From 447ce36291b3a80b4312c536d270caae4789bd1b Mon Sep 17 00:00:00 2001
From: Imre Eilertsen <imreeil42@gmail.com>
Date: Sun, 1 Jun 2025 16:31:21 +0200
Subject: [PATCH] Update Dandelion Sprout's Anti-Malware List.txt

---
 Dandelion Sprout's Anti-Malware List.txt | 110 +++++++++--------------
 1 file changed, 44 insertions(+), 66 deletions(-)

diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt
index 4d4ee5cad..ad68fee81 100644
--- a/Dandelion Sprout's Anti-Malware List.txt	
+++ b/Dandelion Sprout's Anti-Malware List.txt	
@@ -1,6 +1,6 @@
 [Adblock Plus 3.13]
 ! Title: 💊 Dandelion Sprout's Anti-Malware List
-! Version: 29May2025v1
+! Version: 01June2025v1
 ! Expires: 1 day
 ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
 ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -1318,13 +1318,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||videoadblockers.$doc,popup
 ||videoadblockertou.$doc,popup
 ||videoadblockextension.$doc,popup
-!#if !ext_ublock
-://142.91.159.$doc
+$all,ipaddress=/^142\.91\.159\.[12]?\d?\d$/
+$all,ipaddress=/^23\.109\.150\.[12]?\d?\d$/
+$all,ipaddress=/^23\.109\.248\.[12]?\d?\d$/
 ! https://github.com/DandelionSprout/adfilt/issues/942
-/^172\.255\.6\.(\d\d?|[12][0-689]\d|17[0-689])$/
-://23.109.150.$doc
-://23.109.248.$doc
-!#endif
+$all,ipaddress=/^172\.255\.6\.(\d\d?|(17?|2)[0-689]\d)$/
 ||abedwithdrawalautograph.com^$all,~inline-font
 ||abnegateexcavator.com^$all,~inline-font
 ||acceptablefabric.com^$all,~inline-font
@@ -3383,10 +3381,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||zeroclampentice.com^$all,~inline-font
 ||zillionable.com^$all,~inline-font
 !#if !ext_ublock
-://173.233.137.$doc
-://173.233.139.$doc
-://192.243.59.$doc
-://192.243.61.$doc
+$all,ipaddress=/^173\.233\.137\.[12]?\d?\d$/
+$all,ipaddress=/^173\.233\.139\.[12]?\d?\d$/
+$all,ipaddress=/^192\.243\.59\.[12]?\d?\d$/
+$all,ipaddress=/^192\.243\.61\.[12]?\d?\d$/
 !#endif
 ! https://twitter•com/SUNgoddessOKAMI/status/1221295265195405315
 ||deviuser.com^$doc
@@ -4510,11 +4508,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||telemetry-urs-microsoft.com^$all,~inline-font
 ||top-captcharesolver.$all,~inline-font
 ||winrar-desktop.com^$all,~inline-font
-!#if !ext_ublock
-://46.161.27.$doc
-://78.128.112.$doc
-://179.60.146.$doc
-!#endif
+$all,ipaddress=/^46\.161\.27\.[12]?\d?\d$/
+$all,ipaddress=/^78\.128\.112\.[12]?\d?\d$/
+$all,ipaddress=/^179\.60\.146\.[12]?\d?\d$/
 ! https://github.com/AdguardTeam/AdguardFilters/issues/121544
 ||trafredirtds.com^$all,~inline-font,domain=~malware_redirection_trains.*
 ||com/landers/iphone*_spin$doc
@@ -4831,16 +4827,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||z-prize.icu^$all,~inline-font
 ||zfcurqe.art^$all,~inline-font
 ||zuginmw.art^$all,~inline-font
-!#if !ext_ublock
-/^178\.253\.[0-7]\.\d{1,3}$/
-://178.253.14.$doc
-://178.253.15.$doc
-/^178\.253\.2[0145]\\d{1,3}$/
-/^178\.253\.3[04-7]\.\d{1,3}$/
-://178.253.46.$doc
-://178.253.47.$doc
-://178.253.54.$doc
-!#endif
+$all,ipaddress=/^178\.253\.[0-7]\.[12]?\d?\d$/
