+ NOT_PLATFORM(windows, mac, android) ||27.45.14.109^$all + !+ PLATFORM(windows, mac, android) 27.40.101.191$network !+ NOT_PLATFORM(windows, mac, android) ||27.40.101.191^$all + !+ PLATFORM(windows, mac, android) 27.45.119.22$network !+ NOT_PLATFORM(windows, mac, android) ||27.45.119.22^$all + !+ PLATFORM(windows, mac, android) 27.47.73.159$network !+ NOT_PLATFORM(windows, mac, android) ||27.47.73.159^$all + !+ PLATFORM(windows, mac, android) 115.204.119.237$network !+ NOT_PLATFORM(windows, mac, android) ||115.204.119.237^$all + !+ PLATFORM(windows, mac, android) 163.125.31.46$network !+ NOT_PLATFORM(windows, mac, android) ||163.125.31.46^$all + !+ PLATFORM(windows, mac, android) 163.179.168.44$network !+ NOT_PLATFORM(windows, mac, android) ||163.179.168.44^$all + ! https://github.com/uBlockOrigin/uAssets/pull/10647 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md ||money-mod.com^$document @@ -5208,46 +5419,57 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 110.89.59.135$network !+ NOT_PLATFORM(windows, mac, android) ||110.89.59.135^$all + !+ PLATFORM(windows, mac, android) 113.116.89.1$network !+ NOT_PLATFORM(windows, mac, android) ||113.116.89.1^$all + !+ PLATFORM(windows, mac, android) 119.183.146.191$network !+ NOT_PLATFORM(windows, mac, android) ||119.183.146.191^$all + !+ PLATFORM(windows, mac, android) 153.3.3.226$network !+ NOT_PLATFORM(windows, mac, android) ||153.3.3.226^$all + !+ PLATFORM(windows, mac, android) 182.116.104.6$network !+ NOT_PLATFORM(windows, mac, android) ||182.116.104.6^$all + !+ PLATFORM(windows, mac, android) 60.7.133.200$network !+ NOT_PLATFORM(windows, mac, android) ||60.7.133.200^$all + !+ PLATFORM(windows, mac, android) 122.6.254.201$network !+ NOT_PLATFORM(windows, mac, android) ||122.6.254.201^$all + !+ PLATFORM(windows, mac, android) 110.89.11.167$network !+ NOT_PLATFORM(windows, mac, android) ||110.89.11.167^$all + !+ PLATFORM(windows, mac, android) 171.112.177.90$network !+ NOT_PLATFORM(windows, mac, android) ||171.112.177.90^$all + !+ PLATFORM(windows, mac, android) 115.194.38.143$network !+ NOT_PLATFORM(windows, mac, android) ||115.194.38.143^$all + !+ PLATFORM(windows, mac, android) 61.52.79.32$network !+ NOT_PLATFORM(windows, mac, android) ||61.52.79.32^$all + ! https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 ://ups-dk.$document,denyallow=dk|nu|se|no|fo|gl|ups.com,domain=ups-dk.* ! https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 @@ -5281,6 +5503,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 132.148.220.142$network !+ NOT_PLATFORM(windows, mac, android) ||132.148.220.142^$all + ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 ||chess-progress.ru^$document ||ouhastay.net^$all @@ -5302,10 +5525,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 52.53.243.52$network !+ NOT_PLATFORM(windows, mac, android) ||52.53.243.52^$all + !+ PLATFORM(windows, mac, android) 34.201.22.10$network !+ NOT_PLATFORM(windows, mac, android) ||34.201.22.10^$all + ! https://scammer.info/t/crypto-scammers-onceagain/85354 ||business.google.com/website/billyandscapedesign^$all ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community @@ -5313,34 +5538,42 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 123.10.225.196$network !+ NOT_PLATFORM(windows, mac, android) ||123.10.225.196^$all + !+ PLATFORM(windows, mac, android) 122.192.106.84$network !+ NOT_PLATFORM(windows, mac, android) ||122.192.106.84^$all + !+ PLATFORM(windows, mac, android) 172.88.199.9$network !+ NOT_PLATFORM(windows, mac, android) ||172.88.199.9^$all + !+ PLATFORM(windows, mac, android) 114.38.176.185$network !+ NOT_PLATFORM(windows, mac, android) ||114.38.176.185^$all + !+ PLATFORM(windows, mac, android) 61.52.97.35$network !+ NOT_PLATFORM(windows, mac, android) ||61.52.97.35^$all + !+ PLATFORM(windows, mac, android) 27.206.181.208$network !+ NOT_PLATFORM(windows, mac, android) ||27.206.181.208^$all + !+ PLATFORM(windows, mac, android) 124.163.130.175$network !+ NOT_PLATFORM(windows, mac, android) ||124.163.130.175^$all + !+ PLATFORM(windows, mac, android) 118.75.87.102$network !+ NOT_PLATFORM(windows, mac, android) ||118.75.87.102^$all + ! https://github.com/iam-py-test/investigations/blob/main/2021/12/14/1.md ||onemacusa.net^$all ! https://github.com/DevSpen/links/pull/3 @@ -5352,6 +5585,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 134.122.115.190$network !+ NOT_PLATFORM(windows, mac, android) ||134.122.115.190^$all + ||cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com^$all ! https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777 ||viewty.xyz^$all @@ -5377,6 +5611,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 141.8.226.34$network !+ NOT_PLATFORM(windows, mac, android) ||141.8.226.34^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/108571 ||ston-app.com^$all ! fake human verification scam @@ -5396,6 +5631,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 91.240.118.172$network !+ NOT_PLATFORM(windows, mac, android) ||91.240.118.172^$all + ! "Press Allow to continue" ||kuyhaa-mee.com^$all ||waystriling.com^$all @@ -5444,6 +5680,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 198.199.120.251$network !+ NOT_PLATFORM(windows, mac, android) ||198.199.120.251^$all + ! https://www•telia.no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}\$/$document @@ -5470,10 +5707,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 195.201.253.130$network !+ NOT_PLATFORM(windows, mac, android) ||195.201.253.130^$all + !+ PLATFORM(windows, mac, android) 195.201.253.131$network !+ NOT_PLATFORM(windows, mac, android) ||195.201.253.131^$all + ! The bottom download button on https://www•sushichop•com/ ||installiq.com^$all ||specgoal.com^$all @@ -5496,22 +5735,27 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 15.197.244.48$network !+ NOT_PLATFORM(windows, mac, android) ||15.197.244.48^$all + !+ PLATFORM(windows, mac, android) 96.47.230.67$network !+ NOT_PLATFORM(windows, mac, android) ||96.47.230.67^$all + !+ PLATFORM(windows, mac, android) 96.47.230.68$network !+ NOT_PLATFORM(windows, mac, android) ||96.47.230.68^$all + !+ PLATFORM(windows, mac, android) 96.47.230.69$network !+ NOT_PLATFORM(windows, mac, android) ||96.47.230.69^$all + !+ PLATFORM(windows, mac, android) 96.47.230.70$network !+ NOT_PLATFORM(windows, mac, android) ||96.47.230.70^$all + ! https://securitytrails•com/list/ns/ns1•fastthinkingdns•com ||highercaptcha-settle.$all ||highercaptchasettle.$all @@ -5555,6 +5799,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 31.220.27.134$network !+ NOT_PLATFORM(windows, mac, android) ||31.220.27.134^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk.$document ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 @@ -5862,10 +6107,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 85.17.31.152$network !+ NOT_PLATFORM(windows, mac, android) ||85.17.31.152^$all + !+ PLATFORM(windows, mac, android) 95.211.26.202$network !+ NOT_PLATFORM(windows, mac, android) ||95.211.26.202^$all + ! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 ||bzsx.link^$all ||dfvd.link^$all @@ -5883,10 +6130,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 158.247.212.220$network !+ NOT_PLATFORM(windows, mac, android) ||158.247.212.220^$all + !+ PLATFORM(windows, mac, android) 165.227.168.212$network !+ NOT_PLATFORM(windows, mac, android) ||165.227.168.212^$all + !#if !ext_ublock ! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ 162.241.115.*$network @@ -5937,6 +6186,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 23.81.64.183$network !+ NOT_PLATFORM(windows, mac, android) ||23.81.64.183^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/125300 ||zikroarg.com^$all ||dooloust.net^$all @@ -6110,6 +6360,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 139.45.197.236$network !+ NOT_PLATFORM(windows, mac, android) ||139.45.197.236^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^$all ||becovi.co.uk^$all @@ -6141,14 +6392,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 51.91.66.125$network !+ NOT_PLATFORM(windows, mac, android) ||51.91.66.125^$all + !+ PLATFORM(windows, mac, android) 51.178.76.105$network !+ NOT_PLATFORM(windows, mac, android) ||51.178.76.105^$all + !+ PLATFORM(windows, mac, android) 147.135.253.55$network !+ NOT_PLATFORM(windows, mac, android) ||147.135.253.55^$all + ! https://github.com/uBlockOrigin/uAssets/issues/14569 → https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection (https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) ||bnbdeal.net^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/129414 @@ -6161,10 +6415,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 146.19.169.98$network !+ NOT_PLATFORM(windows, mac, android) ||146.19.169.98^$all + !+ PLATFORM(windows, mac, android) 146.19.169.99$network !+ NOT_PLATFORM(windows, mac, android) ||146.19.169.99^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 /pushredirect/?$document,domain=~malware-redirection-trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -7941,6 +8197,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 69.162.80.56$network !+ NOT_PLATFORM(windows, mac, android) ||69.162.80.56^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/134903 ||smartlink.name^$all ! Random Discord servers @@ -7950,6 +8207,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 162.241.124.200$network !+ NOT_PLATFORM(windows, mac, android) ||162.241.124.200^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/135815 ||adsstar.in^$document,popup ||clickcafe.in^$document,popup @@ -7969,6 +8227,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 157.90.71.190$network !+ NOT_PLATFORM(windows, mac, android) ||157.90.71.190^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/135924 ||abazelfan.com^$all ||abburmyer.com^$all @@ -8209,6 +8468,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 139.45.197.239$network !+ NOT_PLATFORM(windows, mac, android) ||139.45.197.239^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub.$document,popup ! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -8412,14 +8672,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 44.228.230.225$network !+ NOT_PLATFORM(windows, mac, android) ||44.228.230.225^$all + !+ PLATFORM(windows, mac, android) 50.112.124.170$network !+ NOT_PLATFORM(windows, mac, android) ||50.112.124.170^$all + !+ PLATFORM(windows, mac, android) 100.20.104.229$network !+ NOT_PLATFORM(windows, mac, android) ||100.20.104.229^$all + ! Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread ||link.sv^$document,popup ||4.fo^$document,popup @@ -8434,24 +8697,29 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 44.236.213.34$network !+ NOT_PLATFORM(windows, mac, android) ||44.236.213.34^$all + !+ PLATFORM(windows, mac, android) 52.24.156.12$network !+ NOT_PLATFORM(windows, mac, android) ||52.24.156.12^$all + !+ PLATFORM(windows, mac, android) 52.25.6.134$network !+ NOT_PLATFORM(windows, mac, android) ||52.25.6.134^$all + !+ PLATFORM(windows, mac, android) 100.20.13.49$network !+ NOT_PLATFORM(windows, mac, android) ||100.20.13.49^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/139667 ||goldmesoil.live^$all !+ PLATFORM(windows, mac, android) 51.68.87.229$network !+ NOT_PLATFORM(windows, mac, android) ||51.68.87.229^$all + ||f9dle.skin^$all ||kilpa2017.fi^$all ! https://github.com/DandelionSprout/adfilt/issues/747 @@ -10259,14 +10527,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 185.106.94.139$network !+ NOT_PLATFORM(windows, mac, android) ||185.106.94.139^$all + !+ PLATFORM(windows, mac, android) 45.90.109.196$network !+ NOT_PLATFORM(windows, mac, android) ||45.90.109.196^$all + !+ PLATFORM(windows, mac, android) 91.229.23.200$network !+ NOT_PLATFORM(windows, mac, android) ||91.229.23.200^$all + ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1401711872 ! https://github.com/AdguardTeam/AdguardFilters/issues/144514 ||attractbestbonuses.life^$all @@ -10331,10 +10602,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 185.155.184.98$network !+ NOT_PLATFORM(windows, mac, android) ||185.155.184.98^$all + !+ PLATFORM(windows, mac, android) 194.110.247.242$network !+ NOT_PLATFORM(windows, mac, android) ||194.110.247.242^$all + ! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ ||ups-addressed.me^$all ||ups-quote.me^$all @@ -10343,6 +10616,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 54.219.218.169$network !+ NOT_PLATFORM(windows, mac, android) ||54.219.218.169^$all + ! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^$all ||0365online.com^$all @@ -10777,6 +11051,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 64.132.201.92$network !+ NOT_PLATFORM(windows, mac, android) ||64.132.201.92^$all + ! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||acessmygov.online^$all ||centerlinkmygov.com^$all @@ -10801,6 +11076,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 209.141.51.49$network !+ NOT_PLATFORM(windows, mac, android) ||209.141.51.49^$all + ://soekpakke*.blogspot.com^$all ||post-norway.web.app^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/142955 @@ -11400,14 +11676,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 208.88.225.116$network !+ NOT_PLATFORM(windows, mac, android) ||208.88.225.116^$all + !+ PLATFORM(windows, mac, android) 208.88.225.117$network !+ NOT_PLATFORM(windows, mac, android) ||208.88.225.117^$all + !+ PLATFORM(windows, mac, android) 208.88.225.119$network !+ NOT_PLATFORM(windows, mac, android) ||208.88.225.119^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/144823 !+ NOT_OPTIMIZED ://landings.*_slots/?partner=$document @@ -11513,18 +11792,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 3.231.116.86$network !+ NOT_PLATFORM(windows, mac, android) ||3.231.116.86^$all + !+ PLATFORM(windows, mac, android) 54.237.193.255$network !+ NOT_PLATFORM(windows, mac, android) ||54.237.193.255^$all + !+ PLATFORM(windows, mac, android) 3.231.137.120$network !+ NOT_PLATFORM(windows, mac, android) ||3.231.137.120^$all + !+ PLATFORM(windows, mac, android) 54.204.83.105$network !+ NOT_PLATFORM(windows, mac, android) ||54.204.83.105^$all + ! https://github.com/DandelionSprout/adfilt/issues/808 ! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) ||jonathanbartz.com^$all @@ -11547,22 +11830,27 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 108.61.242.65$network !+ NOT_PLATFORM(windows, mac, android) ||108.61.242.65^$all + !+ PLATFORM(windows, mac, android) 146.70.78.43$network !+ NOT_PLATFORM(windows, mac, android) ||146.70.78.43^$all + !+ PLATFORM(windows, mac, android) 87.120.254.39$network !+ NOT_PLATFORM(windows, mac, android) ||87.120.254.39^$all + !+ PLATFORM(windows, mac, android) 45.150.108.213$network !+ NOT_PLATFORM(windows, mac, android) ||45.150.108.213^$all + !+ PLATFORM(windows, mac, android) 92.204.160.240$network !+ NOT_PLATFORM(windows, mac, android) ||92.204.160.240^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 /land/*&afftrack=$document,domain=~likely-a-malware-redirection.* ! Comments on Slack @@ -11721,6 +12009,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 34.200.46.148$network !+ NOT_PLATFORM(windows, mac, android) ||34.200.46.148^$all + ||abstorick.com^$all ||affienness.com^$all ||ailippiess.co.in^$all @@ -11781,6 +12070,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 85.17.80.16$network !+ NOT_PLATFORM(windows, mac, android) ||85.17.80.16^$all + ! https://www•adressa.no/nyheter/trondheim/i/Moq2wR/svindlere-kaarer-vinnere-i-konkurranser-gir-en-daarlig-foelelse-aa-forklare-at-dette-bare-er-tull ||sitey.me^$document ! https://github.com/AdguardTeam/AdguardFilters/issues/151479 @@ -11925,22 +12215,27 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 185.246.188.124$network !+ NOT_PLATFORM(windows, mac, android) ||185.246.188.124^$all + !+ PLATFORM(windows, mac, android) 185.246.188.125$network !+ NOT_PLATFORM(windows, mac, android) ||185.246.188.125^$all + !+ PLATFORM(windows, mac, android) 194.63.140.103$network !+ NOT_PLATFORM(windows, mac, android) ||194.63.140.103^$all + !+ PLATFORM(windows, mac, android) 194.63.143.61$network !+ NOT_PLATFORM(windows, mac, android) ||194.63.143.61^$all + !+ PLATFORM(windows, mac, android) 194.63.143.96$network !+ NOT_PLATFORM(windows, mac, android) ||194.63.143.96^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/152945 ||moneystartup.live^$all ||fintechbest.online^$all @@ -12154,14 +12449,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 37.48.80.112$network !+ NOT_PLATFORM(windows, mac, android) ||37.48.80.112^$all + !+ PLATFORM(windows, mac, android) 95.168.170.165$network !+ NOT_PLATFORM(windows, mac, android) ||95.168.170.165^$all + !+ PLATFORM(windows, mac, android) 213.227.149.216$network !+ NOT_PLATFORM(windows, mac, android) ||213.227.149.216^$all + ! Slack comments ||cojcdn.net^$all ||collecl.cc^$all @@ -12191,10 +12489,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 109.206.168.16$network !+ NOT_PLATFORM(windows, mac, android) ||109.206.168.16^$all + !+ PLATFORM(windows, mac, android) 109.206.168.17$network !+ NOT_PLATFORM(windows, mac, android) ||109.206.168.17^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/155298 ||cadstoppam.live^$all ||cottodwin.live^$all @@ -12214,6 +12514,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 57.128.71.215$network !+ NOT_PLATFORM(windows, mac, android) ||57.128.71.215^$all + /^.*&[a-z]{1,2}=[a-zA-Z0-9]{0,}%[a-zA-Z0-9%]{1000,}\$/$document ! https://github.com/AdguardTeam/AdguardFilters/issues/155936 ||truanet.com^$all @@ -12954,42 +13255,52 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 37.1.223.231$network !+ NOT_PLATFORM(windows, mac, android) ||37.1.223.231^$all + !+ PLATFORM(windows, mac, android) 139.45.197.167$network !+ NOT_PLATFORM(windows, mac, android) ||139.45.197.167^$all + !+ PLATFORM(windows, mac, android) 139.45.197.245$network !+ NOT_PLATFORM(windows, mac, android) ||139.45.197.245^$all + !+ PLATFORM(windows, mac, android) 159.223.137.164$network !+ NOT_PLATFORM(windows, mac, android) ||159.223.137.164^$all + !+ PLATFORM(windows, mac, android) 185.56.234.205$network !+ NOT_PLATFORM(windows, mac, android) ||185.56.234.205^$all + !+ PLATFORM(windows, mac, android) 192.243.58.97$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.58.97^$all + !+ PLATFORM(windows, mac, android) 192.243.58.98$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.58.98^$all + !+ PLATFORM(windows, mac, android) 192.243.58.123$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.58.123^$all + !+ PLATFORM(windows, mac, android) 192.243.58.124$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.58.124^$all + !+ PLATFORM(windows, mac, android) 192.243.58.125$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.58.125^$all + [2a02:b48:207:1::2]$network [2a02:b48:207:1::3]$network [2a02:b48:207:1::6]$network @@ -13372,14 +13683,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 5.45.123.44$network !+ NOT_PLATFORM(windows, mac, android) ||5.45.123.44^$all + !+ PLATFORM(windows, mac, android) 69.16.230.226$network !+ NOT_PLATFORM(windows, mac, android) ||69.16.230.226^$all + !+ PLATFORM(windows, mac, android) 208.91.196.46$network !+ NOT_PLATFORM(windows, mac, android) ||208.91.196.46^$all + /page/bouncy.php?$all ! https://github.com/AdguardTeam/AdguardFilters/issues/158316 ||abashfireworks.com^$all @@ -17959,6 +18273,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 93.93.51.223$network !+ NOT_PLATFORM(windows, mac, android) ||93.93.51.223^$all + ||livejasmin.com/*&origin=$document ! https://github.com/AdguardTeam/AdguardFilters/issues/161364 ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) @@ -18215,6 +18530,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 103.174.102.240$network !+ NOT_PLATFORM(windows, mac, android) ||103.174.102.240^$all + ! https://github.com/libre-tube/LibreTube/issues/4409 ||libretube.app^$all ||libretube.net^$all @@ -18368,6 +18684,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 38.180.96.244$network !+ NOT_PLATFORM(windows, mac, android) ||38.180.96.244^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/172569 ||acareewityjh.com^$all ||accedenonre.xyz^$all @@ -18708,10 +19025,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 34.195.224.242$network !+ NOT_PLATFORM(windows, mac, android) ||34.195.224.242^$all + !+ PLATFORM(windows, mac, android) 54.225.185.110$network !+ NOT_PLATFORM(windows, mac, android) ||54.225.185.110^$all + &lp=not_robot_$all ||githubtalentcommunity.$all ! https://github.com/AdguardTeam/AdguardFilters/issues/173925 @@ -18725,6 +19044,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 91.202.233.143$network !