From 2b892abf9ed686969273b85406fef77a94b14006 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Fri, 8 Oct 2021 17:43:37 -0400 Subject: [PATCH 1/9] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index e9de972b0..b40da2f1c 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.6] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 07October2021v2-Beta +! Version: 08October2021v1-Beta ! Expires: 5 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -1237,6 +1237,14 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/commit/f7f114945c83b339be5cdd848e229680d9918abb#commitcomment-57642875 ||23.94.26.138^$all ||ispco.shop^$all +! Insert PR url here +! https://www.virustotal.com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community +||205.185.126.200^$all +||medpro-131.getfoxyproxy.org^$doc +! https://www.virustotal.com/gui/url/337dd5e5c53558dc7d6c8910b5ebe14a7390a78e13830b367363465b85ca8dd6?nocache=1 +||trytogoi.xyz^$all +! https://www.virustotal.com/gui/url/0f8791a82ee4d2c229ccbe3328092cdb2135027439778c280f1d2d3b0fdba1bb +||apple-technicalsupport-icloud.com^$all ! ——— Standard malware that I stumbled upon on my own ——— ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 From 0acff7666467cffac6ac70103b18dd6a67b0bcca Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sat, 9 Oct 2021 10:47:48 -0400 Subject: [PATCH 2/9] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 81 +++++++++++++++++++++++- 1 file changed, 80 insertions(+), 1 deletion(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index b40da2f1c..9daa5bc25 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.6] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 08October2021v1-Beta +! Version: 09October2021v1-Beta ! Expires: 5 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -1245,6 +1245,85 @@ zombooru.com##a[href="http://www.hard55.com"] ||trytogoi.xyz^$all ! https://www.virustotal.com/gui/url/0f8791a82ee4d2c229ccbe3328092cdb2135027439778c280f1d2d3b0fdba1bb ||apple-technicalsupport-icloud.com^$all +! https://www.virustotal.com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community +||185.243.56.167^$all +! https://www.virustotal.com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community +||123.10.224.135^$all +||59.47.187.147^$all +||39.68.172.210^$all +||122.192.177.176^$all +||112.27.124.108^$all +||123.110.176.246^$all +||219.155.105.98^$all +||171.35.161.209^$all +||60.16.255.36^$all +||112.30.4.52^$all +||182.121.191.201^$all +||121.61.48.170^$all +||39.81.68.45^$all +||27.222.220.164^$all +||113.233.215.135^$all +||151.77.100.133^$all +||125.120.13.184^$all +||120.12.138.133^$all +||27.194.115.185^$all +||104.128.199.228^$all +||183.92.123.145^$all +||110.89.8.126^$all +||125.43.211.184^$all +||1.0.218.230^$all +||221.208.4.56^$all +||60.13.60.19^$all +||171.37.29.87^$all +||124.91.237.188^$all +||115.56.137.49^$all +||115.52.240.69^$all +||112.252.132.185^$all +||117.198.240.157^$all +||42.53.240.249^$all +||116.179.138.68^$all +||110.241.119.159^$all +||115.56.31.133^$all +||103.19.128.222^$all +||202.12.80.74^$all +||61.52.8.62^$all +||182.122.252.69^$all +||219.155.26.50^$all +||120.4.141.185^$all +||119.102.7.115^$all +||72.51.127.213^$all +||111.224.199.91^$all +||119.250.236.122^$all +||112.30.110.58^$all +! https://www.virustotal.com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community +||pcae.de^$doc +! https://www.virustotal.com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community +||117.196.49.21^$all +||115.55.54.234^$all +||115.52.17.123^$all +||182.59.69.21^$all +! https://www.virustotal.com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community +||api.chip-secured-download.de^$all +! https://www.virustotal.com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb +! domains which resolve to this (already blocked) ip - for users of HOSTs/Domains/uBlock Origin +||ujgjyjltunl.com^$all +||pvyvglaf.com^$all +||ecsfunhget.com^$all +||xemfrctctdnlhe.com^$all +||tgxcmcoikpgek.com^$all +||lghdoxzulv.com^$all +||knxntpsd.com^$all +||nctylivpwhpby.com^$all +||phhitgjxsit.com^$all +! https://www.virustotal.com/gui/url/b2936e74f35940d2f09cabf4e089a0d655e62a5fc08ad32e1fae79a62683683f?nocache=1 +||saimission.org^$all +! https://www.virustotal.com/gui/url/4c2c3cf2e4f5b9ac9765eb9c58f2756d8f0f4632ec707107afe3c111f4749025?nocache=1 +||grub-wa-saya.duckdns.org^$all +! https://www.virustotal.com/gui/file/a6e89d2bb1c2da1d852fb8e248f39cf7b3d4b0ea05a8d8f343d1b8e74d271d43/relations +||driversupport.com^$document +||front.driversupport.com^$all +||secure.driversupport.com^$all + ! ——— Standard malware that I stumbled upon on my own ——— ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 From 100f8a4590dab4386c1c1e16bba7dd1d875eb812 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sat, 9 Oct 2021 10:56:07 -0400 Subject: [PATCH 3/9] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 9daa5bc25..ce0c25085 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1323,6 +1323,13 @@ zombooru.com##a[href="http://www.hard55.com"] ||driversupport.com^$document ||front.driversupport.com^$all ||secure.driversupport.com^$all +! copied over from URLHaus +||thehotelshowdev.bitkit.dk^$all +! domains related to the above +||big5constructnigeria-staging.bitkit.dk^$all +||big5-nigeria.bitkit.dk^$all +||www.big5constructnigeria-staging.bitkit.dk^$all +||bromic-staging.bitkit.dk^$all ! ——— Standard malware that I stumbled upon on my own ——— From c26271c301e44ff14f3d5ad7ef1651826bc21c16 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sat, 9 Oct 2021 10:59:22 -0400 Subject: [PATCH 4/9] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index ce0c25085..3611c1e6b 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1237,7 +1237,7 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/commit/f7f114945c83b339be5cdd848e229680d9918abb#commitcomment-57642875 ||23.94.26.138^$all ||ispco.shop^$all -! Insert PR url here +! https://github.com/DandelionSprout/adfilt/pull/298 ! https://www.virustotal.com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community ||205.185.126.200^$all ||medpro-131.getfoxyproxy.org^$doc @@ -1320,7 +1320,7 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://www.virustotal.com/gui/url/4c2c3cf2e4f5b9ac9765eb9c58f2756d8f0f4632ec707107afe3c111f4749025?nocache=1 ||grub-wa-saya.duckdns.org^$all ! https://www.virustotal.com/gui/file/a6e89d2bb1c2da1d852fb8e248f39cf7b3d4b0ea05a8d8f343d1b8e74d271d43/relations -||driversupport.com^$document +||driversupport.com^$doc ||front.driversupport.com^$all ||secure.driversupport.com^$all ! copied over from URLHaus From b0ee3ddc34fa7269bba9e54abee6b04004a12623 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sat, 9 Oct 2021 12:39:52 -0400 Subject: [PATCH 5/9] Blocking MyCleanPC --- Dandelion Sprout's Anti-Malware List.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 3611c1e6b..6c4c865f7 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1330,6 +1330,11 @@ zombooru.com##a[href="http://www.hard55.com"] ||big5-nigeria.bitkit.dk^$all ||www.big5constructnigeria-staging.bitkit.dk^$all ||bromic-staging.bitkit.dk^$all +! a PUP +||mycleanpc.com^$doc +! related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'id protection' +||ustechsupport.com^$doc +||mycleanid.com^$doc ! ——— Standard malware that I stumbled upon on my own ——— From 7621477a29cb1da42ee76a25dd5fe44f067dcbc3 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sat, 9 Oct 2021 12:40:48 -0400 Subject: [PATCH 6/9] Fixing a typo --- Dandelion Sprout's Anti-Malware List.