From 4af4ba83cb2fb1b7163c993c2b89b7241579b2b5 Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Tue, 16 Nov 2021 09:44:47 +0100 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 101 +++++++++++++++--- .../AntiMalwareAdGuard.txt | 63 +++++++++-- .../AntiMalwareAdGuardHome.txt | 49 +++++++-- .../AntiMalwareDomains.txt | 44 ++++++-- .../AntiMalwareHosts.txt | 44 ++++++-- .../AntiMalwarePrivoxy.action | 44 ++++++-- .../AntiMalwareTPL.tpl | 47 ++++++-- ...out's and other adblocker lists' IPs.ipset | 5 +- 8 files changed, 330 insertions(+), 67 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index f5abf5bfc..845344520 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.6] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdBlock and Adblock Plus) -! Version: 05November2021v1-Beta +! Version: 15November2021v1-Beta ! Expires: 5 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -143,6 +143,17 @@ bing.com##.b_algo:-abp-has(a[href*=".top/"]) ||useragentswitch.com^$popup ||dev-nano.com^ ||dev-nano.com^$popup +! Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=free]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=clean]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=boost]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=boost][href*=clean]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=gratis]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*="201"]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=security]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*="anti.virus"]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*="scanguard"]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=".totalav."]) ! β€”β€”β€” IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. β€”β€”β€” ||funeducation.com^ @@ -335,6 +346,10 @@ softonic.*,softonic-ar.com,softonic-th.com##a[href*="://adblock."] download.cnet.com#?#.c-globalCard:-abp-has(a[href*="/Sir-AdGuard/"]) download.cnet.com#?#.c-globalCard:-abp-has(a[href*="/Ad-Smasher/"]) download.cnet.com#?#.c-globalCard:-abp-has(a[href*="/AdsCleaner/"]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=adblocker]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=".adblock."]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=adsblock]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href$=".adblock"]) ||apps.apple.com/*/app/*/id1564900435^ ! β€”β€”β€” Wrong TLDs of legitimate sites β€”β€”β€” @@ -658,8 +673,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||captcharesolver.com^$popup ||roaddrinkfun.live^ ||roaddrinkfun.live^$popup -||cpmstatsart.com^ -||cpmstatsart.com^$popup ||instantfwding.com^ ||instantfwding.com^$popup ||fwdservice.com^ @@ -2013,11 +2026,12 @@ zombooru.com##a[href="http://www.hard55.com"] ||big5-nigeria.bitkit.dk^$popup ||bromic-staging.bitkit.dk^ ||bromic-staging.bitkit.dk^$popup -! A PUP +! A PUP and scam website ||mycleanpc.com^ ! Related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'ID protection') ||ustechsupport.com^ ||mycleanid.com^ +||iolostore.com^ ! The main website for the MyCleanPC company ||realdefen.se^ ! Vermilion Strike @@ -2127,8 +2141,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||mybetterdl.com^$popup ||p185689.mybetterdl.com^ ||p185689.mybetterdl.com^$popup -||besty-deals.com^ -||besty-deals.com^$popup ||r-tb.com^ ||r-tb.com^$popup ||cdn.hoood.info^ @@ -2161,8 +2173,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||security-scanner.xyz^$popup ||pushmeup.art^ ||pushmeup.art^$popup -||totalav.com^ -||totalav.com^$popup ||c2egp.xyz^ ||c2egp.xyz^$popup ||ese40.xyz^ @@ -2180,14 +2190,8 @@ zombooru.com##a[href="http://www.hard55.com"] /mcafeedirect.jsp /mcafeedirect.jsp$popup,domain=~mcafee.com /beep.mp3^$domain=xyz|club|pro -||beta-one.net^ -||beta-one.net^$popup ||kokotrokot.com^ ||kokotrokot.com^$popup -||besty-deals.com^ -||besty-deals.com^$popup -||totalav.com^ -||totalav.com^$popup ?next_url=,popup ?uclickhash=,popup ! https://www.upwork.com/freelance-jobs/apply/Integarte-push-notification-for-chrome_~013c73ed9282225184/ @@ -2206,6 +2210,73 @@ zombooru.com##a[href="http://www.hard55.com"] ||youvetube.com^$popup ||youutube.com^ ||youutube.com^$popup +! https://github.com/DandelionSprout/adfilt/pull/348 +! https://www.virustotal.com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community +||39.83.80.247^ +||39.83.80.247^$popup +||68.197.33.124^ +||68.197.33.124^$popup +||219.157.21.37^ +||219.157.21.37^$popup +||182.123.141.17^ +||182.123.141.17^$popup +||125.47.243.187^ +||125.47.243.187^$popup +||182.122.196.203^ +||182.122.196.203^$popup +||182.117.231.182^ +||182.117.231.182^$popup +||112.31.211.135^ +||112.31.211.135^$popup +||125.106.63.93^ +||125.106.63.93^$popup +||115.59.197.46^ +||115.59.197.46^$popup +||122.159.29.192^ +||122.159.29.192^$popup +||171.40.0.127^ +||171.40.0.127^$popup +||171.80.219.160^ +||171.80.219.160^$popup +||123.10.65.201^ +||123.10.65.201^$popup +||168.90.205.46^ +||168.90.205.46^$popup +||125.47.205.109^ +||125.47.205.109^$popup +||39.80.147.239^ +||39.80.147.239^$popup +||45.224.171.130^ +||45.224.171.130^$popup +||45.5.209.75^ +||45.5.209.75^$popup +||116.17.210.157^ +||116.17.210.157^$popup +||27.45.103.240^ +||27.45.103.240^$popup +||110.167.64.171^ +||110.167.64.171^$popup +||39.81.117.73^ +||39.81.117.73^$popup +||183.15.90.156^ +||183.15.90.156^$popup +||119.113.248.74^ +||119.113.248.74^$popup +||175.0.95.85^ +||175.0.95.85^$popup +||61.52.99.109^ +||61.52.99.109^$popup +||222.142.183.194^ +||222.142.183.194^$popup +||106.86.172.194^ +||106.86.172.194^$popup +||103.233.216.77^ +||103.233.216.77^$popup +||183.188.192.55^ +||183.188.192.55^$popup +! https://www.virustotal.com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community +||198.23.255.14^ +||198.23.255.14^$popup ! β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -11993,7 +12064,7 @@ toorgle.net##.join ||discorclnitro.ru^ ||discorclnitro.ru^$popup ||discord*.gift^ -||discord*.gift^$popup +||discord*.gift^$popup,domain=~discord.gift ||discord*.gifts^ ||discord*.gifts^$popup ||discord-app.net^ diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 3dac1831f..5cf838c3e 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ [AdGuard versions from β‰₯2019] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 05November2021v1-Beta +! Version: 15November2021v1-Beta ! Expires: 5 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -140,6 +140,17 @@ bing.com##.b_algo:has(a[href*=".top/"]) 138.68.252.54$network ||useragentswitch.com^$empty,important ||dev-nano.com^$empty,important +! Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=free]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=clean]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=boost]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=boost][href*=clean]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=gratis]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*="201"]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=antivirus][href*=security]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*="anti.virus"]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*="scanguard"]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=".totalav."]) ! β€”β€”β€” IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. β€”β€”β€” ||funeducation.com^$document @@ -332,6 +343,10 @@ softonic.*,softonic-ar.com,softonic-th.com##a[href*="://adblock."] download.cnet.com#?#.c-globalCard:-abp-has(a[href*="/Sir-AdGuard/"]) download.cnet.com#?#.c-globalCard:-abp-has(a[href*="/Ad-Smasher/"]) download.cnet.com#?#.c-globalCard:-abp-has(a[href*="/AdsCleaner/"]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=adblocker]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=".adblock."]