+ NOT_PLATFORM(windows, mac, android) ||91.202.233.143^$all + ! Based on a tip from my secretary ||0842-3231-4323-4243-2344-1333-0595-3453-6439-7-3235-03928-2348.name^$all ||1-3evlhls3yf.shop^$all @@ -19084,6 +19404,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 108.62.157.10$network !+ NOT_PLATFORM(windows, mac, android) ||108.62.157.10^$all + ! https://github.com/AdguardTeam/FiltersRegistry/issues/925 ! https://github.com/AdguardTeam/FiltersRegistry/pull/927 ||avito.avito.avito.$all @@ -19101,42 +19422,52 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 172.240.108.68$network !+ NOT_PLATFORM(windows, mac, android) ||172.240.108.68^$all + !+ PLATFORM(windows, mac, android) 172.240.108.76$network !+ NOT_PLATFORM(windows, mac, android) ||172.240.108.76^$all + !+ PLATFORM(windows, mac, android) 172.240.108.84$network !+ NOT_PLATFORM(windows, mac, android) ||172.240.108.84^$all + !+ PLATFORM(windows, mac, android) 172.240.127.234$network !+ NOT_PLATFORM(windows, mac, android) ||172.240.127.234^$all + !+ PLATFORM(windows, mac, android) 172.240.253.132$network !+ NOT_PLATFORM(windows, mac, android) ||172.240.253.132^$all + !+ PLATFORM(windows, mac, android) 192.243.59.12$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.59.12^$all + !+ PLATFORM(windows, mac, android) 192.243.59.13$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.59.13^$all + !+ PLATFORM(windows, mac, android) 192.243.59.20$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.59.20^$all + !+ PLATFORM(windows, mac, android) 192.243.61.225$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.61.225^$all + !+ PLATFORM(windows, mac, android) 192.243.61.227$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.61.227^$all + ||0sntp7dnrr.com^$all ||0x01n2ptpuz3.com^$all ||2e8dgn8n0e0l.com^$all @@ -22118,6 +22449,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 167.71.252.38$network !+ NOT_PLATFORM(windows, mac, android) ||167.71.252.38^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/183432 ||100carbures.com^$all ||123ecos.com^$all @@ -23231,18 +23563,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 185.149.120.161$network !+ NOT_PLATFORM(windows, mac, android) ||185.149.120.161^$all + !+ PLATFORM(windows, mac, android) 185.149.120.163$network !+ NOT_PLATFORM(windows, mac, android) ||185.149.120.163^$all + !+ PLATFORM(windows, mac, android) 185.149.120.173$network !+ NOT_PLATFORM(windows, mac, android) ||185.149.120.173^$all + !+ PLATFORM(windows, mac, android) 185.149.120.175$network !+ NOT_PLATFORM(windows, mac, android) ||185.149.120.175^$all + ! https://github.com/AdguardTeam/AdguardFilters/issues/184671 ||2rlive.com^$all ||afro-melanin.com^$all @@ -23409,6 +23745,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 185.149.120.173$network !+ NOT_PLATFORM(windows, mac, android) ||185.149.120.173^$all + ! https://sol•no/81812194/ / https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-10360231 ||02helpinfo.com^$all ||02rebill-pending.com^$all @@ -23901,77 +24238,97 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 45.202.32.3$network !+ NOT_PLATFORM(windows, mac, android) ||45.202.32.3^$all + !+ PLATFORM(windows, mac, android) 45.8.92.138$network !+ NOT_PLATFORM(windows, mac, android) ||45.8.92.138^$all + !+ PLATFORM(windows, mac, android) 79.133.46.252$network !+ NOT_PLATFORM(windows, mac, android) ||79.133.46.252^$all + !+ PLATFORM(windows, mac, android) 82.147.85.156$network !+ NOT_PLATFORM(windows, mac, android) ||82.147.85.156^$all + !+ PLATFORM(windows, mac, android) 91.212.166.16$network !+ NOT_PLATFORM(windows, mac, android) ||91.212.166.16^$all + !+ PLATFORM(windows, mac, android) 94.156.64.129$network !+ NOT_PLATFORM(windows, mac, android) ||94.156.64.129^$all + !+ PLATFORM(windows, mac, android) 94.232.249.61$network !+ NOT_PLATFORM(windows, mac, android) ||94.232.249.61^$all + !+ PLATFORM(windows, mac, android) 94.232.249.69$network !+ NOT_PLATFORM(windows, mac, android) ||94.232.249.69^$all + !+ PLATFORM(windows, mac, android) 94.232.249.75$network !+ NOT_PLATFORM(windows, mac, android) ||94.232.249.75^$all + !+ PLATFORM(windows, mac, android) 94.232.249.235$network !+ NOT_PLATFORM(windows, mac, android) ||94.232.249.235^$all + !+ PLATFORM(windows, mac, android) 176.111.174.118$network !+ NOT_PLATFORM(windows, mac, android) ||176.111.174.118^$all + !+ PLATFORM(windows, mac, android) 176.113.115.191$network !+ NOT_PLATFORM(windows, mac, android) ||176.113.115.191^$all + !+ PLATFORM(windows, mac, android) 191.96.224.140$network !+ NOT_PLATFORM(windows, mac, android) ||191.96.224.140^$all + !+ PLATFORM(windows, mac, android) 193.124.185.42$network !+ NOT_PLATFORM(windows, mac, android) ||193.124.185.42^$all + !+ PLATFORM(windows, mac, android) 193.143.1.45$network !+ NOT_PLATFORM(windows, mac, android) ||193.143.1.45^$all + !+ PLATFORM(windows, mac, android) 193.143.1.214$network !+ NOT_PLATFORM(windows, mac, android) ||193.143.1.214^$all + !+ PLATFORM(windows, mac, android) 193.143.1.217$network !+ NOT_PLATFORM(windows, mac, android) ||193.143.1.217^$all + !+ PLATFORM(windows, mac, android) 208.91.189.203$network !+ NOT_PLATFORM(windows, mac, android) ||208.91.189.203^$all + !#if !ext_ublock ://193.143.1.*$document !#endif +! https://github.com/AdguardTeam/AdguardFilters/issues/189905 +/?nw=1&tb=false&cw=$document ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -25611,14 +25968,17 @@ toorgle.net##.join 192.243.59.12$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.59.12^$all + !+ PLATFORM(windows, mac, android) 192.243.59.13$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.59.13^$all + !+ PLATFORM(windows, mac, android) 192.243.59.20$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.59.20^$all + !#if !ext_ublock /^(https?://)?192\.243\.59\.\d{1,3}($|/)/$document !#endif @@ -25655,18 +26015,22 @@ toorgle.net##.join 194.226.139.121$network !+ NOT_PLATFORM(windows, mac, android) ||194.226.139.121^$all + !+ PLATFORM(windows, mac, android) 194.226.139.7$network !+ NOT_PLATFORM(windows, mac, android) ||194.226.139.7^$all + !+ PLATFORM(windows, mac, android) 95.181.157.36$network !+ NOT_PLATFORM(windows, mac, android) ||95.181.157.36^$all + !+ PLATFORM(windows, mac, android) 95.181.172.204$network !+ NOT_PLATFORM(windows, mac, android) ||95.181.172.204^$all + !#if !ext_ublock 194.226.139.*$network ! AS209813 (https://github.com/AdguardTeam/AdguardFilters/issues/114618#issuecomment-1100702530; currently specific to tools that support CIDR blocking) @@ -26280,6 +26644,7 @@ toorgle.net##.join 192.243.61.225$network !+ NOT_PLATFORM(windows, mac, android) ||192.243.61.225^$all + ! https://twitter•com/medicinehelp/status/1550250932394409985 ! https://securitytrails•com/list/ip/147•135•16•27 ||2spendless.$document @@ -26340,6 +26705,7 @@ toorgle.net##.join 147.135.16.27$network !+ NOT_PLATFORM(windows, mac, android) ||147.135.16.27^$all + ! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^$document ! Spambot posts on Tumblr (19/09/2022) @@ -26358,6 +26724,7 @@ apkfab.com##.tip-extension 185.87.148.199$network !+ NOT_PLATFORM(windows, mac, android) ||185.87.148.199^$all + ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) ||imaot.co.il/ContentArea/BannerClick^$all ||q1065.fm/redirect^$all,~inline-font,domain=~malware-redirection-results.* @@ -26373,6 +26740,7 @@ apkfab.com##.tip-extension 45.136.49.35$network !+ NOT_PLATFORM(windows, mac, android) ||45.136.49.35^$all + ||semex.com/popurl.cgi^$all,~inline-font,domain=~malware-redirection-results.* ||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware-redirection-results.* ! Browsing around for Tajik newssites @@ -26430,22 +26798,27 @@ apkfab.com##.tip-extension 51.91.211.94$network !+ NOT_PLATFORM(windows, mac, android) ||51.91.211.94^$all + !+ PLATFORM(windows, mac, android) 162.19.71.16$network !+ NOT_PLATFORM(windows, mac, android) ||162.19.71.16^$all + !+ PLATFORM(windows, mac, android) 146.59.240.191$network !+ NOT_PLATFORM(windows, mac, android) ||146.59.240.191^$all + !+ PLATFORM(windows, mac, android) 54.37.5.34$network !+ NOT_PLATFORM(windows, mac, android) ||54.37.5.34^$all + !+ PLATFORM(windows, mac, android) 54.36.118.105$network !+ NOT_PLATFORM(windows, mac, android) ||54.36.118.105^$all + ! Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt ||highlandnews.com^$all ||genuinescansupport.com^$all @@ -26476,6 +26849,7 @@ apkfab.com##.tip-extension 159.89.10.102$network !+ NOT_PLATFORM(windows, mac, android) ||159.89.10.102^$all + ! Other ||foxsportnetwork.com^$all ||pksauniversity.com^$all @@ -26503,6 +26877,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] 104.206.252.90$network !+ NOT_PLATFORM(windows, mac, android) ||104.206.252.90^$all + ! https://github.com/blocklistproject/Lists/issues/933 ||jNKmS0zFuEh.click^$all ||pjljo54uk.click^$all @@ -26530,6 +26905,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] 34.80.59.191$network !+ NOT_PLATFORM(windows, mac, android) ||34.80.59.191^$all + ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 |http://www6.$document,domain=~often-used-in-malware-redirections.* |http://www1.*&kw$document,domain=~often-used-in-malware-redirections.* @@ -26541,50 +26917,62 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] 45.33.2.79$network !+ NOT_PLATFORM(windows, mac, android) ||45.33.2.79^$all + !+ PLATFORM(windows, mac, android) 45.33.18.44$network !+ NOT_PLATFORM(windows, mac, android) ||45.33.18.44^$all + !+ PLATFORM(windows, mac, android) 45.33.20.235$network !+ NOT_PLATFORM(windows, mac, android) ||45.33.20.235^$all + !+ PLATFORM(windows, mac, android) 45.33.23.183$network !+ NOT_PLATFORM(windows, mac, android) ||45.33.23.183^$all + !+ PLATFORM(windows, mac, android) 45.33.30.197$network !+ NOT_PLATFORM(windows, mac, android) ||45.33.30.197^$all + !+ PLATFORM(windows, mac, android) 45.56.79.23$network !+ NOT_PLATFORM(windows, mac, android) ||45.56.79.23^$all + !+ PLATFORM(windows, mac, android) 45.79.19.196$network !+ NOT_PLATFORM(windows, mac, android) ||45.79.19.196^$all + !+ PLATFORM(windows, mac, android) 72.14.178.174$network !+ NOT_PLATFORM(windows, mac, android) ||72.14.178.174^$all + !+ PLATFORM(windows, mac, android) 72.14.185.43$network !+ NOT_PLATFORM(windows, mac, android) ||72.14.185.43^$all + !+ PLATFORM(windows, mac, android) 96.126.123.244$network !+ NOT_PLATFORM(windows, mac, android) ||96.126.123.244^$all + !+ PLATFORM(windows, mac, android) 173.255.194.134$network !+ NOT_PLATFORM(windows, mac, android) ||173.255.194.134^$all + !+ PLATFORM(windows, mac, android) 198.58.118.167$network !+ NOT_PLATFORM(windows, mac, android) ||198.58.118.167^$all + ! https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ ||123chance.net^$all ||123links4u.net^$all @@ -26966,26 +27354,32 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] 34.117.199.78$network !+ NOT_PLATFORM(windows, mac, android) ||34.117.199.78^$all + !+ PLATFORM(windows, mac, android) 94.237.103.119$network !+ NOT_PLATFORM(windows, mac, android) ||94.237.103.119^$all + !+ PLATFORM(windows, mac, android) 94.237.84.54$network !+ NOT_PLATFORM(windows, mac, android) ||94.237.84.54^$all + !+ PLATFORM(windows, mac, android) 94.237.93.242$network !+ NOT_PLATFORM(windows, mac, android) ||94.237.93.242^$all + !+ PLATFORM(windows, mac, android) 94.237.99.118$network !+ NOT_PLATFORM(windows, mac, android) ||94.237.99.118^$all + !+ PLATFORM(windows, mac, android) 139.45.197.249$network !+ NOT_PLATFORM(windows, mac, android) ||139.45.197.249^$all + ! https://dnpedia•com/tlds/topm•php bizarrely listing "anahitagirted•uno" as the 622th most visited domain worldwide ||acorusinfield.life^$all ||acridlydebit.live^$all @@ -27389,30 +27783,37 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] 196.196.153.151$network !+ NOT_PLATFORM(windows, mac, android) ||196.196.153.151^$all + !+ PLATFORM(windows, mac, android) 158.222.7.116$network !+ NOT_PLATFORM(windows, mac, android) ||158.222.7.116^$all + !+ PLATFORM(windows, mac, android) 196.245.152.139$network !+ NOT_PLATFORM(windows, mac, android) ||196.245.152.139^$all + !+ PLATFORM(windows, mac, android) 165.231.251.197$network !+ NOT_PLATFORM(windows, mac, android) ||165.231.251.197^$all + !+ PLATFORM(windows, mac, android) 196.242.16.29$network !+ NOT_PLATFORM(windows, mac, android) ||196.242.16.29^$all + !+ PLATFORM(windows, mac, android) 165.231.4.90$network !+ NOT_PLATFORM(windows, mac, android) ||165.231.4.90^$all + !+ PLATFORM(windows, mac, android) 158.222.7.83$network !+ NOT_PLATFORM(windows, mac, android) ||158.222.7.83^$all + ! Spam on W.I.T.C.H. and Winx text search results tumblr.com#?#div[tabindex][style]:has(a[href*="tinyurl."]:has-text(_1+8_)) tumblr.com#?#div[tabindex][style]:has(a[href*="://cutt.ly/"]) @@ -27480,6 +27881,7 @@ tumblr.com#?#div[tabindex][style]:has(a[href*="://cutt.ly/"]) 95.214.26.78$network !+ NOT_PLATFORM(windows, mac, android) ||95.214.26.78^$all + ! Overly dedicated E-mail spammers ||wirexapp.africa.com^$all ||tachyoniums.eu.com^$all @@ -27493,10 +27895,12 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat 104.21.82.132$network !+ NOT_PLATFORM(windows, mac, android) ||104.21.82.132^$all + !+ PLATFORM(windows, mac, android) 172.67.158.57$network !+ NOT_PLATFORM(windows, mac, android) ||172.67.158.57^$all + [2606:4700:3030::6815:5284]$network [2606:4700:3037::ac43:9e39]$network ! Google results for «SodaStream site:no cranberry» @@ -27526,10 +27930,12 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat 185.155.184.57$network !+ NOT_PLATFORM(windows, mac, android) ||185.155.184.57^$all + !+ PLATFORM(windows, mac, android) 185.155.186.24$network !+ NOT_PLATFORM(windows, mac, android) ||185.155.186.24^$all + ||usayn.fr^$all ||style-js.com^$all /a.aspx?cid=*&cname=^$all @@ -27537,6 +27943,7 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat 209.74.107.131$network !+ NOT_PLATFORM(windows, mac, android) ||209.74.107.131^$all + ||qidjrsgroup.shop^$all /flying.asp?cid=$all /kjyo.php?cname=$all @@ -27613,10 +28020,12 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat 69.172.200.185$network !+ NOT_PLATFORM(windows, mac, android) ||69.172.200.185^$all + !+ PLATFORM(windows, mac, android) 77.220.214.153$network !+ NOT_PLATFORM(windows, mac, android) ||77.220.214.153^$all + ! More search terms than what can be counted with a supercomputer (11/03/2024) google.*##div[data-attrid^="images "]:has-text(/, [1-9][1-46-9]% OF{2}/) ! Scam E-mails I've got @@ -28079,6 +28488,7 @@ www.microsoft.com##a[data-pfns][href*=pac-men] !+ NOT_PLATFORM(windows, mac, android) ||212.27.60.108^$all + !#if !adguard !#endif diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 84d2a2d22..69a9ea73c 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,10 +1,9 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22) -! Version: 21September2024v1 +! Version: 30September2024v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists -! (Note to self, only applicable to uBO: When 1.59.1 goes stable, implement "*$ipaddress=(...),all" for the IP addresses, alongside the previous syntaxing as the case is for AdGuard Browser Extension.) ! Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#-english ! ——— Bad top-level domains ——— @@ -57,6 +56,7 @@ ||adblock.gjtech.net^ ||spam404bl.com^ 109.201.135.46 + ||fredfiber.no^ ||securemecca.com^ @@ -98,6 +98,7 @@ ! Fraudulent browser extensions ||ublock.org^ 138.68.252.54 + ||useragentswitch.com^ ||dev-nano.com^ ||adblocker-app.info^ @@ -233,19 +234,27 @@ ! ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— ||ubuntu.org^$denyallow=you-were-likely-looking-for-ubuntu.com 103.224.212.249 + ||speedtest.com^$denyallow=you-were-likely-looking-for-speedtest.net ||snapchat.cm^$denyallow=malware-typo-squatter-of-snapchat.com ||facebook.cm^$denyallow=malware-typo-squatter-of-facebook.com ||wix.cm^$denyallow=malware-typo-squatter-of-wix.com 199.59.243.222 + |http://ww01.$denyallow=very-very-extremely-frequently-used-in-malware-redirections.* 173.208.96.42 + 173.208.96.43 + 173.208.96.44 + 173.208.96.45 + 173.208.96.46 + 213.227.149.208 + 213.227.149.211 @@ -255,6 +264,7 @@ + ! https://github.com/DevSpen/links/blob/master/src/links.txt @@ -332,6 +342,7 @@ ||katie.*.net^ ||emily.*.net^ 54.174.156.141 + ||lucretius-ada.com^ ||hippolyte-hag.com^ ||india-abc.com^ @@ -345,13 +356,21 @@ ||madagty.com^ ||zeroredirect5.com^$denyallow=malware-redirection-trains.* 54.209.22.226 + 54.91.125.197 + 52.202.53.245 + 35.175.38.64 + 35.168.147.213 + 34.230.160.215 + 3.226.8.132 + 3.216.243.46 + ||roamingclicks.com^ ! Source: desidert•no @@ -363,8 +382,11 @@ ||sarah.*.com^ ||pamela.*.com^ 54.152.245.247 + 35.172.40.232 + 3.90.125.85 + ! Various ex-affiliate links at www•zombooru•com @@ -375,10 +397,15 @@ ||satcom1.co.uk^ ||splitter.microxml.net^ 94.130.185.237 + 94.130.186.231 + 144.76.0.242 + 144.76.1.130 + 195.201.92.254 + ! https://github.com/DandelionSprout/adfilt/pull/167 ||forgoprokick.icu^ ! https://github.com/AdguardTeam/AdguardFilters/issues/124611 @@ -398,9 +425,13 @@ ||newpage.in^ 34.204.214.165 + 54.85.113.62 + 54.205.83.61 + 54.210.193.115 + 2600:1f18:43d1:2a04:ee05:261e:d408:7ba1 ||ailkeyair.com^ ||amulagaudish.cam^ @@ -453,30 +484,48 @@ ||wonfigfig.com^ ||adblockerapp.com^ 172.255.6.107 + 172.255.6.147 + 172.255.6.219 + 172.255.6.225 + 188.42.129.108 + 188.42.129.116 + 188.42.141.100 + 188.42.141.92 + 23.109.82.144 + 23.109.82.41 + 23.109.82.43 + 23.109.82.65 + 23.109.82.66 + 23.109.87.169 + 23.109.87.207 + 23.109.87.208 + ||entwithou.xyz^ ||chedstimaarr.pics^ ||blueoyster.click^ ||qocvicklgcgr.com^ ||zeikvvbobop.com^ 216.21.13.14 + 216.21.13.15 + ||abaphosis.guru^ ||abietichob.live^ ||abyssusuntouch.guru^ @@ -3567,6 +3616,7 @@ ||zmusic-online.com^ 178.128.142.109 + ||findmedia.biz^ ||backtonews.biz^ ||bagclick.biz^ @@ -3587,6 +3637,7 @@ /^http://\d{1,2}\.[a-z0-9-]{1,}\.(club|me)(/|$)/ /^https://\d{1,2}\.[a-z0-9-]{1,}\.