diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index 2329fe057..f410e3135 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox) -! Version: 27November2025v1 +! Version: 07December2025v2 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -73,8 +73,6 @@ www.google.com,ipv6.google.com,google.ac,google.ad,google.ae,google.af,google.ag ||spam404bl.com^ ||109.201.135.46^ - - ||fredfiber.no^ ||securemecca.com^ @@ -110,8 +108,6 @@ www.google.com,ipv6.google.com,google.ac,google.ad,google.ae,google.af,google.ag ||ublock.org^ ||138.68.252.54^ - - ||useragentswitch.com^ ||useragentswitch.com^$popup ||dev-nano.com^ @@ -402,54 +398,11 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ! ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— ||ubuntu.org^$domain=~you-were-likely-looking-for-ubuntu.com - -||103.224.212.249^ - - ||speedtest.com^$domain=~you-were-likely-looking-for-speedtest.net ||snapchat.cm^$domain=~malware-typo-squatter-of-snapchat.com ||facebook.cm^$domain=~malware-typo-squatter-of-facebook.com ||wix.cm^$domain=~malware-typo-squatter-of-wix.com - -||199.59.243.222^ - - |http://ww01.$domain=~very_very_extremely_frequently_used_in_malware_redirections.* - -||173.208.96.42^ -||173.208.96.42^$popup - - - -||173.208.96.43^ -||173.208.96.43^$popup - - - -||173.208.96.44^ -||173.208.96.44^$popup - - - -||173.208.96.45^ -||173.208.96.45^$popup - - - -||173.208.96.46^ -||173.208.96.46^$popup - - - -||213.227.149.208^ -||213.227.149.208^$popup - - - -||213.227.149.211^ -||213.227.149.211^$popup - - ||ddscordapp. ||ddscordapp.$popup ||diicordapp. @@ -551,7 +504,33 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||githubuser.com^$domain=~you-were-likely-looking-for-githubusercontent.com ||rgithub.com^$domain=~you-were-likely-looking-for-githubusercontent.com ||githubt.com^$domain=~you-were-likely-looking-for-githubusercontent.com -! https://scammer•info/t/discord-nitro-scam-25/87887 + + + + + + + + + + + +||173.208.96.42^ +||173.208.96.42^$popup +||173.208.96.43^ +||173.208.96.43^$popup +||173.208.96.44^ +||173.208.96.44^$popup +||173.208.96.45^ +||173.208.96.45^$popup +||173.208.96.46^ +||173.208.96.46^$popup +||199.59.243.222^ +||213.227.149.208^ +||213.227.149.208^$popup +||213.227.149.211^ +||213.227.149.211^$popup + ! ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— ||hippolyte-hag.com^ @@ -565,40 +544,38 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||photios-raj.com^ ||photios-raj.com^$popup ||zeroredirect5.com^$domain=~malware_redirection_trains.* +||roamingclicks.com^ +||roamingclicks.com^$popup -||54.209.22.226^ + + + -||54.91.125.197^ -||52.202.53.245^ -://35.175.38.64^ ://35.168.147.213^ - - - -||34.230.160.215^ - - - -||3.226.8.132^ - - - +://35.175.38.64^ +||144.76.0.242^ +||144.76.1.130^ +||195.201.92.254^ ||3.216.243.46^ +||3.226.8.132^ +||34.230.160.215^ +||52.202.53.245^ +||54.209.22.226^ +||54.91.125.197^ +||94.130.185.237^ +||94.130.186.231^ - -||roamingclicks.com^ -||roamingclicks.com^$popup ! Source: desidertNO ||collectfasttracks.com^ ||collectfasttracks.com^$popup @@ -615,26 +592,6 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||ns1.trafficclub.com^$popup ||satcom1.co.uk^ ||splitter.microxml.net^ - -||94.130.185.237^ - - - -||94.130.186.231^ - - - -||144.76.0.242^ - - - -||144.76.1.130^ - - - -||195.201.92.254^ - - zombooru.com##a[href$="ttp://www.boorufurry.com/"] zombooru.com##a[href$="ttp://www.analbooru.com/"] zombooru.com##a[href$="ttp://www.hard55.com"] @@ -650,126 +607,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||couponbybox.com^ ||newpage.in^ /mcaf04/*= - -||34.204.214.165^ - - - -||54.85.113.62^ - - - -||54.205.83.61^ - - - -||54.210.193.115^ - - -||[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1]^ -||banalbjar.com^ -||banalbjar.com^$popup -||coryljanty.cam^ -||coryljanty.cam^$popup -||elfpetsic.com^ -||elfpetsic.com^$popup -||postback.report^ -||postback.report^$popup -||roksit.net^ -||roksit.net^$popup -||adblockerapp.com^$popup - -||172.255.6.107^ -||172.255.6.107^$popup - - - -||172.255.6.147^ -||172.255.6.147^$popup - - - -||172.255.6.219^ -||172.255.6.219^$popup - - - -||172.255.6.225^ -||172.255.6.225^$popup - - - -||188.42.129.108^ -||188.42.129.108^$popup - - - -||188.42.129.116^ -||188.42.129.116^$popup - - - -||188.42.141.100^ -||188.42.141.100^$popup - - - -||188.42.141.92^ -||188.42.141.92^$popup - - - -||23.109.82.144^ -||23.109.82.144^$popup - - - -||23.109.82.41^ -||23.109.82.41^$popup - - - -||23.109.82.43^ -||23.109.82.43^$popup - - - -||23.109.82.65^ -||23.109.82.65^$popup - - - -||23.109.82.66^ -||23.109.82.66^$popup - - - -||23.109.87.169^ -||23.109.87.169^$popup - - - -||23.109.87.207^ -||23.109.87.207^$popup - - - -||23.109.87.208^ -||23.109.87.208^$popup - - -||blueoyster.click^ -||blueoyster.click^$popup - -||216.21.13.14^ -||216.21.13.14^$popup - - - -||216.21.13.15^ -||216.21.13.15^$popup - - /^.*\.(xyz|pics)/[a-zA-Z0-9]{130,}$/$script,subdocument,image /^.*\.(cloudfront\.net|xyz|pics)/[a-zA-Z0-9]{20,}/[a-zA-Z0-9]{25,}\+[a-zA-Z0-9+]{90,}$/$script,subdocument,image ||hafisague.com^ @@ -791,9 +628,90 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||videoadblockers.$popup ||videoadblockertou.$popup ||videoadblockextension.$popup +||adblockerapp.com^$popup +||banalbjar.com^ +||banalbjar.com^$popup +||blueoyster.click^ +||blueoyster.click^$popup +||coryljanty.cam^ +||coryljanty.cam^$popup +||elfpetsic.com^ +||elfpetsic.com^$popup +||postback.report^ +||postback.report^$popup +||roksit.net^ +||roksit.net^$popup + + + + + + + + + + + + + + + + + + + + + + + + + + +||172.255.6.107^ +||172.255.6.107^$popup +||172.255.6.147^ +||172.255.6.147^$popup +||172.255.6.219^ +||172.255.6.219^$popup +||172.255.6.225^ +||172.255.6.225^$popup +||188.42.129.108^ +||188.42.129.108^$popup +||188.42.129.116^ +||188.42.129.116^$popup +||188.42.141.100^ +||188.42.141.100^$popup +||188.42.141.92^ +||188.42.141.92^$popup +||216.21.13.14^ +||216.21.13.14^$popup +||216.21.13.15^ +||216.21.13.15^$popup +||23.109.82.144^ +||23.109.82.144^$popup +||23.109.82.41^ +||23.109.82.41^$popup +||23.109.82.43^ +||23.109.82.43^$popup +||23.109.82.65^ +||23.109.82.65^$popup +||23.109.82.66^ +||23.109.82.66^$popup +||23.109.87.169^ +||23.109.87.169^$popup +||23.109.87.207^ +||23.109.87.207^$popup +||23.109.87.208^ +||23.109.87.208^$popup +||34.204.214.165^ +||54.205.83.61^ +||54.210.193.115^ +||54.85.113.62^ +||[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1]^ + ! https://github.com/DandelionSprout/adfilt/issues/942 ||abedwithdrawalautograph.com^ @@ -1487,84 +1405,78 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/61743 /^(https?://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$popup ! https://github.com/easylist/easylist/issues/6111 -||fres-news.com^ -||fres-news.com^$popup -||workerz-news.com^ -||workerz-news.com^$popup -||zredir.com^ -||zredir.com^$popup - -||178.128.142.109^ - - -||findmedia.biz^ -||findmedia.biz^$popup +/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/ ||backtonews.biz^ ||backtonews.biz^$popup ||bagclick.biz^ ||bagclick.biz^$popup +||best202*-games-web1.com^ +||best202*-games-web1.com^$popup ||bigkick.biz^ ||bigkick.biz^$popup +||findmedia.biz^ +||findmedia.biz^$popup +||fres-news.com^ +||fres-news.com^$popup ||getcontent24.com^ ||getcontent24.com^$popup -||klickmode.biz^ -||klickmode.biz^$popup -||newsgate.biz^ -||newsgate.biz^$popup -||redmdeia.biz^ -||redmdeia.biz^$popup -||uptodater.net^ -||uptodater.net^$popup -||virnews.club^ -||virnews.club^$popup -/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/ - -||134.209.136.174^ - - -||whiteclick.biz^ -||whiteclick.biz^$popup ||gonews2.com^ ||gonews2.com^$popup +||hooligapps.com^ +||hooligapps.com^$popup +||klickmode.biz^ +||klickmode.biz^$popup ||mediadate.net^ ||mediadate.net^$popup ||newscode.me^ ||newscode.me^$popup +||newsgate.biz^ +||newsgate.biz^$popup +||redmdeia.biz^ +||redmdeia.biz^$popup ||skymedia7.me^ ||skymedia7.me^$popup ||startmode.biz^ ||startmode.biz^$popup ||texterra.me^ ||texterra.me^$popup - -||62.210.6.153^ - - - -||62.210.7.209^ - - - -||62.210.9.92^ - - - -||62.210.11.203^ - - -||hooligapps.com^ -||hooligapps.com^$popup -||best202*-games-web1.com^ -||best202*-games-web1.com^$popup ||theonlygames.com^ ||theonlygames.com^$popup +||uptodater.net^ +||uptodater.net^$popup +||virnews.club^ +||virnews.club^$popup +||whiteclick.biz^ +||whiteclick.biz^$popup +||workerz-news.com^ +||workerz-news.com^$popup +||zredir.com^ +||zredir.com^$popup + + + + + + + + + +||134.209.136.174^ +||178.128.142.109^ +||62.210.11.203^ +||62.210.6.153^ +||62.210.7.209^ +||62.210.9.92^ + ! https://maldita•es/malditobulo/2020/12/04/concurso-mercadona-ganar-tarjeta-regalo-100-euros-phishing/ ||notified-today.com^ ||new-message.email^ -||167.99.249.47^ + +||167.99.249.47^ + ! https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ ! https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ ||moderncomputer.net^ @@ -1600,55 +1512,42 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^ ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$popup + + + + + ||5.8.34.26^ - - - ||5.8.47.3^ - - - ||103.224.182.251^ - ! https://github.com/DandelionSprout/adfilt/issues/193 ||holescontracting.com^ ||holescontracting.com^$popup ||doggroomingnews.com^ ||doggroomingnews.com^$popup -||5.79.71.205^ -||5.79.71.225^ -||85.17.31.82^ -||85.17.31.122^ - ||178.162.203.202^ - - - ||178.162.203.211^ - - - ||178.162.203.226^ - - - ||178.162.217.107^ - - +||5.79.71.205^ +||5.79.71.225^ +||85.17.31.122^ +||85.17.31.82^ ||[2a02:1668:1034::2]^ + ! https://github.com/DandelionSprout/adfilt/issues/195 ||logicalrecord.com^ ||logicalrecord.com^$popup @@ -1658,20 +1557,16 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||emiratenbduae.com^ ||emiratenbduae.com^$popup -||66.85.156.85^ -||66.85.156.86^ ||108.170.31.123^ - - - ||108.170.52.156^ - +||66.85.156.85^ +||66.85.156.86^ ! https://github.com/DandelionSprout/adfilt/issues/198 ! https://www•bleepingcomputer•com/virus-removal/ (18/06/2021) @@ -1769,16 +1664,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||watch-this.live^ ||watch-this.live^$popup -||95.168.170.165^ + + ||213.227.145.147^ - - - ||213.227.149.216^ - +||95.168.170.165^ ! https://twitter•com/adamziaja/status/1252234957679808513 ||wow-robotics.xyz^ @@ -1795,8 +1688,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||aleinvest.xyz^$popup ||5.188.62.36^ - - ! https://github.com/DandelionSprout/adfilt/issues/223 ||speedupmypcfree.com^ ||speedupmypcfree.com^$popup @@ -1805,8 +1696,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||ssielearning.com^$popup ||69.49.231.244^ - - ! https://movsb•0x0•st/users/mia ||5starhdporn.com^$frame,third-party ! https://github.com/DandelionSprout/adfilt/issues/228 @@ -1827,8 +1716,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yzsnw.com^$popup ||37.34.176.37^ - - ||pcspeedcat.com^ ||pcspeedcat.com^$popup ||auslogics.com^ @@ -1857,36 +1744,28 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||trackwebclick.com^ ||trackwebclick.com^$popup + ||23.111.31.137^ - - - ||23.111.88.207^ - - ! https://github.com/DandelionSprout/adfilt/issues/254 ||onesafesoftware.com^ ! https://github.com/DandelionSprout/adfilt/issues/257 + + + + + + ||185.158.250.239^ ||185.158.250.239^$popup - - - ||192.169.69.25^ ||192.169.69.25^$popup - - - ||212.192.241.72^ ||212.192.241.72^$popup - - - ||37.0.10.83^ ||37.0.10.83^$popup - ||secure-0*.ddnss.ch^ ||secure-0*.ddnss.ch^$popup ||lucdream.com^ @@ -1905,8 +1784,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||192.3.110.170^ ||192.3.110.170^$popup - - ! https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ ||socialsearchconverter.com^ ||install.socialsearchconverter.com^ @@ -1945,8 +1822,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||91.241.19.38^ ||91.241.19.38^$popup - - ! https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection ! https://safeweb•norton•com/report/show?url=telete•in ! https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -1960,15 +1835,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection ||45.90.58.90^ - - ! https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community ! https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection ||95.85.89.98^ ||95.85.89.98^$popup - - ! https://github.com/DandelionSprout/adfilt/issues/267 ||mediafire.com/file/pj9jdm7iznc4d51/tekhacksnet_multi_loader.rar^ ! https://github.com/DandelionSprout/adfilt/pull/278 @@ -1976,79 +1847,55 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||139.28.37.49^ ||139.28.37.49^$popup - - !! https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community - ://35.194.188.37^ ://35.194.188.37^$popup - !! https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community !! https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community ||91.243.121.19^ ||91.243.121.19^$popup - - !! https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community ||103.169.90.205^ ||103.169.90.205^$popup - - ! https://github.com/DandelionSprout/adfilt/pull/281 ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + + + + + + + ||125.44.43.45^ ||125.44.43.45^$popup - - - ||182.121.8.240^ ||182.121.8.240^$popup - - - ||42.235.183.74^ ||42.235.183.74^$popup - - - ||78.36.32.242^ ||78.36.32.242^$popup - - - ||115.50.2.119^ ||115.50.2.119^$popup - - - ||115.50.110.163^ ||115.50.110.163^$popup - - - ||119.179.84.145^ ||119.179.84.145^$popup - - - ||188.120.50.98^ ||188.120.50.98^$popup - - - ||190.238.183.5^ ||190.238.183.5^$popup - - - ||27.220.253.78^ ||27.220.253.78^$popup - ! https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community ||esetnode32-antiviru.ydns.eu^ ||esetnode32-antiviru.ydns.eu^$popup @@ -2059,8 +1906,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||192.3.194.242^ ||192.3.194.242^$popup - - ||w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu^ ||w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu^$popup ||hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu^ @@ -2116,280 +1961,180 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||23.94.26.138^ ||23.94.26.138^$popup - - ! https://github.com/DandelionSprout/adfilt/pull/298 ! https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community ||205.185.126.200^ ||205.185.126.200^$popup - - ! https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community ||185.243.56.167^ ||185.243.56.167^$popup - - ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -||123.10.224.135^ -||123.10.224.135^$popup -||59.47.187.147^ -||59.47.187.147^$popup -||39.68.172.210^ -||39.68.172.210^$popup -||122.192.177.176^ -||122.192.177.176^$popup -||112.27.124.108^ -||112.27.124.108^$popup -||123.110.176.246^ -||123.110.176.246^$popup -||219.155.105.98^ -||219.155.105.98^$popup -||171.35.161.209^ -||171.35.161.209^$popup -||60.16.255.36^ -||60.16.255.36^$popup -||112.30.4.52^ -||112.30.4.52^$popup -||182.121.191.201^ -||182.121.191.201^$popup -||121.61.48.170^ -||121.61.48.170^$popup -||39.81.68.45^ -||39.81.68.45^$popup -||27.222.220.164^ -||27.222.220.164^$popup -||113.233.215.135^ -||113.233.215.135^$popup -||151.77.100.133^ -||151.77.100.133^$popup -||125.120.13.184^ -||125.120.13.184^$popup - - - -||120.12.138.133^ -||120.12.138.133^$popup - - - -||27.194.115.185^ -||27.194.115.185^$popup - - ://104.128.199.228^ ://104.128.199.228^$popup - - - -||183.92.123.145^ -||183.92.123.145^$popup - - - -||110.89.8.126^ -||110.89.8.126^$popup - - - -||125.43.211.184^ -||125.43.211.184^$popup - - - -||1.0.218.230^ -||1.0.218.230^$popup - - - -||221.208.4.56^ -||221.208.4.56^$popup - - - -||60.13.60.19^ -||60.13.60.19^$popup - - - -||171.37.29.87^ -||171.37.29.87^$popup - - - -||124.91.237.188^ -||124.91.237.188^$popup - - - -||115.56.137.49^ -||115.56.137.49^$popup - - - -||115.52.240.69^ -||115.52.240.69^$popup - - - -||112.252.132.185^ -||112.252.132.185^$popup - - - -||117.198.240.157^ -||117.198.240.157^$popup - - - +||27.194.115.185^ +||27.194.115.185^$popup +||27.222.220.164^ +||27.222.220.164^$popup +||39.68.172.210^ +||39.68.172.210^$popup +||39.81.68.45^ +||39.81.68.45^$popup ||42.53.240.249^ ||42.53.240.249^$popup - - - -||116.179.138.68^ -||116.179.138.68^$popup - - - -||110.241.119.159^ -||110.241.119.159^$popup - - - -||115.56.31.133^ -||115.56.31.133^$popup - - - -||103.19.128.222^ -||103.19.128.222^$popup - - - -||202.12.80.74^ -||202.12.80.74^$popup - - - +||59.47.187.147^ +||59.47.187.147^$popup +||60.13.60.19^ +||60.13.60.19^$popup +||60.16.255.36^ +||60.16.255.36^$popup ||61.52.8.62^ ||61.52.8.62^$popup - - - -||182.122.252.69^ -||182.122.252.69^$popup - - - -||219.155.26.50^ -||219.155.26.50^$popup - - - -||120.4.141.185^ -||120.4.141.185^$popup - - - -||119.102.7.115^ -||119.102.7.115^$popup - - - ||72.51.127.213^ ||72.51.127.213^$popup - - - +||1.0.218.230^ +||1.0.218.230^$popup +||103.19.128.222^ +||103.19.128.222^$popup +||110.241.119.159^ +||110.241.119.159^$popup +||110.89.8.126^ +||110.89.8.126^$popup ||111.224.199.91^ ||111.224.199.91^$popup - - - -||119.250.236.122^ -||119.250.236.122^$popup - - - +||112.252.132.185^ +||112.252.132.185^$popup +||112.27.124.108^ +||112.27.124.108^$popup ||112.30.110.58^ ||112.30.110.58^$popup - +||112.30.4.52^ +||112.30.4.52^$popup +||113.233.215.135^ +||113.233.215.135^$popup +||115.52.240.69^ +||115.52.240.69^$popup +||115.56.137.49^ +||115.56.137.49^$popup +||115.56.31.133^ +||115.56.31.133^$popup +||116.179.138.68^ +||116.179.138.68^$popup +||117.198.240.157^ +||117.198.240.157^$popup +||119.102.7.115^ +||119.102.7.115^$popup +||119.250.236.122^ +||119.250.236.122^$popup +||120.12.138.133^ +||120.12.138.133^$popup +||120.4.141.185^ +||120.4.141.185^$popup +||121.61.48.170^ +||121.61.48.170^$popup +||122.192.177.176^ +||122.192.177.176^$popup +||123.10.224.135^ +||123.10.224.135^$popup +||123.110.176.246^ +||123.110.176.246^$popup +||124.91.237.188^ +||124.91.237.188^$popup +||125.120.13.184^ +||125.120.13.184^$popup +||125.43.211.184^ +||125.43.211.184^$popup +||151.77.100.133^ +||151.77.100.133^$popup +||171.35.161.209^ +||171.35.161.209^$popup +||171.37.29.87^ +||171.37.29.87^$popup +||182.121.191.201^ +||182.121.191.201^$popup +||182.122.252.69^ +||182.122.252.69^$popup +||183.92.123.145^ +||183.92.123.145^$popup +||202.12.80.74^ +||202.12.80.74^$popup +||219.155.105.98^ +||219.155.105.98^$popup +||219.155.26.50^ +||219.155.26.50^$popup +||221.208.4.56^ +||221.208.4.56^$popup ! https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community ||pcae.de^ ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + ||117.196.49.21^ ||117.196.49.21^$popup - - - ||115.55.54.234^ ||115.55.54.234^$popup - - - ||115.52.17.123^ ||115.52.17.123^$popup - - - ||182.59.69.21^ ||182.59.69.21^$popup - ! https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community ||chip-secured-download.de^ ||chip-secured-download.de^$popup @@ -2416,8 +2161,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||160.202.163.100^ ||160.202.163.100^$popup - - ! https://www•virustotal•com/gui/ip-address/160•202•163•100/relations ||microsoftkernel.com^ ||microsoftkernel.com^$popup @@ -2436,20 +2179,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||45.95.169.115^ ||45.95.169.115^$popup - - ! https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community ||45.148.120.80^ ||45.148.120.80^$popup - - ! https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community ||85.239.33.9^ ||85.239.33.9^$popup - - ! Relations to the domain above ||adminsys.serveftp.com^ ||adminsys.serveftp.com^$popup @@ -2483,14 +2220,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||107.173.176.183^ ||107.173.176.183^$popup - - ! https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community ||45.148.120.171^ ||45.148.120.171^$popup - - ! https://twitter•com/soranker0/status/1449491402409185283 ://disordgift. ://disordgift.$popup @@ -2502,8 +2235,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||159.148.186.228^ ||159.148.186.228^$popup - - ! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains ||yotube.com^ ||yotube.com^$popup @@ -2530,166 +2261,106 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/pull/348 ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -||39.83.80.247^ -||39.83.80.247^$popup -||68.197.33.124^ -||68.197.33.124^$popup -||219.157.21.37^ -||219.157.21.37^$popup -||182.123.141.17^ -||182.123.141.17^$popup -||125.47.243.187^ -||125.47.243.187^$popup -||182.122.196.203^ -||182.122.196.203^$popup -||182.117.231.182^ -||182.117.231.182^$popup -||112.31.211.135^ -||112.31.211.135^$popup -||125.106.63.93^ -||125.106.63.93^$popup -||115.59.197.46^ -||115.59.197.46^$popup -||122.159.29.192^ -||122.159.29.192^$popup - - - -||171.40.0.127^ -||171.40.0.127^$popup - - - -||171.80.219.160^ -||171.80.219.160^$popup - - - -||123.10.65.201^ -||123.10.65.201^$popup - - - -||168.90.205.46^ -||168.90.205.46^$popup - - - -||125.47.205.109^ -||125.47.205.109^$popup - - - -||39.80.147.239^ -||39.80.147.239^$popup - - - -||45.224.171.130^ -||45.224.171.130^$popup - - - -||45.5.209.75^ -||45.5.209.75^$popup - - - -||116.17.210.157^ -||116.17.210.157^$popup - - - -||27.45.103.240^ -||27.45.103.240^$popup - - - -||110.167.64.171^ -||110.167.64.171^$popup - - - -||39.81.117.73^ -||39.81.117.73^$popup - - - -||183.15.90.156^ -||183.15.90.156^$popup - - - -||119.113.248.74^ -||119.113.248.74^$popup - - - -||175.0.95.85^ -||175.0.95.85^$popup - - - -||61.52.99.109^ -||61.52.99.109^$popup - - - -||222.142.183.194^ -||222.142.183.194^$popup - - - -||106.86.172.194^ -||106.86.172.194^$popup ||103.233.216.77^ ||103.233.216.77^$popup - - - +||106.86.172.194^ +||106.86.172.194^$popup +||110.167.64.171^ +||110.167.64.171^$popup +||112.31.211.135^ +||112.31.211.135^$popup +||115.59.197.46^ +||115.59.197.46^$popup +||116.17.210.157^ +||116.17.210.157^$popup +||119.113.248.74^ +||119.113.248.74^$popup +||122.159.29.192^ +||122.159.29.192^$popup +||123.10.65.201^ +||123.10.65.201^$popup +||125.106.63.93^ +||125.106.63.93^$popup +||125.47.205.109^ +||125.47.205.109^$popup +||125.47.243.187^ +||125.47.243.187^$popup +||168.90.205.46^ +||168.90.205.46^$popup +||171.40.0.127^ +||171.40.0.127^$popup +||171.80.219.160^ +||171.80.219.160^$popup +||175.0.95.85^ +||175.0.95.85^$popup +||182.117.231.182^ +||182.117.231.182^$popup +||182.122.196.203^ +||182.122.196.203^$popup +||182.123.141.17^ +||182.123.141.17^$popup +||183.15.90.156^ +||183.15.90.156^$popup ||183.188.192.55^ ||183.188.192.55^$popup - +||219.157.21.37^ +||219.157.21.37^$popup +||222.142.183.194^ +||222.142.183.194^$popup +||27.45.103.240^ +||27.45.103.240^$popup +||39.80.147.239^ +||39.80.147.239^$popup +||39.81.117.73^ +||39.81.117.73^$popup +||39.83.80.247^ +||39.83.80.247^$popup +||45.224.171.130^ +||45.224.171.130^$popup +||45.5.209.75^ +||45.5.209.75^$popup +||61.52.99.109^ +||61.52.99.109^$popup +||68.197.33.124^ +||68.197.33.124^$popup ! https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community ||198.23.255.14^ ||198.23.255.14^$popup - - ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971512075 ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971495248 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/15/1.md#iocs @@ -2697,39 +2368,31 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||runmodes.com^ ||runmodes.com^$popup + ||91.121.67.60^ ||91.121.67.60^$popup - - - ||172.67.186.189^ ||172.67.186.189^$popup - - ! https://scammer•info/t/mcafee-phish/83725 ||securefirst.us-east-1.linodeobjects.com^ ||securefirst.us-east-1.linodeobjects.com^$popup ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + ||39.65.72.211^ ||39.65.72.211^$popup - - - ||42.238.151.197^ ||42.238.151.197^$popup - - - ||27.213.60.53^ ||27.213.60.53^$popup - - - ||115.56.169.134^ ||115.56.169.134^$popup - ! https://github.com/iam-py-test/investigations/blob/main/2021/11/21/1.md ||yasir252.com^ ||yasir252.com^$popup @@ -2748,14 +2411,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||194.87.138.20^ ||194.87.138.20^$popup - - ! https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community ||103.167.92.73^ ||103.167.92.73^$popup - - ! https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community ||bursakulis.com^ ||bursakulis.com^$popup @@ -2784,45 +2443,33 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/uBlockOrigin/uAssets/pull/10620 ! https://www•virustotal•com/gui/file/d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8/community + + + + + + + + + + ||58.249.74.79^ ||58.249.74.79^$popup - - - ||27.45.14.109^ ||27.45.14.109^$popup - - - ||27.40.101.191^ ||27.40.101.191^$popup - - - ||27.45.119.22^ ||27.45.119.22^$popup - - - ||27.47.73.159^ ||27.47.73.159^$popup - - - ||115.204.119.237^ ||115.204.119.237^$popup - - - ||163.125.31.46^ ||163.125.31.46^$popup - - - ||163.179.168.44^ ||163.179.168.44^$popup - ! https://github.com/uBlockOrigin/uAssets/pull/10647 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md ||money-mod.com^ @@ -2839,60 +2486,42 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||download2264.mediafire.com/pnk44f5ci9rg/at2tvnao5x6ivdo/EngineOwning.rar^$popup ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community + + + + + + + + + + + + + ||110.89.59.135^ ||110.89.59.135^$popup - - - ||113.116.89.1^ ||113.116.89.1^$popup - - - ||119.183.146.191^ ||119.183.146.191^$popup - - - ||153.3.3.226^ ||153.3.3.226^$popup - - - ||182.116.104.6^ ||182.116.104.6^$popup - - - ||60.7.133.200^ ||60.7.133.200^$popup - - - ||122.6.254.201^ ||122.6.254.201^$popup - - - ||110.89.11.167^ ||110.89.11.167^$popup - - - ||171.112.177.90^ ||171.112.177.90^$popup - - - ||115.194.38.143^ ||115.194.38.143^$popup - - - ||61.52.79.32^ ||61.52.79.32^$popup - ! https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 ://ups-dk.$denyallow=dk|nu|se|no|fo|gl|ups.com,domain=ups-dk.* ! https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 @@ -2917,8 +2546,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !+ NOT_OPTIMIZED ||132.148.220.142^ - - ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 ||chess-progress.ru^ ! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 @@ -2943,67 +2570,49 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||haxpc.net^ ||haxpc.net^$popup + ||52.53.243.52^ ||52.53.243.52^$popup - - - ||34.201.22.10^ ||34.201.22.10^$popup - - ! https://scammer•info/t/crypto-scammers-onceagain/85354 ||business.google.com/website/billyandscapedesign^ ||business.google.com/website/billyandscapedesign^$popup ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community + + + + + + + + + + ||123.10.225.196^ ||123.10.225.196^$popup - - - ||122.192.106.84^ ||122.192.106.84^$popup - - - ||172.88.199.9^ ||172.88.199.9^$popup - - - ||114.38.176.185^ ||114.38.176.185^$popup - - - ||61.52.97.35^ ||61.52.97.35^$popup - - - ||27.206.181.208^ ||27.206.181.208^$popup - - - ||124.163.130.175^ ||124.163.130.175^$popup - - - ||118.75.87.102^ ||118.75.87.102^$popup - ! https://github.com/iam-py-test/investigations/blob/main/2021/12/14/1.md ! https://github.com/DevSpen/links/pull/3 ! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ ||134.122.115.190^ ||134.122.115.190^$popup - - ||cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com^ ||cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com^$popup ! https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777 @@ -3030,8 +2639,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||141.8.226.34^ ||141.8.226.34^$popup - - ! https://github.com/AdguardTeam/AdguardFilters/issues/108571 ||ston-app.com^ ||ston-app.com^$popup @@ -3050,8 +2657,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||91.240.118.172^ ||91.240.118.172^$popup - - ! "Press Allow to continue" ||kuyhaa-mee.com^ ||kuyhaa-mee.com^$popup @@ -3095,8 +2700,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||198.199.120.251^ ||198.199.120.251^$popup - - ! https://www•telia•no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/ @@ -3110,38 +2713,28 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||dating-galaxy.life^ ||dating-galaxy.life^$popup + ||195.201.253.130^ - - - ||195.201.253.131^ - - ! The bottom download button on https://www•sushichop•com/ ||installiq.com^ ||installiq.com^$popup /trk2/*?lddomain=,domain=~very_likely_a_malware_redirection.* ||cpmverdirect.com^$domain=~malware_redirection_trains.* + + + + + + + ||15.197.244.48^ - - - ||96.47.230.67^ - - - ||96.47.230.68^ - - - ||96.47.230.69^ - - - ||96.47.230.70^ - ! https://securitytrails•com/list/ns/ns1•fastthinkingdns•com ||highercaptcha-settle. ||highercaptcha-settle.$popup @@ -3154,6 +2747,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] + + ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 ||trafredirtds.com^ ||trafredirtds.com^$popup @@ -3177,8 +2772,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||uuidtsinc.net^$popup ||31.220.27.134^ - - ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk. ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 @@ -3429,24 +3022,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"] + + + ||85.17.31.152^ ||85.17.31.152^$popup - - - ||95.211.26.202^ ||95.211.26.202^$popup - - ! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 + ||158.247.212.220^ - - - ||165.227.168.212^ - - ! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ ! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 @@ -3456,8 +3043,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||23.81.64.183^ ||23.81.64.183^$popup - - ! https://github.com/AdguardTeam/AdguardFilters/issues/125300 ||inmewa.com^ ||inmewa.com^$popup @@ -3487,8 +3072,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||vekeltaizy.net^$popup ||139.45.197.236^ - - ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^ ||becovi.com^$popup @@ -3507,17 +3090,15 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||potestainsula.com^$popup ||motherpipe.net^ + + + + + ||51.91.66.125^ - - - ||51.178.76.105^ - - - ||147.135.253.55^ - ! https://github.com/uBlockOrigin/uAssets/issues/14569 → https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection (https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) ! https://github.com/AdguardTeam/AdguardFilters/issues/129414 !+ NOT_OPTIMIZED @@ -3526,13 +3107,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] /^http://imgblaze.net/[a-z0-9]{6}$/$third-party,subdocument ! https://github.com/AdguardTeam/AdguardFilters/issues/131156 + ||146.19.169.98^ - - - ||146.19.169.99^ - - ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 /pushredirect/?,domain=~malware_redirection_trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -6557,8 +6134,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||69.162.80.56^ ||69.162.80.56^$popup - - ! https://github.com/AdguardTeam/AdguardFilters/issues/134903 ! Random Discord servers ||newntflix- @@ -6566,8 +6141,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||giveawaycord.$popup ||162.241.124.200^ - - ! https://github.com/AdguardTeam/AdguardFilters/issues/135815 ||adsstar.in^$popup ||clickcafe.in^$popup @@ -6581,8 +6154,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||webhostingtips.club^$popup ||157.90.71.190^ - - ! https://github.com/AdguardTeam/AdguardFilters/issues/135924 ||beskittyan.com^ ||beskittyan.com^$popup @@ -6615,8 +6186,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||139.45.197.239^ ||139.45.197.239^$popup - - ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub.ument,popup ! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -6654,17 +6223,15 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||wehiqes.xyz^ ||wehiqes.xyz^$popup + + + + + ||44.228.230.225^ - - - ||50.112.124.170^ - - - ||100.20.104.229^ - ! Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread ||link.sv^$popup ||4.fo^$popup @@ -6680,29 +6247,23 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sapino.net^ ||sapino.net^$popup + + + + + + ||44.236.213.34^ - - - ||52.24.156.12^ - - - ||52.25.6.134^ - - - ||100.20.13.49^ - ! https://github.com/AdguardTeam/AdguardFilters/issues/139667 ||goldmesoil.live^ ||goldmesoil.live^$popup ||51.68.87.229^ ||51.68.87.229^$popup - - ! https://github.com/DandelionSprout/adfilt/issues/747 ||2022crucialcatch.store^ ||2022crucialcatch.store^$popup @@ -7524,6 +7085,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] + + ! https://www•bleepingcomputer•com/news/security/hackers-push-malware-via-google-search-ads-for-vlc-7-zip-ccleaner/ ://rufus.download.$popup ://virtualbox.download.$popup @@ -7544,18 +7107,16 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||webull-download. ||webull-download.$popup + + + + + ||185.106.94.139^ - - - ||45.90.109.196^ - - - ||91.229.23.200^ ||91.229.23.200^$popup - ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1401711872 ! https://github.com/AdguardTeam/AdguardFilters/issues/144514 ||bonusgift.life^ @@ -7583,20 +7144,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||winpulse.life^ ||winpulse.life^$popup + ||185.155.184.98^ ||185.155.184.98^$popup - - - ||194.110.247.242^ ||194.110.247.242^$popup - - ! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ ||54.219.218.169^ - - ! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^ ||0365alert.com^$popup @@ -8407,8 +7962,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||64.132.201.92^ ||64.132.201.92^$popup - - ! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||jatvpn.softether.net^ ||jatvpn.softether.net^$popup @@ -8417,8 +7970,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||209.141.51.49^ ||209.141.51.49^$popup - - ://soekpakke*.blogspot.com^ ://soekpakke*.blogspot.com^$popup ||post-norway.web.app^ @@ -8552,20 +8103,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||wooden-comfort.com^$popup ! Unsuited for wildcarding + + + + + ||208.88.225.116^ ||208.88.225.116^$popup - - - ||208.88.225.117^ ||208.88.225.117^$popup - - - ||208.88.225.119^ ||208.88.225.119^$popup - ! https://github.com/AdguardTeam/AdguardFilters/issues/144823 !+ NOT_OPTIMIZED ://landings.*_slots/?partner= @@ -8637,30 +8186,24 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||office-view.com^ ||office-view.com^$popup + + + + + + + ||108.61.242.65^ ||108.61.242.65^$popup - - - ||146.70.78.43^ ||146.70.78.43^$popup - - - ||87.120.254.39^ ||87.120.254.39^$popup - - - ||45.150.108.213^ ||45.150.108.213^$popup - - - ||92.204.160.240^ ||92.204.160.240^$popup - ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 /land/*&afftrack=,domain=~likely_a_malware_redirection.* ! Comments on Slack @@ -9183,30 +8726,24 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zxvjn4igweb9.com^ ||zxvjn4igweb9.com^$popup + + + + + + + ||185.246.188.124^ ||185.246.188.124^$popup - - - ||185.246.188.125^ ||185.246.188.125^$popup - - - ||194.63.140.103^ ||194.63.140.103^$popup - - - ||194.63.143.61^ ||194.63.143.61^$popup - - - ||194.63.143.96^ ||194.63.143.96^$popup - ! https://github.com/AdguardTeam/AdguardFilters/issues/152945 ||moneystartup.live^ ||moneystartup.live^$popup @@ -9354,8 +8891,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||37.48.80.112^ ||37.48.80.112^$popup - - ! Slack comments ||cojcdn.net^ ||cojcdn.net^$popup @@ -9364,15 +8899,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||totadblock.com^ ||totadblock.com^$popup + ||109.206.168.16^ ||109.206.168.16^$popup - - - ||109.206.168.17^ ||109.206.168.17^$popup - - ! https://github.com/AdguardTeam/AdguardFilters/issues/155298 ||cadstoppam.live^ ||cadstoppam.live^$popup @@ -9381,8 +8912,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||57.128.71.215^ ||57.128.71.215^$popup - - /^.*&[a-z]{1,2}=[a-zA-Z0-9]{0,}%[a-zA-Z0-9%]{1000,}$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/155936 ||rumadel.com^ @@ -9625,6 +9154,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] + + + ||139.45.197.167^ ||139.45.197.167^$popup ||139.45.197.245^ @@ -9645,6 +9177,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||192.243.58.124^$popup ||192.243.58.125^ ||192.243.58.125^$popup + ||[2a02:b48:207:1::2]^ ||[2a02:b48:207:1::2]^$popup ||[2a02:b48:207:1::3]^ @@ -9661,6 +9194,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] + + ! https://github.com/AdguardTeam/AdguardFilters/issues/157308 ||dest.co.in^ ||dest.co.in^$popup @@ -10010,20 +9545,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||ztomy.com^ ||ztomy.com^$popup + + + + + ||5.45.123.44^ ||5.45.123.44^$popup - - - ||69.16.230.226^ ||69.16.230.226^$popup - - - ||208.91.196.46^ ||208.91.196.46^$popup - /page/bouncy.php? /page/bouncy.php?$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/158316 @@ -11356,8 +10889,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||93.93.51.223^ ||93.93.51.223^$popup - - ||livejasmin.com/*&origin= ! https://github.com/AdguardTeam/AdguardFilters/issues/161364 ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) @@ -11426,8 +10957,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||103.174.102.240^ ||103.174.102.240^$popup - - ! https://github.com/libre-tube/LibreTube/issues/4409 ||libretube.net^ ||libretube.net^$popup @@ -11591,8 +11120,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||38.180.96.244^ ||38.180.96.244^$popup - - ! https://github.com/AdguardTeam/AdguardFilters/issues/172569 ||acareewityjh.com^ ||acareewityjh.com^$popup @@ -11831,15 +11358,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||wukbgater.buzz^ ||wukbgater.buzz^$popup + ||34.195.224.242^ ||34.195.224.242^$popup - - - ||54.225.185.110^ ||54.225.185.110^$popup - - &lp=not_robot_ &lp=not_robot_$popup ||githubtalentcommunity. @@ -11856,8 +11379,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||91.202.233.143^ ||91.202.233.143^$popup - - ! Based on a tip from my secretary ||advancedwalletpay.com^ ||advancedwalletpay.com^$popup @@ -12047,8 +11568,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||108.62.157.10^ ||108.62.157.10^$popup - - ! https://github.com/AdguardTeam/FiltersRegistry/issues/925 ! https://github.com/AdguardTeam/FiltersRegistry/pull/927 ||avito.avito.avito. @@ -12073,55 +11592,39 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||booking.com-id*$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/179170 + + + + + + + + + + + + ||172.240.108.68^ ||172.240.108.68^$popup - - - ||172.240.108.76^ ||172.240.108.76^$popup - - - ||172.240.108.84^ ||172.240.108.84^$popup - - - ||172.240.127.234^ ||172.240.127.234^$popup - - - ||172.240.253.132^ ||172.240.253.132^$popup - - - ||192.243.59.12^ ||192.243.59.12^$popup - - - ||192.243.59.13^ ||192.243.59.13^$popup - - - ||192.243.59.20^ ||192.243.59.20^$popup - - - ||192.243.61.225^ ||192.243.61.225^$popup - - - ||192.243.61.227^ ||192.243.61.227^$popup - ||abberantextending.com^ ||abberantextending.com^$popup ||abdicatehorrified.com^ @@ -13874,21 +13377,19 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zymstr.com^ ||zymstr.com^$popup + + + + + + ||185.149.120.161^ ||185.149.120.161^$popup - - - ||185.149.120.163^ ||185.149.120.163^$popup - - - - ||185.149.120.175^ ||185.149.120.175^$popup - ! https://github.com/AdguardTeam/AdguardFilters/issues/184671 ||alatterapistroke.com^ ||alatterapistroke.com^$popup @@ -13979,97 +13480,65 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||vius-inf.com^$popup ||vrsecurego.com^ ||vrsecurego.com^$popup + + + + + + + + + + + + + + + + + + + + ||45.202.32.3^ ||45.202.32.3^$popup - - - ||45.8.92.138^ ||45.8.92.138^$popup - - - ||79.133.46.252^ ||79.133.46.252^$popup - - - ||82.147.85.156^ ||82.147.85.156^$popup - - - ||91.212.166.16^ ||91.212.166.16^$popup - - - ||94.156.64.129^ ||94.156.64.129^$popup - - - ||94.232.249.61^ ||94.232.249.61^$popup - - - ||94.232.249.69^ ||94.232.249.69^$popup - - - ||94.232.249.75^ ||94.232.249.75^$popup - - - ||94.232.249.235^ ||94.232.249.235^$popup - - - ||176.111.174.118^ ||176.111.174.118^$popup - - - ||176.113.115.191^ ||176.113.115.191^$popup - - - ||191.96.224.140^ ||191.96.224.140^$popup - - - ||193.124.185.42^ ||193.124.185.42^$popup - - - ||193.143.1.45^ ||193.143.1.45^$popup - - - ||193.143.1.214^ ||193.143.1.214^$popup - - - ||193.143.1.217^ ||193.143.1.217^$popup - - - ||208.91.189.203^ ||208.91.189.203^$popup - ://193.143.1.* ! https://github.com/AdguardTeam/AdguardFilters/issues/189905 @@ -22864,8 +22333,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yuxc.xyz^ ||103.155.214.207^ - - ! Inspired by https://github.com/AdguardTeam/AdguardFilters/issues/197908 ||app-update.site^ ||app-update.site^$popup @@ -22881,8 +22348,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||185.196.9.214^ ||185.196.9.214^$popup - - ||chrome.webredirect.org^ ||chrome.webredirect.org^$popup ||captcha.webredirect.org^ @@ -22891,8 +22356,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||185.196.9.222^ ||185.196.9.222^$popup - - ! https://github.com/AdguardTeam/AdguardFilters/issues/201064 ||100urls.com^ ||100urls.com^$popup @@ -23743,7 +23206,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||100.28.19.138^$popup ||108.61.99.63^ ||108.61.99.63^$popup - ||[2600:1f18:43d1:2a02:169f:dcbb:85f9:3c56]^ ||[2600:1f18:43d1:2a02:169f:dcbb:85f9:3c56]^$popup ||[2600:1f18:43d1:2a02:b6ee:327b:545e:e578]^ @@ -23765,6 +23227,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] + + + ! https://github.com/AdguardTeam/AdguardFilters/issues/202010 ||adblockermax.com/land,popup ! Various other reports @@ -23907,6 +23372,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] + + ||abcradilytor.com^ ||abcradilytor.com^$popup ||abmagbychan.com^ @@ -24141,11 +23608,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zacmoageeshee.net^$popup ||zucoagorsout.com^ ||zucoagorsout.com^$popup - ||139.45.197.106^ ||139.45.197.106^$popup - ! https://github.com/DandelionSprout/adfilt/issues/1129 ||password-internal.com^ ||password-internal.com^$popup @@ -24547,11 +24012,9 @@ http://secured21.*.com/|$popup ||zc-telegran.org^$popup ||zzz-telegram.com^ ||zzz-telegram.com^$popup - ||43.128.142.70^ ||43.128.142.70^$popup - ! https://github.com/AdguardTeam/AdguardFilters/issues/20787[2-5] ||chceshi001.com^ ||chceshi001.com^$popup @@ -24855,6 +24318,8 @@ http://secured21.*.com/|$popup + + ! https://github.com/DandelionSprout/adfilt/issues/1164 ||device-checking.com^ ||device-checking.com^$popup @@ -24872,11 +24337,9 @@ http://secured21.*.com/|$popup ||systemsnotifications.com^$popup ||warningnotification.com^ ||warningnotification.com^$popup - ||46.101.81.149^ ||46.101.81.149^$popup - ||adaptationfirework.com^ ||adaptationfirework.com^$popup ||armourbreederleadership.com^ @@ -24959,17 +24422,13 @@ http://secured21.*.com/|$popup ||unesmunbrebers.com^$popup ||filinnetirt.com^$popup ||freshsubz.com^ - ||52.15.34.25^ ||52.15.34.25^$popup - ! https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware - ||203.188.171.156^ ||203.188.171.156^$popup - ! https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md ||soft-gets.com^ ||soft-gets.com^$popup @@ -25492,6 +24951,7 @@ http://secured21.*.com/|$popup ||xtrash-tarck.com^$popup ||your-package-delivery.com^ ||your-package-delivery.com^$popup + ||158.94.209.86^ ||158.94.209.86^$popup ||158.94.209.87^ @@ -25510,11 +24970,43 @@ http://secured21.*.com/|$popup + + + ! https://urlscan.io/result/019a4ffd-885c-7545-816a-3c121d8bdc0d/ (Early November 2025) /linkresolver.html?url=*p0 ! https://github.com/DandelionSprout/adfilt/issues/1197 ||creations.tools^$domain=~believed_to_be_fraudsters.* ||idtsoftware.com^$domain=~believed_to_be_fraudsters.