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href*=adsblock]) +play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:-abp-has([href$=".adblock"]) ||apps.apple.com/*/app/*/id1564900435^$document ! β€”β€”β€” Wrong TLDs of legitimate sites β€”β€”β€” @@ -557,7 +572,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||captcharesolving-universe.com^$empty,important ||captcharesolver.com^$empty,important ||roaddrinkfun.live^$empty,important -||cpmstatsart.com^$empty,important ||instantfwding.com^$empty,important ||fwdservice.com^$empty,important ||gamesex.fun^$empty,important @@ -1328,11 +1342,12 @@ zombooru.com##a[href="http://www.hard55.com"] ||big5constructnigeria-staging.bitkit.dk^$empty,important ||big5-nigeria.bitkit.dk^$empty,important ||bromic-staging.bitkit.dk^$empty,important -! A PUP +! A PUP and scam website ||mycleanpc.com^$document ! Related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'ID protection') ||ustechsupport.com^$document ||mycleanid.com^$document +||iolostore.com^$document ! The main website for the MyCleanPC company ||realdefen.se^$document ! Vermilion Strike @@ -1400,7 +1415,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||yotube.com^$empty,important ||mybetterdl.com^$empty,important ||p185689.mybetterdl.com^$empty,important -||besty-deals.com^$empty,important ||r-tb.com^$empty,important ||cdn.hoood.info^$empty,important ||data-px.services^$empty,important @@ -1417,7 +1431,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||welcomejohncena.pro^$empty,important ||security-scanner.xyz^$empty,important ||pushmeup.art^$empty,important -||totalav.com^$empty,important ||c2egp.xyz^$empty,important ||ese40.xyz^$empty,important ||e07wm.xyz^$empty,important @@ -1428,10 +1441,7 @@ zombooru.com##a[href="http://www.hard55.com"] &url_bnm_redirect=$empty,important /mcafeedirect.jsp$all,domain=~mcafee.com /beep.mp3^$domain=xyz|club|pro -||beta-one.net^$empty,important ||kokotrokot.com^$empty,important -||besty-deals.com^$empty,important -||totalav.com^$empty,important ?next_url=$document,popup ?uclickhash=$document,popup ! https://www.upwork.com/freelance-jobs/apply/Integarte-push-notification-for-chrome_~013c73ed9282225184/ @@ -1443,6 +1453,41 @@ zombooru.com##a[href="http://www.hard55.com"] ||mediadlvr.com^$empty,important ||youvetube.com^$empty,important ||youutube.com^$empty,important +! https://github.com/DandelionSprout/adfilt/pull/348 +! https://www.virustotal.com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community +39.83.80.247$network +68.197.33.124$network +219.157.21.37$network +182.123.141.17$network +125.47.243.187$network +182.122.196.203$network +182.117.231.182$network +112.31.211.135$network +125.106.63.93$network +115.59.197.46$network +122.159.29.192$network +171.40.0.127$network +171.80.219.160$network +123.10.65.201$network +168.90.205.46$network +125.47.205.109$network +39.80.147.239$network +45.224.171.130$network +45.5.209.75$network +116.17.210.157$network +27.45.103.240$network +110.167.64.171$network +39.81.117.73$network +183.15.90.156$network +119.113.248.74$network +175.0.95.85$network +61.52.99.109$network +222.142.183.194$network +106.86.172.194$network +103.233.216.77$network +183.188.192.55$network +! https://www.virustotal.com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community +198.23.255.14$network ! β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -6357,7 +6402,7 @@ toorgle.net##.join ||discorci.com^$empty,important ||discorcl-air.xyz^$empty,important ||discorclnitro.ru^$empty,important -||discord*.gift^$empty,important +||discord*.gift^$all,domain=~discord.gift ||discord*.gifts^$empty,important ||discord-app.net^$empty,important ||discord-give.$empty,important diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 7c7afd1ea..8a6af6114 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.6] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard Home, and for AdGuard for Android/Windows' DNS filtering) -! Version: 05November2021v1-Beta +! Version: 15November2021v1-Beta ! Expires: 5 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -91,6 +91,7 @@ 138.68.252.54 ||useragentswitch.com^ ||dev-nano.com^ +! Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. ! β€”β€”β€” IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. β€”β€”β€” ||funeducation.com^ @@ -414,7 +415,6 @@ ||captcharesolving-universe.com^ ||captcharesolver.com^ ||roaddrinkfun.live^ -||cpmstatsart.com^ ||instantfwding.com^ ||fwdservice.com^ ||gamesex.fun^ @@ -1185,11 +1185,12 @@ ||big5constructnigeria-staging.bitkit.dk^ ||big5-nigeria.bitkit.dk^ ||bromic-staging.bitkit.dk^ -! A PUP +! A PUP and scam website ||mycleanpc.com^ ! Related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'ID protection') ||ustechsupport.com^ ||mycleanid.com^ +||iolostore.com^ ! The main website for the MyCleanPC company ||realdefen.se^ ! Vermilion Strike @@ -1257,7 +1258,6 @@ ||yotube.com^ ||mybetterdl.com^ ||p185689.mybetterdl.com^ -||besty-deals.com^ ||r-tb.com^ ||cdn.hoood.info^ ||data-px.services^ @@ -1274,7 +1274,6 @@ ||welcomejohncena.pro^ ||security-scanner.xyz^ ||pushmeup.art^ -||totalav.com^ ||c2egp.xyz^ ||ese40.xyz^ ||e07wm.xyz^ @@ -1285,10 +1284,7 @@ /mcafeedirect.jsp$all,~mcafee.com /beep.mp3^$xyz|club|pro -||beta-one.net^ ||kokotrokot.com^ -||besty-deals.com^ -||totalav.com^ ?next_url=popup ?uclickhash=popup ! https://www.upwork.com/freelance-jobs/apply/Integarte-push-notification-for-chrome_~013c73ed9282225184/ @@ -1300,6 +1296,41 @@ ||mediadlvr.com^ ||youvetube.com^ ||youutube.com^ +! https://github.com/DandelionSprout/adfilt/pull/348 +! https://www.virustotal.com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community +39.83.80.247 +68.197.33.124 +219.157.21.37 +182.123.141.17 +125.47.243.187 +182.122.196.203 +182.117.231.182 +112.31.211.135 +125.106.63.93 +115.59.197.46 +122.159.29.192 +171.40.0.127 +171.80.219.160 +123.10.65.201 +168.90.205.46 +125.47.205.109 +39.80.147.239 +45.224.171.130 +45.5.209.75 +116.17.210.157 +27.45.103.240 +110.167.64.171 +39.81.117.73 +183.15.90.156 +119.113.248.74 +175.0.95.85 +61.52.99.109 +222.142.183.194 +106.86.172.194 +103.233.216.77 +183.188.192.55 +! https://www.virustotal.com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community +198.23.255.14 ! β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -6212,7 +6243,7 @@ ||discorci.com^ ||discorcl-air.xyz^ ||discorclnitro.ru^ -||discord*.gift^ +||discord*.gift^$all,~discord.gift ||discord*.gifts^ ||discord-app.net^ ||discord-give. diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 3a86112b3..5fe5a1f34 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 05November2021v1-Beta +# Version: 15November2021v1-Beta # Expires: 5 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -87,6 +87,7 @@ ublock.org 138.68.252.54 useragentswitch.com dev-nano.com +# Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. # β€”β€”β€” IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. β€”β€”β€” funeducation.com @@ -358,7 +359,6 @@ extragifis.site captcharesolving-universe.com captcharesolver.com roaddrinkfun.live -cpmstatsart.com instantfwding.com fwdservice.com gamesex.fun @@ -1032,11 +1032,12 @@ thehotelshowdev.bitkit.dk big5constructnigeria-staging.bitkit.dk big5-nigeria.bitkit.dk bromic-staging.bitkit.dk -# A PUP +# A PUP and scam website mycleanpc.com # Related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'ID protection') ustechsupport.com mycleanid.com +iolostore.com # The main website for the MyCleanPC company realdefen.se # Vermilion Strike @@ -1087,7 +1088,6 @@ citationsherbe.at yotube.com mybetterdl.com p185689.mybetterdl.com -besty-deals.com r-tb.com cdn.hoood.info data-px.services @@ -1104,7 +1104,6 @@ m6ydd.xyz welcomejohncena.pro security-scanner.xyz pushmeup.art -totalav.com c2egp.xyz ese40.xyz e07wm.xyz @@ -1113,10 +1112,7 @@ steamhistory-offer.xyz -beta-one.net kokotrokot.com -besty-deals.com -totalav.com premiumbros.com @@ -1126,6 +1122,38 @@ safejokesearch.com mediadlvr.com youvetube.com youutube.com +39.83.80.247 +68.197.33.124 +219.157.21.37 +182.123.141.17 +125.47.243.187 +182.122.196.203 +182.117.231.182 +112.31.211.135 +125.106.63.93 +115.59.197.46 +122.159.29.192 +171.40.0.127 +171.80.219.160 +123.10.65.201 +168.90.205.46 +125.47.205.109 +39.80.147.239 +45.224.171.130 +45.5.209.75 +116.17.210.157 +27.45.103.240 +110.167.64.171 +39.81.117.73 +183.15.90.156 +119.113.248.74 +175.0.95.85 +61.52.99.109 +222.142.183.194 +106.86.172.194 +103.233.216.77 +183.188.192.55 +198.23.255.14 # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” downloadprovider.me diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index a42752630..03b61abe8 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Β«hostsΒ» file version) -# Version: 05November2021v1-Alpha +# Version: 15November2021v1-Alpha # Expires: 5 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -87,6 +87,7 @@ 127.0.0.1 138.68.252.54 127.0.0.1 useragentswitch.com 127.0.0.1 dev-nano.com +# Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. # β€”β€”β€” IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. β€”β€”β€” 127.0.0.1 funeducation.com @@ -358,7 +359,6 @@ 127.0.0.1 captcharesolving-universe.com 127.0.0.1 captcharesolver.com 127.0.0.1 roaddrinkfun.live -127.0.0.1 cpmstatsart.com 127.0.0.1 instantfwding.com 127.0.0.1 fwdservice.com 127.0.0.1 gamesex.fun @@ -1032,11 +1032,12 @@ 127.0.0.1 big5constructnigeria-staging.bitkit.dk 127.0.0.1 big5-nigeria.bitkit.dk 127.0.0.1 bromic-staging.bitkit.dk -# A PUP +# A PUP and scam website 127.0.0.1 mycleanpc.com # Related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'ID protection') 127.0.0.1 ustechsupport.com 127.0.0.1 mycleanid.com +127.0.0.1 iolostore.com # The main website for the MyCleanPC company 127.0.0.1 realdefen.se # Vermilion Strike @@ -1087,7 +1088,6 @@ 127.0.0.1 yotube.com 127.0.0.1 mybetterdl.com 127.0.0.1 p185689.mybetterdl.com -127.0.0.1 besty-deals.com 127.0.0.1 r-tb.com 127.0.0.1 cdn.hoood.info 127.0.0.1 data-px.services @@ -1104,7 +1104,6 @@ 127.0.0.1 welcomejohncena.pro 127.0.0.1 security-scanner.xyz 127.0.0.1 pushmeup.art -127.0.0.1 totalav.com 127.0.0.1 c2egp.xyz 127.0.0.1 ese40.xyz 127.0.0.1 e07wm.xyz @@ -1113,10 +1112,7 @@ -127.0.0.1 beta-one.net 127.0.0.1 kokotrokot.com -127.0.0.1 besty-deals.com -127.0.0.1 totalav.com 127.0.0.1 premiumbros.com @@ -1126,6 +1122,38 @@ 127.0.0.1 mediadlvr.com 127.0.0.1 youvetube.com 127.0.0.1 youutube.com +127.0.0.1 39.83.80.247 +127.0.0.1 68.197.33.124 +127.0.0.1 219.157.21.37 +127.0.0.1 182.123.141.17 +127.0.0.1 125.47.243.187 +127.0.0.1 182.122.196.203 +127.0.0.1 182.117.231.182 +127.0.0.1 112.31.211.135 +127.0.0.1 125.106.63.93 +127.0.0.1 115.59.197.46 +127.0.0.1 122.159.29.192 +127.0.0.1 171.40.0.127 +127.0.0.1 171.80.219.160 +127.0.0.1 123.10.65.201 +127.0.0.1 168.90.205.46 +127.0.0.1 125.47.205.109 +127.0.0.1 39.80.147.239 +127.0.0.1 45.224.171.130 +127.0.0.1 45.5.209.75 +127.0.0.1 116.17.210.157 +127.0.0.1 27.45.103.240 +127.0.0.1 110.167.64.171 +127.0.0.1 39.81.117.73 +127.0.0.1 183.15.90.156 +127.0.0.1 119.113.248.74 +127.0.0.1 175.0.95.85 +127.0.0.1 61.52.99.109 +127.0.0.1 222.142.183.194 +127.0.0.1 106.86.172.194 +127.0.0.1 103.233.216.77 +127.0.0.1 183.188.192.55 +127.0.0.1 198.23.255.14 # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” 127.0.0.1 downloadprovider.me diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index c7cab5455..4fcb865e6 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 05November2021v1-Alpha +# Version: 15November2021v1-Alpha # Expires: 5 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -95,6 +95,7 @@ +# Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. {+block} # β€”β€”β€” IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. β€”β€”β€” @@ -872,7 +873,6 @@ - # Relations to the original domain @@ -1056,11 +1056,12 @@ -# A PUP +# A PUP and scam website # Related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'ID protection') + # The main website for the MyCleanPC company # Vermilion Strike @@ -1128,17 +1129,12 @@ - - /mcafeedirect.jsp /beep.mp3 - - - ?next_url= ?uclickhash= @@ -1149,6 +1145,38 