Add files via upload

2026-10-04 22:04:19 +01:00 · 2020-07-13 01:14:40 +02:00
parent 0684ed123a
commit 7c41c1dd6b
7 changed files with 122 additions and 9 deletions
@@ -1,6 +1,6 @@
 [Adblock Plus 3.4]
 ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdBlock and Adblock Plus)
-! Version: 26June2020v1-Beta
+! Version: 13July2020v1-Beta
 ! Expires: 5 days
 ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.
 ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -159,7 +159,8 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer)
 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(SpyHunter)

 ! ——— Sites that fraudulently claim you've won a new phone ———
-/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-party
+/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-partyument,domain=icu|life|live
+/^https://[a-z]{10,16}[0-9]{1,2}\.live/ument,domain=live

 ! ——— Banner for "MSN New Tab" ———
 msn.com##.irisbanner
@@ -249,6 +250,7 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
 ! ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
 ||ppc.netnet44.net^
 ||tncrun.net^
+||amanda.*.net^
 ||54.174.156.141^
 ||lucretius-ada.com^
 ||tango-deg.com^
@@ -284,6 +286,16 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
 ||veremund-hon.com^
 ! Source: desidert.no
 ||collectfasttracks.com^
+! Source: vn-zoom.com
+||ttnrd.com^
+||amanda.*.com^
+||katie.*.com^
+||briana.*.com^
+||sarah.*.com^
+||pamela.*.com^
+||54.152.245.247^
+||35.172.40.232^
+||3.90.125.85^

 ! ——— Found in random witness reports online ———
 ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315
@@ -310,9 +322,12 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)


 ! ——— Zero-width spaces/hyphens in lookalike domains ———
+! uBO support is removed until https://github.com/uBlockOrigin/uBlock-issues/issues/1146 is resolved
+
 *
 *

+
 ! ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ———
 ! https://github.com/AdguardTeam/AdGuardHome/issues/1705
 ||0.168.192.in-addr.arpa^
@@ -384,4 +399,8 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
 ! https://github.com/DandelionSprout/adfilt/issues/71
 ||imgvieweriri.com^

+! Japanese scam
+! https://github.com/AdguardTeam/AdguardFilters/issues/58737
+/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/ument,domain=fun
+
 ! Placeholder line for alternate list versions
@@ -1,6 +1,6 @@
 [AdGuard ≥6]
 ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard)
-! Version: 26June2020v1-Beta
+! Version: 13July2020v1-Beta
 ! Expires: 5 days
 ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.
 ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -183,7 +183,8 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer)
 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(SpyHunter)

 ! ——— Sites that fraudulently claim you've won a new phone ———
-/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-party,empty,important
+/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-party,empty,importantument,domain=icu|life|live
+/^https://[a-z]{10,16}[0-9]{1,2}\.live/$empty,importantument,domain=live

 ! ——— Banner for "MSN New Tab" ———
 msn.com##.irisbanner
@@ -274,6 +275,7 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
 ! ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
 ||ppc.netnet44.net^$empty,important
 ||tncrun.net^$empty,important
+||amanda.*.net^$empty,important
 54.174.156.141$network
 ||lucretius-ada.com^$empty,important
 ||tango-deg.com^$empty,important
@@ -309,6 +311,16 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
 ||veremund-hon.com^$empty,important
 ! Source: desidert.no
 ||collectfasttracks.com^$empty,important
+! Source: vn-zoom.com
+||ttnrd.com^$empty,important
+||amanda.*.com^$empty,important
+||katie.*.com^$empty,important
+||briana.*.com^$empty,important
+||sarah.*.com^$empty,important
+||pamela.*.com^$empty,important
+54.152.245.247$network
+35.172.40.232$network
+3.90.125.85$network

 ! ——— Found in random witness reports online ———
 ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315
@@ -337,8 +349,11 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
 !#endif

