starred/adfilt
1
0
Fork 0
mirror of https://github.com/DandelionSprout/adfilt.git synced 2026-10-04 06:31:07 +01:00
Code Issues Packages Projects Releases 4 Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Imre Eilertsen
2025-02-11 21:44:30 +01:00
committed by GitHub
parent b593e26233
commit 8e4fdea687
8 changed files with 329 additions and 328 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Alternate versions Anti-Malware List/AntiMalwareABP.txt
+85 -85
View File
@@ -1,6 +1,6 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox)
! Version: 07February2025v1
! Version: 11February2025v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -414,7 +414,7 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"])
||wix.cm^$domain=~malware-typo-squatter-of-wix.com
||199.59.243.222^
|http://ww01.$domain=~very-very-extremely-frequently-used-in-malware-redirections.*
|http://ww01.$domain=~very_very_extremely_frequently_used_in_malware_redirections.*
||14d.us^
||14d.us^$popup
||173.208.96.42^
@@ -604,7 +604,7 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"])
||proserpina-zeb.com^$popup
||lordagty.com^
||madagty.com^
||zeroredirect5.com^$domain=~malware-redirection-trains.*
||zeroredirect5.com^$domain=~malware_redirection_trains.*
||54.209.22.226^
||54.91.125.197^
@@ -640,7 +640,7 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"])
||3.90.125.85^
! Various ex-affiliate links at www•zombooru•com
! Various ex-affiliate links at www•zombooru•com
||track.vcdc.com^
||track.vcdc.com^$popup
||track.tkbo.com^
@@ -680,9 +680,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! Adblock Plus list maintainer weekly reports
||pinoy-offers.com^
||googleboost.xyz^
||bemobtracks.com^$popup,domain=~malware-redirection-trains.*
||bemobtrk.com^$popup,domain=~malware-redirection-trains.*
||bemobpath.com^$popup,domain=~malware-redirection-trains.*
||bemobtracks.com^$popup,domain=~malware_redirection_trains.*
||bemobtrk.com^$popup,domain=~malware_redirection_trains.*
||bemobpath.com^$popup,domain=~malware_redirection_trains.*
||couponbybox.com^
||newpage.in^
/mcaf04/*=
@@ -6462,8 +6462,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||gogle.net^$popup
||extragifis.site^
||extragifis.site^$popup
||best-prizes-202*.com^$domain=~malware-site.*
||all-best-prize-202*.com^$domain=~malware-site.*
||best-prizes-202*.com^$domain=~malware_site.*
||all-best-prize-202*.com^$domain=~malware_site.*
||captcharesolving-universe.com^
||captcharesolving-universe.com^$popup
||captcharesolver.com^
@@ -6943,7 +6943,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||renewal-software-update.com^$popup
||pushmeup.art^
||pushmeup.art^$popup
||trc.*.co^$domain=~malware-redirection-trains.*
||trc.*.co^$domain=~malware_redirection_trains.*
||artofads.co^
||pc-my-protection.xyz^
||pc-my-protection.xyz^$popup
@@ -7174,9 +7174,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||newsvot.com^
||adalgard-wol.com^
||adalgard-wol.com^$popup
||trkk4.com^$domain=~malware-redirection-trains.*
||trkk4.com^$domain=~malware_redirection_trains.*
||secure-access-*.gate23.xyz^
||hosting-redirect.com^$domain=~malware-redirection-trains.*
||hosting-redirect.com^$domain=~malware_redirection_trains.*
||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^
! https://github.com/DandelionSprout/adfilt/pull/289
||gogles.com^
@@ -7977,7 +7977,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||sites.google.com/mytv/maintenance^
||sites.google.com/mytv/maintenance^$popup
! https://github.com/AdguardTeam/AdguardFilters/issues/111970
/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$popup,domain=~malware-redirection-trains.*
/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$popup,domain=~malware_redirection_trains.*
! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
||pccrackworld.com^
||pccrackworld.com^$popup
@@ -8084,20 +8084,20 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||specgoal.com^$popup
||sandhyapi.online^
||sandhyapi.online^$popup
/trk2/*?lddomain=,domain=~very-likely-a-malware-redirection.*
/trk2/*?lddomain=,domain=~very_likely_a_malware_redirection.*
||rtbrvdirect.com^
||rtbrvdirect.com^$popup
||goprotectpc.com^
||goprotectpc.com^$popup
||cpmrevdirect.com^$domain=~malware-redirection-trains.*
||rtbverdirect.com^$domain=~malware-redirection-trains.*
||cpmrevdirect.com^$domain=~malware_redirection_trains.*
||rtbverdirect.com^$domain=~malware_redirection_trains.*
||fsalfrwdr.com^
||cpmvrdirect.com^$domain=~malware-redirection-trains.*
||fadverdirect.com^$domain=~malware-redirection-trains.*
||cpmrvdirect.com^$domain=~malware-redirection-trains.*
||rtbrevdirect.com^$domain=~malware-redirection-trains.*
||rtbvrdirect.com^$domain=~malware-redirection-trains.*
||cpmverdirect.com^$domain=~malware-redirection-trains.*
||cpmvrdirect.com^$domain=~malware_redirection_trains.*
||fadverdirect.com^$domain=~malware_redirection_trains.*
||cpmrvdirect.com^$domain=~malware_redirection_trains.*
||rtbrevdirect.com^$domain=~malware_redirection_trains.*
||rtbvrdirect.com^$domain=~malware_redirection_trains.*
||cpmverdirect.com^$domain=~malware_redirection_trains.*
||15.197.244.48^
||96.47.230.67^
@@ -8176,7 +8176,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||saferedirects.xyz^$popup
||online-guard.com^
||online-guard.com^$popup
/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=,popup,domain=~fake-site-with-malware.*
/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=,popup,domain=~fake_site_with_malware.*
! https://twitter•com/iam_py_test/status/1545164642346930176
||amazon-security-info.lnk.to^
||amazon-security-info.lnk.to^$popup
@@ -8996,7 +8996,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||146.19.169.99^
! https://github.com/AdguardTeam/AdguardFilters/issues/132079
/pushredirect/?,domain=~malware-redirection-trains.*
/pushredirect/?,domain=~malware_redirection_trains.*
! https://github.com/AdguardTeam/AdguardFilters/issues/134355
||1000girl.com^
||1000girl.com^$popup
@@ -18252,7 +18252,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||zeroredirect1.com^$popup
||zp-dom.com^
||zp-dom.com^$popup
||redirect.newprogrammatic.click^$domain=~likely-a-malware-redirection.*
||redirect.newprogrammatic.click^$domain=~likely_a_malware_redirection.*
||arcad-hoh.com^
||arcad-hoh.com^$popup
||eadri-fnr.com^
@@ -18341,7 +18341,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||92.204.160.240^$popup
! https://github.com/AdguardTeam/AdguardFilters/issues/148560
/land/*&afftrack=,domain=~likely-a-malware-redirection.*
/land/*&afftrack=,domain=~likely_a_malware_redirection.*
! Comments on Slack
||boot-upextremelyquickinfo-product.info^
||boot-upextremelyquickinfo-product.info^$popup
@@ -20392,7 +20392,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||glefeesh.net^$popup
||gliceebe.xyz^
||gliceebe.xyz^$popup
||go.redirected*/click?^$popup,domain=~malware-redirection-trains.*
||go.redirected*/click?^$popup,domain=~malware_redirection_trains.*
||goldfishka-casino.xyz^
||goldfishka-casino.xyz^$popup
||gousauhu.xyz^
@@ -29297,7 +29297,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||zapprecisionadmire.com^$popup
||zealousstraitcommit.com^
||zealousstraitcommit.com^$popup
://trk.*.run/,domain=~very-likely-a-malware-redirection-train.*
://trk.*.run/,domain=~very_likely_a_malware_redirection_train.*
! https://github.com/AdguardTeam/AdguardFilters/issues/159157
||apbbjmp.com^
||apbbjmp.com^$popup
@@ -57893,7 +57893,7 @@ toorgle.net##.join
||slimxketo.com^$popup
||works35.com^
||works35.com^$popup
! Various ex-affiliate links at www•zombooru•com
! Various ex-affiliate links at www•zombooru•com
||allowandgo.com^
||allowandgo.com^$popup
||aksuu.ru^
@@ -60055,7 +60055,7 @@ toorgle.net##.join
/^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
||eivbjsegbino.com^
||eivbjsegbino.com^$popup
||jpjmpqaupc.com^
@@ -60070,7 +60070,7 @@ toorgle.net##.join
||spizzicopizza.net^