* +! https://github.com/DandelionSprout/adfilt/issues/1212 +||acrossprotocols.com^ +||acrossprotocols.com^$popup +||aftop10.com^ +||aftop10.com^$popup +||directory-opus-manager.github.io^ +||directory-opus-manager.github.io^$popup +||dokopka.icu^ +||dokopka.icu^$popup +||dramajaratstate.com^ +||dramajaratstate.com^$popup +||heygetbarter.com^ +||heygetbarter.com^$popup +||michaelborsari.com^ +||michaelborsari.com^$popup +||softs-window.com^ +||softs-window.com^$popup +||sublime-merge-git-client.github.io^ +||sublime-merge-git-client.github.io^$popup +||sublime-text-3.github.io^ +||sublime-text-3.github.io^$popup +||welearnn.com^ +||welearnn.com^$popup +||94.156.232.201^ +||94.156.232.201^$popup +||213.209.143.119^ +||213.209.143.119^$popup + + ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -26156,7 +25648,6 @@ toorgle.net##.join ||pubggf*.xyz^$popup ||pubggift*.xyz^ ||pubggift*.xyz^$popup - ||194.226.139.121^ ||194.226.139.121^$popup ||194.226.139.7^ @@ -26165,13 +25656,10 @@ toorgle.net##.join ||95.181.157.36^$popup - ||95.181.172.204^ ||95.181.172.204^$popup - - ! AS209813 (https://github.com/AdguardTeam/AdguardFilters/issues/114618#issuecomment-1100702530; currently specific to tools that support CIDR blocking) ://5.8.67. ://5.101.45. @@ -26320,8 +25808,6 @@ toorgle.net##.join ||medication.coupons^ ||147.135.16.27^ - - ! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^ ! https://scambiofigu•forumcommunity•net/?t=57482915 @@ -26334,8 +25820,6 @@ apkfab.com##.tip-extension ||ultimateclassicrock.com/redirect^$popup ||185.87.148.199^ - - ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) ||imaot.co.il/ContentArea/BannerClick^ ||imaot.co.il/ContentArea/BannerClick^$popup @@ -26353,8 +25837,6 @@ apkfab.com##.tip-extension ||zh1653.com^$popup ||45.136.49.35^ - - ||semex.com/popurl.cgi^ ||semex.com/popurl.cgi^$popup ||pharmanimal.com/catalog/redirect.php^ @@ -26377,30 +25859,24 @@ apkfab.com##.tip-extension ||cityratetod.live^ ||cityratetod.live^$popup + + + + + + + ||51.91.211.94^ ||51.91.211.94^$popup - - - ||162.19.71.16^ ||162.19.71.16^$popup - - - ||146.59.240.191^ ||146.59.240.191^$popup - - - ||54.37.5.34^ ||54.37.5.34^$popup - - - ||54.36.118.105^ ||54.36.118.105^$popup - ! Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt ||highlandnews.com^ ||highlandnews.com^$popup @@ -26411,8 +25887,6 @@ apkfab.com##.tip-extension ||159.89.10.102^ ||159.89.10.102^$popup - - ! Other ||pksauniversity.com^ ||pksauniversity.com^$popup @@ -26431,11 +25905,9 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||cbox.ws^$domain=chicks.cam ||inuseme.com^ ||inuseme.com^$popup - ://104.206.252.90^ ://104.206.252.90^$popup - ! https://github.com/blocklistproject/Lists/issues/933 ||jNKmS0zFuEh.click^ ||jNKmS0zFuEh.click^$popup @@ -26456,8 +25928,6 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||34.80.59.191^ ||34.80.59.191^$popup - - ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 |http://www6.$domain=~often_used_in_malware_redirections.* |http://www1.*&kw,domain=~often_used_in_malware_redirections.* @@ -26470,53 +25940,33 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||wh40kart.im^ ||wh40kart.im^$popup + + + + + + + + + + + + + + ||45.33.2.79^ - - - ||45.33.18.44^ - - - ||45.33.20.235^ - - - ||45.33.23.183^ - - - ||45.33.30.197^ - - - ||45.56.79.23^ - - - ||45.79.19.196^ - - - ||72.14.178.174^ - - - ||72.14.185.43^ - - - ||96.126.123.244^ - - - ||173.255.194.134^ - - - ||198.58.118.167^ - ! https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ ||1337links.net^ ||1337links.net^$popup @@ -26711,35 +26161,27 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||youwanthis.com^ ||youwanthis.com^$popup + + + + + + + + ||34.117.199.78^ ||34.117.199.78^$popup - - - ||94.237.103.119^ ||94.237.103.119^$popup - - - ||94.237.84.54^ ||94.237.84.54^$popup - - - ||94.237.93.242^ ||94.237.93.242^$popup - - - ||94.237.99.118^ ||94.237.99.118^$popup - - - ||139.45.197.249^ ||139.45.197.249^$popup - ! https://dnpedia•com/tlds/topm•php bizarrely listing "anahitagirted•uno" as the 622th most visited domain worldwide ||anahitagirted.uno^ ||anahitagirted.uno^$popup @@ -26809,40 +26251,26 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] *skobutikks.com^ *butikksoslo.com^ + + + + + + ||196.196.153.151^ ||196.196.153.151^$popup - - - ||158.222.7.116^ ||158.222.7.116^$popup - - - ||196.245.152.139^ ||196.245.152.139^$popup - - - ||165.231.251.197^ ||165.231.251.197^$popup - - - ||196.242.16.29^ ||196.242.16.29^$popup - - - ||165.231.4.90^ ||165.231.4.90^$popup - - - ||158.222.7.83^ ||158.222.7.83^$popup - - ! A scam SMS I got ||95-214-26-78.plesk.page^ ||95-214-26-78.plesk.page^$popup @@ -26857,8 +26285,6 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||95.214.26.78^ ||95.214.26.78^$popup - - ! Overly dedicated E-mail spammers ||wirexapp.africa.com^ ||wirexapp.africa.com^$popup @@ -26888,15 +26314,11 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||slownansuch.info^ ||slownansuch.info^$popup + ||185.155.184.57^ ||185.155.184.57^$popup - - - ||185.155.186.24^ ||185.155.186.24^$popup - - ||style-js.com^ ||style-js.com^$popup /a.aspx?cid=*&cname=^ @@ -26904,8 +26326,6 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||209.74.107.131^ ||209.74.107.131^$popup - - /flying.asp?cid= /flying.asp?cid=$popup /kjyo.php?cname= @@ -27036,15 +26456,11 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||zeirj14ikqwf.com^ ||zeirj14ikqwf.com^$popup + ||69.172.200.185^ ||69.172.200.185^$popup - - - ||77.220.214.153^ ||77.220.214.153^$popup - - ! More search terms than what can be counted with a supercomputer (11/03/2024) ! Scam E-mails I've got ||googleapis.com/nwfotrac^ @@ -27080,12 +26496,10 @@ tumblr.com#?#div[tabindex][style]:has(a[href*="://cutt.ly/"]) tumblr.com#?#div[tabindex][style]:has(a[href*="tinyurl."]:has-text(_1+8_)) www.tumblr.com#?#div[style="margin-top: 0px;"][tabindex]:has-text(🔞):has-text(/Insta/i) www.tumblr.com#?#div[tabindex][style="margin-top: 0px;"]:not([class],[id]):has(a[target=_blank] > div > div:has-text(/^.*🔞.*insta( |gram).*\n.*$/i)) - ://104.21.82.132^$popup ||172.67.158.57^$popup ||198.12.86.90^ ||198.12.86.90^$popup - ||[2606:4700:3030::6815:5284]^$popup ||[2606:4700:3037::ac43:9e39]^$popup ||adhitagency.shop^ @@ -27223,6 +26637,8 @@ www.tumblr.com#?#div[tabindex][style="margin-top: 0px;"]:not([class],[id]):has(a + + ||sites.google.com/view/*wincashapp^ ||iuxxx.com^ ||iuxxx.com^$popup @@ -27255,7 +26671,6 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||dreamintim.com^$popup ! R34US ! https://github.com/AdguardTeam/FiltersRegistry/issues/654#issuecomment-2629098471 - ||139.45.197.168^ ||139.45.197.168^$popup ||139.45.197.244^ @@ -27265,7 +26680,6 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h - ||ajartoalsushy.com^ ||ajartoalsushy.com^$popup ||catilrecmemsi.com^ @@ -27585,8 +26999,6 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||185.68.16.189^ ||185.68.16.189^$popup - - ||huntinginukraine.com^ ||huntinginukraine.com^$popup ||gitlab.gitlab.gitlab.$popup @@ -27597,8 +27009,6 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||76.223.15.82^ ||76.223.15.82^$popup - - ||10bestchina.com^ ||10bestchina.com^$popup ||123594.com^ @@ -29097,19 +28507,16 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||netnet44.net^ ||netnet44.net^$popup ||odintara.com^ - ||54.174.156.141^ - ! Searched for Breaking Bad Jesse memes on Qwant (29/04/2025) ://old.sermitsiaq.ag^$domain=subdomain_stolen_from_sermitsiaqs_owners.* ||xss.my.id^$third-party - ||85.159.213.158^ ||85.159.213.158^$popup - ! Seemingly mass-generated fake "marketing company" sites that seem to serve no visible purpose (12/05/2025) + ||23.170.252.196^ ||23.170.252.196^$popup ||23.229.68.43^ @@ -29379,6 +28786,9 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h + + + @@ -29418,11 +28828,9 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||rita0.com^$popup ||tshfc.com^ ||tshfc.com^$popup - ||139.45.195.9^ ||139.45.195.9^$popup - ! Other entries ||animeplaynow.com^$popup ||playanimenow.com^$popup @@ -29431,14 +28839,12 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||go.dealslandz.com^ ||go.dealslandz.com^$popup ||awecrptjmp.com^$popup - ||172.240.41.32^ ||172.240.41.32^$popup ||172.240.41.64^ ||172.240.41.64^$popup ||172.240.41.96^ ||172.240.41.96^$popup - ! Spambot(s?) on R34X³ ||24hdeepnude.com^ ! gelbo²ruCOM @@ -29458,6 +28864,8 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h + + ! bdsmx-pornCOM ||6traitors.com^ ||6traitors.com^$popup @@ -29583,6 +28991,7 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||trankosty.shop^$popup ||tubecup.org^ ||tubecup.org^$popup + ||62.122.168.42^ ||62.122.168.42^$popup ||109.206.163.112^ @@ -29628,6 +29037,9 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h + + + ||biuqbiu.com^ ||biuqbiu.com^$popup ||bmgmb.com^ @@ -29651,6 +29063,8 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h + + ||013d5342d9.com^ ||013d5342d9.com^$popup ||03122e72f0.com^ @@ -29827,10 +29241,8 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||selecttopon.com^$popup ||statelinear.com^ ||statelinear.com^$popup - ||167.235.163.216^ ||167.235.163.216^$popup - ||[2a01:4f8:c0:2343::2]^ ||[2a01:4f8:c0:2343::2]^$popup ||[2a01:4f8:e0:19cb::1]^ @@ -29838,6 +29250,8 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h + + ||a3ion.com^ ||a3ion.com^$popup ||advertrek.com^ @@ -29934,11 +29348,9 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||zlinkl.com^$popup ||zlinkv.com^ ||zlinkv.com^$popup - ||95.211.229.247^ ||95.211.229.247^$popup - ! fetish2230•rssing•com ||agdosortione.com^ ||agdosortione.com^$popup @@ -29990,11 +29402,9 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||unrertivermalous.com^$popup ||wherdiapospir.com^ ||wherdiapospir.com^$popup - ||88.208.22.1^ ||88.208.22.1^$popup - ! xmegadriveCOM ||adoredcount.com^ ||adoredcount.com^$popup @@ -30030,10 +29440,8 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||sotomistel.com^$popup ||unripereading.com^ ||unripereading.com^$popup - ||188.72.219.35^ ||188.72.219.35^$popup - ||[2a00:1178:1:4b::e]^ ||[2a00:1178:1:4b::e]^$popup @@ -30877,6 +30285,8 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h + + ! icepornCOM /adx_iframe_$third-party ! https://www•drvhub•net/devices/network/asix/ax88178a-usb-2-0-to-gigabit-ethernet-adapter @@ -31817,6 +31227,7 @@ drvhub.net##.driver-item__install ||trksp2.com^$popup ||trksp3.com^ ||trksp3.com^$popup + ||157.90.33.79^ ||157.90.33.79^$popup ||173.239.53.20^ @@ -31863,6 +31274,9 @@ drvhub.net##.driver-item__install + + + ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^ ||0network.com^$popup @@ -32244,6 +31658,7 @@ drvhub.net##.driver-item__install ||yolkdirxl.com^$popup ||zentrixads.com^ ||zentrixads.com^$popup + ||103.67.200.64^ ||103.67.200.64^$popup ||198.134.116.17^ @@ -32256,6 +31671,9 @@ drvhub.net##.driver-item__install + + + ! Extreme amounts of PUP to a comical extent ||driverpack.io^$domain=~has_extreme_amounts_of_pup_in_it.* ! https://github.com/DandelionSprout/adfilt/issues/1124 @@ -32677,8 +32095,6 @@ www.microsoft.com##a[data-pfns][href*=pac-men] - - ! https://github.com/AdguardTeam/AdguardFilters/issues/145513 @@ -32983,6 +32399,7 @@ www.google.com,ipv6.google.com,google.ac,google.ad,google.ae,google.af,google.ag ||yellowdragon.com^ ||yellowdragon.com^$popup ! Parking services' IP addresses + ||13.248.148.254^ ||13.248.148.254^$popup ||185.53.177.50^ @@ -33016,6 +32433,9 @@ www.google.com,ipv6.google.com,google.ac,google.ad,google.ae,google.af,google.ag + + + ! Bouncing hard-to-close (but admittedly empty) popups on NSFW sites like viperTO .to/popconsole.php| diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 628b22960..08e0b5056 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@  ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 27November2025v1 +! Version: 07December2025v2 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -70,12 +70,10 @@ www.google.*,ipv6.google.com##a[oncontextmenu][href^="https://books.google."]:up ! Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. ||adblock.gjtech.net^$document ||spam404bl.com^$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||109.201.135.46^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 109.201.135.46$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||109.201.135.46^$document ||fredfiber.no^$document ||securemecca.com^$document @@ -109,12 +107,10 @@ www.google.*,ipv6.google.com##a[oncontextmenu][href^="https://books.google."]:up ||mandriva.com^$document ! Fraudulent browser extensions ||ublock.org^$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||138.68.252.54^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 138.68.252.54$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||138.68.252.54^$document ||useragentswitch.com^$all ||dev-nano.com^$all ! Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. @@ -391,65 +387,11 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ! ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— ||ubuntu.org^$document,domain=~you-were-likely-looking-for-ubuntu.com -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||103.224.212.249^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -103.224.212.249$network ||speedtest.com^$document,domain=~you-were-likely-looking-for-speedtest.net ||snapchat.cm^$document,domain=~malware-typo-squatter-of-snapchat.com ||facebook.cm^$document,domain=~malware-typo-squatter-of-facebook.com ||wix.cm^$document,domain=~malware-typo-squatter-of-wix.com -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||199.59.243.222^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -199.59.243.222$network |http://ww01.$document,domain=~very_very_extremely_frequently_used_in_malware_redirections.* -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||173.208.96.42^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -173.208.96.42$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||173.208.96.43^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -173.208.96.43$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||173.208.96.44^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -173.208.96.44$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||173.208.96.45^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -173.208.96.45$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||173.208.96.46^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -173.208.96.46$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||213.227.149.208^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -213.227.149.208$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||213.227.149.211^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -213.227.149.211$network ||ddscordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com ||diicordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com ||disccrdapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com @@ -508,7 +450,42 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||githubuser.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com ||rgithub.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com ||githubt.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com -! https://scammer•info/t/discord-nitro-scam-25/87887 +!#if env_firefox +!+ PLATFORM(windows, mac, android, cli) +173.208.96.42$network +!+ PLATFORM(windows, mac, android, cli) +173.208.96.43$network +!+ PLATFORM(windows, mac, android, cli) +173.208.96.44$network +!+ PLATFORM(windows, mac, android, cli) +173.208.96.45$network +!+ PLATFORM(windows, mac, android, cli) +173.208.96.46$network +!+ PLATFORM(windows, mac, android, cli) +199.59.243.222$network +!+ PLATFORM(windows, mac, android, cli) +213.227.149.208$network +!+ PLATFORM(windows, mac, android, cli) +213.227.149.211$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||173.208.96.42^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||173.208.96.43^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||173.208.96.44^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||173.208.96.45^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||173.208.96.46^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||199.59.243.222^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||213.227.149.208^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||213.227.149.211^$all,~inline-font +!#endif ! ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— ||hippolyte-hag.com^$all @@ -517,55 +494,63 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||paramonos-oha.com^$all ||photios-raj.com^$all ||zeroredirect5.com^$document,domain=~malware_redirection_trains.* -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||54.209.22.226^$document -!#endif +||roamingclicks.com^$all +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) -54.209.22.226$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||54.91.125.197^$document -!#endif +144.76.0.242$network !+ PLATFORM(windows, mac, android, cli) -54.91.125.197$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||52.202.53.245^$document -!#endif +144.76.1.130$network !+ PLATFORM(windows, mac, android, cli) -52.202.53.245$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -://35.175.38.64^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -35.175.38.64$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -://35.168.147.213^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -35.168.147.213$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||34.230.160.215^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -34.230.160.215$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||3.226.8.132^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -3.226.8.132$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||3.216.243.46^$document -!#endif +195.201.92.254$network !+ PLATFORM(windows, mac, android, cli) 3.216.243.46$network -||roamingclicks.com^$all +!+ PLATFORM(windows, mac, android, cli) +3.226.8.132$network +!+ PLATFORM(windows, mac, android, cli) +34.230.160.215$network +!+ PLATFORM(windows, mac, android, cli) +35.168.147.213$network +!+ PLATFORM(windows, mac, android, cli) +35.175.38.64$network +!+ PLATFORM(windows, mac, android, cli) +52.202.53.245$network +!+ PLATFORM(windows, mac, android, cli) +54.209.22.226$network +!+ PLATFORM(windows, mac, android, cli) +54.91.125.197$network +!+ PLATFORM(windows, mac, android, cli) +94.130.185.237$network +!+ PLATFORM(windows, mac, android, cli) +94.130.186.231$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +://35.168.147.213^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +://35.175.38.64^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||144.76.0.242^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||144.76.1.130^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||195.201.92.254^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||3.216.243.46^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||3.226.8.132^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||34.230.160.215^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||52.202.53.245^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||54.209.22.226^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||54.91.125.197^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.130.185.237^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.130.186.231^$document +!#endif ! Source: desidertNO ||collectfasttracks.com^$all,~inline-font,domain=~malware_redirection_trains.* ! Various ex-affiliate links at www•zombooru•com @@ -577,36 +562,6 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||ns1.trafficclub.com^$all ||satcom1.co.uk^$document ||splitter.microxml.net^$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.130.185.237^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -94.130.185.237$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.130.186.231^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -94.130.186.231$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||144.76.0.242^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -144.76.0.242$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||144.76.1.130^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -144.76.1.130$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||195.201.92.254^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -195.201.92.254$network zombooru.com##a[href$="ttp://www.boorufurry.com/"] zombooru.com##a[href$="ttp://www.analbooru.com/"] zombooru.com##a[href$="ttp://www.hard55.com"] @@ -621,146 +576,6 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||couponbybox.com^$document ||newpage.in^$document /mcaf04/*=$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||34.204.214.165^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -34.204.214.165$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||54.85.113.62^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -54.85.113.62$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||54.205.83.61^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -54.205.83.61$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||54.210.193.115^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -54.210.193.115$network -[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1]$network -||banalbjar.com^$all -||coryljanty.cam^$all -||elfpetsic.com^$all -||postback.report^$all -||roksit.net^$all -||adblockerapp.com^$document,popup -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.255.6.107^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -172.255.6.107$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.255.6.147^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -172.255.6.147$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.255.6.219^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -172.255.6.219$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.255.6.225^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -172.255.6.225$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||188.42.129.108^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -188.42.129.108$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||188.42.129.116^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -188.42.129.116$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||188.42.141.100^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -188.42.141.100$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||188.42.141.92^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -188.42.141.92$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.109.82.144^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -23.109.82.144$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.109.82.41^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -23.109.82.41$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.109.82.43^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -23.109.82.43$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.109.82.65^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -23.109.82.65$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.109.82.66^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -23.109.82.66$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.109.87.169^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -23.109.87.169$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.109.87.207^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -23.109.87.207$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.109.87.208^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -23.109.87.208$network -||blueoyster.click^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||216.21.13.14^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -216.21.13.14$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||216.21.13.15^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -216.21.13.15$network /^.*\.(xyz|pics)/[a-zA-Z0-9]{130,}\$/$document,script,subdocument,image /^.*\.(cloudfront\.net|xyz|pics)/[a-zA-Z0-9]{20,}/[a-zA-Z0-9]{25,}\+[a-zA-Z0-9+]{90,}\$/$document,script,subdocument,image ||hafisague.com^$all @@ -777,12 +592,114 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||videoadblockers.$document,popup ||videoadblockertou.$document,popup ||videoadblockextension.$document,popup +||adblockerapp.com^$document,popup +||banalbjar.com^$all +||blueoyster.click^$all +||coryljanty.cam^$all +||elfpetsic.com^$all +||postback.report^$all +||roksit.net^$all +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) /^142\.91\.159\.[12]?\d?\d$/$network !+ PLATFORM(windows, mac, android, cli) /^23\.109\.150\.[12]?\d?\d$/$network !+ PLATFORM(windows, mac, android, cli) /^23\.109\.248\.[12]?\d?\d$/$network +!+ PLATFORM(windows, mac, android, cli) +172.255.6.107$network +!+ PLATFORM(windows, mac, android, cli) +172.255.6.147$network +!+ PLATFORM(windows, mac, android, cli) +172.255.6.219$network +!+ PLATFORM(windows, mac, android, cli) +172.255.6.225$network +!+ PLATFORM(windows, mac, android, cli) +188.42.129.108$network +!+ PLATFORM(windows, mac, android, cli) +188.42.129.116$network +!+ PLATFORM(windows, mac, android, cli) +188.42.141.100$network +!+ PLATFORM(windows, mac, android, cli) +188.42.141.92$network +!+ PLATFORM(windows, mac, android, cli) +216.21.13.14$network +!+ PLATFORM(windows, mac, android, cli) +216.21.13.15$network +!+ PLATFORM(windows, mac, android, cli) +23.109.82.144$network +!+ PLATFORM(windows, mac, android, cli) +23.109.82.41$network +!+ PLATFORM(windows, mac, android, cli) +23.109.82.43$network +!+ PLATFORM(windows, mac, android, cli) +23.109.82.65$network +!+ PLATFORM(windows, mac, android, cli) +23.109.82.66$network +!+ PLATFORM(windows, mac, android, cli) +23.109.87.169$network +!+ PLATFORM(windows, mac, android, cli) +23.109.87.207$network +!+ PLATFORM(windows, mac, android, cli) +23.109.87.208$network +!+ PLATFORM(windows, mac, android, cli) +34.204.214.165$network +!+ PLATFORM(windows, mac, android, cli) +54.205.83.61$network +!+ PLATFORM(windows, mac, android, cli) +54.210.193.115$network +!+ PLATFORM(windows, mac, android, cli) +54.85.113.62$network +!+ PLATFORM(windows, mac, android, cli) +2600:1f18:43d1:2a04:ee05:261e:d408:7ba1$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.255.6.107^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.255.6.147^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.255.6.219^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.255.6.225^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||188.42.129.108^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||188.42.129.116^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||188.42.141.100^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||188.42.141.92^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||216.21.13.14^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||216.21.13.15^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.109.82.144^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.109.82.41^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.109.82.43^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.109.82.65^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.109.82.66^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.109.87.169^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.109.87.207^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.109.87.208^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||34.204.214.165^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||54.205.83.61^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||54.210.193.115^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||54.85.113.62^$document +[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1]$network +!#endif ! https://github.com/DandelionSprout/adfilt/issues/942 !+ PLATFORM(windows, mac, android, cli) /^172\.255\.6\.(\d\d?|(17?|2)[0-689]\d)$/$network @@ -1142,75 +1059,69 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/61743 /^(https?://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$document,popup ! https://github.com/easylist/easylist/issues/6111 -||fres-news.com^$all -||workerz-news.com^$all -||zredir.com^$all,~inline-font,domain=~malware_redirection_trains.* -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||178.128.142.109^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -178.128.142.109$network -||findmedia.biz^$all +/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$document ||backtonews.biz^$all ||bagclick.biz^$all +||best202*-games-web1.com^$all ||bigkick.biz^$all +||findmedia.biz^$all +||fres-news.com^$all ||getcontent24.com^$all -||klickmode.biz^$all -||newsgate.biz^$all -||redmdeia.biz^$all -||uptodater.net^$all -||virnews.club^$all -/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||134.209.136.174^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -134.209.136.174$network -||whiteclick.biz^$all ||gonews2.com^$all +||hooligapps.com^$all +||klickmode.biz^$all ||mediadate.net^$all ||newscode.me^$all +||newsgate.biz^$all +||redmdeia.biz^$all ||skymedia7.me^$all ||startmode.biz^$all ||texterra.me^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||62.210.6.153^$document -!#endif +||theonlygames.com^$all +||uptodater.net^$all +||virnews.club^$all +||whiteclick.biz^$all +||workerz-news.com^$all +||zredir.com^$all,~inline-font,domain=~malware_redirection_trains.* +!#if env_firefox +!+ PLATFORM(windows, mac, android, cli) +134.209.136.174$network +!+ PLATFORM(windows, mac, android, cli) +178.128.142.109$network +!+ PLATFORM(windows, mac, android, cli) +62.210.11.203$network !+ PLATFORM(windows, mac, android, cli) 62.210.6.153$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||62.210.7.209^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 62.210.7.209$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +62.210.9.92$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||134.209.136.174^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||178.128.142.109^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||62.210.11.203^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||62.210.6.153^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||62.210.7.209^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||62.210.9.92^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -62.210.9.92$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||62.210.11.203^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -62.210.11.203$network -||hooligapps.com^$all -||best202*-games-web1.com^$all -||theonlygames.com^$all ! https://maldita•es/malditobulo/2020/12/04/concurso-mercadona-ganar-tarjeta-regalo-100-euros-phishing/ ||notified-today.com^ ||new-message.email^$document -!#if !adguard_app_windows +!#if env_firefox +!+ PLATFORM(windows, mac, android, cli) +167.99.249.47$network +!#endif +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||167.99.249.47^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -167.99.249.47$network ! https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ ! https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ ||moderncomputer.net^ @@ -1239,105 +1150,89 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||kmip.net^$all ||0redirc.com^$all,~inline-font,domain=~malware_redirection_trains.* ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||5.8.34.26^$document -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 5.8.34.26$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||5.8.47.3^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 5.8.47.3$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +103.224.182.251$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||5.8.34.26^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||5.8.47.3^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||103.224.182.251^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -103.224.182.251$network ! https://github.com/DandelionSprout/adfilt/issues/193 ||holescontracting.com^$all ||doggroomingnews.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||5.79.71.205^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -5.79.71.205$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||5.79.71.225^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -5.79.71.225$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||85.17.31.82^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -85.17.31.82$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||85.17.31.122^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -85.17.31.122$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||178.162.203.202^$document -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 178.162.203.202$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||178.162.203.211^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 178.162.203.211$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||178.162.203.226^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 178.162.203.226$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||178.162.217.107^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 178.162.217.107$network +!+ PLATFORM(windows, mac, android, cli) +5.79.71.205$network +!+ PLATFORM(windows, mac, android, cli) +5.79.71.225$network +!+ PLATFORM(windows, mac, android, cli) +85.17.31.122$network +!+ PLATFORM(windows, mac, android, cli) +85.17.31.82$network +!+ PLATFORM(windows, mac, android, cli) +2a02:1668:1034::2$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||178.162.203.202^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||178.162.203.211^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||178.162.203.226^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||178.162.217.107^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||5.79.71.205^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||5.79.71.225^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||85.17.31.122^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||85.17.31.82^$document [2a02:1668:1034::2]$network +!#endif ! https://github.com/DandelionSprout/adfilt/issues/195 ||logicalrecord.com^$all ! https://github.com/DandelionSprout/adfilt/issues/196 ||secureportal.online^$all ||emiratenbduae.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||66.85.156.85^$document -!#endif +!#if env_firefox +!+ PLATFORM(windows, mac, android, cli) +108.170.31.123$network +!+ PLATFORM(windows, mac, android, cli) +108.170.52.156$network !+ PLATFORM(windows, mac, android, cli) 66.85.156.85$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +66.85.156.86$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||108.170.31.123^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||108.170.52.156^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||66.85.156.85^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||66.85.156.86^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -66.85.156.86$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||108.170.31.123^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -108.170.31.123$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||108.170.52.156^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -108.170.52.156$network ! https://github.com/DandelionSprout/adfilt/issues/198 ! https://www•bleepingcomputer•com/virus-removal/ (18/06/2021) ||toksearches.xyz^$all @@ -1387,24 +1282,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||video-call.live^$all ||video-change.digital^$all ||watch-this.live^$all -!#if !adguard_app_windows +!#if env_firefox +!+ PLATFORM(windows, mac, android, cli) +213.227.145.147$network +!+ PLATFORM(windows, mac, android, cli) +213.227.149.216$network +!+ PLATFORM(windows, mac, android, cli) +95.168.170.165$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||213.227.145.147^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||213.227.149.216^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||95.168.170.165^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -95.168.170.165$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||213.227.145.147^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -213.227.145.147$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||213.227.149.216^$document -!#endif -!+ PLATFORM(windows, mac, android, cli) -213.227.149.216$network ! https://twitter•com/adamziaja/status/1252234957679808513 ||wow-robotics.xyz^$all ! https://blog•sucuri•net/2021/05/woocommerce-credit-card-skimmer•html @@ -1413,22 +1306,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||albumzips.xyz^$all ||aleinvest.xyz^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||5.188.62.36^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 5.188.62.36$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||5.188.62.36^$document ! https://github.com/DandelionSprout/adfilt/issues/223 ||speedupmypcfree.com^$all ! https://github.com/DandelionSprout/adfilt/issues/224 ||ssielearning.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||69.49.231.244^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 69.49.231.244$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||69.49.231.244^$document ! https://movsb•0x0•st/users/mia ||5starhdporn.com^$frame,third-party ! https://github.com/DandelionSprout/adfilt/issues/228 @@ -1443,12 +1332,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/issues/251#issue-974102211 ||nanorgin.ydns.eu^$all ||yzsnw.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||37.34.176.37^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 37.34.176.37$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||37.34.176.37^$document ||pcspeedcat.com^$all ||auslogics.com^$document ! (https://github.com/DandelionSprout/adfilt/issues/1076) @@ -1465,45 +1352,37 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||mgmgmg.com^$all ||temp74.com^$all ||trackwebclick.com^$all,~inline-font,domain=~malware_redirection_trains.* -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.111.31.137^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 23.111.31.137$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.111.88.207^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 23.111.88.207$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.111.31.137^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.111.88.207^$document ! https://github.com/DandelionSprout/adfilt/issues/254 ||onesafesoftware.com^$document ! https://github.com/DandelionSprout/adfilt/issues/257 -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.158.250.239^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 185.158.250.239$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||192.169.69.25^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 192.169.69.25$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||212.192.241.72^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 212.192.241.72$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +37.0.10.83$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.158.250.239^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||192.169.69.25^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||212.192.241.72^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||37.0.10.83^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -37.0.10.83$network ||secure-0*.ddnss.ch^$all ||lucdream.com^$document ||pesoaniz.com^$document @@ -1517,12 +1396,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/url/8066b87ad10ddb5466bc307bb48454139572f6c8c8f80a9734275ac89cf966af/detection ! https://www•virustotal•com/gui/url/826c451929420c4da32552f967fb1cab6467405a29c65b23802aaadb6a8c7505/detection ! https://safeweb•norton•com/report/show?url=192•3•110•170 -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||192.3.110.170^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 192.3.110.170$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||192.3.110.170^$all,~inline-font ! https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ ||socialsearchconverter.com^$document ||install.socialsearchconverter.com^$all @@ -1547,12 +1424,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•virustotal•com/gui/file/c683bc3da4966110b419ac54d09a54ce798efdb51be398331d9ce011e2636fa9/community ! https://www•virustotal•com/gui/url/5618023ed5a768d7f879c0d599b9ba7cff0e9171201981256eeaf5ce8eb09fdb/detection ! https://www•virustotal•com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||91.241.19.38^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 91.241.19.38$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||91.241.19.38^$all,~inline-font ! https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection ! https://safeweb•norton•com/report/show?url=telete•in ! https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -1562,125 +1437,95 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||kiff.tech^$all ! https://www•virustotal•com/gui/domain/kiff•tech/relations ! https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.90.58.90^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 45.90.58.90$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.90.58.90^$document ! https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community ! https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||95.85.89.98^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 95.85.89.98$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||95.85.89.98^$all,~inline-font ! https://github.com/DandelionSprout/adfilt/issues/267 ||mediafire.com/file/pj9jdm7iznc4d51/tekhacksnet_multi_loader.rar^$document ! https://github.com/DandelionSprout/adfilt/pull/278 !! https://www.virustotal.com/gui/file/da75c85fe037f9ff9ebbbd0b37dd2ff154f5e70a0dc6870286e0d3df6b8f246f/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||139.28.37.49^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 139.28.37.49$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||139.28.37.49^$all,~inline-font !! https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ://35.194.188.37^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 35.194.188.37$network !! https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community !! https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||91.243.121.19^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 91.243.121.19$network -!! https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) -||103.169.90.205^$all,~inline-font -!#endif +||91.243.121.19^$all,~inline-font +!! https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community !