 ! ——— Zero-width spaces/hyphens in lookalike domains ———
+! uBO support is removed until https://github.com/uBlockOrigin/uBlock-issues/issues/1146 is resolved
+!#if !ext_ublock
 *$empty,important
 *$empty,important
+!#endif

 ! ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ———
 ! https://github.com/AdguardTeam/AdGuardHome/issues/1705
@@ -411,4 +426,8 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
 ! https://github.com/DandelionSprout/adfilt/issues/71
 ||imgvieweriri.com^$empty,important

+! Japanese scam
+! https://github.com/AdguardTeam/AdguardFilters/issues/58737
+/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$empty,importantument,domain=fun
+
 ! Placeholder line for alternate list versions
@@ -1,6 +1,6 @@
 [Adblock Plus 3.4]
 ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home)
-! Version: 26June2020v1-Beta
+! Version: 13July2020v1-Beta
 ! Expires: 5 days
 ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.
 ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -154,6 +154,7 @@

 ! ——— Sites that fraudulently claim you've won a new phone ———
 /(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/
+/^https://[a-z]{10,16}[0-9]{1,2}\.live/$document,live

 ! ——— Banner for "MSN New Tab" ———

@@ -215,6 +216,7 @@
 ! ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
 ||ppc.netnet44.net^
 ||tncrun.net^
+||amanda.*.net^
 54.174.156.141
 ||lucretius-ada.com^
 ||tango-deg.com^
@@ -250,6 +252,16 @@
 ||veremund-hon.com^
 ! Source: desidert.no
 ||collectfasttracks.com^
+! Source: vn-zoom.com
+||ttnrd.com^
+||amanda.*.com^
+||katie.*.com^
+||briana.*.com^
+||sarah.*.com^
+||pamela.*.com^
+54.152.245.247
+35.172.40.232
+3.90.125.85

 ! ——— Found in random witness reports online ———
 ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315
@@ -278,9 +290,12 @@


 ! ——— Zero-width spaces/hyphens in lookalike domains ———
+! uBO support is removed until https://github.com/uBlockOrigin/uBlock-issues/issues/1146 is resolved
+
 *
 *

+
 ! ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ———
 ! https://github.com/AdguardTeam/AdGuardHome/issues/1705
 ||0.168.192.in-addr.arpa^
@@ -352,4 +367,8 @@
 ! https://github.com/DandelionSprout/adfilt/issues/71
 ||imgvieweriri.com^

+! Japanese scam
+! https://github.com/AdguardTeam/AdguardFilters/issues/58737
+/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$document,fun
+
 ! Placeholder line for alternate list versions
@@ -1,5 +1,5 @@
 # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version)
-# Version: 26June2020v1-Beta
+# Version: 13July2020v1-Beta
 # Expires: 5 days
 # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.

@@ -95,6 +95,7 @@ google-analytics.com
 # ——— Sites that fraudulently claim you've won a new phone ———


+
 # ——— Banner for "MSN New Tab" ———

 # ——— Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) ———
@@ -189,6 +190,11 @@ maowaotodowoo.net
 veremund-hon.com
 # Source: desidert.no
 collectfasttracks.com
+# Source: vn-zoom.com
+ttnrd.com
+54.152.245.247
+35.172.40.232
+3.90.125.85

 # ——— Found in random witness reports online ———
 deviuser.com
@@ -217,6 +223,8 @@ version.server

 # ——— Zero-width spaces/hyphens in lookalike domains ———

+
+
 # ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ———
 0.168.192.in-addr.arpa
 1.168.192.in-addr.arpa
@@ -238,4 +246,7 @@ rgithub.com
 # ——— User-submitted entries ———
 imgvieweriri.com

+# Japanese scam
+
+

@@ -1,5 +1,5 @@
 # Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version)
-# Version: 26June2020v1-Alpha
+# Version: 13July2020v1-Alpha
 # Expires: 5 days
 # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.