||spizzicopizza.net^$popup
! Other
||redirectme.net^$domain=~malware-redirection-trains.*
||redirectme.net^$domain=~malware_redirection_trains.*
||anthargo.com^
! Domains on IPs known to host Discord Nitro spambots
||cabura.loan^
@@ -61386,8 +61386,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||34.80.59.191^$popup
! Various domains on https://securitytrails•com/list/ip/72•14•178•174
|http://www6.$domain=~often-used-in-malware-redirections.*
|http://www1.*&kw,domain=~often-used-in-malware-redirections.*
|http://www6.$domain=~often_used_in_malware_redirections.*
|http://www1.*&kw,domain=~often_used_in_malware_redirections.*
||megabooru.com^
||megabooru.com^$popup
||zombooru.com^
@@ -63063,9 +63063,9 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||wirexapp.africa.com^$popup
! Google results for «SodaStream site:no cranberry»
/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$domain=~malware-redirection-results.*
||adservice.google.*/ddm/clk/$domain=~malware-redirection-results.*
/ad_click/q?&url=,domain=~malware-redirection-results.*
/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$domain=~malware_redirection_results.*
||adservice.google.*/ddm/clk/$domain=~malware_redirection_results.*
/ad_click/q?&url=,domain=~malware_redirection_results.*
! Laughably blatant fraud site
||cosercosplay.com^
||cosercosplay.com^$popup
@@ -65402,13 +65402,13 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h
! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
||unofficialtwrp.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidweblog.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidgreek.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||ytechb.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetstwist.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetsfarms.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||techorfy.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||unofficialtwrp.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||androidweblog.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||androidgreek.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||ytechb.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||gadgetstwist.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||gadgetsfarms.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||techorfy.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
@@ -65422,53 +65422,53 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h
! ——— Usually used by various groups who buy old domains and display illicit ads on them ———
://ww4.$domain=~ww4.ikea.com|~ww4.sig-ge.ch|~ww4.autotask.net
://ww4.$domain=~ww4.ikea.com|~ww4.sig-ge.ch|~ww4.autotask.net|~ww4.pornhoarder.org
://ww5.$domain=~ww5.ikea.com|~ww5.msu.ac.zw|~ww5.autotask.net
://ww6.$domain=~ww6.generali.pt|~ww6.autotask.net
://ww7.$domain=~ww7.be|~ww7.readsnk.com|~ww7.autotask.net
!!!://ww8.$domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com|~ww8.autotask.net (Needed way more whitelistings than I had expected.)
://ww9.$domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br|~ww9.autotask.net
://ww10.$domain=~ww10.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww11.$domain=~ww11.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww12.$domain=~ww12.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww13.$domain=~ww13.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww14.$domain=~ww14.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww15.$domain=~ww15.nl|~ww15.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww16.$domain=~ww16.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww17.$domain=~ww17.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww18.$domain=~ww18.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww19.$domain=~ww19.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww20.$domain=~ww20.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww21.$domain=~ww21.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww22.$domain=~ww22.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww23.$domain=~ww23.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww24.$domain=~ww24.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww25.$domain=~ww25.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww26.$domain=~ww26.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww27.$domain=~ww27.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww28.$domain=~ww28.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww29.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww30.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww31.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww32.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww33.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww34.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww35.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww36.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww37.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww38.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww39.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww40.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww41.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww42.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww43.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww44.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww45.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww46.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww47.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww48.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww49.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww50.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww10.$domain=~ww10.autotask.net|~w10.pornhoarder.tv|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww11.$domain=~ww11.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww12.$domain=~ww12.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww13.$domain=~ww13.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww14.$domain=~ww14.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww15.$domain=~ww15.nl|~ww15.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww16.$domain=~ww16.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww17.$domain=~ww17.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww18.$domain=~ww18.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww19.$domain=~ww19.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww20.$domain=~ww20.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww21.$domain=~ww21.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww22.$domain=~ww22.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww23.$domain=~ww23.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww24.$domain=~ww24.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww25.$domain=~ww25.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww26.$domain=~ww26.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww27.$domain=~ww27.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww28.$domain=~ww28.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww29.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww30.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww31.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww32.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww33.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww34.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww35.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww36.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww37.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww38.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww39.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww40.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww41.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww42.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww43.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww44.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww45.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww46.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww47.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww48.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww49.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww50.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ———
