From 61fe8858aed7c5fc73c34bcc2d68337c2cddca9a Mon Sep 17 00:00:00 2001 From: Imre Eilertsen Date: Fri, 29 Nov 2024 03:38:46 +0100 Subject: [PATCH] =?UTF-8?q?RegEx=20maintenance=E2=80=A6=20I=20think.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Dandelion Sprout's Anti-Malware List.txt | 47 +++++++++++------------- 1 file changed, 21 insertions(+), 26 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 6b8cf557b..3fdeac0c4 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 29November2024v1 +! Version: 29November2024v2 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -335,10 +335,8 @@ exefiles.com##.panel:has([href*="/en/recommended/winthruster/"]) exefiles.com##.row:has(a[href*="/recommended/"]) ! Common scam domain patterns -/^http://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live)/$1p,doc -/^https://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live)/$1p,doc -/^https?:\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top -/^https?:\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?u=[0-9a-z]{7}&o=[0-9a-z]{7}/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top +/^https?://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live).*$/$1p,doc +/^https?:\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}.*$/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top ! https://github•com/AdguardTeam/AdguardFilters/issues/58737 /^https?:\/\/(?:www\.)?[-0-9a-z]{14,}\.(?:biz|fun|live)\/[a-zA-Z]{10,}\.php$/$doc,domain=biz|fun|live @@ -475,10 +473,10 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||gift-nitro.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com ||free-discordnitro.$all,~inline-font ||freediscordnitro.$all,~inline-font -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$all,~inline-font,domain=~fake-malware-version-of-discord.gift +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/.*)?$/$all,~inline-font,domain=~fake-malware-version-of-discord.gift !#if false -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/.*)?$/ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/.*)?$/$popup !#endif ||discord*.gifts^$all,~inline-font,domain=~fake-malware-version-of-discord.gift ||discord-give.$all,~inline-font,domain=~fake-malware-version-of-discord.gift @@ -1373,7 +1371,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !#if !ext_ublock ://142.91.159.$doc ! https://github.com/DandelionSprout/adfilt/issues/942 -/^172\.255\.6\.(\d{1,2}|[12][0-689]\d|17[0-689])$/ +/^172\.255\.6\.(\d\d?|[12][0-689]\d|17[0-689])$/ ://23.109.150.$doc ://23.109.248.$doc !#endif @@ -3463,7 +3461,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] /scan-update-and-protect-your-browser.html$doc ! https://github.com/AdguardTeam/AdguardFilters/issues/61755 ! https://github.com/AdguardTeam/AdguardFilters/issues/61743 -/^(https?://)?(www\.)?cunt[a-z]{3,8}\.com(/|$)/$doc,popup +/^(https?://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$doc,popup ! https://github.com/easylist/easylist/issues/6111 ||watch-video.net^$all,~inline-font ||code-zp1.com^$all,~inline-font @@ -3492,8 +3490,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||uptodater.net^$all,~inline-font ||virnews.club^$all,~inline-font ||vviewpoint.biz^$all,~inline-font -/^http://\d{1,2}\.[a-z0-9-]{1,}\.(club|me)(/|$)/$doc -/^https://\d{1,2}\.[a-z0-9-]{1,}\.(club|me)(/|$)/$doc +/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$doc ||134.209.136.174^$doc *$all,ipaddress=134.209.136.174 ||whiteclick.biz^$all,~inline-font @@ -3537,16 +3534,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://maldita•es/malditobulo/2020/11/18/no-no-es-cierto-que-amancio-ortega-haya-invertido-100-millones-en-bitcoin-revolution-es-una-web-falsa/ ||starpowders.github.io^ ! https://github.com/AdguardTeam/AdguardFilters/issues/69611 -/^http://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/|$)/ -/^https://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/|$)/ +/^https?://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/.