From 8e4fdea687d2425f782fdde4948aeb1343e08711 Mon Sep 17 00:00:00 2001 From: Imre Eilertsen Date: Tue, 11 Feb 2025 21:44:30 +0100 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 170 +++++----- .../AntiMalwareAdGuard.txt | 292 +++++++++--------- .../AntiMalwareAdGuardHome.txt | 148 ++++----- .../AntiMalwareDomains.txt | 8 +- .../AntiMalwareHosts.txt | 8 +- .../AntiMalwarePrivoxy.action | 8 +- .../AntiMalwareTPL.tpl | 8 +- ...out's and other adblocker lists' IPs.ipset | 15 +- 8 files changed, 329 insertions(+), 328 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index 47da58dc1..c0739847f 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox) -! Version: 07February2025v1 +! Version: 11February2025v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -414,7 +414,7 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||wix.cm^$domain=~malware-typo-squatter-of-wix.com ||199.59.243.222^ -|http://ww01.$domain=~very-very-extremely-frequently-used-in-malware-redirections.* +|http://ww01.$domain=~very_very_extremely_frequently_used_in_malware_redirections.* ||14d.us^ ||14d.us^$popup ||173.208.96.42^ @@ -604,7 +604,7 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||proserpina-zeb.com^$popup ||lordagty.com^ ||madagty.com^ -||zeroredirect5.com^$domain=~malware-redirection-trains.* +||zeroredirect5.com^$domain=~malware_redirection_trains.* ||54.209.22.226^ ||54.91.125.197^ @@ -640,7 +640,7 @@ download.cnet.com#?#.c-globalCard:has(a[href*="/AdsCleaner/"]) ||3.90.125.85^ -! Various ex-affiliate links at www•zombooru•com +! Various ex-affiliate links at www•zombooru•com ||track.vcdc.com^ ||track.vcdc.com^$popup ||track.tkbo.com^ @@ -680,9 +680,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! Adblock Plus list maintainer weekly reports ||pinoy-offers.com^ ||googleboost.xyz^ -||bemobtracks.com^$popup,domain=~malware-redirection-trains.* -||bemobtrk.com^$popup,domain=~malware-redirection-trains.* -||bemobpath.com^$popup,domain=~malware-redirection-trains.* +||bemobtracks.com^$popup,domain=~malware_redirection_trains.* +||bemobtrk.com^$popup,domain=~malware_redirection_trains.* +||bemobpath.com^$popup,domain=~malware_redirection_trains.* ||couponbybox.com^ ||newpage.in^ /mcaf04/*= @@ -6462,8 +6462,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||gogle.net^$popup ||extragifis.site^ ||extragifis.site^$popup -||best-prizes-202*.com^$domain=~malware-site.* -||all-best-prize-202*.com^$domain=~malware-site.* +||best-prizes-202*.com^$domain=~malware_site.* +||all-best-prize-202*.com^$domain=~malware_site.* ||captcharesolving-universe.com^ ||captcharesolving-universe.com^$popup ||captcharesolver.com^ @@ -6943,7 +6943,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||renewal-software-update.com^$popup ||pushmeup.art^ ||pushmeup.art^$popup -||trc.*.co^$domain=~malware-redirection-trains.* +||trc.*.co^$domain=~malware_redirection_trains.* ||artofads.co^ ||pc-my-protection.xyz^ ||pc-my-protection.xyz^$popup @@ -7174,9 +7174,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||newsvot.com^ ||adalgard-wol.com^ ||adalgard-wol.com^$popup -||trkk4.com^$domain=~malware-redirection-trains.* +||trkk4.com^$domain=~malware_redirection_trains.* ||secure-access-*.gate23.xyz^ -||hosting-redirect.com^$domain=~malware-redirection-trains.* +||hosting-redirect.com^$domain=~malware_redirection_trains.* ||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^ ! https://github.com/DandelionSprout/adfilt/pull/289 ||gogles.com^ @@ -7977,7 +7977,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sites.google.com/mytv/maintenance^ ||sites.google.com/mytv/maintenance^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 -/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$popup,domain=~malware-redirection-trains.* +/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$popup,domain=~malware_redirection_trains.* ! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^ ||pccrackworld.com^$popup @@ -8084,20 +8084,20 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||specgoal.com^$popup ||sandhyapi.online^ ||sandhyapi.online^$popup -/trk2/*?lddomain=,domain=~very-likely-a-malware-redirection.* +/trk2/*?lddomain=,domain=~very_likely_a_malware_redirection.* ||rtbrvdirect.com^ ||rtbrvdirect.com^$popup ||goprotectpc.com^ ||goprotectpc.com^$popup -||cpmrevdirect.com^$domain=~malware-redirection-trains.* -||rtbverdirect.com^$domain=~malware-redirection-trains.* +||cpmrevdirect.com^$domain=~malware_redirection_trains.* +||rtbverdirect.com^$domain=~malware_redirection_trains.* ||fsalfrwdr.com^ -||cpmvrdirect.com^$domain=~malware-redirection-trains.* -||fadverdirect.com^$domain=~malware-redirection-trains.* -||cpmrvdirect.com^$domain=~malware-redirection-trains.* -||rtbrevdirect.com^$domain=~malware-redirection-trains.* -||rtbvrdirect.com^$domain=~malware-redirection-trains.* -||cpmverdirect.com^$domain=~malware-redirection-trains.