From 784bd947bcadcf842f29078053b4236e242500a0 Mon Sep 17 00:00:00 2001
From: Imre Kristoffer Eilertsen <imreeil42@gmail.com>
Date: Tue, 21 Nov 2023 19:12:25 +0100
Subject: [PATCH] Fix #877

Made possible by https://github.com/AdguardTeam/HostlistCompiler/pull/50#issuecomment-1821395498
---
 .../AntiMalwareABP.txt                        |   3 +-
 .../AntiMalwareAdGuard.txt                    |   3 +-
 .../AntiMalwareAdGuardHome.txt                | 122 +++---------------
 .../AntiMalwareDomains.txt                    |   2 +-
 .../AntiMalwareHosts.txt                      |   2 +-
 .../AntiMalwarePrivoxy.action                 |   2 +-
 .../AntiMalwareTPL.tpl                        |   2 +-
 7 files changed, 28 insertions(+), 108 deletions(-)

diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt
index 36b5f35d9..04648dff8 100644
--- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt	
+++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt	
@@ -1,6 +1,6 @@
 [Adblock Plus 3.13]
 ! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus and AdBlock)
-! Version: 14November2023v1
+! Version: 19November2023v1
 ! Expires: 2 days
 ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
 ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -44791,6 +44791,7 @@ tumblr.com#?#div[tabindex][style]:has(a[href*="tinyurl."]:has-text(_1+8_))
 ||ybd001.com^
 ||ybd001.com^$popup
 tumblr.com#?#:is(.post,div[data-cell-id][style]:not([data-cell-id*=carousel]),div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has-text( click & chat me ):has-text(🔞)
+tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has(a[rel=author]:has-text(/^[a-z]{2,6}-[a-z]{2,6}[0-9]{2}$/i)):has-text(/18|sex/i)
 ! Google results for «SodaStream site:no cranberry»
 /^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/
 ||adservice.google.*/ddm/clk/
diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt
index b3de898fb..fd62c42a5 100644
--- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt	
+++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt	
@@ -1,6 +1,6 @@
 [AdGuard]
 ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard)
-! Version: 14November2023v1
+! Version: 19November2023v1
 ! Expires: 2 days
 ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
 ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -23053,6 +23053,7 @@ tumblr.com#?#div[tabindex][style]:has(a[href*="tinyurl."]:has-text(_1+8_))
 ||shua999.com^$all
 ||ybd001.com^$all
 tumblr.com#?#:is(.post,div[data-cell-id][style]:not([data-cell-id*=carousel]),div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has-text( click & chat me ):has-text(🔞)
+tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has(a[rel=author]:has-text(/^[a-z]{2,6}-[a-z]{2,6}[0-9]{2}$/i)):has-text(/18|sex/i)
 ! Google results for «SodaStream site:no cranberry»
 /^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$document
 ||adservice.google.*/ddm/clk/$document
diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt
index 8d8807e8d..ef9e8eb78 100644
--- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt	
+++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt	
@@ -1,6 +1,6 @@
 [Adblock Plus 3.13]
 ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows' DNS filtering, and Pi-Hole FTL ≥5.22)
-! Version: 14November2023v1
+! Version: 19November2023v1
 ! Expires: 2 days
 ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
 ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -14,88 +14,27 @@
 ! Mali (Put on break due to too many and too frequent whitelistings being needed)
 