+$all,ipaddress=/^178\.253\.14\.[12]?\d?\d$/
+$all,ipaddress=/^178\.253\.15\.[12]?\d?\d$/
+$all,ipaddress=/^178\.253\.2[0145]\.[12]?\d?\d$/
+$all,ipaddress=/^178\.253\.3[04-7]\.[12]?\d?\d$/
+$all,ipaddress=/^178\.253\.46\.[12]?\d?\d$/
+$all,ipaddress=/^178\.253\.47\.[12]?\d?\d$/
+$all,ipaddress=/^178\.253\.54\.[12]?\d?\d$/
 ||85.17.31.152^$all,~inline-font
 *$all,ipaddress=85.17.31.152
 ||95.211.26.202^$all,~inline-font
@@ -4862,10 +4856,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 *$all,ipaddress=158.247.212.220
 ||165.227.168.212^$doc
 *$all,ipaddress=165.227.168.212
-!#if !ext_ublock
 ! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
-://162.241.115.$doc
-!#endif
+$all,ipaddress=/^162\.241\.115\.[12]?\d?\d$/
 ! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599
 ||k-yw.com^$all,~inline-font
 ! https://github.com/AdguardTeam/AdguardFilters/issues/125285
@@ -8081,8 +8073,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||zapatillasvejacl.com^$all,~inline-font
 ||zapatosaldochile.org^$all,~inline-font
 !#if !ext_ublock
-://104.160.10.$doc
-://165.231.154.$doc
+$all,ipaddress=/^104\.160\.10\.[12]?\d?\d$/
+$all,ipaddress=/^165\.231\.154\.[12]?\d?\d$/
 !#endif
 ! https://github.com/DandelionSprout/adfilt/issues/748
 ||adidas--*$all,~inline-font
@@ -8813,16 +8805,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||vans-finland.com^$all,~inline-font
 ||martensbratislava.sk^$all,~inline-font
 ||zapatillasmcqueen.com^$all,~inline-font
-!#if !ext_ublock
-://165.231.10.$doc
-://165.231.152.$doc
-://196.196.52.$doc
-://196.196.155.$doc
-://196.240.121.$doc
-://196.242.179.$doc
-://196.245.52.$doc
-://196.245.56.$doc
-!#endif
+$all,ipaddress=/^165\.231\.10\.[12]?\d?\d$/
+$all,ipaddress=/^165\.231\.152\.[12]?\d?\d$/
+$all,ipaddress=/^196\.196\.52\.[12]?\d?\d$/
+$all,ipaddress=/^196\.196\.155\.[12]?\d?\d$/
+$all,ipaddress=/^196\.240\.121\.[12]?\d?\d$/
+$all,ipaddress=/^196\.242\.179\.[12]?\d?\d$/
+$all,ipaddress=/^196\.245\.52\.[12]?\d?\d$/
+$all,ipaddress=/^196\.245\.56\.[12]?\d?\d$/
 ! https://www•bleepingcomputer•com/news/security/hackers-push-malware-via-google-search-ads-for-vlc-7-zip-ccleaner/
 ://rufus.download.$doc,popup
 ://virtualbox.download.$doc,popup
@@ -9499,9 +9489,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||zevaimsu.net^$all,~inline-font
 ||zewoagoo.com^$all,~inline-font
 ||zoozistu.net^$all,~inline-font
-!#if !ext_ublock
-://139.45.197.$doc
-!#endif
+$all,ipaddress=/^139\.45\.197\.[12]?\d?\d$/
 ! https://github.com/AdguardTeam/AdguardFilters/issues/143281
 ||academic-information.com^$all,~inline-font
 ||academicvast.com^$all,~inline-font
@@ -10270,9 +10258,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||moneystartup.live^$all,~inline-font
 ||fintechbest.online^$all,~inline-font
 &trafficsource=Kadam&$doc
-!#if !ext_ublock
-://5.61.60.$doc
-!#endif
+$all,ipaddress=/^5\.61\.60\.[12]?\d?\d$/
 ! https://github.com/AdguardTeam/AdguardFilters/issues/154701
 ||algazira-updates.com^$all,~inline-font
 ||articles-news-magazine.com^$all,~inline-font