* +||cpmvrdirect.com^$domain=~malware_redirection_trains.* +||fadverdirect.com^$domain=~malware_redirection_trains.* +||cpmrvdirect.com^$domain=~malware_redirection_trains.* +||rtbrevdirect.com^$domain=~malware_redirection_trains.* +||rtbvrdirect.com^$domain=~malware_redirection_trains.* +||cpmverdirect.com^$domain=~malware_redirection_trains.* ||15.197.244.48^ ||96.47.230.67^ @@ -8176,7 +8176,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||saferedirects.xyz^$popup ||online-guard.com^ ||online-guard.com^$popup -/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=,popup,domain=~fake-site-with-malware.* +/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=,popup,domain=~fake_site_with_malware.* ! https://twitter•com/iam_py_test/status/1545164642346930176 ||amazon-security-info.lnk.to^ ||amazon-security-info.lnk.to^$popup @@ -8996,7 +8996,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||146.19.169.99^ ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 -/pushredirect/?,domain=~malware-redirection-trains.* +/pushredirect/?,domain=~malware_redirection_trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 ||1000girl.com^ ||1000girl.com^$popup @@ -18252,7 +18252,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zeroredirect1.com^$popup ||zp-dom.com^ ||zp-dom.com^$popup -||redirect.newprogrammatic.click^$domain=~likely-a-malware-redirection.* +||redirect.newprogrammatic.click^$domain=~likely_a_malware_redirection.* ||arcad-hoh.com^ ||arcad-hoh.com^$popup ||eadri-fnr.com^ @@ -18341,7 +18341,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||92.204.160.240^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 -/land/*&afftrack=,domain=~likely-a-malware-redirection.* +/land/*&afftrack=,domain=~likely_a_malware_redirection.* ! Comments on Slack ||boot-upextremelyquickinfo-product.info^ ||boot-upextremelyquickinfo-product.info^$popup @@ -20392,7 +20392,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||glefeesh.net^$popup ||gliceebe.xyz^ ||gliceebe.xyz^$popup -||go.redirected*/click?^$popup,domain=~malware-redirection-trains.* +||go.redirected*/click?^$popup,domain=~malware_redirection_trains.* ||goldfishka-casino.xyz^ ||goldfishka-casino.xyz^$popup ||gousauhu.xyz^ @@ -29297,7 +29297,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zapprecisionadmire.com^$popup ||zealousstraitcommit.com^ ||zealousstraitcommit.com^$popup -://trk.*.run/,domain=~very-likely-a-malware-redirection-train.* +://trk.*.run/,domain=~very_likely_a_malware_redirection_train.* ! https://github.com/AdguardTeam/AdguardFilters/issues/159157 ||apbbjmp.com^ ||apbbjmp.com^$popup @@ -57893,7 +57893,7 @@ toorgle.net##.join ||slimxketo.com^$popup ||works35.com^ ||works35.com^$popup -! Various ex-affiliate links at www•zombooru•com +! Various ex-affiliate links at www•zombooru•com ||allowandgo.com^ ||allowandgo.com^$popup ||aksuu.ru^ @@ -60055,7 +60055,7 @@ toorgle.net##.join /^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/ -! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off +! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^ ||eivbjsegbino.com^$popup ||jpjmpqaupc.com^ @@ -60070,7 +60070,7 @@ toorgle.net##.join ||spizzicopizza.net^ ||spizzicopizza.net^$popup ! Other -||redirectme.net^$domain=~malware-redirection-trains.* +||redirectme.net^$domain=~malware_redirection_trains.* ||anthargo.com^ ! Domains on IPs known to host Discord Nitro spambots ||cabura.loan^ @@ -61386,8 +61386,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||34.80.59.191^$popup ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 -|http://www6.$domain=~often-used-in-malware-redirections.* -|http://www1.*&kw,domain=~often-used-in-malware-redirections.* +|http://www6.$domain=~often_used_in_malware_redirections.* +|http://www1.*&kw,domain=~often_used_in_malware_redirections.* ||megabooru.com^ ||megabooru.com^$popup ||zombooru.com^ @@ -63063,9 +63063,9 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||wirexapp.africa.com^$popup ! Google results for «SodaStream site:no cranberry» -/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$domain=~malware-redirection-results.* -||adservice.google.*/ddm/clk/$domain=~malware-redirection-results.* -/ad_click/q?&url=,domain=~malware-redirection-results.* +/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$domain=~malware_redirection_results.* +||adservice.google.*/ddm/clk/$domain=~malware_redirection_results.* +/ad_click/q?&url=,domain=~malware_redirection_results.* ! Laughably blatant fraud site ||cosercosplay.com^ ||cosercosplay.com^$popup @@ -65402,13 +65402,13 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. -||unofficialtwrp.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||androidweblog.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||androidgreek.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||ytechb.