(club|me)(/|$)/ 134.209.136.174 + ||whiteclick.biz^ ||dreamnews.biz^ ||gonews2.com^ @@ -3600,9 +3651,13 @@ ||texterra.me^ ||worldtxt.club^ 62.210.6.153 + 62.210.7.209 + 62.210.9.92 + 62.210.11.203 + ||ilo134ulih.com^ ||hooligapps.com^ ||best202*-games-web1.com^ @@ -3619,6 +3674,7 @@ ||stay-notified.com^ ||stay-notified.xyz^ 167.99.249.47 + ! https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ ! https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ ||moderncomputer.net^ @@ -3658,19 +3714,30 @@ ||rebiraert.com^ ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^ 5.8.34.26 + 5.8.47.3 + 103.224.182.251 + ! https://github.com/DandelionSprout/adfilt/issues/193 ||holescontracting.com^ ||doggroomingnews.com^ 5.79.71.205 + 5.79.71.225 + 85.17.31.82 + 85.17.31.122 + 178.162.203.202 + 178.162.203.211 + 178.162.203.226 + 178.162.217.107 + 2a02:1668:1034::2 ! https://github.com/DandelionSprout/adfilt/issues/195 ||logicalrecord.com^ @@ -3684,9 +3751,13 @@ ||securebankapp.online^ ||securemailbox.online^ 66.85.156.85 + 66.85.156.86 + 108.170.31.123 + 108.170.52.156 + ! https://github.com/DandelionSprout/adfilt/issues/198 ||mysecrethoookup.com^ ! https://www•bleepingcomputer•com/virus-removal/ (18/06/2021) @@ -3793,8 +3864,11 @@ ||watch-this.live^ ||weather-forecast.today^ 95.168.170.165 + 213.227.145.147 + 213.227.149.216 + ! https://twitter•com/adamziaja/status/1252234957679808513 ||wow-robotics.xyz^ ! https://blog•sucuri•net/2021/05/woocommerce-credit-card-skimmer•html @@ -3810,6 +3884,7 @@ ||fblaster.com^ ||ribinski.us^ 5.188.62.36 + ! https://github.com/DandelionSprout/adfilt/issues/223 ||speedupmypcfree.com^ ! https://github.com/DandelionSprout/adfilt/issues/224 @@ -3845,6 +3920,7 @@ ||ssielearning.com^ ||paymetconfirm.com^ 69.49.231.244 + ! https://movsb•0x0•st/users/mia ||vid.me^$third-party ||5starhdporn.com^$frame,third-party @@ -3869,6 +3945,7 @@ ||blackpass.info^ ||yzsnw.com^ 37.34.176.37 + ||atvcampingtrips.com^ ||thegymmum.com^ ||pcspeedcat.com^ @@ -3885,14 +3962,20 @@ ||temp74.com^ 23.111.31.137 + 23.111.88.207 + ! https://github.com/DandelionSprout/adfilt/issues/254 ||onesafesoftware.com^ ! https://github.com/DandelionSprout/adfilt/issues/257 185.158.250.239 + 192.169.69.25 + 212.192.241.72 + 37.0.10.83 + ||newstepsco.com^ ||secure-0*.ddnss.ch^ ||lucdream.com^ @@ -3923,6 +4006,7 @@ ! https://www•virustotal•com/gui/url/826c451929420c4da32552f967fb1cab6467405a29c65b23802aaadb6a8c7505/detection ! https://safeweb•norton•com/report/show?url=192•3•110•170 192.3.110.170 + ! https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ ||socialsearchconverter.com^ ||install.socialsearchconverter.com^ @@ -3961,6 +4045,7 @@ ! https://www•virustotal•com/gui/url/5618023ed5a768d7f879c0d599b9ba7cff0e9171201981256eeaf5ce8eb09fdb/detection ! https://www•virustotal•com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection 91.241.19.38 + ! https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection ! https://safeweb•norton•com/report/show?url=telete•in ! https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -3971,41 +4056,58 @@ ! https://www•virustotal•com/gui/domain/kiff•tech/relations ! https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection 45.90.58.90 + ! https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community ! https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection 95.85.89.98 + ! https://github.com/DandelionSprout/adfilt/issues/267 ||tekhacks.net^ ! https://github.com/DandelionSprout/adfilt/pull/278 !! https://www.virustotal.com/gui/file/da75c85fe037f9ff9ebbbd0b37dd2ff154f5e70a0dc6870286e0d3df6b8f246f/community 139.28.37.49 + !! https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community 35.194.188.37 + !! https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community ||hydro-ca.link^ !! https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community 91.243.121.19 + !! https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community 103.169.90.205 + ! https://github.com/DandelionSprout/adfilt/pull/281 ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community 125.44.43.45 + 182.121.8.240 + 42.235.183.74 + 78.36.32.242 + 115.50.2.119 + 115.50.110.163 + 119.179.84.145 + 188.120.50.98 + 190.238.183.5 + 27.220.253.78 + ! https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community ||esetnode32-antiviru.ydns.eu^ ! https://www•joesandbox•com/analysis/486636/0/html#domains ||aieov.com^ ! Relations to the original domain 192.3.194.242 + ||w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu^ ||hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu^ ||avira-antivirus.ydns.eu^ @@ -4081,66 +4183,120 @@ ! https://www•virustotal•com/gui/file/78f490e503c86eaaff5760197b9ff5308ed6e03161af13194a6c1e0cd95422de/community ! https://github.com/DandelionSprout/adfilt/commit/f7f114945c83b339be5cdd848e229680d9918abb#commitcomment-57642875 23.94.26.138 + ! https://github.com/DandelionSprout/adfilt/pull/298 ! https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community 205.185.126.200 + ! https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community 185.243.56.167 + ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community 123.10.224.135 + 59.47.187.147 + 39.68.172.210 + 122.192.177.176 + 112.27.124.108 + 123.110.176.246 + 219.155.105.98 + 171.35.161.209 + 60.16.255.36 + 112.30.4.52 + 182.121.191.201 + 121.61.48.170 + 39.81.68.45 + 27.222.220.164 + 113.233.215.135 + 151.77.100.133 + 125.120.13.184 + 120.12.138.133 + 27.194.115.185 + 104.128.199.228 + 183.92.123.145 + 110.89.8.126 + 125.43.211.184 + 1.0.218.230 + 221.208.4.56 + 60.13.60.19 + 171.37.29.87 + 124.91.237.188 + 115.56.137.49 + 115.52.240.69 + 112.252.132.185 + 117.198.240.157 + 42.53.240.249 + 116.179.138.68 + 110.241.119.159 + 115.56.31.133 + 103.19.128.222 + 202.12.80.74 + 61.52.8.62 + 182.122.252.69 + 219.155.26.50 + 120.4.141.185 + 119.102.7.115 + 72.51.127.213 + 111.224.199.91 + 119.250.236.122 + 112.30.110.58 + ! https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community ||pcae.de^ ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community 117.196.49.21 + 115.55.54.234 + 115.52.17.123 + 182.59.69.21 + ! https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community ||chip-secured-download.de^ ! https://www•virustotal•com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb @@ -4164,6 +4320,7 @@ ! Vermilion Strike ! https://www•virustotal•com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations 160.202.163.100 + ! https://www•virustotal•com/gui/ip-address/160•202•163•100/relations ||microsoftkernel.com^ ||microsofthk.com^ @@ -4177,10 +4334,13 @@ ! https://github.com/DandelionSprout/adfilt/pull/303 ! https://www•virustotal•com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community 45.95.169.115 + ! https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community 45.148.120.80 + ! https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community 85.239.33.9 + ! Relations to the domain above ||adminsys.serveftp.com^ ||amazbaidu.serveftp.com^ @@ -4198,8 +4358,10 @@ ||eposcardokubo.serveftp.com^ ! https://www•virustotal•com/gui/file/8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0/community 107.173.176.183 + ! https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community 45.148.120.171 + ! https://twitter•com/soranker0/status/1449491402409185283 ://disordgift. ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-950330114 @@ -4210,6 +4372,7 @@ /(^|://|\.)[a-z]{5,}-[a-z]{5,}-[a-z]{5,}\.xyz($|/)/ ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-951321929 159.148.186.228 + ! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains ||yotube.com^ ||r-tb.com^ @@ -4238,38 +4401,70 @@ ! https://github.com/DandelionSprout/adfilt/pull/348 ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community 39.83.80.247 + 68.197.33.124 + 219.157.21.37 + 182.123.141.17 + 125.47.243.187 + 182.122.196.203 + 182.117.231.182 + 112.31.211.135 + 125.106.63.93 + 115.59.197.46 + 122.159.29.192 + 171.40.0.127 + 171.80.219.160 + 123.10.65.201 + 168.90.205.46 + 125.47.205.109 + 39.80.147.239 + 45.224.171.130 + 45.5.209.75 + 116.17.210.157 + 27.45.103.240 + 110.167.64.171 + 39.81.117.73 + 183.15.90.156 + 119.113.248.74 + 175.0.95.85 + 61.52.99.109 + 222.142.183.194 + 106.86.172.194 + 103.233.216.77 + 183.188.192.55 + ! https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community 198.23.255.14 + ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971512075 ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971495248 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/15/1.md#iocs @@ -4278,7 +4473,9 @@ ||trumops.com^ ||runmodes.com^ 91.121.67.60 + 172.67.186.189 + ! https://www•virustotal•com/gui/url/af8f443208f4e86d469549b219fccbeb43b7cae40be5f1b4c4e5083e27fc8111 ||inconclusive-pyrite-grandparent.glitch.me^ ||delicate-tame-angora.glitch.me^ @@ -4294,9 +4491,13 @@ ||securefirst.us-east-1.linodeobjects.com^ ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community 39.65.72.211 + 42.238.151.197 + 27.213.60.53 + 115.56.169.134 + ! https://github.com/iam-py-test/investigations/blob/main/2021/11/21/1.md ||yasir252.com^ ||safelink.kadal.club^ @@ -4317,8 +4518,10 @@ ! https://www•virustotal•com/gui/file/2b2628a50d3b39b0fa2395d487bf62b00e37cdae847ff76ee58399bbe4e9f7b3/community 194.87.138.20 + ! https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community 103.167.92.73 + ! https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community ||bursakulis.com^ ! https://www•virustotal•com/gui/url/b333c49efa4d399e65c5e2d96a905b380acbca58a3e3052b7bd7cfcb3e0e81ee @@ -4345,13 +4548,21 @@ ||shadyclient.net^ ! https://www•virustotal•com/gui/file/d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8/community 58.249.74.79 + 27.45.14.109 + 27.40.101.191 + 27.45.119.22 + 27.47.73.159 + 115.204.119.237 + 163.125.31.46 + 163.179.168.44 + ! https://github.com/uBlockOrigin/uAssets/pull/10647 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md ||money-mod.com^ @@ -4367,16 +4578,27 @@ ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community 110.89.59.135 + 113.116.89.1 + 119.183.146.191 + 153.3.3.226 + 182.116.104.6 + 60.7.133.200 + 122.6.254.201 + 110.89.11.167 + 171.112.177.90 + 115.194.38.143 + 61.52.79.32 + ! https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 ://ups-dk.$denyallow=dk|nu|se|no|fo|gl|ups.com,ups-dk.* ! https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 @@ -4407,6 +4629,7 @@ ||dundeehills.group^ !+ NOT_OPTIMIZED 132.148.220.142 + ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 ||chess-progress.ru^ ||ouhastay.net^ @@ -4425,18 +4648,28 @@ ! https://github.com/iam-py-test/investigations/blob/main/2021/12/13/1.md ||haxpc.net^ 52.53.243.52 + 34.201.22.10 + ! https://scammer.info/t/crypto-scammers-onceagain/85354 ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community 123.10.225.196 + 122.192.106.84 + 172.88.199.9 + 114.38.176.185 + 61.52.97.35 + 27.206.181.208 + 124.163.130.175 + 118.75.87.102 + ! https://github.com/iam-py-test/investigations/blob/main/2021/12/14/1.md ||onemacusa.net^ ! https://github.com/DevSpen/links/pull/3 @@ -4445,6 +4678,7 @@ ||mozicrack.com^ ||download-srvr.xyz^ 134.122.115.190 + ||cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com^ ! https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777 ||viewty.xyz^ @@ -4467,6 +4701,7 @@ ! https://github.com/AdguardTeam/AdguardFilters/issues/103475 ||ru.com^ 141.8.226.34 + ! https://github.com/AdguardTeam/AdguardFilters/issues/108571 ||ston-app.com^ ! fake human verification scam @@ -4483,6 +4718,7 @@ ||splendid-fallacious-anaconda.glitch.me^ ! https://www•virustotal•com/gui/file/9d40ae0439ddc594b2cf64e21ad0fdea9bb440524298e3a6bcfcc1fb417f1ed2/relations 91.240.118.172 + ! "Press Allow to continue" ||kuyhaa-mee.com^ ||waystriling.com^ @@ -4528,6 +4764,7 @@ ||freeversioncrack.com^$document ||top3hostngc.xyz^ 198.199.120.251 + ! https://www•telia.no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/ @@ -4551,7 +4788,9 @@ ||partners-club.life^ ||cumpussyy.uno^ 195.201.253.130 + 195.201.253.131 + ! The bottom download button on https://www•sushichop•com/ ||installiq.com^ ||specgoal.com^ @@ -4571,10 +4810,15 @@ ||rtbvrdirect.com^$denyallow=malware-redirection-trains.* ||cpmverdirect.com^$denyallow=malware-redirection-trains.* 15.197.244.48 + 96.47.230.67 + 96.47.230.68 + 96.47.230.69 + 96.47.230.70 + ! https://securitytrails•com/list/ns/ns1•fastthinkingdns•com ||highercaptcha-settle. ||highercaptchasettle. @@ -4615,6 +4859,7 @@ ||viixes.com^ ||viiyhn.com^ 31.220.27.134 + ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk. ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 @@ -4919,7 +5164,9 @@ ://178.253.54. 85.17.31.152 + 95.211.26.202 + ! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 ||bzsx.link^ ||dfvd.link^ @@ -4934,8 +5181,10 @@ ||ujtj.link^ ||wznp.link^ 158.247.212.220 + 165.227.168.212 + ! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ ://162.241.115. @@ -4982,6 +5231,7 @@ ||broburchrove.com^ ||galantinkoling.com^ 23.81.64.183 + ! https://github.com/AdguardTeam/AdguardFilters/issues/125300 ||zikroarg.com^ ||dooloust.net^ @@ -5152,6 +5402,7 @@ ||vooculok.com^ 139.45.197.236 + ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^ ||becovi.co.uk^ @@ -5180,8 +5431,11 @@ ||frescopartito.com^ ||motherpipe.net^ 51.91.66.125 + 51.178.76.105 + 147.135.253.55 + ! https://github.com/uBlockOrigin/uAssets/issues/14569 → https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection (https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) ||bnbdeal.net^ ! https://github.com/AdguardTeam/AdguardFilters/issues/129414 @@ -5191,7 +5445,9 @@ /^http://imgblaze.net/[a-z0-9]{6}$/$third-party,subdocument ! https://github.com/AdguardTeam/AdguardFilters/issues/131156 146.19.169.98 + 146.19.169.99 + ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 /pushredirect/?~malware-redirection-trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -6965,12 +7221,14 @@ ||niderschlagsradar.de^ ||2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com^ 69.162.80.56 + ! https://github.com/AdguardTeam/AdguardFilters/issues/134903 ||smartlink.name^ ! Random Discord servers ||newntflix-popup ||giveawaycord. 162.241.124.200 + ! https://github.com/AdguardTeam/AdguardFilters/issues/135815 ||adsstar.in^ ||clickcafe.in^ @@ -6987,6 +7245,7 @@ ||usanewstoday.club^ ||webhostingtips.club^ 157.90.71.190 + ! https://github.com/AdguardTeam/AdguardFilters/issues/135924 ||abazelfan.com^ ||abburmyer.com^ @@ -7224,6 +7483,7 @@ ||zagtertda.com^ ||zoawufoy.net^ 139.45.197.239 + ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub.$document,popup ! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -7424,8 +7684,11 @@ ||zaolutd.icu^ ||zigaahm.icu^ 44.228.230.225 + 50.112.124.170 + 100.20.104.229 + ! Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread ||link.sv^ ||4.fo^ @@ -7437,12 +7700,17 @@ ||pressizer.net^ ||sapino.net^ 44.236.213.34 + 52.24.156.12 + 52.25.6.134 + 100.20.13.49 + ! https://github.com/AdguardTeam/AdguardFilters/issues/139667 ||goldmesoil.live^ 51.68.87.229 + ||f9dle.skin^ ||kilpa2017.fi^ ! https://github.com/DandelionSprout/adfilt/issues/747 @@ -9247,8 +9515,11 @@ ||unity-download.org^ ||webull-download. 185.106.94.139 + 45.90.109.196 + 91.229.23.200 + ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1401711872 ! https://github.com/AdguardTeam/AdguardFilters/issues/144514 ||attractbestbonuses.life^ @@ -9310,12 +9581,15 @@ ||winbest.life^ ||winmacros.life^ 185.155.184.98 + 194.110.247.242 + ! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ ||ups-addressed.me^ ||ups-quote.me^ ||meta-whatsapp.me^ 54.219.218.169 + ! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^ ||0365online.com^ @@ -9747,6 +10021,7 @@ ||yourticketchance.com^ ||yourorderupdate.com^ 64.132.201.92 + ! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||acessmygov.online^ ||centerlinkmygov.com^ @@ -9768,6 +10043,7 @@ ||jatcraft.com^ ||elimef.link^ 209.141.51.49 + ://soekpakke*.blogspot.com^ ||post-norway.web.app^ ! https://github.com/AdguardTeam/AdguardFilters/issues/142955 @@ -10364,8 +10640,11 @@ ||zogrepsili.com^ ! Unsuited for wildcarding 208.88.225.116 + 208.88.225.117 + 208.88.225.119 + ! https://github.com/AdguardTeam/AdguardFilters/issues/144823 !+ NOT_OPTIMIZED @@ -10468,9 +10747,13 @@ ||wulfs-dcm.com^ /zcvisitor/*?campaignid 3.231.116.86 + 54.237.193.255 + 3.231.137.120 + 54.204.83.105 + ! https://github.com/DandelionSprout/adfilt/issues/808 ! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) ||jonathanbartz.com^ @@ -10490,10 +10773,15 @@ ||office-view.com^ ||i-likefood.co^ 108.61.242.65 + 146.70.78.43 + 87.120.254.39 + 45.150.108.213 + 92.204.160.240 + ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 ! Comments on Slack @@ -10649,6 +10937,7 @@ ||watchrenewedcompletelyinfo-product.info^ ||watchuberdevelopedinfo-product.info^ 34.200.46.148 + ||abstorick.com^ ||affienness.com^ ||ailippiess.co.in^ @@ -10706,6 +10995,7 @@ ||wuruclas.co.in^ ||zondeucearixes.com^ 85.17.80.16 + ! https://www•adressa.no/nyheter/trondheim/i/Moq2wR/svindlere-kaarer-vinnere-i-konkurranser-gir-en-daarlig-foelelse-aa-forklare-at-dette-bare-er-tull ||sitey.me^ ! https://github.com/AdguardTeam/AdguardFilters/issues/151479 @@ -10847,10 +11137,15 @@ ||your-finance-now.com^ ||your-survey-services.com^ 185.246.188.124 + 185.246.188.125 + 194.63.140.103 + 194.63.143.61 + 194.63.143.96 + ! https://github.com/AdguardTeam/AdguardFilters/issues/152945 ||moneystartup.live^ ||fintechbest.online^ @@ -11061,8 +11356,11 @@ ||zarta-news.com^ ||zorka-news.com^ 37.48.80.112 + 95.168.170.165 + 213.227.149.216 + ! Slack comments ||cojcdn.net^ ||collecl.cc^ @@ -11089,7 +11387,9 @@ ||totadblock.com^ ||updateasap.online^ 109.206.168.16 + 109.206.168.17 + ! https://github.com/AdguardTeam/AdguardFilters/issues/155298 ||cadstoppam.live^ ||cottodwin.live^ @@ -11107,6 +11407,7 @@ ||usedhutsold.live^ 57.128.71.215 + ! https://github.com/AdguardTeam/AdguardFilters/issues/155936 ||truanet.com^ ||rumadel.com^ @@ -11843,15 +12144,25 @@ ||zzebuh.com^ ||zzrgab.com^ 37.1.223.231 + 139.45.197.167 + 139.45.197.245 + 159.223.137.164 + 185.56.234.205 + 192.243.58.97 + 192.243.58.98 + 192.243.58.123 + 192.243.58.124 + 192.243.58.125 + 2a02:b48:207:1::2 2a02:b48:207:1::3 2a02:b48:207:1::6 @@ -12231,9 +12542,12 @@ ||wellnessfortune.net^ ||ztomy.com^ 5.45.123.44 + 69.16.230.226 + 208.91.196.46 + ! https://github.com/AdguardTeam/AdguardFilters/issues/158316 ||abashfireworks.com^ ||abashinstructor.com^ @@ -16810,6 +17124,7 @@ ||wmptengate.com^ 93.93.51.223 + ! https://github.com/AdguardTeam/AdguardFilters/issues/161364 ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) /(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~third-party,github.*|com|org|net|co|blog|community|host|io|microsoft|office|uk|us|xn--fiqs8s|dev|archive.* @@ -17062,6 +17377,7 @@ ||upstr.us^ ||reschedule-delivery.ups.com. 103.174.102.240 + ! https://github.com/libre-tube/LibreTube/issues/4409 ||libretube.app^ ||libretube.net^ @@ -17212,6 +17528,7 @@ ! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7873648 ||monetrizer*. 38.180.96.244 + ! https://github.com/AdguardTeam/AdguardFilters/issues/172569 ||acareewityjh.com^ ||accedenonre.xyz^ @@ -17549,8 +17866,10 @@ ||yticaframeofm.com^ ||yvaluationiamcur.com^ 34.195.224.242 + 54.225.185.110 + ||githubtalentcommunity. ! https://github.com/AdguardTeam/AdguardFilters/issues/173925 ||sweedbank-help.com^ @@ -17560,6 +17879,7 @@ ||dhlexpress-lieferung.net^ ||pochta-ru.com^ 91.202.233.143 + ! Based on a tip from my secretary ||0842-3231-4323-4243-2344-1333-0595-3453-6439-7-3235-03928-2348.name^ ||1-3evlhls3yf.shop^ @@ -17916,6 +18236,7 @@ ||systemnetworkroute.com^ ||trafficredirectchain.com^ 108.62.157.10 + ! https://github.com/AdguardTeam/FiltersRegistry/issues/925 ! https://github.com/AdguardTeam/FiltersRegistry/pull/927 ||avito.avito.avito. @@ -17930,15 +18251,25 @@ ||booking.com-id* ! https://github.com/AdguardTeam/AdguardFilters/issues/179170 172.240.108.68 + 172.240.108.76 + 172.240.108.84 + 172.240.127.234 + 172.240.253.132 + 192.243.59.12 + 192.243.59.13 + 192.243.59.20 + 192.243.61.225 + 192.243.61.227 + ||0sntp7dnrr.com^ ||0x01n2ptpuz3.com^ ||2e8dgn8n0e0l.com^ @@ -20917,6 +21248,7 @@ ||zipinaccurateoffering.com^ ! https://github.com/AdguardTeam/AdguardFilters/issues/181966 167.71.252.38 + ! https://github.com/AdguardTeam/AdguardFilters/issues/183432 ||100carbures.com^ ||123ecos.com^ @@ -22027,9 +22359,13 @@ ||zoomdirectory.net^ ||zymstr.com^ 185.149.120.161 + 185.149.120.163 + 185.149.120.173 + 185.149.120.175 + ! https://github.com/AdguardTeam/AdguardFilters/issues/184671 ||2rlive.com^ ||afro-melanin.com^ @@ -22193,6 +22529,7 @@ ||zglobalindia.com^ ||zircontahafuz.com^ 185.149.120.173 + ! https://sol•no/81812194/ / https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-10360231 ||02helpinfo.com^ ||02rebill-pending.com^ @@ -22682,26 +23019,46 @@ ||yourtollbymailnyfile.com^ ||youweb-bpm.com^ 45.202.32.3 + 45.8.92.138 + 79.133.46.252 + 82.147.85.156 + 91.212.166.16 + 94.156.64.129 + 94.232.249.61 + 94.232.249.69 + 94.232.249.75 + 94.232.249.235 + 176.111.174.118 + 176.113.115.191 + 191.96.224.140 + 193.124.185.42 + 193.143.1.45 + 193.143.1.214 + 193.143.1.217 + 208.91.189.203 + ://193.143.1.* +! https://github.com/AdguardTeam/AdguardFilters/issues/189905 + ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -24336,9 +24693,12 @@ ||zypy2h6rgfux.com^ ||zzdb5p4upiug.com^ 192.243.59.12 + 192.243.59.13 + 192.243.59.20 + /^(https?://)?192\.243\.59\.\d{1,3}($|/)/ ! rule34hentai.net when uBlock Filters and AdGuard Base are turned off @@ -24371,10 +24731,14 @@ ||skinosoda.online^ 194.226.139.121 + 194.226.139.7 + 95.181.157.36 + 95.181.172.204 + ://194.226.139. ! AS209813 (https://github.com/AdguardTeam/AdguardFilters/issues/114618#issuecomment-1100702530; currently specific to tools that support CIDR blocking) ://5.8.67. @@ -24984,6 +25348,7 @@ ||sidenoteconcern.com^ ||abnegationbanquet.com^ 192.243.61.225 + ! https://twitter•com/medicinehelp/status/1550250932394409985 ! https://securitytrails•com/list/ip/147•135•16•27 ||2spendless. @@ -25041,6 +25406,7 @@ ||medicinecoupons.xyz^ ||medicinehelp.news^ 147.135.16.27 + ! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^ ! Spambot posts on Tumblr (19/09/2022) @@ -25054,6 +25420,7 @@ ||1pwk1j.cyou^ ||986.group^ 185.87.148.199 + ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) @@ -25068,6 +25435,7 @@ 45.136.49.35 + ! Browsing around for Tajik newssites ||arhernot.live^ ||lifelongkick.live^ @@ -25120,10 +25488,15 @@ ||cityratetod.live^ ||onlymetsure.live^ 51.91.211.94 + 162.19.71.16 + 146.59.240.191 + 54.37.5.34 + 54.36.118.105 + ! Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt ||highlandnews.com^ ||genuinescansupport.com^ @@ -25151,6 +25524,7 @@ ||networkprincple.com^ ||pcnetworkdefense.com^ 159.89.10.102 + ! Other ||foxsportnetwork.com^ ||pksauniversity.com^ @@ -25174,6 +25548,7 @@ ||nuouther.com^ ||carpiesi.com^ 104.206.252.90 + ! https://github.com/blocklistproject/Lists/issues/933 ||jNKmS0zFuEh.click^ ||pjljo54uk.click^ @@ -25198,6 +25573,7 @@ ||yuppdownload.com^ ! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) 34.80.59.191 + ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 |http://www6.