+ PLATFORM(windows, mac, android, cli) 103.169.90.205$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||103.169.90.205^$all,~inline-font ! https://github.com/DandelionSprout/adfilt/pull/281 ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||125.44.43.45^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 125.44.43.45$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||182.121.8.240^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 182.121.8.240$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||42.235.183.74^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 42.235.183.74$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||78.36.32.242^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 78.36.32.242$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.50.2.119^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 115.50.2.119$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.50.110.163^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 115.50.110.163$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||119.179.84.145^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 119.179.84.145$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||188.120.50.98^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 188.120.50.98$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||190.238.183.5^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 190.238.183.5$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +27.220.253.78$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||125.44.43.45^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||182.121.8.240^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||42.235.183.74^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||78.36.32.242^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.50.2.119^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.50.110.163^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||119.179.84.145^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||188.120.50.98^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||190.238.183.5^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||27.220.253.78^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -27.220.253.78$network ! https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community ||esetnode32-antiviru.ydns.eu^$all ! https://www•joesandbox•com/analysis/486636/0/html#domains ||aieov.com^$all ! Relations to the original domain -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||192.3.194.242^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 192.3.194.242$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||192.3.194.242^$all,~inline-font ||w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu^$all ||hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu^$all ||avira-antivirus.ydns.eu^$all @@ -1717,337 +1562,237 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||cd.org^$document ! https://www•virustotal•com/gui/file/78f490e503c86eaaff5760197b9ff5308ed6e03161af13194a6c1e0cd95422de/community ! https://github.com/DandelionSprout/adfilt/commit/f7f114945c83b339be5cdd848e229680d9918abb#commitcomment-57642875 -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.94.26.138^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 23.94.26.138$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.94.26.138^$all,~inline-font ! https://github.com/DandelionSprout/adfilt/pull/298 ! https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||205.185.126.200^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 205.185.126.200$network -! https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) -||185.243.56.167^$all,~inline-font -!#endif +||205.185.126.200^$all,~inline-font +! https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community !+ PLATFORM(windows, mac, android, cli) 185.243.56.167$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.243.56.167^$all,~inline-font ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||123.10.224.135^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -123.10.224.135$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||59.47.187.147^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -59.47.187.147$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||39.68.172.210^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -39.68.172.210$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||122.192.177.176^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -122.192.177.176$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||112.27.124.108^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -112.27.124.108$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||123.110.176.246^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -123.110.176.246$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||219.155.105.98^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -219.155.105.98$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||171.35.161.209^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -171.35.161.209$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||60.16.255.36^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -60.16.255.36$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||112.30.4.52^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -112.30.4.52$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||182.121.191.201^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -182.121.191.201$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||121.61.48.170^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -121.61.48.170$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||39.81.68.45^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -39.81.68.45$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||27.222.220.164^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -27.222.220.164$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||113.233.215.135^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -113.233.215.135$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||151.77.100.133^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -151.77.100.133$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||125.120.13.184^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -125.120.13.184$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||120.12.138.133^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -120.12.138.133$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||27.194.115.185^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -27.194.115.185$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -://104.128.199.228^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -104.128.199.228$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||183.92.123.145^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -183.92.123.145$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||110.89.8.126^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -110.89.8.126$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||125.43.211.184^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -125.43.211.184$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||1.0.218.230^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 1.0.218.230$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +27.194.115.185$network +!+ PLATFORM(windows, mac, android, cli) +27.222.220.164$network +!+ PLATFORM(windows, mac, android, cli) +39.68.172.210$network +!+ PLATFORM(windows, mac, android, cli) +39.81.68.45$network +!+ PLATFORM(windows, mac, android, cli) +42.53.240.249$network +!+ PLATFORM(windows, mac, android, cli) +59.47.187.147$network +!+ PLATFORM(windows, mac, android, cli) +60.13.60.19$network +!+ PLATFORM(windows, mac, android, cli) +60.16.255.36$network +!+ PLATFORM(windows, mac, android, cli) +61.52.8.62$network +!+ PLATFORM(windows, mac, android, cli) +72.51.127.213$network +!+ PLATFORM(windows, mac, android, cli) +103.19.128.222$network +!+ PLATFORM(windows, mac, android, cli) +104.128.199.228$network +!+ PLATFORM(windows, mac, android, cli) +110.241.119.159$network +!+ PLATFORM(windows, mac, android, cli) +110.89.8.126$network +!+ PLATFORM(windows, mac, android, cli) +111.224.199.91$network +!+ PLATFORM(windows, mac, android, cli) +112.252.132.185$network +!+ PLATFORM(windows, mac, android, cli) +112.27.124.108$network +!+ PLATFORM(windows, mac, android, cli) +112.30.110.58$network +!+ PLATFORM(windows, mac, android, cli) +112.30.4.52$network +!+ PLATFORM(windows, mac, android, cli) +113.233.215.135$network +!+ PLATFORM(windows, mac, android, cli) +115.52.240.69$network +!+ PLATFORM(windows, mac, android, cli) +115.56.137.49$network +!+ PLATFORM(windows, mac, android, cli) +115.56.31.133$network +!+ PLATFORM(windows, mac, android, cli) +116.179.138.68$network +!+ PLATFORM(windows, mac, android, cli) +117.198.240.157$network +!+ PLATFORM(windows, mac, android, cli) +119.102.7.115$network +!+ PLATFORM(windows, mac, android, cli) +119.250.236.122$network +!+ PLATFORM(windows, mac, android, cli) +120.12.138.133$network +!+ PLATFORM(windows, mac, android, cli) +120.4.141.185$network +!+ PLATFORM(windows, mac, android, cli) +121.61.48.170$network +!+ PLATFORM(windows, mac, android, cli) +122.192.177.176$network +!+ PLATFORM(windows, mac, android, cli) +123.10.224.135$network +!+ PLATFORM(windows, mac, android, cli) +123.110.176.246$network +!+ PLATFORM(windows, mac, android, cli) +124.91.237.188$network +!+ PLATFORM(windows, mac, android, cli) +125.120.13.184$network +!+ PLATFORM(windows, mac, android, cli) +125.43.211.184$network +!+ PLATFORM(windows, mac, android, cli) +151.77.100.133$network +!+ PLATFORM(windows, mac, android, cli) +171.35.161.209$network +!+ PLATFORM(windows, mac, android, cli) +171.37.29.87$network +!+ PLATFORM(windows, mac, android, cli) +182.121.191.201$network +!+ PLATFORM(windows, mac, android, cli) +182.122.252.69$network +!+ PLATFORM(windows, mac, android, cli) +183.92.123.145$network +!+ PLATFORM(windows, mac, android, cli) +202.12.80.74$network +!+ PLATFORM(windows, mac, android, cli) +219.155.105.98$network +!+ PLATFORM(windows, mac, android, cli) +219.155.26.50$network +!+ PLATFORM(windows, mac, android, cli) +221.208.4.56$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +://104.128.199.228^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||27.194.115.185^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||27.222.220.164^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||39.68.172.210^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||39.81.68.45^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||42.53.240.249^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||59.47.187.147^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||60.13.60.19^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||60.16.255.36^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||61.52.8.62^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||72.51.127.213^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||1.0.218.230^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||103.19.128.222^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||110.241.119.159^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||110.89.8.126^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||111.224.199.91^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||112.252.132.185^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||112.27.124.108^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||112.30.110.58^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||112.30.4.52^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||113.233.215.135^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.52.240.69^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.56.137.49^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.56.31.133^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||116.179.138.68^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||117.198.240.157^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||119.102.7.115^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||119.250.236.122^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||120.12.138.133^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||120.4.141.185^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||121.61.48.170^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||122.192.177.176^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||123.10.224.135^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||123.110.176.246^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||124.91.237.188^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||125.120.13.184^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||125.43.211.184^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||151.77.100.133^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||171.35.161.209^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||171.37.29.87^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||182.121.191.201^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||182.122.252.69^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||183.92.123.145^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||202.12.80.74^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||219.155.105.98^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||219.155.26.50^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||221.208.4.56^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -221.208.4.56$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||60.13.60.19^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -60.13.60.19$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||171.37.29.87^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -171.37.29.87$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||124.91.237.188^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -124.91.237.188$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.56.137.49^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -115.56.137.49$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.52.240.69^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -115.52.240.69$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||112.252.132.185^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -112.252.132.185$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||117.198.240.157^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -117.198.240.157$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||42.53.240.249^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -42.53.240.249$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||116.179.138.68^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -116.179.138.68$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||110.241.119.159^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -110.241.119.159$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.56.31.133^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -115.56.31.133$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||103.19.128.222^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -103.19.128.222$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||202.12.80.74^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -202.12.80.74$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||61.52.8.62^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -61.52.8.62$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||182.122.252.69^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -182.122.252.69$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||219.155.26.50^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -219.155.26.50$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||120.4.141.185^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -120.4.141.185$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||119.102.7.115^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -119.102.7.115$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||72.51.127.213^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -72.51.127.213$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||111.224.199.91^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -111.224.199.91$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||119.250.236.122^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -119.250.236.122$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||112.30.110.58^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -112.30.110.58$network ! https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community ||pcae.de^$document ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||117.196.49.21^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 117.196.49.21$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.55.54.234^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 115.55.54.234$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.52.17.123^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 115.52.17.123$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +182.59.69.21$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||117.196.49.21^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.55.54.234^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.52.17.123^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||182.59.69.21^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -182.59.69.21$network ! https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community ||chip-secured-download.de^$all ! https://www•virustotal•com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb @@ -2068,12 +1813,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||realdefen.se^$document ! Vermilion Strike ! https://www•virustotal•com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||160.202.163.100^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 160.202.163.100$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||160.202.163.100^$all,~inline-font ! https://www•virustotal•com/gui/ip-address/160•202•163•100/relations ||microsoftkernel.com^$all ||microsofthk.com^$all @@ -2085,26 +1828,20 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-944612753 ! https://github.com/DandelionSprout/adfilt/pull/303 ! https://www•virustotal•com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.95.169.115^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 45.95.169.115$network -! https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) -||45.148.120.80^$all,~inline-font -!#endif +||45.95.169.115^$all,~inline-font +! https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community !+ PLATFORM(windows, mac, android, cli) 45.148.120.80$network -! https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) -||85.239.33.9^$all,~inline-font -!#endif +||45.148.120.80^$all,~inline-font +! https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community !+ PLATFORM(windows, mac, android, cli) 85.239.33.9$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||85.239.33.9^$all,~inline-font ! Relations to the domain above ||adminsys.serveftp.com^$all ||amazbaidu.serveftp.com^$all @@ -2121,19 +1858,15 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||1log-wellsfargo.serveftp.com^$all ||eposcardokubo.serveftp.com^$all ! https://www•virustotal•com/gui/file/8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||107.173.176.183^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 107.173.176.183$network -! https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) -||45.148.120.171^$all,~inline-font -!#endif +||107.173.176.183^$all,~inline-font +! https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community !+ PLATFORM(windows, mac, android, cli) 45.148.120.171$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.148.120.171^$all,~inline-font ! https://twitter•com/soranker0/status/1449491402409185283 ://disordgift.$all ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-950330114 @@ -2141,12 +1874,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||google-yandex.$document /^(.*://|.*\.)?[a-z]{5,}-[a-z]{5,}-[a-z]{5,}\.xyz(/.*)?$/$document ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-951321929 -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||159.148.186.228^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 159.148.186.228$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||159.148.186.228^$all,~inline-font ! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains ||yotube.com^$all ||security-scanner.xyz^$all @@ -2164,243 +1895,175 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||mediadlvr.com^$all ! https://github.com/DandelionSprout/adfilt/pull/348 ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||39.83.80.247^$all,~inline-font -!#endif +!#if env_firefox +!+ PLATFORM(windows, mac, android, cli) +103.233.216.77$network +!+ PLATFORM(windows, mac, android, cli) +106.86.172.194$network +!+ PLATFORM(windows, mac, android, cli) +110.167.64.171$network +!+ PLATFORM(windows, mac, android, cli) +112.31.211.135$network +!+ PLATFORM(windows, mac, android, cli) +115.59.197.46$network +!+ PLATFORM(windows, mac, android, cli) +116.17.210.157$network +!+ PLATFORM(windows, mac, android, cli) +119.113.248.74$network +!+ PLATFORM(windows, mac, android, cli) +122.159.29.192$network +!+ PLATFORM(windows, mac, android, cli) +123.10.65.201$network +!+ PLATFORM(windows, mac, android, cli) +125.106.63.93$network +!+ PLATFORM(windows, mac, android, cli) +125.47.205.109$network +!+ PLATFORM(windows, mac, android, cli) +125.47.243.187$network +!+ PLATFORM(windows, mac, android, cli) +168.90.205.46$network +!+ PLATFORM(windows, mac, android, cli) +171.40.0.127$network +!+ PLATFORM(windows, mac, android, cli) +171.80.219.160$network +!+ PLATFORM(windows, mac, android, cli) +175.0.95.85$network +!+ PLATFORM(windows, mac, android, cli) +182.117.231.182$network +!+ PLATFORM(windows, mac, android, cli) +182.122.196.203$network +!+ PLATFORM(windows, mac, android, cli) +182.123.141.17$network +!+ PLATFORM(windows, mac, android, cli) +183.15.90.156$network +!+ PLATFORM(windows, mac, android, cli) +183.188.192.55$network +!+ PLATFORM(windows, mac, android, cli) +219.157.21.37$network +!+ PLATFORM(windows, mac, android, cli) +222.142.183.194$network +!+ PLATFORM(windows, mac, android, cli) +27.45.103.240$network +!+ PLATFORM(windows, mac, android, cli) +39.80.147.239$network +!+ PLATFORM(windows, mac, android, cli) +39.81.117.73$network !+ PLATFORM(windows, mac, android, cli) 39.83.80.247$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +45.224.171.130$network +!+ PLATFORM(windows, mac, android, cli) +45.5.209.75$network +!+ PLATFORM(windows, mac, android, cli) +61.52.99.109$network +!+ PLATFORM(windows, mac, android, cli) +68.197.33.124$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||103.233.216.77^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||106.86.172.194^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||110.167.64.171^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||112.31.211.135^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.59.197.46^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||116.17.210.157^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||119.113.248.74^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||122.159.29.192^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||123.10.65.201^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||125.106.63.93^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||125.47.205.109^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||125.47.243.187^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||168.90.205.46^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||171.40.0.127^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||171.80.219.160^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||175.0.95.85^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||182.117.231.182^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||182.122.196.203^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||182.123.141.17^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||183.15.90.156^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||183.188.192.55^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||219.157.21.37^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||222.142.183.194^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||27.45.103.240^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||39.80.147.239^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||39.81.117.73^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||39.83.80.247^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.224.171.130^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.5.209.75^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||61.52.99.109^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||68.197.33.124^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -68.197.33.124$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||219.157.21.37^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -219.157.21.37$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||182.123.141.17^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -182.123.141.17$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||125.47.243.187^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -125.47.243.187$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||182.122.196.203^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -182.122.196.203$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||182.117.231.182^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -182.117.231.182$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||112.31.211.135^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -112.31.211.135$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||125.106.63.93^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -125.106.63.93$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.59.197.46^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -115.59.197.46$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||122.159.29.192^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -122.159.29.192$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||171.40.0.127^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -171.40.0.127$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||171.80.219.160^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -171.80.219.160$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||123.10.65.201^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -123.10.65.201$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||168.90.205.46^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -168.90.205.46$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||125.47.205.109^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -125.47.205.109$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||39.80.147.239^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -39.80.147.239$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.224.171.130^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -45.224.171.130$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.5.209.75^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -45.5.209.75$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||116.17.210.157^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -116.17.210.157$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||27.45.103.240^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -27.45.103.240$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||110.167.64.171^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -110.167.64.171$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||39.81.117.73^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -39.81.117.73$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||183.15.90.156^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -183.15.90.156$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||119.113.248.74^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -119.113.248.74$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||175.0.95.85^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -175.0.95.85$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||61.52.99.109^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -61.52.99.109$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||222.142.183.194^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -222.142.183.194$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||106.86.172.194^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -106.86.172.194$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||103.233.216.77^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -103.233.216.77$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||183.188.192.55^$all,~inline-font -!#endif -!+ PLATFORM(windows, mac, android, cli) -183.188.192.55$network ! https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||198.23.255.14^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 198.23.255.14$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||198.23.255.14^$all,~inline-font ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971512075 ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971495248 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/15/1.md#iocs ||trumops.com^$document ||runmodes.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||91.121.67.60^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 91.121.67.60$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.67.186.189^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 172.67.186.189$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||91.121.67.60^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.67.186.189^$all,~inline-font ! https://scammer•info/t/mcafee-phish/83725 ||securefirst.us-east-1.linodeobjects.com^$all ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||39.65.72.211^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 39.65.72.211$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||42.238.151.197^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 42.238.151.197$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||27.213.60.53^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 27.213.60.53$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +115.56.169.134$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||39.65.72.211^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||42.238.151.197^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||27.213.60.53^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||115.56.169.134^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -115.56.169.134$network ! https://github.com/iam-py-test/investigations/blob/main/2021/11/21/1.md ||yasir252.com^$all ||safelink.kadal.club^$document @@ -2412,19 +2075,15 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yourladiefun.life^$all ! https://www•virustotal•com/gui/url/a2524bba49ae71297d2b408b30d058700d9c80b5b1154924cafe190ec3e605a6/detection ! https://www•virustotal•com/gui/file/2b2628a50d3b39b0fa2395d487bf62b00e37cdae847ff76ee58399bbe4e9f7b3/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||194.87.138.20^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 194.87.138.20$network -! https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) -||103.167.92.73^$all,~inline-font -!#endif +||194.87.138.20^$all,~inline-font +! https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community !+ PLATFORM(windows, mac, android, cli) 103.167.92.73$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||103.167.92.73^$all,~inline-font ! https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community ||bursakulis.com^$all ! https://www•virustotal•com/gui/url/b333c49efa4d399e65c5e2d96a905b380acbca58a3e3052b7bd7cfcb3e0e81ee @@ -2446,54 +2105,42 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yunosurveys.com^$all ! https://github.com/uBlockOrigin/uAssets/pull/10620 ! https://www•virustotal•com/gui/file/d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||58.249.74.79^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 58.249.74.79$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||27.45.14.109^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 27.45.14.109$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||27.40.101.191^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 27.40.101.191$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||27.45.119.22^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 27.45.119.22$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||27.47.73.159^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 27.47.73.159$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.204.119.237^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 115.204.119.237$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||163.125.31.46^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 163.125.31.46$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +163.179.168.44$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||58.249.74.79^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||27.45.14.109^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||27.40.101.191^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||27.45.119.22^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||27.47.73.159^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.204.119.237^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||163.125.31.46^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||163.179.168.44^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -163.179.168.44$network ! https://github.com/uBlockOrigin/uAssets/pull/10647 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md ||money-mod.com^$document @@ -2506,72 +2153,54 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||mediafire.com/file/at2tvnao5x6ivdo/EngineOwning.rar/$all ||download2264.mediafire.com/pnk44f5ci9rg/at2tvnao5x6ivdo/EngineOwning.rar^$all ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||110.89.59.135^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 110.89.59.135$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||113.116.89.1^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 113.116.89.1$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||119.183.146.191^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 119.183.146.191$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||153.3.3.226^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 153.3.3.226$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||182.116.104.6^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 182.116.104.6$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||60.7.133.200^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 60.7.133.200$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||122.6.254.201^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 122.6.254.201$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||110.89.11.167^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 110.89.11.167$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||171.112.177.90^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 171.112.177.90$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||115.194.38.143^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 115.194.38.143$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +61.52.79.32$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||110.89.59.135^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||113.116.89.1^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||119.183.146.191^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||153.3.3.226^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||182.116.104.6^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||60.7.133.200^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||122.6.254.201^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||110.89.11.167^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||171.112.177.90^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||115.194.38.143^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||61.52.79.32^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -61.52.79.32$network ! https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 ://ups-dk.$document,denyallow=dk|nu|se|no|fo|gl|ups.com,domain=ups-dk.* ! https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 @@ -2588,12 +2217,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•nrk.no/vestfoldogtelemark/1.15750360 ||dundeehills.group^$all !+ NOT_OPTIMIZED -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||132.148.220.142^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 132.148.220.142$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||132.148.220.142^$document ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 ||chess-progress.ru^$document ! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 @@ -2610,78 +2237,60 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||p-stn.net^$all ! https://github.com/iam-py-test/investigations/blob/main/2021/12/13/1.md ||haxpc.net^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||52.53.243.52^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 52.53.243.52$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||34.201.22.10^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 34.201.22.10$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||52.53.243.52^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||34.201.22.10^$all,~inline-font ! https://scammer•info/t/crypto-scammers-onceagain/85354 ||business.google.com/website/billyandscapedesign^$all ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||123.10.225.196^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 123.10.225.196$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||122.192.106.84^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 122.192.106.84$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.88.199.9^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 172.88.199.9$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||114.38.176.185^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 114.38.176.185$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||61.52.97.35^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 61.52.97.35$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||27.206.181.208^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 27.206.181.208$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||124.163.130.175^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 124.163.130.175$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +118.75.87.102$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||123.10.225.196^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||122.192.106.84^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.88.199.9^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||114.38.176.185^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||61.52.97.35^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||27.206.181.208^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||124.163.130.175^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||118.75.87.102^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -118.75.87.102$network ! https://github.com/iam-py-test/investigations/blob/main/2021/12/14/1.md ! https://github.com/DevSpen/links/pull/3 ! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||134.122.115.190^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 134.122.115.190$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||134.122.115.190^$all,~inline-font ||cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com^$all ! https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777 ||viewty.xyz^$all @@ -2698,12 +2307,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||microsoftedge.microsoft.com/addons/detail/ecosia-the-search-engin/fhfidmlnclkepgapcephbaciajegheco^$document ! https://github.com/AdguardTeam/AdguardFilters/issues/103475 ||ru.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||141.8.226.34^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 141.8.226.34$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||141.8.226.34^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/108571 ||ston-app.com^$all ! fake human verification scam @@ -2715,12 +2322,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! Other ||crashfixes.com^$all ! https://www•virustotal•com/gui/file/9d40ae0439ddc594b2cf64e21ad0fdea9bb440524298e3a6bcfcc1fb417f1ed2/relations -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||91.240.118.172^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 91.240.118.172$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||91.240.118.172^$all,~inline-font ! "Press Allow to continue" ||kuyhaa-mee.com^$all ||upload-4ever.com^$document @@ -2747,12 +2352,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||activatorwin.com^$all ||freeversioncrack.com^$document ||top3hostngc.xyz^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||198.199.120.251^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 198.199.120.251$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||198.199.120.251^$all,~inline-font ! https://www•telia•no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}\$/$document @@ -2761,63 +2364,55 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||findsexy.life^$all ||findsolemate.life^$all ||dating-galaxy.life^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||195.201.253.130^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 195.201.253.130$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||195.201.253.131^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 195.201.253.131$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||195.201.253.130^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||195.201.253.131^$document ! The bottom download button on https://www•sushichop•com/ ||installiq.com^$all /trk2/*?lddomain=$document,domain=~very_likely_a_malware_redirection.* ||cpmverdirect.com^$document,domain=~malware_redirection_trains.* -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||15.197.244.48^$document -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 15.197.244.48$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||96.47.230.67^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 96.47.230.67$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||96.47.230.68^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 96.47.230.68$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||96.47.230.69^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 96.47.230.69$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +96.47.230.70$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||15.197.244.48^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||96.47.230.67^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||96.47.230.68^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||96.47.230.69^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||96.47.230.70^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -96.47.230.70$network ! https://securitytrails•com/list/ns/ns1•fastthinkingdns•com ||highercaptcha-settle.$all ||highercaptchasettle.$all ||ns*.fastthinkingdns.com^$all ||top-captcharesolver.$all +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) /^46\.161\.27\.[12]?\d?\d$/$network !+ PLATFORM(windows, mac, android, cli) /^78\.128\.112\.[12]?\d?\d$/$network !+ PLATFORM(windows, mac, android, cli) /^179\.60\.146\.[12]?\d?\d$/$network +!#endif ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 ||trafredirtds.com^$all,~inline-font,domain=~malware_redirection_trains.* ||com/landers/iphone*_spin$document @@ -2830,12 +2425,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||kdmrqw.com^$all ||kdmttk.com^$all ||uuidtsinc.net^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||31.220.27.134^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 31.220.27.134$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||31.220.27.134^$document ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk.$document ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 @@ -2960,6 +2553,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||z-bounty.icu^$all ||z-game.icu^$all ||z-prize.icu^$all +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) /^178\.253\.[0-7]\.[12]?\d?\d$/$network !+ PLATFORM(windows, mac, android, cli) @@ -2976,43 +2570,34 @@ zombooru.com##a[href$="ttp://www.hard55.com"] /^178\.253\.47\.[12]?\d?\d$/$network !+ PLATFORM(windows, mac, android, cli) /^178\.253\.54\.[12]?\d?\d$/$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||85.17.31.152^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 85.17.31.152$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||95.211.26.202^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 95.211.26.202$network -! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||158.247.212.220^$document !#endif +!+ NOT_PLATFORM(windows, mac, android, cli) +||85.17.31.152^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||95.211.26.202^$all,~inline-font +! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 !