 ! Equatorial Guinea
-||*.gq^
-@@||inege.gq^
-@@||tvgelive.gq^
-@@||siteproxy.gq^
-@@||blockly.gq^
+||*.gq^$denyallow=inege.gq|tvgelive.gq|siteproxy.gq|blockly.gq
 ! Central African Republic
-||*.cf^
-@@||google.cf^
-@@||rths.cf^
-@@||acap.cf^
+||*.cf^$denyallow=google.cf|rths.cf|acap.cf
 ! Palau (Put on break due to too many whitelistings being needed)
-!!!||pw^
-@@||libgen.pw^
-@@||petridish.pw^
-@@||palaugov.pw^
-@@||dpc.pw^
-@@||buttercup.pw^
-@@||rezka.pw^
-@@||darkcrystal.pw^
-@@||xor.pw^
-@@||fullhdfilmizlesene.pw^
-@@||gopass.pw^
-@@||vost.pw^
-@@||core.pw^
-@@||bittor.pw^
-@@||plutonium.pw^
-@@||nitter.pw^
-@@||kge.pw^
+!!!||pw^~libgen.pw|petridish.pw|palaugov.pw|dpc.pw|buttercup.pw|rezka.pw|darkcrystal.pw|xor.pw|fullhdfilmizlesene.pw|gopass.pw|vost.pw|core.pw|bittor.pw|plutonium.pw|nitter.pw|kge.pw
 ! Legitimate use is almost non-existent, but has a tiny userbase in Japan. Its extreme common-ness in malware redirections means that the entry will be kept forever.
-||*.top^
-@@||caitlin.top^
-@@||corriente.top^
-@@||gdtot.top^
-@@||nicenature.top^
-@@||reminder.top^
-@@||magocoro.top^
-@@||castlevania.top^
-@@||suiten.top^
-@@||shucks.top^
-@@||1stream.top^
-@@||ambr.top^
-@@||techblog.top^
-@@||changlam10.top^
-@@||changlam11.top^
-@@||pdcdn1.top^
-@@||mastodon.top^
-@@||pressplay.top^
-@@||chillx.top^
-@@||strims.top^
-@@||thedesk.top^
-@@||audioforyou.top^
+||*.top^$denyallow=caitlin.top|corriente.top|gdtot.top|nicenature.top|reminder.top|magocoro.top|castlevania.top|suiten.top|shucks.top|1stream.top|ambr.top|techblog.top|changlam10.top|changlam11.top|pdcdn1.top|mastodon.top|pressplay.top|chillx.top|strims.top|thedesk.top|audioforyou.top
 ! International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent.
 ||*.loan^
-||*.agency^
-@@||battlefield.agency^
-@@||baam.agency^
-@@||robotzebra.agency^
-@@||uphotel.agency^
-@@||ws.agency^
-||*.gdn^
-@@||cst.gdn^
+||*.agency^$denyallow=battlefield.agency|baam.agency|robotzebra.agency|uphotel.agency|ws.agency
+||*.gdn^$denyallow=cst.gdn
 ||*.bid^
-||*.ooo^
-@@||toast.ooo^
+||*.ooo^$denyallow=toast.ooo
 ! https://bgp.he.net/AS202492#_prefixes (17/07/2022)
-!!!||monster^
-@@||egybest.monster^
-@@||yts.monster^
-@@||cloudcdn.monster^
-@@||fedi.monster^
-@@||rollenspiel.monster^
-@@||tts.monster^
-@@||geometry.monster^
+!!!||monster^~egybest.monster|yts.monster|cloudcdn.monster|fedi.monster|rollenspiel.monster|tts.monster|geometry.monster
 ! https://github.com/AdguardTeam/AdguardFilters/issues/131156
 ||*.sbs^
 ! https://github.com/DandelionSprout/adfilt/issues/659
-||*.discount^
-@@||real.discount^
+||*.discount^$denyallow=real.discount
 ! https://github.com/AdguardTeam/AdguardFilters/issues/137635
-||*.cfd^
-@@||frcoal.cfd^
-@@||freedium.cfd^
+||*.cfd^$denyallow=frcoal.cfd|freedium.cfd
 ! Experimental attempt to cover a few hardcore spam ASNs
 