$denyallow=often-used-in-malware-redirections.* @@ -25206,17 +25582,29 @@ ||kusubooru.com^ ||wh40kart.im^ 45.33.2.79 + 45.33.18.44 + 45.33.20.235 + 45.33.23.183 + 45.33.30.197 + 45.56.79.23 + 45.79.19.196 + 72.14.178.174 + 72.14.185.43 + 96.126.123.244 + 173.255.194.134 + 198.58.118.167 + ! https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ ||123chance.net^ ||123links4u.net^ @@ -25595,11 +25983,17 @@ ||zebramode.com^ ||zebraoffers.net^ 34.117.199.78 + 94.237.103.119 + 94.237.84.54 + 94.237.93.242 + 94.237.99.118 + 139.45.197.249 + ! https://dnpedia•com/tlds/topm•php bizarrely listing "anahitagirted•uno" as the 622th most visited domain worldwide ||acorusinfield.life^ ||acridlydebit.live^ @@ -26000,12 +26394,19 @@ *skobutikks.com^ *butikksoslo.com^ 196.196.153.151 + 158.222.7.116 + 196.245.152.139 + 165.231.251.197 + 196.242.16.29 + 165.231.4.90 + 158.222.7.83 + ! Spam on W.I.T.C.H. and Winx text search results ! A scam SMS I got ||95-214-26-78.plesk.page^ @@ -26068,6 +26469,7 @@ ||your-ups-track.com^ ||zoll-pakete-support.com^ 95.214.26.78 + ! Overly dedicated E-mail spammers ||wirexapp.africa.com^ ||tachyoniums.eu.com^ @@ -26076,7 +26478,9 @@ ||ybd001.com^ ||deltacorriher.best^ 104.21.82.132 + 172.67.158.57 + 2606:4700:3030::6815:5284 2606:4700:3037::ac43:9e39 ! Google results for «SodaStream site:no cranberry» @@ -26103,11 +26507,14 @@ ||sirdayscare.info^ ||slownansuch.info^ 185.155.184.57 + 185.155.186.24 + ||usayn.fr^ ||style-js.com^ 209.74.107.131 + ||qidjrsgroup.shop^ @@ -26181,7 +26588,9 @@ ||xgptw11vogsh.com^ ||zeirj14ikqwf.com^ 69.172.200.185 + 77.220.214.153 + ! More search terms than what can be counted with a supercomputer (11/03/2024) ! Scam E-mails I've got @@ -26305,6 +26714,7 @@ + ! https://github.com/AdguardTeam/AdguardFilters/issues/145513 diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 8c5f2b940..77c59bc0d 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,9 +1,8 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 21September2024v1 +# Version: 30September2024v2 # Expires: 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway. -# (N # ——— Bad top-level domains ——— # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. @@ -50,6 +49,7 @@ adblock.gjtech.net spam404bl.com 109.201.135.46 + fredfiber.no securemecca.com 1hos.cf @@ -91,6 +91,7 @@ mandriva.com # Fraudulent browser extensions ublock.org 138.68.252.54 + useragentswitch.com dev-nano.com adblocker-app.info @@ -230,19 +231,27 @@ the1adblocker.com # ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— ubuntu.org 103.224.212.249 + speedtest.com snapchat.cm facebook.cm wix.cm 199.59.243.222 + 14d.us 173.208.96.42 + 173.208.96.43 + 173.208.96.44 + 173.208.96.45 + 173.208.96.46 + 213.227.149.208 + 213.227.149.211 @@ -250,6 +259,7 @@ wix.cm + discordapp.cam discordap.com @@ -318,6 +328,7 @@ discorde-nitre.xyz netnet44.net tncrun.net 54.174.156.141 + lucretius-ada.com hippolyte-hag.com india-abc.com @@ -331,21 +342,32 @@ lordagty.com madagty.com zeroredirect5.com 54.209.22.226 + 54.91.125.197 + 52.202.53.245 + 35.175.38.64 + 35.168.147.213 + 34.230.160.215 + 3.226.8.132 + 3.216.243.46 + roamingclicks.com # Source: desidert•no collectfasttracks.com # Source: vn-zoom•com ttnrd.com 54.152.245.247 + 35.172.40.232 + 3.90.125.85 + # Various ex-affiliate links at www•zombooru•com track.vcdc.com track.tkbo.com @@ -356,13 +378,18 @@ ns1.trafficclub.com satcom1.co.uk splitter.microxml.net 94.130.185.237 + 94.130.186.231 + 144.76.0.242 + 144.76.1.130 + 195.201.92.254 + forgoprokick.icu inbluson.com @@ -379,9 +406,13 @@ couponbybox.com newpage.in 34.204.214.165 + 54.85.113.62 + 54.205.83.61 + 54.210.193.115 + [2600:1f18:43d1:2a04:ee05:261e:d408:7ba1] ailkeyair.com amulagaudish.cam @@ -434,30 +465,48 @@ witlayvet.com wonfigfig.com adblockerapp.com 172.255.6.107 + 172.255.6.147 + 172.255.6.219 + 172.255.6.225 + 188.42.129.108 + 188.42.129.116 + 188.42.141.100 + 188.42.141.92 + 23.109.82.144 + 23.109.82.41 + 23.109.82.43 + 23.109.82.65 + 23.109.82.66 + 23.109.87.169 + 23.109.87.207 + 23.109.87.208 + entwithou.xyz chedstimaarr.pics blueoyster.click qocvicklgcgr.com zeikvvbobop.com 216.21.13.14 + 216.21.13.15 + abaphosis.guru abietichob.live abyssusuntouch.guru @@ -3542,6 +3591,7 @@ zmp3-online.com zmusic-online.com zredir.com 178.128.142.109 + findmedia.biz backtonews.biz bagclick.biz @@ -3562,6 +3612,7 @@ vviewpoint.biz 134.209.136.174 + whiteclick.biz dreamnews.biz gonews2.com @@ -3575,9 +3626,13 @@ startmode.biz texterra.me worldtxt.club 62.210.6.153 + 62.210.7.209 + 62.210.9.92 + 62.210.11.203 + ilo134ulih.com hooligapps.com theonlygames.com @@ -3592,6 +3647,7 @@ notified-today.xyz stay-notified.com stay-notified.xyz 167.99.249.47 + moderncomputer.net version.gratis starpowders.github.io @@ -3617,18 +3673,29 @@ redirekted.com rebiraert.com iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com 5.8.34.26 + 5.8.47.3 + 103.224.182.251 + holescontracting.com doggroomingnews.com 5.79.71.205 + 5.79.71.225 + 85.17.31.82 + 85.17.31.122 + 178.162.203.202 + 178.162.203.211 + 178.162.203.226 + 178.162.217.107 + [2a02:1668:1034::2] logicalrecord.com secureportal.online @@ -3640,9 +3707,13 @@ emiratenbduae.com securebankapp.online securemailbox.online 66.85.156.85 + 66.85.156.86 + 108.170.31.123 + 108.170.52.156 + mysecrethoookup.com toksearches.xyz smashapps.net @@ -3746,8 +3817,11 @@ video-update.digital watch-this.live weather-forecast.today 95.168.170.165 + 213.227.145.147 + 213.227.149.216 + wow-robotics.xyz deepe.icu google-analytics.buzz @@ -3761,6 +3835,7 @@ aleinvest.xyz fblaster.com ribinski.us 5.188.62.36 + speedupmypcfree.com flomongteren.com gedinetuwus.com @@ -3794,6 +3869,7 @@ untilkawan.com ssielearning.com paymetconfirm.com 69.49.231.244 + vid.me 5starhdporn.com helooworld.us @@ -3812,6 +3888,7 @@ cocinasintonterias.com blackpass.info yzsnw.com 37.34.176.37 + atvcampingtrips.com thegymmum.com pcspeedcat.com @@ -3827,12 +3904,18 @@ mgmgmg.com temp74.com trackwebclick.com 23.111.31.137 + 23.111.88.207 + onesafesoftware.com 185.158.250.239 + 192.169.69.25 + 212.192.241.72 + 37.0.10.83 + newstepsco.com lucdream.com beastbuying.com @@ -3854,6 +3937,7 @@ pc-my-protection.xyz beta-news.org dashwoodestates.com 192.3.110.170 + socialsearchconverter.com install.socialsearchconverter.com feed.socialsearchconverter.com @@ -3883,31 +3967,49 @@ totaladblock.com totaladblocker.xyz totalwebshield.xyz 91.241.19.38 + telete.in kiff.tech 45.90.58.90 + 95.85.89.98 + tekhacks.net 139.28.37.49 + 35.194.188.37 + hydro-ca.link 91.243.121.19 + 103.169.90.205 + 125.44.43.45 + 182.121.8.240 + 42.235.183.74 + 78.36.32.242 + 115.50.2.119 + 115.50.110.163 + 119.179.84.145 + 188.120.50.98 + 190.238.183.5 + 27.220.253.78 + esetnode32-antiviru.ydns.eu aieov.com # Relations to the original domain 192.3.194.242 + w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu avira-antivirus.ydns.eu @@ -3971,60 +4073,114 @@ mcafee12.tt.omtrdc.net trolleydrop.info cd.org 23.94.26.138 + 205.185.126.200 + 185.243.56.167 + 123.10.224.135 + 59.47.187.147 + 39.68.172.210 + 122.192.177.176 + 112.27.124.108 + 123.110.176.246 + 219.155.105.98 + 171.35.161.209 + 60.16.255.36 + 112.30.4.52 + 182.121.191.201 + 121.61.48.170 + 39.81.68.45 + 27.222.220.164 + 113.233.215.135 + 151.77.100.133 + 125.120.13.184 + 120.12.138.133 + 27.194.115.185 + 104.128.199.228 + 183.92.123.145 + 110.89.8.126 + 125.43.211.184 + 1.0.218.230 + 221.208.4.56 + 60.13.60.19 + 171.37.29.87 + 124.91.237.188 + 115.56.137.49 + 115.52.240.69 + 112.252.132.185 + 117.198.240.157 + 42.53.240.249 + 116.179.138.68 + 110.241.119.159 + 115.56.31.133 + 103.19.128.222 + 202.12.80.74 + 61.52.8.62 + 182.122.252.69 + 219.155.26.50 + 120.4.141.185 + 119.102.7.115 + 72.51.127.213 + 111.224.199.91 + 119.250.236.122 + 112.30.110.58 + pcae.de 117.196.49.21 + 115.55.54.234 + 115.52.17.123 + 182.59.69.21 + chip-secured-download.de # Domains which resolve to this (already blocked) IP - for users of HOSTs/Domains/uBlock Origin nctylivpwhpby.com @@ -4041,6 +4197,7 @@ iolostore.com realdefen.se # Vermilion Strike 160.202.163.100 + microsoftkernel.com microsofthk.com @@ -4048,8 +4205,11 @@ machinesalaver.net pushbizapi.com 45.95.169.115 + 45.148.120.80 + 85.239.33.9 + # Relations to the domain above adminsys.serveftp.com amazbaidu.serveftp.com @@ -4066,13 +4226,16 @@ c4ase-verified9932.serveftp.com 1log-wellsfargo.serveftp.com eposcardokubo.serveftp.com 107.173.176.183 + 45.148.120.171 + free-softs.net cloud-apps.store 159.148.186.228 + yotube.com r-tb.com cdn.hoood.info @@ -4095,43 +4258,77 @@ mediadlvr.com youvetube.com youutube.com 39.83.80.247 + 68.197.33.124 + 219.157.21.37 + 182.123.141.17 + 125.47.243.187 + 182.122.196.203 + 182.117.231.182 + 112.31.211.135 + 125.106.63.93 + 115.59.197.46 + 122.159.29.192 + 171.40.0.127 + 171.80.219.160 + 123.10.65.201 + 168.90.205.46 + 125.47.205.109 + 39.80.147.239 + 45.224.171.130 + 45.5.209.75 + 116.17.210.157 + 27.45.103.240 + 110.167.64.171 + 39.81.117.73 + 183.15.90.156 + 119.113.248.74 + 175.0.95.85 + 61.52.99.109 + 222.142.183.194 + 106.86.172.194 + 103.233.216.77 + 183.188.192.55 + 198.23.255.14 + freedownloadfiles.org querahinor.xyz trumops.com runmodes.com 91.121.67.60 + 172.67.186.189 + inconclusive-pyrite-grandparent.glitch.me delicate-tame-angora.glitch.me secureinvoice.glitch.me @@ -4144,9 +4341,13 @@ mature-periwinkle-advantage.glitch.me tough-numerous-lemur.glitch.me securefirst.us-east-1.linodeobjects.com 39.65.72.211 + 42.238.151.197 + 27.213.60.53 + 115.56.169.134 + yasir252.com safelink.kadal.club bedrapiona.com @@ -4162,7 +4363,9 @@ t.tonightshookup.com yourladiefun.life newrrb.bid 194.87.138.20 + 103.167.92.73 + bursakulis.com 610418.selcdn.ru alexstewartinternationalltd.rw @@ -4179,13 +4382,21 @@ fasterfiles.net yunosurveys.com shadyclient.net 58.249.74.79 + 27.45.14.109 + 27.40.101.191 + 27.45.119.22 + 27.47.73.159 + 115.204.119.237 + 163.125.31.46 + 163.179.168.44 + money-mod.com reykijnoac.com totalnicefeed.com @@ -4195,17 +4406,28 @@ bestlifeoffer20.com 110.89.59.135 + 113.116.89.1 + 119.183.146.191 + 153.3.3.226 + 182.116.104.6 + 60.7.133.200 + 122.6.254.201 + 110.89.11.167 + 171.112.177.90 + 115.194.38.143 + 61.52.79.32 + lowseelan.com @@ -4221,6 +4443,7 @@ flash.cn dundeehills.group !+ NOT_OPTIMIZED 132.148.220.142 + chess-progress.ru ouhastay.net askara.super.site @@ -4232,21 +4455,32 @@ galerijajava.ba p-stn.net haxpc.net 52.53.243.52 + 34.201.22.10 + 123.10.225.196 + 122.192.106.84 + 172.88.199.9 + 114.38.176.185 + 61.52.97.35 + 27.206.181.208 + 124.163.130.175 + 118.75.87.102 + onemacusa.net systemupdatecontrol.com mozicrack.com download-srvr.xyz 134.122.115.190 + cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com viewty.xyz landing.marketstm.com @@ -4266,6 +4500,7 @@ new-meet-dating.life wellhello.com ru.com 141.8.226.34 + ston-app.com # fake human verification scam # start form - reported for abuse @@ -4279,6 +4514,7 @@ d13pxqgp3ixdbh.cloudfront.net crashfixes.com splendid-fallacious-anaconda.glitch.me 91.240.118.172 + # "Press Allow to continue" kuyhaa-mee.com waystriling.com @@ -4318,6 +4554,7 @@ activatorwin.com freeversioncrack.com top3hostngc.xyz 198.199.120.251 + !+ NOT_OPTIMIZED # A Discord conversation I had about Throneful @@ -4340,7 +4577,9 @@ partners-space.life partners-club.life cumpussyy.uno 195.201.253.130 + 195.201.253.131 + installiq.com specgoal.com sandhyapi.online @@ -4359,12 +4598,17 @@ rtbrevdirect.com rtbvrdirect.com cpmverdirect.com 15.197.244.48 + 96.47.230.67 + 96.47.230.68 + 96.47.230.69 + 96.47.230.70 + telemetry-urs-microsoft.com winrar-desktop.com @@ -4400,6 +4644,7 @@ viixes.com viiyhn.com 31.220.27.134 + saferedirects.xyz online-guard.com @@ -4694,7 +4939,9 @@ zuginmw.art 85.17.31.152 + 95.211.26.202 + bzsx.link dfvd.link dsvs.link @@ -4708,10 +4955,12 @@ szxo.link ujtj.link wznp.link 158.247.212.220 + 165.227.168.212 + k-yw.com fearconic.com atobunderevenes.com @@ -4753,6 +5002,7 @@ proilammix.com broburchrove.com galantinkoling.com 23.81.64.183 + zikroarg.com dooloust.net vooshagy.net @@ -4922,6 +5172,7 @@ influencer2020.com vooculok.com mobytrks.com 139.45.197.236 + becovi.com becovi.co.uk shopfirststop.com @@ -4949,16 +5200,21 @@ optimusquaero.com frescopartito.com motherpipe.net 51.91.66.125 + 51.178.76.105 + 147.135.253.55 + bnbdeal.net !+ NOT_OPTIMIZED !+ NOT_OPTIMIZED 146.19.169.98 + 146.19.169.99 + 1000girl.com 1000islandsinfo.com 100blackmenkc.org @@ -6729,11 +6985,13 @@ zz1200.com niderschlagsradar.de 2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com 69.162.80.56 + smartlink.name # Random Discord servers 162.241.124.200 + adsstar.in clickcafe.in earnme.club @@ -6749,6 +7007,7 @@ tnvalue.in usanewstoday.club webhostingtips.club 157.90.71.190 + abazelfan.com abburmyer.com abyamaskor.com @@ -6986,6 +7245,7 @@ zagtertda.com zoawufoy.net 139.45.197.239 + adblock-chrome.net aaolh.icu aboqs.icu @@ -7182,8 +7442,11 @@ yugiidv.xyz zaolutd.icu zigaahm.icu 44.228.230.225 + 50.112.124.170 + 100.20.104.229 + # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread link.sv 4.fo @@ -7194,11 +7457,16 @@ gsecurecontent.com pressizer.net sapino.net 44.236.213.34 + 52.24.156.12 + 52.25.6.134 + 100.20.13.49 + goldmesoil.live 51.68.87.229 + f9dle.skin kilpa2017.fi 2022crucialcatch.store @@ -8988,8 +9256,11 @@ unity-download.com unity-download.org 185.106.94.139 + 45.90.109.196 + 91.229.23.200 + attractbestbonuses.life attractbonus.life best-prize.life @@ -9049,11 +9320,14 @@ winxlbonus.life winbest.life winmacros.life 185.155.184.98 + 194.110.247.242 + ups-addressed.me ups-quote.me meta-whatsapp.me 54.219.218.169 + 0365alert.com 0365online.com 365-notifcation.com @@ -9484,6 +9758,7 @@ yourlivingequity.com yourticketchance.com yourorderupdate.com 64.132.201.92 + acessmygov.online centerlinkmygov.com centierssl.us @@ -9504,6 +9779,7 @@ verifyauth-mtbonline.us jatcraft.com elimef.link 209.141.51.49 + post-norway.web.app propellerclick.com abclefabletor.com @@ -10097,8 +10373,11 @@ wyglyvaso.com zogrepsili.com # Unsuited for wildcarding 208.88.225.116 + 208.88.225.117 + 208.88.225.119 + !+ NOT_OPTIMIZED achilles-par.com adrastos-eli.com @@ -10198,9 +10477,13 @@ wiela-kig.com wulfs-dcm.com 3.231.116.86 + 54.237.193.255 + 3.231.137.120 + 54.204.83.105 + jonathanbartz.com jp.imonitorsoft.com junk-bros.com @@ -10218,11 +10501,16 @@ center-main.com office-view.com i-likefood.co 108.61.242.65 + 146.70.78.43 + 87.120.254.39 + 45.150.108.213 + 92.204.160.240 + # Comments on Slack antivirussprotection.com boot-upextremelyquickinfo-product.info @@ -10376,6 +10664,7 @@ watchprecisehighlyinfo-product.info watchrenewedcompletelyinfo-product.info watchuberdevelopedinfo-product.info 34.200.46.148 + abstorick.com affienness.com ailippiess.co.in @@ -10433,6 +10722,7 @@ urnigarted.com wuruclas.co.in zondeucearixes.com 85.17.80.16 + sitey.me agazpeppily.live agraffesalps.com @@ -10568,10 +10858,15 @@ winwin-raffle.com your-finance-now.com your-survey-services.com 185.246.188.124 + 185.246.188.125 + 194.63.140.103 + 194.63.143.61 + 194.63.143.96 + moneystartup.live fintechbest.online @@ -10780,8 +11075,11 @@ yourlifestyle-blog.com zarta-news.com zorka-news.com 37.48.80.112 + 95.168.170.165 + 213.227.149.216 + # Slack comments cojcdn.net collecl.cc @@ -10808,7 +11106,9 @@ tapore.net totadblock.com updateasap.online 109.206.168.16 + 109.206.168.17 + cadstoppam.live cottodwin.live cumwaysroe.live @@ -10825,6 +11125,7 @@ showjoinnip.live usedhutsold.live 57.128.71.215 + truanet.com rumadel.com @@ -11557,15 +11858,25 @@ zybnzw.com zzebuh.com zzrgab.com 37.1.223.231 + 139.45.197.167 + 139.45.197.245 + 159.223.137.164 + 185.56.234.205 + 192.243.58.97 + 192.243.58.98 + 192.243.58.123 + 192.243.58.124 + 192.243.58.125 + [2a02:b48:207:1::2] [2a02:b48:207:1::3] [2a02:b48:207:1::6] @@ -11944,9 +12255,12 @@ vitalwealth.net wellnessfortune.net ztomy.com 5.45.123.44 + 69.16.230.226 + 208.91.196.46 + abashfireworks.com abashinstructor.com abateall.com @@ -16521,6 +16835,7 @@ wmptengate.com 93.93.51.223 + github.sale 0nedr1ved0cumentonline.com 88godetailsvc.com @@ -16768,6 +17083,7 @@ upste.us upstr.us 103.174.102.240 + libretube.app libretube.net khw6g09fx28k.cfd @@ -16913,6 +17229,7 @@ yttersiden.no 38.180.96.244 + acareewityjh.com accedenonre.xyz adeditiontowritingef.net @@ -17249,9 +17566,11 @@ ysearchingfo.xyz yticaframeofm.com yvaluationiamcur.com 34.195.224.242 + 54.225.185.110 + sweedbank-help.com swedbank-account.com levering-ekspedition.network @@ -17259,6 +17578,7 @@ regularisierung-konto.com dhlexpress-lieferung.net pochta-ru.com 91.202.233.143 + # Based on a tip from my secretary 0842-3231-4323-4243-2344-1333-0595-3453-6439-7-3235-03928-2348.name 1-3evlhls3yf.shop @@ -17624,16 +17944,27 @@ trafficredirectchain.com + 172.240.108.68 + 172.240.108.76 + 172.240.108.84 + 172.240.127.234 + 172.240.253.132 + 192.243.59.12 + 192.243.59.13 + 192.243.59.20 + 192.243.61.225 + 192.243.61.227 + 0sntp7dnrr.com 0x01n2ptpuz3.com 2e8dgn8n0e0l.com @@ -20611,6 +20942,7 @@ youtrustedprolong.com yydtbpms8tf4.com zipinaccurateoffering.com 167.71.252.38 + 100carbures.com 123ecos.com 1win-k.com @@ -21720,9 +22052,13 @@ zircuil.pro zoomdirectory.net zymstr.com 185.149.120.161 + 185.149.120.163 + 185.149.120.173 + 185.149.120.175 + 2rlive.com afro-melanin.com alatterapistroke.com @@ -21885,6 +22221,7 @@ yourivyonly.com zglobalindia.com zircontahafuz.com 185.149.120.173 + 02helpinfo.com 02rebill-pending.com 0niinebankingrbcroyabank.com @@ -22373,26 +22710,45 @@ wisehelpcentre.com yourtollbymailnyfile.com youweb-bpm.com 45.202.32.3 + 45.8.92.138 + 79.133.46.252 + 82.147.85.156 + 91.212.166.16 + 94.156.64.129 + 94.232.249.61 + 94.232.249.69 + 94.232.249.75 + 94.232.249.235 + 176.111.174.118 + 176.113.115.191 + 191.96.224.140 + 193.124.185.42 + 193.143.1.45 + 193.143.1.214 + 193.143.1.217 + 208.91.189.203 + + # ——— Standard malware that I stumbled upon on my own ——— downloadprovider.me cash93.com @@ -24019,11 +24375,14 @@ zqvee2re50mr.com zypy2h6rgfux.com zzdb5p4upiug.com 192.243.59.12 + 192.243.59.13 + 192.243.59.20 + # rule34hentai.net when uBlock Filters and AdGuard Base are turned off eivbjsegbino.com jpjmpqaupc.com @@ -24049,8 +24408,11 @@ s-arts.pro skinosoda.online 194.226.139.121 + 194.226.139.7 + 95.181.157.36 + 95.181.172.204 @@ -24073,6 +24435,7 @@ skinosoda.online + dispositionadverb.com @@ -24661,6 +25024,7 @@ sidenoteconcern.com abnegationbanquet.com 192.243.61.225 + acrx.online acrx.org acrx.press @@ -24715,6 +25079,7 @@ medicinecoupons.space medicinecoupons.xyz medicinehelp.news 147.135.16.27 + ingeniovirtual.com # Spambot posts on Tumblr (19/09/2022) scambiofigu.net @@ -24726,6 +25091,7 @@ scambiofigu.net 1pwk1j.cyou 986.group 185.87.148.199 + # Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) @@ -24740,6 +25106,7 @@ zh1653.com 45.136.49.35 + # Browsing around for Tajik newssites arhernot.live lifelongkick.live @@ -24792,10 +25159,15 @@ fillrumrip.live cityratetod.live onlymetsure.live 51.91.211.94 + 162.19.71.16 + 146.59.240.191 + 54.37.5.34 + 54.36.118.105 + highlandnews.com genuinescansupport.com diverseflowlink.com @@ -24822,6 +25194,7 @@ multilpleflow.com networkprincple.com pcnetworkdefense.com 159.89.10.102 + # Other foxsportnetwork.com pksauniversity.com @@ -24845,6 +25218,7 @@ neracti.com nuouther.com carpiesi.com 104.206.252.90 + jNKmS0zFuEh.click pjljo54uk.click v1asy4ncr.click @@ -24864,22 +25238,35 @@ yuppdownload.com 34.80.59.191 + megabooru.com zombooru.com kusubooru.com wh40kart.im 45.33.2.79 + 45.33.18.44 + 45.33.20.235 + 45.33.23.183 + 45.33.30.197 + 45.56.79.23 + 45.79.19.196 + 72.14.178.174 + 72.14.185.43 + 96.126.123.244 + 173.255.194.134 + 198.58.118.167 + 123chance.net 123links4u.net 123prizes.net @@ -25257,11 +25644,17 @@ youwanthis.com zebramode.com zebraoffers.net 34.117.199.78 + 94.237.103.119 + 94.237.84.54 + 94.237.93.242 + 94.237.99.118 + 139.45.197.249 + acorusinfield.life acridlydebit.live aeneasclosure.website @@ -25652,12 +26045,19 @@ gymsharkbutikksoslo.com josefseibeloutletnorge.com 196.196.153.151 + 158.222.7.116 + 196.245.152.139 + 165.231.251.197 + 196.242.16.29 + 165.231.4.90 + 158.222.7.83 + # Spam on W.I.T.C.H. and Winx text search results # A scam SMS I got 95-214-26-78.plesk.page @@ -25720,6 +26120,7 @@ your-track-ups.net your-ups-track.com zoll-pakete-support.com 95.214.26.78 + # Overly dedicated E-mail spammers wirexapp.africa.com tachyoniums.eu.com @@ -25728,7 +26129,9 @@ shua999.com ybd001.com deltacorriher.best 104.21.82.132 + 172.67.158.57 + [2606:4700:3030::6815:5284] [2606:4700:3037::ac43:9e39] # Google results for «SodaStream site:no cranberry» @@ -25742,6 +26145,7 @@ cosercosplay.com + asptryfa.info awpasslong.info butheadstar.info @@ -25754,11 +26158,14 @@ seedlogoonce.info sirdayscare.info slownansuch.info 185.155.184.57 + 185.155.186.24 + usayn.fr style-js.com 209.74.107.131 + qidjrsgroup.shop @@ -25769,7 +26176,7 @@ estudioespositoymiguel.com.ar juerfe.buzz -= + yasaracarfenlisesi.com abadfaheff4.com afflat3a2.com @@ -25831,7 +26238,9 @@ wsdcq7wayud.com xgptw11vogsh.com zeirj14ikqwf.com 69.172.200.185 + 77.220.214.153 + # More search terms than what can be counted with a supercomputer (11/03/2024) # Scam E-mails I've got @@ -25963,6 +26372,7 @@ trmff.wpengine.com + # Yet more Google searches diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 620e18e3e..862f0c14e 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -2,7 +2,6 @@ # Expires: 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. !