+ PLATFORM(windows, mac, android, cli) 158.247.212.220$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||165.227.168.212^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 165.227.168.212$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||158.247.212.220^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||165.227.168.212^$document ! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ !+ PLATFORM(windows, mac, android, cli) /^162\.241\.115\.[12]?\d?\d$/$network ! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 ! https://github.com/AdguardTeam/AdguardFilters/issues/125285 ||garbiaes.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||23.81.64.183^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 23.81.64.183$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||23.81.64.183^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/125300 ||inmewa.com^$all ||omshellderom.com^$all @@ -3027,12 +2612,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||stelronsi.net^$all ||tadaickaipt.com^$all ||vekeltaizy.net^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||139.45.197.236^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 139.45.197.236$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||139.45.197.236^$document ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^$all ||becovi.co.uk^$all @@ -3048,24 +2631,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||tutatagliente.com^$document,popup ||potestainsula.com^$document,popup ||motherpipe.net^$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||51.91.66.125^$document -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 51.91.66.125$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||51.178.76.105^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 51.178.76.105$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +147.135.253.55$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||51.91.66.125^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||51.178.76.105^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||147.135.253.55^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -147.135.253.55$network ! https://github.com/uBlockOrigin/uAssets/issues/14569 → https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection (https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) ! https://github.com/AdguardTeam/AdguardFilters/issues/129414 !+ NOT_OPTIMIZED @@ -3073,18 +2654,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !+ NOT_OPTIMIZED /^http://imgblaze.net/[a-z0-9]{6}\$/$third-party,subdocument ! https://github.com/AdguardTeam/AdguardFilters/issues/131156 -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||146.19.169.98^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 146.19.169.98$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||146.19.169.99^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 146.19.169.99$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||146.19.169.98^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||146.19.169.99^$document ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 /pushredirect/?$document,domain=~malware_redirection_trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -4597,22 +4174,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zz1200.com^$all ||niderschlagsradar.de^$all ||2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||69.162.80.56^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 69.162.80.56$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||69.162.80.56^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/134903 ! Random Discord servers ||newntflix-$document,popup ||giveawaycord.$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||162.241.124.200^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 162.241.124.200$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||162.241.124.200^$document ! https://github.com/AdguardTeam/AdguardFilters/issues/135815 ||adsstar.in^$document,popup ||clickcafe.in^$document,popup @@ -4624,12 +4197,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||tnlink.in^$document,popup ||tnvalue.in^$document,popup ||webhostingtips.club^$document,popup -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||157.90.71.190^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 157.90.71.190$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||157.90.71.190^$document ! https://github.com/AdguardTeam/AdguardFilters/issues/135924 ||beskittyan.com^$all ||cadbitff.com^$all @@ -4645,12 +4216,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||uponelectabuzzor.club^$all ||vethojoa.net^$all ||wumpeeps.net^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||139.45.197.239^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 139.45.197.239$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||139.45.197.239^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub.$document,popup ! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -4671,24 +4240,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||uxobx.xyz^$all ||vayamuegn.icu^$all ||wehiqes.xyz^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||44.228.230.225^$document -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 44.228.230.225$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||50.112.124.170^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 50.112.124.170$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +100.20.104.229$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||44.228.230.225^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||50.112.124.170^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||100.20.104.229^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -100.20.104.229$network ! Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread ||link.sv^$document,popup ||4.fo^$document,popup @@ -4698,38 +4265,32 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||gsecurecontent.com^$all ||pressizer.net^$all ||sapino.net^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||44.236.213.34^$document -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 44.236.213.34$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||52.24.156.12^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 52.24.156.12$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||52.25.6.134^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 52.25.6.134$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +100.20.13.49$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||44.236.213.34^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||52.24.156.12^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||52.25.6.134^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||100.20.13.49^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -100.20.13.49$network ! https://github.com/AdguardTeam/AdguardFilters/issues/139667 ||goldmesoil.live^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||51.68.87.229^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 51.68.87.229$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||51.68.87.229^$all,~inline-font ! https://github.com/DandelionSprout/adfilt/issues/747 ||2022crucialcatch.store^$all ||adidascostarica.com^$all @@ -5143,6 +4704,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||nanavypredaj.sk^$all ||salononfranceonline.com^$all ||zapatillasmcqueen.com^$all +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) /^165\.231\.10\.[12]?\d?\d$/$network !+ PLATFORM(windows, mac, android, cli) @@ -5159,6 +4721,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] /^196\.245\.52\.[12]?\d?\d$/$network !+ PLATFORM(windows, mac, android, cli) /^196\.245\.56\.[12]?\d?\d$/$network +!#endif ! https://www•bleepingcomputer•com/news/security/hackers-push-malware-via-google-search-ads-for-vlc-7-zip-ccleaner/ ://rufus.download.$document,popup ://virtualbox.download.$document,popup @@ -5172,24 +4735,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||project-obs.com^$all ||studio-obs.com^$all ||webull-download.$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.106.94.139^$document -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 185.106.94.139$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.90.109.196^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 45.90.109.196$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +91.229.23.200$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.106.94.139^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.90.109.196^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||91.229.23.200^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -91.229.23.200$network ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1401711872 ! https://github.com/AdguardTeam/AdguardFilters/issues/144514 ||bonusgift.life^$all @@ -5204,25 +4765,19 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||thebestprizes.life^$all ||winearth.life^$all ||winpulse.life^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.155.184.98^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 185.155.184.98$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||194.110.247.242^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 194.110.247.242$network -! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) -||54.219.218.169^$document -!#endif +||185.155.184.98^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||194.110.247.242^$all,~inline-font +! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ !+ PLATFORM(windows, mac, android, cli) 54.219.218.169$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||54.219.218.169^$document ! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^$all ||0365online.com^$all @@ -5627,21 +5182,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yourlivingequity.com^$all ||yourticketchance.com^$all ||yourorderupdate.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||64.132.201.92^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 64.132.201.92$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||64.132.201.92^$all,~inline-font ! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||jatvpn.softether.net^$all ||jatcraft.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||209.141.51.49^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 209.141.51.49$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||209.141.51.49^$all,~inline-font ://soekpakke*.blogspot.com^$all ||post-norway.web.app^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/142955 @@ -5711,24 +5262,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||wholegrady.com^$all ||wooden-comfort.com^$all ! Unsuited for wildcarding -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||208.88.225.116^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 208.88.225.116$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||208.88.225.117^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 208.88.225.117$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +208.88.225.119$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||208.88.225.116^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||208.88.225.117^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||208.88.225.119^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -208.88.225.119$network ! https://github.com/AdguardTeam/AdguardFilters/issues/144823 !+ NOT_OPTIMIZED ://landings.*_slots/?partner=$document @@ -5778,36 +5327,30 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||kristinee.com^$all ||lakeside-fishandchips.com^$all ||office-view.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||108.61.242.65^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 108.61.242.65$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||146.70.78.43^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 146.70.78.43$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||87.120.254.39^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 87.120.254.39$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.150.108.213^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 45.150.108.213$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +92.204.160.240$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||108.61.242.65^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||146.70.78.43^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||87.120.254.39^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.150.108.213^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||92.204.160.240^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -92.204.160.240$network ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 /land/*&afftrack=$document,domain=~likely_a_malware_redirection.* ! Comments on Slack @@ -6077,36 +5620,30 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||z5v6h8recpgb.com^$all ||zirze151uk5d.com^$all ||zxvjn4igweb9.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.246.188.124^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 185.246.188.124$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.246.188.125^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 185.246.188.125$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||194.63.140.103^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 194.63.140.103$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||194.63.143.61^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 194.63.143.61$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +194.63.143.96$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.246.188.124^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.246.188.125^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||194.63.140.103^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||194.63.143.61^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||194.63.143.96^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -194.63.143.96$network ! https://github.com/AdguardTeam/AdguardFilters/issues/152945 ||moneystartup.live^$all &trafficsource=Kadam&$document @@ -6182,37 +5719,29 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||xxxmessages.com^$all ||yourlifestyle-blog.com^$all ||zorka-news.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||37.48.80.112^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 37.48.80.112$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||37.48.80.112^$all,~inline-font ! Slack comments ||cojcdn.net^$all ||redic3.com^$all,~inline-font,domain=~malware_redirection_trains.* ||totadblock.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||109.206.168.16^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 109.206.168.16$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||109.206.168.17^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 109.206.168.17$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||109.206.168.16^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||109.206.168.17^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/155298 ||cadstoppam.live^$all ||paidsuenut.live^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||57.128.71.215^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 57.128.71.215$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||57.128.71.215^$all,~inline-font /^.*&[a-z]{1,2}=[a-zA-Z0-9]{0,}%[a-zA-Z0-9%]{1000,}\$/$document ! https://github.com/AdguardTeam/AdguardFilters/issues/155936 ||rumadel.com^$all @@ -6336,6 +5865,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zrqdqt.com^$all ||ztzguv.com^$all ||zuhrzf.com^$all +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 139.45.197.167$network !+ PLATFORM(windows, mac, android, cli) @@ -6346,6 +5876,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 185.56.234.205$network !+ PLATFORM(windows, mac, android, cli) 37.1.223.231$network +!#endif +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||139.45.197.167^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) @@ -6366,11 +5898,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||192.243.58.124^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||192.243.58.125^$all,~inline-font +!#endif [2a02:b48:207:1::2]$network [2a02:b48:207:1::3]$network [2a02:b48:207:1::6]$network [2a02:b48:207:1::7]$network [2a02:b48:207:1::8]$network +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 2a02:b48:207:1::2$network !+ PLATFORM(windows, mac, android, cli) @@ -6383,6 +5917,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 2a02:b48:207:1::8$network !+ PLATFORM(windows, mac, android, cli) /^192\.243\.58\.[12]?\d?\d$/$network +!#endif ! https://github.com/AdguardTeam/AdguardFilters/issues/157308 ||dest.co.in^$all ||dkeie.co.in^$all @@ -6558,24 +6093,22 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||vitalityfortune.com^$all ||wellnessfortune.net^$all ||ztomy.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||5.45.123.44^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 5.45.123.44$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||69.16.230.226^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 69.16.230.226$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +208.91.196.46$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||5.45.123.44^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||69.16.230.226^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||208.91.196.46^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -208.91.196.46$network /page/bouncy.php?$all ! https://github.com/AdguardTeam/AdguardFilters/issues/158316 ||abberantbeefy.com^$all @@ -7242,12 +6775,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||ptentry.com^$all ||ptosrd.com^$all ||ptwmbed.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||93.93.51.223^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 93.93.51.223$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||93.93.51.223^$all,~inline-font ||livejasmin.com/*&origin=$document ! https://github.com/AdguardTeam/AdguardFilters/issues/161364 ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) @@ -7284,12 +6815,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||179.43.189.62$all ! https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/ ||reschedule-delivery.ups.com.$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||103.174.102.240^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 103.174.102.240$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||103.174.102.240^$all,~inline-font ! https://github.com/libre-tube/LibreTube/issues/4409 ||libretube.net^$all ! https://github.com/RPiList/specials/issues/1353 @@ -7380,12 +6909,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !!!://162.214.80.$document ! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7873648 ||monetrizer*.$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||38.180.96.244^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 38.180.96.244$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||38.180.96.244^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/172569 ||acareewityjh.com^$all ||accedenonre.xyz^$all @@ -7505,18 +7032,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||wasanasset.buzz^$all ||withmefeyauknaly.com^$all ||wukbgater.buzz^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||34.195.224.242^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 34.195.224.242$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||54.225.185.110^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 54.225.185.110$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||34.195.224.242^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||54.225.185.110^$all &lp=not_robot_$all ||githubtalentcommunity.$all ! https://github.com/AdguardTeam/AdguardFilters/issues/173925 @@ -7524,12 +7047,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||levering-ekspedition.network^$all ||dhlexpress-lieferung.net^$all ||pochta-ru.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||91.202.233.143^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 91.202.233.143$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||91.202.233.143^$all,~inline-font ! Based on a tip from my secretary ||advancedwalletpay.com^$all ||amberzextracts.com^$all @@ -7626,12 +7147,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||routingsequencepriority.com^$all ||speednetworkchain.com^$all ||systemnetworkroute.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||108.62.157.10^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 108.62.157.10$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||108.62.157.10^$all,~inline-font ! https://github.com/AdguardTeam/FiltersRegistry/issues/925 ! https://github.com/AdguardTeam/FiltersRegistry/pull/927 ||avito.avito.avito.$all @@ -7645,66 +7164,50 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||avito.avito.www.avito.$all ||booking.com-id*$all ! https://github.com/AdguardTeam/AdguardFilters/issues/179170 -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.240.108.68^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 172.240.108.68$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.240.108.76^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 172.240.108.76$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.240.108.84^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 172.240.108.84$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.240.127.234^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 172.240.127.234$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||172.240.253.132^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 172.240.253.132$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||192.243.59.12^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 192.243.59.12$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||192.243.59.13^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 192.243.59.13$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||192.243.59.20^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 192.243.59.20$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||192.243.61.225^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 192.243.61.225$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +192.243.61.227$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.240.108.68^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.240.108.76^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.240.108.84^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.240.127.234^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||172.240.253.132^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||192.243.59.12^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||192.243.59.13^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||192.243.59.20^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||192.243.61.225^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||192.243.61.227^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -192.243.61.227$network ||abberantextending.com^$all ||abdicatehorrified.com^$all ||abjectpreludeparity.com^$all @@ -8583,26 +8086,24 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yelitong.com^$all ||yourchoicehealthplan.com^$all ||zymstr.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.149.120.161^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 185.149.120.161$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.149.120.163^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 185.149.120.163$network !+ PLATFORM(windows, mac, android, cli) 185.149.120.173$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +185.149.120.175$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.149.120.161^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.149.120.163^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||185.149.120.175^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -185.149.120.175$network ! https://github.com/AdguardTeam/AdguardFilters/issues/184671 ||alatterapistroke.com^$all ||astrarestaurant.com^$all @@ -8649,114 +8150,82 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||upsbezahlung.com^$all ||vius-inf.com^$all ||vrsecurego.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.202.32.3^$all -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 45.202.32.3$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.8.92.138^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 45.8.92.138$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||79.133.46.252^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 79.133.46.252$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||82.147.85.156^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 82.147.85.156$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||91.212.166.16^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 91.212.166.16$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.156.64.129^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 94.156.64.129$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.232.249.61^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 94.232.249.61$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.232.249.69^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 94.232.249.69$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.232.249.75^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 94.232.249.75$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.232.249.235^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 94.232.249.235$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||176.111.174.118^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 176.111.174.118$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||176.113.115.191^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 176.113.115.191$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||191.96.224.140^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 191.96.224.140$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||193.124.185.42^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 193.124.185.42$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||193.143.1.45^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 193.143.1.45$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||193.143.1.214^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 193.143.1.214$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||193.143.1.217^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 193.143.1.217$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +208.91.189.203$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.202.32.3^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.8.92.138^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||79.133.46.252^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||82.147.85.156^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||91.212.166.16^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.156.64.129^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.232.249.61^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.232.249.69^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.232.249.75^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.232.249.235^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||176.111.174.118^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||176.113.115.191^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||191.96.224.140^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||193.124.185.42^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||193.143.1.45^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||193.143.1.214^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||193.143.1.217^$all !+ NOT_PLATFORM(windows, mac, android, cli) ||208.91.189.203^$all !#endif -!+ PLATFORM(windows, mac, android, cli) -208.91.189.203$network !#if !ext_ublock ://193.143.1.*$document !#endif @@ -13168,12 +12637,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yj-huayuan.com^$document ||ynjkdl.com^$document ||yuxc.xyz^$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||103.155.214.207^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 103.155.214.207$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||103.155.214.207^$document ! Inspired by https://github.com/AdguardTeam/AdguardFilters/issues/197908 ||app-update.site^$all ||appupdate.net^$all @@ -13181,21 +12648,17 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||mijndiensten.website^$all ||potanschranky.com^$all ||prihlasit-secure-auth.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.196.9.214^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 185.196.9.214$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.196.9.214^$all ||chrome.webredirect.org^$all ||captcha.webredirect.org^$all .microsoft.com.chrome.$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.196.9.222^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 185.196.9.222$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.196.9.222^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/201064 ||100urls.com^$all ||17lc.cc^$all @@ -13620,7 +13083,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yoursweetfantazeez.site^$all ||yoursweetfantazeez.store^$all ||yoursweetflirt.online^$all -!#if !adguard_app_windows +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||3.220.51.12^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -13633,12 +13096,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||100.28.19.138^$all !+ NOT_PLATFORM(windows, mac, android, cli) ||108.61.99.63^$all -!#endif [2600:1f18:43d1:2a02:169f:dcbb:85f9:3c56]$network [2600:1f18:43d1:2a02:b6ee:327b:545e:e578]$network [2600:1f18:43d1:2a02:c3bd:35f3:da0a:4041]$network [2600:1f18:43d1:2a02:c6f9:e151:e2e1:732d]$network [2600:1f1c:57F:b502:dd8:9588:11e6:282]$network +!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 3.220.51.12$network !+ PLATFORM(windows, mac, android, cli) @@ -13661,6 +13125,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 2600:1f18:43d1:2a02:c6f9:e151:e2e1:732d$network !+ PLATFORM(windows, mac, android, cli) 2600:1f1c:57F:b502:dd8:9588:11e6:282$network +!#endif ! https://github.com/AdguardTeam/AdguardFilters/issues/202010 ||adblockermax.com/land$document,popup ! Various other reports @@ -13732,12 +13197,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||womsacmackoa.com^$all ||wounofoarausooy.net^$all ||zmeso.com^$all +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 172.240.41.32$network !+ PLATFORM(windows, mac, android, cli) 172.240.41.64$network !+ PLATFORM(windows, mac, android, cli) 172.240.41.96$network +!#endif ||abcradilytor.com^$all ||abmagbychan.com^$all ||agatorkoaltor.com^$all @@ -13855,10 +13322,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||wsbuckon.com^$all ||zacmoageeshee.net^$all ||zucoagorsout.com^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||139.45.197.106^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 139.45.197.106$network ! https://github.com/DandelionSprout/adfilt/issues/1129 @@ -14066,10 +13531,8 @@ http://secured21.*.com/|$all ||xxx-telegram.com^$all ||zc-telegran.org^$all ||zzz-telegram.com^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||43.128.142.70^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 43.128.142.70$network ! https://github.com/AdguardTeam/AdguardFilters/issues/20787[2-5] @@ -14217,7 +13680,7 @@ http://secured21.*.com/|$all ||whatcsappwap.com^$all ||whatstapps.com^$all ||whetcsapp.com^$all -!#if !adguard_app_windows +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||149.30.232.154^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -14227,6 +13690,7 @@ http://secured21.*.com/|$all !+ NOT_PLATFORM(windows, mac, android, cli) ||206.119.178.163^$all !#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 149.30.232.154$network !+ PLATFORM(windows, mac, android, cli) @@ -14235,6 +13699,7 @@ http://secured21.*.com/|$all 156.245.23.49$network !+ PLATFORM(windows, mac, android, cli) 206.119.178.163$network +!#endif ! https://github.com/DandelionSprout/adfilt/issues/1164 ||device-checking.com^$all ||device-cleanup.com^$all @@ -14244,10 +13709,8 @@ http://secured21.*.com/|$all ||system-noticers.com^$all ||systemsnotifications.com^$all ||warningnotification.com^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||46.101.81.149^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 46.101.81.149$network ||adaptationfirework.com^$all @@ -14293,17 +13756,13 @@ http://secured21.*.com/|$all ||unesmunbrebers.com^$document,popup ||filinnetirt.com^$document,popup ||freshsubz.com^$document -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||52.15.34.25^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 52.15.34.25$network ! https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||203.188.171.156^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 203.188.171.156$network ! https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md @@ -14568,6 +14027,7 @@ http://secured21.*.com/|$all ||workspace-drive.com^$all ||xtrash-tarck.com^$all ||your-package-delivery.com^$all +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||158.94.209.86^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -14580,6 +14040,8 @@ http://secured21.*.com/|$all ||158.94.209.90^$all !+ NOT_PLATFORM(windows, mac, android, cli) ||223.29.226.200^$all +!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 158.94.209.86$network !+ PLATFORM(windows, mac, android, cli) @@ -14592,11 +14054,32 @@ http://secured21.*.com/|$all 158.94.209.90$network !+ PLATFORM(windows, mac, android, cli) 223.29.226.200$network +!#endif ! https://urlscan.io/result/019a4ffd-885c-7545-816a-3c121d8bdc0d/ (Early November 2025) /linkresolver.html?url=*p0$document ! https://github.com/DandelionSprout/adfilt/issues/1197 ||creations.tools^$document,domain=~believed_to_be_fraudsters.* ||idtsoftware.com^$document,domain=~believed_to_be_fraudsters.* +! https://github.com/DandelionSprout/adfilt/issues/1212 +||acrossprotocols.com^$all +||aftop10.com^$all +||directory-opus-manager.github.io^$all +||dokopka.icu^$all +||dramajaratstate.com^$all +||heygetbarter.com^$all +||michaelborsari.com^$all +||softs-window.com^$all +||sublime-merge-git-client.github.io^$all +||sublime-text-3.github.io^$all +||welearnn.com^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.156.232.201^$all +!+ NOT_PLATFORM(windows, mac, android, cli) +||213.209.143.119^$all +!+ PLATFORM(windows, mac, android, cli) +213.209.143.119$network +!+ PLATFORM(windows, mac, android, cli) +94.156.232.201$network ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -14937,22 +14420,18 @@ toorgle.net##.join ||market-csgo.ru^$all ||pubggf*.xyz^$all ||pubggift*.xyz^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||194.226.139.121^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||194.226.139.7^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||95.181.157.36^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 95.181.157.36$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||95.181.172.204^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 95.181.172.204$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||95.181.172.204^$all,~inline-font !+ PLATFORM(windows, mac, android, cli) /^194\.226\.139\.[12]?\d?\d$/$network !#if !ext_ublock @@ -15048,12 +14527,10 @@ toorgle.net##.join ||drugcoupons.xyz^$document ||freemedicine.info^$document ||medication.coupons^$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||147.135.16.27^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 147.135.16.27$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||147.135.16.27^$document ! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^$document ! https://scambiofigu•forumcommunity•net/?t=57482915 @@ -15062,12 +14539,10 @@ apkfab.com##.tip-extension ! Google results for 'Katy and Bob：Cake Café powerpc' (04/11/2022) ||xxlmag.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* ||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.87.148.199^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 185.87.148.199$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.87.148.199^$document ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) ||imaot.co.il/ContentArea/BannerClick^$all ||q1065.fm/redirect^$all,~inline-font,domain=~malware_redirection_results.* @@ -15076,12 +14551,10 @@ apkfab.com##.tip-extension ||wnbf.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* ||gacorhub.com^$all ||zh1653.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.136.49.35^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 45.136.49.35$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.136.49.35^$document ||semex.com/popurl.cgi^$all,~inline-font,domain=~malware_redirection_results.* ||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware_redirection_results.* ! Browsing around for Tajik newssites @@ -15093,46 +14566,38 @@ apkfab.com##.tip-extension ||biztomjean.live^$all ||backshyoh.live^$all ||cityratetod.live^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||51.91.211.94^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 51.91.211.94$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||162.19.71.16^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 162.19.71.16$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||146.59.240.191^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 146.59.240.191$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||54.37.5.34^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 54.37.5.34$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +54.36.118.105$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||51.91.211.94^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||162.19.71.16^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||146.59.240.191^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||54.37.5.34^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||54.36.118.105^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -54.36.118.105$network ! Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt ||highlandnews.com^$all ||pcbasicstrength.com^$all ||leantime.bigfi.re^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||159.89.10.102^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 159.89.10.102$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||159.89.10.102^$all,~inline-font ! Other ||pksauniversity.com^$all ||sharedmega.com^$document @@ -15146,10 +14611,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||thotsbay-leaked.com^$document ||cbox.ws^$domain=chicks.cam ||inuseme.com^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ://104.206.252.90^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 104.206.252.90$network ! https://github.com/blocklistproject/Lists/issues/933 @@ -15164,12 +14627,10 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ! https://github.com/RPiList/specials/issues/948#issuecomment-1458739160 ||yuppdownload.com^$all ! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||34.80.59.191^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 34.80.59.191$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||34.80.59.191^$all,~inline-font ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 |http://www6.$document,domain=~often_used_in_malware_redirections.* |http://www1.*&kw$document,domain=~often_used_in_malware_redirections.* @@ -15177,78 +14638,58 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||zombooru.com^$all ||kusubooru.com^$all ||wh40kart.im^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.33.2.79^$document -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 45.33.2.79$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.33.18.44^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 45.33.18.44$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.33.20.235^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 45.33.20.235$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.33.23.183^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 45.33.23.183$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.33.30.197^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 45.33.30.197$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.56.79.23^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 45.56.79.23$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||45.79.19.196^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 45.79.19.196$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||72.14.178.174^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 72.14.178.174$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||72.14.185.43^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 72.14.185.43$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||96.126.123.244^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 96.126.123.244$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||173.255.194.134^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 173.255.194.134$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +198.58.118.167$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.33.2.79^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.33.18.44^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.33.20.235^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.33.23.183^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.33.30.197^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.56.79.23^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||45.79.19.196^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||72.14.178.174^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||72.14.185.43^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||96.126.123.244^$document +!+ NOT_PLATFORM(windows, mac, android, cli) +||173.255.194.134^$document !+ NOT_PLATFORM(windows, mac, android, cli) ||198.58.118.167^$document !#endif -!+ PLATFORM(windows, mac, android, cli) -198.58.118.167$network ! https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ ||1337links.net^$all ||777offers.net^$all @@ -15346,42 +14787,34 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||whackyblue.com^$all ||ym3trk.com^$all,~inline-font,domain=~malware_redirection_trains.* ||youwanthis.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||34.117.199.78^$all,~inline-font -!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 34.117.199.78$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.237.103.119^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 94.237.103.119$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.237.84.54^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 94.237.84.54$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.237.93.242^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 94.237.93.242$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||94.237.99.118^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 94.237.99.118$network -!#if !adguard_app_windows +!+ PLATFORM(windows, mac, android, cli) +139.45.197.249$network +!#endif +!#if !env_firefox +!+ NOT_PLATFORM(windows, mac, android, cli) +||34.117.199.78^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.237.103.119^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.237.84.54^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.237.93.242^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||94.237.99.118^$all,~inline-font !+ NOT_PLATFORM(windows, mac, android, cli) ||139.45.197.249^$all,~inline-font !#endif -!