diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 73e2dd62c..564fc043d 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -68,8 +68,8 @@ ||willyousurvive.com^ ||underthegarden.com^ ||fileplanet.com^ -||inputmapper.com^$denyallow=stolen_by_casino_spammers.* -||henrypp.org^$denyallow=stolen_by_casino_spammers.* +||inputmapper.com^ +||henrypp.org^ ! ——— IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. ——— ||funeducation.com^ ||iq-research.info^ @@ -152,7 +152,7 @@ ||facebook.cm^$denyallow=malware-typo-squatter-of-facebook.com ||wix.cm^$denyallow=malware-typo-squatter-of-wix.com 199.59.243.222 -|http://ww01.$denyallow=very_very_extremely_frequently_used_in_malware_redirections.* +|http://ww01. 173.208.96.42 173.208.96.43 173.208.96.44 @@ -180,7 +180,7 @@ ||ortrun-adi.com^ ||paramonos-oha.com^ ||photios-raj.com^ -||zeroredirect5.com^$denyallow=malware_redirection_trains.* +||zeroredirect5.com^ 54.209.22.226 54.91.125.197 52.202.53.245 @@ -191,7 +191,11 @@ 3.216.243.46 ||roamingclicks.com^ ! Source: desidertNO +||collectfasttracks.com^ ! Various ex-affiliate links at www•zombooru•com +||track.vcdc.com^ +||track.tkbo.com^ +||track.traffic.club^ ||lasvegas-vacations.net^ ||ndsplitter.com^ ||ns1.trafficclub.com^ @@ -618,6 +622,7 @@ ! https://github.com/easylist/easylist/issues/6111 ||fres-news.com^ ||workerz-news.com^ +||zredir.com^ 178.128.142.109 ||findmedia.biz^ ||backtonews.biz^ @@ -669,11 +674,12 @@ ||safe-offers.net^ ! https://github.com/DandelionSprout/adfilt/issues/188 ||gogle.net^ -||best-prizes-202*.com^$denyallow=malware_site.* -||all-best-prize-202*.com^$denyallow=malware_site.* +||best-prizes-202*.com^ +||all-best-prize-202*.com^ ||instantfwding.com^ ||fwdservice.com^ ||kmip.net^ +||0redirc.com^ ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^ 5.8.34.26 5.8.47.3 @@ -791,6 +797,7 @@ ||mediagetplus.com^ ||mgmgmg.com^ ||temp74.com^ +||trackwebclick.com^ 23.111.31.137 23.111.88.207 ! https://github.com/DandelionSprout/adfilt/issues/254 @@ -804,7 +811,7 @@ ||lucdream.com^ ||pesoaniz.com^ ||apsolutamente.com^ -||trc.*.co^$denyallow=malware_redirection_trains.* +||trc.*.co^ ||artofads.co^ ! https://github.com/DandelionSprout/adfilt/pull/266 ! https://www•virustotal•com/gui/domain/kirstialechulbard•space/relations @@ -1080,6 +1087,7 @@ ||delicate-tame-angora.glitch.me^ ||secureinvoice.glitch.me^ ||holy-ruddy-brace.glitch.me^ +||instagramcomphoto212paaatrk.glitch.me^ ||instafollow.glitch.me^ ||loving-discovered-swordfish.glitch.me^ ||aquamarine-cotton-impala.glitch.me^ @@ -1228,6 +1236,7 @@ ||gluegames.xyz^ ! https://twitter•com/iam_py_test/status/1496259425493225472 ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 +/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/ ! https://twitter•com/MBThreatIntel/status/1509956416311742464 ||newsjump.xyz^ ||newsmaven.xyz^ @@ -1249,8 +1258,7 @@ 195.201.253.131 ! The bottom download button on https://www•sushichop•com/ ||installiq.com^ -/trk2/*?lddomain=domain=~very_likely_a_malware_redirection.* -||cpmverdirect.com^$denyallow=malware_redirection_trains.* +||cpmverdirect.com^ 15.197.244.48 96.47.230.67 96.47.230.68 @@ -1265,9 +1273,11 @@ /^78\.128\.112\.[12]?\d?\d$/ /^179\.60\.146\.[12]?\d?\d$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 +||trafredirtds.com^ ! https://github.com/AdguardTeam/AdguardFilters/issues/121772 ||pu020ev.com^ ||kadam.net^ +||kdtrk.net^ ||clcpb.net^ ||kadxin.net^ ||kdmrqw.com^ @@ -1390,6 +1400,10 @@ ||spins-game.icu^ ||spintogreen.com^ ||toprefgtbvatv.com^ +||track2it4.icu^ +||trackerry.com^ +||trackgdi.com^ +||trckrry.com^ ||udlwwle.site^ ||video-stream.club^ ||winn-ex.icu^ @@ -1466,7 +1480,7 @@ 146.19.169.98 146.19.169.99 ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 -/pushredirect/?domain=~malware_redirection_trains.* +/pushredirect/? ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 ||1000girl.com^ ||1000islandsinfo.com^ @@ -2117,6 +2131,7 @@ ||keyrug.com^ ||keysschools.net^ ||keystonehoops.com^ +||keywebtracker.com^ ||keywordadvisetoolplus.com^ ||kickoff.cm^ ||kindfirls.com^ @@ -3022,6 +3037,7 @@ ||alspearowa.com^ ||beskittyan.com^ ||cadbitff.com^ +||clicktracklink.com^ ||getsurv2youu.com^ ||ggetsurveey.com^ ||gggtrenks.com^ @@ -3066,6 +3082,7 @@ ||4.fo^ ||kckb.st^ ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 +-trk.xyz^ ||gsecurecontent.com^ ||pressizer.net^ ||sapino.net^ @@ -4275,8 +4292,9 @@ ||thor-pom.com^ ||thutm-bru.com^ ||uthyr-que.com^ +||zeroredirect1.com^ ||zp-dom.com^ -||redirect.newprogrammatic.click^$denyallow=likely_a_malware_redirection.* +||redirect.newprogrammatic.click^ ||arcad-hoh.com^ ||eadri-fnr.com^ ||gerhi-psv.com^ @@ -4628,6 +4646,8 @@ ||pw-show-ad.com^ ||pw-show-main.com^ ||pw-show-test.com^ +||pwredir-*.com^ +||redir-pw*.com^ ||rich-people-club.com^ ||search-top-videos.com^ ||secret-casino-site.com^ @@ -4986,9 +5006,11 @@ ||online-notifications.com^ ||openthenotification.com^ ||pclkpackg.xyz^ +||pclkredrct.xyz^ ||popular-messages.com^ ||premium-news-for.me^ ||premium-shops-around.me^ +||pushapitracker.com^ ||read-and-reveal.com^ ||read-before-the-rest.com^ ||read-new-post.com^ @@ -5038,6 +5060,7 @@ ||trending-celeb-news.com^ ||trending-gossip.com^ ||trends-celebs.com^ +||ts-tracker.me^ ||updates-news-magazine.com^ ||videochatonlinesite.com^ ||viralvidoes-buzz-blog.com^ @@ -5062,6 +5085,18 @@ ||collecl.cc^ ||defre.net^ ||puredi.net^ +||redic.net^ +||redic2.net^ +||redic3.com^ +||redic4.com^ +||redir2.net^ +||redir3.net^ +||redir4.net^ +||redir5.net^ +||redir6.net^ +||redir7.net^ +||redir8.net^ +||redir9.net^ ||rejco.online^ ||spinwincas.online^ ||tapore.net^ @@ -5584,6 +5619,7 @@ ||rahfnq.com^ ||raybhi.com^ ||rcqmrz.com^ +||redirected1.com^ ||rfduik.com^ ||rgitpv.com^ ||riaeqd.com^ @@ -6112,6 +6148,7 @@ ||searchassured.com^ ||searchequivalents.com^ ||searchexcellent.com^ +||searchingredirect.com^ ||searchinquire.com^ ||searchsimilars.com^ ||searchstarters.com^ @@ -9737,6 +9774,7 @@ ||zapdescendant.com^ ||zapprecisionadmire.com^ ||zealousstraitcommit.com^ +://trk.*.run/ ! https://github.com/AdguardTeam/AdguardFilters/issues/159157 ||apbbjmp.com^ ||awbbgate.com^ @@ -9798,6 +9836,7 @@ ||charutboll.com^ ||chaseverifications.com^ ||cloud-network.online^ +||cmcmdirrect.com^ ||coltersaidas.com^ ||com-96-hours.com^ ||com-96hours.com^ @@ -9921,6 +9960,7 @@ ||paywide.cards^ ||promo-carte-avantages.com^ ||qc1.site^ +||redirect2url.com^ ||revoiut-cy.com^ ||revoke.money^ ||richiediilrimborso.com^ @@ -10129,6 +10169,12 @@ ||usqtvc.com ||usutnr.top ||204.44.92.187 +://ap-trk. +://cw-trk. +://cw-trak. +://ktraks. +://flow-clck. +://apps-trk. ||betzykrisesenter.no^ ||citra2010oslo.no^ ||digiter.no^ @@ -21293,7 +21339,7 @@ http://secured21.*.com/| ||nickswheels.com^ ||spizzicopizza.net^ ! Other -||redirectme.net^$denyallow=malware_redirection_trains.* +||redirectme.net^ ||anthargo.com^ ! Domains on IPs known to host Discord Nitro spambots ||csgocup.ru^ @@ -21906,6 +21952,7 @@ http://secured21.*.com/| ||highlandnews.com^ ||genuinescansupport.com^ ||diverseflowlink.com^ +||redirectedflow.com^ ||pcbasicstrength.com^ ||varietyflow.com^ ||securecertainflow.com^ @@ -21971,7 +22018,7 @@ http://secured21.*.com/| ! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) 34.80.59.191 ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 -|http://www6.$denyallow=often_used_in_malware_redirections.* +|http://www6. ||megabooru.com^ ||zombooru.com^ ||kusubooru.com^ @@ -22026,6 +22073,7 @@ http://secured21.*.com/| ||awesomewinner.com^ ||awesomewinner.net^ ||awesomewinners.net^ +||b2ztrk.com^ ||beastgadget.net^ ||beastoffer.net^ ||beastoffrs.com^ @@ -22345,6 +22393,7 @@ http://secured21.*.com/| ||winnerssite.net^ ||xyzoffer.net^ ||yasdoodl.com^ +||ym3trk.com^ ||youwanthis.com^ ||zebramode.com^ ||zebraoffers.net^ @@ -26507,10 +26556,16 @@ http://secured21.*.com/| ! https://www•drvhub•net/devices/network/asix/ax88178a-usb-2-0-to-gigabit-ethernet-adapter ||az-partners.net^ ! I myself managed to fall for their scam, to the tune of the low-3-digits of Euros. -||divingshop.nl^$denyallow=bank_transaction_scammers.