@@ -95,6 +95,7 @@
 # ——— Sites that fraudulently claim you've won a new phone ———


+
 # ——— Banner for "MSN New Tab" ———

 # ——— Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) ———
@@ -189,6 +190,11 @@
 127.0.0.1 veremund-hon.com
 # Source: desidert.no
 127.0.0.1 collectfasttracks.com
+# Source: vn-zoom.com
+127.0.0.1 ttnrd.com
+127.0.0.1 54.152.245.247
+127.0.0.1 35.172.40.232
+127.0.0.1 3.90.125.85

 # ——— Found in random witness reports online ———
 127.0.0.1 deviuser.com
@@ -217,6 +223,8 @@

 # ——— Zero-width spaces/hyphens in lookalike domains ———

+
+
 # ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ———
 127.0.0.1 0.168.192.in-addr.arpa
 127.0.0.1 1.168.192.in-addr.arpa
@@ -238,4 +246,7 @@
 # ——— User-submitted entries ———
 127.0.0.1 imgvieweriri.com

+# Japanese scam
+
+

@@ -1,6 +1,6 @@
 {+block}
 # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy)
-# Version: 26June2020v1-Alpha
+# Version: 13July2020v1-Alpha
 # Expires: 5 days
 # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.

@@ -177,6 +177,7 @@
 # ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
 .ppc.netnet44.net
 .tncrun.net
+.amanda.*.net
 .54.174.156.141
 .lucretius-ada.com
 .tango-deg.com
@@ -212,6 +213,16 @@
 .veremund-hon.com
 # Source: desidert.no
 .collectfasttracks.com
+# Source: vn-zoom.com
+.ttnrd.com
+.amanda.*.com
+.katie.*.com
+.briana.*.com
+.sarah.*.com
+.pamela.*.com
+.54.152.245.247
+.35.172.40.232
+.3.90.125.85

 {+block}
 # ——— Found in random witness reports online ———
@@ -244,8 +255,10 @@

 {+block}
 # ——— Zero-width spaces/hyphens in lookalike domains ———
+#
 *
 *
+#

 {+block}
 # ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ———
@@ -272,6 +285,8 @@
 # ——— User-submitted entries ———
 .imgvieweriri.com

+# Japanese scam
+
 {-block}
 # Manually updated Privoxy version of the whitelisted domains from the other versions of this list.
 .coolcmd.tk
@@ -1,6 +1,6 @@
 msFilterList
 # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL)
-# Version: 26June2020v1-Beta
+# Version: 13July2020v1-Beta
 : expires = 5
 # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.
 # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -155,6 +155,7 @@ msFilterList
 # ——— Sites that fraudulently claim you've won a new phone ———
 - (apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live) 

+
 # ——— Banner for "MSN New Tab" ———

 # ——— Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) ———
@@ -215,6 +216,7 @@ msFilterList
 # ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
 -d ppc.netnet44.net
 -d tncrun.net
+
 -d 54.174.156.141
 -d lucretius-ada.com
 -d tango-deg.com
@@ -250,6 +252,16 @@ msFilterList
 -d veremund-hon.com
 # Source: desidert.no
 -d collectfasttracks.com
+# Source: vn-zoom.com
+-d ttnrd.com
+
+
+
+
+
+-d 54.152.245.247
+-d 35.172.40.232
+-d 3.90.125.85

 # ——— Found in random witness reports online ———
 # https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315
@@ -276,9 +288,12 @@ msFilterList


 # ——— Zero-width spaces hyphens in lookalike domains ———
+# uBO support is removed until https://github.com/uBlockOrigin/uBlock-issues/issues/1146/is/resolved
+
 *
 *

+
 # ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ———
 # https://github.com/AdguardTeam/AdGuardHome/issues/1705
 -d 0.168.192.in-addr.arpa
@@ -304,4 +319,8 @@ msFilterList
 # https://github.com/DandelionSprout/adfilt/issues/71
 -d imgvieweriri.com

+# Japanese scam
+# https://github.com/AdguardTeam/AdguardFilters/issues/58737
+
+
 # Placeholder line for alternate list versions