diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 6b8cf557b..3fdeac0c4 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 29November2024v1 +! Version: 29November2024v2 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -335,10 +335,8 @@ exefiles.com##.panel:has([href*="/en/recommended/winthruster/"]) exefiles.com##.row:has(a[href*="/recommended/"]) ! Common scam domain patterns -/^http://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live)/$1p,doc -/^https://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live)/$1p,doc -/^https?:\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top -/^https?:\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?u=[0-9a-z]{7}&o=[0-9a-z]{7}/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top +/^https?://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live).*$/$1p,doc +/^https?:\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}.*$/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top ! https://github•com/AdguardTeam/AdguardFilters/issues/58737 /^https?:\/\/(?:www\.)?[-0-9a-z]{14,}\.(?:biz|fun|live)\/[a-zA-Z]{10,}\.php$/$doc,domain=biz|fun|live @@ -475,10 +473,10 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||gift-nitro.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com ||free-discordnitro.$all,~inline-font ||freediscordnitro.$all,~inline-font -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$all,~inline-font,domain=~fake-malware-version-of-discord.gift +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/.*)?$/$all,~inline-font,domain=~fake-malware-version-of-discord.gift !#if false -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/.*)?$/ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/.*)?$/$popup !#endif ||discord*.gifts^$all,~inline-font,domain=~fake-malware-version-of-discord.gift ||discord-give.$all,~inline-font,domain=~fake-malware-version-of-discord.gift @@ -1373,7 +1371,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !#if !ext_ublock ://142.91.159.$doc ! https://github.com/DandelionSprout/adfilt/issues/942 -/^172\.255\.6\.(\d{1,2}|[12][0-689]\d|17[0-689])$/ +/^172\.255\.6\.(\d\d?|[12][0-689]\d|17[0-689])$/ ://23.109.150.$doc ://23.109.248.$doc !#endif @@ -3463,7 +3461,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] /scan-update-and-protect-your-browser.html$doc ! https://github.com/AdguardTeam/AdguardFilters/issues/61755 ! https://github.com/AdguardTeam/AdguardFilters/issues/61743 -/^(https?://)?(www\.)?cunt[a-z]{3,8}\.com(/|$)/$doc,popup +/^(https?://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$doc,popup ! https://github.com/easylist/easylist/issues/6111 ||watch-video.net^$all,~inline-font ||code-zp1.com^$all,~inline-font @@ -3492,8 +3490,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||uptodater.net^$all,~inline-font ||virnews.club^$all,~inline-font ||vviewpoint.biz^$all,~inline-font -/^http://\d{1,2}\.[a-z0-9-]{1,}\.(club|me)(/|$)/$doc -/^https://\d{1,2}\.[a-z0-9-]{1,}\.(club|me)(/|$)/$doc +/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$doc ||134.209.136.174^$doc *$all,ipaddress=134.209.136.174 ||whiteclick.biz^$all,~inline-font @@ -3537,16 +3534,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://maldita•es/malditobulo/2020/11/18/no-no-es-cierto-que-amancio-ortega-haya-invertido-100-millones-en-bitcoin-revolution-es-una-web-falsa/ ||starpowders.github.io^ ! https://github.com/AdguardTeam/AdguardFilters/issues/69611 -/^http://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/|$)/ -/^https://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/|$)/ +/^https?://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/.*)?$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/71721 ! https://github.com/AdguardTeam/AdguardFilters/issues/71369 ! https://github.com/AdguardTeam/AdguardFilters/issues/73623 ! https://github.com/AdguardTeam/AdguardFilters/issues/73627 -/^http://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/|$)/ -/^https://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/|$)/ +/^https?://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/.*)?$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/73133 -/^(https?://)?\d{1,2}\.[a-z0-9-]{1,}\.biz(/|$)/$doc +/^(https?://)?\d\d?\.[a-z0-9-]{1,}\.biz(/.*)?$/$doc ! https://github.com/DandelionSprout/adfilt/discussions/163#discussioncomment-428333 ||safe-offers.net^$doc /bitcoinrevolution/lp.php^$doc @@ -4196,7 +4191,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/iam-py-test/investigations/blob/main/2021/10/24/1.md#html-capture ||google-yandex.$doc ||cloud-apps.store^$doc -/(^|://|\.)[a-z]{5,}-[a-z]{5,}-[a-z]{5,}\.xyz($|/)/$doc +/^(.*://|.*\.)?[a-z]{5,}-[a-z]{5,}-[a-z]{5,}\.xyz(/.*)?$/$doc ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-951321929 ||159.148.186.228^$all,~inline-font *$all,ipaddress=159.148.186.228 @@ -4550,7 +4545,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sites.google.com/view/groundworkssolutions/^$all,~inline-font ||sites.google.com/mytv/maintenance^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 -/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$doc,popup,domain=~malware-redirection-trains.* +/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$doc,popup,domain=~malware-redirection-trains.* ! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^$all,~inline-font ||calsign.xyz^$all,~inline-font @@ -4680,10 +4675,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||amazon-security-info.lnk.to^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/123968 ! https://github.com/AdguardTeam/AdguardFilters/issues/124620 -/(\.|//|^)1xslot\d{5,}\.com(/|$)/$all,~inline-font -/(\.|//|^)linebet\d{4}\.com(/|$)/$all,~inline-font -/(\.|//|^)linebet\d{5,}[a-z]\.com(/|$)/$all,~inline-font -/(\.|//|^)lite-1x\d{5,}\.com(/|$)/$all,~inline-font +/^(.*\.|.*//)?1xslot\d{5,}\.com(/.*)?$/$all,~inline-font +/^(.*\.|.*//)?linebet\d{4}\.com(/.*)?$/$all,~inline-font +/^(.*\.|.*//)?linebet\d{5,}[a-z]\.com(/.*)?$/$all,~inline-font +/^(.*\.|.*//)?lite-1x\d{5,}\.com(/.*)?$/$all,~inline-font ||11promo.icu^$all,~inline-font ||1x-asiabet.mobi^$all,~inline-font ||1x-bet-co.com^$all,~inline-font @@ -15215,7 +15210,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||livejasmin.com/*&origin=$doc ! https://github.com/AdguardTeam/AdguardFilters/issues/161364 ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) -/(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~third-party,domain=github.*|~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev|~archive.* +/^(.*//|.*\.)?github\.[a-z]{2,20}(/.*)?$/$document,match-case,~third-party,domain=github.*|~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev|~archive.* ||github.sale^$all,~inline-font ! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ ||0nedr1ved0cumentonline.com^$all,~inline-font @@ -20466,7 +20461,7 @@ toorgle.net##.join ||192.243.59.20^$doc *$all,ipaddress=192.243.59.20 !#if !ext_ublock -/^(https?://)?192\.243\.59\.\d{1,3}($|/)/$doc +/^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/$doc !#endif ! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^$all,~inline-font @@ -22111,7 +22106,7 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat .aspx?iid=*&cid=$all,~inline-font .aspx?cname=*&cid=$all,~inline-font /shop.php?iid=$all,~inline-font -/\.[a-z]{2,18}\/Stars\.php\?/$match-case,all,~inline-font +/^.*\.[a-z]{2,18}\/Stars\.php\?.*$/$match-case,all,~inline-font ||asptryfa.info^$all,~inline-font ||awpasslong.info^$all,~inline-font ||butheadstar.info^$all,~inline-font