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||gadgetstwist.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||gadgetsfarms.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||techorfy.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||unofficialtwrp.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||androidweblog.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||androidgreek.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||ytechb.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||gadgetstwist.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||gadgetsfarms.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||techorfy.com^$domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* ! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ——— @@ -65422,53 +65422,53 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ! ——— Usually used by various groups who buy old domains and display illicit ads on them ——— -://ww4.$domain=~ww4.ikea.com|~ww4.sig-ge.ch|~ww4.autotask.net +://ww4.$domain=~ww4.ikea.com|~ww4.sig-ge.ch|~ww4.autotask.net|~ww4.pornhoarder.org ://ww5.$domain=~ww5.ikea.com|~ww5.msu.ac.zw|~ww5.autotask.net ://ww6.$domain=~ww6.generali.pt|~ww6.autotask.net ://ww7.$domain=~ww7.be|~ww7.readsnk.com|~ww7.autotask.net !!!://ww8.$domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com|~ww8.autotask.net (Needed way more whitelistings than I had expected.) ://ww9.$domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br|~ww9.autotask.net -://ww10.$domain=~ww10.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww11.$domain=~ww11.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww12.$domain=~ww12.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww13.$domain=~ww13.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww14.$domain=~ww14.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww15.$domain=~ww15.nl|~ww15.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww16.$domain=~ww16.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww17.$domain=~ww17.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww18.$domain=~ww18.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww19.$domain=~ww19.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww20.$domain=~ww20.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww21.$domain=~ww21.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww22.$domain=~ww22.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww23.$domain=~ww23.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww24.$domain=~ww24.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww25.$domain=~ww25.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww26.$domain=~ww26.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww27.$domain=~ww27.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww28.$domain=~ww28.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww29.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww30.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww31.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww32.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww33.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww34.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww35.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww36.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww37.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww38.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww39.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww40.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww41.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww42.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww43.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww44.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww45.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww46.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww47.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww48.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww49.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww50.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww10.$domain=~ww10.autotask.net|~w10.pornhoarder.tv|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww11.$domain=~ww11.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww12.$domain=~ww12.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww13.$domain=~ww13.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww14.$domain=~ww14.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww15.$domain=~ww15.nl|~ww15.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww16.$domain=~ww16.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww17.$domain=~ww17.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww18.$domain=~ww18.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww19.$domain=~ww19.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww20.