+ PLATFORM(windows, mac, android, cli) -139.45.197.249$network ! https://dnpedia•com/tlds/topm•php bizarrely listing "anahitagirted•uno" as the 622th most visited domain worldwide ||anahitagirted.uno^$all ||arenitezill.com^$all @@ -15425,60 +14858,44 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] *norgestores.com^$document *skobutikks.com^$document *butikksoslo.com^$document -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||196.196.153.151^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 196.196.153.151$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||158.222.7.116^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 158.222.7.116$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||196.245.152.139^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 196.245.152.139$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||165.231.251.197^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 165.231.251.197$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||196.242.16.29^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 196.242.16.29$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||165.231.4.90^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 165.231.4.90$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||158.222.7.83^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 158.222.7.83$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||196.196.153.151^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||158.222.7.116^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||196.245.152.139^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||165.231.251.197^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||196.242.16.29^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||165.231.4.90^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||158.222.7.83^$all,~inline-font ! A scam SMS I got ||95-214-26-78.plesk.page^$all ||account-limitato.org^$all ||netfiixhungary.net^$all ||tracking-sk.com^$all ||supportnetflix.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||95.214.26.78^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 95.214.26.78$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||95.214.26.78^$all,~inline-font ! Overly dedicated E-mail spammers ||wirexapp.africa.com^$all @@ -15497,26 +14914,20 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||kidroleland.info^$all ||sirdayscare.info^$all ||slownansuch.info^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.155.184.57^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 185.155.184.57$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.155.186.24^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 185.155.186.24$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.155.184.57^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.155.186.24^$all,~inline-font ||style-js.com^$all /a.aspx?cid=*&cname=^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||209.74.107.131^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 209.74.107.131$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||209.74.107.131^$all,~inline-font /flying.asp?cid=$all /kjyo.php?cname=$all /flying?cid=*&keywords=$all @@ -15585,18 +14996,14 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||wsdcq7wayud.com^$all ||xgptw11vogsh.com^$all ||zeirj14ikqwf.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||69.172.200.185^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 69.172.200.185$network -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||77.220.214.153^$all,~inline-font -!#endif !+ PLATFORM(windows, mac, android, cli) 77.220.214.153$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||69.172.200.185^$all,~inline-font +!+ NOT_PLATFORM(windows, mac, android, cli) +||77.220.214.153^$all,~inline-font ! More search terms than what can be counted with a supercomputer (11/03/2024) google.*##div[data-attrid^="images "]:has-text(/, [1-9][1-46-9]% OF{2}/) ! Scam E-mails I've got @@ -15623,14 +15030,12 @@ tumblr.com##div[tabindex][style]:has(a[href*="://cutt.ly/"]) tumblr.com#?#div[tabindex][style]:has(a[href*="tinyurl."]:has-text(_1+8_)) www.tumblr.com##div[style="margin-top: 0px;"][tabindex]:has-text(🔞):has-text(/Insta/i) www.tumblr.com##div[tabindex][style="margin-top: 0px;"]:not([class],[id]):has(a[target=_blank] > div > div:has-text(/^.*🔞.*insta( |gram).*\n.*$/i)) -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ://104.21.82.132^$document,popup !+ NOT_PLATFORM(windows, mac, android, cli) ||172.67.158.57^$document,popup !+ NOT_PLATFORM(windows, mac, android, cli) ||198.12.86.90^$all -!#endif [2606:4700:3030::6815:5284]$network [2606:4700:3037::ac43:9e39]$network ||adhitagency.shop^$all @@ -15699,12 +15104,14 @@ www.tumblr.com##div[tabindex][style="margin-top: 0px;"]:not([class],[id]):has(a[ ||tq24k.com^$all ||vcqtools.com^$all ||vgadeal.com^$all +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 104.21.82.132$network !+ PLATFORM(windows, mac, android, cli) 172.67.158.57$network !+ PLATFORM(windows, mac, android, cli) 198.12.86.90$network +!#endif ||sites.google.com/view/*wincashapp^$document ||iuxxx.com^$all ||tuusi.com^$all @@ -15723,12 +15130,10 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||dreamintim.com^$all ! R34US ! https://github.com/AdguardTeam/FiltersRegistry/issues/654#issuecomment-2629098471 -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||139.45.197.168^$all !+ NOT_PLATFORM(windows, mac, android, cli) ||139.45.197.244^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 139.45.197.168$network !+ PLATFORM(windows, mac, android, cli) @@ -15898,24 +15303,20 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||wackel-dackel.com^$all ||whashop.xyz^$all ||bestpartnerfinderonline.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||185.68.16.189^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 185.68.16.189$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||185.68.16.189^$all ||huntinginukraine.com^$all ||gitlab.gitlab.gitlab.$document,popup ||gitlab.git.git.$document,popup ||gitlab.gitlab.git.$document,popup ||git.git.git.git.$document,popup ||git.gitlab.gitlab.$document,popup -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||76.223.15.82^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 76.223.15.82$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||76.223.15.82^$all ||10bestchina.com^$all ||123594.com^$all ||127453.com^$all @@ -16669,22 +16070,19 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||netnet33.net^$all ||netnet44.net^$all ||odintara.com^$document -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||54.174.156.141^$document -!#endif !+ PLATFORM(windows, mac, android, cli) 54.174.156.141$network ! Searched for Breaking Bad Jesse memes on Qwant (29/04/2025) ://old.sermitsiaq.ag^$document,domain=subdomain_stolen_from_sermitsiaqs_owners.* ||xss.my.id^$third-party -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||85.159.213.158^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 85.159.213.158$network ! Seemingly mass-generated fake "marketing company" sites that seem to serve no visible purpose (12/05/2025) +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||23.170.252.196^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -16866,6 +16264,8 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ://216.246.30.83^$all !+ NOT_PLATFORM(windows, mac, android, cli) ://216.246.30.84^$all +!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 23.170.252.196$network !+ PLATFORM(windows, mac, android, cli) @@ -17048,6 +16448,7 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr 216.246.30.84$network !+ PLATFORM(windows, mac, android, cli) 2a14:2d81:0:27::1$network +!#endif ||taylorcopies.com^$document ||atypicalnorms.com^$document ||beastlyendeavors.com^$document @@ -17077,10 +16478,8 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||psaitchuzaubo.com^$all ||rita0.com^$all ||tshfc.com^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||139.45.195.9^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 139.45.195.9$network ! Other entries @@ -17089,19 +16488,17 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||datedate.today^$all ||go.dealslandz.com^$all ||awecrptjmp.com^$document,popup -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||172.240.41.32^$all !+ NOT_PLATFORM(windows, mac, android, cli) ||172.240.41.64^$all !+ NOT_PLATFORM(windows, mac, android, cli) ||172.240.41.96^$all -!#endif ! Spambot(s?) on R34X³ ||24hdeepnude.com^$document ! gelbo²ruCOM ||debateobsoletesimply.com^$all -!#if !adguard_app_windows +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||172.240.41.33^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -17111,6 +16508,7 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr !+ NOT_PLATFORM(windows, mac, android, cli) ||172.240.41.129^$all !#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 172.240.41.33$network !+ PLATFORM(windows, mac, android, cli) @@ -17119,6 +16517,7 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr 172.240.41.97$network !+ PLATFORM(windows, mac, android, cli) 172.240.41.129$network +!#endif ! bdsmx-pornCOM ||6traitors.com^$all ||baimgfroggd.site^$all @@ -17182,6 +16581,7 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||sunsandmoon.com^$all ||trankosty.shop^$all ||tubecup.org^$all +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||62.122.168.42^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -17205,6 +16605,8 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr [2a02:128:7:5427::2]$network [2a02:128:7:5905::2]$network [2a02:128:7:5940::3]$network +!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 62.122.168.42$network !+ PLATFORM(windows, mac, android, cli) @@ -17235,6 +16637,7 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr 2a02:128:7:5905::2$network !+ PLATFORM(windows, mac, android, cli) 2a02:128:7:5940::3$network +!#endif ||biuqbiu.com^$all ||bmgmb.com^$all ||onclckbn.com^$all @@ -17246,12 +16649,14 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||178.63.5.120^$all [2a01:4f8:c0:33d8::1]$network [2a01:4f8:c0:2a5c::1]$network +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 178.63.5.120$network !+ PLATFORM(windows, mac, android, cli) 2a01:4f8:c0:33d8::1$network !+ PLATFORM(windows, mac, android, cli) 2a01:4f8:c0:2a5c::1$network +!#endif ||013d5342d9.com^$all ||03122e72f0.com^$all ||0551acf6ed.com^$all @@ -17340,18 +16745,18 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||ntvpevnts.com^$all ||selecttopon.com^$all ||statelinear.com^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||167.235.163.216^$all -!#endif [2a01:4f8:c0:2343::2]$network [2a01:4f8:e0:19cb::1]$network +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 167.235.163.216$network !+ PLATFORM(windows, mac, android, cli) 2a01:4f8:c0:2343::2$network !+ PLATFORM(windows, mac, android, cli) 2a01:4f8:e0:19cb::1$network +!#endif ||a3ion.com^$all ||advertrek.com^$all ||cant3am.com^$all @@ -17400,10 +16805,8 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||zlink9.com^$all ||zlinkl.com^$all ||zlinkv.com^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||95.211.229.247^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 95.211.229.247$network ! fetish2230•rssing•com @@ -17432,10 +16835,8 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||undeciliste.com^$all ||unrertivermalous.com^$all ||wherdiapospir.com^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||88.208.22.1^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 88.208.22.1$network ! xmegadriveCOM @@ -17456,10 +16857,8 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||repulsiveguarantee.com^$all ||sotomistel.com^$all ||unripereading.com^$all -!#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||188.72.219.35^$all -!#endif [2a00:1178:1:4b::e]$network !+ PLATFORM(windows, mac, android, cli) 188.72.219.35$network @@ -17874,7 +17273,7 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||ukpayment.xin^$all ||uspsprl.cfd^$all ||zaepost.cfd^$all -!#if !adguard_app_windows +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||43.100.125.58^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -17890,6 +17289,7 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr !+ NOT_PLATFORM(windows, mac, android, cli) ||154.223.16.232^$all !#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 43.100.125.58$network !+ PLATFORM(windows, mac, android, cli) @@ -17904,6 +17304,7 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr 147.93.63.211$network !+ PLATFORM(windows, mac, android, cli) 154.223.16.232$network +!#endif ! icepornCOM /adx_iframe_$third-party ! https://www•drvhub•net/devices/network/asix/ax88178a-usb-2-0-to-gigabit-ethernet-adapter @@ -18387,6 +17788,7 @@ drvhub.net##.driver-item__install ||trksp1.com^$all ||trksp2.com^$all ||trksp3.com^$all +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||157.90.33.79^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -18414,6 +17816,8 @@ drvhub.net##.driver-item__install [2604:9e00:1:129::2:b10]$network [2606:4700:3033::6815:5644]$network [2a01:4f8:2201:388a::2]$network +!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 157.90.33.79$network !+ PLATFORM(windows, mac, android, cli) @@ -18444,6 +17848,7 @@ drvhub.net##.driver-item__install 2606:4700:3033::6815:5644$network !+ PLATFORM(windows, mac, android, cli) 2a01:4f8:2201:388a::2$network +!#endif ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^$all @@ -18636,6 +18041,7 @@ drvhub.net##.driver-item__install ||yolkclknu.com^$all ||yolkdirxl.com^$all ||zentrixads.com^$all +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||103.67.200.64^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -18643,6 +18049,8 @@ drvhub.net##.driver-item__install !+ NOT_PLATFORM(windows, mac, android, cli) ||198.134.116.30^$all [2a00:8860:10d:1::2:b01]$network +!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 103.67.200.64$network !+ PLATFORM(windows, mac, android, cli) @@ -18651,6 +18059,7 @@ drvhub.net##.driver-item__install 198.134.116.30$network !+ PLATFORM(windows, mac, android, cli) 2a00:8860:10d:1::2:b01$network +!#endif ! Extreme amounts of PUP to a comical extent ||driverpack.io^$document,domain=~has_extreme_amounts_of_pup_in_it.* ! https://github.com/DandelionSprout/adfilt/issues/1124 @@ -19062,12 +18471,10 @@ www.microsoft.com##a[data-pfns][href*=pac-men] ! (Presumably anonymous) E-mail tips ||s.free.fr^$all ||trmff.wpengine.com^$all -!#if !adguard_app_windows -!+ NOT_PLATFORM(windows, mac, android, cli) -||212.27.60.108^$all -!#endif !+ PLATFORM(windows, mac, android, cli) 212.27.60.108$network +!+ NOT_PLATFORM(windows, mac, android, cli) +||212.27.60.108^$all !#if !adguard @@ -19266,6 +18673,7 @@ www.google.*,ipv6.google.com##div[data-attrid^="images "]:has(a[href*=".aspx?cna ||xyz.cm^$all ||yellowdragon.com^$all ! Parking services' IP addresses +!#if !env_firefox !+ NOT_PLATFORM(windows, mac, android, cli) ||13.248.148.254^$all !+ NOT_PLATFORM(windows, mac, android, cli) @@ -19288,6 +18696,8 @@ www.google.*,ipv6.google.com##div[data-attrid^="images "]:has(a[href*=".aspx?cna ||185.53.178.53^$all !+ NOT_PLATFORM(windows, mac, android, cli) ||185.53.178.54^$all +!#endif +!#if env_firefox !+ PLATFORM(windows, mac, android, cli) 13.248.148.254$network !+ PLATFORM(windows, mac, android, cli) @@ -19310,6 +18720,7 @@ www.google.*,ipv6.google.com##div[data-attrid^="images "]:has(a[href*=".aspx?cna 185.53.178.53$network !+ PLATFORM(windows, mac, android, cli) 185.53.178.54$network +!#endif ! Bouncing hard-to-close (but admittedly empty) popups on NSFW sites like viperTO .to/popconsole.php| diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 094dc26e5..717ddb9a2 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22) -! Version: 27November2025v1 +! Version: 07December2025v2 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -26,6 +26,7 @@ ! Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. ||adblock.gjtech.net^ ||spam404bl.com^ +ipaddress=109.201.135.46 109.201.135.46 ||fredfiber.no^ ||securemecca.com^ @@ -56,6 +57,7 @@ ||mandriva.com^ ! Fraudulent browser extensions ||ublock.org^ +ipaddress=138.68.252.54 138.68.252.54 ||useragentswitch.com^ ||dev-nano.com^ @@ -143,20 +145,11 @@ ! Other sites ! ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— ||ubuntu.org^$denyallow=you-were-likely-looking-for-ubuntu.com -103.224.212.249 ||speedtest.com^$denyallow=you-were-likely-looking-for-speedtest.net ||snapchat.cm^$denyallow=malware-typo-squatter-of-snapchat.com ||facebook.cm^$denyallow=malware-typo-squatter-of-facebook.com ||wix.cm^$denyallow=malware-typo-squatter-of-wix.com -199.59.243.222 |http://ww01. -173.208.96.42 -173.208.96.43 -173.208.96.44 -173.208.96.45 -173.208.96.46 -213.227.149.208 -213.227.149.211 ! https://github.com/DevSpen/links/blob/master/src/links.txt ||steamcommin*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com ||steamconnu*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com @@ -170,7 +163,14 @@ ||githubuser.com^$denyallow=you-were-likely-looking-for-githubusercontent.com ||rgithub.com^$denyallow=you-were-likely-looking-for-githubusercontent.com ||githubt.com^$denyallow=you-were-likely-looking-for-githubusercontent.com -! https://scammer•info/t/discord-nitro-scam-25/87887 +173.208.96.42 +173.208.96.43 +173.208.96.44 +173.208.96.45 +173.208.96.46 +199.59.243.222 +213.227.149.208 +213.227.149.211 ! ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— ||hippolyte-hag.com^ ||india-abc.com^ @@ -178,15 +178,20 @@ ||paramonos-oha.com^ ||photios-raj.com^ ||zeroredirect5.com^ +||roamingclicks.com^ +35.168.147.213 +35.175.38.64 +144.76.0.242 +144.76.1.130 +195.201.92.254 +3.216.243.46 +3.226.8.132 +34.230.160.215 +52.202.53.245 54.209.22.226 54.91.125.197 -52.202.53.245 -35.175.38.64 -35.168.147.213 -34.230.160.215 -3.226.8.132 -3.216.243.46 -||roamingclicks.com^ +94.130.185.237 +94.130.186.231 ! Source: desidertNO ||collectfasttracks.com^ ! Various ex-affiliate links at www•zombooru•com @@ -198,11 +203,6 @@ ||ns1.trafficclub.com^ ||satcom1.co.uk^ ||splitter.microxml.net^ -94.130.185.237 -94.130.186.231 -144.76.0.242 -144.76.1.130 -195.201.92.254 ! https://github.com/DandelionSprout/adfilt/pull/167 ! https://github.com/AdguardTeam/AdguardFilters/issues/124611 ! (https://github.com/DandelionSprout/adfilt/issues/632) @@ -211,36 +211,6 @@ ||pinoy-offers.com^ ||couponbybox.com^ ||newpage.in^ -34.204.214.165 -54.85.113.62 -54.205.83.61 -54.210.193.115 -2600:1f18:43d1:2a04:ee05:261e:d408:7ba1 -||banalbjar.com^ -||coryljanty.cam^ -||elfpetsic.com^ -||postback.report^ -||roksit.net^ -||adblockerapp.com^ -172.255.6.107 -172.255.6.147 -172.255.6.219 -172.255.6.225 -188.42.129.108 -188.42.129.116 -188.42.141.100 -188.42.141.92 -23.109.82.144 -23.109.82.41 -23.109.82.43 -23.109.82.65 -23.109.82.66 -23.109.87.169 -23.109.87.207 -23.109.87.208 -||blueoyster.click^ -216.21.13.14 -216.21.13.15 ||hafisague.com^ ||iortnhooping.website^ ||sitaopiqure.com^ @@ -255,9 +225,39 @@ ||videoadblockers. ||videoadblockertou. ||videoadblockextension. +||adblockerapp.com^ +||banalbjar.com^ +||blueoyster.click^ +||coryljanty.cam^ +||elfpetsic.com^ +||postback.report^ +||roksit.net^ /^142\.91\.159\.[12]?\d?\d$/ /^23\.109\.150\.[12]?\d?\d$/ /^23\.109\.248\.[12]?\d?\d$/ +172.255.6.107 +172.255.6.147 +172.255.6.219 +172.255.6.225 +188.42.129.108 +188.42.129.116 +188.42.141.100 +188.42.141.92 +216.21.13.14 +216.21.13.15 +23.109.82.144 +23.109.82.41 +23.109.82.43 +23.109.82.65 +23.109.82.66 +23.109.87.169 +23.109.87.207 +23.109.87.208 +34.204.214.165 +54.205.83.61 +54.210.193.115 +54.85.113.62 +2600:1f18:43d1:2a04:ee05:261e:d408:7ba1 ! https://github.com/DandelionSprout/adfilt/issues/942 /^172\.255\.6\.(\d\d?|(17?|2)[0-689]\d)$/ ||abedwithdrawalautograph.com^ @@ -610,36 +610,36 @@ ! https://github.com/AdguardTeam/AdguardFilters/issues/61743 /^(https?://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/ ! https://github.com/easylist/easylist/issues/6111 -||fres-news.com^ -||workerz-news.com^ -||zredir.com^ -178.128.142.109 -||findmedia.biz^ +/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/ ||backtonews.biz^ ||bagclick.biz^ +||best202*-games-web1.com^ ||bigkick.biz^ +||findmedia.biz^ +||fres-news.com^ ||getcontent24.com^ -||klickmode.biz^ -||newsgate.biz^ -||redmdeia.biz^ -||uptodater.net^ -||virnews.club^ -/^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/ -134.209.136.174 -||whiteclick.biz^ ||gonews2.com^ +||hooligapps.com^ +||klickmode.biz^ ||mediadate.net^ ||newscode.me^ +||newsgate.biz^ +||redmdeia.biz^ ||skymedia7.me^ ||startmode.biz^ ||texterra.me^ +||theonlygames.com^ +||uptodater.net^ +||virnews.club^ +||whiteclick.biz^ +||workerz-news.com^ +||zredir.com^ +134.209.136.174 +178.128.142.109 +62.210.11.203 62.210.6.153 62.210.7.209 62.210.9.92 -62.210.11.203 -||hooligapps.com^ -||best202*-games-web1.com^ -||theonlygames.com^ ! https://maldita•es/malditobulo/2020/12/04/concurso-mercadona-ganar-tarjeta-regalo-100-euros-phishing/ ||notified-today.com^ ||new-message.email^ @@ -670,30 +670,37 @@ ||kmip.net^ ||0redirc.com^ ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^ +ipaddress=5.8.34.26 +ipaddress=5.8.47.3 +ipaddress=103.224.182.251 5.8.34.26 5.8.47.3 103.224.182.251 ! https://github.com/DandelionSprout/adfilt/issues/193 ||holescontracting.com^ ||doggroomingnews.com^ -5.79.71.205 -5.79.71.225 -85.17.31.82 -85.17.31.122 178.162.203.202 178.162.203.211 178.162.203.226 178.162.217.107 +5.79.71.205 +5.79.71.225 +85.17.31.122 +85.17.31.82 2a02:1668:1034::2 ! https://github.com/DandelionSprout/adfilt/issues/195 ||logicalrecord.com^ ! https://github.com/DandelionSprout/adfilt/issues/196 ||secureportal.online^ ||emiratenbduae.com^ -66.85.156.85 -66.85.156.86 +ipaddress=108.170.31.123 +ipaddress=108.170.52.156 +ipaddress=66.85.156.85 +ipaddress=66.85.156.86 108.170.31.123 108.170.52.156 +66.85.156.85 +66.85.156.86 ! https://github.com/DandelionSprout/adfilt/issues/198 ! https://www•bleepingcomputer•com/virus-removal/ (18/06/2021) ||toksearches.xyz^ @@ -743,9 +750,9 @@ ||video-call.live^ ||video-change.digital^ ||watch-this.live^ -95.168.170.165 213.227.145.147 213.227.149.216 +95.168.170.165 ! https://twitter•com/adamziaja/status/1252234957679808513 ||wow-robotics.xyz^ ! https://blog•sucuri•net/2021/05/woocommerce-credit-card-skimmer•html @@ -753,11 +760,13 @@ ||justinstalledpanel.com^ ||albumzips.xyz^ ||aleinvest.xyz^ +ipaddress=5.188.62.36 5.188.62.36 ! https://github.com/DandelionSprout/adfilt/issues/223 ||speedupmypcfree.com^ ! https://github.com/DandelionSprout/adfilt/issues/224 ||ssielearning.com^ +ipaddress=69.49.231.244 69.49.231.244 ! https://movsb•0x0•st/users/mia ! https://github.com/DandelionSprout/adfilt/issues/228 @@ -767,6 +776,7 @@ ||rblxexploits.net^ ||nanorgin.ydns.eu^ ||yzsnw.com^ +ipaddress=37.34.176.37 37.34.176.37 ||pcspeedcat.com^ ||auslogics.com^ @@ -784,6 +794,8 @@ ||mgmgmg.com^ ||temp74.com^ ||trackwebclick.com^ +ipaddress=23.111.31.137 +ipaddress=23.111.88.207 23.111.31.137 23.111.88.207 ! https://github.com/DandelionSprout/adfilt/issues/254 @@ -839,6 +851,7 @@ ||kiff.tech^ ! https://www•virustotal•com/gui/domain/kiff•tech/relations ! https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection +ipaddress=45.90.58.90 45.90.58.90 ! https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community ! https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection @@ -908,53 +921,53 @@ ! https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community 185.243.56.167 ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -123.10.224.135 -59.47.187.147 -39.68.172.210 -122.192.177.176 -112.27.124.108 -123.110.176.246 -219.155.105.98 -171.35.161.209 -60.16.255.36 -112.30.4.52 -182.121.191.201 -121.61.48.170 -39.81.68.45 -27.222.220.164 -113.233.215.135 -151.77.100.133 -125.120.13.184 -120.12.138.133 -27.194.115.185 104.128.199.228 -183.92.123.145 -110.89.8.126 -125.43.211.184 -1.0.218.230 -221.208.4.56 -60.13.60.19 -171.37.29.87 -124.91.237.188 -115.56.137.49 -115.52.240.69 -112.252.132.185 -117.198.240.157 +27.194.115.185 +27.222.220.164 +39.68.172.210 +39.81.68.45 42.53.240.249 -116.179.138.68 -110.241.119.159 -115.56.31.133 -103.19.128.222 -202.12.80.74 +59.47.187.147 +60.13.60.19 +60.16.255.36 61.52.8.62 -182.122.252.69 -219.155.26.50 -120.4.141.185 -119.102.7.115 72.51.127.213 +1.0.218.230 +103.19.128.222 +110.241.119.159 +110.89.8.126 111.224.199.91 -119.250.236.122 +112.252.132.185 +112.27.124.108 112.30.110.58 +112.30.4.52 +113.233.215.135 +115.52.240.69 +115.56.137.49 +115.56.31.133 +116.179.138.68 +117.198.240.157 +119.102.7.115 +119.250.236.122 +120.12.138.133 +120.4.141.185 +121.61.48.170 +122.192.177.176 +123.10.224.135 +123.110.176.246 +124.91.237.188 +125.120.13.184 +125.43.211.184 +151.77.100.133 +171.35.161.209 +171.37.29.87 +182.121.191.201 +182.122.252.69 +183.92.123.145 +202.12.80.74 +219.155.105.98 +219.155.26.50 +221.208.4.56 ! https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community ||pcae.de^ ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community @@ -1029,37 +1042,37 @@ ||mediadlvr.com^ ! https://github.com/DandelionSprout/adfilt/pull/348 ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -39.83.80.247 -68.197.33.124 -219.157.21.37 -182.123.141.17 -125.47.243.187 -182.122.196.203 -182.117.231.182 +103.233.216.77 +106.86.172.194 +110.167.64.171 112.31.211.135 -125.106.63.93 115.59.197.46 +116.17.210.157 +119.113.248.74 122.159.29.192 +123.10.65.201 +125.106.63.93 +125.47.205.109 +125.47.243.187 +168.90.205.46 171.40.0.127 171.80.219.160 -123.10.65.201 -168.90.205.46 -125.47.205.109 +175.0.95.85 +182.117.231.182 +182.122.196.203 +182.123.141.17 +183.15.90.156 +183.188.192.55 +219.157.21.37 +222.142.183.194 +27.45.103.240 39.80.147.239 +39.81.117.73 +39.83.80.247 45.224.171.130 45.5.209.75 -116.17.210.157 -27.45.103.240 -110.167.64.171 -39.81.117.73 -183.15.90.156 -119.113.248.74 -175.0.95.85 61.52.99.109 -222.142.183.194 -106.86.172.194 -103.233.216.77 -183.188.192.55 +68.197.33.124 ! https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community 198.23.255.14 ||trumops.com^ @@ -1147,6 +1160,7 @@ ! https://www•nrk.no/vestfoldogtelemark/1.15750360 ||dundeehills.group^ !+ NOT_OPTIMIZED +ipaddress=132.148.220.142 132.148.220.142 ||chess-progress.ru^ ! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 @@ -1223,11 +1237,18 @@ ||findsexy.life^ ||findsolemate.life^ ||dating-galaxy.life^ +ipaddress=195.201.253.130 +ipaddress=195.201.253.131 195.201.253.130 195.201.253.131 ! The bottom download button on https://www•sushichop•com/ ||installiq.com^ ||cpmverdirect.com^ +ipaddress=15.197.244.48 +ipaddress=96.47.230.67 +ipaddress=96.47.230.68 +ipaddress=96.47.230.69 +ipaddress=96.47.230.70 15.197.244.48 96.47.230.67 96.47.230.68 @@ -1252,6 +1273,7 @@ ||kdmrqw.com^ ||kdmttk.com^ ||uuidtsinc.net^ +ipaddress=31.220.27.134 31.220.27.134 ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk. @@ -1387,6 +1409,8 @@ 85.17.31.152 95.211.26.202 ! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 +ipaddress=158.247.212.220 +ipaddress=165.227.168.212 158.247.212.220 165.227.168.212 ! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ @@ -1409,6 +1433,7 @@ ||stelronsi.net^ ||tadaickaipt.com^ ||vekeltaizy.net^ +ipaddress=139.45.197.236 139.45.197.236 ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^ @@ -1425,6 +1450,9 @@ ||tutatagliente.com^ ||potestainsula.com^ ||motherpipe.net^ +ipaddress=51.91.66.125 +ipaddress=51.178.76.105 +ipaddress=147.135.253.55 51.91.66.125 51.178.76.105 147.135.253.55 @@ -1433,6 +1461,8 @@ !+ NOT_OPTIMIZED !+ NOT_OPTIMIZED ! https://github.com/AdguardTeam/AdguardFilters/issues/131156 +ipaddress=146.19.169.98 +ipaddress=146.19.169.99 146.19.169.98 146.19.169.99 ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 @@ -2951,6 +2981,7 @@ ! Random Discord servers ||newntflix- ||giveawaycord. +ipaddress=162.241.124.200 162.241.124.200 ! https://github.com/AdguardTeam/AdguardFilters/issues/135815 ||adsstar.in^ @@ -2963,6 +2994,7 @@ ||tnlink.in^ ||tnvalue.in^ ||webhostingtips.club^ +ipaddress=157.90.71.190 157.90.71.190 ! https://github.com/AdguardTeam/AdguardFilters/issues/135924 ||beskittyan.com^ @@ -3000,6 +3032,9 @@ ||uxobx.xyz^ ||vayamuegn.icu^ ||wehiqes.xyz^ +ipaddress=44.228.230.225 +ipaddress=50.112.124.170 +ipaddress=100.20.104.229 44.228.230.225 50.112.124.170 100.20.104.229 @@ -3012,6 +3047,10 @@ ||gsecurecontent.com^ ||pressizer.net^ ||sapino.net^ +ipaddress=44.236.213.34 +ipaddress=52.24.156.12 +ipaddress=52.25.6.134 +ipaddress=100.20.13.49 44.236.213.34 52.24.156.12 52.25.6.134 @@ -3448,6 +3487,8 @@ ||project-obs.com^ ||studio-obs.com^ ||webull-download. +ipaddress=185.106.94.139 +ipaddress=45.90.109.196 185.106.94.139 45.90.109.196 91.229.23.200 @@ -3467,6 +3508,7 @@ 185.155.184.98 194.110.247.242 ! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ +ipaddress=54.219.218.169 54.219.218.169 ! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^ @@ -11035,6 +11077,7 @@ ||yj-huayuan.com^ ||ynjkdl.com^ ||yuxc.xyz^ +ipaddress=103.155.214.207 103.155.214.207 ! Inspired by https://github.com/AdguardTeam/AdguardFilters/issues/197908 ||app-update.site^ @@ -12342,6 +12385,20 @@ http://secured21.*.com/| ! https://github.com/DandelionSprout/adfilt/issues/1197 ||creations.tools^ ||idtsoftware.com^ +! https://github.com/DandelionSprout/adfilt/issues/1212 +||acrossprotocols.com^ +||aftop10.com^ +||directory-opus-manager.github.io^ +||dokopka.icu^ +||dramajaratstate.com^ +||heygetbarter.com^ +||michaelborsari.com^ +||softs-window.com^ +||sublime-merge-git-client.github.io^ +||sublime-text-3.github.io^ +||welearnn.com^ +94.156.232.201 +213.209.143.119 ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 ||downloadprovider.me^ @@ -12763,16 +12820,19 @@ http://secured21.*.com/| ||drugcoupons.xyz^ ||freemedicine.info^ ||medication.coupons^ +ipaddress=147.135.16.27 147.135.16.27 ! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^ ! https://scambiofigu•forumcommunity•net/?t=57482915 ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious ! Google results for 'Katy and Bob：Cake Café powerpc' (04/11/2022) +ipaddress=185.87.148.199 185.87.148.199 ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) ||gacorhub.com^ ||zh1653.com^ +ipaddress=45.136.49.35 45.136.49.35 ! Browsing around for Tajik newssites ||etarefcity.live^ @@ -12822,6 +12882,18 @@ http://secured21.*.com/| ||zombooru.com^ ||kusubooru.com^ ||wh40kart.im^ +ipaddress=45.33.2.79 +ipaddress=45.33.18.44 +ipaddress=45.33.20.235 +ipaddress=45.33.23.183 +ipaddress=45.33.30.197 +ipaddress=45.56.79.23 +ipaddress=45.79.19.196 +ipaddress=72.14.178.174 +ipaddress=72.14.185.43 +ipaddress=96.126.123.244 +ipaddress=173.255.194.134 +ipaddress=198.58.118.167 45.33.2.79 45.33.18.44 45.33.20.235 diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 3f7e8447b..85e487200 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 27November2025v1 +# Version: 07December2025v2 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway. @@ -64,8 +64,6 @@ adblock.gjtech.net spam404bl.com 109.201.135.46 - - fredfiber.no securemecca.com 1hos.cf @@ -101,8 +99,6 @@ mandriva.com ublock.org 138.68.252.54 - - useragentswitch.com dev-nano.com # Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. @@ -262,47 +258,11 @@ the1adblocker.com # ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— ubuntu.org - -103.224.212.249 - - speedtest.com snapchat.cm facebook.cm wix.cm -199.59.243.222 - - - - -173.208.96.42 - - - -173.208.96.43 - - - -173.208.96.44 - - - -173.208.96.45 - - - -173.208.96.46 - - - -213.227.149.208 - - - -213.227.149.211 - - ddscordapp.com diicordapp.com disccrdapp.com @@ -358,7 +318,26 @@ wgithub.com githubuser.com rgithub.com githubt.com -# https://scammer•info/t/discord-nitro-scam-25/87887 + + + + + + + + + + + +173.208.96.42 +173.208.96.43 +173.208.96.44 +173.208.96.45 +173.208.96.46 +199.59.243.222 +213.227.149.208 +213.227.149.211 + # ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— hippolyte-hag.com @@ -367,39 +346,37 @@ ortrun-adi.com paramonos-oha.com photios-raj.com zeroredirect5.com +roamingclicks.com -54.209.22.226 + + + -54.91.125.197 -52.202.53.245 -35.175.38.64 35.168.147.213 - - - -34.230.160.215 - - - -3.226.8.132 - - - +35.175.38.64 +144.76.0.242 +144.76.1.130 +195.201.92.254 3.216.243.46 +3.226.8.132 +34.230.160.215 +52.202.53.245 +54.209.22.226 +54.91.125.197 +94.130.185.237 +94.130.186.231 - -roamingclicks.com # Source: desidertNO collectfasttracks.com # Various ex-affiliate links at www•zombooru•com @@ -412,26 +389,6 @@ ns1.trafficclub.com satcom1.co.uk splitter.microxml.net -94.130.185.237 - - - -94.130.186.231 - - - -144.76.0.242 - - - -144.76.1.130 - - - -195.201.92.254 - - - # https://github.com/DandelionSprout/adfilt/pull/167 @@ -446,102 +403,6 @@ couponbybox.com newpage.in -34.204.214.165 - - - -54.85.113.62 - - - -54.205.83.61 - - - -54.210.193.115 - - -[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1] -banalbjar.com -coryljanty.cam -elfpetsic.com -postback.report -roksit.net -adblockerapp.com - -172.255.6.107 - - - -172.255.6.147 - - - -172.255.6.219 - - - -172.255.6.225 - - - -188.42.129.108 - - - -188.42.129.116 - - - -188.42.141.100 - - - -188.42.141.92 - - - -23.109.82.144 - - - -23.109.82.41 - - - -23.109.82.43 - - - -23.109.82.65 - - - -23.109.82.66 - - - -23.109.87.169 - - - -23.109.87.207 - - - -23.109.87.208 - - -blueoyster.click - -216.21.13.14 - - - -216.21.13.15 - - - hafisague.com iortnhooping.website @@ -557,9 +418,66 @@ videoadblockerpro.com videoadblockers.com videoadblockertou.com videoadblockextension.com +adblockerapp.com +banalbjar.com +blueoyster.click +coryljanty.cam +elfpetsic.com +postback.report +roksit.net + + + + + + + + + + + + + + + + + + + + + + + + + + +172.255.6.107 +172.255.6.147 +172.255.6.219 +172.255.6.225 +188.42.129.108 +188.42.129.116 +188.42.141.100 +188.42.141.92 +216.21.13.14 +216.21.13.15 +23.109.82.144 +23.109.82.41 +23.109.82.43 +23.109.82.65 +23.109.82.66 +23.109.87.169 +23.109.87.207 +23.109.87.208 +34.204.214.165 +54.205.83.61 +54.210.193.115 +54.85.113.62 +[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1] + # https://github.com/DandelionSprout/adfilt/issues/942 abedwithdrawalautograph.com @@ -914,60 +832,54 @@ zeroclampentice.com # https://github.com/AdguardTeam/AdguardFilters/issues/61743 # https://github.com/easylist/easylist/issues/6111 -fres-news.com -workerz-news.com -zredir.com -178.128.142.109 - - -findmedia.biz backtonews.biz bagclick.biz bigkick.biz +findmedia.biz +fres-news.com getcontent24.com -klickmode.biz -newsgate.biz -redmdeia.biz -uptodater.net -virnews.club - - -134.209.136.174 - - -whiteclick.biz gonews2.com +hooligapps.com +klickmode.biz mediadate.net newscode.me +newsgate.biz +redmdeia.biz skymedia7.me startmode.biz texterra.me +theonlygames.com +uptodater.net +virnews.club +whiteclick.biz +workerz-news.com +zredir.com + + + + + + + + +134.209.136.174 +178.128.142.109 +62.210.11.203 62.210.6.153 - - - 62.210.7.209 - - - 62.210.9.92 - - -62.210.11.203 - - -hooligapps.com -theonlygames.com # https://maldita•es/malditobulo/2020/12/04/concurso-mercadona-ganar-tarjeta-regalo-100-euros-phishing/ notified-today.com new-message.email -167.99.249.47 + +167.99.249.47 + # https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ # https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ moderncomputer.net @@ -995,73 +907,56 @@ kmip.net 0redirc.com iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com + + + + + 5.8.34.26 - - - 5.8.47.3 - - - 103.224.182.251 - # https://github.com/DandelionSprout/adfilt/issues/193 holescontracting.com doggroomingnews.com -5.79.71.205 -5.79.71.225 -85.17.31.82 -85.17.31.122 - 178.162.203.202 - - - 178.162.203.211 - - - 178.162.203.226 - - - 178.162.217.107 - - +5.79.71.205 +5.79.71.225 +85.17.31.122 +85.17.31.82 [2a02:1668:1034::2] + # https://github.com/DandelionSprout/adfilt/issues/195 logicalrecord.com # https://github.com/DandelionSprout/adfilt/issues/196 secureportal.online emiratenbduae.com -66.85.156.85 -66.85.156.86 108.170.31.123 - - - 108.170.52.156 - +66.85.156.85 +66.85.156.86 # https://github.com/DandelionSprout/adfilt/issues/198 # https://www•bleepingcomputer•com/virus-removal/ (18/06/2021) @@ -1113,16 +1008,14 @@ video-call.live video-change.digital watch-this.live -95.168.170.165 + + 213.227.145.147 - - - 213.227.149.216 - +95.168.170.165 # https://twitter•com/adamziaja/status/1252234957679808513 wow-robotics.xyz @@ -1134,16 +1027,12 @@ albumzips.xyz aleinvest.xyz 5.188.62.36 - - # https://github.com/DandelionSprout/adfilt/issues/223 speedupmypcfree.com # https://github.com/DandelionSprout/adfilt/issues/224 ssielearning.com 69.49.231.244 - - # https://movsb•0x0•st/users/mia 5starhdporn.com # https://github.com/DandelionSprout/adfilt/issues/228 @@ -1160,8 +1049,6 @@ nanorgin.ydns.eu yzsnw.com 37.34.176.37 - - pcspeedcat.com auslogics.com # (https://github.com/DandelionSprout/adfilt/issues/1076) @@ -1178,32 +1065,24 @@ mgmgmg.com temp74.com trackwebclick.com + 23.111.31.137 - - - 23.111.88.207 - - # https://github.com/DandelionSprout/adfilt/issues/254 onesafesoftware.com # https://github.com/DandelionSprout/adfilt/issues/257 + + + + + + 185.158.250.239 - - - 192.169.69.25 - - - 212.192.241.72 - - - 37.0.10.83 - lucdream.com pesoaniz.com artofads.co @@ -1217,8 +1096,6 @@ dashwoodestates.com # https://safeweb•norton•com/report/show?url=192•3•110•170 192.3.110.170 - - # https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ socialsearchconverter.com install.socialsearchconverter.com @@ -1245,8 +1122,6 @@ totalwebshield.xyz # https://www•virustotal•com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection 91.241.19.38 - - # https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection # https://safeweb•norton•com/report/show?url=telete•in # https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -1258,80 +1133,52 @@ kiff.tech # https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection 45.90.58.90 - - # https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community # https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection 95.85.89.98 - - # https://github.com/DandelionSprout/adfilt/issues/267 # https://github.com/DandelionSprout/adfilt/pull/278 # https://www.virustotal.com/gui/file/da75c85fe037f9ff9ebbbd0b37dd2ff154f5e70a0dc6870286e0d3df6b8f246f/community 139.28.37.49 - - # https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community - 35.194.188.37 - # https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community # https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community 91.243.121.19 - - # https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community 103.169.90.205 - - # https://github.com/DandelionSprout/adfilt/pull/281 # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + + + + + + + 125.44.43.45 - - - 182.121.8.240 - - - 42.235.183.74 - - - 78.36.32.242 - - - 115.50.2.119 - - - 115.50.110.163 - - - 119.179.84.145 - - - 188.120.50.98 - - - 190.238.183.5 - - - 27.220.253.78 - # https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community esetnode32-antiviru.ydns.eu # https://www•joesandbox•com/analysis/486636/0/html#domains @@ -1339,8 +1186,6 @@ aieov.com # Relations to the original domain 192.3.194.242 - - w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu avira-antivirus.ydns.eu @@ -1378,227 +1223,127 @@ cd.org # https://github.com/DandelionSprout/adfilt/commit/f7f114945c83b339be5cdd848e229680d9918abb#commitcomment-57642875 23.94.26.138 - - # https://github.com/DandelionSprout/adfilt/pull/298 # https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community 205.185.126.200 - - # https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community 185.243.56.167 - - # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -123.10.224.135 -59.47.187.147 -39.68.172.210 -122.192.177.176 -112.27.124.108 -123.110.176.246 -219.155.105.98 -171.35.161.209 -60.16.255.36 -112.30.4.52 -182.121.191.201 -121.61.48.170 -39.81.68.45 -27.222.220.164 -113.233.215.135 -151.77.100.133 -125.120.13.184 - - - -120.12.138.133 - - - -27.194.115.185 - - 104.128.199.228 - - - -183.92.123.145 - - - -110.89.8.126 - - - -125.43.211.184 - - - -1.0.218.230 - - - -221.208.4.56 - - - -60.13.60.19 - - - -171.37.29.87 - - - -124.91.237.188 - - - -115.56.137.49 - - - -115.52.240.69 - - - -112.252.132.185 - - - -117.198.240.157 - - - +27.194.115.185 +27.222.220.164 +39.68.172.210 +39.81.68.45 42.53.240.249 - - - -116.179.138.68 - - - -110.241.119.159 - - - -115.56.31.133 - - - -103.19.128.222 - - - -202.12.80.74 - - - +59.47.187.147 +60.13.60.19 +60.16.255.36 61.52.8.62 - - - -182.122.252.69 - - - -219.155.26.50 - - - -120.4.141.185 - - - -119.102.7.115 - - - 72.51.127.213 - - - +1.0.218.230 +103.19.128.222 +110.241.119.159 +110.89.8.126 111.224.199.91 - - - -119.250.236.122 - - - +112.252.132.185 +112.27.124.108 112.30.110.58 - +112.30.4.52 +113.233.215.135 +115.52.240.69 +115.56.137.49 +115.56.31.133 +116.179.138.68 +117.198.240.157 +119.102.7.115 +119.250.236.122 +120.12.138.133 +120.4.141.185 +121.61.48.170 +122.192.177.176 +123.10.224.135 +123.110.176.246 +124.91.237.188 +125.120.13.184 +125.43.211.184 +151.77.100.133 +171.35.161.209 +171.37.29.87 +182.121.191.201 +182.122.252.69 +183.92.123.145 +202.12.80.74 +219.155.105.98 +219.155.26.50 +221.208.4.56 # https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community pcae.de # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + 117.196.49.21 - - - 115.55.54.234 - - - 115.52.17.123 - - - 182.59.69.21 - # https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community chip-secured-download.de # https://www•virustotal•com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb @@ -1620,8 +1365,6 @@ realdefen.se # https://www•virustotal•com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations 160.202.163.100 - - # https://www•virustotal•com/gui/ip-address/160•202•163•100/relations microsoftkernel.com microsofthk.com @@ -1635,18 +1378,12 @@ machinesalaver.net # https://www•virustotal•com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community 45.95.169.115 - - # https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community 45.148.120.80 - - # https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community 85.239.33.9 - - # Relations to the domain above adminsys.serveftp.com amazbaidu.serveftp.com @@ -1665,13 +1402,9 @@ eposcardokubo.serveftp.com # https://www•virustotal•com/gui/file/8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0/community 107.173.176.183 - - # https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community 45.148.120.171 - - # https://twitter•com/soranker0/status/1449491402409185283 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-950330114 @@ -1681,8 +1414,6 @@ google-yandex.com # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-951321929 159.148.186.228 - - # https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains yotube.com security-scanner.xyz @@ -1701,166 +1432,98 @@ mediadlvr.com # https://github.com/DandelionSprout/adfilt/pull/348 # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -39.83.80.247 -68.197.33.124 -219.157.21.37 -182.123.141.17 -125.47.243.187 -182.122.196.203 -182.117.231.182 -112.31.211.135 -125.106.63.93 -115.59.197.46 -122.159.29.192 - - - -171.40.0.127 - - - -171.80.219.160 - - - -123.10.65.201 - - - -168.90.205.46 - - - -125.47.205.109 - - - -39.80.147.239 - - - -45.224.171.130 - - - -45.5.209.75 - - - -116.17.210.157 - - - -27.45.103.240 - - - -110.167.64.171 - - - -39.81.117.73 - - - -183.15.90.156 - - - -119.113.248.74 - - - -175.0.95.85 - - - -61.52.99.109 - - - -222.142.183.194 - - - -106.86.172.194 103.233.216.77 - - - +106.86.172.194 +110.167.64.171 +112.31.211.135 +115.59.197.46 +116.17.210.157 +119.113.248.74 +122.159.29.192 +123.10.65.201 +125.106.63.93 +125.47.205.109 +125.47.243.187 +168.90.205.46 +171.40.0.127 +171.80.219.160 +175.0.95.85 +182.117.231.182 +182.122.196.203 +182.123.141.17 +183.15.90.156 183.188.192.55 - +219.157.21.37 +222.142.183.194 +27.45.103.240 +39.80.147.239 +39.81.117.73 +39.83.80.247 +45.224.171.130 +45.5.209.75 +61.52.99.109 +68.197.33.124 # https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community 198.23.255.14 - - # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971512075 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971495248 # https://github.com/iam-py-test/investigations/blob/main/2021/11/15/1.md#iocs trumops.com runmodes.com + 91.121.67.60 - - - 172.67.186.189 - - # https://scammer•info/t/mcafee-phish/83725 securefirst.us-east-1.linodeobjects.com # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + 39.65.72.211 - - - 42.238.151.197 - - - 27.213.60.53 - - - 115.56.169.134 - # https://github.com/iam-py-test/investigations/blob/main/2021/11/21/1.md yasir252.com safelink.kadal.club @@ -1874,13 +1537,9 @@ yourladiefun.life # https://www•virustotal•com/gui/file/2b2628a50d3b39b0fa2395d487bf62b00e37cdae847ff76ee58399bbe4e9f7b3/community 194.87.138.20 - - # https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community 103.167.92.73 - - # https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community bursakulis.com # https://www•virustotal•com/gui/url/b333c49efa4d399e65c5e2d96a905b380acbca58a3e3052b7bd7cfcb3e0e81ee @@ -1903,37 +1562,25 @@ yunosurveys.com # https://github.com/uBlockOrigin/uAssets/pull/10620 # https://www•virustotal•com/gui/file/d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8/community + + + + + + + + + + 58.249.74.79 - - - 27.45.14.109 - - - 27.40.101.191 - - - 27.45.119.22 - - - 27.47.73.159 - - - 115.204.119.237 - - - 163.125.31.46 - - - 163.179.168.44 - # https://github.com/uBlockOrigin/uAssets/pull/10647 # https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md money-mod.com @@ -1947,49 +1594,31 @@ bestlifeoffer20.com # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community + + + + + + + + + + + + + 110.89.59.135 - - - 113.116.89.1 - - - 119.183.146.191 - - - 153.3.3.226 - - - 182.116.104.6 - - - 60.7.133.200 - - - 122.6.254.201 - - - 110.89.11.167 - - - 171.112.177.90 - - - 115.194.38.143 - - - 61.52.79.32 - # https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 # https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 @@ -2008,8 +1637,6 @@ dundeehills.group 132.148.220.142 - - # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 chess-progress.ru # https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 @@ -2027,55 +1654,37 @@ p-stn.net # https://github.com/iam-py-test/investigations/blob/main/2021/12/13/1.md haxpc.net + 52.53.243.52 - - - 34.201.22.10 - - # https://scammer•info/t/crypto-scammers-onceagain/85354 # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community + + + + + + + + + + 123.10.225.196 - - - 122.192.106.84 - - - 172.88.199.9 - - - 114.38.176.185 - - - 61.52.97.35 - - - 27.206.181.208 - - - 124.163.130.175 - - - 118.75.87.102 - # https://github.com/iam-py-test/investigations/blob/main/2021/12/14/1.md # https://github.com/DevSpen/links/pull/3 # https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ 134.122.115.190 - - cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com # https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777 viewty.xyz @@ -2094,8 +1703,6 @@ lekms.com ru.com 141.8.226.34 - - # https://github.com/AdguardTeam/AdguardFilters/issues/108571 ston-app.com # fake human verification scam @@ -2109,8 +1716,6 @@ crashfixes.com # https://www•virustotal•com/gui/file/9d40ae0439ddc594b2cf64e21ad0fdea9bb440524298e3a6bcfcc1fb417f1ed2/relations 91.240.118.172 - - # "Press Allow to continue" kuyhaa-mee.com upload-4ever.com @@ -2139,8 +1744,6 @@ freeversioncrack.com top3hostngc.xyz 198.199.120.251 - - # https://www•telia•no/kundeservice/mobil/malware-flubot-android/ @@ -2150,37 +1753,27 @@ findsexy.life findsolemate.life dating-galaxy.life + 195.201.253.130 - - - 195.201.253.131 - - # The bottom download button on https://www•sushichop•com/ installiq.com cpmverdirect.com + + + + + + + 15.197.244.48 - - - 96.47.230.67 - - - 96.47.230.68 - - - 96.47.230.69 - - - 96.47.230.70 - # https://securitytrails•com/list/ns/ns1•fastthinkingdns•com highercaptcha-settle.com highercaptchasettle.com @@ -2188,6 +1781,8 @@ top-captcharesolver.com + + # https://github.com/AdguardTeam/AdguardFilters/issues/121544 trafredirtds.com @@ -2202,8 +1797,6 @@ kdmttk.com uuidtsinc.net 31.220.27.134 - - # https://github.com/AdguardTeam/AdguardFilters/issues/122757 # https://github.com/AdguardTeam/AdguardFilters/issues/123544 @@ -2333,22 +1926,16 @@ z-prize.icu + + + 85.17.31.152 - - - 95.211.26.202 - - # https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 + 158.247.212.220 - - - 165.227.168.212 - - # https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ # https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 @@ -2356,8 +1943,6 @@ z-prize.icu garbiaes.com 23.81.64.183 - - # https://github.com/AdguardTeam/AdguardFilters/issues/125300 inmewa.com omshellderom.com @@ -2374,8 +1959,6 @@ tadaickaipt.com vekeltaizy.net 139.45.197.236 - - # https://github.com/AdguardTeam/AdguardFilters/issues/128029 becovi.com becovi.co.uk @@ -2392,17 +1975,15 @@ tutatagliente.com potestainsula.com motherpipe.net + + + + + 51.91.66.125 - - - 51.178.76.105 - - - 147.135.253.55 - # https://github.com/uBlockOrigin/uAssets/issues/14569 → https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection (https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) # https://github.com/AdguardTeam/AdguardFilters/issues/129414 @@ -2411,13 +1992,9 @@ motherpipe.net # https://github.com/AdguardTeam/AdguardFilters/issues/131156 + 146.19.169.98 - - - 146.19.169.99 - - # https://github.com/AdguardTeam/AdguardFilters/issues/132079 # https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -3932,16 +3509,12 @@ niderschlagsradar.de 2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com 69.162.80.56 - - # https://github.com/AdguardTeam/AdguardFilters/issues/134903 # Random Discord servers giveawaycord.com 162.241.124.200 - - # https://github.com/AdguardTeam/AdguardFilters/issues/135815 adsstar.in clickcafe.in @@ -3955,8 +3528,6 @@ tnvalue.in webhostingtips.club 157.90.71.190 - - # https://github.com/AdguardTeam/AdguardFilters/issues/135924 beskittyan.com cadbitff.com @@ -3974,8 +3545,6 @@ vethojoa.net wumpeeps.net 139.45.197.239 - - # https://github.com/AdguardTeam/AdguardFilters/issues/136390 glthub.com # https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -3997,17 +3566,15 @@ uxobx.xyz vayamuegn.icu wehiqes.xyz + + + + + 44.228.230.225 - - - 50.112.124.170 - - - 100.20.104.229 - # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread link.sv 4.fo @@ -4018,27 +3585,21 @@ gsecurecontent.com pressizer.net sapino.net + + + + + + 44.236.213.34 - - - 52.24.156.12 - - - 52.25.6.134 - - - 100.20.13.49 - # https://github.com/AdguardTeam/AdguardFilters/issues/139667 goldmesoil.live 51.68.87.229 - - # https://github.com/DandelionSprout/adfilt/issues/747 2022crucialcatch.store adidascostarica.com @@ -4446,6 +4007,8 @@ zapatillasmcqueen.com + + # https://www•bleepingcomputer•com/news/security/hackers-push-malware-via-google-search-ads-for-vlc-7-zip-ccleaner/ @@ -4460,17 +4023,15 @@ project-obs.com studio-obs.com webull-download.com + + + + + 185.106.94.139 - - - 45.90.109.196 - - - 91.229.23.200 - # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1401711872 # https://github.com/AdguardTeam/AdguardFilters/issues/144514 bonusgift.life @@ -4486,18 +4047,12 @@ thebestprizes.life winearth.life winpulse.life + 185.155.184.98 - - - 194.110.247.242 - - # https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ 54.219.218.169 - - # https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ 0365alert.com 0365online.com @@ -4904,15 +4459,11 @@ yourticketchance.com yourorderupdate.com 64.132.201.92 - - # https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener jatvpn.softether.net jatcraft.com 209.141.51.49 - - post-norway.web.app # https://github.com/AdguardTeam/AdguardFilters/issues/142955 arquilavaan.com @@ -4981,17 +4532,15 @@ wholegrady.com wooden-comfort.com # Unsuited for wildcarding + + + + + 208.88.225.116 - - - 208.88.225.117 - - - 208.88.225.119 - # https://github.com/AdguardTeam/AdguardFilters/issues/144823 @@ -5034,25 +4583,19 @@ kristinee.com lakeside-fishandchips.com office-view.com + + + + + + + 108.61.242.65 - - - 146.70.78.43 - - - 87.120.254.39 - - - 45.150.108.213 - - - 92.204.160.240 - # https://github.com/AdguardTeam/AdguardFilters/issues/148560 # Comments on Slack @@ -5316,25 +4859,19 @@ z5v6h8recpgb.com zirze151uk5d.com zxvjn4igweb9.com + + + + + + + 185.246.188.124 - - - 185.246.188.125 - - - 194.63.140.103 - - - 194.63.143.61 - - - 194.63.143.96 - # https://github.com/AdguardTeam/AdguardFilters/issues/152945 moneystartup.live @@ -5411,28 +4948,20 @@ yourlifestyle-blog.com zorka-news.com 37.48.80.112 - - # Slack comments cojcdn.net redic3.com totadblock.com + 109.206.168.16 - - - 109.206.168.17 - - # https://github.com/AdguardTeam/AdguardFilters/issues/155298 cadstoppam.live paidsuenut.live 57.128.71.215 - - # https://github.com/AdguardTeam/AdguardFilters/issues/155936 rumadel.com @@ -5559,6 +5088,9 @@ zuhrzf.com + + + 139.45.197.167 139.45.197.245 159.223.137.164 @@ -5569,6 +5101,7 @@ zuhrzf.com 192.243.58.123 192.243.58.124 192.243.58.125 + [2a02:b48:207:1::2] [2a02:b48:207:1::3] [2a02:b48:207:1::6] @@ -5580,6 +5113,8 @@ zuhrzf.com + + # https://github.com/AdguardTeam/AdguardFilters/issues/157308 dest.co.in dkeie.co.in @@ -5756,18 +5291,16 @@ vitalityfortune.com wellnessfortune.net ztomy.com + + + + + 5.45.123.44 - - - 69.16.230.226 - - - 208.91.196.46 - # https://github.com/AdguardTeam/AdguardFilters/issues/158316 abberantbeefy.com abominableexhibition.com @@ -6436,8 +5969,6 @@ ptwmbed.com 93.93.51.223 - - # https://github.com/AdguardTeam/AdguardFilters/issues/161364 # (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) @@ -6475,8 +6006,6 @@ no-oppdatert.com reschedule-delivery.ups.com.com 103.174.102.240 - - # https://github.com/libre-tube/LibreTube/issues/4409 libretube.net # https://github.com/RPiList/specials/issues/1353 @@ -6568,8 +6097,6 @@ yttersiden.no # https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7873648 38.180.96.244 - - # https://github.com/AdguardTeam/AdguardFilters/issues/172569 acareewityjh.com accedenonre.xyz @@ -6690,14 +6217,10 @@ wasanasset.buzz withmefeyauknaly.com wukbgater.buzz + 34.195.224.242 - - - 54.225.185.110 - - githubtalentcommunity.com # https://github.com/AdguardTeam/AdguardFilters/issues/173925 sweedbank-help.com @@ -6706,8 +6229,6 @@ dhlexpress-lieferung.net pochta-ru.com 91.202.233.143 - - # Based on a tip from my secretary advancedwalletpay.com amberzextracts.com @@ -6805,8 +6326,6 @@ speednetworkchain.com systemnetworkroute.com 108.62.157.10 - - # https://github.com/AdguardTeam/FiltersRegistry/issues/925 # https://github.com/AdguardTeam/FiltersRegistry/pull/927 avito.avito.avito.com @@ -6821,45 +6340,29 @@ avito.avito.www.avito.com # https://github.com/AdguardTeam/AdguardFilters/issues/179170 + + + + + + + + + + + + 172.240.108.68 - - - 172.240.108.76 - - - 172.240.108.84 - - - 172.240.127.234 - - - 172.240.253.132 - - - 192.243.59.12 - - - 192.243.59.13 - - - 192.243.59.20 - - - 192.243.61.225 - - - 192.243.61.227 - abberantextending.com abdicatehorrified.com abjectpreludeparity.com @@ -7738,18 +7241,16 @@ yelitong.com yourchoicehealthplan.com zymstr.com + + + + + + 185.149.120.161 - - - 185.149.120.163 - - - - 185.149.120.175 - # https://github.com/AdguardTeam/AdguardFilters/issues/184671 alatterapistroke.com astrarestaurant.com @@ -7796,81 +7297,49 @@ ups-packaging.delivery upsbezahlung.com vius-inf.com vrsecurego.com + + + + + + + + + + + + + + + + + + + + 45.202.32.3 - - - 45.8.92.138 - - - 79.133.46.252 - - - 82.147.85.156 - - - 91.212.166.16 - - - 94.156.64.129 - - - 94.232.249.61 - - - 94.232.249.69 - - - 94.232.249.75 - - - 94.232.249.235 - - - 176.111.174.118 - - - 176.113.115.191 - - - 191.96.224.140 - - - 193.124.185.42 - - - 193.143.1.45 - - - 193.143.1.214 - - - 193.143.1.217 - - - 208.91.189.203 - # https://github.com/AdguardTeam/AdguardFilters/issues/189905 # https://github.com/AdguardTeam/AdguardFilters/issues/196657 @@ -12278,8 +11747,6 @@ ynjkdl.com yuxc.xyz 103.155.214.207 - - # Inspired by https://github.com/AdguardTeam/AdguardFilters/issues/197908 app-update.site appupdate.net @@ -12289,15 +11756,11 @@ potanschranky.com prihlasit-secure-auth.com 185.196.9.214 - - chrome.webredirect.org captcha.webredirect.org 185.196.9.222 - - # https://github.com/AdguardTeam/AdguardFilters/issues/201064 100urls.com 17lc.cc @@ -12729,7 +12192,6 @@ yoursweetflirt.online 52.204.19.219 100.28.19.138 108.61.99.63 - [2600:1f18:43d1:2a02:169f:dcbb:85f9:3c56] [2600:1f18:43d1:2a02:b6ee:327b:545e:e578] [2600:1f18:43d1:2a02:c3bd:35f3:da0a:4041] @@ -12746,6 +12208,9 @@ yoursweetflirt.online + + + # https://github.com/AdguardTeam/AdguardFilters/issues/202010 # Various other reports @@ -12820,6 +12285,8 @@ zmeso.com + + abcradilytor.com abmagbychan.com agatorkoaltor.com @@ -12937,10 +12404,8 @@ wipteetolu.net wsbuckon.com zacmoageeshee.net zucoagorsout.com - 139.45.197.106 - # https://github.com/DandelionSprout/adfilt/issues/1129 password-internal.com # Though not _inherently_ malware, at least 1 spambot on this repo had direct ties to that site @@ -13146,10 +12611,8 @@ xn--2i0bt7pgig82ap6tbga.xn--mk1bu44c xxx-telegram.com zc-telegran.org zzz-telegram.com - 43.128.142.70 - # https://github.com/AdguardTeam/AdguardFilters/issues/20787[2-5] chceshi001.com gametime.fyi @@ -13305,6 +12768,8 @@ whetcsapp.com + + # https://github.com/DandelionSprout/adfilt/issues/1164 device-checking.com device-cleanup.com @@ -13314,10 +12779,8 @@ loadmyvids.com system-noticers.com systemsnotifications.com warningnotification.com - 46.101.81.149 - adaptationfirework.com armourbreederleadership.com bleachinjectionuncommon.com @@ -13361,15 +12824,11 @@ update-macos.com unesmunbrebers.com filinnetirt.com freshsubz.com - 52.15.34.25 - # https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware - 203.188.171.156 - # https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md soft-gets.com reaitek.com @@ -13632,6 +13091,7 @@ watch-user-help.com workspace-drive.com xtrash-tarck.com your-package-delivery.com + 158.94.209.86 158.94.209.87 158.94.209.88 @@ -13644,11 +13104,30 @@ your-package-delivery.com + + + # https://urlscan.io/result/019a4ffd-885c-7545-816a-3c121d8bdc0d/ (Early November 2025) # https://github.com/DandelionSprout/adfilt/issues/1197 creations.tools idtsoftware.com +# https://github.com/DandelionSprout/adfilt/issues/1212 +acrossprotocols.com +aftop10.com +directory-opus-manager.github.io +dokopka.icu +dramajaratstate.com +heygetbarter.com +michaelborsari.com +softs-window.com +sublime-merge-git-client.github.io +sublime-text-3.github.io +welearnn.com +94.156.232.201 +213.209.143.119 + + # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -13982,18 +13461,14 @@ cabura.loan csgocup.ru eslpro.ru market-csgo.ru - 194.226.139.121 194.226.139.7 95.181.157.36 - 95.181.172.204 - - # AS209813 (https://github.com/AdguardTeam/AdguardFilters/issues/114618#issuecomment-1100702530; currently specific to tools that support CIDR blocking) @@ -14088,8 +13563,6 @@ freemedicine.info medication.coupons 147.135.16.27 - - # https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ingeniovirtual.com # https://scambiofigu•forumcommunity•net/?t=57482915 @@ -14099,8 +13572,6 @@ ingeniovirtual.com 185.87.148.199 - - # Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) @@ -14113,8 +13584,6 @@ zh1653.com 45.136.49.35 - - # Browsing around for Tajik newssites etarefcity.live yepsimmen.live @@ -14125,33 +13594,25 @@ biztomjean.live backshyoh.live cityratetod.live + + + + + + + 51.91.211.94 - - - 162.19.71.16 - - - 146.59.240.191 - - - 54.37.5.34 - - - 54.36.118.105 - # Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt highlandnews.com pcbasicstrength.com leantime.bigfi.re 159.89.10.102 - - # Other pksauniversity.com sharedmega.com @@ -14165,10 +13626,8 @@ only4leaked.co thotsbay-leaked.com cbox.ws inuseme.com - 104.206.252.90 - # https://github.com/blocklistproject/Lists/issues/933 jNKmS0zFuEh.click # https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2 @@ -14183,8 +13642,6 @@ yuppdownload.com # Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) 34.80.59.191 - - # Various domains on https://securitytrails•com/list/ip/72•14•178•174 @@ -14193,53 +13650,33 @@ zombooru.com kusubooru.com wh40kart.im + + + + + + + + + + + + + + 45.33.2.79 - - - 45.33.18.44 - - - 45.33.20.235 - - - 45.33.23.183 - - - 45.33.30.197 - - - 45.56.79.23 - - - 45.79.19.196 - - - 72.14.178.174 - - - 72.14.185.43 - - - 96.126.123.244 - - - 173.255.194.134 - - - 198.58.118.167 - # https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ 1337links.net 777offers.net @@ -14338,29 +13775,21 @@ whackyblue.com ym3trk.com youwanthis.com + + + + + + + + 34.117.199.78 - - - 94.237.103.119 - - - 94.237.84.54 - - - 94.237.93.242 - - - 94.237.99.118 - - - 139.45.197.249 - # https://dnpedia•com/tlds/topm•php bizarrely listing "anahitagirted•uno" as the 622th most visited domain worldwide anahitagirted.uno arenitezill.com @@ -14394,33 +13823,19 @@ hokacanadaoutlet.ca louboutinnorge.com + + + + + + 196.196.153.151 - - - 158.222.7.116 - - - 196.245.152.139 - - - 165.231.251.197 - - - 196.242.16.29 - - - 165.231.4.90 - - - 158.222.7.83 - - # A scam SMS I got 95-214-26-78.plesk.page account-limitato.org @@ -14429,8 +13844,6 @@ tracking-sk.com supportnetflix.com 95.214.26.78 - - # Overly dedicated E-mail spammers wirexapp.africa.com @@ -14450,13 +13863,9 @@ kidroleland.info sirdayscare.info slownansuch.info + 185.155.184.57 - - - 185.155.186.24 - - style-js.com @@ -14466,8 +13875,6 @@ style-js.com - - estudioespositoymiguel.com.ar @@ -14532,13 +13939,9 @@ wsdcq7wayud.com xgptw11vogsh.com zeirj14ikqwf.com + 69.172.200.185 - - - 77.220.214.153 - - # More search terms than what can be counted with a supercomputer (11/03/2024) # Scam E-mails I've got @@ -14560,11 +13963,9 @@ wp3.xyz - 104.21.82.132 172.67.158.57 198.12.86.90 - [2606:4700:3030::6815:5284] [2606:4700:3037::ac43:9e39] adhitagency.shop @@ -14637,6 +14038,8 @@ vgadeal.com + + iuxxx.com tuusi.com messageme.life @@ -14653,7 +14056,6 @@ girlselfies.online dreamintim.com # R34US # https://github.com/AdguardTeam/FiltersRegistry/issues/654#issuecomment-2629098471 - 139.45.197.168 139.45.197.244 @@ -14661,7 +14063,6 @@ dreamintim.com - ajartoalsushy.com catilrecmemsi.com chusapsoarduwa.net @@ -14823,8 +14224,6 @@ whashop.xyz bestpartnerfinderonline.com 185.68.16.189 - - huntinginukraine.com gitlab.gitlab.gitlab.com gitlab.git.git.com @@ -14833,8 +14232,6 @@ git.git.git.git.com git.gitlab.gitlab.com 76.223.15.82 - - 10bestchina.com 123594.com 127453.com @@ -15588,18 +14985,15 @@ googleapis.info netnet33.net netnet44.net odintara.com - 54.174.156.141 - # Searched for Breaking Bad Jesse memes on Qwant (29/04/2025) old.sermitsiaq.ag xss.my.id - 85.159.213.158 - # Seemingly mass-generated fake "marketing company" sites that seem to serve no visible purpose (12/05/2025) + 23.170.252.196 23.229.68.43 23.229.68.44 @@ -15778,6 +15172,9 @@ xss.my.id + + + @@ -15811,21 +15208,17 @@ pdidp.com psaitchuzaubo.com rita0.com tshfc.com - 139.45.195.9 - # Other entries animeplaynow.com playanimenow.com datedate.today go.dealslandz.com awecrptjmp.com - 172.240.41.32 172.240.41.64 172.240.41.96 - # Spambot(s?) on R34X³ 24hdeepnude.com # gelbo²ruCOM @@ -15840,6 +15233,8 @@ debateobsoletesimply.com + + # bdsmx-pornCOM 6traitors.com baimgfroggd.site @@ -15903,6 +15298,7 @@ storewbhjkk.shop sunsandmoon.com trankosty.shop tubecup.org + 62.122.168.42 109.206.163.112 109.206.163.116 @@ -15933,6 +15329,9 @@ tubecup.org + + + biuqbiu.com bmgmb.com onclckbn.com @@ -15946,6 +15345,8 @@ zivroq.com + + 013d5342d9.com 03122e72f0.com 0551acf6ed.com @@ -16034,14 +15435,14 @@ maginp.com ntvpevnts.com selecttopon.com statelinear.com - 167.235.163.216 - [2a01:4f8:c0:2343::2] [2a01:4f8:e0:19cb::1] + + a3ion.com advertrek.com cant3am.com @@ -16090,10 +15491,8 @@ zlink3.com zlink9.com zlinkl.com zlinkv.com - 95.211.229.247 - # fetish2230•rssing•com agdosortione.com ashwayinvers.com @@ -16120,10 +15519,8 @@ uncilingalin.com undeciliste.com unrertivermalous.com wherdiapospir.com - 88.208.22.1 - # xmegadriveCOM adoredcount.com amused-condition.com @@ -16142,9 +15539,7 @@ reflectingproject.com repulsiveguarantee.com sotomistel.com unripereading.com - 188.72.219.35 - [2a00:1178:1:4b::e] @@ -16572,6 +15967,8 @@ zaepost.cfd + + # icepornCOM # https://www•drvhub•net/devices/network/asix/ax88178a-usb-2-0-to-gigabit-ethernet-adapter @@ -17054,6 +16451,7 @@ trk-pu.com trksp1.com trksp2.com trksp3.com + 157.90.33.79 173.239.53.20 178.63.248.53 @@ -17085,6 +16483,9 @@ trksp3.com + + + # ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— 0network.com 100conversions.com @@ -17276,6 +16677,7 @@ yodirecxl.com yolkclknu.com yolkdirxl.com zentrixads.com + 103.67.200.64 198.134.116.17 198.134.116.30 @@ -17284,6 +16686,9 @@ zentrixads.com + + + # Extreme amounts of PUP to a comical extent driverpack.io # https://github.com/DandelionSprout/adfilt/issues/1124 @@ -17386,8 +16791,6 @@ trmff.wpengine.com - - # https://github.com/AdguardTeam/AdguardFilters/issues/145513 @@ -17577,6 +16980,7 @@ woodburn.com.au xyz.cm yellowdragon.com # Parking services' IP addresses + 13.248.148.254 185.53.177.50 185.53.177.51 @@ -17599,6 +17003,9 @@ yellowdragon.com + + + # Bouncing hard-to-close (but admittedly empty) popups on NSFW sites like viperTO diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index d71574050..1471fc45f 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version) -# Version: 27November2025v1 +# Version: 07December2025v2 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Users of Pi-Hole FTL 5.22 and later can consider switching to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/refs/heads/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, due to an unconfirmed belief of mine that it allows better wildcarding than the Hosts and raw-domains versions. @@ -41,8 +41,6 @@ 127.0.0.1 spam404bl.com 127.0.0.1 109.201.135.46 - - 127.0.0.1 fredfiber.no 127.0.0.1 securemecca.com 127.0.0.1 1hos.cf @@ -80,8 +78,6 @@ 127.0.0.1 demo.ublock.org 127.0.0.1 138.68.252.54 - - 127.0.0.1 useragentswitch.com 127.0.0.1 dev-nano.com # Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. @@ -213,47 +209,11 @@ # ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— 127.0.0.1 ubuntu.org - -127.0.0.1 103.224.212.249 - - 127.0.0.1 speedtest.com 127.0.0.1 snapchat.cm 127.0.0.1 facebook.cm 127.0.0.1 wix.cm -127.0.0.1 199.59.243.222 - - - - -127.0.0.1 173.208.96.42 - - - -127.0.0.1 173.208.96.43 - - - -127.0.0.1 173.208.96.44 - - - -127.0.0.1 173.208.96.45 - - - -127.0.0.1 173.208.96.46 - - - -127.0.0.1 213.227.149.208 - - - -127.0.0.1 213.227.149.211 - - 127.0.0.1 ddscordapp.com 127.0.0.1 diicordapp.com 127.0.0.1 disccrdapp.com @@ -309,7 +269,26 @@ 127.0.0.1 githubuser.com 127.0.0.1 rgithub.com 127.0.0.1 githubt.com -# https://scammer•info/t/discord-nitro-scam-25/87887 + + + + + + + + + + + +127.0.0.1 173.208.96.42 +127.0.0.1 173.208.96.43 +127.0.0.1 173.208.96.44 +127.0.0.1 173.208.96.45 +127.0.0.1 173.208.96.46 +127.0.0.1 199.59.243.222 +127.0.0.1 213.227.149.208 +127.0.0.1 213.227.149.211 + # ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— 127.0.0.1 hippolyte-hag.com @@ -318,39 +297,37 @@ 127.0.0.1 paramonos-oha.com 127.0.0.1 photios-raj.com 127.0.0.1 zeroredirect5.com +127.0.0.1 roamingclicks.com -127.0.0.1 54.209.22.226 + + + -127.0.0.1 54.91.125.197 -127.0.0.1 52.202.53.245 -127.0.0.1 35.175.38.64 127.0.0.1 35.168.147.213 - - - -127.0.0.1 34.230.160.215 - - - -127.0.0.1 3.226.8.132 - - - +127.0.0.1 35.175.38.64 +127.0.0.1 144.76.0.242 +127.0.0.1 144.76.1.130 +127.0.0.1 195.201.92.254 127.0.0.1 3.216.243.46 +127.0.0.1 3.226.8.132 +127.0.0.1 34.230.160.215 +127.0.0.1 52.202.53.245 +127.0.0.1 54.209.22.226 +127.0.0.1 54.91.125.197 +127.0.0.1 94.130.185.237 +127.0.0.1 94.130.186.231 - -127.0.0.1 roamingclicks.com # Source: desidertNO 127.0.0.1 collectfasttracks.com # Various ex-affiliate links at www•zombooru•com @@ -363,26 +340,6 @@ 127.0.0.1 satcom1.co.uk 127.0.0.1 splitter.microxml.net -127.0.0.1 94.130.185.237 - - - -127.0.0.1 94.130.186.231 - - - -127.0.0.1 144.76.0.242 - - - -127.0.0.1 144.76.1.130 - - - -127.0.0.1 195.201.92.254 - - - # https://github.com/DandelionSprout/adfilt/pull/167 @@ -397,102 +354,6 @@ 127.0.0.1 newpage.in -127.0.0.1 34.204.214.165 - - - -127.0.0.1 54.85.113.62 - - - -127.0.0.1 54.205.83.61 - - - -127.0.0.1 54.210.193.115 - - - -127.0.0.1 banalbjar.com -127.0.0.1 coryljanty.cam -127.0.0.1 elfpetsic.com -127.0.0.1 postback.report -127.0.0.1 roksit.net -127.0.0.1 adblockerapp.com - -127.0.0.1 172.255.6.107 - - - -127.0.0.1 172.255.6.147 - - - -127.0.0.1 172.255.6.219 - - - -127.0.0.1 172.255.6.225 - - - -127.0.0.1 188.42.129.108 - - - -127.0.0.1 188.42.129.116 - - - -127.0.0.1 188.42.141.100 - - - -127.0.0.1 188.42.141.92 - - - -127.0.0.1 23.109.82.144 - - - -127.0.0.1 23.109.82.41 - - - -127.0.0.1 23.109.82.43 - - - -127.0.0.1 23.109.82.65 - - - -127.0.0.1 23.109.82.66 - - - -127.0.0.1 23.109.87.169 - - - -127.0.0.1 23.109.87.207 - - - -127.0.0.1 23.109.87.208 - - -127.0.0.1 blueoyster.click - -127.0.0.1 216.21.13.14 - - - -127.0.0.1 216.21.13.15 - - - 127.0.0.1 hafisague.com 127.0.0.1 iortnhooping.website @@ -508,9 +369,66 @@ 127.0.0.1 videoadblockers.com 127.0.0.1 videoadblockertou.com 127.0.0.1 videoadblockextension.com +127.0.0.1 adblockerapp.com +127.0.0.1 banalbjar.com +127.0.0.1 blueoyster.click +127.0.0.1 coryljanty.cam +127.0.0.1 elfpetsic.com +127.0.0.1 postback.report +127.0.0.1 roksit.net + + + + + + + + + + + + + + + + + + + + + + + + + + +127.0.0.1 172.255.6.107 +127.0.0.1 172.255.6.147 +127.0.0.1 172.255.6.219 +127.0.0.1 172.255.6.225 +127.0.0.1 188.42.129.108 +127.0.0.1 188.42.129.116 +127.0.0.1 188.42.141.100 +127.0.0.1 188.42.141.92 +127.0.0.1 216.21.13.14 +127.0.0.1 216.21.13.15 +127.0.0.1 23.109.82.144 +127.0.0.1 23.109.82.41 +127.0.0.1 23.109.82.43 +127.0.0.1 23.109.82.65 +127.0.0.1 23.109.82.66 +127.0.0.1 23.109.87.169 +127.0.0.1 23.109.87.207 +127.0.0.1 23.109.87.208 +127.0.0.1 34.204.214.165 +127.0.0.1 54.205.83.61 +127.0.0.1 54.210.193.115 +127.0.0.1 54.85.113.62 + + # https://github.com/DandelionSprout/adfilt/issues/942 127.0.0.1 abedwithdrawalautograph.com @@ -865,60 +783,54 @@ # https://github.com/AdguardTeam/AdguardFilters/issues/61743 # https://github.com/easylist/easylist/issues/6111 -127.0.0.1 fres-news.com -127.0.0.1 workerz-news.com -127.0.0.1 zredir.com -127.0.0.1 178.128.142.109 - - -127.0.0.1 findmedia.biz 127.0.0.1 backtonews.biz 127.0.0.1 bagclick.biz 127.0.0.1 bigkick.biz +127.0.0.1 findmedia.biz +127.0.0.1 fres-news.com 127.0.0.1 getcontent24.com -127.0.0.1 klickmode.biz -127.0.0.1 newsgate.biz -127.0.0.1 redmdeia.biz -127.0.0.1 uptodater.net -127.0.0.1 virnews.club - - -127.0.0.1 134.209.136.174 - - -127.0.0.1 whiteclick.biz 127.0.0.1 gonews2.com +127.0.0.1 hooligapps.com +127.0.0.1 klickmode.biz 127.0.0.1 mediadate.net 127.0.0.1 newscode.me +127.0.0.1 newsgate.biz +127.0.0.1 redmdeia.biz 127.0.0.1 skymedia7.me 127.0.0.1 startmode.biz 127.0.0.1 texterra.me +127.0.0.1 theonlygames.com +127.0.0.1 uptodater.net +127.0.0.1 virnews.club +127.0.0.1 whiteclick.biz +127.0.0.1 workerz-news.com +127.0.0.1 zredir.com + + + + + + + + +127.0.0.1 134.209.136.174 +127.0.0.1 178.128.142.109 +127.0.0.1 62.210.11.203 127.0.0.1 62.210.6.153 - - - 127.0.0.1 62.210.7.209 - - - 127.0.0.1 62.210.9.92 - - -127.0.0.1 62.210.11.203 - - -127.0.0.1 hooligapps.com -127.0.0.1 theonlygames.com # https://maldita•es/malditobulo/2020/12/04/concurso-mercadona-ganar-tarjeta-regalo-100-euros-phishing/ 127.0.0.1 notified-today.com 127.0.0.1 new-message.email -127.0.0.1 167.99.249.47 + +127.0.0.1 167.99.249.47 + # https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ # https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ 127.0.0.1 moderncomputer.net @@ -946,51 +858,38 @@ 127.0.0.1 0redirc.com 127.0.0.1 iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com + + + + + 127.0.0.1 5.8.34.26 - - - 127.0.0.1 5.8.47.3 - - - 127.0.0.1 103.224.182.251 - # https://github.com/DandelionSprout/adfilt/issues/193 127.0.0.1 holescontracting.com 127.0.0.1 doggroomingnews.com -127.0.0.1 5.79.71.205 -127.0.0.1 5.79.71.225 -127.0.0.1 85.17.31.82 -127.0.0.1 85.17.31.122 - 127.0.0.1 178.162.203.202 - - - 127.0.0.1 178.162.203.211 - - - 127.0.0.1 178.162.203.226 - - - 127.0.0.1 178.162.217.107 - +127.0.0.1 5.79.71.205 +127.0.0.1 5.79.71.225 +127.0.0.1 85.17.31.122 +127.0.0.1 85.17.31.82 # https://github.com/DandelionSprout/adfilt/issues/195 @@ -999,20 +898,16 @@ 127.0.0.1 secureportal.online 127.0.0.1 emiratenbduae.com -127.0.0.1 66.85.156.85 -127.0.0.1 66.85.156.86 127.0.0.1 108.170.31.123 - - - 127.0.0.1 108.170.52.156 - +127.0.0.1 66.85.156.85 +127.0.0.1 66.85.156.86 # https://github.com/DandelionSprout/adfilt/issues/198 # https://www•bleepingcomputer•com/virus-removal/ (18/06/2021) @@ -1064,16 +959,14 @@ 127.0.0.1 video-change.digital 127.0.0.1 watch-this.live -127.0.0.1 95.168.170.165 + + 127.0.0.1 213.227.145.147 - - - 127.0.0.1 213.227.149.216 - +127.0.0.1 95.168.170.165 # https://twitter•com/adamziaja/status/1252234957679808513 127.0.0.1 wow-robotics.xyz @@ -1085,16 +978,12 @@ 127.0.0.1 aleinvest.xyz 127.0.0.1 5.188.62.36 - - # https://github.com/DandelionSprout/adfilt/issues/223 127.0.0.1 speedupmypcfree.com # https://github.com/DandelionSprout/adfilt/issues/224 127.0.0.1 ssielearning.com 127.0.0.1 69.49.231.244 - - # https://movsb•0x0•st/users/mia 127.0.0.1 5starhdporn.com # https://github.com/DandelionSprout/adfilt/issues/228 @@ -1111,8 +1000,6 @@ 127.0.0.1 yzsnw.com 127.0.0.1 37.34.176.37 - - 127.0.0.1 pcspeedcat.com 127.0.0.1 auslogics.com # (https://github.com/DandelionSprout/adfilt/issues/1076) @@ -1129,32 +1016,24 @@ 127.0.0.1 temp74.com 127.0.0.1 trackwebclick.com + 127.0.0.1 23.111.31.137 - - - 127.0.0.1 23.111.88.207 - - # https://github.com/DandelionSprout/adfilt/issues/254 127.0.0.1 onesafesoftware.com # https://github.com/DandelionSprout/adfilt/issues/257 + + + + + + 127.0.0.1 185.158.250.239 - - - 127.0.0.1 192.169.69.25 - - - 127.0.0.1 212.192.241.72 - - - 127.0.0.1 37.0.10.83 - 127.0.0.1 lucdream.com 127.0.0.1 pesoaniz.com 127.0.0.1 artofads.co @@ -1168,8 +1047,6 @@ # https://safeweb•norton•com/report/show?url=192•3•110•170 127.0.0.1 192.3.110.170 - - # https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ 127.0.0.1 socialsearchconverter.com 127.0.0.1 install.socialsearchconverter.com @@ -1196,8 +1073,6 @@ # https://www•virustotal•com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection 127.0.0.1 91.241.19.38 - - # https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection # https://safeweb•norton•com/report/show?url=telete•in # https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -1209,80 +1084,52 @@ # https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection 127.0.0.1 45.90.58.90 - - # https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community # https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection 127.0.0.1 95.85.89.98 - - # https://github.com/DandelionSprout/adfilt/issues/267 # https://github.com/DandelionSprout/adfilt/pull/278 # https://www.virustotal.com/gui/file/da75c85fe037f9ff9ebbbd0b37dd2ff154f5e70a0dc6870286e0d3df6b8f246f/community 127.0.0.1 139.28.37.49 - - # https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community - 127.0.0.1 35.194.188.37 - # https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community # https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community 127.0.0.1 91.243.121.19 - - # https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community 127.0.0.1 103.169.90.205 - - # https://github.com/DandelionSprout/adfilt/pull/281 # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + + + + + + + 127.0.0.1 125.44.43.45 - - - 127.0.0.1 182.121.8.240 - - - 127.0.0.1 42.235.183.74 - - - 127.0.0.1 78.36.32.242 - - - 127.0.0.1 115.50.2.119 - - - 127.0.0.1 115.50.110.163 - - - 127.0.0.1 119.179.84.145 - - - 127.0.0.1 188.120.50.98 - - - 127.0.0.1 190.238.183.5 - - - 127.0.0.1 27.220.253.78 - # https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community 127.0.0.1 esetnode32-antiviru.ydns.eu # https://www•joesandbox•com/analysis/486636/0/html#domains @@ -1290,8 +1137,6 @@ # Relations to the original domain 127.0.0.1 192.3.194.242 - - 127.0.0.1 w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu 127.0.0.1 hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu 127.0.0.1 avira-antivirus.ydns.eu @@ -1329,227 +1174,127 @@ # https://github.com/DandelionSprout/adfilt/commit/f7f114945c83b339be5cdd848e229680d9918abb#commitcomment-57642875 127.0.0.1 23.94.26.138 - - # https://github.com/DandelionSprout/adfilt/pull/298 # https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community 127.0.0.1 205.185.126.200 - - # https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community 127.0.0.1 185.243.56.167 - - # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -127.0.0.1 123.10.224.135 -127.0.0.1 59.47.187.147 -127.0.0.1 39.68.172.210 -127.0.0.1 122.192.177.176 -127.0.0.1 112.27.124.108 -127.0.0.1 123.110.176.246 -127.0.0.1 219.155.105.98 -127.0.0.1 171.35.161.209 -127.0.0.1 60.16.255.36 -127.0.0.1 112.30.4.52 -127.0.0.1 182.121.191.201 -127.0.0.1 121.61.48.170 -127.0.0.1 39.81.68.45 -127.0.0.1 27.222.220.164 -127.0.0.1 113.233.215.135 -127.0.0.1 151.77.100.133 -127.0.0.1 125.120.13.184 - - - -127.0.0.1 120.12.138.133 - - - -127.0.0.1 27.194.115.185 - - 127.0.0.1 104.128.199.228 - - - -127.0.0.1 183.92.123.145 - - - -127.0.0.1 110.89.8.126 - - - -127.0.0.1 125.43.211.184 - - - -127.0.0.1 1.0.218.230 - - - -127.0.0.1 221.208.4.56 - - - -127.0.0.1 60.13.60.19 - - - -127.0.0.1 171.37.29.87 - - - -127.0.0.1 124.91.237.188 - - - -127.0.0.1 115.56.137.49 - - - -127.0.0.1 115.52.240.69 - - - -127.0.0.1 112.252.132.185 - - - -127.0.0.1 117.198.240.157 - - - +127.0.0.1 27.194.115.185 +127.0.0.1 27.222.220.164 +127.0.0.1 39.68.172.210 +127.0.0.1 39.81.68.45 127.0.0.1 42.53.240.249 - - - -127.0.0.1 116.179.138.68 - - - -127.0.0.1 110.241.119.159 - - - -127.0.0.1 115.56.31.133 - - - -127.0.0.1 103.19.128.222 - - - -127.0.0.1 202.12.80.74 - - - +127.0.0.1 59.47.187.147 +127.0.0.1 60.13.60.19 +127.0.0.1 60.16.255.36 127.0.0.1 61.52.8.62 - - - -127.0.0.1 182.122.252.69 - - - -127.0.0.1 219.155.26.50 - - - -127.0.0.1 120.4.141.185 - - - -127.0.0.1 119.102.7.115 - - - 127.0.0.1 72.51.127.213 - - - +127.0.0.1 1.0.218.230 +127.0.0.1 103.19.128.222 +127.0.0.1 110.241.119.159 +127.0.0.1 110.89.8.126 127.0.0.1 111.224.199.91 - - - -127.0.0.1 119.250.236.122 - - - +127.0.0.1 112.252.132.185 +127.0.0.1 112.27.124.108 127.0.0.1 112.30.110.58 - +127.0.0.1 112.30.4.52 +127.0.0.1 113.233.215.135 +127.0.0.1 115.52.240.69 +127.0.0.1 115.56.137.49 +127.0.0.1 115.56.31.133 +127.0.0.1 116.179.138.68 +127.0.0.1 117.198.240.157 +127.0.0.1 119.102.7.115 +127.0.0.1 119.250.236.122 +127.0.0.1 120.12.138.133 +127.0.0.1 120.4.141.185 +127.0.0.1 121.61.48.170 +127.0.0.1 122.192.177.176 +127.0.0.1 123.10.224.135 +127.0.0.1 123.110.176.246 +127.0.0.1 124.91.237.188 +127.0.0.1 125.120.13.184 +127.0.0.1 125.43.211.184 +127.0.0.1 151.77.100.133 +127.0.0.1 171.35.161.209 +127.0.0.1 171.37.29.87 +127.0.0.1 182.121.191.201 +127.0.0.1 182.122.252.69 +127.0.0.1 183.92.123.145 +127.0.0.1 202.12.80.74 +127.0.0.1 219.155.105.98 +127.0.0.1 219.155.26.50 +127.0.0.1 221.208.4.56 # https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community 127.0.0.1 pcae.de # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + 127.0.0.1 117.196.49.21 - - - 127.0.0.1 115.55.54.234 - - - 127.0.0.1 115.52.17.123 - - - 127.0.0.1 182.59.69.21 - # https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community 127.0.0.1 chip-secured-download.de # https://www•virustotal•com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb @@ -1571,8 +1316,6 @@ # https://www•virustotal•com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations 127.0.0.1 160.202.163.100 - - # https://www•virustotal•com/gui/ip-address/160•202•163•100/relations 127.0.0.1 microsoftkernel.com 127.0.0.1 microsofthk.com @@ -1586,18 +1329,12 @@ # https://www•virustotal•com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community 127.0.0.1 45.95.169.115 - - # https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community 127.0.0.1 45.148.120.80 - - # https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community 127.0.0.1 85.239.33.9 - - # Relations to the domain above 127.0.0.1 adminsys.serveftp.com 127.0.0.1 amazbaidu.serveftp.com @@ -1616,13 +1353,9 @@ # https://www•virustotal•com/gui/file/8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0/community 127.0.0.1 107.173.176.183 - - # https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community 127.0.0.1 45.148.120.171 - - # https://twitter•com/soranker0/status/1449491402409185283 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-950330114 @@ -1632,8 +1365,6 @@ # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-951321929 127.0.0.1 159.148.186.228 - - # https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains 127.0.0.1 yotube.com 127.0.0.1 security-scanner.xyz @@ -1652,166 +1383,98 @@ # https://github.com/DandelionSprout/adfilt/pull/348 # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -127.0.0.1 39.83.80.247 -127.0.0.1 68.197.33.124 -127.0.0.1 219.157.21.37 -127.0.0.1 182.123.141.17 -127.0.0.1 125.47.243.187 -127.0.0.1 182.122.196.203 -127.0.0.1 182.117.231.182 -127.0.0.1 112.31.211.135 -127.0.0.1 125.106.63.93 -127.0.0.1 115.59.197.46 -127.0.0.1 122.159.29.192 - - - -127.0.0.1 171.40.0.127 - - - -127.0.0.1 171.80.219.160 - - - -127.0.0.1 123.10.65.201 - - - -127.0.0.1 168.90.205.46 - - - -127.0.0.1 125.47.205.109 - - - -127.0.0.1 39.80.147.239 - - - -127.0.0.1 45.224.171.130 - - - -127.0.0.1 45.5.209.75 - - - -127.0.0.1 116.17.210.157 - - - -127.0.0.1 27.45.103.240 - - - -127.0.0.1 110.167.64.171 - - - -127.0.0.1 39.81.117.73 - - - -127.0.0.1 183.15.90.156 - - - -127.0.0.1 119.113.248.74 - - - -127.0.0.1 175.0.95.85 - - - -127.0.0.1 61.52.99.109 - - - -127.0.0.1 222.142.183.194 - - - -127.0.0.1 106.86.172.194 127.0.0.1 103.233.216.77 - - - +127.0.0.1 106.86.172.194 +127.0.0.1 110.167.64.171 +127.0.0.1 112.31.211.135 +127.0.0.1 115.59.197.46 +127.0.0.1 116.17.210.157 +127.0.0.1 119.113.248.74 +127.0.0.1 122.159.29.192 +127.0.0.1 123.10.65.201 +127.0.0.1 125.106.63.93 +127.0.0.1 125.47.205.109 +127.0.0.1 125.47.243.187 +127.0.0.1 168.90.205.46 +127.0.0.1 171.40.0.127 +127.0.0.1 171.80.219.160 +127.0.0.1 175.0.95.85 +127.0.0.1 182.117.231.182 +127.0.0.1 182.122.196.203 +127.0.0.1 182.123.141.17 +127.0.0.1 183.15.90.156 127.0.0.1 183.188.192.55 - +127.0.0.1 219.157.21.37 +127.0.0.1 222.142.183.194 +127.0.0.1 27.45.103.240 +127.0.0.1 39.80.147.239 +127.0.0.1 39.81.117.73 +127.0.0.1 39.83.80.247 +127.0.0.1 45.224.171.130 +127.0.0.1 45.5.209.75 +127.0.0.1 61.52.99.109 +127.0.0.1 68.197.33.124 # https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community 127.0.0.1 198.23.255.14 - - # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971512075 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971495248 # https://github.com/iam-py-test/investigations/blob/main/2021/11/15/1.md#iocs 127.0.0.1 trumops.com 127.0.0.1 runmodes.com + 127.0.0.1 91.121.67.60 - - - 127.0.0.1 172.67.186.189 - - # https://scammer•info/t/mcafee-phish/83725 127.0.0.1 securefirst.us-east-1.linodeobjects.com # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + 127.0.0.1 39.65.72.211 - - - 127.0.0.1 42.238.151.197 - - - 127.0.0.1 27.213.60.53 - - - 127.0.0.1 115.56.169.134 - # https://github.com/iam-py-test/investigations/blob/main/2021/11/21/1.md 127.0.0.1 yasir252.com 127.0.0.1 safelink.kadal.club @@ -1825,13 +1488,9 @@ # https://www•virustotal•com/gui/file/2b2628a50d3b39b0fa2395d487bf62b00e37cdae847ff76ee58399bbe4e9f7b3/community 127.0.0.1 194.87.138.20 - - # https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community 127.0.0.1 103.167.92.73 - - # https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community 127.0.0.1 bursakulis.com # https://www•virustotal•com/gui/url/b333c49efa4d399e65c5e2d96a905b380acbca58a3e3052b7bd7cfcb3e0e81ee @@ -1854,37 +1513,25 @@ # https://github.com/uBlockOrigin/uAssets/pull/10620 # https://www•virustotal•com/gui/file/d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8/community + + + + + + + + + + 127.0.0.1 58.249.74.79 - - - 127.0.0.1 27.45.14.109 - - - 127.0.0.1 27.40.101.191 - - - 127.0.0.1 27.45.119.22 - - - 127.0.0.1 27.47.73.159 - - - 127.0.0.1 115.204.119.237 - - - 127.0.0.1 163.125.31.46 - - - 127.0.0.1 163.179.168.44 - # https://github.com/uBlockOrigin/uAssets/pull/10647 # https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md 127.0.0.1 money-mod.com @@ -1898,49 +1545,31 @@ # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community + + + + + + + + + + + + + 127.0.0.1 110.89.59.135 - - - 127.0.0.1 113.116.89.1 - - - 127.0.0.1 119.183.146.191 - - - 127.0.0.1 153.3.3.226 - - - 127.0.0.1 182.116.104.6 - - - 127.0.0.1 60.7.133.200 - - - 127.0.0.1 122.6.254.201 - - - 127.0.0.1 110.89.11.167 - - - 127.0.0.1 171.112.177.90 - - - 127.0.0.1 115.194.38.143 - - - 127.0.0.1 61.52.79.32 - # https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 # https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 @@ -1959,8 +1588,6 @@ 127.0.0.1 132.148.220.142 - - # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 127.0.0.1 chess-progress.ru # https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 @@ -1978,55 +1605,37 @@ # https://github.com/iam-py-test/investigations/blob/main/2021/12/13/1.md 127.0.0.1 haxpc.net + 127.0.0.1 52.53.243.52 - - - 127.0.0.1 34.201.22.10 - - # https://scammer•info/t/crypto-scammers-onceagain/85354 # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community + + + + + + + + + + 127.0.0.1 123.10.225.196 - - - 127.0.0.1 122.192.106.84 - - - 127.0.0.1 172.88.199.9 - - - 127.0.0.1 114.38.176.185 - - - 127.0.0.1 61.52.97.35 - - - 127.0.0.1 27.206.181.208 - - - 127.0.0.1 124.163.130.175 - - - 127.0.0.1 118.75.87.102 - # https://github.com/iam-py-test/investigations/blob/main/2021/12/14/1.md # https://github.com/DevSpen/links/pull/3 # https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ 127.0.0.1 134.122.115.190 - - 127.0.0.1 cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com # https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777 127.0.0.1 viewty.xyz @@ -2045,8 +1654,6 @@ 127.0.0.1 ru.com 127.0.0.1 141.8.226.34 - - # https://github.com/AdguardTeam/AdguardFilters/issues/108571 127.0.0.1 ston-app.com # fake human verification scam @@ -2060,8 +1667,6 @@ # https://www•virustotal•com/gui/file/9d40ae0439ddc594b2cf64e21ad0fdea9bb440524298e3a6bcfcc1fb417f1ed2/relations 127.0.0.1 91.240.118.172 - - # "Press Allow to continue" 127.0.0.1 kuyhaa-mee.com 127.0.0.1 upload-4ever.com @@ -2090,8 +1695,6 @@ 127.0.0.1 top3hostngc.xyz 127.0.0.1 198.199.120.251 - - # https://www•telia•no/kundeservice/mobil/malware-flubot-android/ @@ -2101,37 +1704,27 @@ 127.0.0.1 findsolemate.life 127.0.0.1 dating-galaxy.life + 127.0.0.1 195.201.253.130 - - - 127.0.0.1 195.201.253.131 - - # The bottom download button on https://www•sushichop•com/ 127.0.0.1 installiq.com 127.0.0.1 cpmverdirect.com + + + + + + + 127.0.0.1 15.197.244.48 - - - 127.0.0.1 96.47.230.67 - - - 127.0.0.1 96.47.230.68 - - - 127.0.0.1 96.47.230.69 - - - 127.0.0.1 96.47.230.70 - # https://securitytrails•com/list/ns/ns1•fastthinkingdns•com 127.0.0.1 highercaptcha-settle.com 127.0.0.1 highercaptchasettle.com @@ -2139,6 +1732,8 @@ + + # https://github.com/AdguardTeam/AdguardFilters/issues/121544 127.0.0.1 trafredirtds.com @@ -2153,8 +1748,6 @@ 127.0.0.1 uuidtsinc.net 127.0.0.1 31.220.27.134 - - # https://github.com/AdguardTeam/AdguardFilters/issues/122757 # https://github.com/AdguardTeam/AdguardFilters/issues/123544 @@ -2284,22 +1877,16 @@ + + + 127.0.0.1 85.17.31.152 - - - 127.0.0.1 95.211.26.202 - - # https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 + 127.0.0.1 158.247.212.220 - - - 127.0.0.1 165.227.168.212 - - # https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ # https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 @@ -2307,8 +1894,6 @@ 127.0.0.1 garbiaes.com 127.0.0.1 23.81.64.183 - - # https://github.com/AdguardTeam/AdguardFilters/issues/125300 127.0.0.1 inmewa.com 127.0.0.1 omshellderom.com @@ -2325,8 +1910,6 @@ 127.0.0.1 vekeltaizy.net 127.0.0.1 139.45.197.236 - - # https://github.com/AdguardTeam/AdguardFilters/issues/128029 127.0.0.1 becovi.com 127.0.0.1 becovi.co.uk @@ -2343,17 +1926,15 @@ 127.0.0.1 potestainsula.com 127.0.0.1 motherpipe.net + + + + + 127.0.0.1 51.91.66.125 - - - 127.0.0.1 51.178.76.105 - - - 127.0.0.1 147.135.253.55 - # https://github.com/uBlockOrigin/uAssets/issues/14569 → https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection (https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) # https://github.com/AdguardTeam/AdguardFilters/issues/129414 @@ -2362,13 +1943,9 @@ # https://github.com/AdguardTeam/AdguardFilters/issues/131156 + 127.0.0.1 146.19.169.98 - - - 127.0.0.1 146.19.169.99 - - # https://github.com/AdguardTeam/AdguardFilters/issues/132079 # https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -3883,16 +3460,12 @@ 127.0.0.1 2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com 127.0.0.1 69.162.80.56 - - # https://github.com/AdguardTeam/AdguardFilters/issues/134903 # Random Discord servers 127.0.0.1 giveawaycord.com 127.0.0.1 162.241.124.200 - - # https://github.com/AdguardTeam/AdguardFilters/issues/135815 127.0.0.1 adsstar.in 127.0.0.1 clickcafe.in @@ -3906,8 +3479,6 @@ 127.0.0.1 webhostingtips.club 127.0.0.1 157.90.71.190 - - # https://github.com/AdguardTeam/AdguardFilters/issues/135924 127.0.0.1 beskittyan.com 127.0.0.1 cadbitff.com @@ -3925,8 +3496,6 @@ 127.0.0.1 wumpeeps.net 127.0.0.1 139.45.197.239 - - # https://github.com/AdguardTeam/AdguardFilters/issues/136390 127.0.0.1 glthub.com # https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -3948,17 +3517,15 @@ 127.0.0.1 vayamuegn.icu 127.0.0.1 wehiqes.xyz + + + + + 127.0.0.1 44.228.230.225 - - - 127.0.0.1 50.112.124.170 - - - 127.0.0.1 100.20.104.229 - # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread 127.0.0.1 link.sv 127.0.0.1 4.fo @@ -3969,27 +3536,21 @@ 127.0.0.1 pressizer.net 127.0.0.1 sapino.net + + + + + + 127.0.0.1 44.236.213.34 - - - 127.0.0.1 52.24.156.12 - - - 127.0.0.1 52.25.6.134 - - - 127.0.0.1 100.20.13.49 - # https://github.com/AdguardTeam/AdguardFilters/issues/139667 127.0.0.1 goldmesoil.live 127.0.0.1 51.68.87.229 - - # https://github.com/DandelionSprout/adfilt/issues/747 127.0.0.1 2022crucialcatch.store 127.0.0.1 adidascostarica.com @@ -4397,6 +3958,8 @@ + + # https://www•bleepingcomputer•com/news/security/hackers-push-malware-via-google-search-ads-for-vlc-7-zip-ccleaner/ @@ -4411,17 +3974,15 @@ 127.0.0.1 studio-obs.com 127.0.0.1 webull-download.com + + + + + 127.0.0.1 185.106.94.139 - - - 127.0.0.1 45.90.109.196 - - - 127.0.0.1 91.229.23.200 - # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1401711872 # https://github.com/AdguardTeam/AdguardFilters/issues/144514 127.0.0.1 bonusgift.life @@ -4437,18 +3998,12 @@ 127.0.0.1 winearth.life 127.0.0.1 winpulse.life + 127.0.0.1 185.155.184.98 - - - 127.0.0.1 194.110.247.242 - - # https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ 127.0.0.1 54.219.218.169 - - # https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ 127.0.0.1 0365alert.com 127.0.0.1 0365online.com @@ -4855,15 +4410,11 @@ 127.0.0.1 yourorderupdate.com 127.0.0.1 64.132.201.92 - - # https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener 127.0.0.1 jatvpn.softether.net 127.0.0.1 jatcraft.com 127.0.0.1 209.141.51.49 - - 127.0.0.1 post-norway.web.app # https://github.com/AdguardTeam/AdguardFilters/issues/142955 127.0.0.1 arquilavaan.com @@ -4932,17 +4483,15 @@ 127.0.0.1 wooden-comfort.com # Unsuited for wildcarding + + + + + 127.0.0.1 208.88.225.116 - - - 127.0.0.1 208.88.225.117 - - - 127.0.0.1 208.88.225.119 - # https://github.com/AdguardTeam/AdguardFilters/issues/144823 @@ -4985,25 +4534,19 @@ 127.0.0.1 lakeside-fishandchips.com 127.0.0.1 office-view.com + + + + + + + 127.0.0.1 108.61.242.65 - - - 127.0.0.1 146.70.78.43 - - - 127.0.0.1 87.120.254.39 - - - 127.0.0.1 45.150.108.213 - - - 127.0.0.1 92.204.160.240 - # https://github.com/AdguardTeam/AdguardFilters/issues/148560 # Comments on Slack @@ -5267,25 +4810,19 @@ 127.0.0.1 zirze151uk5d.com 127.0.0.1 zxvjn4igweb9.com + + + + + + + 127.0.0.1 185.246.188.124 - - - 127.0.0.1 185.246.188.125 - - - 127.0.0.1 194.63.140.103 - - - 127.0.0.1 194.63.143.61 - - - 127.0.0.1 194.63.143.96 - # https://github.com/AdguardTeam/AdguardFilters/issues/152945 127.0.0.1 moneystartup.live @@ -5362,28 +4899,20 @@ 127.0.0.1 zorka-news.com 127.0.0.1 37.48.80.112 - - # Slack comments 127.0.0.1 cojcdn.net 127.0.0.1 redic3.com 127.0.0.1 totadblock.com + 127.0.0.1 109.206.168.16 - - - 127.0.0.1 109.206.168.17 - - # https://github.com/AdguardTeam/AdguardFilters/issues/155298 127.0.0.1 cadstoppam.live 127.0.0.1 paidsuenut.live 127.0.0.1 57.128.71.215 - - # https://github.com/AdguardTeam/AdguardFilters/issues/155936 127.0.0.1 rumadel.com @@ -5510,6 +5039,9 @@ + + + 127.0.0.1 139.45.197.167 127.0.0.1 139.45.197.245 127.0.0.1 159.223.137.164 @@ -5531,6 +5063,9 @@ + + + # https://github.com/AdguardTeam/AdguardFilters/issues/157308 127.0.0.1 dest.co.in 127.0.0.1 dkeie.co.in @@ -5707,18 +5242,16 @@ 127.0.0.1 wellnessfortune.net 127.0.0.1 ztomy.com + + + + + 127.0.0.1 5.45.123.44 - - - 127.0.0.1 69.16.230.226 - - - 127.0.0.1 208.91.196.46 - # https://github.com/AdguardTeam/AdguardFilters/issues/158316 127.0.0.1 abberantbeefy.com 127.0.0.1 abominableexhibition.com @@ -6387,8 +5920,6 @@ 127.0.0.1 93.93.51.223 - - # https://github.com/AdguardTeam/AdguardFilters/issues/161364 # (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) @@ -6426,8 +5957,6 @@ 127.0.0.1 reschedule-delivery.ups.com.com 127.0.0.1 103.174.102.240 - - # https://github.com/libre-tube/LibreTube/issues/4409 127.0.0.1 libretube.net # https://github.com/RPiList/specials/issues/1353 @@ -6519,8 +6048,6 @@ # https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7873648 127.0.0.1 38.180.96.244 - - # https://github.com/AdguardTeam/AdguardFilters/issues/172569 127.0.0.1 acareewityjh.com 127.0.0.1 accedenonre.xyz @@ -6641,14 +6168,10 @@ 127.0.0.1 withmefeyauknaly.com 127.0.0.1 wukbgater.buzz + 127.0.0.1 34.195.224.242 - - - 127.0.0.1 54.225.185.110 - - 127.0.0.1 githubtalentcommunity.com # https://github.com/AdguardTeam/AdguardFilters/issues/173925 127.0.0.1 sweedbank-help.com @@ -6657,8 +6180,6 @@ 127.0.0.1 pochta-ru.com 127.0.0.1 91.202.233.143 - - # Based on a tip from my secretary 127.0.0.1 advancedwalletpay.com 127.0.0.1 amberzextracts.com @@ -6756,8 +6277,6 @@ 127.0.0.1 systemnetworkroute.com 127.0.0.1 108.62.157.10 - - # https://github.com/AdguardTeam/FiltersRegistry/issues/925 # https://github.com/AdguardTeam/FiltersRegistry/pull/927 127.0.0.1 avito.avito.avito.com @@ -6772,45 +6291,29 @@ # https://github.com/AdguardTeam/AdguardFilters/issues/179170 + + + + + + + + + + + + 127.0.0.1 172.240.108.68 - - - 127.0.0.1 172.240.108.76 - - - 127.0.0.1 172.240.108.84 - - - 127.0.0.1 172.240.127.234 - - - 127.0.0.1 172.240.253.132 - - - 127.0.0.1 192.243.59.12 - - - 127.0.0.1 192.243.59.13 - - - 127.0.0.1 192.243.59.20 - - - 127.0.0.1 192.243.61.225 - - - 127.0.0.1 192.243.61.227 - 127.0.0.1 abberantextending.com 127.0.0.1 abdicatehorrified.com 127.0.0.1 abjectpreludeparity.com @@ -7689,18 +7192,16 @@ 127.0.0.1 yourchoicehealthplan.com 127.0.0.1 zymstr.com + + + + + + 127.0.0.1 185.149.120.161 - - - 127.0.0.1 185.149.120.163 - - - - 127.0.0.1 185.149.120.175 - # https://github.com/AdguardTeam/AdguardFilters/issues/184671 127.0.0.1 alatterapistroke.com 127.0.0.1 astrarestaurant.com @@ -7747,81 +7248,49 @@ 127.0.0.1 upsbezahlung.com 127.0.0.1 vius-inf.com 127.0.0.1 vrsecurego.com + + + + + + + + + + + + + + + + + + + + 127.0.0.1 45.202.32.3 - - - 127.0.0.1 45.8.92.138 - - - 127.0.0.1 79.133.46.252 - - - 127.0.0.1 82.147.85.156 - - - 127.0.0.1 91.212.166.16 - - - 127.0.0.1 94.156.64.129 - - - 127.0.0.1 94.232.249.61 - - - 127.0.0.1 94.232.249.69 - - - 127.0.0.1 94.232.249.75 - - - 127.0.0.1 94.232.249.235 - - - 127.0.0.1 176.111.174.118 - - - 127.0.0.1 176.113.115.191 - - - 127.0.0.1 191.96.224.140 - - - 127.0.0.1 193.124.185.42 - - - 127.0.0.1 193.143.1.45 - - - 127.0.0.1 193.143.1.214 - - - 127.0.0.1 193.143.1.217 - - - 127.0.0.1 208.91.189.203 - # https://github.com/AdguardTeam/AdguardFilters/issues/189905 # https://github.com/AdguardTeam/AdguardFilters/issues/196657 @@ -12229,8 +11698,6 @@ 127.0.0.1 yuxc.xyz 127.0.0.1 103.155.214.207 - - # Inspired by https://github.com/AdguardTeam/AdguardFilters/issues/197908 127.0.0.1 app-update.site 127.0.0.1 appupdate.net @@ -12240,15 +11707,11 @@ 127.0.0.1 prihlasit-secure-auth.com 127.0.0.1 185.196.9.214 - - 127.0.0.1 chrome.webredirect.org 127.0.0.1 captcha.webredirect.org 127.0.0.1 185.196.9.222 - - # https://github.com/AdguardTeam/AdguardFilters/issues/201064 127.0.0.1 100urls.com 127.0.0.1 17lc.cc @@ -12697,6 +12160,8 @@ + + # https://github.com/AdguardTeam/AdguardFilters/issues/202010 # Various other reports @@ -12771,6 +12236,8 @@ + + 127.0.0.1 abcradilytor.com 127.0.0.1 abmagbychan.com 127.0.0.1 agatorkoaltor.com @@ -12888,10 +12355,8 @@ 127.0.0.1 wsbuckon.com 127.0.0.1 zacmoageeshee.net 127.0.0.1 zucoagorsout.com - 127.0.0.1 139.45.197.106 - # https://github.com/DandelionSprout/adfilt/issues/1129 127.0.0.1 password-internal.com # Though not _inherently_ malware, at least 1 spambot on this repo had direct ties to that site @@ -13097,10 +12562,8 @@ 127.0.0.1 xxx-telegram.com 127.0.0.1 zc-telegran.org 127.0.0.1 zzz-telegram.com - 127.0.0.1 43.128.142.70 - # https://github.com/AdguardTeam/AdguardFilters/issues/20787[2-5] 127.0.0.1 chceshi001.com 127.0.0.1 gametime.fyi @@ -13256,6 +12719,8 @@ + + # https://github.com/DandelionSprout/adfilt/issues/1164 127.0.0.1 device-checking.com 127.0.0.1 device-cleanup.com @@ -13265,10 +12730,8 @@ 127.0.0.1 system-noticers.com 127.0.0.1 systemsnotifications.com 127.0.0.1 warningnotification.com - 127.0.0.1 46.101.81.149 - 127.0.0.1 adaptationfirework.com 127.0.0.1 armourbreederleadership.com 127.0.0.1 bleachinjectionuncommon.com @@ -13312,15 +12775,11 @@ 127.0.0.1 unesmunbrebers.com 127.0.0.1 filinnetirt.com 127.0.0.1 freshsubz.com - 127.0.0.1 52.15.34.25 - # https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware - 127.0.0.1 203.188.171.156 - # https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md 127.0.0.1 soft-gets.com 127.0.0.1 reaitek.com @@ -13583,6 +13042,7 @@ 127.0.0.1 workspace-drive.com 127.0.0.1 xtrash-tarck.com 127.0.0.1 your-package-delivery.com + 127.0.0.1 158.94.209.86 127.0.0.1 158.94.209.87 127.0.0.1 158.94.209.88 @@ -13595,11 +13055,30 @@ + + + # https://urlscan.io/result/019a4ffd-885c-7545-816a-3c121d8bdc0d/ (Early November 2025) # https://github.com/DandelionSprout/adfilt/issues/1197 127.0.0.1 creations.tools 127.0.0.1 idtsoftware.com +# https://github.com/DandelionSprout/adfilt/issues/1212 +127.0.0.1 acrossprotocols.com +127.0.0.1 aftop10.com +127.0.0.1 directory-opus-manager.github.io +127.0.0.1 dokopka.icu +127.0.0.1 dramajaratstate.com +127.0.0.1 heygetbarter.com +127.0.0.1 michaelborsari.com +127.0.0.1 softs-window.com +127.0.0.1 sublime-merge-git-client.github.io +127.0.0.1 sublime-text-3.github.io +127.0.0.1 welearnn.com +127.0.0.1 94.156.232.201 +127.0.0.1 213.209.143.119 + + # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -13933,18 +13412,14 @@ 127.0.0.1 csgocup.ru 127.0.0.1 eslpro.ru 127.0.0.1 market-csgo.ru - 127.0.0.1 194.226.139.121 127.0.0.1 194.226.139.7 127.0.0.1 95.181.157.36 - 127.0.0.1 95.181.172.204 - - # AS209813 (https://github.com/AdguardTeam/AdguardFilters/issues/114618#issuecomment-1100702530; currently specific to tools that support CIDR blocking) @@ -14039,8 +13514,6 @@ 127.0.0.1 medication.coupons 127.0.0.1 147.135.16.27 - - # https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img 127.0.0.1 ingeniovirtual.com # https://scambiofigu•forumcommunity•net/?t=57482915 @@ -14050,8 +13523,6 @@ 127.0.0.1 185.87.148.199 - - # Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) @@ -14064,8 +13535,6 @@ 127.0.0.1 45.136.49.35 - - # Browsing around for Tajik newssites 127.0.0.1 etarefcity.live 127.0.0.1 yepsimmen.live @@ -14076,33 +13545,25 @@ 127.0.0.1 backshyoh.live 127.0.0.1 cityratetod.live + + + + + + + 127.0.0.1 51.91.211.94 - - - 127.0.0.1 162.19.71.16 - - - 127.0.0.1 146.59.240.191 - - - 127.0.0.1 54.37.5.34 - - - 127.0.0.1 54.36.118.105 - # Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt 127.0.0.1 highlandnews.com 127.0.0.1 pcbasicstrength.com 127.0.0.1 leantime.bigfi.re 127.0.0.1 159.89.10.102 - - # Other 127.0.0.1 pksauniversity.com 127.0.0.1 sharedmega.com @@ -14115,10 +13576,8 @@ 127.0.0.1 thotsbay-leaked.com 127.0.0.1 cbox.ws 127.0.0.1 inuseme.com - 127.0.0.1 104.206.252.90 - # https://github.com/blocklistproject/Lists/issues/933 127.0.0.1 jNKmS0zFuEh.click # https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2 @@ -14133,8 +13592,6 @@ # Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) 127.0.0.1 34.80.59.191 - - # Various domains on https://securitytrails•com/list/ip/72•14•178•174 @@ -14143,53 +13600,33 @@ 127.0.0.1 kusubooru.com 127.0.0.1 wh40kart.im + + + + + + + + + + + + + + 127.0.0.1 45.33.2.79 - - - 127.0.0.1 45.33.18.44 - - - 127.0.0.1 45.33.20.235 - - - 127.0.0.1 45.33.23.183 - - - 127.0.0.1 45.33.30.197 - - - 127.0.0.1 45.56.79.23 - - - 127.0.0.1 45.79.19.196 - - - 127.0.0.1 72.14.178.174 - - - 127.0.0.1 72.14.185.43 - - - 127.0.0.1 96.126.123.244 - - - 127.0.0.1 173.255.194.134 - - - 127.0.0.1 198.58.118.167 - # https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ 127.0.0.1 1337links.net 127.0.0.1 777offers.net @@ -14288,29 +13725,21 @@ 127.0.0.1 ym3trk.com 127.0.0.1 youwanthis.com + + + + + + + + 127.0.0.1 34.117.199.78 - - - 127.0.0.1 94.237.103.119 - - - 127.0.0.1 94.237.84.54 - - - 127.0.0.1 94.237.93.242 - - - 127.0.0.1 94.237.99.118 - - - 127.0.0.1 139.45.197.249 - # https://dnpedia•com/tlds/topm•php bizarrely listing "anahitagirted•uno" as the 622th most visited domain worldwide 127.0.0.1 anahitagirted.uno 127.0.0.1 arenitezill.com @@ -14344,33 +13773,19 @@ 127.0.0.1 louboutinnorge.com + + + + + + 127.0.0.1 196.196.153.151 - - - 127.0.0.1 158.222.7.116 - - - 127.0.0.1 196.245.152.139 - - - 127.0.0.1 165.231.251.197 - - - 127.0.0.1 196.242.16.29 - - - 127.0.0.1 165.231.4.90 - - - 127.0.0.1 158.222.7.83 - - # A scam SMS I got 127.0.0.1 95-214-26-78.plesk.page 127.0.0.1 account-limitato.org @@ -14379,8 +13794,6 @@ 127.0.0.1 supportnetflix.com 127.0.0.1 95.214.26.78 - - # Overly dedicated E-mail spammers 127.0.0.1 wirexapp.africa.com @@ -14400,13 +13813,9 @@ 127.0.0.1 sirdayscare.info 127.0.0.1 slownansuch.info + 127.0.0.1 185.155.184.57 - - - 127.0.0.1 185.155.186.24 - - 127.0.0.1 style-js.com @@ -14416,8 +13825,6 @@ - - 127.0.0.1 estudioespositoymiguel.com.ar @@ -14482,13 +13889,9 @@ 127.0.0.1 xgptw11vogsh.com 127.0.0.1 zeirj14ikqwf.com + 127.0.0.1 69.172.200.185 - - - 127.0.0.1 77.220.214.153 - - # More search terms than what can be counted with a supercomputer (11/03/2024) # Scam E-mails I've got @@ -14507,13 +13910,11 @@ 127.0.0.1 wp3.xyz # Tumblr spammers - 127.0.0.1 104.21.82.132 127.0.0.1 172.67.158.57 127.0.0.1 198.12.86.90 - 127.0.0.1 adhitagency.shop 127.0.0.1 advanceddigitalbusiness.com 127.0.0.1 ajkalshop.com @@ -14584,6 +13985,8 @@ + + 127.0.0.1 iuxxx.com 127.0.0.1 tuusi.com 127.0.0.1 messageme.life @@ -14600,7 +14003,6 @@ 127.0.0.1 dreamintim.com # R34US # https://github.com/AdguardTeam/FiltersRegistry/issues/654#issuecomment-2629098471 - 127.0.0.1 139.45.197.168 127.0.0.1 139.45.197.244 @@ -14608,7 +14010,6 @@ - 127.0.0.1 ajartoalsushy.com 127.0.0.1 catilrecmemsi.com 127.0.0.1 chusapsoarduwa.net @@ -14770,8 +14171,6 @@ 127.0.0.1 bestpartnerfinderonline.com 127.0.0.1 185.68.16.189 - - 127.0.0.1 huntinginukraine.com 127.0.0.1 gitlab.gitlab.gitlab.com 127.0.0.1 gitlab.git.git.com @@ -14780,8 +14179,6 @@ 127.0.0.1 git.gitlab.gitlab.com 127.0.0.1 76.223.15.82 - - 127.0.0.1 10bestchina.com 127.0.0.1 123594.com 127.0.0.1 127453.com @@ -15535,18 +14932,15 @@ 127.0.0.1 netnet33.net 127.0.0.1 netnet44.net 127.0.0.1 odintara.com - 127.0.0.1 54.174.156.141 - # Searched for Breaking Bad Jesse memes on Qwant (29/04/2025) 127.0.0.1 old.sermitsiaq.ag 127.0.0.1 xss.my.id - 127.0.0.1 85.159.213.158 - # Seemingly mass-generated fake "marketing company" sites that seem to serve no visible purpose (12/05/2025) + 127.0.0.1 23.170.252.196 127.0.0.1 23.229.68.43 127.0.0.1 23.229.68.44 @@ -15725,6 +15119,9 @@ + + + @@ -15758,21 +15155,17 @@ 127.0.0.1 psaitchuzaubo.com 127.0.0.1 rita0.com 127.0.0.1 tshfc.com - 127.0.0.1 139.45.195.9 - # Other entries 127.0.0.1 animeplaynow.com 127.0.0.1 playanimenow.com 127.0.0.1 datedate.today 127.0.0.1 go.dealslandz.com 127.0.0.1 awecrptjmp.com - 127.0.0.1 172.240.41.32 127.0.0.1 172.240.41.64 127.0.0.1 172.240.41.96 - # Spambot(s?) on R34X³ 127.0.0.1 24hdeepnude.com # gelbo²ruCOM @@ -15787,6 +15180,8 @@ + + # bdsmx-pornCOM 127.0.0.1 6traitors.com 127.0.0.1 baimgfroggd.site @@ -15850,6 +15245,7 @@ 127.0.0.1 sunsandmoon.com 127.0.0.1 trankosty.shop 127.0.0.1 tubecup.org + 127.0.0.1 62.122.168.42 127.0.0.1 109.206.163.112 127.0.0.1 109.206.163.116 @@ -15876,6 +15272,9 @@ + + + @@ -15893,6 +15292,8 @@ + + 127.0.0.1 013d5342d9.com 127.0.0.1 03122e72f0.com 127.0.0.1 0551acf6ed.com @@ -15981,7 +15382,6 @@ 127.0.0.1 ntvpevnts.com 127.0.0.1 selecttopon.com 127.0.0.1 statelinear.com - 127.0.0.1 167.235.163.216 @@ -15989,6 +15389,7 @@ + 127.0.0.1 a3ion.com 127.0.0.1 advertrek.com 127.0.0.1 cant3am.com @@ -16037,10 +15438,8 @@ 127.0.0.1 zlink9.com 127.0.0.1 zlinkl.com 127.0.0.1 zlinkv.com - 127.0.0.1 95.211.229.247 - # fetish2230•rssing•com 127.0.0.1 agdosortione.com 127.0.0.1 ashwayinvers.com @@ -16067,10 +15466,8 @@ 127.0.0.1 undeciliste.com 127.0.0.1 unrertivermalous.com 127.0.0.1 wherdiapospir.com - 127.0.0.1 88.208.22.1 - # xmegadriveCOM 127.0.0.1 adoredcount.com 127.0.0.1 amused-condition.com @@ -16089,12 +15486,10 @@ 127.0.0.1 repulsiveguarantee.com 127.0.0.1 sotomistel.com 127.0.0.1 unripereading.com - 127.0.0.1 188.72.219.35 - # Various postal credential fraud syndicates 127.0.0.1 236956.today 127.0.0.1 adresdoreczenie.today @@ -16519,6 +15914,8 @@ + + # icepornCOM # https://www•drvhub•net/devices/network/asix/ax88178a-usb-2-0-to-gigabit-ethernet-adapter @@ -17001,6 +16398,7 @@ 127.0.0.1 trksp1.com 127.0.0.1 trksp2.com 127.0.0.1 trksp3.com + 127.0.0.1 157.90.33.79 127.0.0.1 173.239.53.20 127.0.0.1 178.63.248.53 @@ -17030,6 +16428,9 @@ + + + # ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— @@ -17223,6 +16624,7 @@ 127.0.0.1 yolkclknu.com 127.0.0.1 yolkdirxl.com 127.0.0.1 zentrixads.com + 127.0.0.1 103.67.200.64 127.0.0.1 198.134.116.17 127.0.0.1 198.134.116.30 @@ -17231,6 +16633,9 @@ + + + # Extreme amounts of PUP to a comical extent 127.0.0.1 driverpack.io # https://github.com/DandelionSprout/adfilt/issues/1124 @@ -17318,8 +16723,6 @@ - - # https://github.com/AdguardTeam/AdguardFilters/issues/145513 @@ -17510,6 +16913,7 @@ 127.0.0.1 xyz.cm 127.0.0.1 yellowdragon.com # Parking services' IP addresses + 127.0.0.1 13.248.148.254 127.0.0.1 185.53.177.50 127.0.0.1 185.53.177.51 @@ -17532,6 +16936,9 @@ + + + # Bouncing hard-to-close (but admittedly empty) popups on NSFW sites like viperTO diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 6d4c4f1f1..c8c170bfa 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 27November2025v1-Deprecated +# Version: 07December2025v2-Deprecated # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -32,8 +32,6 @@ .spam404bl.com .109.201.135.46 - - .fredfiber.no .securemecca.com .1hos.cf @@ -69,8 +67,6 @@ .ublock.org .138.68.252.54 - - .useragentswitch.com .dev-nano.com # Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. @@ -158,46 +154,10 @@ {+block} # ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— .ubuntu.org - -.103.224.212.249 - - .speedtest.com .snapchat.cm .facebook.cm .wix.cm - -.199.59.243.222 - - - -.173.208.96.42 - - - -.173.208.96.43 - - - -.173.208.96.44 - - - -.173.208.96.45 - - - -.173.208.96.46 - - - -.213.227.149.208 - - - -.213.227.149.211 - - .ddscordapp. .diicordapp. .disccrdapp. @@ -253,6 +213,26 @@ .rgithub.com .githubt.com + + + + + + + + + + +.173.208.96.42 +.173.208.96.43 +.173.208.96.44 +.173.208.96.45 +.173.208.96.46 +.199.59.243.222 +.213.227.149.208 +.213.227.149.211 + + {+block} # ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— .hippolyte-hag.com @@ -261,37 +241,35 @@ .paramonos-oha.com .photios-raj.com .zeroredirect5.com - -.54.209.22.226 - - - -.54.91.125.197 - - - -.52.202.53.245 - - - - - - - - - -.34.230.160.215 - - - -.3.226.8.132 - - - -.3.216.243.46 - - .roamingclicks.com + + + + + + + + + + + + + + + + +.144.76.0.242 +.144.76.1.130 +.195.201.92.254 +.3.216.243.46 +.3.226.8.132 +.34.230.160.215 +.52.202.53.245 +.54.209.22.226 +.54.91.125.197 +.94.130.185.237 +.94.130.186.231 + # Source: desidertNO .collectfasttracks.com # Various ex-affiliate links at www•zombooru•com @@ -303,26 +281,6 @@ .ns1.trafficclub.com .satcom1.co.uk .splitter.microxml.net - -.94.130.185.237 - - - -.94.130.186.231 - - - -.144.76.0.242 - - - -.144.76.1.130 - - - -.195.201.92.254 - - ?bemobdata= {+block} @@ -332,102 +290,6 @@ .couponbybox.com .newpage.in /mcaf04/*= - -.34.204.214.165 - - - -.54.85.113.62 - - - -.54.205.83.61 - - - -.54.210.193.115 - - -.[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1] -.banalbjar.com -.coryljanty.cam -.elfpetsic.com -.postback.report -.roksit.net -.adblockerapp.com - -.172.255.6.107 - - - -.172.255.6.147 - - - -.172.255.6.219 - - - -.172.255.6.225 - - - -.188.42.129.108 - - - -.188.42.129.116 - - - -.188.42.141.100 - - - -.188.42.141.92 - - - -.23.109.82.144 - - - -.23.109.82.41 - - - -.23.109.82.43 - - - -.23.109.82.65 - - - -.23.109.82.66 - - - -.23.109.87.169 - - - -.23.109.87.207 - - - -.23.109.87.208 - - -.blueoyster.click - -.216.21.13.14 - - - -.216.21.13.15 - - /.*\.(xyz|pics)/[a-zA-Z0-9]{130,} /.*\.(cloudfront\.net|xyz|pics)/[a-zA-Z0-9]{20,}/[a-zA-Z0-9]{25,}\+[a-zA-Z0-9+]{90,} .hafisague.com @@ -442,10 +304,67 @@ .videoadblockers. .videoadblockertou. .videoadblockextension. +.adblockerapp.com +.banalbjar.com +.blueoyster.click +.coryljanty.cam +.elfpetsic.com +.postback.report +.roksit.net + + + + + + + + + + + + + + + + + + + + + + + + + +.172.255.6.107 +.172.255.6.147 +.172.255.6.219 +.172.255.6.225 +.188.42.129.108 +.188.42.129.116 +.188.42.141.100 +.188.42.141.92 +.216.21.13.14 +.216.21.13.15 +.23.109.82.144 +.23.109.82.41 +.23.109.82.43 +.23.109.82.65 +.23.109.82.66 +.23.109.87.169 +.23.109.87.207 +.23.109.87.208 +.34.204.214.165 +.54.205.83.61 +.54.210.193.115 +.54.85.113.62 +.[2600:1f18:43d1:2a04:ee05:261e:d408:7ba1] + + .abedwithdrawalautograph.com .abnegateexcavator.com .acceptablefabric.com @@ -792,59 +711,53 @@ /scan-update-and-protect-your-browser.html -.fres-news.com -.workerz-news.com -.zredir.com - -.178.128.142.109 - - -.findmedia.biz .backtonews.biz .bagclick.biz +.best202*-games-web1.com .bigkick.biz +.findmedia.biz +.fres-news.com .getcontent24.com -.klickmode.biz -.newsgate.biz -.redmdeia.biz -.uptodater.net -.virnews.club - -.134.209.136.174 - - -.whiteclick.biz .gonews2.com +.hooligapps.com +.klickmode.biz .mediadate.net .newscode.me +.newsgate.biz +.redmdeia.biz .skymedia7.me .startmode.biz .texterra.me +.theonlygames.com +.uptodater.net +.virnews.club +.whiteclick.biz +.workerz-news.com +.zredir.com + + + + + + + + +.134.209.136.174 +.178.128.142.109 +.62.210.11.203 .62.210.6.153 - - - .62.210.7.209 - - - .62.210.9.92 - - -.62.210.11.203 - - -.hooligapps.com -.best202*-games-web1.com -.theonlygames.com .notified-today.com .new-message.email -.167.99.249.47 + +.167.99.249.47 + .moderncomputer.net .version.gratis .starpowders.github.io @@ -859,70 +772,53 @@ .0redirc.com .iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com + + + + + .5.8.34.26 - - - .5.8.47.3 - - - .103.224.182.251 - .holescontracting.com .doggroomingnews.com -.5.79.71.205 -.5.79.71.225 -.85.17.31.82 -.85.17.31.122 - .178.162.203.202 - - - .178.162.203.211 - - - .178.162.203.226 - - - .178.162.217.107 - - +.5.79.71.205 +.5.79.71.225 +.85.17.31.122 +.85.17.31.82 .[2a02:1668:1034::2] + .logicalrecord.com .secureportal.online .emiratenbduae.com -.66.85.156.85 -.66.85.156.86 .108.170.31.123 - - - .108.170.52.156 - +.66.85.156.85 +.66.85.156.86 .toksearches.xyz .smashapps.net @@ -971,16 +867,14 @@ .video-change.digital .watch-this.live -.95.168.170.165 + + .213.227.145.147 - - - .213.227.149.216 - +.95.168.170.165 .wow-robotics.xyz .johndoe.icu @@ -990,14 +884,10 @@ .aleinvest.xyz .5.188.62.36 - - .speedupmypcfree.com .ssielearning.com .69.49.231.244 - - .5starhdporn.com .vrthcobj.com .rblxexploits.net @@ -1008,8 +898,6 @@ .yzsnw.com .37.34.176.37 - - .pcspeedcat.com .auslogics.com .in-automate.brevo.com @@ -1024,30 +912,22 @@ .temp74.com .trackwebclick.com + .23.111.31.137 - - - .23.111.88.207 - - .onesafesoftware.com + + + + + + .185.158.250.239 - - - .192.169.69.25 - - - .212.192.241.72 - - - .37.0.10.83 - .secure-0*.ddnss.ch .lucdream.com .pesoaniz.com @@ -1056,8 +936,6 @@ .dashwoodestates.com .192.3.110.170 - - .socialsearchconverter.com .install.socialsearchconverter.com .feed.socialsearchconverter.com @@ -1075,81 +953,49 @@ .totalwebshield.xyz .91.241.19.38 - - .telete.in .kiff.tech .45.90.58.90 - - .95.85.89.98 - - .mediafire.com/file/pj9jdm7iznc4d51/tekhacksnet_multi_loader.rar .139.28.37.49 - - - - .91.243.121.19 - - .103.169.90.205 + + + + + + + + + + .125.44.43.45 - - - .182.121.8.240 - - - .42.235.183.74 - - - .78.36.32.242 - - - .115.50.2.119 - - - .115.50.110.163 - - - .119.179.84.145 - - - .188.120.50.98 - - - .190.238.183.5 - - - .27.220.253.78 - .esetnode32-antiviru.ydns.eu .aieov.com # Relations to the original domain .192.3.194.242 - - .w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu .hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu .avira-antivirus.ydns.eu @@ -1178,219 +1024,119 @@ .23.94.26.138 - - .205.185.126.200 - - .185.243.56.167 -.123.10.224.135 -.59.47.187.147 -.39.68.172.210 -.122.192.177.176 -.112.27.124.108 -.123.110.176.246 -.219.155.105.98 -.171.35.161.209 -.60.16.255.36 -.112.30.4.52 -.182.121.191.201 -.121.61.48.170 -.39.81.68.45 -.27.222.220.164 -.113.233.215.135 -.151.77.100.133 - - - -.125.120.13.184 - - - -.120.12.138.133 - .27.194.115.185 - - - - - - -.183.92.123.145 - - - -.110.89.8.126 - - - -.125.43.211.184 - - - -.1.0.218.230 - - - -.221.208.4.56 - - - -.60.13.60.19 - - - -.171.37.29.87 - - - -.124.91.237.188 - - - -.115.56.137.49 - - - -.115.52.240.69 - - - -.112.252.132.185 - - - -.117.198.240.157 - - - +.27.222.220.164 +.39.68.172.210 +.39.81.68.45 .42.53.240.249 - - - -.116.179.138.68 - - - -.110.241.119.159 - - - -.115.56.31.133 - - - -.103.19.128.222 - - - -.202.12.80.74 - - - +.59.47.187.147 +.60.13.60.19 +.60.16.255.36 .61.52.8.62 - - - -.182.122.252.69 - - - -.219.155.26.50 - - - -.120.4.141.185 - - - -.119.102.7.115 - - - .72.51.127.213 - - - +.1.0.218.230 +.103.19.128.222 +.110.241.119.159 +.110.89.8.126 .111.224.199.91 - - - -.119.250.236.122 - - - +.112.252.132.185 +.112.27.124.108 .112.30.110.58 - +.112.30.4.52 +.113.233.215.135 +.115.52.240.69 +.115.56.137.49 +.115.56.31.133 +.116.179.138.68 +.117.198.240.157 +.119.102.7.115 +.119.250.236.122 +.120.12.138.133 +.120.4.141.185 +.121.61.48.170 +.122.192.177.176 +.123.10.224.135 +.123.110.176.246 +.124.91.237.188 +.125.120.13.184 +.125.43.211.184 +.151.77.100.133 +.171.35.161.209 +.171.37.29.87 +.182.121.191.201 +.182.122.252.69 +.183.92.123.145 +.202.12.80.74 +.219.155.105.98 +.219.155.26.50 +.221.208.4.56 .pcae.de + + + + + + .117.196.49.21 - - - .115.55.54.234 - - - .115.52.17.123 - - - .182.59.69.21 - .chip-secured-download.de # Domains which resolve to this (already blocked) IP - for users of HOSTs/Domains/uBlock Origin .saimission.org @@ -1407,8 +1153,6 @@ # Vermilion Strike .160.202.163.100 - - .microsoftkernel.com .microsofthk.com .lnk.to/GlXHtur0 @@ -1417,15 +1161,9 @@ .45.95.169.115 - - .45.148.120.80 - - .85.239.33.9 - - # Relations to the domain above .adminsys.serveftp.com .amazbaidu.serveftp.com @@ -1444,16 +1182,10 @@ .107.173.176.183 - - .45.148.120.171 - - .google-yandex. .159.148.186.228 - - .yotube.com .security-scanner.xyz @@ -1466,160 +1198,92 @@ .safejokesearch.com .mediadlvr.com -.39.83.80.247 -.68.197.33.124 -.219.157.21.37 -.182.123.141.17 -.125.47.243.187 -.182.122.196.203 -.182.117.231.182 -.112.31.211.135 -.125.106.63.93 -.115.59.197.46 -.122.159.29.192 - - - -.171.40.0.127 - - - -.171.80.219.160 - - - -.123.10.65.201 - - - -.168.90.205.46 - - - -.125.47.205.109 - - - -.39.80.147.239 - - - -.45.224.171.130 - - - -.45.5.209.75 - - - -.116.17.210.157 - - - -.27.45.103.240 - - - -.110.167.64.171 - - - -.39.81.117.73 - - - -.183.15.90.156 - - - -.119.113.248.74 - - - -.175.0.95.85 - - - -.61.52.99.109 - - - -.222.142.183.194 - - - -.106.86.172.194 .103.233.216.77 - - - +.106.86.172.194 +.110.167.64.171 +.112.31.211.135 +.115.59.197.46 +.116.17.210.157 +.119.113.248.74 +.122.159.29.192 +.123.10.65.201 +.125.106.63.93 +.125.47.205.109 +.125.47.243.187 +.168.90.205.46 +.171.40.0.127 +.171.80.219.160 +.175.0.95.85 +.182.117.231.182 +.182.122.196.203 +.182.123.141.17 +.183.15.90.156 .183.188.192.55 - +.219.157.21.37 +.222.142.183.194 +.27.45.103.240 +.39.80.147.239 +.39.81.117.73 +.39.83.80.247 +.45.224.171.130 +.45.5.209.75 +.61.52.99.109 +.68.197.33.124 .198.23.255.14 - - .trumops.com .runmodes.com + .91.121.67.60 - - - .172.67.186.189 - - .securefirst.us-east-1.linodeobjects.com + + + + + + .39.65.72.211 - - - .42.238.151.197 - - - .27.213.60.53 - - - .115.56.169.134 - .yasir252.com .safelink.kadal.club .tonightshookup.com @@ -1629,11 +1293,7 @@ .194.87.138.20 - - .103.167.92.73 - - .bursakulis.com .610418.selcdn.ru .alexstewartinternationalltd.rw @@ -1646,37 +1306,25 @@ .mygametoa.com .yunosurveys.com + + + + + + + + + + .58.249.74.79 - - - .27.45.14.109 - - - .27.40.101.191 - - - .27.45.119.22 - - - .27.47.73.159 - - - .115.204.119.237 - - - .163.125.31.46 - - - .163.179.168.44 - .money-mod.com .bestlifeoffer20.com .youtube.com/watch?v=8nY7SnvNxH4 @@ -1684,49 +1332,31 @@ .mediafire.com/file/at2tvnao5x6ivdo/EngineOwning.rar/ .download2264.mediafire.com/pnk44f5ci9rg/at2tvnao5x6ivdo/EngineOwning.rar + + + + + + + + + + + + + .110.89.59.135 - - - .113.116.89.1 - - - .119.183.146.191 - - - .153.3.3.226 - - - .182.116.104.6 - - - .60.7.133.200 - - - .122.6.254.201 - - - .110.89.11.167 - - - .171.112.177.90 - - - .115.194.38.143 - - - .61.52.79.32 - .dl02.s3.amazonaws.com/installers/747947/oi_picasa38-setupexe.exe .dl02.s3.amazonaws.com/installers/424531/2gzbsoj4gxb.exe # ||zhuangjizhuli.com @@ -1736,8 +1366,6 @@ .132.148.220.142 - - .chess-progress.ru .askara.super.site .cdn.discordapp.com/attachments/916361798763053136/917187511053320202/Askara.exe @@ -1748,50 +1376,32 @@ .p-stn.net .haxpc.net + .52.53.243.52 - - - .34.201.22.10 - - .business.google.com/website/billyandscapedesign + + + + + + + + + + .123.10.225.196 - - - .122.192.106.84 - - - .172.88.199.9 - - - .114.38.176.185 - - - .61.52.97.35 - - - .27.206.181.208 - - - .124.163.130.175 - - - .118.75.87.102 - .134.122.115.190 - - .cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com .viewty.xyz .landing.marketstm.com @@ -1807,8 +1417,6 @@ .ru.com .141.8.226.34 - - .ston-app.com # fake human verification scam # start form - reported for abuse @@ -1820,8 +1428,6 @@ .crashfixes.com .91.240.118.172 - - # "Press Allow to continue" .kuyhaa-mee.com .upload-4ever.com @@ -1844,44 +1450,32 @@ .198.199.120.251 - - # A Discord conversation I had about Throneful .datings-club.life .findsexy.life .findsolemate.life .dating-galaxy.life + .195.201.253.130 - - - .195.201.253.131 - - .installiq.com /trk2/*?lddomain= .cpmverdirect.com + + + + + + + .15.197.244.48 - - - .96.47.230.67 - - - .96.47.230.68 - - - .96.47.230.69 - - - .96.47.230.70 - .highercaptcha-settle. .highercaptchasettle. .ns*.fastthinkingdns.com @@ -1889,6 +1483,8 @@ + + .trafredirtds.com .com/landers/iphone*_spin .pu020ev.com @@ -1901,8 +1497,6 @@ .uuidtsinc.net .31.220.27.134 - - .online-guard.com /mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*= .amazon-security-info.lnk.to @@ -2030,27 +1624,19 @@ + + + .85.17.31.152 - - - .95.211.26.202 - .158.247.212.220 - - - .165.227.168.212 - - .garbiaes.com .23.81.64.183 - - .inmewa.com .omshellderom.com .beonixom.com @@ -2066,8 +1652,6 @@ .vekeltaizy.net .139.45.197.236 - - .becovi.com .becovi.co.uk .desideriosoldi.com @@ -2083,14 +1667,13 @@ .potestainsula.com .motherpipe.net + + + + + .51.91.66.125 - - - .51.178.76.105 - - - .147.135.253.55 @@ -2098,12 +1681,7 @@ .146.19.169.98 - - - .146.19.169.99 - - /pushredirect/? .1000girl.com .1000islandsinfo.com @@ -3616,15 +3194,11 @@ .2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com .69.162.80.56 - - # Random Discord servers .newntflix- .giveawaycord. .162.241.124.200 - - .adsstar.in .clickcafe.in .easyviewz.com @@ -3637,8 +3211,6 @@ .webhostingtips.club .157.90.71.190 - - .beskittyan.com .cadbitff.com .clicktracklink.com @@ -3655,8 +3227,6 @@ .wumpeeps.net .139.45.197.239 - - .glthub. .adblock-chrome.net .cemec.xyz @@ -3675,17 +3245,15 @@ .vayamuegn.icu .wehiqes.xyz + + + + + .44.228.230.225 - - - .50.112.124.170 - - - .100.20.104.229 - # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread .link.sv .4.fo @@ -3695,26 +3263,20 @@ .pressizer.net .sapino.net + + + + + + .44.236.213.34 - - - .52.24.156.12 - - - .52.25.6.134 - - - .100.20.13.49 - .goldmesoil.live .51.68.87.229 - - .2022crucialcatch.store .adidascostarica.com .adulttoysale.top @@ -4132,6 +3694,8 @@ + + .blender3d-download. .blender3d-software. .blender3ds-download. @@ -4139,17 +3703,15 @@ .studio-obs.com .webull-download. + + + + + .185.106.94.139 - - - .45.90.109.196 - - - .91.229.23.200 - .bonusgift.life .bonusscore.life .giftaward.life @@ -4163,17 +3725,11 @@ .winearth.life .winpulse.life + .185.155.184.98 - - - .194.110.247.242 - - .54.219.218.169 - - .0365alert.com .0365online.com .365-notifcation.com @@ -4579,14 +4135,10 @@ .yourorderupdate.com .64.132.201.92 - - .jatvpn.softether.net .jatcraft.com .209.141.51.49 - - .post-norway.web.app .arquilavaan.com .bailonushe.com @@ -4653,18 +4205,16 @@ .wooden-comfort.com # Unsuited for wildcarding + + + + + .208.88.225.116 - - - .208.88.225.117 - - - .208.88.225.119 - .adrastos-eli.com .agapios-gla.com .aslau-cre.info @@ -4701,25 +4251,19 @@ .lakeside-fishandchips.com .office-view.com + + + + + + + .108.61.242.65 - - - .146.70.78.43 - - - .87.120.254.39 - - - .45.150.108.213 - - - .92.204.160.240 - /land/*&afftrack= # Comments on Slack .updatefreecompletelytheproduct.vip @@ -4982,25 +4526,19 @@ .zirze151uk5d.com .zxvjn4igweb9.com + + + + + + + .185.246.188.124 - - - .185.246.188.125 - - - .194.63.140.103 - - - .194.63.143.61 - - - .194.63.143.96 - .moneystartup.live @@ -5075,26 +4613,18 @@ .zorka-news.com .37.48.80.112 - - # Slack comments .cojcdn.net .redic3.com .totadblock.com + .109.206.168.16 - - - .109.206.168.17 - - .cadstoppam.live .paidsuenut.live .57.128.71.215 - - /.*&[a-z]{1,2}=[a-zA-Z0-9]{0,}%[a-zA-Z0-9%]{1000,} .rumadel.com @@ -5218,6 +4748,9 @@ + + + .139.45.197.167 .139.45.197.245 .159.223.137.164 @@ -5228,6 +4761,7 @@ .192.243.58.123 .192.243.58.124 .192.243.58.125 + .[2a02:b48:207:1::2] .[2a02:b48:207:1::3] .[2a02:b48:207:1::6] @@ -5239,6 +4773,8 @@ + + .dest.co.in .dkeie.co.in .fastvps-server.com @@ -5414,17 +4950,15 @@ .wellnessfortune.net .ztomy.com + + + + + .5.45.123.44 - - - .69.16.230.226 - - - .208.91.196.46 - /page/bouncy.php? .abberantbeefy.com .abominableexhibition.com @@ -6090,8 +5624,6 @@ .ptwmbed.com .93.93.51.223 - - .livejasmin.com/*&origin= /(.*//|.*\.)?github\.[a-z]{2,20}(/.*)? .github.sale @@ -6126,8 +5658,6 @@ .reschedule-delivery.ups.com. .103.174.102.240 - - .libretube.net .khw6g09fx28k.cfd .49gw5gonj143k.click @@ -6209,8 +5739,6 @@ .monetrizer*. .38.180.96.244 - - .acareewityjh.com .accedenonre.xyz .adeditiontowritingef.net @@ -6330,14 +5858,10 @@ .withmefeyauknaly.com .wukbgater.buzz + .34.195.224.242 - - - .54.225.185.110 - - .githubtalentcommunity. .sweedbank-help.com .levering-ekspedition.network @@ -6345,8 +5869,6 @@ .pochta-ru.com .91.202.233.143 - - # Based on a tip from my secretary .advancedwalletpay.com .amberzextracts.com @@ -6443,8 +5965,6 @@ .systemnetworkroute.com .108.62.157.10 - - .avito.avito.avito. .booking.com-id* .com-id*.info @@ -6456,45 +5976,29 @@ .avito.avito.www.avito. .booking.com-id* + + + + + + + + + + + + .172.240.108.68 - - - .172.240.108.76 - - - .172.240.108.84 - - - .172.240.127.234 - - - .172.240.253.132 - - - .192.243.59.12 - - - .192.243.59.13 - - - .192.243.59.20 - - - .192.243.61.225 - - - .192.243.61.227 - .abberantextending.com .abdicatehorrified.com .abjectpreludeparity.com @@ -7371,18 +6875,16 @@ .yourchoicehealthplan.com .zymstr.com + + + + + + .185.149.120.161 - - - .185.149.120.163 - - - - .185.149.120.175 - .alatterapistroke.com .astrarestaurant.com .bamasolutions.com @@ -7427,80 +6929,48 @@ .upsbezahlung.com .vius-inf.com .vrsecurego.com + + + + + + + + + + + + + + + + + + + + .45.202.32.3 - - - .45.8.92.138 - - - .79.133.46.252 - - - .82.147.85.156 - - - .91.212.166.16 - - - .94.156.64.129 - - - .94.232.249.61 - - - .94.232.249.69 - - - .94.232.249.75 - - - .94.232.249.235 - - - .176.111.174.118 - - - .176.113.115.191 - - - .191.96.224.140 - - - .193.124.185.42 - - - .193.143.1.45 - - - .193.143.1.214 - - - .193.143.1.217 - - - .208.91.189.203 - /?nw=1&tb=false&cw= .ablyglossmartyr.com .aboveaveragefinallycast.com @@ -11908,8 +11378,6 @@ .yuxc.xyz .103.155.214.207 - - .app-update.site .appupdate.net .flawflessas.com @@ -11918,15 +11386,11 @@ .prihlasit-secure-auth.com .185.196.9.214 - - .chrome.webredirect.org .captcha.webredirect.org .microsoft.com.chrome. .185.196.9.222 - - .100urls.com .17lc.cc .1android.ru @@ -12357,7 +11821,6 @@ .52.204.19.219 .100.28.19.138 .108.61.99.63 - .[2600:1f18:43d1:2a02:169f:dcbb:85f9:3c56] .[2600:1f18:43d1:2a02:b6ee:327b:545e:e578] .[2600:1f18:43d1:2a02:c3bd:35f3:da0a:4041] @@ -12374,6 +11837,9 @@ + + + .adblockermax.com/land # Various other reports .afsrepair.com @@ -12447,6 +11913,8 @@ + + .abcradilytor.com .abmagbychan.com .agatorkoaltor.com @@ -12564,10 +12032,8 @@ .wsbuckon.com .zacmoageeshee.net .zucoagorsout.com - .139.45.197.106 - .password-internal.com # Though not _inherently_ malware, at least 1 spambot on this repo had direct ties to that site .eyestore.tebex.io @@ -12769,10 +12235,8 @@ .xxx-telegram.com .zc-telegran.org .zzz-telegram.com - .43.128.142.70 - .chceshi001.com .gametime.fyi .hrun818.com @@ -12927,6 +12391,8 @@ + + .device-checking.com .device-cleanup.com .devicenotificationes.com @@ -12935,10 +12401,8 @@ .system-noticers.com .systemsnotifications.com .warningnotification.com - .46.101.81.149 - .adaptationfirework.com .armourbreederleadership.com .bleachinjectionuncommon.com @@ -12981,14 +12445,10 @@ .unesmunbrebers.com .filinnetirt.com .freshsubz.com - .52.15.34.25 - - .203.188.171.156 - .soft-gets.com .reaitek.com .fastdomain-uoemathhvq.workers.dev @@ -13249,6 +12709,7 @@ .workspace-drive.com .xtrash-tarck.com .your-package-delivery.com + .158.94.209.86 .158.94.209.87 .158.94.209.88 @@ -13261,9 +12722,27 @@ + + + /linkresolver.html?url=*p0 .creations.tools .idtsoftware.com +.acrossprotocols.com +.aftop10.com +.directory-opus-manager.github.io +.dokopka.icu +.dramajaratstate.com +.heygetbarter.com +.michaelborsari.com +.softs-window.com +.sublime-merge-git-client.github.io +.sublime-text-3.github.io +.welearnn.com +.94.156.232.201 +.213.209.143.119 + + {+block} # ——— Standard malware that I stumbled upon on my own ——— @@ -13597,18 +13076,14 @@ .market-csgo.ru .pubggf*.xyz .pubggift*.xyz - .194.226.139.121 .194.226.139.7 .95.181.157.36 - .95.181.172.204 - - /5\.8\.4[4-7]\.\d{1,3} /5\.101\.4[67]\.\d{1,3} /5\.188\.5[01]\.\d{1,3} @@ -13687,8 +13162,6 @@ .medication.coupons .147.135.16.27 - - .ingeniovirtual.com # Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious # Google results for 'Katy and Bob：Cake Café powerpc' (04/11/2022) @@ -13696,8 +13169,6 @@ .ultimateclassicrock.com/redirect .185.87.148.199 - - # Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) .imaot.co.il/ContentArea/BannerClick .q1065.fm/redirect @@ -13708,8 +13179,6 @@ .zh1653.com .45.136.49.35 - - .semex.com/popurl.cgi .pharmanimal.com/catalog/redirect.php # Browsing around for Tajik newssites @@ -13722,32 +13191,24 @@ .backshyoh.live .cityratetod.live + + + + + + + .51.91.211.94 - - - .162.19.71.16 - - - .146.59.240.191 - - - .54.37.5.34 - - - .54.36.118.105 - .highlandnews.com .pcbasicstrength.com .leantime.bigfi.re .159.89.10.102 - - # Other .pksauniversity.com .sharedmega.com @@ -13761,8 +13222,6 @@ .cbox.ws .inuseme.com - - .jNKmS0zFuEh.click .ru-torproject.ru .anapatformacion.org/modules/file/tor/tor-browser.zip @@ -13770,60 +13229,38 @@ .yuppdownload.com .34.80.59.191 - - .megabooru.com .zombooru.com .kusubooru.com .wh40kart.im + + + + + + + + + + + + + + .45.33.2.79 - - - .45.33.18.44 - - - .45.33.20.235 - - - .45.33.23.183 - - - .45.33.30.197 - - - .45.56.79.23 - - - .45.79.19.196 - - - .72.14.178.174 - - - .72.14.185.43 - - - .96.126.123.244 - - - .173.255.194.134 - - - .198.58.118.167 - .1337links.net .777offers.net .789offers.net @@ -13921,29 +13358,21 @@ .ym3trk.com .youwanthis.com + + + + + + + + .34.117.199.78 - - - .94.237.103.119 - - - .94.237.84.54 - - - .94.237.93.242 - - - .94.237.99.118 - - - .139.45.197.249 - .anahitagirted.uno .arenitezill.com .balneasoucars.website @@ -13985,33 +13414,19 @@ *skobutikks.com *butikksoslo.com + + + + + + .196.196.153.151 - - - .158.222.7.116 - - - .196.245.152.139 - - - .165.231.251.197 - - - .196.242.16.29 - - - .165.231.4.90 - - - .158.222.7.83 - - # A scam SMS I got .95-214-26-78.plesk.page .account-limitato.org @@ -14020,8 +13435,6 @@ .supportnetflix.com .95.214.26.78 - - # Overly dedicated E-mail spammers .wirexapp.africa.com @@ -14040,19 +13453,13 @@ .sirdayscare.info .slownansuch.info + .185.155.184.57 - - - .185.155.186.24 - - .style-js.com /a.aspx?cid=*&cname= .209.74.107.131 - - /flying.asp?cid= /kjyo.php?cname= /flying?cid=*&keywords= @@ -14121,13 +13528,9 @@ .xgptw11vogsh.com .zeirj14ikqwf.com + .69.172.200.185 - - - .77.220.214.153 - - # More search terms than what can be counted with a supercomputer (11/03/2024) # Scam E-mails I've got .googleapis.com/nwfotrac @@ -14143,10 +13546,8 @@ .wp3.xyz # Tumblr spammers - .172.67.158.57 .198.12.86.90 - .[2606:4700:3030::6815:5284] .[2606:4700:3037::ac43:9e39] .adhitagency.shop @@ -14218,6 +13619,8 @@ + + .sites.google.com/view/*wincashapp .iuxxx.com .tuusi.com @@ -14234,7 +13637,6 @@ .girlselfies.online .dreamintim.com # R34US - .139.45.197.168 .139.45.197.244 @@ -14242,7 +13644,6 @@ - .ajartoalsushy.com .catilrecmemsi.com .chusapsoarduwa.net @@ -14404,8 +13805,6 @@ .bestpartnerfinderonline.com .185.68.16.189 - - .huntinginukraine.com .gitlab.gitlab.gitlab. .gitlab.git.git. @@ -14414,8 +13813,6 @@ .git.gitlab.gitlab. .76.223.15.82 - - .10bestchina.com .123594.com .127453.com @@ -15168,17 +14565,14 @@ .netnet33.net .netnet44.net .odintara.com - .54.174.156.141 - # Searched for Breaking Bad Jesse memes on Qwant (29/04/2025) .xss.my.id - .85.159.213.158 - # Seemingly mass-generated fake "marketing company" sites that seem to serve no visible purpose (12/05/2025) + .23.170.252.196 .23.229.68.43 .23.229.68.44 @@ -15346,6 +14740,9 @@ + + + @@ -15379,21 +14776,17 @@ .psaitchuzaubo.com .rita0.com .tshfc.com - .139.45.195.9 - # Other entries .animeplaynow.com .playanimenow.com .datedate.today .go.dealslandz.com .awecrptjmp.com - .172.240.41.32 .172.240.41.64 .172.240.41.96 - # Spambot(s?) on R34X³ .24hdeepnude.com # gelbo²ruCOM @@ -15408,6 +14801,8 @@ + + # bdsmx-pornCOM .6traitors.com .baimgfroggd.site @@ -15471,6 +14866,7 @@ .sunsandmoon.com .trankosty.shop .tubecup.org + .62.122.168.42 .109.206.163.112 .109.206.163.116 @@ -15501,6 +14897,9 @@ + + + .biuqbiu.com .bmgmb.com .onclckbn.com @@ -15514,6 +14913,8 @@ + + .013d5342d9.com .03122e72f0.com .0551acf6ed.com @@ -15602,14 +15003,14 @@ .ntvpevnts.com .selecttopon.com .statelinear.com - .167.235.163.216 - .