!!!/\\/
Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt
+146 -146
View File
@@ -1,6 +1,6 @@
! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard)
! Version: 07February2025v1
! Version: 11February2025v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -401,7 +401,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"])
||199.59.243.222^$document
!+ PLATFORM(windows, mac, android)
199.59.243.222$network
|http://ww01.$document,domain=~very-very-extremely-frequently-used-in-malware-redirections.*
|http://ww01.$document,domain=~very_very_extremely_frequently_used_in_malware_redirections.*
||14d.us^$all,~inline-font,domain=~malware-redirection-and-also-you-were-very-likely-looking-for-1d4.us
||173.208.96.42^$all
!+ PLATFORM(windows, mac, android)
@@ -522,7 +522,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"])
||proserpina-zeb.com^$all
||lordagty.com^$document
||madagty.com^$document
||zeroredirect5.com^$document,domain=~malware-redirection-trains.*
||zeroredirect5.com^$document,domain=~malware_redirection_trains.*
||54.209.22.226^$document
!+ PLATFORM(windows, mac, android)
54.209.22.226$network
@@ -549,7 +549,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"])
3.216.243.46$network
||roamingclicks.com^$all
! Source: desidertNO
||collectfasttracks.com^$all,~inline-font,domain=~malware-redirection-trains.*
||collectfasttracks.com^$all,~inline-font,domain=~malware_redirection_trains.*
! Source: vn-zoomCOM
||ttnrd.com^$all
||amanda.*.com^$document
@@ -566,10 +566,10 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"])
||3.90.125.85^$document
!+ PLATFORM(windows, mac, android)
3.90.125.85$network
! Various ex-affiliate links at www•zombooru•com
||track.vcdc.com^$all,~inline-font,domain=~malware-redirection-trains.*
||track.tkbo.com^$all,~inline-font,domain=~malware-redirection-trains.*
||track.traffic.club^$all,~inline-font,domain=~malware-redirection-trains.*
! Various ex-affiliate links at www•zombooru•com
||track.vcdc.com^$all,~inline-font,domain=~malware_redirection_trains.*
||track.tkbo.com^$all,~inline-font,domain=~malware_redirection_trains.*
||track.traffic.club^$all,~inline-font,domain=~malware_redirection_trains.*
||lasvegas-vacations.net^$document
||ndsplitter.com^$document
||ns1.trafficclub.com^$all
@@ -604,9 +604,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! Adblock Plus list maintainer weekly reports
||pinoy-offers.com^
||googleboost.xyz^$document
||bemobtracks.com^$document,popup,domain=~malware-redirection-trains.*
||bemobtrk.com^$document,popup,domain=~malware-redirection-trains.*
||bemobpath.com^$document,popup,domain=~malware-redirection-trains.*
||bemobtracks.com^$document,popup,domain=~malware_redirection_trains.*
||bemobtrk.com^$document,popup,domain=~malware_redirection_trains.*
||bemobpath.com^$document,popup,domain=~malware_redirection_trains.*
||couponbybox.com^$document
||newpage.in^$document
/mcaf04/*=$document
@@ -3496,7 +3496,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||zfirst-news.com^$all
||zmp3-online.com^$all
||zmusic-online.com^$all
||zredir.com^$all,~inline-font,domain=~malware-redirection-trains.*
||zredir.com^$all,~inline-font,domain=~malware_redirection_trains.*
||178.128.142.109^$document
!+ PLATFORM(windows, mac, android)
178.128.142.109$network
@@ -3580,8 +3580,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! https://github.com/DandelionSprout/adfilt/issues/188
||gogle.net^$all
||extragifis.site^$all
||best-prizes-202*.com^$document,domain=~malware-site.*
||all-best-prize-202*.com^$document,domain=~malware-site.*
||best-prizes-202*.com^$document,domain=~malware_site.*
||all-best-prize-202*.com^$document,domain=~malware_site.*
||captcharesolving-universe.com^$all
||captcharesolver.com^$all
||instantfwding.com^$all
@@ -3589,8 +3589,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||gamesex.fun^$all
||goldprize.xyz^$all
||kmip.net^$all
||0redirc.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirekted.com^$all,~inline-font,domain=~malware-redirection-trains.*
||0redirc.com^$all,~inline-font,domain=~malware_redirection_trains.*
||redirekted.com^$all,~inline-font,domain=~malware_redirection_trains.*
||rebiraert.com^$all
||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$all
||5.8.34.26^$document
@@ -3856,7 +3856,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||mediagetplus.com^$all
||mgmgmg.com^$all
||temp74.com^$all
||trackwebclick.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trackwebclick.com^$all,~inline-font,domain=~malware_redirection_trains.*
||23.111.31.137^$document
!+ PLATFORM(windows, mac, android)
23.111.31.137$network
@@ -3890,7 +3890,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||apsolutamente.com^$all
||renewal-software-update.com^$all
||pushmeup.art^$all
||trc.*.co^$document,domain=~malware-redirection-trains.*
||trc.*.co^$document,domain=~malware_redirection_trains.*
||artofads.co^$document
||pc-my-protection.xyz^$all
||beta-news.org^$document
@@ -4070,9 +4070,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||data-px.services^$document
||newsvot.com^$document
||adalgard-wol.com^$all
||trkk4.com^$document,domain=~malware-redirection-trains.*
||trkk4.com^$document,domain=~malware_redirection_trains.*
||secure-access-*.gate23.xyz^$document
||hosting-redirect.com^$document,domain=~malware-redirection-trains.*
||hosting-redirect.com^$document,domain=~malware_redirection_trains.*
||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^$document
! https://github.com/DandelionSprout/adfilt/pull/289
||gogles.com^$all
@@ -4342,7 +4342,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||welcomejohncena.pro^$all
||security-scanner.xyz^$all
! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md
&url_bnm_redirect=$all,~inline-font,domain=~malware-redirection-trains.*
&url_bnm_redirect=$all,~inline-font,domain=~malware_redirection_trains.*
/mcafeedirect.jsp$all,domain=~mcafee.com
/beep.mp3^$domain=xyz|club|pro
!!!?next_url=$document,popup (https://github.com/AdguardTeam/AdguardFilters/issues/108072#issuecomment-1021534226)
@@ -4472,7 +4472,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||delicate-tame-angora.glitch.me^$all
||secureinvoice.glitch.me^$all
||holy-ruddy-brace.glitch.me^$all
||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware-redirection-trains.*
||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware_redirection_trains.*
||instafollow.glitch.me^$all
||loving-discovered-swordfish.glitch.me^$all
||aquamarine-cotton-impala.glitch.me^$all
@@ -4757,7 +4757,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||sites.google.com/view/groundworkssolutions/^$all
||sites.google.com/mytv/maintenance^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/111970
/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$document,popup,domain=~malware-redirection-trains.*
/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$document,popup,domain=~malware_redirection_trains.*
! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
||pccrackworld.com^$all
||calsign.xyz^$all
@@ -4822,18 +4822,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||installiq.com^$all
||specgoal.com^$all
||sandhyapi.online^$all
/trk2/*?lddomain=$document,domain=~very-likely-a-malware-redirection.*
||rtbrvdirect.com^$all,~inline-font,domain=~malware-redirection-trains.*
/trk2/*?lddomain=$document,domain=~very_likely_a_malware_redirection.*
