From 8afd4eea812130551a34b7113d64997c9be32528 Mon Sep 17 00:00:00 2001 From: Imre Eilertsen Date: Sat, 5 Oct 2024 01:56:07 +0200 Subject: [PATCH] Fix #1062 Fix #1063, take 3 --- .../AntiMalwareDomains.txt | 74 +++++++++++++++++-- .../AntiMalwareHosts.txt | 14 ++-- 2 files changed, 75 insertions(+), 13 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index a74828a8a..fb2fd7452 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -3,6 +3,7 @@ # Expires: 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway. +# Note 2: Users of Pi-Hole FTL 5.22 and later, and of AdGuard Home, are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists # Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#-english @@ -52,6 +53,29 @@ + + + + + + + + + + + + + + + + + + + + + + + # ——— Old dead tech-related domains ——— # Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. adblock.gjtech.net @@ -144,6 +168,9 @@ officialiqtests.com # https://windowsreport•com/extend-windows-laptop-battery-life/ # https://appuals•com/fix-error-0x800701e3-on-windows-7-8-1-10/ # https://ugetfix•com/ask/how-to-fix-windows-store-error-0x8000ffff/ + + + # https://www•thewindowsclub•com/fix-windows-update-error-0xc1900130-on-windows-10 # https://www•majorgeeks•com/files/details/patch_my_pc•html @@ -170,6 +197,7 @@ google-analytics.com # https://howtoremove•guide/redirector-gvt1-com-virus-malware-chrome-removal/ # https://www•2-spyware•com/remove-redirector-gvt1-com•html + # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-968070041 # https://www•cyclonis•com/how-to-create-gmail-account-without-phone-number/ # https://www•2-viruses•com/remove-ad-spam-press-allow-to-continue @@ -201,6 +229,7 @@ google-analytics.com driver-soft.com # ¤¤¤ Outbyte ¤¤¤ + outbyte.com testedforyou.net # ¤¤¤ PC Reviver ¤¤¤ @@ -209,6 +238,8 @@ testedforyou.net # ¤¤¤ WinThruster ¤¤¤ solvusoft.com + + # Common scam domain patterns @@ -256,6 +287,12 @@ witkey.com # ——— Browser extension store entries for notoriously poor or malicious adblocker forks ——— # Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages # Chrome Web Store + + + + + + # Mozilla Add-ons # These entries can be used in Firefox with regular browser extensions (uBO|AdGuard Browser Extension|ABP) by opening about:config, removing the "addons.mozilla.com" part from "extensions.webextensions.restrictedDomains", and then creating a new string called "privacy.resistFingerprinting.block_mozAddonManager" (That exact capitalisation must be used) set to (Boolean) true. # Homepages @@ -263,6 +300,14 @@ the1adblocker.com # Other sites + + + + + + + + # ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— ubuntu.org 103.224.212.249 @@ -3950,7 +3995,7 @@ vrthcobj.com rblxexploits.net youneerdmo.top image-find.com -://linkvertise.com/23001/OxygenU + usegetmarketings.com bestappever4you.com thecrs.club @@ -10643,7 +10688,7 @@ zogrepsili.com # https://github.com/AdguardTeam/AdguardFilters/issues/144823 !+ NOT_OPTIMIZED -:// + # https://github.com/AdguardTeam/AdguardFilters/issues/145513 achilles-par.com adrastos-eli.com @@ -17066,7 +17111,7 @@ yowlvernon.com zapdescendant.com zapprecisionadmire.com zealousstraitcommit.com -:// + # https://github.com/AdguardTeam/AdguardFilters/issues/159157 apbbjmp.com apptjmp.com @@ -23048,7 +23093,7 @@ youweb-bpm.com 208.91.189.203 -:// + # https://github.com/AdguardTeam/AdguardFilters/issues/189905 @@ -23098,7 +23143,7 @@ crazycrabreedville.com # https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021) messium.info # Various Google searches -://hullcitytigers.com +hullcitytigers.com # Various search results for 'kelloggs tresor' in Norwegian (30/05/2021) # https://fx-onlinee•blogspot•com/2021/06/?r=Bergens-Tidende-Flertallet-av-fastlegene-i-Trondheim-sier-nei-til-Janssen-vaksinen-Umulig-%C3%A5-ta-det-ansvaret-seo+aj @@ -25522,6 +25567,7 @@ dorderstar.xyz greaterfiledownload.com vlcmediadownload.com quiremuken.xyz + sexy-egirls-leaked.com file2share.co erothots.co @@ -26387,6 +26433,7 @@ josefseibeloutletnorge.com 158.222.7.83 # Spam on W.I.T.C.H. and Winx text search results + # A scam SMS I got 95-214-26-78.plesk.page account-limitato.org @@ -26660,6 +26707,10 @@ hitnslab.info # ——— Spam in comment sections across the internet about "working" from "home" ——— + + + + # ——— Upgrades HTTP requests to HTTPS on sites that don't do it automatically ——— @@ -26687,10 +26738,21 @@ mip.api.mcafeewebadvisor.com + + + + + + + + + + + # All legitimate Pac-Man games would use "pac-man" links with a dash # https://eclypsium•com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/ -http://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4 + # (Presumably anonymous) E-mail tips s.free.fr diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 58e3489ec..e0a2a26d3 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -2,7 +2,7 @@ # Version: 30September2024v2 # Expires: 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. -# Users of Pi-Hole FTL 5.22 and later are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven. +# Users of Pi-Hole FTL 5.22 and later, and of AdGuard Home, are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven. !#if !env_mv3 # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists # Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#-english @@ -3944,7 +3944,7 @@ 127.0.0.1 rblxexploits.net 127.0.0.1 youneerdmo.top 127.0.0.1 image-find.com -://linkvertise.com/23001/OxygenU + 127.0.0.1 usegetmarketings.com 127.0.0.1 bestappever4you.com 127.0.0.1 thecrs.club @@ -10637,7 +10637,7 @@ # https://github.com/AdguardTeam/AdguardFilters/issues/144823 !+ NOT_OPTIMIZED -:// + # https://github.com/AdguardTeam/AdguardFilters/issues/145513 127.0.0.1 achilles-par.com 127.0.0.1 adrastos-eli.com @@ -17060,7 +17060,7 @@ 127.0.0.1 zapdescendant.com 127.0.0.1 zapprecisionadmire.com 127.0.0.1 zealousstraitcommit.com -:// + # https://github.com/AdguardTeam/AdguardFilters/issues/159157 127.0.0.1 apbbjmp.com 127.0.0.1 apptjmp.com @@ -23042,7 +23042,7 @@ 127.0.0.1 208.91.189.203 !#if !ext_ublock -:// + !#endif # https://github.com/AdguardTeam/AdguardFilters/issues/189905 @@ -23092,7 +23092,7 @@ # https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021) 127.0.0.1 messium.info # Various Google searches -://hullcitytigers.com +127.0.0.1 hullcitytigers.com # Various search results for 'kelloggs tresor' in Norwegian (30/05/2021) # https://fx-onlinee•blogspot•com/2021/06/?r=Bergens-Tidende-Flertallet-av-fastlegene-i-Trondheim-sier-nei-til-Janssen-vaksinen-Umulig-%C3%A5-ta-det-ansvaret-seo+aj @@ -26684,7 +26684,7 @@ # All legitimate Pac-Man games would use "pac-man" links with a dash # https://eclypsium•com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/ -127.0.0.1 http://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4 + # (Presumably anonymous) E-mail tips 127.0.0.1 s.free.fr