#if !env_mv3 -# (N # ——— Bad top-level domains ——— # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. @@ -48,6 +47,7 @@ 127.0.0.1 adblock.gjtech.net 127.0.0.1 spam404bl.com 127.0.0.1 109.201.135.46 + 127.0.0.1 fredfiber.no 127.0.0.1 securemecca.com 127.0.0.1 1hos.cf @@ -89,6 +89,7 @@ # Fraudulent browser extensions 127.0.0.1 ublock.org www.ublock.org demo.ublock.org 127.0.0.1 138.68.252.54 + 127.0.0.1 useragentswitch.com 127.0.0.1 dev-nano.com 127.0.0.1 adblocker-app.info @@ -221,19 +222,27 @@ # ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— 127.0.0.1 ubuntu.org 127.0.0.1 103.224.212.249 + 127.0.0.1 speedtest.com 127.0.0.1 snapchat.cm 127.0.0.1 facebook.cm 127.0.0.1 wix.cm 127.0.0.1 199.59.243.222 + 127.0.0.1 14d.us 127.0.0.1 173.208.96.42 + 127.0.0.1 173.208.96.43 + 127.0.0.1 173.208.96.44 + 127.0.0.1 173.208.96.45 + 127.0.0.1 173.208.96.46 + 127.0.0.1 213.227.149.208 + 127.0.0.1 213.227.149.211 @@ -241,6 +250,7 @@ + 127.0.0.1 discordapp.cam 127.0.0.1 discordap.com @@ -309,6 +319,7 @@ 127.0.0.1 netnet44.net 127.0.0.1 tncrun.net www.tncrun.net amanda.tncrun.net sarah.tncrun.net pamela.tncrun.net jessica.tncrun.net ics.tncrun.net katie.tncrun.net pbu.tncrun.net emily.tncrun.net 127.0.0.1 54.174.156.141 + 127.0.0.1 lucretius-ada.com 127.0.0.1 hippolyte-hag.com 127.0.0.1 india-abc.com @@ -322,21 +333,32 @@ 127.0.0.1 madagty.com 127.0.0.1 zeroredirect5.com 127.0.0.1 54.209.22.226 + 127.0.0.1 54.91.125.197 + 127.0.0.1 52.202.53.245 + 127.0.0.1 35.175.38.64 + 127.0.0.1 35.168.147.213 + 127.0.0.1 34.230.160.215 + 127.0.0.1 3.226.8.132 + 127.0.0.1 3.216.243.46 + 127.0.0.1 roamingclicks.com # Source: desidert•no 127.0.0.1 collectfasttracks.com # Source: vn-zoom•com 127.0.0.1 ttnrd.com www.ttnrd.com amanda.ttnrd.com katie.ttnrd.com briana.ttnrd.com sarah.ttnrd.com pamela.ttnrd.com 127.0.0.1 54.152.245.247 + 127.0.0.1 35.172.40.232 + 127.0.0.1 3.90.125.85 + # Various ex-affiliate links at www•zombooru•com 127.0.0.1 track.vcdc.com 127.0.0.1 track.tkbo.com @@ -347,13 +369,18 @@ 127.0.0.1 satcom1.co.uk 127.0.0.1 splitter.microxml.net 127.0.0.1 94.130.185.237 + 127.0.0.1 94.130.186.231 + 127.0.0.1 144.76.0.242 + 127.0.0.1 144.76.1.130 + 127.0.0.1 195.201.92.254 + 127.0.0.1 forgoprokick.icu 127.0.0.1 inbluson.com @@ -370,10 +397,14 @@ 127.0.0.1 newpage.in 127.0.0.1 34.204.214.165 + 127.0.0.1 54.85.113.62 + 127.0.0.1 54.205.83.61 + 127.0.0.1 54.210.193.115 + 127.0.0.1 ailkeyair.com 127.0.0.1 amulagaudish.cam 127.0.0.1 aperushmo.cam @@ -425,30 +456,48 @@ 127.0.0.1 wonfigfig.com 127.0.0.1 adblockerapp.com 127.0.0.1 172.255.6.107 + 127.0.0.1 172.255.6.147 + 127.0.0.1 172.255.6.219 + 127.0.0.1 172.255.6.225 + 127.0.0.1 188.42.129.108 + 127.0.0.1 188.42.129.116 + 127.0.0.1 188.42.141.100 + 127.0.0.1 188.42.141.92 + 127.0.0.1 23.109.82.144 + 127.0.0.1 23.109.82.41 + 127.0.0.1 23.109.82.43 + 127.0.0.1 23.109.82.65 + 127.0.0.1 23.109.82.66 + 127.0.0.1 23.109.87.169 + 127.0.0.1 23.109.87.207 + 127.0.0.1 23.109.87.208 + 127.0.0.1 entwithou.xyz 127.0.0.1 chedstimaarr.pics 127.0.0.1 blueoyster.click 127.0.0.1 qocvicklgcgr.com 127.0.0.1 zeikvvbobop.com 127.0.0.1 216.21.13.14 + 127.0.0.1 216.21.13.15 + 127.0.0.1 abaphosis.guru 127.0.0.1 abietichob.live 127.0.0.1 abyssusuntouch.guru @@ -3533,6 +3582,7 @@ 127.0.0.1 zmusic-online.com 127.0.0.1 zredir.com 127.0.0.1 178.128.142.109 + 127.0.0.1 findmedia.biz 127.0.0.1 backtonews.biz 127.0.0.1 bagclick.biz @@ -3553,6 +3603,7 @@ 127.0.0.1 134.209.136.174 + 127.0.0.1 whiteclick.biz 127.0.0.1 dreamnews.biz 127.0.0.1 gonews2.com @@ -3566,9 +3617,13 @@ 127.0.0.1 texterra.me 127.0.0.1 worldtxt.club 127.0.0.1 62.210.6.153 + 127.0.0.1 62.210.7.209 + 127.0.0.1 62.210.9.92 + 127.0.0.1 62.210.11.203 + 127.0.0.1 ilo134ulih.com 127.0.0.1 hooligapps.com 127.0.0.1 theonlygames.com @@ -3583,6 +3638,7 @@ 127.0.0.1 stay-notified.com 127.0.0.1 stay-notified.xyz 127.0.0.1 167.99.249.47 + 127.0.0.1 moderncomputer.net 127.0.0.1 version.gratis 127.0.0.1 starpowders.github.io @@ -3608,19 +3664,30 @@ 127.0.0.1 rebiraert.com 127.0.0.1 iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com 127.0.0.1 5.8.34.26 + 127.0.0.1 5.8.47.3 + 127.0.0.1 103.224.182.251 + 127.0.0.1 holescontracting.com 127.0.0.1 doggroomingnews.com 127.0.0.1 5.79.71.205 + 127.0.0.1 5.79.71.225 + 127.0.0.1 85.17.31.82 + 127.0.0.1 85.17.31.122 + 127.0.0.1 178.162.203.202 + 127.0.0.1 178.162.203.211 + 127.0.0.1 178.162.203.226 + 127.0.0.1 178.162.217.107 + 127.0.0.1 logicalrecord.com 127.0.0.1 secureportal.online 127.0.0.1 accbaus.com @@ -3631,9 +3698,13 @@ 127.0.0.1 securebankapp.online 127.0.0.1 securemailbox.online 127.0.0.1 66.85.156.85 + 127.0.0.1 66.85.156.86 + 127.0.0.1 108.170.31.123 + 127.0.0.1 108.170.52.156 + 127.0.0.1 mysecrethoookup.com 127.0.0.1 toksearches.xyz 127.0.0.1 smashapps.net @@ -3737,8 +3808,11 @@ 127.0.0.1 watch-this.live 127.0.0.1 weather-forecast.today 127.0.0.1 95.168.170.165 + 127.0.0.1 213.227.145.147 + 127.0.0.1 213.227.149.216 + 127.0.0.1 wow-robotics.xyz 127.0.0.1 deepe.icu 127.0.0.1 google-analytics.buzz @@ -3752,6 +3826,7 @@ 127.0.0.1 fblaster.com 127.0.0.1 ribinski.us 127.0.0.1 5.188.62.36 + 127.0.0.1 speedupmypcfree.com 127.0.0.1 flomongteren.com 127.0.0.1 gedinetuwus.com @@ -3785,6 +3860,7 @@ 127.0.0.1 ssielearning.com 127.0.0.1 paymetconfirm.com 127.0.0.1 69.49.231.244 + 127.0.0.1 vid.me 127.0.0.1 5starhdporn.com 127.0.0.1 helooworld.us @@ -3803,6 +3879,7 @@ 127.0.0.1 blackpass.info 127.0.0.1 yzsnw.com 127.0.0.1 37.34.176.37 + 127.0.0.1 atvcampingtrips.com 127.0.0.1 thegymmum.com 127.0.0.1 pcspeedcat.com @@ -3818,12 +3895,18 @@ 127.0.0.1 temp74.com 127.0.0.1 trackwebclick.com 127.0.0.1 23.111.31.137 + 127.0.0.1 23.111.88.207 + 127.0.0.1 onesafesoftware.com 127.0.0.1 185.158.250.239 + 127.0.0.1 192.169.69.25 + 127.0.0.1 212.192.241.72 + 127.0.0.1 37.0.10.83 + 127.0.0.1 newstepsco.com 127.0.0.1 lucdream.com 127.0.0.1 beastbuying.com @@ -3845,6 +3928,7 @@ 127.0.0.1 beta-news.org 127.0.0.1 dashwoodestates.com 127.0.0.1 192.3.110.170 + 127.0.0.1 socialsearchconverter.com 127.0.0.1 install.socialsearchconverter.com 127.0.0.1 feed.socialsearchconverter.com @@ -3874,31 +3958,49 @@ 127.0.0.1 totaladblocker.xyz 127.0.0.1 totalwebshield.xyz 127.0.0.1 91.241.19.38 + 127.0.0.1 telete.in 127.0.0.1 kiff.tech 127.0.0.1 45.90.58.90 + 127.0.0.1 95.85.89.98 + 127.0.0.1 tekhacks.net 127.0.0.1 139.28.37.49 + 127.0.0.1 35.194.188.37 + 127.0.0.1 hydro-ca.link 127.0.0.1 91.243.121.19 + 127.0.0.1 103.169.90.205 + 127.0.0.1 125.44.43.45 + 127.0.0.1 182.121.8.240 + 127.0.0.1 42.235.183.74 + 127.0.0.1 78.36.32.242 + 127.0.0.1 115.50.2.119 + 127.0.0.1 115.50.110.163 + 127.0.0.1 119.179.84.145 + 127.0.0.1 188.120.50.98 + 127.0.0.1 190.238.183.5 + 127.0.0.1 27.220.253.78 + 127.0.0.1 esetnode32-antiviru.ydns.eu 127.0.0.1 aieov.com # Relations to the original domain 127.0.0.1 192.3.194.242 + 127.0.0.1 w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu 127.0.0.1 hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu 127.0.0.1 avira-antivirus.ydns.eu @@ -3962,60 +4064,114 @@ 127.0.0.1 trolleydrop.info 127.0.0.1 cd.org 127.0.0.1 23.94.26.138 + 127.0.0.1 205.185.126.200 + 127.0.0.1 185.243.56.167 + 127.0.0.1 123.10.224.135 + 127.0.0.1 59.47.187.147 + 127.0.0.1 39.68.172.210 + 127.0.0.1 122.192.177.176 + 127.0.0.1 112.27.124.108 + 127.0.0.1 123.110.176.246 + 127.0.0.1 219.155.105.98 + 127.0.0.1 171.35.161.209 + 127.0.0.1 60.16.255.36 + 127.0.0.1 112.30.4.52 + 127.0.0.1 182.121.191.201 + 127.0.0.1 121.61.48.170 + 127.0.0.1 39.81.68.45 + 127.0.0.1 27.222.220.164 + 127.0.0.1 113.233.215.135 + 127.0.0.1 151.77.100.133 + 127.0.0.1 125.120.13.184 + 127.0.0.1 120.12.138.133 + 127.0.0.1 27.194.115.185 + 127.0.0.1 104.128.199.228 + 127.0.0.1 183.92.123.145 + 127.0.0.1 110.89.8.126 + 127.0.0.1 125.43.211.184 + 127.0.0.1 1.0.218.230 + 127.0.0.1 221.208.4.56 + 127.0.0.1 60.13.60.19 + 127.0.0.1 171.37.29.87 + 127.0.0.1 124.91.237.188 + 127.0.0.1 115.56.137.49 + 127.0.0.1 115.52.240.69 + 127.0.0.1 112.252.132.185 + 127.0.0.1 117.198.240.157 + 127.0.0.1 42.53.240.249 + 127.0.0.1 116.179.138.68 + 127.0.0.1 110.241.119.159 + 127.0.0.1 115.56.31.133 + 127.0.0.1 103.19.128.222 + 127.0.0.1 202.12.80.74 + 127.0.0.1 61.52.8.62 + 127.0.0.1 182.122.252.69 + 127.0.0.1 219.155.26.50 + 127.0.0.1 120.4.141.185 + 127.0.0.1 119.102.7.115 + 127.0.0.1 72.51.127.213 + 127.0.0.1 111.224.199.91 + 127.0.0.1 119.250.236.122 + 127.0.0.1 112.30.110.58 + 127.0.0.1 pcae.de 127.0.0.1 117.196.49.21 + 127.0.0.1 115.55.54.234 + 127.0.0.1 115.52.17.123 + 127.0.0.1 182.59.69.21 + 127.0.0.1 chip-secured-download.de # Domains which resolve to this (already blocked) IP - for users of HOSTs/Domains/uBlock Origin 127.0.0.1 nctylivpwhpby.com @@ -4032,6 +4188,7 @@ 127.0.0.1 realdefen.se # Vermilion Strike 127.0.0.1 160.202.163.100 + 127.0.0.1 microsoftkernel.com 127.0.0.1 microsofthk.com @@ -4039,8 +4196,11 @@ 127.0.0.1 pushbizapi.com 127.0.0.1 45.95.169.115 + 127.0.0.1 45.148.120.80 + 127.0.0.1 85.239.33.9 + # Relations to the domain above 127.0.0.1 adminsys.serveftp.com 127.0.0.1 amazbaidu.serveftp.com @@ -4057,13 +4217,16 @@ 127.0.0.1 1log-wellsfargo.serveftp.com 127.0.0.1 eposcardokubo.serveftp.com 127.0.0.1 107.173.176.183 + 127.0.0.1 45.148.120.171 + 127.0.0.1 free-softs.net 127.0.0.1 cloud-apps.store 127.0.0.1 159.148.186.228 + 127.0.0.1 yotube.com 127.0.0.1 r-tb.com 127.0.0.1 cdn.hoood.info @@ -4077,7 +4240,7 @@ 127.0.0.1 kokotrokot.com -!!!? + 127.0.0.1 mugrikees.com 127.0.0.1 alpha-news.org @@ -4086,43 +4249,77 @@ 127.0.0.1 youvetube.com 127.0.0.1 youutube.com 127.0.0.1 39.83.80.247 + 127.0.0.1 68.197.33.124 + 127.0.0.1 219.157.21.37 + 127.0.0.1 182.123.141.17 + 127.0.0.1 125.47.243.187 + 127.0.0.1 182.122.196.203 + 127.0.0.1 182.117.231.182 + 127.0.0.1 112.31.211.135 + 127.0.0.1 125.106.63.93 + 127.0.0.1 115.59.197.46 + 127.0.0.1 122.159.29.192 + 127.0.0.1 171.40.0.127 + 127.0.0.1 171.80.219.160 + 127.0.0.1 123.10.65.201 + 127.0.0.1 168.90.205.46 + 127.0.0.1 125.47.205.109 + 127.0.0.1 39.80.147.239 + 127.0.0.1 45.224.171.130 + 127.0.0.1 45.5.209.75 + 127.0.0.1 116.17.210.157 + 127.0.0.1 27.45.103.240 + 127.0.0.1 110.167.64.171 + 127.0.0.1 39.81.117.73 + 127.0.0.1 183.15.90.156 + 127.0.0.1 119.113.248.74 + 127.0.0.1 175.0.95.85 + 127.0.0.1 61.52.99.109 + 127.0.0.1 222.142.183.194 + 127.0.0.1 106.86.172.194 + 127.0.0.1 103.233.216.77 + 127.0.0.1 183.188.192.55 + 127.0.0.1 198.23.255.14 + 127.0.0.1 freedownloadfiles.org 127.0.0.1 querahinor.xyz 127.0.0.1 trumops.com 127.0.0.1 runmodes.com 127.0.0.1 91.121.67.60 + 127.0.0.1 172.67.186.189 + 127.0.0.1 inconclusive-pyrite-grandparent.glitch.me 127.0.0.1 delicate-tame-angora.glitch.me 127.0.0.1 secureinvoice.glitch.me @@ -4135,9 +4332,13 @@ 127.0.0.1 tough-numerous-lemur.glitch.me 127.0.0.1 securefirst.us-east-1.linodeobjects.com 127.0.0.1 39.65.72.211 + 127.0.0.1 42.238.151.197 + 127.0.0.1 27.213.60.53 + 127.0.0.1 115.56.169.134 + 127.0.0.1 yasir252.com 127.0.0.1 safelink.kadal.club 127.0.0.1 bedrapiona.com @@ -4153,7 +4354,9 @@ 127.0.0.1 yourladiefun.life 127.0.0.1 newrrb.bid 127.0.0.1 194.87.138.20 + 127.0.0.1 103.167.92.73 + 127.0.0.1 bursakulis.com 127.0.0.1 610418.selcdn.ru 127.0.0.1 alexstewartinternationalltd.rw @@ -4170,13 +4373,21 @@ 127.0.0.1 yunosurveys.com 127.0.0.1 shadyclient.net 127.0.0.1 58.249.74.79 + 127.0.0.1 27.45.14.109 + 127.0.0.1 27.40.101.191 + 127.0.0.1 27.45.119.22 + 127.0.0.1 27.47.73.159 + 127.0.0.1 115.204.119.237 + 127.0.0.1 163.125.31.46 + 127.0.0.1 163.179.168.44 + 127.0.0.1 money-mod.com 127.0.0.1 reykijnoac.com 127.0.0.1 totalnicefeed.com @@ -4186,17 +4397,28 @@ 127.0.0.1 110.89.59.135 + 127.0.0.1 113.116.89.1 + 127.0.0.1 119.183.146.191 + 127.0.0.1 153.3.3.226 + 127.0.0.1 182.116.104.6 + 127.0.0.1 60.7.133.200 + 127.0.0.1 122.6.254.201 + 127.0.0.1 110.89.11.167 + 127.0.0.1 171.112.177.90 + 127.0.0.1 115.194.38.143 + 127.0.0.1 61.52.79.32 + 127.0.0.1 lowseelan.com @@ -4212,6 +4434,7 @@ 127.0.0.1 dundeehills.group !+ NOT_OPTIMIZED 127.0.0.1 132.148.220.142 + 127.0.0.1 chess-progress.ru 127.0.0.1 ouhastay.net 127.0.0.1 askara.super.site @@ -4223,21 +4446,32 @@ 127.0.0.1 p-stn.net 127.0.0.1 haxpc.net 127.0.0.1 52.53.243.52 + 127.0.0.1 34.201.22.10 + 127.0.0.1 123.10.225.196 + 127.0.0.1 122.192.106.84 + 127.0.0.1 172.88.199.9 + 127.0.0.1 114.38.176.185 + 127.0.0.1 61.52.97.35 + 127.0.0.1 27.206.181.208 + 127.0.0.1 124.163.130.175 + 127.0.0.1 118.75.87.102 + 127.0.0.1 onemacusa.net 127.0.0.1 systemupdatecontrol.com 127.0.0.1 mozicrack.com 127.0.0.1 download-srvr.xyz 127.0.0.1 134.122.115.190 + 127.0.0.1 cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com 127.0.0.1 viewty.xyz 127.0.0.1 landing.marketstm.com @@ -4257,6 +4491,7 @@ 127.0.0.1 wellhello.com 127.0.0.1 ru.com 127.0.0.1 141.8.226.34 + 127.0.0.1 ston-app.com # fake human verification scam # start form - reported for abuse @@ -4270,6 +4505,7 @@ 127.0.0.1 crashfixes.com 127.0.0.1 splendid-fallacious-anaconda.glitch.me 127.0.0.1 91.240.118.172 + # "Press Allow to continue" 127.0.0.1 kuyhaa-mee.com 127.0.0.1 waystriling.com @@ -4309,6 +4545,7 @@ 127.0.0.1 freeversioncrack.com 127.0.0.1 top3hostngc.xyz 127.0.0.1 198.199.120.251 + !+ NOT_OPTIMIZED # A Discord conversation I had about Throneful @@ -4331,7 +4568,9 @@ 127.0.0.1 partners-club.life 127.0.0.1 cumpussyy.uno 127.0.0.1 195.201.253.130 + 127.0.0.1 195.201.253.131 + 127.0.0.1 installiq.com 127.0.0.1 specgoal.com 127.0.0.1 sandhyapi.online @@ -4350,12 +4589,17 @@ 127.0.0.1 rtbvrdirect.com 127.0.0.1 cpmverdirect.com 127.0.0.1 15.197.244.48 + 127.0.0.1 96.47.230.67 + 127.0.0.1 96.47.230.68 + 127.0.0.1 96.47.230.69 + 127.0.0.1 96.47.230.70 + 127.0.0.1 telemetry-urs-microsoft.com 127.0.0.1 winrar-desktop.com @@ -4391,6 +4635,7 @@ 127.0.0.1 viiyhn.com 127.0.0.1 31.220.27.134 + 127.0.0.1 saferedirects.xyz 127.0.0.1 online-guard.com @@ -4685,7 +4930,9 @@ !#endif 127.0.0.1 85.17.31.152 + 127.0.0.1 95.211.26.202 + 127.0.0.1 bzsx.link 127.0.0.1 dfvd.link 127.0.0.1 dsvs.link @@ -4699,7 +4946,9 @@ 127.0.0.1 ujtj.link 127.0.0.1 wznp.link 127.0.0.1 158.247.212.220 + 127.0.0.1 165.227.168.212 + !#if !ext_ublock !#endif @@ -4744,6 +4993,7 @@ 127.0.0.1 broburchrove.com 127.0.0.1 galantinkoling.com 127.0.0.1 23.81.64.183 + 127.0.0.1 zikroarg.com 127.0.0.1 dooloust.net 127.0.0.1 vooshagy.net @@ -4913,6 +5163,7 @@ 127.0.0.1 vooculok.com 127.0.0.1 mobytrks.com 127.0.0.1 139.45.197.236 + 127.0.0.1 becovi.com 127.0.0.1 becovi.co.uk 127.0.0.1 shopfirststop.com @@ -4940,16 +5191,21 @@ 127.0.0.1 frescopartito.com 127.0.0.1 motherpipe.net 127.0.0.1 51.91.66.125 + 127.0.0.1 51.178.76.105 + 127.0.0.1 147.135.253.55 + 127.0.0.1 bnbdeal.net !+ NOT_OPTIMIZED !+ NOT_OPTIMIZED 127.0.0.1 146.19.169.98 + 127.0.0.1 146.19.169.99 + 127.0.0.1 1000girl.com 127.0.0.1 1000islandsinfo.com 127.0.0.1 100blackmenkc.org @@ -6720,11 +6976,13 @@ 127.0.0.1 niderschlagsradar.de 127.0.0.1 2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com 127.0.0.1 69.162.80.56 + 127.0.0.1 smartlink.name # Random Discord servers 127.0.0.1 162.241.124.200 + 127.0.0.1 adsstar.in 127.0.0.1 clickcafe.in 127.0.0.1 earnme.club @@ -6740,6 +6998,7 @@ 127.0.0.1 usanewstoday.club 127.0.0.1 webhostingtips.club 127.0.0.1 157.90.71.190 + 127.0.0.1 abazelfan.com 127.0.0.1 abburmyer.com 127.0.0.1 abyamaskor.com @@ -6977,6 +7236,7 @@ 127.0.0.1 zoawufoy.net 127.0.0.1 139.45.197.239 + 127.0.0.1 adblock-chrome.net 127.0.0.1 aaolh.icu 127.0.0.1 aboqs.icu @@ -7173,8 +7433,11 @@ 127.0.0.1 zaolutd.icu 127.0.0.1 zigaahm.icu 127.0.0.1 44.228.230.225 + 127.0.0.1 50.112.124.170 + 127.0.0.1 100.20.104.229 + # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread 127.0.0.1 link.sv 127.0.0.1 4.fo @@ -7185,11 +7448,16 @@ 127.0.0.1 pressizer.net 127.0.0.1 sapino.net 127.0.0.1 44.236.213.34 + 127.0.0.1 52.24.156.12 + 127.0.0.1 52.25.6.134 + 127.0.0.1 100.20.13.49 + 127.0.0.1 goldmesoil.live 127.0.0.1 51.68.87.229 + 127.0.0.1 f9dle.skin 127.0.0.1 kilpa2017.fi 127.0.0.1 2022crucialcatch.store @@ -8979,8 +9247,11 @@ 127.0.0.1 unity-download.org 127.0.0.1 185.106.94.139 + 127.0.0.1 45.90.109.196 + 127.0.0.1 91.229.23.200 + 127.0.0.1 attractbestbonuses.life 127.0.0.1 attractbonus.life 127.0.0.1 best-prize.life @@ -9040,11 +9311,14 @@ 127.0.0.1 winbest.life 127.0.0.1 winmacros.life 127.0.0.1 185.155.184.98 + 127.0.0.1 194.110.247.242 + 127.0.0.1 ups-addressed.me 127.0.0.1 ups-quote.me 127.0.0.1 meta-whatsapp.me 127.0.0.1 54.219.218.169 + 127.0.0.1 0365alert.com 127.0.0.1 0365online.com 127.0.0.1 365-notifcation.com @@ -9475,6 +9749,7 @@ 127.0.0.1 yourticketchance.com 127.0.0.1 yourorderupdate.com 127.0.0.1 64.132.201.92 + 127.0.0.1 acessmygov.online 127.0.0.1 centerlinkmygov.com 127.0.0.1 centierssl.us @@ -9495,6 +9770,7 @@ 127.0.0.1 jatcraft.com 127.0.0.1 elimef.link 127.0.0.1 209.141.51.49 + 127.0.0.1 post-norway.web.app 127.0.0.1 propellerclick.com 127.0.0.1 abclefabletor.com @@ -10088,8 +10364,11 @@ 127.0.0.1 zogrepsili.com # Unsuited for wildcarding 127.0.0.1 208.88.225.116 + 127.0.0.1 208.88.225.117 + 127.0.0.1 208.88.225.119 + !+ NOT_OPTIMIZED 127.0.0.1 achilles-par.com 127.0.0.1 adrastos-eli.com @@ -10189,9 +10468,13 @@ 127.0.0.1 wulfs-dcm.com 127.0.0.1 3.231.116.86 + 127.0.0.1 54.237.193.255 + 127.0.0.1 3.231.137.120 + 127.0.0.1 54.204.83.105 + 127.0.0.1 jonathanbartz.com 127.0.0.1 jp.imonitorsoft.com 127.0.0.1 junk-bros.com @@ -10209,11 +10492,16 @@ 127.0.0.1 office-view.com 127.0.0.1 i-likefood.co 127.0.0.1 108.61.242.65 + 127.0.0.1 146.70.78.43 + 127.0.0.1 87.120.254.39 + 127.0.0.1 45.150.108.213 + 127.0.0.1 92.204.160.240 + # Comments on Slack 127.0.0.1 antivirussprotection.com 127.0.0.1 boot-upextremelyquickinfo-product.info @@ -10367,6 +10655,7 @@ 127.0.0.1 watchrenewedcompletelyinfo-product.info 127.0.0.1 watchuberdevelopedinfo-product.info 127.0.0.1 34.200.46.148 + 127.0.0.1 abstorick.com 127.0.0.1 affienness.com 127.0.0.1 ailippiess.co.in @@ -10424,6 +10713,7 @@ 127.0.0.1 wuruclas.co.in 127.0.0.1 zondeucearixes.com 127.0.0.1 85.17.80.16 + 127.0.0.1 sitey.me 127.0.0.1 agazpeppily.live 127.0.0.1 agraffesalps.com @@ -10559,10 +10849,15 @@ 127.0.0.1 your-finance-now.com 127.0.0.1 your-survey-services.com 127.0.0.1 185.246.188.124 + 127.0.0.1 185.246.188.125 + 127.0.0.1 194.63.140.103 + 127.0.0.1 194.63.143.61 + 127.0.0.1 194.63.143.96 + 127.0.0.1 moneystartup.live 127.0.0.1 fintechbest.online @@ -10771,8 +11066,11 @@ 127.0.0.1 zarta-news.com 127.0.0.1 zorka-news.com 127.0.0.1 37.48.80.112 + 127.0.0.1 95.168.170.165 + 127.0.0.1 213.227.149.216 + # Slack comments 127.0.0.1 cojcdn.net 127.0.0.1 collecl.cc @@ -10799,7 +11097,9 @@ 127.0.0.1 totadblock.com 127.0.0.1 updateasap.online 127.0.0.1 109.206.168.16 + 127.0.0.1 109.206.168.17 + 127.0.0.1 cadstoppam.live 127.0.0.1 cottodwin.live 127.0.0.1 cumwaysroe.live @@ -10816,6 +11116,7 @@ 127.0.0.1 usedhutsold.live 127.0.0.1 57.128.71.215 + 127.0.0.1 truanet.com 127.0.0.1 rumadel.com !#if !ext_ublock @@ -11548,20 +11849,30 @@ 127.0.0.1 zzebuh.com 127.0.0.1 zzrgab.com 127.0.0.1 37.1.223.231 + 127.0.0.1 139.45.197.167 + 127.0.0.1 139.45.197.245 + 127.0.0.1 159.223.137.164 + 127.0.0.1 185.56.234.205 + 127.0.0.1 192.243.58.97 + 127.0.0.1 192.243.58.98 + 127.0.0.1 192.243.58.123 + 127.0.0.1 192.243.58.124 + 127.0.0.1 192.243.58.125 + !#if !ext_ublock !