$domain=~ww20.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww21.$domain=~ww21.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww22.$domain=~ww22.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww23.$domain=~ww23.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww24.$domain=~ww24.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww25.$domain=~ww25.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww26.$domain=~ww26.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww27.$domain=~ww27.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww28.$domain=~ww28.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww29.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww30.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww31.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww32.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww33.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww34.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww35.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww36.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww37.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww38.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww39.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww40.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww41.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww42.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww43.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww44.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww45.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww46.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww47.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww48.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww49.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww50.$domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* ! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ——— !!!/\\/ diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index b543b8090..7388ec24b 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 07February2025v1 +! Version: 11February2025v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -401,7 +401,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||199.59.243.222^$document !+ PLATFORM(windows, mac, android) 199.59.243.222$network -|http://ww01.$document,domain=~very-very-extremely-frequently-used-in-malware-redirections.* +|http://ww01.$document,domain=~very_very_extremely_frequently_used_in_malware_redirections.* ||14d.us^$all,~inline-font,domain=~malware-redirection-and-also-you-were-very-likely-looking-for-1d4.us ||173.208.96.42^$all !+ PLATFORM(windows, mac, android) @@ -522,7 +522,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||proserpina-zeb.com^$all ||lordagty.com^$document ||madagty.com^$document -||zeroredirect5.com^$document,domain=~malware-redirection-trains.* +||zeroredirect5.com^$document,domain=~malware_redirection_trains.* ||54.209.22.226^$document !+ PLATFORM(windows, mac, android) 54.209.22.226$network @@ -549,7 +549,7 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) 3.216.243.46$network ||roamingclicks.com^$all ! Source: desidertNO -||collectfasttracks.com^$all,~inline-font,domain=~malware-redirection-trains.* +||collectfasttracks.com^$all,~inline-font,domain=~malware_redirection_trains.* ! Source: vn-zoomCOM ||ttnrd.com^$all ||amanda.*.com^$document @@ -566,10 +566,10 @@ download.cnet.com##.c-globalCard:has(a[href*="/AdsCleaner/"]) ||3.90.125.85^$document !+ PLATFORM(windows, mac, android) 3.90.125.85$network -! Various ex-affiliate links at www•zombooru•com -||track.vcdc.com^$all,~inline-font,domain=~malware-redirection-trains.* -||track.tkbo.com^$all,~inline-font,domain=~malware-redirection-trains.* -||track.traffic.club^$all,~inline-font,domain=~malware-redirection-trains.* +! Various ex-affiliate links at www•zombooru•com +||track.vcdc.com^$all,~inline-font,domain=~malware_redirection_trains.* +||track.tkbo.com^$all,~inline-font,domain=~malware_redirection_trains.* +||track.traffic.club^$all,~inline-font,domain=~malware_redirection_trains.* ||lasvegas-vacations.net^$document ||ndsplitter.com^$document ||ns1.trafficclub.com^$all @@ -604,9 +604,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! Adblock Plus list maintainer weekly reports ||pinoy-offers.com^ ||googleboost.xyz^$document -||bemobtracks.com^$document,popup,domain=~malware-redirection-trains.* -||bemobtrk.com^$document,popup,domain=~malware-redirection-trains.* -||bemobpath.com^$document,popup,domain=~malware-redirection-trains.* +||bemobtracks.com^$document,popup,domain=~malware_redirection_trains.* +||bemobtrk.com^$document,popup,domain=~malware_redirection_trains.* +||bemobpath.com^$document,popup,domain=~malware_redirection_trains.