*)?$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/71721 ! https://github.com/AdguardTeam/AdguardFilters/issues/71369 ! https://github.com/AdguardTeam/AdguardFilters/issues/73623 ! https://github.com/AdguardTeam/AdguardFilters/issues/73627 -/^http://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/|$)/ -/^https://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/|$)/ +/^https?://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/.*)?$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/73133 -/^(https?://)?\d{1,2}\.[a-z0-9-]{1,}\.biz(/|$)/$doc +/^(https?://)?\d\d?\.[a-z0-9-]{1,}\.biz(/.*)?$/$doc ! https://github.com/DandelionSprout/adfilt/discussions/163#discussioncomment-428333 ||safe-offers.net^$doc /bitcoinrevolution/lp.php^$doc @@ -4196,7 +4191,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/iam-py-test/investigations/blob/main/2021/10/24/1.md#html-capture ||google-yandex.$doc ||cloud-apps.store^$doc -/(^|://|\.)[a-z]{5,}-[a-z]{5,}-[a-z]{5,}\.xyz($|/)/$doc +/^(.*://|.*\.)?[a-z]{5,}-[a-z]{5,}-[a-z]{5,}\.xyz(/.*)?$/$doc ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-951321929 ||159.148.186.228^$all,~inline-font *$all,ipaddress=159.148.186.228 @@ -4550,7 +4545,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sites.google.com/view/groundworkssolutions/^$all,~inline-font ||sites.google.com/mytv/maintenance^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 -/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$doc,popup,domain=~malware-redirection-trains.* +/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$doc,popup,domain=~malware-redirection-trains.* ! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^$all,~inline-font ||calsign.xyz^$all,~inline-font @@ -4680,10 +4675,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||amazon-security-info.lnk.to^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/123968 ! https://github.com/AdguardTeam/AdguardFilters/issues/124620 -/(\.|//|^)1xslot\d{5,}\.com(/|$)/$all,~inline-font -/(\.|//|^)linebet\d{4}\.com(/|$)/$all,~inline-font -/(\.|//|^)linebet\d{5,}[a-z]\.com(/|$)/$all,~inline-font -/(\.|//|^)lite-1x\d{5,}\.com(/|$)/$all,~inline-font +/^(.*\.|.*//)?1xslot\d{5,}\.com(/.*)?$/$all,~inline-font +/^(.*\.|.*//)?linebet\d{4}\.com(/.*)?$/$all,~inline-font +/^(.*\.|.*//)?linebet\d{5,}[a-z]\.com(/.*)?$/$all,~inline-font +/^(.*\.|.*//)?lite-1x\d{5,}\.com(/.*)?$/$all,~inline-font ||11promo.icu^$all,~inline-font ||1x-asiabet.mobi^$all,~inline-font ||1x-bet-co.com^$all,~inline-font @@ -15215,7 +15210,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||livejasmin.com/*&origin=$doc ! https://github.com/AdguardTeam/AdguardFilters/issues/161364 ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) -/(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~third-party,domain=github.*|~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev|~archive.* +/^(.*//|.*\.)?github\.[a-z]{2,20}(/.*)?$/$document,match-case,~third-party,domain=github.*|~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev|~archive.* ||github.sale^$all,~inline-font ! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ ||0nedr1ved0cumentonline.com^$all,~inline-font @@ -20466,7 +20461,7 @@ toorgle.net##.join ||192.243.59.20^$doc *$all,ipaddress=192.243.59.20 !#if !ext_ublock -/^(https?://)?192\.243\.59\.\d{1,3}($|/)/$doc +/^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/$doc !#endif ! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^$all,~inline-font @@ -22111,7 +22106,7 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat .aspx?iid=*&cid=$all,~inline-font .aspx?cname=*&cid=$all,~inline-font /shop.php?iid=$all,~inline-font -/\.[a-z]{2,18}\/Stars\.php\?/$match-case,all,~inline-font +/^.*\.[a-z]{2,18}\/Stars\.php\?.*$/$match-case,all,~inline-font ||asptryfa.info^$all,~inline-font ||awpasslong.info^$all,~inline-font ||butheadstar.info^$all,~inline-font