From 515fef2047b3b793e3a6e26836de902fd52cf428 Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Tue, 6 Oct 2020 21:58:46 +0200 Subject: [PATCH] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 374 +++++++++++------------ 1 file changed, 186 insertions(+), 188 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index b4ba1e1f8..29b389886 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.4] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List -! Version: 04October2020v1-Beta +! Version: 06October2020v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -21,11 +21,11 @@ ! Palau ||pw^$doc,domain=~libgen.pw|~petridish.pw|~palaugov.pw|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers. ! International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. -||loan^$doc,domain=~ Warning displayed due to: It's a topical domain whose sites have an unusally big chance of being fraudulent. -||agency^$doc,domain=~ Warning displayed due to: It's a topical domain whose sites have an unusally big chance of being fraudulent. -||gdn^$doc,domain=~ Warning displayed due to: It's a topical domain whose sites have an unusally big chance of being fraudulent. -||bid^$doc,domain=~ Warning displayed due to: Being a very frequently abused TLD in EasyList entries. -||top^$doc,domain=~ Warning displayed due to: Being a very frequently abused TLD by malware pushers. +||loan^$doc +||agency^$doc +||gdn^$doc +||bid^$doc +||top^$doc ! β€”β€”β€” Attempted removal of Google search result entries that lead to the above top-level domains (Advanced adblockers only) β€”β€”β€” google.*##.rc:has(a[href*=".tk/"]:not([href*="coolcmd.tk"]):not([href*="budterence.tk"]):not([href*="google.tk"]):not([href*="transportnews.tk"]):not([href*="unicorncardlist.tk"]):not([href*="c0d3c.tk"]):not([href*="anonytext.tk"]):not([href*="tokelau-info.tk"]):not([href*="fakaofo.tk"]):not([href*="loljp-wiki.tk"]):not([href*="ninetail.tk"]):not([href*="goshujin.tk"]):not([href*="graph.tk"]):not([href*="haopro.tk"]):not([href*="ps2online.tk"]):not([href*="nolfrevival.tk"]):not([href*="steamroller.tk"])) @@ -63,54 +63,54 @@ google.*##a[oncontextmenu][href^="https://books.google."]:upward(2) ! β€”β€”β€” Old dead tech-related domains β€”β€”β€” ! Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. -||adblock.gjtech.net^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and has been picked up by malware pushers. -||spam404bl.com^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||109.201.135.46^$doc,domain=~ Warning displayed due to: Malware pushers. -||hufilter.hu^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||fredfiber.no^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||securemecca.com^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||1hos.cf^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||1hosts.cf^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||everythingisnt.com^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||vin-plastiks.com^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||adblock-listefr.com^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||intr0.cf^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||njabl.org^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||dutchmega.nl^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||juvander.net^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. -||ssl.bblck.me^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. +||adblock.gjtech.net^$doc +||spam404bl.com^$doc +||109.201.135.46^$doc +||hufilter.hu^$doc +||fredfiber.no^$doc +||securemecca.com^$doc +||1hos.cf^$doc +||1hosts.cf^$doc +||everythingisnt.com^$doc +||vin-plastiks.com^$doc +||adblock-listefr.com^$doc +||intr0.cf^$doc +||njabl.org^$doc +||dutchmega.nl^$doc +||juvander.net^$doc +||ssl.bblck.me^$doc ! Malicious domains found in videogame manuals -||acclaimsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now pushing malware. -||acclaimmaxsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now promoting fake consumer loans. -||hip-games.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. -||thq.com.au^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. -||gp32.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. +||acclaimsports.com^$doc +||acclaimmaxsports.com^$doc +||hip-games.com^$doc +||thq.com.au^$doc +||gp32.com^$doc ! Dead router connection URΔ°s ! To log in to TP-Link routers, use tplinkwifi.net instead. -||tplinklogin.net^$doc,domain=~ Warning displayed due to: TP-Link embarrasingly losing the rights to that router login domain; and it may have been snapped up by malware pushers. Please try tplinkwifi.net instead. -||tplinkextender.net^$doc,domain=~ Warning displayed due to: TP-Link embarrasingly losing the rights to that router login domain; and it has been snapped up by malware pushers. Please try tplinkwifi.net instead. +||tplinklogin.net^$doc +||tplinkextender.net^$doc ! Old Linux-related domains ! How these links still remain in Unetbootin, is anyone's guess. -||dreamlinux.com.br^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. -||dreamlinux.net^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. -||dreamlinux.info^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. -||hacktolive.org^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. -||mandriva.com^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. +||dreamlinux.com.br^$doc +||dreamlinux.net^$doc +||dreamlinux.info^$doc +||hacktolive.org^$doc +||mandriva.com^$doc ! Other -||ublock.org^$doc,domain=~ Warning displayed due to: It playing on its old similarities with uBlock Origin to solicit large donations for limited work effort. -||138.68.252.54^$doc,domain=~ Warning displayed due to: It playing on its