||rtbrvdirect.com^$all,~inline-font,domain=~malware_redirection_trains.*
||goprotectpc.com^$all
||cpmrevdirect.com^$document,domain=~malware-redirection-trains.*
||rtbverdirect.com^$document,domain=~malware-redirection-trains.*
||cpmrevdirect.com^$document,domain=~malware_redirection_trains.*
||rtbverdirect.com^$document,domain=~malware_redirection_trains.*
||fsalfrwdr.com^$document
||cpmvrdirect.com^$document,domain=~malware-redirection-trains.*
||fadverdirect.com^$document,domain=~malware-redirection-trains.*
||cpmrvdirect.com^$document,domain=~malware-redirection-trains.*
||rtbrevdirect.com^$document,domain=~malware-redirection-trains.*
||rtbvrdirect.com^$document,domain=~malware-redirection-trains.*
||cpmverdirect.com^$document,domain=~malware-redirection-trains.*
||cpmvrdirect.com^$document,domain=~malware_redirection_trains.*
||fadverdirect.com^$document,domain=~malware_redirection_trains.*
||cpmrvdirect.com^$document,domain=~malware_redirection_trains.*
||rtbrevdirect.com^$document,domain=~malware_redirection_trains.*
||rtbvrdirect.com^$document,domain=~malware_redirection_trains.*
||cpmverdirect.com^$document,domain=~malware_redirection_trains.*
||15.197.244.48^$document
!+ PLATFORM(windows, mac, android)
15.197.244.48$network
@@ -4862,12 +4862,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
://179.60.146.$document
!#endif
! https://github.com/AdguardTeam/AdguardFilters/issues/121544
||trafredirtds.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trafredirtds.com^$all,~inline-font,domain=~malware_redirection_trains.*
||com/landers/iphone*_spin$document
! https://github.com/AdguardTeam/AdguardFilters/issues/121772
||pu020ev.com^$all
||kadam.net^$all
||kdtrk.net^$all,~inline-font,domain=~malware-redirection-trains.*
||kdtrk.net^$all,~inline-font,domain=~malware_redirection_trains.*
||clcpb.net^$all
||kadxin.net^$all
||kdmrqw.com^$all
@@ -4889,9 +4889,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! https://github.com/AdguardTeam/AdguardFilters/issues/122757
://adbrbk.$document
! https://github.com/AdguardTeam/AdguardFilters/issues/123544
||saferedirects.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
||saferedirects.xyz^$all,~inline-font,domain=~malware_redirection_trains.*
||online-guard.com^$all
/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$document,popup,domain=~fake-site-with-malware.*
/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$document,popup,domain=~fake_site_with_malware.*
! https://twitter•com/iam_py_test/status/1545164642346930176
||amazon-security-info.lnk.to^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/123968
@@ -5135,10 +5135,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||tlkn45ssg.cyou^$all
||toprefgtbvatv.com^$all
||tov49ro5ep.art^$all
||track2it4.icu^$all,~inline-font,domain=~malware-redirection-trains.*
||trackerry.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trackgdi.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trckrry.com^$all,~inline-font,domain=~malware-redirection-trains.*
||track2it4.icu^$all,~inline-font,domain=~malware_redirection_trains.*
||trackerry.com^$all,~inline-font,domain=~malware_redirection_trains.*
||trackgdi.com^$all,~inline-font,domain=~malware_redirection_trains.*
||trckrry.com^$all,~inline-font,domain=~malware_redirection_trains.*
||udlwwle.site^$all
||uij5nn-ta.cyou^$all
||uqujzco.xyz^$all
@@ -5349,7 +5349,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
!+ PLATFORM(windows, mac, android)
146.19.169.99$network
! https://github.com/AdguardTeam/AdguardFilters/issues/132079
/pushredirect/?$document,domain=~malware-redirection-trains.*
/pushredirect/?$document,domain=~malware_redirection_trains.*
! https://github.com/AdguardTeam/AdguardFilters/issues/134355
||1000girl.com^$all
||1000islandsinfo.com^$all
@@ -6140,7 +6140,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||keyrug.com^$all
||keysschools.net^$all
||keystonehoops.com^$all
||keywebtracker.com^$all,~inline-font,domain=~malware-redirection-trains.*
||keywebtracker.com^$all,~inline-font,domain=~malware_redirection_trains.*
||keywordadvisetoolplus.com^$all
||kickoff.cm^$all
||kindfirls.com^$all
@@ -7150,7 +7150,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||beskittyan.com^$all
||bigsport.today^$all
||cadbitff.com^$all
||clicktracklink.com^$all,~inline-font,domain=~malware-redirection-trains.*
||clicktracklink.com^$all,~inline-font,domain=~malware_redirection_trains.*
||comivolo.com^$all
||davaifoa.com^$all
||dodurantom.com^$all
@@ -7416,7 +7416,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||4.fo^$document,popup
||kckb.st^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/139106
-trk.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
-trk.xyz^$all,~inline-font,domain=~malware_redirection_trains.*
||loadingnow.me^$all
||gsecurecontent.com^$all
||pressizer.net^$all
@@ -10051,9 +10051,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||thor-pom.com^$all
||thutm-bru.com^$all
||uthyr-que.com^$all
||zeroredirect1.com^$all,~inline-font,domain=~malware-redirection-trains.*
||zeroredirect1.com^$all,~inline-font,domain=~malware_redirection_trains.*
||zp-dom.com^$all
||redirect.newprogrammatic.click^$document,domain=~likely-a-malware-redirection.*
||redirect.newprogrammatic.click^$document,domain=~likely_a_malware_redirection.*
||arcad-hoh.com^$all
||eadri-fnr.com^$all
||gerhi-psv.com^$all
@@ -10114,7 +10114,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
!+ PLATFORM(windows, mac, android)
92.204.160.240$network
! https://github.com/AdguardTeam/AdguardFilters/issues/148560
/land/*&afftrack=$document,domain=~likely-a-malware-redirection.*
/land/*&afftrack=$document,domain=~likely_a_malware_redirection.*
! Comments on Slack
||boot-upextremelyquickinfo-product.info^$all
||boot-upextremelyswiftinfo-product.info^$all
@@ -10404,7 +10404,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||horny-neighbour.com^$all
||hornygirlsinapp.com^$all
||jump-path2.com^$all
||redirect-path2.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirect-path2.com^$all,~inline-font,domain=~malware_redirection_trains.*
||your-online-casino.com^$all
||hot-girls-around.com^$all
||how2-become-rich.com^$all
@@ -10430,8 +10430,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||pw-show-ad.com^$all
||pw-show-main.com^$all
||pw-show-test.com^$all
||pwredir-*.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redir-pw*.com^$all,~inline-font,domain=~malware-redirection-trains.*
||pwredir-*.com^$all,~inline-font,domain=~malware_redirection_trains.*
||redir-pw*.com^$all,~inline-font,domain=~malware_redirection_trains.*
||rich-people-club.com^$all
||search-top-videos.com^$all
||secret-casino-site.com^$all
@@ -10808,11 +10808,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||online-notifications.com^$all
||openthenotification.com^$all
||pclkpackg.xyz^$all
||pclkredrct.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
||pclkredrct.xyz^$all,~inline-font,domain=~malware_redirection_trains.*
||popular-messages.com^$all
||premium-news-for.me^$all
||premium-shops-around.me^$all
||pushapitracker.com^$all,~inline-font,domain=~malware-redirection-trains.*
||pushapitracker.com^$all,~inline-font,domain=~malware_redirection_trains.*
||read-and-reveal.com^$all
||read-before-the-rest.com^$all
||read-new-post.com^$all
@@ -10862,7 +10862,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||trending-celeb-news.com^$all
||trending-gossip.com^$all
||trends-celebs.com^$all
||ts-tracker.me^$all,~inline-font,domain=~malware-redirection-trains.*
||ts-tracker.me^$all,~inline-font,domain=~malware_redirection_trains.*
||updates-news-magazine.com^$all
||videochatonlinesite.com^$all
||viralvidoes-buzz-blog.com^$all
@@ -10889,18 +10889,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||collecl.cc^$all
||defre.net^$all
||puredi.net^$all