#endif @@ -11935,9 +12246,12 @@ 127.0.0.1 wellnessfortune.net 127.0.0.1 ztomy.com 127.0.0.1 5.45.123.44 + 127.0.0.1 69.16.230.226 + 127.0.0.1 208.91.196.46 + 127.0.0.1 abashfireworks.com 127.0.0.1 abashinstructor.com 127.0.0.1 abateall.com @@ -16512,6 +16826,7 @@ 127.0.0.1 93.93.51.223 + 127.0.0.1 github.sale 127.0.0.1 0nedr1ved0cumentonline.com 127.0.0.1 88godetailsvc.com @@ -16759,6 +17074,7 @@ 127.0.0.1 upstr.us 127.0.0.1 103.174.102.240 + 127.0.0.1 libretube.app 127.0.0.1 libretube.net 127.0.0.1 khw6g09fx28k.cfd @@ -16904,6 +17220,7 @@ 127.0.0.1 38.180.96.244 + 127.0.0.1 acareewityjh.com 127.0.0.1 accedenonre.xyz 127.0.0.1 adeditiontowritingef.net @@ -17240,9 +17557,11 @@ 127.0.0.1 yticaframeofm.com 127.0.0.1 yvaluationiamcur.com 127.0.0.1 34.195.224.242 + 127.0.0.1 54.225.185.110 + 127.0.0.1 sweedbank-help.com 127.0.0.1 swedbank-account.com 127.0.0.1 levering-ekspedition.network @@ -17250,6 +17569,7 @@ 127.0.0.1 dhlexpress-lieferung.net 127.0.0.1 pochta-ru.com 127.0.0.1 91.202.233.143 + # Based on a tip from my secretary 127.0.0.1 0842-3231-4323-4243-2344-1333-0595-3453-6439-7-3235-03928-2348.name 127.0.0.1 1-3evlhls3yf.shop @@ -17615,16 +17935,27 @@ + 127.0.0.1 172.240.108.68 + 127.0.0.1 172.240.108.76 + 127.0.0.1 172.240.108.84 + 127.0.0.1 172.240.127.234 + 127.0.0.1 172.240.253.132 + 127.0.0.1 192.243.59.12 + 127.0.0.1 192.243.59.13 + 127.0.0.1 192.243.59.20 + 127.0.0.1 192.243.61.225 + 127.0.0.1 192.243.61.227 + 127.0.0.1 0sntp7dnrr.com 127.0.0.1 0x01n2ptpuz3.com 127.0.0.1 2e8dgn8n0e0l.com @@ -20602,6 +20933,7 @@ 127.0.0.1 yydtbpms8tf4.com 127.0.0.1 zipinaccurateoffering.com 127.0.0.1 167.71.252.38 + 127.0.0.1 100carbures.com 127.0.0.1 123ecos.com 127.0.0.1 1win-k.com @@ -21711,9 +22043,13 @@ 127.0.0.1 zoomdirectory.net 127.0.0.1 zymstr.com 127.0.0.1 185.149.120.161 + 127.0.0.1 185.149.120.163 + 127.0.0.1 185.149.120.173 + 127.0.0.1 185.149.120.175 + 127.0.0.1 2rlive.com 127.0.0.1 afro-melanin.com 127.0.0.1 alatterapistroke.com @@ -21876,6 +22212,7 @@ 127.0.0.1 zglobalindia.com 127.0.0.1 zircontahafuz.com 127.0.0.1 185.149.120.173 + 127.0.0.1 02helpinfo.com 127.0.0.1 02rebill-pending.com 127.0.0.1 0niinebankingrbcroyabank.com @@ -22364,26 +22701,45 @@ 127.0.0.1 yourtollbymailnyfile.com 127.0.0.1 youweb-bpm.com 127.0.0.1 45.202.32.3 + 127.0.0.1 45.8.92.138 + 127.0.0.1 79.133.46.252 + 127.0.0.1 82.147.85.156 + 127.0.0.1 91.212.166.16 + 127.0.0.1 94.156.64.129 + 127.0.0.1 94.232.249.61 + 127.0.0.1 94.232.249.69 + 127.0.0.1 94.232.249.75 + 127.0.0.1 94.232.249.235 + 127.0.0.1 176.111.174.118 + 127.0.0.1 176.113.115.191 + 127.0.0.1 191.96.224.140 + 127.0.0.1 193.124.185.42 + 127.0.0.1 193.143.1.45 + 127.0.0.1 193.143.1.214 + 127.0.0.1 193.143.1.217 + 127.0.0.1 208.91.189.203 + !#if !ext_ublock !#endif + # ——— Standard malware that I stumbled upon on my own ——— 127.0.0.1 downloadprovider.me 127.0.0.1 cash93.com @@ -24010,8 +24366,11 @@ 127.0.0.1 zypy2h6rgfux.com 127.0.0.1 zzdb5p4upiug.com 127.0.0.1 192.243.59.12 + 127.0.0.1 192.243.59.13 + 127.0.0.1 192.243.59.20 + !#if !ext_ublock !#endif @@ -24040,9 +24399,13 @@ 127.0.0.1 skinosoda.online 127.0.0.1 194.226.139.121 + 127.0.0.1 194.226.139.7 + 127.0.0.1 95.181.157.36 + 127.0.0.1 95.181.172.204 + !#if !ext_ublock @@ -24652,6 +25015,7 @@ 127.0.0.1 abnegationbanquet.com 127.0.0.1 192.243.61.225 + 127.0.0.1 acrx.online 127.0.0.1 acrx.org 127.0.0.1 acrx.press @@ -24706,6 +25070,7 @@ 127.0.0.1 medicinecoupons.xyz 127.0.0.1 medicinehelp.news 127.0.0.1 147.135.16.27 + 127.0.0.1 ingeniovirtual.com # Spambot posts on Tumblr (19/09/2022) 127.0.0.1 scambiofigu.net @@ -24717,6 +25082,7 @@ 127.0.0.1 1pwk1j.cyou 127.0.0.1 986.group 127.0.0.1 185.87.148.199 + # Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) @@ -24731,6 +25097,7 @@ 127.0.0.1 45.136.49.35 + # Browsing around for Tajik newssites 127.0.0.1 arhernot.live 127.0.0.1 lifelongkick.live @@ -24783,10 +25150,15 @@ 127.0.0.1 cityratetod.live 127.0.0.1 onlymetsure.live 127.0.0.1 51.91.211.94 + 127.0.0.1 162.19.71.16 + 127.0.0.1 146.59.240.191 + 127.0.0.1 54.37.5.34 + 127.0.0.1 54.36.118.105 + 127.0.0.1 highlandnews.com 127.0.0.1 genuinescansupport.com 127.0.0.1 diverseflowlink.com @@ -24813,6 +25185,7 @@ 127.0.0.1 networkprincple.com 127.0.0.1 pcnetworkdefense.com 127.0.0.1 159.89.10.102 + # Other 127.0.0.1 foxsportnetwork.com 127.0.0.1 pksauniversity.com @@ -24836,6 +25209,7 @@ 127.0.0.1 nuouther.com 127.0.0.1 carpiesi.com 127.0.0.1 104.206.252.90 + 127.0.0.1 jNKmS0zFuEh.click 127.0.0.1 pjljo54uk.click 127.0.0.1 v1asy4ncr.click @@ -24855,22 +25229,35 @@ 127.0.0.1 34.80.59.191 + 127.0.0.1 megabooru.com 127.0.0.1 zombooru.com 127.0.0.1 kusubooru.com 127.0.0.1 wh40kart.im 127.0.0.1 45.33.2.79 + 127.0.0.1 45.33.18.44 + 127.0.0.1 45.33.20.235 + 127.0.0.1 45.33.23.183 + 127.0.0.1 45.33.30.197 + 127.0.0.1 45.56.79.23 + 127.0.0.1 45.79.19.196 + 127.0.0.1 72.14.178.174 + 127.0.0.1 72.14.185.43 + 127.0.0.1 96.126.123.244 + 127.0.0.1 173.255.194.134 + 127.0.0.1 198.58.118.167 + 127.0.0.1 123chance.net 127.0.0.1 123links4u.net 127.0.0.1 123prizes.net @@ -25248,11 +25635,17 @@ 127.0.0.1 zebramode.com 127.0.0.1 zebraoffers.net 127.0.0.1 34.117.199.78 + 127.0.0.1 94.237.103.119 + 127.0.0.1 94.237.84.54 + 127.0.0.1 94.237.93.242 + 127.0.0.1 94.237.99.118 + 127.0.0.1 139.45.197.249 + 127.0.0.1 acorusinfield.life 127.0.0.1 acridlydebit.live 127.0.0.1 aeneasclosure.website @@ -25643,12 +26036,19 @@ 127.0.0.1 josefseibeloutletnorge.com 127.0.0.1 196.196.153.151 + 127.0.0.1 158.222.7.116 + 127.0.0.1 196.245.152.139 + 127.0.0.1 165.231.251.197 + 127.0.0.1 196.242.16.29 + 127.0.0.1 165.231.4.90 + 127.0.0.1 158.222.7.83 + # Spam on W.I.T.C.H. and Winx text search results # A scam SMS I got 127.0.0.1 95-214-26-78.plesk.page @@ -25711,6 +26111,7 @@ 127.0.0.1 your-ups-track.com 127.0.0.1 zoll-pakete-support.com 127.0.0.1 95.214.26.78 + # Overly dedicated E-mail spammers 127.0.0.1 wirexapp.africa.com 127.0.0.1 tachyoniums.eu.com @@ -25719,9 +26120,11 @@ 127.0.0.1 ybd001.com 127.0.0.1 deltacorriher.best 127.0.0.1 104.21.82.132 + 127.0.0.1 172.67.158.57 + # Google results for «SodaStream site:no cranberry» @@ -25733,6 +26136,7 @@ + 127.0.0.1 asptryfa.info 127.0.0.1 awpasslong.info 127.0.0.1 butheadstar.info @@ -25745,11 +26149,14 @@ 127.0.0.1 sirdayscare.info 127.0.0.1 slownansuch.info 127.0.0.1 185.155.184.57 + 127.0.0.1 185.155.186.24 + 127.0.0.1 usayn.fr 127.0.0.1 style-js.com 127.0.0.1 209.74.107.131 + 127.0.0.1 qidjrsgroup.shop @@ -25760,7 +26167,7 @@ 127.0.0.1 juerfe.buzz -= + 127.0.0.1 yasaracarfenlisesi.com 127.0.0.1 abadfaheff4.com 127.0.0.1 afflat3a2.com @@ -25822,7 +26229,9 @@ 127.0.0.1 xgptw11vogsh.com 127.0.0.1 zeirj14ikqwf.com 127.0.0.1 69.172.200.185 + 127.0.0.1 77.220.214.153 + # More search terms than what can be counted with a supercomputer (11/03/2024) # Scam E-mails I've got @@ -25942,6 +26351,7 @@ 127.0.0.1 trmff.wpengine.com 127.0.0.1 212.27.60.108 + !#if !adguard !#include uBO%20list%20extensions/AdGuardSafeBrowsing-ReverseEngineered.txt !#endif diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index e932acbc6..a9152d6c2 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,37 +1,36 @@ {+block} # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 21September2024v1-Deprecated +# Version: 30September2024v2-Deprecated # Expires: 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. -# (Note to self, only applicable to uBO: When 1.59.1 goes stable, implement "* {+block} # ——— Bad top-level domains ——— # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. # When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. # Tokelau (Put on break due to too many whitelistings being needed) -# + # Mali (Put on break due to too many and too frequent whitelistings being needed) -# + # Equatorial Guinea -# + # Central African Republic -# + # Palau (Put on break due to too many whitelistings being needed) -# + # Legitimate use is almost non-existent, but has a tiny userbase in Japan. Its extreme common-ness in malware redirections means that the entry will be kept forever. .top # International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. .loan -# -# + + .bid -# -# -# -# -# -# + + + + + + # Experimental attempt to cover a few hardcore spam ASNs .buzz/*/?*=*&*=*&*=*&*=*&*= .life/*/?*=*&*=*&*=*&*=*&*= @@ -41,10 +40,10 @@ {+block} # ——— You know those ultra-fraudulent auto-generated things that clutter up Google searches? These entries should remove some of them. ——— -# -# -# -# + + + + {+block} # ——— Old dead tech-related domains ——— @@ -52,6 +51,7 @@ .adblock.gjtech.net .spam404bl.com .109.201.135.46 + .fredfiber.no .securemecca.com .1hos.cf @@ -93,6 +93,7 @@ # Fraudulent browser extensions .ublock.org .138.68.252.54 + .useragentswitch.com .dev-nano.com .adblocker-app.info @@ -207,19 +208,28 @@ # ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— .ubuntu.org .103.224.212.249 + .speedtest.com .snapchat.cm .facebook.cm .wix.cm .199.59.243.222 + .14d.us .173.208.96.42 + .173.208.96.43 + .173.208.96.44 + .173.208.96.45 + .173.208.96.46 + .213.227.149.208 + .213.227.149.211 + .ddscordapp. .diicordapp. .disccrdapp. @@ -253,10 +263,10 @@ .free-discordnitro. .freediscordnitro. /(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ -# + /(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ /(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ -# + .discord*.gifts .discord-give. .discord-nitro-gift. @@ -301,6 +311,7 @@ .katie.*.net .emily.*.net .54.174.156.141 + .lucretius-ada.com .hippolyte-hag.com .india-abc.com @@ -314,13 +325,21 @@ .madagty.com .zeroredirect5.com .54.209.22.226 + .54.91.125.197 + .52.202.53.245 + .35.175.38.64 + .35.168.147.213 + .34.230.160.215 + .3.226.8.132 + .3.216.243.46 + .roamingclicks.com # Source: desidert•no .collectfasttracks.com @@ -332,8 +351,11 @@ .sarah.*.com .pamela.*.com .54.152.245.247 + .35.172.40.232 + .3.90.125.85 + # Various ex-affiliate links at www•zombooru•com .track.vcdc.com .track.tkbo.com @@ -344,10 +366,15 @@ .satcom1.co.uk .splitter.microxml.net .94.130.185.237 + .94.130.186.231 + .144.76.0.242 + .144.76.1.130 + .195.201.92.254 + .forgoprokick.icu ?bemobdata= .inbluson.com @@ -365,9 +392,13 @@ .newpage.in /mcaf04/*= .34.204.214.165 + .54.85.113.62 + .54.205.83.61 + .54.210.193.115 + .[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1] .ailkeyair.com .amulagaudish.cam @@ -420,28 +451,46 @@ .wonfigfig.com .adblockerapp.com .172.255.6.107 + .172.255.6.147 + .172.255.6.219 + .172.255.6.225 + .188.42.129.108 + .188.42.129.116 + .188.42.141.100 + .188.42.141.92 + .23.109.82.144 + .23.109.82.41 + .23.109.82.43 + .23.109.82.65 + .23.109.82.66 + .23.109.87.169 + .23.109.87.207 + .23.109.87.208 + .entwithou.xyz .chedstimaarr.pics .blueoyster.click .qocvicklgcgr.com .zeikvvbobop.com .216.21.13.14 + .216.21.13.15 + /.*\.(xyz|pics)/[a-zA-Z0-9]{130,} /.*\.(cloudfront\.net|xyz|pics)/[a-zA-Z0-9]{20,}/[a-zA-Z0-9]{25,}\+[a-zA-Z0-9+]{90,} .abaphosis.guru @@ -1128,9 +1177,9 @@ .videoadblockers. .videoadblockertou. .videoadblockextension. -# + /172\.255\.6\.(\d{1,2}|[12][0-689]\d|17[0-689]) -# + .abbotinexperienced.com .abedwithdrawalautograph.com .abnegateexcavator.com @@ -3504,8 +3553,8 @@ .zeroclampentice.com .zillionable.com .zonedummy.com -# -# + + .deviuser.com /scan-update-and-protect-your-browser.html .watch-video.net @@ -3518,6 +3567,7 @@ .zmusic-online.com .zredir.com .178.128.142.109 + .findmedia.biz .backtonews.biz .bagclick.biz @@ -3536,6 +3586,7 @@ .virnews.club .vviewpoint.biz .134.209.136.174 + .whiteclick.biz .dreamnews.biz .gonews2.com @@ -3549,9 +3600,13 @@ .texterra.me .worldtxt.club .62.210.6.153 + .62.210.7.209 + .62.210.9.92 + .62.210.11.203 + .ilo134ulih.com .hooligapps.com .best202*-games-web1.com @@ -3567,6 +3622,7 @@ .stay-notified.com .stay-notified.xyz .167.99.249.47 + .moderncomputer.net .version.gratis .starpowders.github.io @@ -3589,18 +3645,29 @@ .rebiraert.com .iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com .5.8.34.26 + .5.8.47.3 + .103.224.182.251 + .holescontracting.com .doggroomingnews.com .5.79.71.205 + .5.79.71.225 + .85.17.31.82 + .85.17.31.122 + .178.162.203.202 + .178.162.203.211 + .178.162.203.226 + .178.162.217.107 + .[2a02:1668:1034::2] .logicalrecord.com .secureportal.online @@ -3612,9 +3679,13 @@ .securebankapp.online .securemailbox.online .66.85.156.85 + .66.85.156.86 + .108.170.31.123 + .108.170.52.156 + .mysecrethoookup.com .toksearches.xyz .smashapps.net @@ -3718,8 +3789,11 @@ .watch-this.live .weather-forecast.today .95.168.170.165 + .213.227.145.147 + .213.227.149.216 + .wow-robotics.xyz .deepe.icu .google-analytics.buzz @@ -3733,6 +3807,7 @@ .fblaster.com .ribinski.us .5.188.62.36 + .speedupmypcfree.com .flomongteren.com .gedinetuwus.com @@ -3766,6 +3841,7 @@ .ssielearning.com .paymetconfirm.com .69.49.231.244 + .vid.me .5starhdporn.com .helooworld.us @@ -3784,6 +3860,7 @@ .blackpass.info .yzsnw.com .37.34.176.37 + .atvcampingtrips.com .thegymmum.com .pcspeedcat.com @@ -3799,12 +3876,18 @@ .temp74.com .trackwebclick.com .23.111.31.137 + .23.111.88.207 + .onesafesoftware.com .185.158.250.239 + .192.169.69.25 + .212.192.241.72 + .37.0.10.83 + .newstepsco.com .secure-0*.ddnss.ch .lucdream.com @@ -3828,6 +3911,7 @@ .beta-news.org .dashwoodestates.com .192.3.110.170 + .socialsearchconverter.com .install.socialsearchconverter.com .feed.socialsearchconverter.com @@ -3857,31 +3941,49 @@ .totaladblocker.xyz .totalwebshield.xyz .91.241.19.38 + .telete.in .kiff.tech .45.90.58.90 + .95.85.89.98 + .tekhacks.net .mediafire.com/file/pj9jdm7iznc4d51/tekhacksnet_multi_loader.rar .139.28.37.49 + .35.194.188.37 + .hydro-ca.link .91.243.121.19 + .103.169.90.205 + .125.44.43.45 + .182.121.8.240 + .42.235.183.74 + .78.36.32.242 + .115.50.2.119 + .115.50.110.163 + .119.179.84.145 + .188.120.50.98 + .190.238.183.5 + .27.220.253.78 + .esetnode32-antiviru.ydns.eu .aieov.com # Relations to the original domain .192.3.194.242 + .w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu .hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu .avira-antivirus.ydns.eu @@ -3912,7 +4014,7 @@ .findanswersnow.net .gpush.cogocast.net .info.leadid.com -# + .partner.mediawallahscript.com .signupandturnyourscreenoffsafepowernow.date .tag.cogocast.net @@ -3946,60 +4048,114 @@ .trolleydrop.info .cd.org .23.94.26.138 + .205.185.126.200 + .185.243.56.167 + .123.10.224.135 + .59.47.187.147 + .39.68.172.210 + .122.192.177.176 + .112.27.124.108 + .123.110.176.246 + .219.155.105.98 + .171.35.161.209 + .60.16.255.36 + .112.30.4.52 + .182.121.191.201 + .121.61.48.170 + .39.81.68.45 + .27.222.220.164 + .113.233.215.135 + .151.77.100.133 + .125.120.13.184 + .120.12.138.133 + .27.194.115.185 + .104.128.199.228 + .183.92.123.145 + .110.89.8.126 + .125.43.211.184 + .1.0.218.230 + .221.208.4.56 + .60.13.60.19 + .171.37.29.87 + .124.91.237.188 + .115.56.137.49 + .115.52.240.69 + .112.252.132.185 + .117.198.240.157 + .42.53.240.249 + .116.179.138.68 + .110.241.119.159 + .115.56.31.133 + .103.19.128.222 + .202.12.80.74 + .61.52.8.62 + .182.122.252.69 + .219.155.26.50 + .120.4.141.185 + .119.102.7.115 + .72.51.127.213 + .111.224.199.91 + .119.250.236.122 + .112.30.110.58 + .pcae.de .117.196.49.21 + .115.55.54.234 + .115.52.17.123 + .182.59.69.21 + .chip-secured-download.de # Domains which resolve to this (already blocked) IP - for users of HOSTs/Domains/uBlock Origin .nctylivpwhpby.com @@ -4017,6 +4173,7 @@ .realdefen.se # Vermilion Strike .160.202.163.100 + .microsoftkernel.com .microsofthk.com .lnk.to/GlXHtur0 @@ -4024,8 +4181,11 @@ .pushbizapi.com .45.95.169.115 + .45.148.120.80 + .85.239.33.9 + # Relations to the domain above .adminsys.serveftp.com .amazbaidu.serveftp.com @@ -4042,11 +4202,14 @@ .1log-wellsfargo.serveftp.com .eposcardokubo.serveftp.com .107.173.176.183 + .45.148.120.171 + .free-softs.net .google-yandex. .cloud-apps.store .159.148.186.228 + .yotube.com .r-tb.com .cdn.hoood.info @@ -4060,7 +4223,7 @@ /mcafeedirect.jsp /beep.mp3 .kokotrokot.com -# + ?uclickhash= .mugrikees.com .alpha-news.org @@ -4069,43 +4232,77 @@ .youvetube.com .youutube.com .39.83.80.247 + .68.197.33.124 + .219.157.21.37 + .182.123.141.17 + .125.47.243.187 + .182.122.196.203 + .182.117.231.182 + .112.31.211.135 + .125.106.63.93 + .115.59.197.46 + .122.159.29.192 + .171.40.0.127 + .171.80.219.160 + .123.10.65.201 + .168.90.205.46 + .125.47.205.109 + .39.80.147.239 + .45.224.171.130 + .45.5.209.75 + .116.17.210.157 + .27.45.103.240 + .110.167.64.171 + .39.81.117.73 + .183.15.90.156 + .119.113.248.74 + .175.0.95.85 + .61.52.99.109 + .222.142.183.194 + .106.86.172.194 + .103.233.216.77 + .183.188.192.55 + .198.23.255.14 + .freedownloadfiles.org .querahinor.xyz .trumops.com .runmodes.com .91.121.67.60 + .172.67.186.189 + .inconclusive-pyrite-grandparent.glitch.me .delicate-tame-angora.glitch.me .secureinvoice.glitch.me @@ -4118,9 +4315,13 @@ .tough-numerous-lemur.glitch.me .securefirst.us-east-1.linodeobjects.com .39.65.72.211 + .42.238.151.197 + .27.213.60.53 + .115.56.169.134 + .yasir252.com .safelink.kadal.club .bedrapiona.com @@ -4136,7 +4337,9 @@ .yourladiefun.life .newrrb.bid .194.87.138.20 + .103.167.92.73 + .bursakulis.com .610418.selcdn.ru .alexstewartinternationalltd.rw @@ -4153,13 +4356,21 @@ .yunosurveys.com .shadyclient.net .58.249.74.79 + .27.45.14.109 + .27.40.101.191 + .27.45.119.22 + .27.47.73.159 + .115.204.119.237 + .163.125.31.46 + .163.179.168.44 + .money-mod.com .reykijnoac.com .totalnicefeed.com @@ -4169,16 +4380,27 @@ .mediafire.com/file/at2tvnao5x6ivdo/EngineOwning.rar/ .download2264.mediafire.com/pnk44f5ci9rg/at2tvnao5x6ivdo/EngineOwning.rar .110.89.59.135 + .113.116.89.1 + .119.183.146.191 + .153.3.3.226 + .182.116.104.6 + .60.7.133.200 + .122.6.254.201 + .110.89.11.167 + .171.112.177.90 + .115.194.38.143 + .61.52.79.32 + .lowseelan.com .dl02.s3.amazonaws.com/installers/747947/oi_picasa38-setupexe.exe .dl02.s3.amazonaws.com/installers/424531/2gzbsoj4gxb.exe @@ -4192,8 +4414,9 @@ .qqfzn.com .flash.cn .dundeehills.group -# + .132.148.220.142 + .chess-progress.ru .ouhastay.net .askara.super.site @@ -4205,21 +4428,32 @@ .p-stn.net .haxpc.net .52.53.243.52 + .34.201.22.10 + .business.google.com/website/billyandscapedesign .123.10.225.196 + .122.192.106.84 + .172.88.199.9 + .114.38.176.185 + .61.52.97.35 + .27.206.181.208 + .124.163.130.175 + .118.75.87.102 + .onemacusa.net .systemupdatecontrol.com .mozicrack.com .download-srvr.xyz .134.122.115.190 + .cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com .viewty.xyz .landing.marketstm.com @@ -4239,6 +4473,7 @@ .wellhello.com .ru.com .141.8.226.34 + .ston-app.com # fake human verification scam # start form - reported for abuse @@ -4252,6 +4487,7 @@ .crashfixes.com .splendid-fallacious-anaconda.glitch.me .91.240.118.172 + # "Press Allow to continue" .kuyhaa-mee.com .waystriling.com @@ -4290,7 +4526,8 @@ .freeversioncrack.com .top3hostngc.xyz .198.199.120.251 -# + + # A Discord conversation I had about Throneful .lover-finder.life .super-datings.life @@ -4311,7 +4548,9 @@ .partners-club.life .cumpussyy.uno .195.201.253.130 + .195.201.253.131 + .installiq.com .specgoal.com .sandhyapi.online @@ -4330,18 +4569,23 @@ .rtbvrdirect.com .cpmverdirect.com .15.197.244.48 + .96.47.230.67 + .96.47.230.68 + .96.47.230.69 + .96.47.230.70 + .highercaptcha-settle. .highercaptchasettle. .ns*.fastthinkingdns.com .telemetry-urs-microsoft.com .top-captcharesolver. .winrar-desktop.com -# -# + + .trafredirtds.com .com/landers/iphone*_spin .pu020ev.com @@ -4368,6 +4612,7 @@ .viixes.com .viiyhn.com .31.220.27.134 + .saferedirects.xyz .online-guard.com /mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*= @@ -4655,13 +4900,15 @@ .z-prize.icu .zfcurqe.art .zuginmw.art -# + /178\.253\.[0-7]\.\d{1,3} /178\.253\.2[0145]\\d{1,3} /178\.253\.3[04-7]\.