From 7c41c1dd6bb640d3db275c5fec876cc42a704cae Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Mon, 13 Jul 2020 01:14:40 +0200 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 23 +++++++++++++++++-- .../AntiMalwareAdGuard.txt | 23 +++++++++++++++++-- .../AntiMalwareAdGuardHome.txt | 21 ++++++++++++++++- .../AntiMalwareDomains.txt | 13 ++++++++++- .../AntiMalwareHosts.txt | 13 ++++++++++- .../AntiMalwarePrivoxy.action | 17 +++++++++++++- .../AntiMalwareTPL.tpl | 21 ++++++++++++++++- 7 files changed, 122 insertions(+), 9 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index 2c5a33fb4..2b019a20b 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.4] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdBlock and Adblock Plus) -! Version: 26June2020v1-Beta +! Version: 13July2020v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -159,7 +159,8 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(SpyHunter) ! β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” -/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-party +/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-partyument,domain=icu|life|live +/^https://[a-z]{10,16}[0-9]{1,2}\.live/ument,domain=live ! β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” msn.com##.irisbanner @@ -249,6 +250,7 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” ||ppc.netnet44.net^ ||tncrun.net^ +||amanda.*.net^ ||54.174.156.141^ ||lucretius-ada.com^ ||tango-deg.com^ @@ -284,6 +286,16 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ||veremund-hon.com^ ! Source: desidert.no ||collectfasttracks.com^ +! Source: vn-zoom.com +||ttnrd.com^ +||amanda.*.com^ +||katie.*.com^ +||briana.*.com^ +||sarah.*.com^ +||pamela.*.com^ +||54.152.245.247^ +||35.172.40.232^ +||3.90.125.85^ ! β€”β€”β€” Found in random witness reports online β€”β€”β€” ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 @@ -310,9 +322,12 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! β€”β€”β€” Zero-width spaces/hyphens in lookalike domains β€”β€”β€” +! uBO support is removed until https://github.com/uBlockOrigin/uBlock-issues/issues/1146 is resolved + Β­* ​* + ! β€”β€”β€” These DNS resolver requests lead to localhost and can't ever receive a proper request β€”β€”β€” ! https://github.com/AdguardTeam/AdGuardHome/issues/1705 ||0.168.192.in-addr.arpa^ @@ -384,4 +399,8 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! https://github.com/DandelionSprout/adfilt/issues/71 ||imgvieweriri.com^ +! Japanese scam +! https://github.com/AdguardTeam/AdguardFilters/issues/58737 +/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/ument,domain=fun + ! Placeholder line for alternate list versions diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index d4cee9cfa..32a15e6cf 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ [AdGuard β‰₯6] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 26June2020v1-Beta +! Version: 13July2020v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -183,7 +183,8 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(SpyHunter) ! β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” -/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-party,empty,important +/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-party,empty,importantument,domain=icu|life|live +/^https://[a-z]{10,16}[0-9]{1,2}\.live/$empty,importantument,domain=live ! β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” msn.com##.irisbanner @@ -274,6 +275,7 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” ||ppc.netnet44.net^$empty,important ||tncrun.net^$empty,important +||amanda.*.net^$empty,important 54.174.156.141$network ||lucretius-ada.com^$empty,important ||tango-deg.com^$empty,important @@ -309,6 +311,16 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ||veremund-hon.com^$empty,important ! Source: desidert.no ||collectfasttracks.com^$empty,important +! Source: vn-zoom.com +||ttnrd.com^$empty,important +||amanda.*.com^$empty,important +||katie.*.com^$empty,important +||briana.*.com^$empty,important +||sarah.