||redic.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redic2.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redic3.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redic4.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redir2.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir3.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir4.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir5.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir6.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir7.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir8.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir9.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redic.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redic2.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redic3.com^$all,~inline-font,domain=~malware_redirection_trains.*
||redic4.com^$all,~inline-font,domain=~malware_redirection_trains.*
||redir2.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir3.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir4.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir5.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir6.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir7.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir8.net^$all,~inline-font,domain=~malware_redirection_trains.*
||redir9.net^$all,~inline-font,domain=~malware_redirection_trains.*
||rejco.online^$all
||spinwincas.online^$all
||tapore.net^$all
@@ -11167,7 +11167,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||glaingoo.xyz^$all
||glefeesh.net^$all
||gliceebe.xyz^$all
||go.redirected*/click?^$document,popup,domain=~malware-redirection-trains.*
||go.redirected*/click?^$document,popup,domain=~malware_redirection_trains.*
||goldfishka-casino.xyz^$all
||gousauhu.xyz^$all
||gphyvg.com^$all
@@ -11433,7 +11433,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||rahfnq.com^$all
||raybhi.com^$all
||rcqmrz.com^$all
||redirected1.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirected1.com^$all,~inline-font,domain=~malware_redirection_trains.*
||rfduik.com^$all
||rgitpv.com^$all
||riaeqd.com^$all
@@ -11986,7 +11986,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||searchassured.com^$all
||searchequivalents.com^$all
||searchexcellent.com^$all
||searchingredirect.com^$all,~inline-font,domain=~malware-redirection-trains.*
||searchingredirect.com^$all,~inline-font,domain=~malware_redirection_trains.*
||searchinquire.com^$all
||searchsimilars.com^$all
||searchstarters.com^$all
@@ -15642,7 +15642,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||zapdescendant.com^$all
||zapprecisionadmire.com^$all
||zealousstraitcommit.com^$all
://trk.*.run/$document,domain=~very-likely-a-malware-redirection-train.*
://trk.*.run/$document,domain=~very_likely_a_malware_redirection_train.*
! https://github.com/AdguardTeam/AdguardFilters/issues/159157
||apbbjmp.com^$all
||awbbgate.com^$all
@@ -15709,7 +15709,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||charutboll.com^$all
||chaseverifications.com^$all
||cloud-network.online^$all
||cmcmdirrect.com^$all,~inline-font,domain=~malware-redirection-trains.*
||cmcmdirrect.com^$all,~inline-font,domain=~malware_redirection_trains.*
||coltersaidas.com^$all
||com-96-hours.com^$all
||com-96hours.com^$all
@@ -15834,7 +15834,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||paywide.cards^$all
||promo-carte-avantages.com^$all
||qc1.site^$all
||redirect2url.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirect2url.com^$all,~inline-font,domain=~malware_redirection_trains.*
||revoiut-cy.com^$all
||revoke.money^$all
||richiediilrimborso.com^$all
@@ -16049,12 +16049,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||usqtvc.com$all
||usutnr.top$all
||204.44.92.187$all
://ap-trk.$all,~inline-font,domain=~malware-redirection-trains.*
://cw-trk.$all,~inline-font,domain=~malware-redirection-trains.*
://cw-trak.$all,~inline-font,domain=~malware-redirection-trains.*
://ktraks.$all,~inline-font,domain=~malware-redirection-trains.*
://flow-clck.$all,~inline-font,domain=~malware-redirection-trains.*
://apps-trk.$all,~inline-font,domain=~malware-redirection-trains.*
://ap-trk.$all,~inline-font,domain=~malware_redirection_trains.*
://cw-trk.$all,~inline-font,domain=~malware_redirection_trains.*
://cw-trak.$all,~inline-font,domain=~malware_redirection_trains.*
://ktraks.$all,~inline-font,domain=~malware_redirection_trains.*
://flow-clck.$all,~inline-font,domain=~malware_redirection_trains.*
://apps-trk.$all,~inline-font,domain=~malware_redirection_trains.*
! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103
||betzykrisesenter.no^$document
||citra2010oslo.no^$document
@@ -30045,7 +30045,7 @@ toorgle.net##.join
||netpay8.com^$all
||slimxketo.com^$all
||works35.com^$all
! Various ex-affiliate links at www•zombooru•com
! Various ex-affiliate links at www•zombooru•com
||allowandgo.com^$all
||aksuu.ru^$all
||allow-space.com^$all
@@ -31138,7 +31138,7 @@ toorgle.net##.join
!#if !ext_ublock
/^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/$document
!#endif
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
||eivbjsegbino.com^$all
||jpjmpqaupc.com^$all
||qrclevrfjw.com^$all
@@ -31147,7 +31147,7 @@ toorgle.net##.join
||nickswheels.com^$all
||spizzicopizza.net^$all
! Other
||redirectme.net^$document,domain=~malware-redirection-trains.*
||redirectme.net^$document,domain=~malware_redirection_trains.*
||anthargo.com^$document
! Domains on IPs known to host Discord Nitro spambots
@@ -31714,8 +31714,8 @@ toorgle.net##.join
! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
apkfab.com##.tip-extension
! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022)
||xxlmag.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||xxlmag.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||2y68554.cyou^$all
||1pwk1j.cyou^$all
||986.group^$all
@@ -31724,10 +31724,10 @@ apkfab.com##.tip-extension
185.87.148.199$network
! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022)
||imaot.co.il/ContentArea/BannerClick^$all
||q1065.fm/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||wobm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||us105fm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||wnbf.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||q1065.fm/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||wobm.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||us105fm.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||wnbf.com/redirect^$all,~inline-font,domain=~malware_redirection_results.*
||ynxqoc2.cyou^$all
||resurrectionlinks.online^$all
||canon70x70.site^$all
@@ -31736,8 +31736,8 @@ apkfab.com##.tip-extension
||45.136.49.35^$document
!+ PLATFORM(windows, mac, android)
45.136.49.35$network
||semex.com/popurl.cgi^$all,~inline-font,domain=~malware-redirection-results.*
||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware-redirection-results.*
||semex.com/popurl.cgi^$all,~inline-font,domain=~malware_redirection_results.*
||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware_redirection_results.*
! Browsing around for Tajik newssites
||arhernot.live^$all
||lifelongkick.live^$all
@@ -31808,7 +31808,7 @@ apkfab.com##.tip-extension
||highlandnews.com^$all
||genuinescansupport.com^$all
||diverseflowlink.com^$all
||redirectedflow.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirectedflow.com^$all,~inline-font,domain=~malware_redirection_trains.*
||pcbasicstrength.com^$all
||varietyflow.com^$all
||securecertainflow.com^$all
@@ -31884,8 +31884,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
!+ PLATFORM(windows, mac, android)
34.80.59.191$network
! Various domains on https://securitytrails•com/list/ip/72•14•178•174
|http://www6.$document,domain=~often-used-in-malware-redirections.*
|http://www1.*&kw$document,domain=~often-used-in-malware-redirections.*
|http://www6.$document,domain=~often_used_in_malware_redirections.*