* ||couponbybox.com^$document ||newpage.in^$document /mcaf04/*=$document @@ -3496,7 +3496,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zfirst-news.com^$all ||zmp3-online.com^$all ||zmusic-online.com^$all -||zredir.com^$all,~inline-font,domain=~malware-redirection-trains.* +||zredir.com^$all,~inline-font,domain=~malware_redirection_trains.* ||178.128.142.109^$document !+ PLATFORM(windows, mac, android) 178.128.142.109$network @@ -3580,8 +3580,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/issues/188 ||gogle.net^$all ||extragifis.site^$all -||best-prizes-202*.com^$document,domain=~malware-site.* -||all-best-prize-202*.com^$document,domain=~malware-site.* +||best-prizes-202*.com^$document,domain=~malware_site.* +||all-best-prize-202*.com^$document,domain=~malware_site.* ||captcharesolving-universe.com^$all ||captcharesolver.com^$all ||instantfwding.com^$all @@ -3589,8 +3589,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||gamesex.fun^$all ||goldprize.xyz^$all ||kmip.net^$all -||0redirc.com^$all,~inline-font,domain=~malware-redirection-trains.* -||redirekted.com^$all,~inline-font,domain=~malware-redirection-trains.* +||0redirc.com^$all,~inline-font,domain=~malware_redirection_trains.* +||redirekted.com^$all,~inline-font,domain=~malware_redirection_trains.* ||rebiraert.com^$all ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$all ||5.8.34.26^$document @@ -3856,7 +3856,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||mediagetplus.com^$all ||mgmgmg.com^$all ||temp74.com^$all -||trackwebclick.com^$all,~inline-font,domain=~malware-redirection-trains.* +||trackwebclick.com^$all,~inline-font,domain=~malware_redirection_trains.* ||23.111.31.137^$document !+ PLATFORM(windows, mac, android) 23.111.31.137$network @@ -3890,7 +3890,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||apsolutamente.com^$all ||renewal-software-update.com^$all ||pushmeup.art^$all -||trc.*.co^$document,domain=~malware-redirection-trains.* +||trc.*.co^$document,domain=~malware_redirection_trains.* ||artofads.co^$document ||pc-my-protection.xyz^$all ||beta-news.org^$document @@ -4070,9 +4070,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||data-px.services^$document ||newsvot.com^$document ||adalgard-wol.com^$all -||trkk4.com^$document,domain=~malware-redirection-trains.* +||trkk4.com^$document,domain=~malware_redirection_trains.* ||secure-access-*.gate23.xyz^$document -||hosting-redirect.com^$document,domain=~malware-redirection-trains.* +||hosting-redirect.com^$document,domain=~malware_redirection_trains.* ||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^$document ! https://github.com/DandelionSprout/adfilt/pull/289 ||gogles.com^$all @@ -4342,7 +4342,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||welcomejohncena.pro^$all ||security-scanner.xyz^$all ! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md -&url_bnm_redirect=$all,~inline-font,domain=~malware-redirection-trains.* +&url_bnm_redirect=$all,~inline-font,domain=~malware_redirection_trains.* /mcafeedirect.jsp$all,domain=~mcafee.com /beep.mp3^$domain=xyz|club|pro !!!?next_url=$document,popup (https://github.com/AdguardTeam/AdguardFilters/issues/108072#issuecomment-1021534226) @@ -4472,7 +4472,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||delicate-tame-angora.glitch.me^$all ||secureinvoice.glitch.me^$all ||holy-ruddy-brace.glitch.me^$all -||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware-redirection-trains.* +||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware_redirection_trains.* ||instafollow.glitch.me^$all ||loving-discovered-swordfish.glitch.me^$all ||aquamarine-cotton-impala.glitch.me^$all @@ -4757,7 +4757,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sites.google.com/view/groundworkssolutions/^$all ||sites.google.com/mytv/maintenance^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 -/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$document,popup,domain=~malware-redirection-trains.* +/^(.*\.|.*://)?[a-z0-9-]{2,}trk\.xyz(/.*)?$/$document,popup,domain=~malware_redirection_trains.* ! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^$all ||calsign.xyz^$all @@ -4822,18 +4822,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||installiq.com^$all ||specgoal.com^$all ||sandhyapi.online^$all -/trk2/*?lddomain=$document,domain=~very-likely-a-malware-redirection.* -||rtbrvdirect.com^$all,~inline-font,domain=~malware-redirection-trains.* +/trk2/*?lddomain=$document,domain=~very_likely_a_malware_redirection.* +||rtbrvdirect.com^$all,~inline-font,domain=~malware_redirection_trains.* ||goprotectpc.com^$all -||cpmrevdirect.com^$document,domain=~malware-redirection-trains.* -||rtbverdirect.com^$document,domain=~malware-redirection-trains.* +||cpmrevdirect.com^$document,domain=~malware_redirection_trains.* +||rtbverdirect.com^$document,domain=~malware_redirection_trains.* ||fsalfrwdr.com^$document -||cpmvrdirect.com^$document,domain=~malware-redirection-trains.