\d{1,3} -# + .85.17.31.152 + .95.211.26.202 + .bzsx.link .dfvd.link .dsvs.link @@ -4675,9 +4922,11 @@ .ujtj.link .wznp.link .158.247.212.220 + .165.227.168.212 -# -# + + + .k-yw.com .fearconic.com .atobunderevenes.com @@ -4719,6 +4968,7 @@ .broburchrove.com .galantinkoling.com .23.81.64.183 + .zikroarg.com .dooloust.net .vooshagy.net @@ -4888,6 +5138,7 @@ .vooculok.com .mobytrks.com .139.45.197.236 + .becovi.com .becovi.co.uk .shopfirststop.com @@ -4915,13 +5166,18 @@ .frescopartito.com .motherpipe.net .51.91.66.125 + .51.178.76.105 + .147.135.253.55 + .bnbdeal.net -# -# + + .146.19.169.98 + .146.19.169.99 + /pushredirect/? .1000girl.com .1000islandsinfo.com @@ -6693,11 +6949,13 @@ .niderschlagsradar.de .2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com .69.162.80.56 + .smartlink.name # Random Discord servers .newntflix- .giveawaycord. .162.241.124.200 + .adsstar.in .clickcafe.in .earnme.club @@ -6713,6 +6971,7 @@ .usanewstoday.club .webhostingtips.club .157.90.71.190 + .abazelfan.com .abburmyer.com .abyamaskor.com @@ -6949,6 +7208,7 @@ .zagtertda.com .zoawufoy.net .139.45.197.239 + .glthub. .adblock-chrome.net .aaolh.icu @@ -7146,8 +7406,11 @@ .zaolutd.icu .zigaahm.icu .44.228.230.225 + .50.112.124.170 + .100.20.104.229 + # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread .link.sv .4.fo @@ -7158,11 +7421,16 @@ .pressizer.net .sapino.net .44.236.213.34 + .52.24.156.12 + .52.25.6.134 + .100.20.13.49 + .goldmesoil.live .51.68.87.229 + .f9dle.skin .kilpa2017.fi .2022crucialcatch.store @@ -8175,8 +8443,8 @@ .zamberlanireland.com .zapatillasvejacl.com .zapatosaldochile.org -# -# + + .adidas--* .adidas-outlet* .adidasfactoryoutlet* @@ -8918,8 +9186,8 @@ .vans-finland.com .martensbratislava.sk .zapatillasmcqueen.com -# -# + + .blendepr.org .blendevr.org .blendesr.org @@ -8948,8 +9216,11 @@ .unity-download.org .webull-download. .185.106.94.139 + .45.90.109.196 + .91.229.23.200 + .attractbestbonuses.life .attractbonus.life .best-prize.life @@ -9009,11 +9280,14 @@ .winbest.life .winmacros.life .185.155.184.98 + .194.110.247.242 + .ups-addressed.me .ups-quote.me .meta-whatsapp.me .54.219.218.169 + .0365alert.com .0365online.com .365-notifcation.com @@ -9444,6 +9718,7 @@ .yourticketchance.com .yourorderupdate.com .64.132.201.92 + .acessmygov.online .centerlinkmygov.com .centierssl.us @@ -9464,6 +9739,7 @@ .jatcraft.com .elimef.link .209.141.51.49 + .post-norway.web.app .propellerclick.com .abclefabletor.com @@ -9936,8 +10212,8 @@ .zevaimsu.net .zewoagoo.com .zoozistu.net -# -# + + .academic-information.com .academicvast.com .amused-ground.com @@ -10056,9 +10332,12 @@ .zogrepsili.com # Unsuited for wildcarding .208.88.225.116 + .208.88.225.117 + .208.88.225.119 -# + + .achilles-par.com .adrastos-eli.com .aegid-bal.com @@ -10157,9 +10436,13 @@ .wulfs-dcm.com /zcvisitor/*?campaignid .3.231.116.86 + .54.237.193.255 + .3.231.137.120 + .54.204.83.105 + .jonathanbartz.com .jp.imonitorsoft.com .junk-bros.com @@ -10177,10 +10460,15 @@ .office-view.com .i-likefood.co .108.61.242.65 + .146.70.78.43 + .87.120.254.39 + .45.150.108.213 + .92.204.160.240 + /land/*&afftrack= # Comments on Slack .antivirussprotection.com @@ -10335,6 +10623,7 @@ .watchrenewedcompletelyinfo-product.info .watchuberdevelopedinfo-product.info .34.200.46.148 + .abstorick.com .affienness.com .ailippiess.co.in @@ -10392,6 +10681,7 @@ .wuruclas.co.in .zondeucearixes.com .85.17.80.16 + .sitey.me .agazpeppily.live .agraffesalps.com @@ -10530,15 +10820,20 @@ .your-finance-now.com .your-survey-services.com .185.246.188.124 + .185.246.188.125 + .194.63.140.103 + .194.63.143.61 + .194.63.143.96 + .moneystartup.live .fintechbest.online -# -# + + .algazira-updates.com .articles-news-magazine.com .bellisimo-news.com @@ -10741,8 +11036,11 @@ .zarta-news.com .zorka-news.com .37.48.80.112 + .95.168.170.165 + .213.227.149.216 + # Slack comments .cojcdn.net .collecl.cc @@ -10769,7 +11067,9 @@ .totadblock.com .updateasap.online .109.206.168.16 + .109.206.168.17 + .cadstoppam.live .cottodwin.live .cumwaysroe.live @@ -10785,11 +11085,12 @@ .showjoinnip.live .usedhutsold.live .57.128.71.215 + /.*&[a-z]{1,2}=[a-zA-Z0-9]{0,}%[a-zA-Z0-9%]{1000,} .truanet.com .rumadel.com -# -# + + .apigroup.xyz .apihouse.xyz .apiinfo.xyz @@ -11517,22 +11818,32 @@ .zzebuh.com .zzrgab.com .37.1.223.231 + .139.45.197.167 + .139.45.197.245 + .159.223.137.164 + .185.56.234.205 + .192.243.58.97 + .192.243.58.98 + .192.243.58.123 + .192.243.58.124 + .192.243.58.125 + .[2a02:b48:207:1::2] .[2a02:b48:207:1::3] .[2a02:b48:207:1::6] .[2a02:b48:207:1::7] .[2a02:b48:207:1::8] -# -# + + .abdoser.co.in .acelim.co.in .adsos.xyz @@ -11903,8 +12214,11 @@ .wellnessfortune.net .ztomy.com .5.45.123.44 + .69.16.230.226 + .208.91.196.46 + /page/bouncy.php? .abashfireworks.com .abashinstructor.com @@ -16478,6 +16792,7 @@ .ptwmjmp.com .wmptengate.com .93.93.51.223 + .livejasmin.com/*&origin= /(//|\.|)github\.[a-z]{2,20}(/ .github.sale @@ -16727,6 +17042,7 @@ .upstr.us .reschedule-delivery.ups.com. .103.174.102.240 + .libretube.app .libretube.net .khw6g09fx28k.cfd @@ -16863,9 +17179,10 @@ .topshineauto.no .vossblues.no .yttersiden.no -# + .monetrizer*. .38.180.96.244 + .acareewityjh.com .accedenonre.xyz .adeditiontowritingef.net @@ -17202,8 +17519,10 @@ .yticaframeofm.com .yvaluationiamcur.com .34.195.224.242 + .54.225.185.110 + .githubtalentcommunity. .sweedbank-help.com .swedbank-account.com @@ -17212,6 +17531,7 @@ .dhlexpress-lieferung.net .pochta-ru.com .91.202.233.143 + # Based on a tip from my secretary .0842-3231-4323-4243-2344-1333-0595-3453-6439-7-3235-03928-2348.name .1-3evlhls3yf.shop @@ -17566,6 +17886,7 @@ .systemnetworkroute.com .trafficredirectchain.com .108.62.157.10 + .avito.avito.avito. .booking.com-id* .com-id*.info @@ -17577,15 +17898,25 @@ .avito.avito.www.avito. .booking.com-id* .172.240.108.68 + .172.240.108.76 + .172.240.108.84 + .172.240.127.234 + .172.240.253.132 + .192.243.59.12 + .192.243.59.13 + .192.243.59.20 + .192.243.61.225 + .192.243.61.227 + .0sntp7dnrr.com .0x01n2ptpuz3.com .2e8dgn8n0e0l.com @@ -20563,6 +20894,7 @@ .yydtbpms8tf4.com .zipinaccurateoffering.com .167.71.252.38 + .100carbures.com .123ecos.com .1win-k.com @@ -21672,9 +22004,13 @@ .zoomdirectory.net .zymstr.com .185.149.120.161 + .185.149.120.163 + .185.149.120.173 + .185.149.120.175 + .2rlive.com .afro-melanin.com .alatterapistroke.com @@ -21837,6 +22173,7 @@ .zglobalindia.com .zircontahafuz.com .185.149.120.173 + .02helpinfo.com .02rebill-pending.com .0niinebankingrbcroyabank.com @@ -22325,25 +22662,44 @@ .yourtollbymailnyfile.com .youweb-bpm.com .45.202.32.3 + .45.8.92.138 + .79.133.46.252 + .82.147.85.156 + .91.212.166.16 + .94.156.64.129 + .94.232.249.61 + .94.232.249.69 + .94.232.249.75 + .94.232.249.235 + .176.111.174.118 + .176.113.115.191 + .191.96.224.140 + .193.124.185.42 + .193.143.1.45 + .193.143.1.214 + .193.143.1.217 + .208.91.189.203 -# -# + + + +/?nw=1&tb=false&cw= {+block} # ——— Standard malware that I stumbled upon on my own ——— @@ -23972,10 +24328,13 @@ .zypy2h6rgfux.com .zzdb5p4upiug.com .192.243.59.12 + .192.243.59.13 + .192.243.59.20 -# -# + + + # rule34hentai.net when uBlock Filters and AdGuard Base are turned off .eivbjsegbino.com .jpjmpqaupc.com @@ -24006,10 +24365,14 @@ .skinosoda.online .194.226.139.121 + .194.226.139.7 + .95.181.157.36 + .95.181.172.204 -# + + /5\.8\.4[4-7]\.\d{1,3} /5\.101\.4[67]\.\d{1,3} /5\.188\.5[01]\.\d{1,3} @@ -24018,7 +24381,7 @@ /5\.189\.21[89]\.\d{1,3} /31\.184\.20[0-3]\.\d{1,3} /185\.238\.15[2-5]\.\d{1,3} -# + .dispositionadverb.com .wednesdayexpandingbarb.com .broadslippery.com @@ -24604,6 +24967,7 @@ .sidenoteconcern.com .abnegationbanquet.com .192.243.61.225 + .2spendless. .acrx.online .acrx.org @@ -24659,6 +25023,7 @@ .medicinecoupons.xyz .medicinehelp.news .147.135.16.27 + .ingeniovirtual.com # Spambot posts on Tumblr (19/09/2022) .scambiofigu.net @@ -24670,6 +25035,7 @@ .1pwk1j.cyou .986.group .185.87.148.199 + # Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) .imaot.co.il/ContentArea/BannerClick .q1065.fm/redirect @@ -24682,6 +25048,7 @@ .gacorhub.com .zh1653.com .45.136.49.35 + .semex.com/popurl.cgi .pharmanimal.com/catalog/redirect.php # Browsing around for Tajik newssites @@ -24736,10 +25103,15 @@ .cityratetod.live .onlymetsure.live .51.91.211.94 + .162.19.71.16 + .146.59.240.191 + .54.37.5.34 + .54.36.118.105 + .highlandnews.com .genuinescansupport.com .diverseflowlink.com @@ -24766,6 +25138,7 @@ .networkprincple.com .pcnetworkdefense.com .159.89.10.102 + # Other .foxsportnetwork.com .pksauniversity.com @@ -24789,6 +25162,7 @@ .nuouther.com .carpiesi.com .104.206.252.90 + .jNKmS0zFuEh.click .pjljo54uk.click .v1asy4ncr.click @@ -24806,22 +25180,35 @@ .123secure.org .yuppdownload.com .34.80.59.191 + .megabooru.com .zombooru.com .kusubooru.com .wh40kart.im .45.33.2.79 + .45.33.18.44 + .45.33.20.235 + .45.33.23.183 + .45.33.30.197 + .45.56.79.23 + .45.79.19.196 + .72.14.178.174 + .72.14.185.43 + .96.126.123.244 + .173.255.194.134 + .198.58.118.167 + .123chance.net .123links4u.net .123prizes.net @@ -25199,11 +25586,17 @@ .zebramode.com .zebraoffers.net .34.117.199.78 + .94.237.103.119 + .94.237.84.54 + .94.237.93.242 + .94.237.99.118 + .139.45.197.249 + .acorusinfield.life .acridlydebit.live .aeneasclosure.website @@ -25516,8 +25909,8 @@ .zapsenlight.space .zoqueanbannets.tech -# -# + + # Fake Gymshark webshops .gantdanmark.com .gantnorge.com @@ -25601,12 +25994,19 @@ *skobutikks.com *butikksoslo.com .196.196.153.151 + .158.222.7.116 + .196.245.152.139 + .165.231.251.197 + .196.242.16.29 + .165.231.4.90 + .158.222.7.83 + # Spam on W.I.T.C.H. and Winx text search results # A scam SMS I got .95-214-26-78.plesk.page @@ -25669,6 +26069,7 @@ .your-ups-track.com .zoll-pakete-support.com .95.214.26.78 + # Overly dedicated E-mail spammers .wirexapp.africa.com .tachyoniums.eu.com @@ -25677,7 +26078,9 @@ .ybd001.com .deltacorriher.best .104.21.82.132 + .172.67.158.57 + .[2606:4700:3030::6815:5284] .[2606:4700:3037::ac43:9e39] # Google results for «SodaStream site:no cranberry» @@ -25703,11 +26106,14 @@ .sirdayscare.info .slownansuch.info .185.155.184.57 + .185.155.186.24 + .usayn.fr .style-js.com /a.aspx?cid=*&cname= .209.74.107.131 + .qidjrsgroup.shop /flying.asp?cid= /kjyo.php?cname= @@ -25780,7 +26186,9 @@ .xgptw11vogsh.com .zeirj14ikqwf.com .69.172.200.185 + .77.220.214.153 + # More search terms than what can be counted with a supercomputer (11/03/2024) # Scam E-mails I've got .googleapis.com/nwfotrac @@ -25804,7 +26212,7 @@ .gadgetsfarms.com .techorfy.com -# + {+block} # ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ——— # If you use AdGuard Home ≥v0.106.3, I warmly recommend manually pasting these entries into Settings → DNS Settings → Disallowed domains @@ -25816,13 +26224,13 @@ .dominiosvision.com .hitnslab.info .1x1.cz -# + {+block} # ——— Usually used by various groups who buy old domains and display illicit ads on them ——— -# -# + + {+block} # ——— Spam in comment sections across the internet about "working" from "home" ——— @@ -25834,11 +26242,11 @@ {+block} # ——— Anti-'Malware comments' (Currently Disqus-specific) ——— -# + {+block} # ——— Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) ——— .if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data -# + {+block} # ——— Anti-PUP (WIP) ——— @@ -25850,7 +26258,7 @@ {+block} # ——— Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control ——— -# + # All legitimate Pac-Man games would use "pac-man" links with a dash @@ -25859,9 +26267,10 @@ .trmff.wpengine.com .212.27.60.108 -# -# -# + + + + @@ -25874,7 +26283,7 @@ # Domains stolen by casino SEO spammers .aussie-gamer.com -# + # Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests @@ -25882,7 +26291,7 @@ -# + {-block} # Manually updated Privoxy version of the whitelisted domains from the other versions of this list. diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index b33f2bb40..20b47f3ed 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,10 +1,9 @@ msFilterList # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 21September2024v1-Deprecated +# Version: 30September2024v2-Deprecated : expires = 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists -# (Note to self, only applicable to uBO: When 1.59.1 goes stable, implement "* # Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#-english # ——— Bad top-level domains ——— @@ -149,6 +148,7 @@ msFilterList -d adblock.gjtech.net -d spam404bl.com -d 109.201.135.46 + -d fredfiber.no -d securemecca.com -d 1hos.cf @@ -190,6 +190,7 @@ msFilterList # Fraudulent browser extensions -d ublock.org -d 138.68.252.54 + -d useragentswitch.com -d dev-nano.com -d adblocker-app.info @@ -340,19 +341,28 @@ msFilterList # ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— -d ubuntu.org -d 103.224.212.249 + -d speedtest.com -d snapchat.cm -d facebook.cm -d wix.cm -d 199.59.243.222 + -d 14d.us -d 173.208.96.42 + -d 173.208.96.43 + -d 173.208.96.44 + -d 173.208.96.45 + -d 173.208.96.46 + -d 213.227.149.208 + -d 213.227.149.211 + -d ddscordapp. -d diicordapp. -d disccrdapp. @@ -438,6 +448,7 @@ msFilterList -d 54.174.156.141 + -d lucretius-ada.com -d hippolyte-hag.com -d india-abc.com @@ -451,13 +462,21 @@ msFilterList -d madagty.com -d zeroredirect5.com -d 54.209.22.226 + -d 54.91.125.197 + -d 52.202.53.245 + -d 35.175.38.64 + -d 35.168.147.213 + -d 34.230.160.215 + -d 3.226.8.132 + -d 3.216.243.46 + -d roamingclicks.com # Source: desidert•no -d collectfasttracks.com @@ -469,8 +488,11 @@ msFilterList -d 54.152.245.247 + -d 35.172.40.232 + -d 3.90.125.85 + # Various ex-affiliate links at www•zombooru•com -d track.vcdc.com -d track.tkbo.com @@ -481,10 +503,15 @@ msFilterList -d satcom1.co.uk -d splitter.microxml.net -d 94.130.185.237 + -d 94.130.186.231 + -d 144.76.0.242 + -d 144.76.1.130 + -d 195.201.92.254 + # https://github.com/DandelionSprout/adfilt/pull/167 -d forgoprokick.icu # https://github.com/AdguardTeam/AdguardFilters/issues/124611 @@ -504,9 +531,13 @@ msFilterList -d newpage.in - mcaf04 *= -d 34.204.214.165 + -d 54.85.113.62 + -d 54.205.83.61 + -d 54.210.193.115 + -d [2600:1f18:43d1:2a04:ee05:261e:d408:7ba1] -d ailkeyair.com -d amulagaudish.cam @@ -559,30 +590,48 @@ msFilterList -d wonfigfig.com -d adblockerapp.com -d 172.255.6.107 + -d 172.255.6.147 + -d 172.255.6.219 + -d 172.255.6.225 + -d 188.42.129.108 + -d 188.42.129.116 + -d 188.42.141.100 + -d 188.42.141.92 + -d 23.109.82.144 + -d 23.109.82.41 + -d 23.109.82.43 + -d 23.109.82.65 + -d 23.109.82.66 + -d 23.109.87.169 + -d 23.109.87.207 + -d 23.109.87.208 + -d entwithou.xyz -d chedstimaarr.pics -d blueoyster.click -d qocvicklgcgr.com -d zeikvvbobop.com -d 216.21.13.14 + -d 216.21.13.15 + -d abaphosis.guru -d abietichob.live -d abyssusuntouch.guru @@ -3664,6 +3713,7 @@ msFilterList -d zmusic-online.com -d zredir.com -d 178.128.142.109 + -d findmedia.biz -d backtonews.biz -d bagclick.biz @@ -3684,6 +3734,7 @@ msFilterList -d 134.209.136.174 + -d whiteclick.biz -d dreamnews.biz -d gonews2.com @@ -3697,9 +3748,13 @@ msFilterList -d texterra.me -d worldtxt.club -d 62.210.6.153 + -d 62.210.7.209 + -d 62.210.9.92 + -d 62.210.11.203 + -d ilo134ulih.com -d hooligapps.com -d best202*-games-web1.com @@ -3716,6 +3771,7 @@ msFilterList -d stay-notified.com -d stay-notified.xyz -d 167.99.249.47 + # https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ # https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ -d moderncomputer.net @@ -3755,19 +3811,30 @@ msFilterList -d rebiraert.com -d iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com -d 5.8.34.26 + -d 5.8.47.3 + -d 103.224.182.251 + # https://github.com/DandelionSprout/adfilt/issues/193 -d holescontracting.com -d doggroomingnews.com -d 5.79.71.205 + -d 5.79.71.225 + -d 85.17.31.82 + -d 85.17.31.122 + -d 178.162.203.202 + -d 178.162.203.211 + -d 178.162.203.226 + -d 178.162.217.107 + -d [2a02:1668:1034::2] # https://github.com/DandelionSprout/adfilt/issues/195 -d logicalrecord.com @@ -3781,9 +3848,13 @@ msFilterList -d securebankapp.online -d securemailbox.online -d 66.85.156.85 + -d 66.85.156.86 + -d 108.170.31.123 + -d 108.170.52.156 + # https://github.com/DandelionSprout/adfilt/issues/198 -d mysecrethoookup.com # https://www•bleepingcomputer•com/virus-removal/ (18/06 2021) @@ -3890,8 +3961,11 @@ msFilterList -d watch-this.live -d weather-forecast.today -d 95.168.170.165 + -d 213.227.145.147 + -d 213.227.149.216 + # https://twitter•com/adamziaja/status/1252234957679808513 -d wow-robotics.xyz # https://blog•sucuri•net/2021/05/woocommerce-credit-card-skimmer•html @@ -3907,6 +3981,7 @@ msFilterList -d fblaster.com -d ribinski.us -d 5.188.62.36 + # https://github.com/DandelionSprout/adfilt/issues/223 -d speedupmypcfree.com # https://github.com/DandelionSprout/adfilt/issues/224 @@ -3942,6 +4017,7 @@ msFilterList -d ssielearning.com -d paymetconfirm.com -d 69.49.231.244 + # https://movsb•0x0•st/users/mia -d vid.me -d 5starhdporn.com @@ -3966,6 +4042,7 @@ msFilterList -d blackpass.info -d yzsnw.com -d 37.34.176.37 + -d atvcampingtrips.com -d thegymmum.com -d pcspeedcat.com @@ -3982,14 +4059,20 @@ msFilterList -d temp74.com -d trackwebclick.com -d 23.111.31.137 + -d 23.111.88.207 + # https://github.com/DandelionSprout/adfilt/issues/254 -d onesafesoftware.com # https://github.com/DandelionSprout/adfilt/issues/257 -d 185.158.250.239 + -d 192.169.69.25 + -d 212.192.241.72 + -d 37.0.10.83 + -d newstepsco.com -d lucdream.com @@ -4020,6 +4103,7 @@ msFilterList # https://www•virustotal•com/gui/url/826c451929420c4da32552f967fb1cab6467405a29c65b23802aaadb6a8c7505/detection # https://safeweb•norton•com/report/show?url=192•3•110•170 -d 192.3.110.170 + # https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ -d socialsearchconverter.com -d install.socialsearchconverter.com @@ -4058,6 +4142,7 @@ msFilterList # https://www•virustotal•com/gui/url/5618023ed5a768d7f879c0d599b9ba7cff0e9171201981256eeaf5ce8eb09fdb/detection # https://www•virustotal•com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection -d 91.241.19.38 + # https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection # https://safeweb•norton•com/report/show?url=telete•in # https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -4068,41 +4153,58 @@ msFilterList # https://www•virustotal•com/gui/domain/kiff•tech/relations # https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection -d 45.90.58.90 + # https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community # https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection -d 95.85.89.98 + # https://github.com/DandelionSprout/adfilt/issues/267 -d tekhacks.net -d mediafire.com file pj9jdm7iznc4d51 tekhacksnet_multi_loader.rar # https://github.com/DandelionSprout/adfilt/pull/278 # https://www.virustotal.com/gui/file/da75c85fe037f9ff9ebbbd0b37dd2ff154f5e70a0dc6870286e0d3df6b8f246f/community -d 139.28.37.49 + # https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community -d 35.194.188.37 + # https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community -d hydro-ca.link # https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community -d 91.243.121.19 + # https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community -d 103.169.90.205 + # https://github.com/DandelionSprout/adfilt/pull/281 # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community -d 125.44.43.45 + -d 182.121.8.240 + -d 42.235.183.74 + -d 78.36.32.242 + -d 115.50.2.119 + -d 115.50.110.163 + -d 119.179.84.145 + -d 188.120.50.98 + -d 190.238.183.5 + -d 27.220.253.78 + # https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community -d esetnode32-antiviru.ydns.eu # https://www•joesandbox•com/analysis/486636/0/html#domains -d aieov.com # Relations to the original domain -d 192.3.194.242 + -d w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu -d hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu -d avira-antivirus.ydns.eu @@ -4178,66 +4280,120 @@ msFilterList # https://www•virustotal•com/gui/file/78f490e503c86eaaff5760197b9ff5308ed6e03161af13194a6c1e0cd95422de/community # https://github.com/DandelionSprout/adfilt/commit/f7f114945c83b339be5cdd848e229680d9918abb#commitcomment-57642875 -d 23.94.26.138 + # https://github.com/DandelionSprout/adfilt/pull/298 # https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community -d 205.185.126.200 + # https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community -d 185.243.56.167 + # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -d 123.10.224.135 + -d 59.47.187.147 + -d 39.68.172.210 + -d 122.192.177.176 + -d 112.27.124.108 + -d 123.110.176.246 + -d 219.155.105.98 + -d 171.35.161.209 + -d 60.16.255.36 + -d 112.30.4.52 + -d 182.121.191.201 + -d 121.61.48.170 + -d 39.81.68.45 + -d 27.222.220.164 + -d 113.233.215.135 + -d 151.77.100.133 + -d 125.120.13.184 + -d 120.12.138.133 + -d 27.194.115.185 + -d 104.128.199.228 + -d 183.92.123.145 + -d 110.89.8.126 + -d 125.43.211.184 + -d 1.0.218.230 + -d 221.208.4.56 + -d 60.13.60.19 + -d 171.37.29.87 + -d 124.91.237.188 + -d 115.56.137.49 + -d 115.52.240.69 + -d 112.252.132.185 + -d 117.198.240.157 + -d 42.53.240.249 + -d 116.179.138.68 + -d 110.241.119.159 + -d 115.56.31.133 + -d 103.19.128.222 + -d 202.12.80.74 + -d 61.52.8.62 + -d 182.122.252.69 + -d 219.155.26.50 + -d 120.4.141.185 + -d 119.102.7.115 + -d 72.51.127.213 + -d 111.224.199.91 + -d 119.250.236.122 + -d 112.30.110.58 + # https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community -d pcae.de # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community -d 117.196.49.21 + -d 115.55.54.234 + -d 115.52.17.123 + -d 182.59.69.21 + # https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community -d chip-secured-download.de # https://www•virustotal•com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb @@ -4260,6 +4416,7 @@ msFilterList # Vermilion Strike # https://www•virustotal•com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations -d 160.202.163.100 + # https://www•virustotal•com/gui/ip-address/160•202•163•100/relations -d microsoftkernel.com -d microsofthk.com @@ -4273,10 +4430,13 @@ msFilterList # https://github.com/DandelionSprout/adfilt/pull/303 # https://www•virustotal•com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community -d 45.95.169.115 + # https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community -d 45.148.120.80 + # https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community -d 85.239.33.9 + # Relations to the domain above -d adminsys.serveftp.com -d amazbaidu.serveftp.com @@ -4294,8 +4454,10 @@ msFilterList -d eposcardokubo.serveftp.com # https://www•virustotal•com/gui/file/8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0/community -d 107.173.176.183 + # https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community -d 45.148.120.171 + # https://twitter•com/soranker0/status/1449491402409185283 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-950330114 -d free-softs.net @@ -4305,6 +4467,7 @@ msFilterList # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-951321929 -d 159.148.186.228 + # https://github.com/iam-py-test/investigations/blob/main/2021/10 26 1.md#domains -d yotube.com -d r-tb.com @@ -4333,38 +4496,70 @@ msFilterList # https://github.com/DandelionSprout/adfilt/pull/348 # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -d 39.83.80.247 + -d 68.197.33.124 + -d 219.157.21.37 + -d 182.123.141.17 + -d 125.47.243.187 + -d 182.122.196.203 + -d 182.117.231.182 + -d 112.31.211.135 + -d 125.106.63.93 + -d 115.59.197.46 + -d 122.159.29.192 + -d 171.40.0.127 + -d 171.80.219.160 + -d 123.10.65.201 + -d 168.90.205.46 + -d 125.47.205.109 + -d 39.80.147.239 + -d 45.224.171.130 + -d 45.5.209.75 + -d 116.17.210.157 + -d 27.45.103.240 + -d 110.167.64.171 + -d 39.81.117.73 + -d 183.15.90.156 + -d 119.113.248.74 + -d 175.0.95.85 + -d 61.52.99.109 + -d 222.142.183.194 + -d 106.86.172.194 + -d 103.233.216.77 + -d 183.188.192.55 + # https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community -d 198.23.255.14 + # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971512075 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971495248 # https://github.com/iam-py-test/investigations/blob/main/2021/11 15 1.md#iocs @@ -4373,7 +4568,9 @@ msFilterList -d trumops.com -d runmodes.com -d 91.121.67.60 + -d 172.67.186.189 + # https://www•virustotal•com/gui/url/af8f443208f4e86d469549b219fccbeb43b7cae40be5f1b4c4e5083e27fc8111 -d inconclusive-pyrite-grandparent.glitch.me -d delicate-tame-angora.glitch.me @@ -4389,9 +4586,13 @@ msFilterList -d securefirst.us-east-1.linodeobjects.com # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community -d 39.65.72.211 + -d 42.238.151.197 + -d 27.213.60.53 + -d 115.56.169.134 + # https://github.com/iam-py-test/investigations/blob/main/2021/11 21 1.md -d yasir252.com -d safelink.kadal.club @@ -4412,8 +4613,10 @@ msFilterList -d newrrb.bid # https://www•virustotal•com/gui/file/2b2628a50d3b39b0fa2395d487bf62b00e37cdae847ff76ee58399bbe4e9f7b3/community -d 194.87.138.20 + # https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community -d 103.167.92.73 + # https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community -d bursakulis.com # https://www•virustotal•com/gui/url/b333c49efa4d399e65c5e2d96a905b380acbca58a3e3052b7bd7cfcb3e0e81ee @@ -4440,13 +4643,21 @@ msFilterList -d shadyclient.net # https://www•virustotal•com/gui/file/d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8/community -d 58.249.74.79 + -d 27.45.14.109 + -d 27.40.101.191 + -d 27.45.119.22 + -d 27.47.73.159 + -d 115.204.119.237 + -d 163.125.31.46 + -d 163.179.168.44 + # https://github.com/uBlockOrigin/uAssets/pull/10647 # https://github.com/iam-py-test/investigations/blob/main/2021/11 28 1.md -d money-mod.com @@ -4462,16 +4673,27 @@ msFilterList -d download2264.mediafire.com pnk44f5ci9rg at2tvnao5x6ivdo EngineOwning.rar # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -d 110.89.59.135 + -d 113.116.89.1 + -d 119.183.146.191 + -d 153.3.3.226 + -d 182.116.104.6 + -d 60.7.133.200 + -d 122.6.254.201 + -d 110.89.11.167 + -d 171.112.177.90 + -d 115.194.38.143 + -d 61.52.79.32 + # https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 # https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 -d lowseelan.com @@ -4501,6 +4723,7 @@ msFilterList -d dundeehills.group -d 132.148.220.142 + # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 -d chess-progress.ru -d ouhastay.net @@ -4519,18 +4742,28 @@ msFilterList # https://github.com/iam-py-test/investigations/blob/main/2021/12 13 1.md -d haxpc.net -d 52.53.243.52 + -d 34.201.22.10 + # https://scammer.info/t/crypto-scammers-onceagain/85354 -d business.google.com website billyandscapedesign # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -d 123.10.225.196 + -d 122.192.106.84 + -d 172.88.199.9 + -d 114.38.176.185 + -d 61.52.97.35 + -d 27.206.181.208 + -d 124.163.130.175 + -d 118.75.87.102 + # https://github.com/iam-py-test/investigations/blob/main/2021/12 14 1.md -d onemacusa.net # https://github.com/DevSpen/links/pull/3 @@ -4539,6 +4772,7 @@ msFilterList -d mozicrack.com -d download-srvr.xyz -d 134.122.115.190 + -d cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com # https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777 -d viewty.xyz @@ -4561,6 +4795,7 @@ msFilterList # https://github.com/AdguardTeam/AdguardFilters/issues/103475 -d ru.com -d 141.8.226.34 + # https://github.com/AdguardTeam/AdguardFilters/issues/108571 -d ston-app.com # fake human verification scam @@ -4577,6 +4812,7 @@ msFilterList -d splendid-fallacious-anaconda.glitch.me # https://www•virustotal•com/gui/file/9d40ae0439ddc594b2cf64e21ad0fdea9bb440524298e3a6bcfcc1fb417f1ed2/relations -d 91.240.118.172 + # "Press Allow to continue" -d kuyhaa-mee.com -d waystriling.com @@ -4622,6 +4858,7 @@ msFilterList -d freeversioncrack.com -d top3hostngc.xyz -d 198.199.120.251 + # https://www•telia.no/kundeservice/mobil/malware-flubot-android/ @@ -4645,7 +4882,9 @@ msFilterList -d partners-club.life -d cumpussyy.uno -d 195.201.253.130 + -d 195.201.253.131 + # The bottom download button on https://www•sushichop•com/ -d installiq.com -d specgoal.com @@ -4665,10 +4904,15 @@ msFilterList -d rtbvrdirect.com -d cpmverdirect.com -d 15.197.244.48 + -d 96.47.230.67 + -d 96.47.230.68 + -d 96.47.230.69 + -d 96.47.230.70 + # https://securitytrails•com/list/ns/ns1•fastthinkingdns•com -d highercaptcha-settle. -d highercaptchasettle. @@ -4706,6 +4950,7 @@ msFilterList -d viixes.com -d viiyhn.com -d 31.220.27.134 + # https://github.com/AdguardTeam/AdguardFilters/issues/122757 # https://github.com/AdguardTeam/AdguardFilters/issues/123544 -d saferedirects.xyz @@ -5004,7 +5249,9 @@ msFilterList -d 85.17.31.152 + -d 95.211.26.202 + # https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 -d bzsx.link -d dfvd.link @@ -5019,8 +5266,10 @@ msFilterList -d ujtj.link -d wznp.link -d 158.247.212.220 + -d 165.227.168.212 + # https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ # https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599 @@ -5066,6 +5315,7 @@ msFilterList -d broburchrove.com -d galantinkoling.com -d 23.81.64.183 + # https://github.com/AdguardTeam/AdguardFilters/issues/125300 -d zikroarg.com -d dooloust.net @@ -5236,6 +5486,7 @@ msFilterList -d vooculok.com -d mobytrks.com -d 139.45.197.236 + # https://github.com/AdguardTeam/AdguardFilters/issues/128029 -d becovi.com -d becovi.co.uk @@ -5264,8 +5515,11 @@ msFilterList -d frescopartito.com -d motherpipe.net -d 51.91.66.125 + -d 51.178.76.105 + -d 147.135.253.55 + # https://github.com/uBlockOrigin/uAssets/issues/14569/→/https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection/(https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) -d bnbdeal.net # https://github.com/AdguardTeam/AdguardFilters/issues/129414 @@ -5275,7 +5529,9 @@ msFilterList # https://github.com/AdguardTeam/AdguardFilters/issues/131156 -d 146.19.169.98 + -d 146.19.169.99 + # https://github.com/AdguardTeam/AdguardFilters/issues/132079 - pushredirect ? # https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -7049,12 +7305,14 @@ msFilterList -d niderschlagsradar.de -d 2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com -d 69.162.80.56 + # https://github.com/AdguardTeam/AdguardFilters/issues/134903 -d smartlink.name # Random Discord servers -d newntflix- -d giveawaycord. -d 162.241.124.200 + # https://github.com/AdguardTeam/AdguardFilters/issues/135815 -d adsstar.in -d clickcafe.in @@ -7071,6 +7329,7 @@ msFilterList -d usanewstoday.club -d webhostingtips.club -d 157.90.71.190 + # https://github.com/AdguardTeam/AdguardFilters/issues/135924 -d abazelfan.com -d abburmyer.com @@ -7308,6 +7567,7 @@ msFilterList -d zagtertda.com -d zoawufoy.net -d 139.45.197.239 + # https://github.com/AdguardTeam/AdguardFilters/issues/136390 -d glthub. # https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -7508,8 +7768,11 @@ msFilterList -d zaolutd.icu -d zigaahm.icu -d 44.228.230.225 + -d 50.112.124.170 + -d 100.20.104.229 + # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread -d link.sv -d 4.fo @@ -7521,12 +7784,17 @@ msFilterList -d pressizer.net -d sapino.net -d 44.236.213.34 + -d 52.24.156.12 + -d 52.25.6.134 + -d 100.20.13.49 + # https://github.com/AdguardTeam/AdguardFilters/issues/139667 -d goldmesoil.live -d 51.68.87.229 + -d f9dle.skin -d kilpa2017.fi # https://github.com/DandelionSprout/adfilt/issues/747 @@ -9315,8 +9583,11 @@ msFilterList -d unity-download.org -d webull-download. -d 185.106.94.139 + -d 45.90.109.196 + -d 91.229.23.200 + # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1401711872 # https://github.com/AdguardTeam/AdguardFilters/issues/144514 -d attractbestbonuses.life @@ -9378,12 +9649,15 @@ msFilterList -d winbest.life -d winmacros.life -d 185.155.184.98 + -d 194.110.247.242 + # https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ -d ups-addressed.me -d ups-quote.me -d meta-whatsapp.me -d 54.219.218.169 + # https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ -d 0365alert.com -d 0365online.com @@ -9815,6 +10089,7 @@ msFilterList -d yourticketchance.com -d yourorderupdate.com -d 64.132.201.92 + # https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener -d acessmygov.online -d centerlinkmygov.com @@ -9836,6 +10111,7 @@ msFilterList -d jatcraft.com -d elimef.link -d 209.141.51.49 + -d post-norway.web.app # https://github.com/AdguardTeam/AdguardFilters/issues/142955 -d propellerclick.com @@ -10430,8 +10706,11 @@ msFilterList -d zogrepsili.com # Unsuited for wildcarding -d 208.88.225.116 + -d 208.88.225.117 + -d 208.88.225.119 + # https://github.com/AdguardTeam/AdguardFilters/issues/144823 -d landings.*_slots/?partner= @@ -10534,9 +10813,13 @@ msFilterList -d wulfs-dcm.com - zcvisitor *?campaignid -d 3.231.116.86 + -d 54.237.193.255 + -d 3.231.137.120 + -d 54.204.83.105 + # https://github.com/DandelionSprout/adfilt/issues/808 # https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations/(26/01/2023) -d jonathanbartz.com @@ -10556,10 +10839,15 @@ msFilterList -d office-view.com -d i-likefood.co -d 108.61.242.65 + -d 146.70.78.43 + -d 87.120.254.39 + -d 45.150.108.213 + -d 92.204.160.240 + # https://github.com/AdguardTeam/AdguardFilters/issues/148560 - land *&afftrack= # Comments on Slack @@ -10715,6 +11003,7 @@ msFilterList -d watchrenewedcompletelyinfo-product.info -d watchuberdevelopedinfo-product.info -d 34.200.46.148 + -d abstorick.com -d affienness.com -d ailippiess.co.in @@ -10772,6 +11061,7 @@ msFilterList -d wuruclas.co.in -d zondeucearixes.com -d 85.17.80.16 + # https://www•adressa.no/nyheter/trondheim/i/Moq2wR/svindlere-kaarer-vinnere-i-konkurranser-gir-en-daarlig-foelelse-aa-forklare-at-dette-bare-er-tull -d sitey.me # https://github.com/AdguardTeam/AdguardFilters/issues/151479 @@ -10913,10 +11203,15 @@ msFilterList -d your-finance-now.com -d your-survey-services.com -d 185.246.188.124 + -d 185.246.188.125 + -d 194.63.140.103 + -d 194.63.143.61 + -d 194.63.143.96 + # https://github.com/AdguardTeam/AdguardFilters/issues/152945 -d moneystartup.live -d fintechbest.online @@ -11126,8 +11421,11 @@ msFilterList -d zarta-news.com -d zorka-news.com -d 37.48.80.112 + -d 95.168.170.165 + -d 213.227.149.216 + # Slack comments -d cojcdn.net -d collecl.cc @@ -11154,7 +11452,9 @@ msFilterList -d totadblock.com -d updateasap.online -d 109.206.168.16 + -d 109.206.168.17 + # https://github.com/AdguardTeam/AdguardFilters/issues/155298 -d cadstoppam.live -d cottodwin.live @@ -11172,6 +11472,7 @@ msFilterList -d usedhutsold.live -d 57.128.71.215 + # https://github.com/AdguardTeam/AdguardFilters/issues/155936 -d truanet.com -d rumadel.com @@ -11907,15 +12208,25 @@ msFilterList -d zzebuh.com -d zzrgab.com -d 37.1.223.231 + -d 139.45.197.167 + -d 139.45.197.245 + -d 159.223.137.164 + -d 185.56.234.205 + -d 192.243.58.97 + -d 192.243.58.98 + -d 192.243.58.123 + -d 192.243.58.124 + -d 192.243.58.125 + -d [2a02:b48:207:1::2] -d [2a02:b48:207:1::3] -d [2a02:b48:207:1::6] @@ -12294,8 +12605,11 @@ msFilterList -d wellnessfortune.net -d ztomy.com -d 5.45.123.44 + -d 69.16.230.226 + -d 208.91.196.46 + - page bouncy.php? # https://github.com/AdguardTeam/AdguardFilters/issues/158316 -d abashfireworks.com @@ -16872,6 +17186,7 @@ msFilterList -d ptwmjmp.com -d wmptengate.com -d 93.93.51.223 + -d livejasmin.com *&origin= # https://github.com/AdguardTeam/AdguardFilters/issues/161364 # (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) @@ -17141,6 +17456,7 @@ msFilterList -d upstr.us -d reschedule-delivery.ups.com. -d 103.174.102.240 + # https://github.com/libre-tube/LibreTube/issues/4409 -d libretube.app -d libretube.net @@ -17284,6 +17600,7 @@ msFilterList # https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7873648 -d 38.180.96.244 + # https://github.com/AdguardTeam/AdguardFilters/issues/172569 -d acareewityjh.com -d accedenonre.xyz @@ -17621,8 +17938,10 @@ msFilterList -d yticaframeofm.com -d yvaluationiamcur.com -d 34.195.224.242 + -d 54.225.185.110 + -d githubtalentcommunity. # https://github.com/AdguardTeam/AdguardFilters/issues/173925 -d sweedbank-help.com @@ -17632,6 +17951,7 @@ msFilterList -d dhlexpress-lieferung.net -d pochta-ru.com -d 91.202.233.143 + # Based on a tip from my secretary -d 0842-3231-4323-4243-2344-1333-0595-3453-6439-7-3235-03928-2348.name -d 1-3evlhls3yf.shop @@ -17987,6 +18307,7 @@ msFilterList -d systemnetworkroute.com -d trafficredirectchain.com -d 108.62.157.10 + # https://github.com/AdguardTeam/FiltersRegistry/issues/925 # https://github.com/AdguardTeam/FiltersRegistry/pull/927 -d avito.avito.avito. @@ -18001,15 +18322,25 @@ vito.www.booking. -d booking.com-id* # https://github.com/AdguardTeam/AdguardFilters/issues/179170 -d 172.240.108.68 + -d 172.240.108.76 + -d 172.240.108.84 + -d 172.240.127.234 + -d 172.240.253.132 + -d 192.243.59.12 + -d 192.243.59.13 + -d 192.243.59.20 + -d 192.243.61.225 + -d 192.243.61.227 + -d 0sntp7dnrr.com -d 0x01n2ptpuz3.com -d 2e8dgn8n0e0l.com @@ -20988,6 +21319,7 @@ vito.www.booking. -d zipinaccurateoffering.com # https://github.com/AdguardTeam/AdguardFilters/issues/181966 -d 167.71.252.38 + # https://github.com/AdguardTeam/AdguardFilters/issues/183432 -d 100carbures.com -d 123ecos.com @@ -22098,9 +22430,13 @@ vito.www.booking. -d zoomdirectory.net -d zymstr.com -d 185.149.120.161 + -d 185.149.120.163 + -d 185.149.120.173 + -d 185.149.120.175 + # https://github.com/AdguardTeam/AdguardFilters/issues/184671 -d 2rlive.com -d afro-melanin.com @@ -22264,6 +22600,7 @@ vito.www.booking. -d zglobalindia.com -d zircontahafuz.com -d 185.149.120.173 + # https://sol•no/81812194////https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-10360231 -d 02helpinfo.com -d 02rebill-pending.com @@ -22753,26 +23090,46 @@ vito.www.booking. -d yourtollbymailnyfile.com -d youweb-bpm.com -d 45.202.32.3 + -d 45.8.92.138 + -d 79.133.46.252 + -d 82.147.85.156 + -d 91.212.166.16 + -d 94.156.64.129 + -d 94.232.249.61 + -d 94.232.249.69 + -d 94.232.249.75 + -d 94.232.249.235 + -d 176.111.174.118 + -d 176.113.115.191 + -d 191.96.224.140 + -d 193.124.185.42 + -d 193.143.1.45 + -d 193.143.1.214 + -d 193.143.1.217 + -d 208.91.189.203 +# https://github.com/AdguardTeam/AdguardFilters/issues/189905 +- ?nw=1&tb=false&cw= + # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 -d downloadprovider.me @@ -24407,11 +24764,14 @@ dvancedhosters.com$doc,domain= -d zypy2h6rgfux.com -d zzdb5p4upiug.com -d 192.243.59.12 + -d 192.243.59.13 + -d 192.243.59.20 + # rule34hentai.net when uBlock Filters and AdGuard Base are turned off -d eivbjsegbino.com -d jpjmpqaupc.com @@ -24442,10 +24802,14 @@ dvancedhosters.com$doc,domain= -d skinosoda.online -d 194.226.139.121 + -d 194.226.139.7 + -d 95.181.157.36 + -d 95.181.172.204 + # AS209813 (https://github.com/AdguardTeam/AdguardFilters/issues/114618#issuecomment-1100702530;/currently/specific to tools that support CIDR blocking) @@ -25042,6 +25406,7 @@ dvancedhosters.com$doc,domain= -d sidenoteconcern.com -d abnegationbanquet.com -d 192.243.61.225 + # https://twitter•com/medicinehelp/status/1550250932394409985 # https://securitytrails•com/list/ip/147•135•16•27 -d 2spendless. @@ -25099,6 +25464,7 @@ dvancedhosters.com$doc,domain= -d medicinecoupons.xyz -d medicinehelp.news -d 147.135.16.27 + # https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img -d ingeniovirtual.com # Spambot posts on Tumblr (19 09 2022) @@ -25112,6 +25478,7 @@ dvancedhosters.com$doc,domain= -d 1pwk1j.cyou -d 986.group -d 185.87.148.199 + # Google results for 'horse tales: emerald valley ranch mobygames' (05 11 2022) -d imaot.co.il ContentArea BannerClick -d q1065.fm redirect @@ -25124,6 +25491,7 @@ dvancedhosters.com$doc,domain= -d gacorhub.com -d zh1653.com -d 45.136.49.35 + -d semex.com popurl.cgi -d pharmanimal.com catalog redirect.php # Browsing around for Tajik newssites @@ -25178,10 +25546,15 @@ dvancedhosters.com$doc,domain= -d cityratetod.live -d onlymetsure.live -d 51.91.211.94 + -d 162.19.71.16 + -d 146.59.240.191 + -d 54.37.5.34 + -d 54.36.118.105 + # Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt -d highlandnews.com -d genuinescansupport.com @@ -25209,6 +25582,7 @@ dvancedhosters.com$doc,domain= -d networkprincple.com -d pcnetworkdefense.com -d 159.89.10.102 + # Other -d foxsportnetwork.com -d pksauniversity.com @@ -25232,6 +25606,7 @@ dvancedhosters.com$doc,domain= -d nuouther.com -d carpiesi.com -d 104.206.252.90 + # https://github.com/blocklistproject/Lists/issues/933 -d jNKmS0zFuEh.click -d pjljo54uk.click @@ -25256,23 +25631,36 @@ dvancedhosters.com$doc,domain= -d yuppdownload.com # Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) -d 34.80.59.191 + # Various domains on https://securitytrails•com/list/ip/72•14•178•174 -d megabooru.com -d zombooru.com -d kusubooru.com -d wh40kart.im -d 45.33.2.79 + -d 45.33.18.44 + -d 45.33.20.235 + -d 45.33.23.183 + -d 45.33.30.197 + -d 45.56.79.23 + -d 45.79.19.196 + -d 72.14.178.174 + -d 72.14.185.43 + -d 96.126.123.244 + -d 173.255.194.134 + -d 198.58.118.167 + # https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ -d 123chance.net -d 123links4u.net @@ -25651,11 +26039,17 @@ dvancedhosters.com$doc,domain= -d zebramode.com -d zebraoffers.net -d 34.117.199.78 + -d 94.237.103.119 + -d 94.237.84.54 + -d 94.237.93.242 + -d 94.237.99.118 + -d 139.45.197.249 + # https://dnpedia•com/tlds/topm•php/bizarrely/listing/"anahitagirted•uno"/as the 622th most visited domain worldwide -d acorusinfield.life -d acridlydebit.live @@ -26054,12 +26448,19 @@ dvancedhosters.com$doc,domain= *skobutikks.com *butikksoslo.com -d 196.196.153.151 + -d 158.222.7.116 + -d 196.245.152.139 + -d 165.231.251.197 + -d 196.242.16.29 + -d 165.231.4.90 + -d 158.222.7.83 + # Spam on W.I.T.C.H. and Winx text search results # A scam SMS I got -d 95-214-26-78.plesk.page @@ -26122,6 +26523,7 @@ dvancedhosters.com$doc,domain= -d your-ups-track.com -d zoll-pakete-support.com -d 95.214.26.78 + # Overly dedicated E-mail spammers -d wirexapp.africa.com -d tachyoniums.eu.com @@ -26130,7 +26532,9 @@ dvancedhosters.com$doc,domain= -d ybd001.com -d deltacorriher.best -d 104.21.82.132 + -d 172.67.158.57 + -d [2606:4700:3030::6815:5284] -d [2606:4700:3037::ac43:9e39] # Google results for «SodaStream site:no cranberry» @@ -26157,11 +26561,14 @@ spx?cname=*&cid= -d sirdayscare.info -d slownansuch.info -d 185.155.184.57 + -d 185.155.186.24 + -d usayn.fr -d style-js.com - a.aspx?cid=*&cname= -d 209.74.107.131 + -d qidjrsgroup.shop - flying.asp?cid= - kjyo.php?cname= @@ -26235,7 +26642,9 @@ ed.br ?q=artstation- -d xgptw11vogsh.com -d zeirj14ikqwf.com -d 69.172.200.185 + -d 77.220.214.153 + # More search terms than what can be counted with a supercomputer (11 03 2024) # Scam E-mails I've got -d googleapis.com nwfotrac @@ -26313,6 +26722,7 @@ ed.br ?q=artstation- + # https://github.com/AdguardTeam/AdguardFilters/issues/145513