|http://www1.*&kw$document,domain=~often_used_in_malware_redirections.*
||megabooru.com^$all
||zombooru.com^$all
||kusubooru.com^$all
@@ -31964,7 +31964,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||awesomewinner.com^$all
||awesomewinner.net^$all
||awesomewinners.net^$all
||b2ztrk.com^$all,~inline-font,domain=~malware-redirection-trains.*
||b2ztrk.com^$all,~inline-font,domain=~malware_redirection_trains.*
||beastgadget.net^$all
||beastoffer.net^$all
||beastoffrs.com^$all
@@ -32284,7 +32284,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||winnerssite.net^$all
||xyzoffer.net^$all
||yasdoodl.com^$all
||ym3trk.com^$all,~inline-font,domain=~malware-redirection-trains.*
||ym3trk.com^$all,~inline-font,domain=~malware_redirection_trains.*
||youwanthis.com^$all
||zebramode.com^$all
||zebraoffers.net^$all
@@ -32779,9 +32779,9 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||wirexapp.africa.com^$all
! Google results for «SodaStream site:no cranberry»
/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)\$/$document,domain=~malware-redirection-results.*
||adservice.google.*/ddm/clk/$document,domain=~malware-redirection-results.*
/ad_click/q?&url=$document,domain=~malware-redirection-results.*
/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)\$/$document,domain=~malware_redirection_results.*
||adservice.google.*/ddm/clk/$document,domain=~malware_redirection_results.*
/ad_click/q?&url=$document,domain=~malware_redirection_results.*
! Laughably blatant fraud site
||cosercosplay.com^$all
! Fraudulent art thefts for money on Google Image Search, e.g. 'cassandra tangled site:tumblr.com suit'
@@ -33988,13 +33988,13 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr
! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
||unofficialtwrp.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidweblog.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidgreek.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||ytechb.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetstwist.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetsfarms.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||techorfy.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||unofficialtwrp.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||androidweblog.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||androidgreek.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||ytechb.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||gadgetstwist.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||gadgetsfarms.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||techorfy.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
!#if false
! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
@@ -34010,53 +34010,53 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr
!#endif
! ——— Usually used by various groups who buy old domains and display illicit ads on them ———
://ww4.$document,domain=~ww4.ikea.com|~ww4.sig-ge.ch|~ww4.autotask.net
://ww4.$document,domain=~ww4.ikea.com|~ww4.sig-ge.ch|~ww4.autotask.net|~ww4.pornhoarder.org
://ww5.$document,domain=~ww5.ikea.com|~ww5.msu.ac.zw|~ww5.autotask.net
://ww6.$document,domain=~ww6.generali.pt|~ww6.autotask.net
://ww7.$document,domain=~ww7.be|~ww7.readsnk.com|~ww7.autotask.net
!!!://ww8.$document,domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com|~ww8.autotask.net (Needed way more whitelistings than I had expected.)
://ww9.$document,domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br|~ww9.autotask.net
://ww10.$document,domain=~ww10.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww11.$document,domain=~ww11.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww12.$document,domain=~ww12.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww13.$document,domain=~ww13.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww14.$document,domain=~ww14.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww15.$document,domain=~ww15.nl|~ww15.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww16.$document,domain=~ww16.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww17.$document,domain=~ww17.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww18.$document,domain=~ww18.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww19.$document,domain=~ww19.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww20.$document,domain=~ww20.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww21.$document,domain=~ww21.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww22.$document,domain=~ww22.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww23.$document,domain=~ww23.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww24.$document,domain=~ww24.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww25.$document,domain=~ww25.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww26.$document,domain=~ww26.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww27.$document,domain=~ww27.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww28.$document,domain=~ww28.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww29.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww30.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww31.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww32.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww33.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww34.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww35.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww36.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww37.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww38.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww39.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww40.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww41.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww42.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww43.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww44.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww45.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww46.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww47.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww48.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww49.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww50.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww10.$document,domain=~ww10.autotask.net|~w10.pornhoarder.tv|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww11.$document,domain=~ww11.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww12.$document,domain=~ww12.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww13.$document,domain=~ww13.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww14.$document,domain=~ww14.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww15.$document,domain=~ww15.nl|~ww15.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww16.$document,domain=~ww16.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww17.$document,domain=~ww17.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww18.$document,domain=~ww18.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww19.$document,domain=~ww19.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww20.$document,domain=~ww20.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww21.$document,domain=~ww21.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww22.$document,domain=~ww22.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww23.$document,domain=~ww23.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww24.$document,domain=~ww24.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww25.$document,domain=~ww25.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww26.$document,domain=~ww26.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww27.$document,domain=~ww27.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww28.$document,domain=~ww28.