[2a01:4f8:c0:2343::2] .[2a01:4f8:e0:19cb::1] + + .a3ion.com .advertrek.com .cant3am.com @@ -15658,10 +15059,8 @@ .zlink9.com .zlinkl.com .zlinkv.com - .95.211.229.247 - # fetish2230•rssing•com .agdosortione.com .ashwayinvers.com @@ -15688,10 +15087,8 @@ .undeciliste.com .unrertivermalous.com .wherdiapospir.com - .88.208.22.1 - # xmegadriveCOM .adoredcount.com .amused-condition.com @@ -15710,9 +15107,7 @@ .repulsiveguarantee.com .sotomistel.com .unripereading.com - .188.72.219.35 - .[2a00:1178:1:4b::e] @@ -16141,6 +15536,8 @@ + + # icepornCOM /adx_iframe_ .az-partners.net @@ -16616,6 +16013,7 @@ .trksp1.com .trksp2.com .trksp3.com + .157.90.33.79 .173.239.53.20 .178.63.248.53 @@ -16647,6 +16045,9 @@ + + + .0network.com .100conversions.com .1tag.ai @@ -16837,6 +16238,7 @@ .yolkclknu.com .yolkdirxl.com .zentrixads.com + .103.67.200.64 .198.134.116.17 .198.134.116.30 @@ -16845,6 +16247,9 @@ + + + # Extreme amounts of PUP to a comical extent .driverpack.io .doh-gov.com @@ -16933,8 +16338,6 @@ - - # Inspired by various reports in the early hours of 5 January 2024 @@ -17069,6 +16472,7 @@ .xyz.cm .yellowdragon.com # Parking services' IP addresses + .13.248.148.254 .185.53.177.50 .185.53.177.51 @@ -17091,6 +16495,9 @@ + + + # Bouncing hard-to-close (but admittedly empty) popups on NSFW sites like viperTO .to/popconsole.php diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 0c8cbb4cf..977c93b60 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 27November2025v1-Deprecated +# Version: 07December2025v2-Deprecated : expires = 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -73,8 +73,6 @@ -d spam404bl.com -d 109.201.135.46 - - -d fredfiber.no -d securemecca.com -d 1hos.cf @@ -110,8 +108,6 @@ -d ublock.org -d 138.68.252.54 - - -d useragentswitch.com -d dev-nano.com # Presumed to be fraudulent antivirus extensions on app extension sites where it's perfectly probable that everyday people could install them. @@ -235,46 +231,10 @@ # ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— -d ubuntu.org - --d 103.224.212.249 - - -d speedtest.com -d snapchat.cm -d facebook.cm -d wix.cm - --d 199.59.243.222 - - - --d 173.208.96.42 - - - --d 173.208.96.43 - - - --d 173.208.96.44 - - - --d 173.208.96.45 - - - --d 173.208.96.46 - - - --d 213.227.149.208 - - - --d 213.227.149.211 - - -d ddscordapp. -d diicordapp. -d disccrdapp. @@ -333,7 +293,26 @@ -d githubuser.com -d rgithub.com -d githubt.com -# https://scammer•info/t/discord-nitro-scam-25/87887 + + + + + + + + + + + +-d 173.208.96.42 +-d 173.208.96.43 +-d 173.208.96.44 +-d 173.208.96.45 +-d 173.208.96.46 +-d 199.59.243.222 +-d 213.227.149.208 +-d 213.227.149.211 + # ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— -d hippolyte-hag.com @@ -342,37 +321,35 @@ -d paramonos-oha.com -d photios-raj.com -d zeroredirect5.com - --d 54.209.22.226 - - - --d 54.91.125.197 - - - --d 52.202.53.245 - - - - - - - - - --d 34.230.160.215 - - - --d 3.226.8.132 - - - --d 3.216.243.46 - - -d roamingclicks.com + + + + + + + + + + + + + + + + +-d 144.76.0.242 +-d 144.76.1.130 +-d 195.201.92.254 +-d 3.216.243.46 +-d 3.226.8.132 +-d 34.230.160.215 +-d 52.202.53.245 +-d 54.209.22.226 +-d 54.91.125.197 +-d 94.130.185.237 +-d 94.130.186.231 + # Source: desidertNO -d collectfasttracks.com # Various ex-affiliate links at www•zombooru•com @@ -384,26 +361,6 @@ -d ns1.trafficclub.com -d satcom1.co.uk -d splitter.microxml.net - --d 94.130.185.237 - - - --d 94.130.186.231 - - - --d 144.76.0.242 - - - --d 144.76.1.130 - - - --d 195.201.92.254 - - # https://github.com/DandelionSprout/adfilt/pull/167 # https://github.com/AdguardTeam/AdguardFilters/issues/124611 # (https://github.com/DandelionSprout/adfilt/issues/632) @@ -416,102 +373,6 @@ -d newpage.in - mcaf04 *= --d 34.204.214.165 - - - --d 54.85.113.62 - - - --d 54.205.83.61 - - - --d 54.210.193.115 - - --d [2600:1f18:43d1:2a04:ee05:261e:d408:7ba1] --d banalbjar.com --d coryljanty.cam --d elfpetsic.com --d postback.report --d roksit.net --d adblockerapp.com - --d 172.255.6.107 - - - --d 172.255.6.147 - - - --d 172.255.6.219 - - - --d 172.255.6.225 - - - --d 188.42.129.108 - - - --d 188.42.129.116 - - - --d 188.42.141.100 - - - --d 188.42.141.92 - - - --d 23.109.82.144 - - - --d 23.109.82.41 - - - --d 23.109.82.43 - - - --d 23.109.82.65 - - - --d 23.109.82.66 - - - --d 23.109.87.169 - - - --d 23.109.87.207 - - - --d 23.109.87.208 - - --d blueoyster.click - --d 216.21.13.14 - - - --d 216.21.13.15 - - - -d hafisague.com -d iortnhooping.website @@ -525,9 +386,66 @@ -d videoadblockers. -d videoadblockertou. -d videoadblockextension. +-d adblockerapp.com +-d banalbjar.com +-d blueoyster.click +-d coryljanty.cam +-d elfpetsic.com +-d postback.report +-d roksit.net + + + + + + + + + + + + + + + + + + + + + + + + + + +-d 172.255.6.107 +-d 172.255.6.147 +-d 172.255.6.219 +-d 172.255.6.225 +-d 188.42.129.108 +-d 188.42.129.116 +-d 188.42.141.100 +-d 188.42.141.92 +-d 216.21.13.14 +-d 216.21.13.15 +-d 23.109.82.144 +-d 23.109.82.41 +-d 23.109.82.43 +-d 23.109.82.65 +-d 23.109.82.66 +-d 23.109.87.169 +-d 23.109.87.207 +-d 23.109.87.208 +-d 34.204.214.165 +-d 54.205.83.61 +-d 54.210.193.115 +-d 54.85.113.62 +-d [2600:1f18:43d1:2a04:ee05:261e:d408:7ba1] + # https://github.com/DandelionSprout/adfilt/issues/942 -d abedwithdrawalautograph.com @@ -882,61 +800,55 @@ # https://github.com/AdguardTeam/AdguardFilters/issues/61743 # https://github.com/easylist/easylist/issues/6111 --d fres-news.com --d workerz-news.com --d zredir.com --d 178.128.142.109 - - --d findmedia.biz -d backtonews.biz -d bagclick.biz +-d best202*-games-web1.com -d bigkick.biz +-d findmedia.biz +-d fres-news.com -d getcontent24.com --d klickmode.biz --d newsgate.biz --d redmdeia.biz --d uptodater.net --d virnews.club - - --d 134.209.136.174 - - --d whiteclick.biz -d gonews2.com +-d hooligapps.com +-d klickmode.biz -d mediadate.net -d newscode.me +-d newsgate.biz +-d redmdeia.biz -d skymedia7.me -d startmode.biz -d texterra.me +-d theonlygames.com +-d uptodater.net +-d virnews.club +-d whiteclick.biz +-d workerz-news.com +-d zredir.com + + + + + + + + +-d 134.209.136.174 +-d 178.128.142.109 +-d 62.210.11.203 -d 62.210.6.153 - - - -d 62.210.7.209 - - - -d 62.210.9.92 - - --d 62.210.11.203 - - --d hooligapps.com --d best202*-games-web1.com --d theonlygames.com # https://maldita•es/malditobulo/2020/12/04/concurso-mercadona-ganar-tarjeta-regalo-100-euros-phishing/ -d notified-today.com -d new-message.email --d 167.99.249.47 + +-d 167.99.249.47 + # https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ # https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ -d moderncomputer.net @@ -966,73 +878,56 @@ -d 0redirc.com -d iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com + + + + + -d 5.8.34.26 - - - -d 5.8.47.3 - - - -d 103.224.182.251 - # https://github.com/DandelionSprout/adfilt/issues/193 -d holescontracting.com -d doggroomingnews.com --d 5.79.71.205 --d 5.79.71.225 --d 85.17.31.82 --d 85.17.31.122 - -d 178.162.203.202 - - - -d 178.162.203.211 - - - -d 178.162.203.226 - - - -d 178.162.217.107 - - +-d 5.79.71.205 +-d 5.79.71.225 +-d 85.17.31.122 +-d 85.17.31.82 -d [2a02:1668:1034::2] + # https://github.com/DandelionSprout/adfilt/issues/195 -d logicalrecord.com # https://github.com/DandelionSprout/adfilt/issues/196 -d secureportal.online -d emiratenbduae.com --d 66.85.156.85 --d 66.85.156.86 -d 108.170.31.123 - - - -d 108.170.52.156 - +-d 66.85.156.85 +-d 66.85.156.86 # https://github.com/DandelionSprout/adfilt/issues/198 # https://www•bleepingcomputer•com/virus-removal/ (18/06 2021) @@ -1084,16 +979,14 @@ -d video-change.digital -d watch-this.live --d 95.168.170.165 + + -d 213.227.145.147 - - - -d 213.227.149.216 - +-d 95.168.170.165 # https://twitter•com/adamziaja/status/1252234957679808513 -d wow-robotics.xyz @@ -1105,16 +998,12 @@ -d aleinvest.xyz -d 5.188.62.36 - - # https://github.com/DandelionSprout/adfilt/issues/223 -d speedupmypcfree.com # https://github.com/DandelionSprout/adfilt/issues/224 -d ssielearning.com -d 69.49.231.244 - - # https://movsb•0x0•st/users/mia -d 5starhdporn.com # https://github.com/DandelionSprout/adfilt/issues/228 @@ -1131,8 +1020,6 @@ -d yzsnw.com -d 37.34.176.37 - - -d pcspeedcat.com -d auslogics.com # (https://github.com/DandelionSprout/adfilt/issues/1076) @@ -1150,33 +1037,25 @@ -d temp74.com -d trackwebclick.com + -d 23.111.31.137 - - - -d 23.111.88.207 - - # https://github.com/DandelionSprout/adfilt/issues/254 -d onesafesoftware.com # https://github.com/DandelionSprout/adfilt/issues/257 + + + + + + -d 185.158.250.239 - - - -d 192.169.69.25 - - - -d 212.192.241.72 - - - -d 37.0.10.83 - -d lucdream.com -d pesoaniz.com @@ -1191,8 +1070,6 @@ # https://safeweb•norton•com/report/show?url=192•3•110•170 -d 192.3.110.170 - - # https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ -d socialsearchconverter.com -d install.socialsearchconverter.com @@ -1219,8 +1096,6 @@ # https://www•virustotal•com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection -d 91.241.19.38 - - # https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection # https://safeweb•norton•com/report/show?url=telete•in # https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -1232,79 +1107,51 @@ # https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection -d 45.90.58.90 - - # https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community # https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection -d 95.85.89.98 - - # https://github.com/DandelionSprout/adfilt/issues/267 -d mediafire.com file pj9jdm7iznc4d51 tekhacksnet_multi_loader.rar # https://github.com/DandelionSprout/adfilt/pull/278 # https://www.virustotal.com/gui/file/da75c85fe037f9ff9ebbbd0b37dd2ff154f5e70a0dc6870286e0d3df6b8f246f/community -d 139.28.37.49 - - # https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community - - # https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community # https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community -d 91.243.121.19 - - # https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community -d 103.169.90.205 - - # https://github.com/DandelionSprout/adfilt/pull/281 # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + + + + + + + -d 125.44.43.45 - - - -d 182.121.8.240 - - - -d 42.235.183.74 - - - -d 78.36.32.242 - - - -d 115.50.2.119 - - - -d 115.50.110.163 - - - -d 119.179.84.145 - - - -d 188.120.50.98 - - - -d 190.238.183.5 - - - -d 27.220.253.78 - # https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community -d esetnode32-antiviru.ydns.eu # https://www•joesandbox•com/analysis/486636/0/html#domains @@ -1312,8 +1159,6 @@ # Relations to the original domain -d 192.3.194.242 - - -d w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu -d hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu -d avira-antivirus.ydns.eu @@ -1352,226 +1197,126 @@ # https://github.com/DandelionSprout/adfilt/commit/f7f114945c83b339be5cdd848e229680d9918abb#commitcomment-57642875 -d 23.94.26.138 - - # https://github.com/DandelionSprout/adfilt/pull/298 # https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community -d 205.185.126.200 - - # https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community -d 185.243.56.167 - - # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community --d 123.10.224.135 --d 59.47.187.147 --d 39.68.172.210 --d 122.192.177.176 --d 112.27.124.108 --d 123.110.176.246 --d 219.155.105.98 --d 171.35.161.209 --d 60.16.255.36 --d 112.30.4.52 --d 182.121.191.201 --d 121.61.48.170 --d 39.81.68.45 --d 27.222.220.164 --d 113.233.215.135 --d 151.77.100.133 --d 125.120.13.184 - - - --d 120.12.138.133 - - -d 27.194.115.185 - - - - - - --d 183.92.123.145 - - - --d 110.89.8.126 - - - --d 125.43.211.184 - - - --d 1.0.218.230 - - - --d 221.208.4.56 - - - --d 60.13.60.19 - - - --d 171.37.29.87 - - - --d 124.91.237.188 - - - --d 115.56.137.49 - - - --d 115.52.240.69 - - - --d 112.252.132.185 - - - --d 117.198.240.157 - - - +-d 27.222.220.164 +-d 39.68.172.210 +-d 39.81.68.45 -d 42.53.240.249 - - - --d 116.179.138.68 - - - --d 110.241.119.159 - - - --d 115.56.31.133 - - - --d 103.19.128.222 - - - --d 202.12.80.74 - - - +-d 59.47.187.147 +-d 60.13.60.19 +-d 60.16.255.36 -d 61.52.8.62 - - - --d 182.122.252.69 - - - --d 219.155.26.50 - - - --d 120.4.141.185 - - - --d 119.102.7.115 - - - -d 72.51.127.213 - - - +-d 1.0.218.230 +-d 103.19.128.222 +-d 110.241.119.159 +-d 110.89.8.126 -d 111.224.199.91 - - - --d 119.250.236.122 - - - +-d 112.252.132.185 +-d 112.27.124.108 -d 112.30.110.58 - +-d 112.30.4.52 +-d 113.233.215.135 +-d 115.52.240.69 +-d 115.56.137.49 +-d 115.56.31.133 +-d 116.179.138.68 +-d 117.198.240.157 +-d 119.102.7.115 +-d 119.250.236.122 +-d 120.12.138.133 +-d 120.4.141.185 +-d 121.61.48.170 +-d 122.192.177.176 +-d 123.10.224.135 +-d 123.110.176.246 +-d 124.91.237.188 +-d 125.120.13.184 +-d 125.43.211.184 +-d 151.77.100.133 +-d 171.35.161.209 +-d 171.37.29.87 +-d 182.121.191.201 +-d 182.122.252.69 +-d 183.92.123.145 +-d 202.12.80.74 +-d 219.155.105.98 +-d 219.155.26.50 +-d 221.208.4.56 # https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community -d pcae.de # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + -d 117.196.49.21 - - - -d 115.55.54.234 - - - -d 115.52.17.123 - - - -d 182.59.69.21 - # https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community -d chip-secured-download.de # https://www•virustotal•com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb @@ -1593,8 +1338,6 @@ # https://www•virustotal•com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations -d 160.202.163.100 - - # https://www•virustotal•com/gui/ip-address/160•202•163•100/relations -d microsoftkernel.com -d microsofthk.com @@ -1608,18 +1351,12 @@ # https://www•virustotal•com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community -d 45.95.169.115 - - # https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community -d 45.148.120.80 - - # https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community -d 85.239.33.9 - - # Relations to the domain above -d adminsys.serveftp.com -d amazbaidu.serveftp.com @@ -1638,13 +1375,9 @@ # https://www•virustotal•com/gui/file/8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0/community -d 107.173.176.183 - - # https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community -d 45.148.120.171 - - # https://twitter•com/soranker0/status/1449491402409185283 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-950330114 # https://github.com/iam-py-test/investigations/blob/main/2021/10 24 1.md#html-capture @@ -1653,8 +1386,6 @@ # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-951321929 -d 159.148.186.228 - - # https://github.com/iam-py-test/investigations/blob/main/2021/10 26 1.md#domains -d yotube.com -d security-scanner.xyz @@ -1673,166 +1404,98 @@ # https://github.com/DandelionSprout/adfilt/pull/348 # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community --d 39.83.80.247 --d 68.197.33.124 --d 219.157.21.37 --d 182.123.141.17 --d 125.47.243.187 --d 182.122.196.203 --d 182.117.231.182 --d 112.31.211.135 --d 125.106.63.93 --d 115.59.197.46 --d 122.159.29.192 - - - --d 171.40.0.127 - - - --d 171.80.219.160 - - - --d 123.10.65.201 - - - --d 168.90.205.46 - - - --d 125.47.205.109 - - - --d 39.80.147.239 - - - --d 45.224.171.130 - - - --d 45.5.209.75 - - - --d 116.17.210.157 - - - --d 27.45.103.240 - - - --d 110.167.64.171 - - - --d 39.81.117.73 - - - --d 183.15.90.156 - - - --d 119.113.248.74 - - - --d 175.0.95.85 - - - --d 61.52.99.109 - - - --d 222.142.183.194 - - - --d 106.86.172.194 -d 103.233.216.77 - - - +-d 106.86.172.194 +-d 110.167.64.171 +-d 112.31.211.135 +-d 115.59.197.46 +-d 116.17.210.157 +-d 119.113.248.74 +-d 122.159.29.192 +-d 123.10.65.201 +-d 125.106.63.93 +-d 125.47.205.109 +-d 125.47.243.187 +-d 168.90.205.46 +-d 171.40.0.127 +-d 171.80.219.160 +-d 175.0.95.85 +-d 182.117.231.182 +-d 182.122.196.203 +-d 182.123.141.17 +-d 183.15.90.156 -d 183.188.192.55 - +-d 219.157.21.37 +-d 222.142.183.194 +-d 27.45.103.240 +-d 39.80.147.239 +-d 39.81.117.73 +-d 39.83.80.247 +-d 45.224.171.130 +-d 45.5.209.75 +-d 61.52.99.109 +-d 68.197.33.124 # https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community -d 198.23.255.14 - - # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971512075 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-971495248 # https://github.com/iam-py-test/investigations/blob/main/2021/11 15 1.md#iocs -d trumops.com -d runmodes.com + -d 91.121.67.60 - - - -d 172.67.186.189 - - # https://scammer•info/t/mcafee-phish/83725 -d securefirst.us-east-1.linodeobjects.com # https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community + + + + + + -d 39.65.72.211 - - - -d 42.238.151.197 - - - -d 27.213.60.53 - - - -d 115.56.169.134 - # https://github.com/iam-py-test/investigations/blob/main/2021/11 21 1.md -d yasir252.com -d safelink.kadal.club @@ -1846,13 +1509,9 @@ # https://www•virustotal•com/gui/file/2b2628a50d3b39b0fa2395d487bf62b00e37cdae847ff76ee58399bbe4e9f7b3/community -d 194.87.138.20 - - # https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community -d 103.167.92.73 - - # https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community -d bursakulis.com # https://www•virustotal•com/gui/url/b333c49efa4d399e65c5e2d96a905b380acbca58a3e3052b7bd7cfcb3e0e81ee @@ -1875,37 +1534,25 @@ # https://github.com/uBlockOrigin/uAssets/pull/10620 # https://www•virustotal•com/gui/file/d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8/community + + + + + + + + + + -d 58.249.74.79 - - - -d 27.45.14.109 - - - -d 27.40.101.191 - - - -d 27.45.119.22 - - - -d 27.47.73.159 - - - -d 115.204.119.237 - - - -d 163.125.31.46 - - - -d 163.179.168.44 - # https://github.com/uBlockOrigin/uAssets/pull/10647 # https://github.com/iam-py-test/investigations/blob/main/2021/11 28 1.md -d money-mod.com @@ -1919,49 +1566,31 @@ -d download2264.mediafire.com pnk44f5ci9rg at2tvnao5x6ivdo EngineOwning.rar # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community + + + + + + + + + + + + + -d 110.89.59.135 - - - -d 113.116.89.1 - - - -d 119.183.146.191 - - - -d 153.3.3.226 - - - -d 182.116.104.6 - - - -d 60.7.133.200 - - - -d 122.6.254.201 - - - -d 110.89.11.167 - - - -d 171.112.177.90 - - - -d 115.194.38.143 - - - -d 61.52.79.32 - # https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 # https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 # https://www•virustotal•com/gui/file/50fd813cf8fe981e6aee179f8ba394e5527c5128b84c328f9f8347cd994bbc42/community @@ -1979,8 +1608,6 @@ -d 132.148.220.142 - - # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 -d chess-progress.ru # https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 @@ -1998,55 +1625,37 @@ # https://github.com/iam-py-test/investigations/blob/main/2021/12 13 1.md -d haxpc.net + -d 52.53.243.52 - - - -d 34.201.22.10 - - # https://scammer•info/t/crypto-scammers-onceagain/85354 -d business.google.com website billyandscapedesign # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community + + + + + + + + + + -d 123.10.225.196 - - - -d 122.192.106.84 - - - -d 172.88.199.9 - - - -d 114.38.176.185 - - - -d 61.52.97.35 - - - -d 27.206.181.208 - - - -d 124.163.130.175 - - - -d 118.75.87.102 - # https://github.com/iam-py-test/investigations/blob/main/2021/12 14 1.md # https://github.com/DevSpen/links/pull/3 # https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ -d 134.122.115.190 - - -d cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com # https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777 -d viewty.xyz @@ -2065,8 +1674,6 @@ -d ru.com -d 141.8.226.34 - - # https://github.com/AdguardTeam/AdguardFilters/issues/108571 -d ston-app.com # fake human verification scam @@ -2080,8 +1687,6 @@ # https://www•virustotal•com/gui/file/9d40ae0439ddc594b2cf64e21ad0fdea9bb440524298e3a6bcfcc1fb417f1ed2/relations -d 91.240.118.172 - - # "Press Allow to continue" -d kuyhaa-mee.com -d upload-4ever.com @@ -2110,8 +1715,6 @@ -d top3hostngc.xyz -d 198.199.120.251 - - # https://www•telia•no/kundeservice/mobil/malware-flubot-android/ @@ -2121,37 +1724,27 @@ -d findsolemate.life -d dating-galaxy.life + -d 195.201.253.130 - - - -d 195.201.253.131 - - # The bottom download button on https://www•sushichop•com/ -d installiq.com - trk2 *?lddomain= -d cpmverdirect.com + + + + + + + -d 15.197.244.48 - - - -d 96.47.230.67 - - - -d 96.47.230.68 - - - -d 96.47.230.69 - - - -d 96.47.230.70 - # https://securitytrails•com/list/ns/ns1•fastthinkingdns•com -d highercaptcha-settle. -d highercaptchasettle. @@ -2160,6 +1753,8 @@ + + # https://github.com/AdguardTeam/AdguardFilters/issues/121544 -d trafredirtds.com -d com landers iphone*_spin @@ -2174,8 +1769,6 @@ -d uuidtsinc.net -d 31.220.27.134 - - # https://github.com/AdguardTeam/AdguardFilters/issues/122757 # https://github.com/AdguardTeam/AdguardFilters/issues/123544 -d online-guard.com @@ -2308,22 +1901,16 @@ + + + -d 85.17.31.152 - - - -d 95.211.26.202 - - # https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 + -d 158.247.212.220 - - - -d 165.227.168.212 - - # https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ # https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 @@ -2331,8 +1918,6 @@ -d garbiaes.com -d 23.81.64.183 - - # https://github.com/AdguardTeam/AdguardFilters/issues/125300 -d inmewa.com -d omshellderom.com @@ -2349,8 +1934,6 @@ -d vekeltaizy.net -d 139.45.197.236 - - # https://github.com/AdguardTeam/AdguardFilters/issues/128029 -d becovi.com -d becovi.co.uk @@ -2367,17 +1950,15 @@ -d potestainsula.com -d motherpipe.net + + + + + -d 51.91.66.125 - - - -d 51.178.76.105 - - - -d 147.135.253.55 - # https://github.com/uBlockOrigin/uAssets/issues/14569/→/https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection/(https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) # https://github.com/AdguardTeam/AdguardFilters/issues/129414 @@ -2386,13 +1967,9 @@ # https://github.com/AdguardTeam/AdguardFilters/issues/131156 + -d 146.19.169.98 - - - -d 146.19.169.99 - - # https://github.com/AdguardTeam/AdguardFilters/issues/132079 - pushredirect ? # https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -3907,16 +3484,12 @@ -d 2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com -d 69.162.80.56 - - # https://github.com/AdguardTeam/AdguardFilters/issues/134903 # Random Discord servers -d newntflix- -d giveawaycord. -d 162.241.124.200 - - # https://github.com/AdguardTeam/AdguardFilters/issues/135815 -d adsstar.in -d clickcafe.in @@ -3930,8 +3503,6 @@ -d webhostingtips.club -d 157.90.71.190 - - # https://github.com/AdguardTeam/AdguardFilters/issues/135924 -d beskittyan.com -d cadbitff.com @@ -3949,8 +3520,6 @@ -d wumpeeps.net -d 139.45.197.239 - - # https://github.com/AdguardTeam/AdguardFilters/issues/136390 -d glthub. # https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -3972,17 +3541,15 @@ -d vayamuegn.icu -d wehiqes.xyz + + + + + -d 44.228.230.225 - - - -d 50.112.124.170 - - - -d 100.20.104.229 - # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread -d link.sv -d 4.fo @@ -3993,27 +3560,21 @@ -d pressizer.net -d sapino.net + + + + + + -d 44.236.213.34 - - - -d 52.24.156.12 - - - -d 52.25.6.134 - - - -d 100.20.13.49 - # https://github.com/AdguardTeam/AdguardFilters/issues/139667 -d goldmesoil.live -d 51.68.87.229 - - # https://github.com/DandelionSprout/adfilt/issues/747 -d 2022crucialcatch.store -d adidascostarica.com @@ -4433,6 +3994,8 @@ + + # https://www•bleepingcomputer•com/news/security/hackers-push-malware-via-google-search-ads-for-vlc-7-zip-ccleaner/ -d blender3d-download. -d blender3d-software. @@ -4441,17 +4004,15 @@ -d studio-obs.com -d webull-download. + + + + + -d 185.106.94.139 - - - -d 45.90.109.196 - - - -d 91.229.23.200 - # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1401711872 # https://github.com/AdguardTeam/AdguardFilters/issues/144514 -d bonusgift.life @@ -4467,18 +4028,12 @@ -d winearth.life -d winpulse.life + -d 185.155.184.98 - - - -d 194.110.247.242 - - # https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ -d 54.219.218.169 - - # https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ -d 0365alert.com -d 0365online.com @@ -4885,15 +4440,11 @@ -d yourorderupdate.com -d 64.132.201.92 - - # https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener -d jatvpn.softether.net -d jatcraft.com -d 209.141.51.49 - - -d post-norway.web.app # https://github.com/AdguardTeam/AdguardFilters/issues/142955 -d arquilavaan.com @@ -4962,17 +4513,15 @@ -d wooden-comfort.com # Unsuited for wildcarding + + + + + -d 208.88.225.116 - - - -d 208.88.225.117 - - - -d 208.88.225.119 - # https://github.com/AdguardTeam/AdguardFilters/issues/144823 -d landings.*_slots/?partner= @@ -5015,25 +4564,19 @@ -d lakeside-fishandchips.com -d office-view.com + + + + + + + -d 108.61.242.65 - - - -d 146.70.78.43 - - - -d 87.120.254.39 - - - -d 45.150.108.213 - - - -d 92.204.160.240 - # https://github.com/AdguardTeam/AdguardFilters/issues/148560 - land *&afftrack= # Comments on Slack @@ -5300,25 +4843,19 @@ -d zirze151uk5d.com -d zxvjn4igweb9.com + + + + + + + -d 185.246.188.124 - - - -d 185.246.188.125 - - - -d 194.63.140.103 - - - -d 194.63.143.61 - - - -d 194.63.143.96 - # https://github.com/AdguardTeam/AdguardFilters/issues/152945 -d moneystartup.live @@ -5395,28 +4932,20 @@ -d zorka-news.com -d 37.48.80.112 - - # Slack comments -d cojcdn.net -d redic3.com -d totadblock.com + -d 109.206.168.16 - - - -d 109.206.168.17 - - # https://github.com/AdguardTeam/AdguardFilters/issues/155298 -d cadstoppam.live -d paidsuenut.live -d 57.128.71.215 - - # https://github.com/AdguardTeam/AdguardFilters/issues/155936 -d rumadel.com @@ -5543,6 +5072,9 @@ + + + -d 139.45.197.167 -d 139.45.197.245 -d 159.223.137.164 @@ -5553,6 +5085,7 @@ -d 192.243.58.123 -d 192.243.58.124 -d 192.243.58.125 + -d [2a02:b48:207:1::2] -d [2a02:b48:207:1::3] -d [2a02:b48:207:1::6] @@ -5564,6 +5097,8 @@ + + # https://github.com/AdguardTeam/AdguardFilters/issues/157308 -d dest.co.in -d dkeie.co.in @@ -5740,17 +5275,15 @@ -d wellnessfortune.net -d ztomy.com + + + + + -d 5.45.123.44 - - - -d 69.16.230.226 - - - -d 208.91.196.46 - - page bouncy.php? # https://github.com/AdguardTeam/AdguardFilters/issues/158316 -d abberantbeefy.com @@ -6419,8 +5952,6 @@ -d ptwmbed.com -d 93.93.51.223 - - -d livejasmin.com *&origin= # https://github.com/AdguardTeam/AdguardFilters/issues/161364 # (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) @@ -6475,8 +6006,6 @@ -d reschedule-delivery.ups.com. -d 103.174.102.240 - - # https://github.com/libre-tube/LibreTube/issues/4409 -d libretube.net # https://github.com/RPiList/specials/issues/1353 @@ -6562,8 +6091,6 @@ -d 38.180.96.244 - - # https://github.com/AdguardTeam/AdguardFilters/issues/172569 -d acareewityjh.com -d accedenonre.xyz @@ -6684,14 +6211,10 @@ -d withmefeyauknaly.com -d wukbgater.buzz + -d 34.195.224.242 - - - -d 54.225.185.110 - - -d githubtalentcommunity. # https://github.com/AdguardTeam/AdguardFilters/issues/173925 -d sweedbank-help.com @@ -6700,8 +6223,6 @@ -d pochta-ru.com -d 91.202.233.143 - - # Based on a tip from my secretary -d advancedwalletpay.com -d amberzextracts.com @@ -6799,8 +6320,6 @@ -d systemnetworkroute.com -d 108.62.157.10 - - # https://github.com/AdguardTeam/FiltersRegistry/issues/925 # https://github.com/AdguardTeam/FiltersRegistry/pull/927 -d avito.avito.avito. @@ -6815,45 +6334,29 @@ vito.www.booking. -d booking.com-id* # https://github.com/AdguardTeam/AdguardFilters/issues/179170 + + + + + + + + + + + + -d 172.240.108.68 - - - -d 172.240.108.76 - - - -d 172.240.108.84 - - - -d 172.240.127.234 - - - -d 172.240.253.132 - - - -d 192.243.59.12 - - - -d 192.243.59.13 - - - -d 192.243.59.20 - - - -d 192.243.61.225 - - - -d 192.243.61.227 - -d abberantextending.com -d abdicatehorrified.com -d abjectpreludeparity.com @@ -7732,18 +7235,16 @@ vito.www.booking. -d yourchoicehealthplan.com -d zymstr.com + + + + + + -d 185.149.120.161 - - - -d 185.149.120.163 - - - - -d 185.149.120.175 - # https://github.com/AdguardTeam/AdguardFilters/issues/184671 -d alatterapistroke.com -d astrarestaurant.com @@ -7790,80 +7291,48 @@ vito.www.booking. -d upsbezahlung.com -d vius-inf.com -d vrsecurego.com + + + + + + + + + + + + + + + + + + + + -d 45.202.32.3 - - - -d 45.8.92.138 - - - -d 79.133.46.252 - - - -d 82.147.85.156 - - - -d 91.212.166.16 - - - -d 94.156.64.129 - - - -d 94.232.249.61 - - - -d 94.232.249.69 - - - -d 94.232.249.75 - - - -d 94.232.249.235 - - - -d 176.111.174.118 - - - -d 176.113.115.191 - - - -d 191.96.224.140 - - - -d 193.124.185.42 - - - -d 193.143.1.45 - - - -d 193.143.1.214 - - - -d 193.143.1.217 - - - -d 208.91.189.203 - # https://github.com/AdguardTeam/AdguardFilters/issues/189905 - ?nw=1&tb=false&cw= # https://github.com/AdguardTeam/AdguardFilters/issues/196657 @@ -12274,8 +11743,6 @@ vito.www.booking. -d yuxc.xyz -d 103.155.214.207 - - # Inspired by https://github.com/AdguardTeam/AdguardFilters/issues/197908 -d app-update.site -d appupdate.net @@ -12285,15 +11752,11 @@ vito.www.booking. -d prihlasit-secure-auth.com -d 185.196.9.214 - - -d chrome.webredirect.org -d captcha.webredirect.org icrosoft.com.chrome. -d 185.196.9.222 - - # https://github.com/AdguardTeam/AdguardFilters/issues/201064 -d 100urls.com -d 17lc.cc @@ -12725,7 +12188,6 @@ icrosoft.com.chrome. -d 52.204.19.219 -d 100.28.19.138 -d 108.61.99.63 - -d [2600:1f18:43d1:2a02:169f:dcbb:85f9:3c56] -d [2600:1f18:43d1:2a02:b6ee:327b:545e:e578] -d [2600:1f18:43d1:2a02:c3bd:35f3:da0a:4041] @@ -12742,6 +12204,9 @@ icrosoft.com.chrome. + + + # https://github.com/AdguardTeam/AdguardFilters/issues/202010 -d adblockermax.com land # Various other reports @@ -12816,6 +12281,8 @@ icrosoft.com.chrome. + + -d abcradilytor.com -d abmagbychan.com -d agatorkoaltor.com @@ -12933,10 +12400,8 @@ icrosoft.com.chrome. -d wsbuckon.com -d zacmoageeshee.net -d zucoagorsout.com - -d 139.45.197.106 - # https://github.com/DandelionSprout/adfilt/issues/1129 -d password-internal.com # Though not _inherently_ malware, at least 1 spambot on this repo had direct ties to that site @@ -13142,10 +12607,8 @@ http://secured21.*.com/ -d xxx-telegram.com -d zc-telegran.org -d zzz-telegram.com - -d 43.128.142.70 - # https://github.com/AdguardTeam/AdguardFilters/issues/20787[2-5] -d chceshi001.com -d gametime.fyi @@ -13301,6 +12764,8 @@ http://secured21.*.com/ + + # https://github.com/DandelionSprout/adfilt/issues/1164 -d device-checking.com -d device-cleanup.com @@ -13310,10 +12775,8 @@ http://secured21.*.com/ -d system-noticers.com -d systemsnotifications.com -d warningnotification.com - -d 46.101.81.149 - -d adaptationfirework.com -d armourbreederleadership.com -d bleachinjectionuncommon.com @@ -13357,15 +12820,11 @@ http://secured21.*.com/ -d unesmunbrebers.com -d filinnetirt.com -d freshsubz.com - -d 52.15.34.25 - # https://www•gdatasoftware•com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware - -d 203.188.171.156 - # https://github•com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign•md -d soft-gets.com -d reaitek.com @@ -13628,6 +13087,7 @@ http://secured21.*.com/ -d workspace-drive.com -d xtrash-tarck.com -d your-package-delivery.com + -d 158.94.209.86 -d 158.94.209.87 -d 158.94.209.88 @@ -13640,11 +13100,30 @@ http://secured21.*.com/ + + + # https://urlscan.io/result/019a4ffd-885c-7545-816a-3c121d8bdc0d/ (Early November 2025) - linkresolver.html?url=*p0 # https://github.com/DandelionSprout/adfilt/issues/1197 -d creations.tools -d idtsoftware.com +# https://github.com/DandelionSprout/adfilt/issues/1212 +-d acrossprotocols.com +-d aftop10.com +-d directory-opus-manager.github.io +-d dokopka.icu +-d dramajaratstate.com +-d heygetbarter.com +-d michaelborsari.com +-d softs-window.com +-d sublime-merge-git-client.github.io +-d sublime-text-3.github.io +-d welearnn.com +-d 94.156.232.201 +-d 213.209.143.119 + + # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -13985,18 +13464,14 @@ dvancedhosters.com$doc,domain= -d market-csgo.ru - -d 194.226.139.121 -d 194.226.139.7 -d 95.181.157.36 - -d 95.181.172.204 - - # AS209813 (https://github.com/AdguardTeam/AdguardFilters/issues/114618#issuecomment-1100702530;/currently/specific to tools that support CIDR blocking) @@ -14079,8 +13554,6 @@ dvancedhosters.com$doc,domain= -d medication.coupons -d 147.135.16.27 - - # https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img -d ingeniovirtual.com # https://scambiofigu•forumcommunity•net/?t=57482915 @@ -14090,8 +13563,6 @@ dvancedhosters.com$doc,domain= -d ultimateclassicrock.com redirect -d 185.87.148.199 - - # Google results for 'horse tales: emerald valley ranch mobygames' (05 11 2022) -d imaot.co.il ContentArea BannerClick -d q1065.fm redirect @@ -14102,8 +13573,6 @@ dvancedhosters.com$doc,domain= -d zh1653.com -d 45.136.49.35 - - -d semex.com popurl.cgi -d pharmanimal.com catalog redirect.php # Browsing around for Tajik newssites @@ -14116,33 +13585,25 @@ dvancedhosters.com$doc,domain= -d backshyoh.live -d cityratetod.live + + + + + + + -d 51.91.211.94 - - - -d 162.19.71.16 - - - -d 146.59.240.191 - - - -d 54.37.5.34 - - - -d 54.36.118.105 - # Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt -d highlandnews.com -d pcbasicstrength.com -d leantime.bigfi.re -d 159.89.10.102 - - # Other -d pksauniversity.com -d sharedmega.com @@ -14156,8 +13617,6 @@ dvancedhosters.com$doc,domain= -d cbox.ws -d inuseme.com - - # https://github.com/blocklistproject/Lists/issues/933 -d jNKmS0zFuEh.click # https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448/and/https://tria•ge/230217-xd8nksgc9x/behavioral2 @@ -14172,61 +13631,39 @@ dvancedhosters.com$doc,domain= # Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) -d 34.80.59.191 - - # Various domains on https://securitytrails•com/list/ip/72•14•178•174 -d megabooru.com -d zombooru.com -d kusubooru.com -d wh40kart.im + + + + + + + + + + + + + + -d 45.33.2.79 - - - -d 45.33.18.44 - - - -d 45.33.20.235 - - - -d 45.33.23.183 - - - -d 45.33.30.197 - - - -d 45.56.79.23 - - - -d 45.79.19.196 - - - -d 72.14.178.174 - - - -d 72.14.185.43 - - - -d 96.126.123.244 - - - -d 173.255.194.134 - - - -d 198.58.118.167 - # https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ -d 1337links.net -d 777offers.net @@ -14325,29 +13762,21 @@ dvancedhosters.com$doc,domain= -d ym3trk.com -d youwanthis.com + + + + + + + + -d 34.117.199.78 - - - -d 94.237.103.119 - - - -d 94.237.84.54 - - - -d 94.237.93.242 - - - -d 94.237.99.118 - - - -d 139.45.197.249 - # https://dnpedia•com/tlds/topm•php/bizarrely/listing/"anahitagirted•uno"/as the 622th most visited domain worldwide -d anahitagirted.uno -d arenitezill.com @@ -14390,33 +13819,19 @@ dvancedhosters.com$doc,domain= *skobutikks.com *butikksoslo.com + + + + + + -d 196.196.153.151 - - - -d 158.222.7.116 - - - -d 196.245.152.139 - - - -d 165.231.251.197 - - - -d 196.242.16.29 - - - -d 165.231.4.90 - - - -d 158.222.7.83 - - # A scam SMS I got -d 95-214-26-78.plesk.page -d account-limitato.org @@ -14425,8 +13840,6 @@ dvancedhosters.com$doc,domain= -d supportnetflix.com -d 95.214.26.78 - - # Overly dedicated E-mail spammers -d wirexapp.africa.com @@ -14446,19 +13859,13 @@ spx?cname=*&cid= -d sirdayscare.info -d slownansuch.info + -d 185.155.184.57 - - - -d 185.155.186.24 - - -d style-js.com - a.aspx?cid=*&cname= -d 209.74.107.131 - - - flying.asp?cid= - kjyo.php?cname= - flying?cid=*&keywords= @@ -14528,13 +13935,9 @@ ed.br ?q=artstation- -d xgptw11vogsh.com -d zeirj14ikqwf.com + -d 69.172.200.185 - - - -d 77.220.214.153 - - # More search terms than what can be counted with a supercomputer (11 03 2024) # Scam E-mails I've got -d googleapis.com nwfotrac @@ -14553,10 +13956,8 @@ ed.br ?q=artstation- -d wp3.xyz # Tumblr spammers - -d 172.67.158.57 -d 198.12.86.90 - -d [2606:4700:3030::6815:5284] -d [2606:4700:3037::ac43:9e39] -d adhitagency.shop @@ -14628,6 +14029,8 @@ ed.br ?q=artstation- + + -d sites.google.com view *wincashapp -d iuxxx.com -d tuusi.com @@ -14645,7 +14048,6 @@ ed.br ?q=artstation- -d dreamintim.com # R34US # https://github.com/AdguardTeam/FiltersRegistry/issues/654#issuecomment-2629098471 - -d 139.45.197.168 -d 139.45.197.244 @@ -14653,7 +14055,6 @@ ed.br ?q=artstation- - -d ajartoalsushy.com -d catilrecmemsi.com -d chusapsoarduwa.net @@ -14815,8 +14216,6 @@ ed.br ?q=artstation- -d bestpartnerfinderonline.com -d 185.68.16.189 - - -d huntinginukraine.com -d gitlab.gitlab.gitlab. -d gitlab.git.git. @@ -14825,8 +14224,6 @@ ed.br ?q=artstation- -d git.gitlab.gitlab. -d 76.223.15.82 - - -d 10bestchina.com -d 123594.com -d 127453.com @@ -15580,17 +14977,14 @@ ed.br ?q=artstation- -d netnet33.net -d netnet44.net -d odintara.com - -d 54.174.156.141 - # Searched for Breaking Bad Jesse memes on Qwant (29 04 2025) -d xss.my.id - -d 85.159.213.158 - # Seemingly mass-generated fake "marketing company" sites that seem to serve no visible purpose (12 05 2025) + -d 23.170.252.196 -d 23.229.68.43 -d 23.229.68.44 @@ -15758,6 +15152,9 @@ ed.br ?q=artstation- + + + @@ -15791,21 +15188,17 @@ ed.br ?q=artstation- -d psaitchuzaubo.com -d rita0.com -d tshfc.com - -d 139.45.195.9 - # Other entries -d animeplaynow.com -d playanimenow.com -d datedate.today -d go.dealslandz.com -d awecrptjmp.com - -d 172.240.41.32 -d 172.240.41.64 -d 172.240.41.96 - # Spambot(s?) on R34X³ -d 24hdeepnude.com # gelbo²ruCOM @@ -15820,6 +15213,8 @@ ed.br ?q=artstation- + + # bdsmx-pornCOM -d 6traitors.com -d baimgfroggd.site @@ -15883,6 +15278,7 @@ ed.br ?q=artstation- -d sunsandmoon.com -d trankosty.shop -d tubecup.org + -d 62.122.168.42 -d 109.206.163.112 -d 109.206.163.116 @@ -15913,6 +15309,9 @@ ed.br ?q=artstation- + + + -d biuqbiu.com -d bmgmb.com -d onclckbn.com @@ -15926,6 +15325,8 @@ ed.br ?q=artstation- + + -d 013d5342d9.com -d 03122e72f0.com -d 0551acf6ed.com @@ -16014,14 +15415,14 @@ ed.br ?q=artstation- -d ntvpevnts.com -d selecttopon.com -d statelinear.com - -d 167.235.163.216 - -d [2a01:4f8:c0:2343::2] -d [2a01:4f8:e0:19cb::1] + + -d a3ion.com -d advertrek.com -d cant3am.com @@ -16070,10 +15471,8 @@ ed.br ?q=artstation- -d zlink9.com -d zlinkl.com -d zlinkv.com - -d 95.211.229.247 - # fetish2230•rssing•com -d agdosortione.com -d ashwayinvers.com @@ -16100,10 +15499,8 @@ ed.br ?q=artstation- -d undeciliste.com -d unrertivermalous.com -d wherdiapospir.com - -d 88.208.22.1 - # xmegadriveCOM -d adoredcount.com -d amused-condition.com @@ -16122,9 +15519,7 @@ ed.br ?q=artstation- -d repulsiveguarantee.com -d sotomistel.com -d unripereading.com - -d 188.72.219.35 - -d [2a00:1178:1:4b::e] @@ -16553,6 +15948,8 @@ ed.br ?q=artstation- + + # icepornCOM - adx_iframe_ # https://www•drvhub•net/devices/network/asix/ax88178a-usb-2-0-to-gigabit-ethernet-adapter @@ -17035,6 +16432,7 @@ ed.br ?q=artstation- -d trksp1.com -d trksp2.com -d trksp3.com + -d 157.90.33.79 -d 173.239.53.20 -d 178.63.248.53 @@ -17066,6 +16464,9 @@ ed.br ?q=artstation- + + + # ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter/——— -d 0network.com -d 100conversions.com @@ -17257,6 +16658,7 @@ ed.br ?q=artstation- -d yolkclknu.com -d yolkdirxl.com -d zentrixads.com + -d 103.67.200.64 -d 198.134.116.17 -d 198.134.116.30 @@ -17265,6 +16667,9 @@ ed.br ?q=artstation- + + + # Extreme amounts of PUP to a comical extent -d driverpack.io # https://github.com/DandelionSprout/adfilt/issues/1124 @@ -17345,8 +16750,6 @@ ed.br ?q=artstation- - - # https://github.com/AdguardTeam/AdguardFilters/issues/145513 @@ -17489,6 +16892,7 @@ sp?url=http://xn--*.xn--p1ai/ -d xyz.cm -d yellowdragon.com # Parking services' IP addresses + -d 13.248.148.254 -d 185.53.177.50 -d 185.53.177.51 @@ -17511,6 +16915,9 @@ sp?url=http://xn--*.xn--p1ai/ + + + # Bouncing hard-to-close (but admittedly empty) popups on NSFW sites like viperTO o popconsole.php diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p index b07574f59..43a5b436f 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p @@ -1,9 +1,3 @@ -# Title: Dandelion Sprout's and other adblocker lists' IPs (P2P IPv4) -# Expires: 1 day -# Description: This IP set combines IP and CIDR addresses from plentiful of major adblocker lists. It contains heavily altered content from Dandelion Sprout's Anti-Malware List, Dandelion Sprout's Nordic Filters, EasyList, uBlock Filters, uBlock Filters - Badware Risks, AdGuard Base Filter, AdGuard French Filter, EasyList Germany, ABP Anti-Circumvention Filters, RU AdList, Liste AR, and EasyList Spanish. -# For more information and details about this list and other lists of mine, go to https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english -# For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists -# Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#-english F:109.201.135.46-109.201.135.46 F:138.68.252.54-138.68.252.54 F:103.224.212.249-103.224.212.249 @@ -930,4 +924,4 @@ F:94.130.167.163-94.130.167.163 F:192.151.218.66-192.151.218.66 F:23.224.89.2-23.224.89.2 F:156.233.32.123-156.233.32.123 -F:207.148.44.179-207.148.44.179 \ No newline at end of file +F:207.148.44.179-207.148.44.179 diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset index e63de192c..27fb958f3 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset @@ -582,7 +582,6 @@ 18.202.86.139 198.134.116.17 198.134.116.30 -37.48.80.112 52.72.216.6 94.130.197.238 63.33.119.172 @@ -591,8 +590,6 @@ [2606:4700:3033::6815:5644] [2a01:4f8:2201:388a::2] 103.67.200.64 -198.134.116.17 -198.134.116.30 [2a00:8860:10d:1::2:b01] 212.27.60.108 13.248.148.254 @@ -612,7 +609,6 @@ 5.39.221.180 13.49.35.236 35.227.231.163 -38.180.96.244 45.58.146.154 51.195.133.131 52.216.146.90 @@ -626,15 +622,12 @@ 85.17.76.181 92.42.104.146 94.156.65.204 -132.148.220.142 134.209.82.119 136.243.73.30 138.201.126.227 154.213.16.136 156.236.126.173 -158.247.212.220 162.241.194.206 -165.227.168.212 167.71.49.177 167.99.196.225 176.58.98.57 @@ -645,26 +638,8 @@ 195.88.55.21 195.242.152.122 196.196.230.76 -212.27.60.108 -193.143.1.45 -193.143.1.214 -193.143.1.217 -109.230.237.116 -147.93.63.211 -154.223.16.232 -43.100.125.58 -43.159.140.215 -43.162.119.45 -47.76.132.29 212.224.107.120 196.251.85.197 -158.94.209.89 -158.94.209.86 -158.94.209.87 -158.94.209.88 -158.94.209.89 -158.94.209.90 -223.29.226.200 104.160.10.0/24 165.231.154.0/24 165.231.10.0/24 @@ -855,22 +830,6 @@ 212.117.190.212 212.117.190.213 91.204.226.224 -57.128.71.215 -172.240.108.68 -172.240.108.76 -172.240.108.84 -172.240.127.234 -172.240.253.132 -185.246.188.124 -185.246.188.125 -192.243.59.12 -192.243.59.13 -192.243.59.20 -192.243.61.225 -192.243.61.227 -194.63.140.103 -194.63.143.61 -194.63.143.96 104.155.51.226:443 139.45.197.151 139.45.197.152 @@ -894,3 +853,40 @@ 95.213.229.88 95.213.231.34 35.193.89.147 +198.23.198.110 +185.216.143.121 +158.247.208. +23.109.82. +23.109.87. +54.222.186.106 +23.224.199.96 +23.224.199.74 +31.14.252.148 +110.93.143.144 +180.76.2.18 +66.228.52.30 +67.228.151.70 +74.55.82.102 +79.125.117.123 +184.106.248.76 +200.72.40.46 +37.220.26.135 +37.220.26.136 +37.220.26.137 +77.247.178.41 +78.140.134.198 +78.140.149.216 +88.85.75.147 +88.85.77.92 +91.207.192.31 +95.211.125.226 +193.200.64.24 +206.54.181.250 +62.76.25.27 +62.76.25.28 +45.82.68.79 +94.130.167.163 +192.151.218.66 +23.224.89.2 +156.233.32.123 +207.148.44.179 \ No newline at end of file