* -||fadverdirect.com^$document,domain=~malware-redirection-trains.* -||cpmrvdirect.com^$document,domain=~malware-redirection-trains.* -||rtbrevdirect.com^$document,domain=~malware-redirection-trains.* -||rtbvrdirect.com^$document,domain=~malware-redirection-trains.* -||cpmverdirect.com^$document,domain=~malware-redirection-trains.* +||cpmvrdirect.com^$document,domain=~malware_redirection_trains.* +||fadverdirect.com^$document,domain=~malware_redirection_trains.* +||cpmrvdirect.com^$document,domain=~malware_redirection_trains.* +||rtbrevdirect.com^$document,domain=~malware_redirection_trains.* +||rtbvrdirect.com^$document,domain=~malware_redirection_trains.* +||cpmverdirect.com^$document,domain=~malware_redirection_trains.* ||15.197.244.48^$document !+ PLATFORM(windows, mac, android) 15.197.244.48$network @@ -4862,12 +4862,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ://179.60.146.$document !#endif ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 -||trafredirtds.com^$all,~inline-font,domain=~malware-redirection-trains.* +||trafredirtds.com^$all,~inline-font,domain=~malware_redirection_trains.* ||com/landers/iphone*_spin$document ! https://github.com/AdguardTeam/AdguardFilters/issues/121772 ||pu020ev.com^$all ||kadam.net^$all -||kdtrk.net^$all,~inline-font,domain=~malware-redirection-trains.* +||kdtrk.net^$all,~inline-font,domain=~malware_redirection_trains.* ||clcpb.net^$all ||kadxin.net^$all ||kdmrqw.com^$all @@ -4889,9 +4889,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk.$document ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 -||saferedirects.xyz^$all,~inline-font,domain=~malware-redirection-trains.* +||saferedirects.xyz^$all,~inline-font,domain=~malware_redirection_trains.* ||online-guard.com^$all -/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$document,popup,domain=~fake-site-with-malware.* +/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$document,popup,domain=~fake_site_with_malware.* ! https://twitter•com/iam_py_test/status/1545164642346930176 ||amazon-security-info.lnk.to^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/123968 @@ -5135,10 +5135,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||tlkn45ssg.cyou^$all ||toprefgtbvatv.com^$all ||tov49ro5ep.art^$all -||track2it4.icu^$all,~inline-font,domain=~malware-redirection-trains.* -||trackerry.com^$all,~inline-font,domain=~malware-redirection-trains.* -||trackgdi.com^$all,~inline-font,domain=~malware-redirection-trains.* -||trckrry.com^$all,~inline-font,domain=~malware-redirection-trains.* +||track2it4.icu^$all,~inline-font,domain=~malware_redirection_trains.* +||trackerry.com^$all,~inline-font,domain=~malware_redirection_trains.* +||trackgdi.com^$all,~inline-font,domain=~malware_redirection_trains.* +||trckrry.com^$all,~inline-font,domain=~malware_redirection_trains.* ||udlwwle.site^$all ||uij5nn-ta.cyou^$all ||uqujzco.xyz^$all @@ -5349,7 +5349,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !+ PLATFORM(windows, mac, android) 146.19.169.99$network ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 -/pushredirect/?$document,domain=~malware-redirection-trains.* +/pushredirect/?$document,domain=~malware_redirection_trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 ||1000girl.com^$all ||1000islandsinfo.com^$all @@ -6140,7 +6140,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||keyrug.com^$all ||keysschools.net^$all ||keystonehoops.com^$all -||keywebtracker.com^$all,~inline-font,domain=~malware-redirection-trains.* +||keywebtracker.com^$all,~inline-font,domain=~malware_redirection_trains.* ||keywordadvisetoolplus.com^$all ||kickoff.cm^$all ||kindfirls.com^$all @@ -7150,7 +7150,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||beskittyan.com^$all ||bigsport.today^$all ||cadbitff.com^$all -||clicktracklink.com^$all,~inline-font,domain=~malware-redirection-trains.* +||clicktracklink.com^$all,~inline-font,domain=~malware_redirection_trains.* ||comivolo.com^$all ||davaifoa.com^$all ||dodurantom.com^$all @@ -7416,7 +7416,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||4.fo^$document,popup ||kckb.st^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 --trk.xyz^$all,~inline-font,domain=~malware-redirection-trains.* +-trk.xyz^$all,~inline-font,domain=~malware_redirection_trains.* ||loadingnow.me^$all ||gsecurecontent.com^$all ||pressizer.net^$all @@ -10051,9 +10051,9 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||thor-pom.com^$all ||thutm-bru.com^$all ||uthyr-que.com^$all -||zeroredirect1.com^$all,~inline-font,domain=~malware-redirection-trains.* +||zeroredirect1.com^$all,~inline-font,domain=~malware_redirection_trains.* ||zp-dom.com^$all -||redirect.newprogrammatic.click^$document,domain=~likely-a-malware-redirection.* +||redirect.newprogrammatic.click^$document,domain=~likely_a_malware_redirection.