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww29.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww30.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww31.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww32.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww33.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww34.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww35.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww36.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww37.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww38.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww39.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww40.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww41.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww42.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww43.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww44.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww45.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww46.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww47.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww48.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww49.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww50.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.*
! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ———
!!!/\\/$document
Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt
+74 -74
View File
@@ -1,6 +1,6 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22)
! Version: 07February2025v1
! Version: 11February2025v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -198,7 +198,7 @@
||wix.cm^$denyallow=malware-typo-squatter-of-wix.com
199.59.243.222
|http://ww01.$denyallow=very-very-extremely-frequently-used-in-malware-redirections.*
|http://ww01.$denyallow=very_very_extremely_frequently_used_in_malware_redirections.*
173.208.96.42
@@ -311,7 +311,7 @@
||proserpina-zeb.com^
||lordagty.com^
||madagty.com^
||zeroredirect5.com^$denyallow=malware-redirection-trains.*
||zeroredirect5.com^$denyallow=malware_redirection_trains.*
54.209.22.226
54.91.125.197
@@ -344,7 +344,7 @@
3.90.125.85
! Various ex-affiliate links at www•zombooru•com
! Various ex-affiliate links at www•zombooru•com
@@ -3321,8 +3321,8 @@
! https://github.com/DandelionSprout/adfilt/issues/188
||gogle.net^
||extragifis.site^
||best-prizes-202*.com^$denyallow=malware-site.*
||all-best-prize-202*.com^$denyallow=malware-site.*
||best-prizes-202*.com^$denyallow=malware_site.*
||all-best-prize-202*.com^$denyallow=malware_site.*
||captcharesolving-universe.com^
||captcharesolver.com^
||instantfwding.com^
@@ -3604,7 +3604,7 @@
||apsolutamente.com^
||renewal-software-update.com^
||pushmeup.art^
||trc.*.co^$denyallow=malware-redirection-trains.*
||trc.*.co^$denyallow=malware_redirection_trains.*
||artofads.co^
||pc-my-protection.xyz^
||beta-news.org^
@@ -3765,9 +3765,9 @@
||data-px.services^
||newsvot.com^
||adalgard-wol.com^
||trkk4.com^$denyallow=malware-redirection-trains.*
||trkk4.com^$denyallow=malware_redirection_trains.*
||secure-access-*.gate23.xyz^
||hosting-redirect.com^$denyallow=malware-redirection-trains.*
||hosting-redirect.com^$denyallow=malware_redirection_trains.*
! https://github.com/DandelionSprout/adfilt/pull/289
||gogles.com^
@@ -4380,18 +4380,18 @@
||installiq.com^
||specgoal.com^
||sandhyapi.online^
/trk2/*?ld~very-likely-a-malware-redirection.*
/trk2/*?ld~very_likely_a_malware_redirection.*
||goprotectpc.com^
||cpmrevdirect.com^$denyallow=malware-redirection-trains.*
||rtbverdirect.com^$denyallow=malware-redirection-trains.*
||cpmrevdirect.com^$denyallow=malware_redirection_trains.*
||rtbverdirect.com^$denyallow=malware_redirection_trains.*
||fsalfrwdr.com^
||cpmvrdirect.com^$denyallow=malware-redirection-trains.*
||fadverdirect.com^$denyallow=malware-redirection-trains.*
||cpmrvdirect.com^$denyallow=malware-redirection-trains.*
||rtbrevdirect.com^$denyallow=malware-redirection-trains.*
||rtbvrdirect.com^$denyallow=malware-redirection-trains.*
||cpmverdirect.com^$denyallow=malware-redirection-trains.*
||cpmvrdirect.com^$denyallow=malware_redirection_trains.*
||fadverdirect.com^$denyallow=malware_redirection_trains.*
||cpmrvdirect.com^$denyallow=malware_redirection_trains.*
||rtbrevdirect.com^$denyallow=malware_redirection_trains.*
||rtbvrdirect.com^$denyallow=malware_redirection_trains.*
||cpmverdirect.com^$denyallow=malware_redirection_trains.*
15.197.244.48
96.47.230.67
@@ -4890,7 +4890,7 @@
146.19.169.99
! https://github.com/AdguardTeam/AdguardFilters/issues/132079
/pushredirect/?~malware-redirection-trains.*
/pushredirect/?~malware_redirection_trains.*
! https://github.com/AdguardTeam/AdguardFilters/issues/134355
||1000girl.com^
||1000islandsinfo.com^
@@ -9571,7 +9571,7 @@
||uthyr-que.com^
||zp-dom.com^
||redirect.newprogrammatic.click^$denyallow=likely-a-malware-redirection.*
||redirect.newprogrammatic.click^$denyallow=likely_a_malware_redirection.*
||arcad-hoh.com^
||eadri-fnr.com^
||gerhi-psv.com^
@@ -15127,7 +15127,7 @@
||zapdescendant.com^
||zapprecisionadmire.com^
||zealousstraitcommit.com^
://trk.*.run/$document,~very-likely-a-malware-redirection-train.*
://trk.*.run/$document,~very_likely_a_malware_redirection_train.*
! https://github.com/AdguardTeam/AdguardFilters/issues/159157
||apbbjmp.com^
||awbbgate.com^
@@ -29485,7 +29485,7 @@
||netpay8.com^
||slimxketo.com^
||works35.com^
! Various ex-affiliate links at www•zombooru•com
! Various ex-affiliate links at www•zombooru•com
||allowandgo.com^
||aksuu.ru^
||allow-space.com^
@@ -30578,7 +30578,7 @@
/^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
||eivbjsegbino.com^
||jpjmpqaupc.com^
||qrclevrfjw.com^
@@ -30587,7 +30587,7 @@
||nickswheels.com^
||spizzicopizza.net^
! Other
||redirectme.net^$denyallow=malware-redirection-trains.*
||redirectme.net^$denyallow=malware_redirection_trains.*
||anthargo.com^
! Domains on IPs known to host Discord Nitro spambots
@@ -31307,7 +31307,7 @@
34.80.59.191
! Various domains on https://securitytrails•com/list/ip/72•14•178•174
|http://www6.$denyallow=often-used-in-malware-redirections.*
|http://www6.$denyallow=often_used_in_malware_redirections.*
||megabooru.com^
||zombooru.com^
@@ -33363,13 +33363,13 @@
! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
||unofficialtwrp.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidweblog.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidgreek.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||ytechb.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetstwist.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetsfarms.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||techorfy.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||unofficialtwrp.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||androidweblog.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||androidgreek.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||ytechb.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||gadgetstwist.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||gadgetsfarms.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
||techorfy.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.*
! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
@@ -33382,53 +33382,53 @@
! ——— Usually used by various groups who buy old domains and display illicit ads on them ———
://ww4.$denyallow=ww4.ikea.com|ww4.sig-ge.ch|ww4.autotask.net
://ww4.$denyallow=ww4.ikea.com|ww4.sig-ge.ch|ww4.autotask.net|ww4.pornhoarder.org
://ww5.$denyallow=ww5.ikea.com|ww5.msu.ac.zw|ww5.autotask.net
://ww6.$denyallow=ww6.generali.pt|ww6.autotask.net
://ww7.$denyallow=ww7.be|ww7.readsnk.com|ww7.autotask.net
!!!://ww8.~ww8.co|ww8.ikea.com|ww8.tiki.ne.jp|ww8.erovoice.us|ww8.anyanime.com|ww8.bakushpal.az|ww8.tokyoghoulre.com|ww8.readonepiece.com|ww8.autotask.net (Needed way more whitelistings than I had expected.)
://ww9.$denyallow=ww9.ikea.com|ww9.tiki.ne.jp|ww9.sakura.ne.jp|ww9.generali.pt|ww9.itau.com.br|ww9.autotask.net
://ww10.$denyallow=ww10.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww11.$denyallow=ww11.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww12.$denyallow=ww12.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww13.$denyallow=ww13.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww14.$denyallow=ww14.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww15.$denyallow=ww15.nl|ww15.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww16.$denyallow=ww16.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww17.$denyallow=ww17.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww18.$denyallow=ww18.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww19.$denyallow=ww19.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww20.$denyallow=ww20.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww21.$denyallow=ww21.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww22.$denyallow=ww22.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww23.$denyallow=ww23.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww24.$denyallow=ww24.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww25.$denyallow=ww25.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww26.$denyallow=ww26.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww27.$denyallow=ww27.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww28.$denyallow=ww28.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww29.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww30.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww31.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww32.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww33.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww34.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww35.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww36.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww37.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww38.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww39.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww40.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww41.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww42.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww43.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww44.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww45.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww46.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww47.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww48.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww49.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww50.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww10.$denyallow=ww10.autotask.net|w10.pornhoarder.tv|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww11.$denyallow=ww11.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww12.$denyallow=ww12.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww13.$denyallow=ww13.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww14.$denyallow=ww14.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww15.$denyallow=ww15.nl|ww15.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww16.$denyallow=ww16.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww17.$denyallow=ww17.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww18.$denyallow=ww18.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww19.$denyallow=ww19.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww20.$denyallow=ww20.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww21.$denyallow=ww21.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww22.$denyallow=ww22.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww23.$denyallow=ww23.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww24.$denyallow=ww24.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww25.$denyallow=ww25.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww26.$denyallow=ww26.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww27.$denyallow=ww27.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww28.$denyallow=ww28.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww29.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww30.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww31.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww32.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww33.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww34.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww35.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww36.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww37.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww38.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww39.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww40.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww41.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww42.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww43.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww44.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww45.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww46.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww47.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww48.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww49.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
://ww50.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.*
! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ———
!!!/\\/
Alternate versions Anti-Malware List/AntiMalwareDomains.txt
+4 -4
View File
@@ -1,5 +1,5 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version)
# Version: 07February2025v1
# Version: 11February2025v1
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway.
@@ -405,7 +405,7 @@ ttnrd.com
3.90.125.85
# Various ex-affiliate links at www•zombooru•com
# Various ex-affiliate links at www•zombooru•com
track.vcdc.com
track.tkbo.com
track.traffic.club
@@ -29517,7 +29517,7 @@ money87.com
netpay8.com
slimxketo.com
works35.com
# Various ex-affiliate links at www•zombooru•com
# Various ex-affiliate links at www•zombooru•com
allowandgo.com
aksuu.ru
allow-space.com
@@ -30610,7 +30610,7 @@ zzdb5p4upiug.com
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
eivbjsegbino.com
jpjmpqaupc.com
qrclevrfjw.com
Alternate versions Anti-Malware List/AntiMalwareHosts.txt
+4 -4
View File
@@ -1,5 +1,5 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version)
# Version: 07February2025v1
# Version: 11February2025v1
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Users of Pi-Hole FTL 5.22 and later, and of AdGuard Home, are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven.
@@ -354,7 +354,7 @@
127.0.0.1 3.90.125.85
# Various ex-affiliate links at www•zombooru•com
# Various ex-affiliate links at www•zombooru•com
127.0.0.1 track.vcdc.com
127.0.0.1 track.tkbo.com
127.0.0.1 track.traffic.club
@@ -29466,7 +29466,7 @@
127.0.0.1 netpay8.com
127.0.0.1 slimxketo.com
127.0.0.1 works35.com
# Various ex-affiliate links at www•zombooru•com
# Various ex-affiliate links at www•zombooru•com
127.0.0.1 allowandgo.com
127.0.0.1 aksuu.ru
127.0.0.1 allow-space.com
@@ -30559,7 +30559,7 @@
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
127.0.0.1 eivbjsegbino.com
127.0.0.1 jpjmpqaupc.com
127.0.0.1 qrclevrfjw.com
Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action
+4 -4
View File
@@ -1,6 +1,6 @@
{+block}
# Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy)
# Version: 07February2025v1-Deprecated
# Version: 11February2025v1-Deprecated
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -313,7 +313,7 @@
.3.90.125.85
# Various ex-affiliate links at www•zombooru•com
# Various ex-affiliate links at www•zombooru•com
.track.vcdc.com
.track.tkbo.com
.track.traffic.club
@@ -29123,7 +29123,7 @@
.netpay8.com
.slimxketo.com
.works35.com
# Various ex-affiliate links at www•zombooru•com
# Various ex-affiliate links at www•zombooru•com
.allowandgo.com
.aksuu.ru
.allow-space.com
@@ -30211,7 +30211,7 @@
.zzdb5p4upiug.com
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
.eivbjsegbino.com
.jpjmpqaupc.com
.qrclevrfjw.com
Alternate versions Anti-Malware List/AntiMalwareTPL.tpl
+4 -4
View File
@@ -1,6 +1,6 @@
msFilterList
# Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL)
# Version: 07February2025v1-Deprecated
# Version: 11February2025v1-Deprecated
: expires = 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -382,7 +382,7 @@ msFilterList
-d 3.90.125.85
# Various ex-affiliate links at www•zombooru•com
# Various ex-affiliate links at www•zombooru•com
-d track.vcdc.com
-d track.tkbo.com
-d track.traffic.club
@@ -29487,7 +29487,7 @@ icrosoft.com.chrome.
-d netpay8.com
-d slimxketo.com
-d works35.com
# Various ex-affiliate links at www•zombooru•com
# Various ex-affiliate links at www•zombooru•com
-d allowandgo.com
-d aksuu.ru
-d allow-space.com
@@ -30582,7 +30582,7 @@ dvancedhosters.com$doc,domain=
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
-d eivbjsegbino.com
-d jpjmpqaupc.com
-d qrclevrfjw.com
Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset
+8 -7
View File
@@ -303,8 +303,6 @@
194.63.143.61
194.63.143.96
37.48.80.112
95.168.170.165
213.227.149.216
109.206.168.16
109.206.168.17
57.128.71.215
@@ -348,7 +346,6 @@
185.149.120.163
185.149.120.173
185.149.120.175
185.149.120.173
45.202.32.3
45.8.92.138
79.133.46.252
@@ -367,14 +364,13 @@
193.143.1.214
193.143.1.217
208.91.189.203
192.243.59.12
192.243.59.13
192.243.59.20
103.155.214.207
185.196.9.214
185.196.9.222
194.226.139.121
194.226.139.7
95.181.157.36
95.181.172.204
192.243.61.225
147.135.16.27
185.87.148.199
45.136.49.35
@@ -422,6 +418,11 @@
198.12.86.90
[2606:4700:3030::6815:5284]
[2606:4700:3037::ac43:9e39]
139.45.197.168
139.45.197.244
172.240.41.32
172.240.41.64
172.240.41.96
212.27.60.108
1.14.61.188
3.248.18.175