old similarities with uBlock Origin to solicit large donations for limited work effort. +||ublock.org^$doc +||138.68.252.54^$doc ! β€”β€”β€” IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. β€”β€”β€” -||funeducation.com^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -||iq-research.info^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -||iq-test-online.org^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -||iq-test.co.uk^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -||iqtest.co.uk^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -||iqtest.com^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -||iqtestnow.org^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -||iqtestonline24.com^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -||test-iq.org^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -||officialiqtests.com^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. +||funeducation.com^$doc +||iq-research.info^$doc +||iq-test-online.org^$doc +||iq-test.co.uk^$doc +||iqtest.co.uk^$doc +||iqtest.com^$doc +||iqtestnow.org^$doc +||iqtestonline24.com^$doc +||test-iq.org^$doc +||officialiqtests.com^$doc ! β€”β€”β€” Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware β€”β€”β€” ! ReImagePlus (Also added to "uBlock Filters - Badware Risks") @@ -196,42 +196,42 @@ msn.com##.irisbanner ! β€”β€”β€” Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) β€”β€”β€” ! If you're in a situation where you need to torrent something, such as for hard-to-buy or region-locked games, or games that you own for consoles that lack accessible rip tools, you can at least try to use sites that have legit downloads with the actual game files. -||gamecopyworld.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files. -||coolrom.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files. -||freeroms.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files. -||portalroms.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files. -||romsmania.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files. -||loveroms.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files. -||portableroms.com^$doc,domain=~ Warning displayed due to: Questionable download site whose non-ad download links can contain malware .exe files. +||gamecopyworld.com^$doc +||coolrom.com^$doc +||freeroms.com^$doc +||portalroms.com^$doc +||romsmania.com^$doc +||loveroms.com^$doc +||portableroms.com^$doc ! β€”β€”β€” Entries from Β«abuse.ch ZeuS BlocklistΒ», which was discontinued on the 8th of July 2019. β€”β€”β€” -||afobal.cl^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||alvoportas.com.br^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||blogerjijer.pw^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||bright.su^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||domnicpeter.in.net^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||dzitech.net^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||fadzulani.com^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||hruner.com^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||interlogistics.com.vn^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||ivansaru.418.com1.ru^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||jangasm.org^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||kesikelyaf.com^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||ns511849.ip-192-99-19.net^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||ns513726.ip-192-99-148.net^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||panel.vargakragard.se^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||sanyai-love.rmu.ac.th^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||servmill.com^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||ssl.sinergycosmetics.com^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||telefonfiyatlari.org^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||update.rifugiopontese.it^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||vodahelp.sytes.net^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||nikey.cn^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. -||witkey.com^$doc,domain=~ Warning displayed due to: Believed to contain the ZeuS trojan as of the 7th of July 2019. +||afobal.cl^$doc +||alvoportas.com.br^$doc +||blogerjijer.pw^$doc +||bright.su^$doc +||domnicpeter.in.net^$doc +||dzitech.net^$doc +||fadzulani.com^$doc +||hruner.com^$doc +||interlogistics.com.vn^$doc +||ivansaru.418.com1.ru^$doc +||jangasm.org^$doc +||kesikelyaf.com^$doc +||ns511849.ip-192-99-19.net^$doc +||ns513726.ip-192-99-148.net^$doc +||panel.vargakragard.se^$doc +||sanyai-love.rmu.ac.th^$doc +||servmill.com^$doc +||ssl.sinergycosmetics.com^$doc +||telefonfiyatlari.org^$doc +||update.rifugiopontese.it^$doc +||vodahelp.sytes.net^$doc +||nikey.cn^$doc +||witkey.com^$doc ! β€”β€”β€” Truly extraordinarily cases of sites so bad that it counts as malware that directly affects human brains β€”β€”β€” ! https://www.reddit.com/r/insanepeoplefacebook/comments/czvv5i/incel_tracking_down_a_mother_of_a_murdered/ -||incels.co^$doc,domain=~ Warning displayed due to: Being so super-ultra-toxic that it counts as malware that directly affect human brains. +||incels.co^$doc ! β€”β€”β€” Browser extension store entries for notoriously poor or malicious adblocker forks β€”β€”β€” ! Note: Currently the entries only work properly on AdGuard for Windows/Mac, due to what seems to be limitations placed on browser extensions. @@ -265,75 +265,75 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Easy AdBlock) addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker Genius Pro) addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! Homepages -||adblock.biz^$doc,domain=~ Warning displayed due to: Low-quality or malicious adblocker. -||the1adblocker.com^$doc,domain=~ Warning displayed due to: Low-quality or malicious adblocker. +||adblock.biz^$doc +||the1adblocker.com^$doc ! β€”β€”β€” Wrong suffixes of legitimate sites β€”β€”β€” ! https://new.reddit.com/r/dwarffortress/comments/e4srco/be_sure_to_use_org_instead_of_com_when_going_to/ -||dwarffortresswiki.com^$doc,domain=~ Warning displayed due to: Malicious version of domain; please use .org instead. +||dwarffortresswiki.com^$doc ||103.224.212.249^$doc -||speedtest.com^$doc,domain=~ Warning displayed due to: Malicious version of domain; please use .net instead. +||speedtest.com^$doc ! β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” -||ppc.netnet44.net^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of otherwise innocuous sites. -||tncrun.net^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of otherwise innocuous sites. -||amanda.*.net^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||sarah.*.net^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||pamela.*.net^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||jessica.*.net^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||katie.*.net^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||emily.*.net^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||54.174.156.141^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of otherwise innocuous sites. -||lucretius-ada.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||tango-deg.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||ezekiel-sam.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||franciscus-ful.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||hippolyte-hag.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||india-abc.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||leontius-eli.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||mohini-ger.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||nethaneel-has.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||ortrun-adi.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||paramonos-oha.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||paula-secundinus.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||photios-raj.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||proserpina-zeb.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||ieronimus-kay.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||fredagty.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||lordagty.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||madagty.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||onsdagty.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||zeroredirect5.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||54.209.22.226^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||54.91.125.197^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||52.202.53.245^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||35.175.38.64^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||35.168.147.213^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||34.230.160.215^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||3.226.8.132^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||3.216.243.46^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||maowaotodowoo.net^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||roamingclicks.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. +||ppc.netnet44.net^$doc +||tncrun.net^$doc +||amanda.*.net^$doc +||sarah.*.net^$doc +||pamela.*.net^$doc +||jessica.*.net^$doc +||katie.*.net^$doc +||emily.*.net^$doc +||54.174.156.141^$doc +||lucretius-ada.com^$doc +||tango-deg.com^$doc +||ezekiel-sam.com^$doc +||franciscus-ful.com^$doc +||hippolyte-hag.com^$doc +||india-abc.com^$doc +||leontius-eli.com^$doc +||mohini-ger.com^$doc +||nethaneel-has.com^$doc +||ortrun-adi.com^$doc +||paramonos-oha.com^$doc +||paula-secundinus.com^$doc +||photios-raj.com^$doc +||proserpina-zeb.com^$doc +||ieronimus-kay.com^$doc +||fredagty.com^$doc +||lordagty.com^$doc +||madagty.com^$doc +||onsdagty.com^$doc +||zeroredirect5.com^$doc +||54.209.22.226^$doc +||54.91.125.197^$doc +||52.202.53.245^$doc +||35.175.38.64^$doc +||35.168.147.213^$doc +||34.230.160.215^$doc +||3.226.8.132^$doc +||3.216.243.46^$doc +||maowaotodowoo.net^$doc +||roamingclicks.com^$doc ! Source: demonoid.pw -||veremund-hon.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. +||veremund-hon.com^$doc ! Source: desidert.no -||collectfasttracks.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. +||collectfasttracks.com^$doc ! Source: vn-zoom.com -||ttnrd.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||amanda.*.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||katie.*.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||briana.*.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||sarah.*.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||pamela.*.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||54.152.245.247^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||35.172.40.232^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. -||3.90.125.85^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. +||ttnrd.com^$doc +||amanda.*.com^$doc +||katie.*.com^$doc +||briana.*.com^$doc +||sarah.*.com^$doc +||pamela.*.com^$doc +||54.152.245.247^$doc +||35.172.40.232^$doc +||3.90.125.85^$doc ! β€”β€”β€” Found in random witness reports online β€”β€”β€” ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 ||deviuser.com^$doc ! https://github.com/AdguardTeam/AdguardFilters/issues/61838 -/scan-update-and-protect-your-browser.html$doc,domain=~ Warning displayed due to: Fake site that tries to get you to install viruses. +/scan-update-and-protect-your-browser.html$doc ! https://github.com/AdguardTeam/AdguardFilters/issues/61755 ! https://github.com/AdguardTeam/AdguardFilters/issues/61743 /://(www\.)