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 6c4c865f7..2e2fdc028 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1332,7 +1332,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||bromic-staging.bitkit.dk^$all ! a PUP ||mycleanpc.com^$doc -! related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'id protection' +! related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'id protection') ||ustechsupport.com^$doc ||mycleanid.com^$doc From 037ebb79133c69f2712cf96e679d6d243cc7ec54 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sat, 9 Oct 2021 12:44:47 -0400 Subject: [PATCH 7/9] Vermilion Strike --- Dandelion Sprout's Anti-Malware List.txt | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 2e2fdc028..bfdcfe3f7 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1335,6 +1335,16 @@ zombooru.com##a[href="http://www.hard55.com"] ! related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'id protection') ||ustechsupport.com^$doc ||mycleanid.com^$doc +! Vermilion Strike +! https://www.virustotal.com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations +||160.202.163.100^$all +! https://www.virustotal.com/gui/ip-address/160.202.163.100/relations +||microsoftkernel.com^$all +||update.microsoftkernel.com^$all +||hksupd.com^$all +||amazon.hksupd.com^$all +||microsofthk.com^$all +||update.microsofthk.com^$all ! ——— Standard malware that I stumbled upon on my own ——— From c105498c377e80494e602faa1b05cf7872329058 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sat, 9 Oct 2021 16:52:40 -0400 Subject: [PATCH 8/9] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index bfdcfe3f7..4a5b44ae6 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1335,6 +1335,8 @@ zombooru.com##a[href="http://www.hard55.com"] ! related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'id protection') ||ustechsupport.com^$doc ||mycleanid.com^$doc +! the main website for the company +||realdefen.se^$doc ! Vermilion Strike ! https://www.virustotal.com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations ||160.202.163.100^$all From af8c64930f1b33a1b906caf205c270fd38409aca Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Sun, 10 Oct 2021 03:26:12 +0200 Subject: [PATCH 9/9] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 4a5b44ae6..3761b7221 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1303,9 +1303,9 @@ zombooru.com##a[href="http://www.hard55.com"] ||115.52.17.123^$all ||182.59.69.21^$all ! https://www.virustotal.com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community -||api.chip-secured-download.de^$all +||chip-secured-download.de^$all ! https://www.virustotal.com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb -! domains which resolve to this (already blocked) ip - for users of HOSTs/Domains/uBlock Origin +! Domains which resolve to this (already blocked) IP - for users of HOSTs/Domains/uBlock Origin ||ujgjyjltunl.com^$all ||pvyvglaf.com^$all ||ecsfunhget.com^$all @@ -1321,33 +1321,26 @@ zombooru.com##a[href="http://www.hard55.com"] ||grub-wa-saya.duckdns.org^$all ! https://www.virustotal.com/gui/file/a6e89d2bb1c2da1d852fb8e248f39cf7b3d4b0ea05a8d8f343d1b8e74d271d43/relations ||driversupport.com^$doc -||front.driversupport.com^$all -||secure.driversupport.com^$all -! copied over from URLHaus +! Copied over from URLHaus ||thehotelshowdev.bitkit.dk^$all -! domains related to the above +! Domains related to the above ||big5constructnigeria-staging.bitkit.dk^$all ||big5-nigeria.bitkit.dk^$all -||www.big5constructnigeria-staging.bitkit.dk^$all ||bromic-staging.bitkit.dk^$all -! a PUP +! A PUP ||mycleanpc.com^$doc -! related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'id protection') +! Related domains owned by the same company and used for payment (the first is for 'tech support' scams, the second for their 'ID protection') ||ustechsupport.com^$doc ||mycleanid.com^$doc -! the main website for the company +! The main website for the MyCleanPC company ||realdefen.se^$doc ! Vermilion Strike ! https://www.virustotal.com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations ||160.202.163.100^$all ! https://www.virustotal.com/gui/ip-address/160.202.163.100/relations ||microsoftkernel.com^$all -||update.microsoftkernel.com^$all ||hksupd.com^$all -||amazon.hksupd.com^$all ||microsofthk.com^$all -||update.microsofthk.com^$all - ! ——— Standard malware that I stumbled upon on my own ——— ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666