* ||arcad-hoh.com^$all ||eadri-fnr.com^$all ||gerhi-psv.com^$all @@ -10114,7 +10114,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !+ PLATFORM(windows, mac, android) 92.204.160.240$network ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 -/land/*&afftrack=$document,domain=~likely-a-malware-redirection.* +/land/*&afftrack=$document,domain=~likely_a_malware_redirection.* ! Comments on Slack ||boot-upextremelyquickinfo-product.info^$all ||boot-upextremelyswiftinfo-product.info^$all @@ -10404,7 +10404,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||horny-neighbour.com^$all ||hornygirlsinapp.com^$all ||jump-path2.com^$all -||redirect-path2.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirect-path2.com^$all,~inline-font,domain=~malware_redirection_trains.* ||your-online-casino.com^$all ||hot-girls-around.com^$all ||how2-become-rich.com^$all @@ -10430,8 +10430,8 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||pw-show-ad.com^$all ||pw-show-main.com^$all ||pw-show-test.com^$all -||pwredir-*.com^$all,~inline-font,domain=~malware-redirection-trains.* -||redir-pw*.com^$all,~inline-font,domain=~malware-redirection-trains.* +||pwredir-*.com^$all,~inline-font,domain=~malware_redirection_trains.* +||redir-pw*.com^$all,~inline-font,domain=~malware_redirection_trains.* ||rich-people-club.com^$all ||search-top-videos.com^$all ||secret-casino-site.com^$all @@ -10808,11 +10808,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||online-notifications.com^$all ||openthenotification.com^$all ||pclkpackg.xyz^$all -||pclkredrct.xyz^$all,~inline-font,domain=~malware-redirection-trains.* +||pclkredrct.xyz^$all,~inline-font,domain=~malware_redirection_trains.* ||popular-messages.com^$all ||premium-news-for.me^$all ||premium-shops-around.me^$all -||pushapitracker.com^$all,~inline-font,domain=~malware-redirection-trains.* +||pushapitracker.com^$all,~inline-font,domain=~malware_redirection_trains.* ||read-and-reveal.com^$all ||read-before-the-rest.com^$all ||read-new-post.com^$all @@ -10862,7 +10862,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||trending-celeb-news.com^$all ||trending-gossip.com^$all ||trends-celebs.com^$all -||ts-tracker.me^$all,~inline-font,domain=~malware-redirection-trains.* +||ts-tracker.me^$all,~inline-font,domain=~malware_redirection_trains.* ||updates-news-magazine.com^$all ||videochatonlinesite.com^$all ||viralvidoes-buzz-blog.com^$all @@ -10889,18 +10889,18 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||collecl.cc^$all ||defre.net^$all ||puredi.net^$all -||redic.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redic2.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redic3.com^$all,~inline-font,domain=~malware-redirection-trains.* -||redic4.com^$all,~inline-font,domain=~malware-redirection-trains.* -||redir2.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir3.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir4.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir5.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir6.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir7.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir8.net^$all,~inline-font,domain=~malware-redirection-trains.* -||redir9.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redic.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redic2.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redic3.com^$all,~inline-font,domain=~malware_redirection_trains.* +||redic4.com^$all,~inline-font,domain=~malware_redirection_trains.* +||redir2.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir3.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir4.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir5.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir6.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir7.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir8.net^$all,~inline-font,domain=~malware_redirection_trains.* +||redir9.net^$all,~inline-font,domain=~malware_redirection_trains.* ||rejco.online^$all ||spinwincas.online^$all ||tapore.net^$all @@ -11167,7 +11167,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||glaingoo.xyz^$all ||glefeesh.net^$all ||gliceebe.xyz^$all -||go.redirected*/click?^$document,popup,domain=~malware-redirection-trains.* +||go.redirected*/click?^$document,popup,domain=~malware_redirection_trains.* ||goldfishka-casino.xyz^$all ||gousauhu.xyz^$all ||gphyvg.com^$all @@ -11433,7 +11433,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||rahfnq.com^$all ||raybhi.com^$all ||rcqmrz.com^$all -||redirected1.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirected1.com^$all,~inline-font,domain=~malware_redirection_trains.* ||rfduik.com^$all ||rgitpv.com^$all ||riaeqd.com^$all @@ -11986,7 +11986,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||searchassured.com^$all ||searchequivalents.com^$all ||searchexcellent.com^$all -||searchingredirect.com^$all,~inline-font,domain=~malware-redirection-trains.