*.com^$empty,important +||pamela.*.com^$empty,important +54.152.245.247$network +35.172.40.232$network +3.90.125.85$network ! β€”β€”β€” Found in random witness reports online β€”β€”β€” ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 @@ -337,8 +349,11 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) !#endif ! β€”β€”β€” Zero-width spaces/hyphens in lookalike domains β€”β€”β€” +! uBO support is removed until https://github.com/uBlockOrigin/uBlock-issues/issues/1146 is resolved +!#if !ext_ublock Β­*$empty,important ​*$empty,important +!#endif ! β€”β€”β€” These DNS resolver requests lead to localhost and can't ever receive a proper request β€”β€”β€” ! https://github.com/AdguardTeam/AdGuardHome/issues/1705 @@ -411,4 +426,8 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! https://github.com/DandelionSprout/adfilt/issues/71 ||imgvieweriri.com^$empty,important +! Japanese scam +! https://github.com/AdguardTeam/AdguardFilters/issues/58737 +/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$empty,importantument,domain=fun + ! Placeholder line for alternate list versions diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index e5f1fb29d..34e1fc5e7 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.4] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard Home) -! Version: 26June2020v1-Beta +! Version: 13July2020v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -154,6 +154,7 @@ ! β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” /(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/ +/^https://[a-z]{10,16}[0-9]{1,2}\.live/$document,live ! β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” @@ -215,6 +216,7 @@ ! β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” ||ppc.netnet44.net^ ||tncrun.net^ +||amanda.*.net^ 54.174.156.141 ||lucretius-ada.com^ ||tango-deg.com^ @@ -250,6 +252,16 @@ ||veremund-hon.com^ ! Source: desidert.no ||collectfasttracks.com^ +! Source: vn-zoom.com +||ttnrd.com^ +||amanda.*.com^ +||katie.*.com^ +||briana.*.com^ +||sarah.*.com^ +||pamela.*.com^ +54.152.245.247 +35.172.40.232 +3.90.125.85 ! β€”β€”β€” Found in random witness reports online β€”β€”β€” ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 @@ -278,9 +290,12 @@ ! β€”β€”β€” Zero-width spaces/hyphens in lookalike domains β€”β€”β€” +! uBO support is removed until https://github.com/uBlockOrigin/uBlock-issues/issues/1146 is resolved + Β­* ​* + ! β€”β€”β€” These DNS resolver requests lead to localhost and can't ever receive a proper request β€”β€”β€” ! https://github.com/AdguardTeam/AdGuardHome/issues/1705 ||0.168.192.in-addr.arpa^ @@ -352,4 +367,8 @@ ! https://github.com/DandelionSprout/adfilt/issues/71 ||imgvieweriri.com^ +! Japanese scam +! https://github.com/AdguardTeam/AdguardFilters/issues/58737 +/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$document,fun + ! Placeholder line for alternate list versions diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 215ddf0c7..90e38dc5d 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 26June2020v1-Beta +# Version: 13July2020v1-Beta # Expires: 5 days # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. @@ -95,6 +95,7 @@ google-analytics.com # β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” + # β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” # β€”β€”β€” Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) β€”β€”β€” @@ -189,6 +190,11 @@ maowaotodowoo.net veremund-hon.com # Source: desidert.no collectfasttracks.com +# Source: vn-zoom.com +ttnrd.com +54.152.245.247 +35.172.40.232 +3.90.125.85 # β€”β€”β€” Found in random witness reports online β€”β€”β€” deviuser.com @@ -217,6 +223,8 @@ version.server # β€”β€”β€” Zero-width spaces/hyphens in lookalike domains β€”β€”β€” + + # β€”β€”β€” These DNS resolver requests lead to localhost and can't ever receive a proper request β€”β€”β€” 0.168.192.in-addr.arpa 1.168.192.in-addr.arpa @@ -238,4 +246,7 @@ rgithub.com # β€”β€”β€” User-submitted entries β€”β€”β€” imgvieweriri.com +# Japanese scam + + diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 9343ab23d..3d1d0e5fe 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Β«hostsΒ» file version) -# Version: 26June2020v1-Alpha +# Version: 13July2020v1-Alpha # Expires: 5 days # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. @@ -95,6 +95,7 @@ # β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” + # β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” # β€”β€”β€” Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) β€”β€”β€” @@ -189,6 +190,11 @@ 127.0.0.1 veremund-hon.com # Source: desidert.no 127.0.0.1 collectfasttracks.com +# Source: vn-zoom.com +127.0.0.1 ttnrd.com +127.0.0.1 54.152.245.247 +127.0.0.1 35.172.40.232 +127.0.0.1 3.90.125.85 # β€”β€”β€” Found in random witness reports online β€”β€”β€” 127.0.0.1 deviuser.com @@ -217,6 +223,8 @@ # β€”β€”β€” Zero-width spaces/hyphens in lookalike domains β€”β€”β€” + + # β€”β€”β€” These DNS resolver requests lead to localhost and can't ever receive a proper request β€”β€”β€” 127.0.0.1 0.168.192.in-addr.arpa 127.0.0.1 1.168.192.in-addr.arpa @@ -238,4 +246,7 @@ # β€”β€”β€” User-submitted entries β€”β€”β€” 127.0.0.1 imgvieweriri.com +# Japanese scam + + diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 8d842ecd4..92f8f93f5 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 26June2020v1-Alpha +# Version: 13July2020v1-Alpha # Expires: 5 days # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. @@ -177,6 +177,7 @@ # β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” .ppc.netnet44.net .tncrun.net +.amanda.*.net .54.174.156.141 .lucretius-ada.com .tango-deg.com @@ -212,6 +213,16 @@ .veremund-hon.com # Source: desidert.no .collectfasttracks.com +# Source: vn-zoom.com +.ttnrd.com +.amanda.*.com +.katie.*.com +.briana.*.com +.sarah.*.com +.pamela.*.com +.54.152.245.247 +.35.172.40.232 +.3.90.125.85 {+block} # β€”β€”β€” Found in random witness reports online β€”β€”β€” @@ -244,8 +255,10 @@ {+block} # β€”β€”β€” Zero-width spaces/hyphens in lookalike domains β€”β€”β€” +# Β­* ​* +# {+block} # β€”β€”β€” These DNS resolver requests lead to localhost and can't ever receive a proper request β€”β€”β€” @@ -272,6 +285,8 @@ # β€”β€”β€” User-submitted entries β€”β€”β€” .imgvieweriri.com +# Japanese scam + {-block} # Manually updated Privoxy version of the whitelisted domains from the other versions of this list. .coolcmd.tk diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 657471d06..6b92c7469 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 26June2020v1-Beta +# Version: 13July2020v1-Beta : expires = 5 # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -155,6 +155,7 @@ msFilterList # β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” - (apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live) + # β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” # β€”β€”β€” Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) β€”β€”β€” @@ -215,6 +216,7 @@ msFilterList # β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” -d ppc.netnet44.net -d tncrun.net + -d 54.174.156.141 -d lucretius-ada.com -d tango-deg.com @@ -250,6 +252,16 @@ msFilterList -d veremund-hon.com # Source: desidert.no -d collectfasttracks.com +# Source: vn-zoom.com +-d ttnrd.com + + + + + +-d 54.152.245.247 +-d 35.172.40.232 +-d 3.90.125.85 # β€”β€”β€” Found in random witness reports online β€”β€”β€” # https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 @@ -276,9 +288,12 @@ msFilterList # β€”β€”β€” Zero-width spaces hyphens in lookalike domains β€”β€”β€” +# uBO support is removed until https://github.com/uBlockOrigin/uBlock-issues/issues/1146/is/resolved + Β­* ​* + # β€”β€”β€” These DNS resolver requests lead to localhost and can't ever receive a proper request β€”β€”β€” # https://github.com/AdguardTeam/AdGuardHome/issues/1705 -d 0.168.192.in-addr.arpa @@ -304,4 +319,8 @@ msFilterList # https://github.com/DandelionSprout/adfilt/issues/71 -d imgvieweriri.com +# Japanese scam +# https://github.com/AdguardTeam/AdguardFilters/issues/58737 + + # Placeholder line for alternate list versions