* +||divingshop.nl^ ! Now this one I did not fall for, however. +||gitcoin-passport. +||passport-gitcoin. ! https://news•ycombinator•com/item?id=45308596 +||gitcoin-developers. +||github-foundation. +||gitcoin-grants. ! https://new•reddit•com/r/CryptoScams/comments/1nlma8m/potential_crypto_phishing_scam_masquerading_as/ +||foundation-github. ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^ ||100conversions.com^ @@ -26714,19 +26769,19 @@ http://secured21.*.com/| 198.134.116.30 2a00:8860:10d:1::2:b01 ! Extreme amounts of PUP to a comical extent -||driverpack.io^$denyallow=has_extreme_amounts_of_pup_in_it.* +||driverpack.io^ ! https://github.com/DandelionSprout/adfilt/issues/1124 ||doh-gov.com^ ||doh-gov.ph^ ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. -||unofficialtwrp.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* -||androidweblog.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* -||androidgreek.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* -||ytechb.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* -||gadgetstwist.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* -||gadgetsfarms.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* -||techorfy.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||unofficialtwrp.com^ +||androidweblog.com^ +||androidgreek.com^ +||ytechb.com^ +||gadgetstwist.com^ +||gadgetsfarms.com^ +||techorfy.com^ ! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ——— ! If you use AdGuard Home ≥v0.106.3, I warmly recommend manually pasting these entries into Settings → DNS Settings → Disallowed domains ||version.bind| @@ -26808,28 +26863,28 @@ http://secured21.*.com/| ://ww26.$denyallow=ww26.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* ://ww27.$denyallow=ww27.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* ://ww28.$denyallow=ww28.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww29.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww30.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww31.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww32.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww33.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww34.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww35.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww36.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww37.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww38.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww39.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww40.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww41.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww42.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww43.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww44.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww45.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww46.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww47.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww48.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww49.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* -://ww50.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww29. +://ww30. +://ww31. +://ww32. +://ww33. +://ww34. +://ww35. +://ww36. +://ww37. +://ww38. +://ww39. +://ww40. +://ww41. +://ww42. +://ww43. +://ww44. +://ww45. +://ww46. +://ww47. +://ww48. +://ww49. +://ww50. ! e.g. picnicnetworkORG (04/05/2025) ||1800sweepstakes.com^ ||2soft.com^ diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p index 89aaf14b7..946644414 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p @@ -380,6 +380,7 @@ F:156.245.23.49-156.245.23.49 F:206.119.178.163-206.119.178.163 F:46.101.81.149-46.101.81.149 F:52.15.34.25-52.15.34.25 +F:203.188.171.156-203.188.171.156 F:194.226.139.121-194.226.139.121 F:194.226.139.7-194.226.139.7 F:95.181.157.36-95.181.157.36 diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset index 411c613ac..44251c3af 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset @@ -380,6 +380,7 @@ 206.119.178.163 46.101.81.149 52.15.34.25 +203.188.171.156 194.226.139.121 194.226.139.7 95.181.157.36