@@ -10521,9 +10507,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 /^.*&[a-z]{1,2}=[a-zA-Z0-9]{0,}%[a-zA-Z0-9%]{1000,}$/$doc
 ! https://github.com/AdguardTeam/AdguardFilters/issues/155936
 ||rumadel.com^$all,~inline-font
-!#if !ext_ublock
-://103.224.182.$doc
-!#endif
+$all,ipaddress=/^103\.224\.182\.[12]?\d?\d$/
 ! https://github.com/AdguardTeam/AdguardFilters/issues/156487
 ||apigroup.xyz^$all,~inline-font
 ||apihouse.xyz^$all,~inline-font
@@ -11235,23 +11219,21 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||185.56.234.205^$all,~inline-font
 *$all,ipaddress=185.56.234.205
 ||192.243.58.97^$all,~inline-font
-*$all,ipaddress=192.243.58.97
 ||192.243.58.98^$all,~inline-font
-*$all,ipaddress=192.243.58.98
 ||192.243.58.123^$all,~inline-font
-*$all,ipaddress=192.243.58.123
 ||192.243.58.124^$all,~inline-font
-*$all,ipaddress=192.243.58.124
 ||192.243.58.125^$all,~inline-font
-*$all,ipaddress=192.243.58.125
 ||[2a02:b48:207:1::2]^$all,~inline-font
 ||[2a02:b48:207:1::3]^$all,~inline-font
 ||[2a02:b48:207:1::6]^$all,~inline-font
 ||[2a02:b48:207:1::7]^$all,~inline-font
 ||[2a02:b48:207:1::8]^$all,~inline-font
-!#if !ext_ublock
-://||192.243.58.$doc
-!#endif
+$all,ipaddress=2a02:b48:207:1::2
+$all,ipaddress=2a02:b48:207:1::3
+$all,ipaddress=2a02:b48:207:1::6
+$all,ipaddress=2a02:b48:207:1::7
+$all,ipaddress=2a02:b48:207:1::8
+$all,ipaddress=/^192\.243\.58\.[12]?\d?\d$/
 ! https://github.com/AdguardTeam/AdguardFilters/issues/157308
 ||abdoser.co.in^$all,~inline-font
 ||acelim.co.in^$all,~inline-font
@@ -16288,7 +16270,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
 ||zigse.com^$all,~inline-font
 ||zrl7.com^$all,~inline-font
 ||modreminiapk.com^$all,~inline-font
-://45.141.59.$doc
+$all,ipaddress=/^45\.141\.59\.[12]?\d?\d$/
 ! https://github•com/AdguardTeam/AdguardFilters/issues/176214
 ||basicnetworkhistory.com^$all,~inline-font
 ||chainedconnections.com^$all,~inline-font
@@ -28263,15 +28245,13 @@ toorgle.net##.join
 ||s-arts.pro^$all,~inline-font
 ||skinosoda.online^$all,~inline-font
 ||194.226.139.121^$all,~inline-font
-*$all,ipaddress=194.226.139.121
 ||194.226.139.7^$all,~inline-font
-*$all,ipaddress=194.226.139.7
 ||95.181.157.36^$all,~inline-font
 *$all,ipaddress=95.181.157.36
 ||95.181.172.204^$all,~inline-font
 *$all,ipaddress=95.181.172.204
+$all,ipaddress=/^194\.226\.139\.[12]?\d?\d$/
 !#if !ext_ublock
-://194.226.139.$doc
 ! AS209813 (https://github.com/AdguardTeam/AdguardFilters/issues/114618#issuecomment-1100702530; currently specific to tools that support CIDR blocking)
 ://5.8.67.$doc
 ://5.101.45.$doc
@@ -29670,10 +29650,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
 ||yuzlikmimed.uno^$all,~inline-font
 ||zapsenlight.space^$all,~inline-font
 ||zoqueanbannets.tech^$all,~inline-font
-!#if !ext_ublock
-://188.42.84.$doc
-://203.195.121.$doc
-!#endif
+$all,ipaddress=/^188\.42\.84\.[12]?\d?\d$/
+$all,ipaddress=/^203\.195\.121\.[12]?\d?\d$/
 ! Fake Gymshark webshops
 ||gantdanmark.com^$all,~inline-font
 ||gantnorge.com^$all,~inline-font