?cunt[a-z]{3,8}\.com(/|$)/ @@ -349,13 +349,12 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! β€”β€”β€” Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. -||unofficialtwrp.com^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones. -||androidweblog.com^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones. -||hardreset.info^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones. +||unofficialtwrp.com^$doc +||androidweblog.com^$doc +||hardreset.info^$doc ! β€”β€”β€” If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions β€”β€”β€” -!#if !ext_ublock -!#if !adguard +!#if no ||version.bind^ |pizzaseo.com^ ||version.server^ @@ -364,13 +363,12 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ||hitnslab.cn^ ||hitnslab.xyz^ !#endif -!#endif ! β€”β€”β€” Zero-width spaces/hyphens in lookalike domains β€”β€”β€” ! uBO support is removed until https://github.com/uBlockOrigin/uBlock-issues/issues/1146 is resolved !#if !ext_ublock -Β­*$doc,domain=~ Warning shown due to: The domain uses at least one fake spacing; which is a very clear sign of fraud sites. -​*$doc,domain=~ Warning shown due to: The domain uses at least one fake spacing; which is a very clear sign of fraud sites. +Β­*$doc +​*$doc !#endif ! β€”β€”β€” These DNS resolver requests lead to localhost and can't ever receive a proper request β€”β€”β€” @@ -389,59 +387,59 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ||rgithub.com^ ! β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” -://ww5.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww6.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww7.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww8.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww9.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww10.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww11.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww12.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww13.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww14.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww15.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww16.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww17.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww18.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww19.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww20.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww21.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww22.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww23.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww24.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww25.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww26.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww27.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww28.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww29.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww30.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww31.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww32.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww33.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww34.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww35.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww36.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww37.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww38.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww39.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww40.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww41.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww42.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww43.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww44.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww45.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww46.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww47.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww48.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww49.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. -://ww50.$doc,domain=~ Warning displayed due to: Pattern is usually used by various groups who buy old domains and display illicit ads on them. +://ww5.$doc +://ww6.$doc +://ww7.$doc +://ww8.$doc +://ww9.$doc +://ww10.$doc +://ww11.$doc +://ww12.$doc +://ww13.$doc +://ww14.$doc +://ww15.$doc +://ww16.$doc +://ww17.$doc +://ww18.$doc +://ww19.$doc +://ww20.$doc +://ww21.$doc +://ww22.$doc +://ww23.$doc +://ww24.$doc +://ww25.$doc +://ww26.$doc +://ww27.$doc +://ww28.$doc +://ww29.$doc +://ww30.$doc +://ww31.$doc +://ww32.$doc +://ww33.$doc +://ww34.$doc +://ww35.$doc +://ww36.$doc +://ww37.$doc +://ww38.$doc +://ww39.$doc +://ww40.$doc +://ww41.$doc +://ww42.$doc +://ww43.$doc +://ww44.$doc +://ww45.$doc +://ww46.$doc +://ww47.$doc +://ww48.$doc +://ww49.$doc +://ww50.$doc ! β€”β€”β€” Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 β€”β€”β€” -/\\/$doc,domain=~ Warning displayed due to: The website most likely using backwards slashes to evade adblocker-syntax subdomain blocking. +/\\/$doc ! Oddly enough, there seems to be no need to couple it with "@@/:\\/", since web browsers convert Windows filenames from backwards to forwards slashes. ! β€”β€”β€” User-submitted entries β€”β€”β€” ! https://github.com/DandelionSprout/adfilt/issues/71 -||imgvieweriri.com^$all,domain=~ Warning shown due to: Used for Instagram credential thefts. +||imgvieweriri.com^$all ! Placeholder line for alternate list versions