 
@@ -4393,7 +4332,7 @@
 115.194.38.143
 61.52.79.32
 ! https://scammer.info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466
-://ups-dk.$denyallow=dk|nu|se|no|fo|gl|ups.com|ups-dk.*
+://ups-dk.$denyallow=dk|nu|se|no|fo|gl|ups.com,ups-dk.*
 ! https://www.virustotal.com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1
 ||lowseelan.com^
 ! https://www.virustotal.com/gui/file/50fd813cf8fe981e6aee179f8ba394e5527c5128b84c328f9f8347cd994bbc42/community
@@ -17098,8 +17037,7 @@
 
 ! https://github.com/AdguardTeam/AdguardFilters/issues/161364
 ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497)
-/(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev^
-@@||archive.*
+/(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~com|org|net|co|blog|community|host|io|microsoft|office|uk|us|xn--fiqs8s|dev|archive.*
 ||github.sale^
 ! https://www.tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
 ||0nedr1ved0cumentonline.com^
@@ -22911,38 +22849,18 @@
 ||githubt.com^
 
 ! ——— Usually used by various groups who buy old domains and display illicit ads on them ———
-://ww4.
-@@||ww4.ikea.com^
-://ww5.
-@@||ww5.ikea.com^
-@@||ww5.msu.ac.zw^
-://ww6.
-@@||ww6.generali.pt^
-://ww7.
-@@||ww7.be^
-@@||ww7.readsnk.com^
-://ww8.
-@@||ww8.co^
-@@||ww8.ikea.com^
-@@||ww8.tiki.ne.jp^
-@@||ww8.erovoice.us^
-@@||ww8.anyanime.com^
-@@||ww8.bakushpal.az^
-@@||ww8.tokyoghoulre.com^
-@@||ww8.readonepiece.com^
-://ww9.
-@@||ww9.ikea.com^
-@@||ww9.tiki.ne.jp^
-@@||ww9.sakura.ne.jp^
-@@||ww9.generali.pt^
-@@||ww9.itau.com.br^
+://ww4.$denyallow=ww4.ikea.com
+://ww5.$denyallow=ww5.ikea.com|ww5.msu.ac.zw
+://ww6.$denyallow=ww6.generali.pt
+://ww7.$denyallow=ww7.be|ww7.readsnk.com
+://ww8.$denyallow=ww8.co|ww8.ikea.com|ww8.tiki.ne.jp|ww8.erovoice.us|ww8.anyanime.com|ww8.bakushpal.az|ww8.tokyoghoulre.com|ww8.readonepiece.com
+://ww9.$denyallow=ww9.ikea.com|ww9.tiki.ne.jp|ww9.sakura.ne.jp|ww9.generali.pt|ww9.itau.com.br
 ://ww10.
 ://ww11.
 ://ww12.
 ://ww13.
 ://ww14.
-://ww15.
-@@||ww15.nl^
+://ww15.$denyallow=ww15.nl
 ://ww16.
 ://ww17.
 ://ww18.
diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt
index bc4476dd7..69f6583cd 100644
--- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt	
+++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt	
@@ -1,5 +1,5 @@
 # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version)
-# Version: 14November2023v1
+# Version: 19November2023v1
 # Expires: 2 days
 # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
 
diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt
index 8c1032690..e3bc11590 100644
--- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt	
+++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt	
@@ -1,5 +1,5 @@
 # Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version)
-# Version: 14November2023v1
+# Version: 19November2023v1
 # Expires: 2 days
 # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
 
diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action
index 5c21f76d4..c6a71e31b 100644
--- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action	
+++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action	
@@ -1,6 +1,6 @@
 {+block}
 # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy)
-# Version: 14November2023v1-Deprecated
+# Version: 19November2023v1-Deprecated
 # Expires: 2 days
 # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
 
diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl
index 74a9ae362..6568f3b69 100644
--- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl	
+++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl	
@@ -1,6 +1,6 @@
 msFilterList
 # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL)
-# Version: 14November2023v1-Deprecated
+# Version: 19November2023v1-Deprecated
 : expires = 2 days
 # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
 # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists