From 7d22ad91f2bd1a290aebed2b1ba97927744a994b Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Mon, 6 Sep 2021 20:15:57 +0200 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 144 ++++++++++++++++-- .../AntiMalwareAdGuard.txt | 92 ++++++++++- .../AntiMalwareAdGuardHome.txt | 107 +++++++++++-- .../AntiMalwareDomains.txt | 54 ++++++- .../AntiMalwareHosts.txt | 54 ++++++- .../AntiMalwarePrivoxy.action | 52 ++++++- .../AntiMalwareTPL.tpl | 91 ++++++++++- 7 files changed, 560 insertions(+), 34 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index b246ff3df..f1ef88fc3 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,8 +1,8 @@ [Adblock Plus 3.6] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdBlock and Adblock Plus) -! Version: 02September2021v1-Beta +! Version: 06September2021v1-Beta ! Expires: 5 days -! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. +! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists ! Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english @@ -1449,17 +1449,18 @@ zombooru.com##a[href="http://www.hard55.com"] ||37.0.10.83^$popup ||newstepsco.com^ ||newstepsco.com^$popup -.duckdns.org^ +||duckdns.org^$domain=~www.duckdns.org +@@://duckdns.org^ ||chse-security-notifications.email^ ||chse-security-notifications.email^$popup ||secure-0*.ddnss.ch^ ||secure-0*.ddnss.ch^$popup -||lucdream.com^ument -||beastbuying.com^ument -||kokotrokot.com^ument +||lucdream.com^ +||beastbuying.com^ +||kokotrokot.com^ ||07ca17vejqqej990.inteo.xyz^ -||pesoaniz.com^ument -||plarium.com^ument +||pesoaniz.com^ +||plarium.com^ ||omnatuor.com^ ||omnatuor.com^$popup ||novitrk1.com^ @@ -1490,11 +1491,134 @@ zombooru.com##a[href="http://www.hard55.com"] ||covercenter.xyz^$popup ||gettrk.xyz^ ||gettrk.xyz^$popup -||trc.*.co^ument -||artofads.co^ument +||trc.*.co^ +||artofads.co^ ||pc-my-protection.xyz^ ||pc-my-protection.xyz^$popup ||beta-news.org^ +! https://github.com/DandelionSprout/adfilt/pull/266 +! https://www.virustotal.com/gui/domain/kirstialechulbard.space/relations +! https://www.virustotal.com/gui/ip-address/198.54.117.244/relations +||easywebverification2.info^ +||easywebverification2.info^$popup +||mywalletsconnectonline.com^ +||mywalletsconnectonline.com^$popup +||dashwoodestates.com^ +||dashwoodestates.com^$popup +||tdcanadasecurityweb54761.info^ +||tdcanadasecurityweb54761.info^$popup +||ghshb.com^ +||ghshb.com^$popup +||conncorrd.com^ +||conncorrd.com^$popup +||youtubepremiumuk.com^ +||youtubepremiumuk.com^$popup +||mobileapp-members.com^ +||mobileapp-members.com^$popup +||jumperctin.com^ +||jumperctin.com^$popup +||vm-business.online^ +||vm-business.online^$popup +||apple-map.help^ +||apple-map.help^$popup +||recover-delivery.com^ +||recover-delivery.com^$popup +! http://vxvault.net/ViriFiche.php?ID=44013 +! https://www.virustotal.com/gui/url/8066b87ad10ddb5466bc307bb48454139572f6c8c8f80a9734275ac89cf966af/detection +! https://www.virustotal.com/gui/url/826c451929420c4da32552f967fb1cab6467405a29c65b23802aaadb6a8c7505/detection +! https://safeweb.norton.com/report/show?url=192.3.110.170 +||192.3.110.170^ +||192.3.110.170^$popup +! https://www.virustotal.com/gui/file/0f242e89dd3f1685ace979a248300f7f414932b8a2a75af88585c427f2758c10/community +! https://www.virustotal.com/gui/url/f66829e7fd9e897db874d352ef7c7b46fce80d070bc24917bc7300559d29d014/detection +! https://www.virustotal.com/gui/url/75676a0f8d715afa318f380e214bbe7bc1f7b08c66740a320a888c8912212ad9/detection +||tochmini.mooo.com^ +||tochmini.mooo.com^$popup +! https://www.virustotal.com/gui/url/ce7a42f35eca4072ab018cb7f5f7fbaaa7f17c10f982a2fa2baa24122385a805/detection +! https://www.virustotal.com/gui/url/9324c63cab60da5f60dacb4b2b37a02f5a7e2a5b932d96440415a232da6ec0c2/detection +||leavemylinkpls.mooo.com^ +||leavemylinkpls.mooo.com^$popup +! https://forums.malwarebytes.com/topic/278209-removal-instructions-for-socialsearchconverter/ +||socialsearchconverter.com^ +||install.socialsearchconverter.com^ +||install.socialsearchconverter.com^$popup +||feed.socialsearchconverter.com^ +||feed.socialsearchconverter.com^$popup +||api.socialsearchconverter.com^ +||api.socialsearchconverter.com^$popup +||install1.notify-service.com^ +||install1.notify-service.com^$popup +||notify-service.com^ +||notify-service.com^$popup +||install.stream-all.com^ +||install.stream-all.com^$popup +! copied over from https://github.com/uBlockOrigin/uAssets/issues/9848 +||gghacks.com^ +||gghacks.com^$popup +||rewardsgiantusa.com^ +||promotionsonlineusa.com^ +||qualityhealth.com^ +||consumerproductsusa.com^ +||get-cracked.com^ +||get-cracked.com^$popup +||tinyurl.com/gp84uz2^ +||www.mediafiire.com^ +||www.mediafiire.com^$popup +||mediafiire.com^ +||d1xkyo9j4r7vnn.cloudfront.net^ +||d1xkyo9j4r7vnn.cloudfront.net^$popup +||onlinepromotionsusa.com^ +||w.promotionsonlineusa.com^ +||w.promotionsonlineusa.com^$popup +! https://securelist.com/apkpure-android-app-store-infected/101845/ +! https://www.virustotal.com/gui/url/866a25343864f03dc5a10105fda523bfbb6ed09c486d07fd31ca2b5306440089/detection +||wcf.seven1029.com^ +||wcf.seven1029.com^$popup +! https://www.virustotal.com/gui/url/9c66e331e455dc5c5c9d06e1a537580c9e4db279182d2285c07783e837806a16/detection +||foodin.site^ +||foodin.site^$popup +! https://github.com/AdguardTeam/AdguardFilters/issues/90947 +! https://www.virustotal.com/gui/url/07466d5d29da0af49d185e69ca35b996917c429d7b2f38b24607bbe708306177/detection +||hourfeedoil.top^ +||hourfeedoil.top^$popup +||b0dk11t.hourfeedoil.top^ +||b0dk11t.hourfeedoil.top^$popup +! https://www.virustotal.com/gui/file/f29908da1b8065356704e746f9e282378a7e5ae65c753e2e9fe02b214b5b792b/community +! https://www.virustotal.com/gui/url/cea7b7ccd54fabd22b14cff5521f13b9dca4fd06d47d0bc2119dac6b77ecc04d/detection +||serrtjw256jw565w.gq^ +||serrtjw256jw565w.gq^$popup +! https://github.com/AdguardTeam/AdguardFilters/issues/91506#issuecomment-904080849 +||totalav.com^ +||totalav.com^$popup +! https://www.virustotal.com/gui/file/c683bc3da4966110b419ac54d09a54ce798efdb51be398331d9ce011e2636fa9/community +! https://www.virustotal.com/gui/url/5618023ed5a768d7f879c0d599b9ba7cff0e9171201981256eeaf5ce8eb09fdb/detection +! https://www.virustotal.com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection +||91.241.19.38^ +||91.241.19.38^$popup +! https://www.virustotal.com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection +! https://safeweb.norton.com/report/show?url=telete.in +! https://www.siteadvisor.com/sitereport.html?url=telete.in +||telete.in^ +||telete.in^$popup +! https://www.virustotal.com/gui/file/e63b2d03e3fee2d538f8bd721b61dd3641284fa941087d846dea6f15cab40308/community +! https://www.virustotal.com/gui/url/fbbc8a671bff32539bd829a76f6df9f364a21ac2279922e64e3ec494a1669dd3/detection +||kiff.tech^ +||kiff.tech^$popup +! https://www.virustotal.com/gui/domain/kiff.tech/relations +! https://www.virustotal.com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection +||45.90.58.90^ +! https://www.virustotal.com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community +! https://www.virustotal.com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection +||95.85.89.98^ +||95.85.89.98^$popup +! https://www.virustotal.com/gui/url/fa1e39a425d65e8ae4e10a0c1552edd9d9e22ec3057cc7feccca114ee469303c/community +! https://www.virustotal.com/gui/url/d2efdd72a368b2573e3fb8b10f4058c0d41403c2fee829457390be07bb608ba6/detection +||physic-craft.us^ +||physic-craft.us^$popup +! https://github.com/DandelionSprout/adfilt/issues/267 +||tekhacks.net^ +||tekhacks.net^$popup +||mediafire.com/file/pj9jdm7iznc4d51/tekhacksnet_multi_loader.rar^ ! β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 29ba1d75c..8b3a0acce 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,8 +1,8 @@ [AdGuard versions from β‰₯2019] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 02September2021v1-Beta +! Version: 06September2021v1-Beta ! Expires: 5 days -! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. +! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists ! Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english @@ -974,7 +974,8 @@ zombooru.com##a[href="http://www.hard55.com"] 212.192.241.72$network 37.0.10.83$network ||newstepsco.com^$empty,important -.duckdns.org^$document +||duckdns.org^$document,domain=~www.duckdns.org +@@://duckdns.org^$document ||chse-security-notifications.email^$empty,important ||secure-0*.ddnss.ch^$empty,important ||lucdream.com^$document @@ -1003,6 +1004,91 @@ zombooru.com##a[href="http://www.hard55.com"] ||artofads.co^$document ||pc-my-protection.xyz^$empty,important ||beta-news.org^$document +! https://github.com/DandelionSprout/adfilt/pull/266 +! https://www.virustotal.com/gui/domain/kirstialechulbard.space/relations +! https://www.virustotal.com/gui/ip-address/198.54.117.244/relations +||easywebverification2.info^$empty,important +||mywalletsconnectonline.com^$empty,important +||dashwoodestates.com^$empty,important +||tdcanadasecurityweb54761.info^$empty,important +||ghshb.com^$empty,important +||conncorrd.com^$empty,important +||youtubepremiumuk.com^$empty,important +||mobileapp-members.com^$empty,important +||jumperctin.com^$empty,important +||vm-business.online^$empty,important +||apple-map.help^$empty,important +||recover-delivery.com^$empty,important +! http://vxvault.net/ViriFiche.php?ID=44013 +! https://www.virustotal.com/gui/url/8066b87ad10ddb5466bc307bb48454139572f6c8c8f80a9734275ac89cf966af/detection +! https://www.virustotal.com/gui/url/826c451929420c4da32552f967fb1cab6467405a29c65b23802aaadb6a8c7505/detection +! https://safeweb.norton.com/report/show?url=192.3.110.170 +192.3.110.170$network +! https://www.virustotal.com/gui/file/0f242e89dd3f1685ace979a248300f7f414932b8a2a75af88585c427f2758c10/community +! https://www.virustotal.com/gui/url/f66829e7fd9e897db874d352ef7c7b46fce80d070bc24917bc7300559d29d014/detection +! https://www.virustotal.com/gui/url/75676a0f8d715afa318f380e214bbe7bc1f7b08c66740a320a888c8912212ad9/detection +||tochmini.mooo.com^$empty,important +! https://www.virustotal.com/gui/url/ce7a42f35eca4072ab018cb7f5f7fbaaa7f17c10f982a2fa2baa24122385a805/detection +! https://www.virustotal.com/gui/url/9324c63cab60da5f60dacb4b2b37a02f5a7e2a5b932d96440415a232da6ec0c2/detection +||leavemylinkpls.mooo.com^$empty,important +! https://forums.malwarebytes.com/topic/278209-removal-instructions-for-socialsearchconverter/ +||socialsearchconverter.com^$document +||install.socialsearchconverter.com^$empty,important +||feed.socialsearchconverter.com^$empty,important +||api.socialsearchconverter.com^$empty,important +||install1.notify-service.com^$empty,important +||notify-service.com^$empty,important +||install.stream-all.com^$empty,important +! copied over from https://github.com/uBlockOrigin/uAssets/issues/9848 +||gghacks.com^$empty,important +||rewardsgiantusa.com^$document +||promotionsonlineusa.com^$document +||qualityhealth.com^$document +||consumerproductsusa.com^$document +||get-cracked.com^$empty,important +||tinyurl.com/gp84uz2^$document +||www.mediafiire.com^$empty,important +||mediafiire.com^$document +||d1xkyo9j4r7vnn.cloudfront.net^$empty,important +||onlinepromotionsusa.com^$document +||w.promotionsonlineusa.com^$empty,important +! https://securelist.com/apkpure-android-app-store-infected/101845/ +! https://www.virustotal.com/gui/url/866a25343864f03dc5a10105fda523bfbb6ed09c486d07fd31ca2b5306440089/detection +||wcf.seven1029.com^$empty,important +! https://www.virustotal.com/gui/url/9c66e331e455dc5c5c9d06e1a537580c9e4db279182d2285c07783e837806a16/detection +||foodin.site^$empty,important +! https://github.com/AdguardTeam/AdguardFilters/issues/90947 +! https://www.virustotal.com/gui/url/07466d5d29da0af49d185e69ca35b996917c429d7b2f38b24607bbe708306177/detection +||hourfeedoil.top^$empty,important +||b0dk11t.hourfeedoil.top^$empty,important +! https://www.virustotal.com/gui/file/f29908da1b8065356704e746f9e282378a7e5ae65c753e2e9fe02b214b5b792b/community +! https://www.virustotal.com/gui/url/cea7b7ccd54fabd22b14cff5521f13b9dca4fd06d47d0bc2119dac6b77ecc04d/detection +||serrtjw256jw565w.gq^$empty,important +! https://github.com/AdguardTeam/AdguardFilters/issues/91506#issuecomment-904080849 +||totalav.com^$empty,important +! https://www.virustotal.com/gui/file/c683bc3da4966110b419ac54d09a54ce798efdb51be398331d9ce011e2636fa9/community +! https://www.virustotal.com/gui/url/5618023ed5a768d7f879c0d599b9ba7cff0e9171201981256eeaf5ce8eb09fdb/detection +! https://www.virustotal.com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection +91.241.19.38$network +! https://www.virustotal.com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection +! https://safeweb.norton.com/report/show?url=telete.in +! https://www.siteadvisor.com/sitereport.html?url=telete.in +||telete.in^$empty,important +! https://www.virustotal.com/gui/file/e63b2d03e3fee2d538f8bd721b61dd3641284fa941087d846dea6f15cab40308/community +! https://www.virustotal.com/gui/url/fbbc8a671bff32539bd829a76f6df9f364a21ac2279922e64e3ec494a1669dd3/detection +||kiff.tech^$empty,important +! https://www.virustotal.com/gui/domain/kiff.tech/relations +! https://www.virustotal.com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection +45.90.58.90$network +! https://www.virustotal.com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community +! https://www.virustotal.com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection +95.85.89.98$network +! https://www.virustotal.com/gui/url/fa1e39a425d65e8ae4e10a0c1552edd9d9e22ec3057cc7feccca114ee469303c/community +! https://www.virustotal.com/gui/url/d2efdd72a368b2573e3fb8b10f4058c0d41403c2fee829457390be07bb608ba6/detection +||physic-craft.us^$empty,important +! https://github.com/DandelionSprout/adfilt/issues/267 +||tekhacks.net^$empty,important +||mediafire.com/file/pj9jdm7iznc4d51/tekhacksnet_multi_loader.rar^$document ! β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index b6c8fd61d..bbea640b4 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,8 +1,8 @@ [Adblock Plus 3.6] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard Home, and for AdGuard for Android/Windows' DNS filtering) -! Version: 02September2021v1-Beta +! Version: 06September2021v1-Beta ! Expires: 5 days -! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. +! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists ! Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english @@ -887,15 +887,17 @@ 212.192.241.72 37.0.10.83 ||newstepsco.com^ -.duckdns.org^ +||duckdns.org^ +@@||www.duckdns.org^ +@@://duckdns.org^ ||chse-security-notifications.email^ ||secure-0*.ddnss.ch^ -||lucdream.com^$document -||beastbuying.com^$document -||kokotrokot.com^$document +||lucdream.com^ +||beastbuying.com^ +||kokotrokot.com^ ||07ca17vejqqej990.inteo.xyz^ -||pesoaniz.com^$document -||plarium.com^$document +||pesoaniz.com^ +||plarium.com^ ||omnatuor.com^ ||novitrk1.com^ ||cu27t-evo29lution.xyz^ @@ -912,10 +914,95 @@ ||pushmeup.art^ ||covercenter.xyz^ ||gettrk.xyz^ -||trc.*.co^$document -||artofads.co^$document +||trc.*.co^ +||artofads.co^ ||pc-my-protection.xyz^ ||beta-news.org^ +! https://github.com/DandelionSprout/adfilt/pull/266 +! https://www.virustotal.com/gui/domain/kirstialechulbard.space/relations +! https://www.virustotal.com/gui/ip-address/198.54.117.244/relations +||easywebverification2.info^ +||mywalletsconnectonline.com^ +||dashwoodestates.com^ +||tdcanadasecurityweb54761.info^ +||ghshb.com^ +||conncorrd.com^ +||youtubepremiumuk.com^ +||mobileapp-members.com^ +||jumperctin.com^ +||vm-business.online^ +||apple-map.help^ +||recover-delivery.com^ +! http://vxvault.net/ViriFiche.php?ID=44013 +! https://www.virustotal.com/gui/url/8066b87ad10ddb5466bc307bb48454139572f6c8c8f80a9734275ac89cf966af/detection +! https://www.virustotal.com/gui/url/826c451929420c4da32552f967fb1cab6467405a29c65b23802aaadb6a8c7505/detection +! https://safeweb.norton.com/report/show?url=192.3.110.170 +192.3.110.170 +! https://www.virustotal.com/gui/file/0f242e89dd3f1685ace979a248300f7f414932b8a2a75af88585c427f2758c10/community +! https://www.virustotal.com/gui/url/f66829e7fd9e897db874d352ef7c7b46fce80d070bc24917bc7300559d29d014/detection +! https://www.virustotal.com/gui/url/75676a0f8d715afa318f380e214bbe7bc1f7b08c66740a320a888c8912212ad9/detection +||tochmini.mooo.com^ +! https://www.virustotal.com/gui/url/ce7a42f35eca4072ab018cb7f5f7fbaaa7f17c10f982a2fa2baa24122385a805/detection +! https://www.virustotal.com/gui/url/9324c63cab60da5f60dacb4b2b37a02f5a7e2a5b932d96440415a232da6ec0c2/detection +||leavemylinkpls.mooo.com^ +! https://forums.malwarebytes.com/topic/278209-removal-instructions-for-socialsearchconverter/ +||socialsearchconverter.com^ +||install.socialsearchconverter.com^ +||feed.socialsearchconverter.com^ +||api.socialsearchconverter.com^ +||install1.notify-service.com^ +||notify-service.com^ +||install.stream-all.com^ +! copied over from https://github.com/uBlockOrigin/uAssets/issues/9848 +||gghacks.com^ +||rewardsgiantusa.com^ +||promotionsonlineusa.com^ +||qualityhealth.com^ +||consumerproductsusa.com^ +||get-cracked.com^ + +||www.mediafiire.com^ +||mediafiire.com^ +||d1xkyo9j4r7vnn.cloudfront.net^ +||onlinepromotionsusa.com^ +||w.promotionsonlineusa.com^ +! https://securelist.com/apkpure-android-app-store-infected/101845/ +! https://www.virustotal.com/gui/url/866a25343864f03dc5a10105fda523bfbb6ed09c486d07fd31ca2b5306440089/detection +||wcf.seven1029.com^ +! https://www.virustotal.com/gui/url/9c66e331e455dc5c5c9d06e1a537580c9e4db279182d2285c07783e837806a16/detection +||foodin.site^ +! https://github.com/AdguardTeam/AdguardFilters/issues/90947 +! https://www.virustotal.com/gui/url/07466d5d29da0af49d185e69ca35b996917c429d7b2f38b24607bbe708306177/detection +||hourfeedoil.top^ +||b0dk11t.hourfeedoil.top^ +! https://www.virustotal.com/gui/file/f29908da1b8065356704e746f9e282378a7e5ae65c753e2e9fe02b214b5b792b/community +! https://www.virustotal.com/gui/url/cea7b7ccd54fabd22b14cff5521f13b9dca4fd06d47d0bc2119dac6b77ecc04d/detection +||serrtjw256jw565w.gq^ +! https://github.com/AdguardTeam/AdguardFilters/issues/91506#issuecomment-904080849 +||totalav.com^ +! https://www.virustotal.com/gui/file/c683bc3da4966110b419ac54d09a54ce798efdb51be398331d9ce011e2636fa9/community +! https://www.virustotal.com/gui/url/5618023ed5a768d7f879c0d599b9ba7cff0e9171201981256eeaf5ce8eb09fdb/detection +! https://www.virustotal.com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection +91.241.19.38 +! https://www.virustotal.com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection +! https://safeweb.norton.com/report/show?url=telete.in +! https://www.siteadvisor.com/sitereport.html?url=telete.in +||telete.in^ +! https://www.virustotal.com/gui/file/e63b2d03e3fee2d538f8bd721b61dd3641284fa941087d846dea6f15cab40308/community +! https://www.virustotal.com/gui/url/fbbc8a671bff32539bd829a76f6df9f364a21ac2279922e64e3ec494a1669dd3/detection +||kiff.tech^ +! https://www.virustotal.com/gui/domain/kiff.tech/relations +! https://www.virustotal.com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection +45.90.58.90 +! https://www.virustotal.com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community +! https://www.virustotal.com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection +95.85.89.98 +! https://www.virustotal.com/gui/url/fa1e39a425d65e8ae4e10a0c1552edd9d9e22ec3057cc7feccca114ee469303c/community +! https://www.virustotal.com/gui/url/d2efdd72a368b2573e3fb8b10f4058c0d41403c2fee829457390be07bb608ba6/detection +||physic-craft.us^ +! https://github.com/DandelionSprout/adfilt/issues/267 +||tekhacks.net^ + ! β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index bc28fbd2f..98f52bc28 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,7 +1,7 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 02September2021v1-Beta +# Version: 06September2021v1-Beta # Expires: 5 days -# Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. +# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. @@ -761,7 +761,7 @@ onesafesoftware.com 212.192.241.72 37.0.10.83 newstepsco.com - +duckdns.org chse-security-notifications.email lucdream.com beastbuying.com @@ -788,6 +788,54 @@ gettrk.xyz artofads.co pc-my-protection.xyz beta-news.org +easywebverification2.info +mywalletsconnectonline.com +dashwoodestates.com +tdcanadasecurityweb54761.info +ghshb.com +conncorrd.com +youtubepremiumuk.com +mobileapp-members.com +jumperctin.com +vm-business.online +apple-map.help +recover-delivery.com +192.3.110.170 +tochmini.mooo.com +leavemylinkpls.mooo.com +socialsearchconverter.com +install.socialsearchconverter.com +feed.socialsearchconverter.com +api.socialsearchconverter.com +install1.notify-service.com +notify-service.com +install.stream-all.com +gghacks.com +rewardsgiantusa.com +promotionsonlineusa.com +qualityhealth.com +consumerproductsusa.com +get-cracked.com + +www.mediafiire.com +mediafiire.com +d1xkyo9j4r7vnn.cloudfront.net +onlinepromotionsusa.com +w.promotionsonlineusa.com +wcf.seven1029.com +foodin.site +hourfeedoil.top +b0dk11t.hourfeedoil.top +serrtjw256jw565w.gq +totalav.com +91.241.19.38 +telete.in +kiff.tech +45.90.58.90 +95.85.89.98 +physic-craft.us +tekhacks.net + # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” downloadprovider.me diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 09688f165..b2706e3a9 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,7 +1,7 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Β«hostsΒ» file version) -# Version: 02September2021v1-Alpha +# Version: 06September2021v1-Alpha # Expires: 5 days -# Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. +# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. @@ -761,7 +761,7 @@ 127.0.0.1 212.192.241.72 127.0.0.1 37.0.10.83 127.0.0.1 newstepsco.com - +127.0.0.1 duckdns.org 127.0.0.1 chse-security-notifications.email 127.0.0.1 lucdream.com 127.0.0.1 beastbuying.com @@ -788,6 +788,54 @@ 127.0.0.1 artofads.co 127.0.0.1 pc-my-protection.xyz 127.0.0.1 beta-news.org +127.0.0.1 easywebverification2.info +127.0.0.1 mywalletsconnectonline.com +127.0.0.1 dashwoodestates.com +127.0.0.1 tdcanadasecurityweb54761.info +127.0.0.1 ghshb.com +127.0.0.1 conncorrd.com +127.0.0.1 youtubepremiumuk.com +127.0.0.1 mobileapp-members.com +127.0.0.1 jumperctin.com +127.0.0.1 vm-business.online +127.0.0.1 apple-map.help +127.0.0.1 recover-delivery.com +127.0.0.1 192.3.110.170 +127.0.0.1 tochmini.mooo.com +127.0.0.1 leavemylinkpls.mooo.com +127.0.0.1 socialsearchconverter.com +127.0.0.1 install.socialsearchconverter.com +127.0.0.1 feed.socialsearchconverter.com +127.0.0.1 api.socialsearchconverter.com +127.0.0.1 install1.notify-service.com +127.0.0.1 notify-service.com +127.0.0.1 install.stream-all.com +127.0.0.1 gghacks.com +127.0.0.1 rewardsgiantusa.com +127.0.0.1 promotionsonlineusa.com +127.0.0.1 qualityhealth.com +127.0.0.1 consumerproductsusa.com +127.0.0.1 get-cracked.com + +127.0.0.1 www.mediafiire.com +127.0.0.1 mediafiire.com +127.0.0.1 d1xkyo9j4r7vnn.cloudfront.net +127.0.0.1 onlinepromotionsusa.com +127.0.0.1 w.promotionsonlineusa.com +127.0.0.1 wcf.seven1029.com +127.0.0.1 foodin.site +127.0.0.1 hourfeedoil.top +127.0.0.1 b0dk11t.hourfeedoil.top +127.0.0.1 serrtjw256jw565w.gq +127.0.0.1 totalav.com +127.0.0.1 91.241.19.38 +127.0.0.1 telete.in +127.0.0.1 kiff.tech +127.0.0.1 45.90.58.90 +127.0.0.1 95.85.89.98 +127.0.0.1 physic-craft.us +127.0.0.1 tekhacks.net + # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” 127.0.0.1 downloadprovider.me diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 19b16f015..543a971a0 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,8 +1,8 @@ {+block} # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 02September2021v1-Alpha +# Version: 06September2021v1-Alpha # Expires: 5 days -# Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. +# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. {+block} # β€”β€”β€” Bad top-level domains β€”β€”β€” @@ -793,6 +793,54 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index b11fab70a..08de59f59 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,8 +1,8 @@ msFilterList # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 02September2021v1-Beta +# Version: 06September2021v1-Beta : expires = 5 -# Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. +# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists # Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english @@ -881,7 +881,7 @@ msFilterList -d 212.192.241.72 -d 37.0.10.83 -d newstepsco.com -uckdns.org +-d duckdns.org -d chse-security-notifications.email -d lucdream.com @@ -910,6 +910,91 @@ uckdns.org -d artofads.co -d pc-my-protection.xyz -d beta-news.org +# https://github.com/DandelionSprout/adfilt/pull/266 +# https://www.virustotal.com/gui/domain/kirstialechulbard.space/relations +# https://www.virustotal.com/gui/ip-address/198.54.117.244/relations +-d easywebverification2.info +-d mywalletsconnectonline.com +-d dashwoodestates.com +-d tdcanadasecurityweb54761.info +-d ghshb.com +-d conncorrd.com +-d youtubepremiumuk.com +-d mobileapp-members.com +-d jumperctin.com +-d vm-business.online +-d apple-map.help +-d recover-delivery.com +# http://vxvault.net/ViriFiche.php?ID=44013 +# https://www.virustotal.com/gui/url/8066b87ad10ddb5466bc307bb48454139572f6c8c8f80a9734275ac89cf966af/detection +# https://www.virustotal.com/gui/url/826c451929420c4da32552f967fb1cab6467405a29c65b23802aaadb6a8c7505/detection +# https://safeweb.norton.com/report/show?url=192.3.110.170 +-d 192.3.110.170 +# https://www.virustotal.com/gui/file/0f242e89dd3f1685ace979a248300f7f414932b8a2a75af88585c427f2758c10/community +# https://www.virustotal.com/gui/url/f66829e7fd9e897db874d352ef7c7b46fce80d070bc24917bc7300559d29d014/detection +# https://www.virustotal.com/gui/url/75676a0f8d715afa318f380e214bbe7bc1f7b08c66740a320a888c8912212ad9/detection +-d tochmini.mooo.com +# https://www.virustotal.com/gui/url/ce7a42f35eca4072ab018cb7f5f7fbaaa7f17c10f982a2fa2baa24122385a805/detection +# https://www.virustotal.com/gui/url/9324c63cab60da5f60dacb4b2b37a02f5a7e2a5b932d96440415a232da6ec0c2/detection +-d leavemylinkpls.mooo.com +# https://forums.malwarebytes.com/topic/278209-removal-instructions-for-socialsearchconverter/ +-d socialsearchconverter.com +-d install.socialsearchconverter.com +-d feed.socialsearchconverter.com +-d api.socialsearchconverter.com +-d install1.notify-service.com +-d notify-service.com +-d install.stream-all.com +# copied over from https://github.com/uBlockOrigin/uAssets/issues/9848 +-d gghacks.com +-d rewardsgiantusa.com +-d promotionsonlineusa.com +-d qualityhealth.com +-d consumerproductsusa.com +-d get-cracked.com +-d tinyurl.com gp84uz2 +-d www.mediafiire.com +-d mediafiire.com +-d d1xkyo9j4r7vnn.cloudfront.net +-d onlinepromotionsusa.com +-d w.promotionsonlineusa.com +# https://securelist.com/apkpure-android-app-store-infected/101845/ +# https://www.virustotal.com/gui/url/866a25343864f03dc5a10105fda523bfbb6ed09c486d07fd31ca2b5306440089/detection +-d wcf.seven1029.com +# https://www.virustotal.com/gui/url/9c66e331e455dc5c5c9d06e1a537580c9e4db279182d2285c07783e837806a16/detection +-d foodin.site +# https://github.com/AdguardTeam/AdguardFilters/issues/90947 +# https://www.virustotal.com/gui/url/07466d5d29da0af49d185e69ca35b996917c429d7b2f38b24607bbe708306177/detection +-d hourfeedoil.top +-d b0dk11t.hourfeedoil.top +# https://www.virustotal.com/gui/file/f29908da1b8065356704e746f9e282378a7e5ae65c753e2e9fe02b214b5b792b/community +# https://www.virustotal.com/gui/url/cea7b7ccd54fabd22b14cff5521f13b9dca4fd06d47d0bc2119dac6b77ecc04d/detection +-d serrtjw256jw565w.gq +# https://github.com/AdguardTeam/AdguardFilters/issues/91506#issuecomment-904080849 +-d totalav.com +# https://www.virustotal.com/gui/file/c683bc3da4966110b419ac54d09a54ce798efdb51be398331d9ce011e2636fa9/community +# https://www.virustotal.com/gui/url/5618023ed5a768d7f879c0d599b9ba7cff0e9171201981256eeaf5ce8eb09fdb/detection +# https://www.virustotal.com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection +-d 91.241.19.38 +# https://www.virustotal.com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection +# https://safeweb.norton.com/report/show?url=telete.in +# https://www.siteadvisor.com/sitereport.html?url=telete.in +-d telete.in +# https://www.virustotal.com/gui/file/e63b2d03e3fee2d538f8bd721b61dd3641284fa941087d846dea6f15cab40308/community +# https://www.virustotal.com/gui/url/fbbc8a671bff32539bd829a76f6df9f364a21ac2279922e64e3ec494a1669dd3/detection +-d kiff.tech +# https://www.virustotal.com/gui/domain/kiff.tech/relations +# https://www.virustotal.com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection +-d 45.90.58.90 +# https://www.virustotal.com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community +# https://www.virustotal.com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection +-d 95.85.89.98 +# https://www.virustotal.com/gui/url/fa1e39a425d65e8ae4e10a0c1552edd9d9e22ec3057cc7feccca114ee469303c/community +# https://www.virustotal.com/gui/url/d2efdd72a368b2573e3fb8b10f4058c0d41403c2fee829457390be07bb608ba6/detection +-d physic-craft.us +# https://github.com/DandelionSprout/adfilt/issues/267 +-d tekhacks.net +-d mediafire.com file pj9jdm7iznc4d51 tekhacksnet_multi_loader.rar # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” # http://www.toorgle.net/results.php?q=fetishkitsch&security=666