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + {+block} # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 3d2333cf1..adf6b1196 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 05November2021v1-Beta +# Version: 15November2021v1-Beta : expires = 5 # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -138,6 +138,7 @@ msFilterList -d 138.68.252.54 -d useragentswitch.com -d dev-nano.com +# Presumed to be fraudulent antivirus extensions on app extension sites where it's perfectly probable that everyday people could install them. # β€”β€”β€” IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. β€”β€”β€” -d funeducation.com @@ -461,7 +462,6 @@ msFilterList -d captcharesolving-universe.com -d captcharesolver.com -d roaddrinkfun.live --d cpmstatsart.com -d instantfwding.com -d fwdservice.com -d gamesex.fun @@ -1229,11 +1229,12 @@ msFilterList -d big5constructnigeria-staging.bitkit.dk -d big5-nigeria.bitkit.dk -d bromic-staging.bitkit.dk -# A PUP +# A PUP and scam website -d mycleanpc.com # Related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'ID protection') -d ustechsupport.com -d mycleanid.com +-d iolostore.com # The main website for the MyCleanPC company -d realdefen.se # Vermilion Strike @@ -1300,7 +1301,6 @@ msFilterList -d yotube.com -d mybetterdl.com -d p185689.mybetterdl.com --d besty-deals.com -d r-tb.com -d cdn.hoood.info -d data-px.services @@ -1317,7 +1317,6 @@ msFilterList -d welcomejohncena.pro -d security-scanner.xyz -d pushmeup.art --d totalav.com -d c2egp.xyz -d ese40.xyz -d e07wm.xyz @@ -1328,10 +1327,7 @@ msFilterList &url_bnm_redirect= - mcafeedirect.jsp - beep.mp3 --d beta-one.net -d kokotrokot.com --d besty-deals.com --d totalav.com ?next_url= ?uclickhash= # https://www.upwork.com/freelance-jobs/apply/Integarte-push-notification-for-chrome_~013c73ed9282225184/ @@ -1343,6 +1339,41 @@ msFilterList -d mediadlvr.com -d youvetube.com -d youutube.com +# https://github.com/DandelionSprout/adfilt/pull/348 +# https://www.virustotal.com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community +-d 39.83.80.247 +-d 68.197.33.124 +-d 219.157.21.37 +-d 182.123.141.17 +-d 125.47.243.187 +-d 182.122.196.203 +-d 182.117.231.182 +-d 112.31.211.135 +-d 125.106.63.93 +-d 115.59.197.46 +-d 122.159.29.192 +-d 171.40.0.127 +-d 171.80.219.160 +-d 123.10.65.201 +-d 168.90.205.46 +-d 125.47.205.109 +-d 39.80.147.239 +-d 45.224.171.130 +-d 45.5.209.75 +-d 116.17.210.157 +-d 27.45.103.240 +-d 110.167.64.171 +-d 39.81.117.73 +-d 183.15.90.156 +-d 119.113.248.74 +-d 175.0.95.85 +-d 61.52.99.109 +-d 222.142.183.194 +-d 106.86.172.194 +-d 103.233.216.77 +-d 183.188.192.55 +# https://www.virustotal.com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community +-d 198.23.255.14 # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” # http://www.toorgle.net/results.php?q=fetishkitsch&security=666 diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset index 1d1a1dcbd..b6d9f6510 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset @@ -1,5 +1,5 @@ # Title: Dandelion Sprout's and other adblocker lists' IPs -# Version: 03November2021v1-Beta +# Version: 05November2021v1-Beta # Expires: 5 days # Description: This IP set combines IP and CIDR addresses from plentiful of major adblocker lists. It contains heavily altered content from Dandelion Sprout's Anti-Malware List, Dandelion Sprout's Nordic Filters, EasyList, uBlock Filters, uBlock Filters - Badware Risks, AdGuard Base Filter, AdGuard French Filter, EasyList Germany, ABP Anti-Circumvention Filters, RU AdList, Liste AR, and EasyList Spanish. # For more information and details about this list and other lists of mine, go to https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english @@ -210,6 +210,8 @@ 176.31.68.242 185.147.34.126 23.109.150.101 +23.109.248.149 +23.109.248.159 23.109.82.104 23.109.82.74 5.45.79.15 @@ -221,7 +223,6 @@ 35.226.75.50 35.224.227.218 35.238.205.163 -37.1.209.213 91.241.60.117 91.241.60.119 146.59.188.42