* +||searchingredirect.com^$all,~inline-font,domain=~malware_redirection_trains.* ||searchinquire.com^$all ||searchsimilars.com^$all ||searchstarters.com^$all @@ -15642,7 +15642,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||zapdescendant.com^$all ||zapprecisionadmire.com^$all ||zealousstraitcommit.com^$all -://trk.*.run/$document,domain=~very-likely-a-malware-redirection-train.* +://trk.*.run/$document,domain=~very_likely_a_malware_redirection_train.* ! https://github.com/AdguardTeam/AdguardFilters/issues/159157 ||apbbjmp.com^$all ||awbbgate.com^$all @@ -15709,7 +15709,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||charutboll.com^$all ||chaseverifications.com^$all ||cloud-network.online^$all -||cmcmdirrect.com^$all,~inline-font,domain=~malware-redirection-trains.* +||cmcmdirrect.com^$all,~inline-font,domain=~malware_redirection_trains.* ||coltersaidas.com^$all ||com-96-hours.com^$all ||com-96hours.com^$all @@ -15834,7 +15834,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||paywide.cards^$all ||promo-carte-avantages.com^$all ||qc1.site^$all -||redirect2url.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirect2url.com^$all,~inline-font,domain=~malware_redirection_trains.* ||revoiut-cy.com^$all ||revoke.money^$all ||richiediilrimborso.com^$all @@ -16049,12 +16049,12 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||usqtvc.com$all ||usutnr.top$all ||204.44.92.187$all -://ap-trk.$all,~inline-font,domain=~malware-redirection-trains.* -://cw-trk.$all,~inline-font,domain=~malware-redirection-trains.* -://cw-trak.$all,~inline-font,domain=~malware-redirection-trains.* -://ktraks.$all,~inline-font,domain=~malware-redirection-trains.* -://flow-clck.$all,~inline-font,domain=~malware-redirection-trains.* -://apps-trk.$all,~inline-font,domain=~malware-redirection-trains.* +://ap-trk.$all,~inline-font,domain=~malware_redirection_trains.* +://cw-trk.$all,~inline-font,domain=~malware_redirection_trains.* +://cw-trak.$all,~inline-font,domain=~malware_redirection_trains.* +://ktraks.$all,~inline-font,domain=~malware_redirection_trains.* +://flow-clck.$all,~inline-font,domain=~malware_redirection_trains.* +://apps-trk.$all,~inline-font,domain=~malware_redirection_trains.* ! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103 ||betzykrisesenter.no^$document ||citra2010oslo.no^$document @@ -30045,7 +30045,7 @@ toorgle.net##.join ||netpay8.com^$all ||slimxketo.com^$all ||works35.com^$all -! Various ex-affiliate links at www•zombooru•com +! Various ex-affiliate links at www•zombooru•com ||allowandgo.com^$all ||aksuu.ru^$all ||allow-space.com^$all @@ -31138,7 +31138,7 @@ toorgle.net##.join !#if !ext_ublock /^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/$document !#endif -! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off +! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^$all ||jpjmpqaupc.com^$all ||qrclevrfjw.com^$all @@ -31147,7 +31147,7 @@ toorgle.net##.join ||nickswheels.com^$all ||spizzicopizza.net^$all ! Other -||redirectme.net^$document,domain=~malware-redirection-trains.* +||redirectme.net^$document,domain=~malware_redirection_trains.* ||anthargo.com^$document ! Domains on IPs known to host Discord Nitro spambots @@ -31714,8 +31714,8 @@ toorgle.net##.join ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious apkfab.com##.tip-extension ! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022) -||xxlmag.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* -||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* +||xxlmag.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* +||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* ||2y68554.cyou^$all ||1pwk1j.cyou^$all ||986.group^$all @@ -31724,10 +31724,10 @@ apkfab.com##.tip-extension 185.87.148.199$network ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) ||imaot.co.il/ContentArea/BannerClick^$all -||q1065.fm/redirect^$all,~inline-font,domain=~malware-redirection-results.* -||wobm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* -||us105fm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* -||wnbf.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* +||q1065.fm/redirect^$all,~inline-font,domain=~malware_redirection_results.* +||wobm.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* +||us105fm.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* +||wnbf.com/redirect^$all,~inline-font,domain=~malware_redirection_results.* ||ynxqoc2.cyou^$all ||resurrectionlinks.online^$all ||canon70x70.site^$all @@ -31736,8 +31736,8 @@ apkfab.com##.tip-extension ||45.136.49.35^$document !+ PLATFORM(windows, mac, android) 45.136.49.35$network -||semex.com/popurl.cgi^$all,~inline-font,domain=~malware-redirection-results.* -||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware-redirection-results.* +||semex.com/popurl.cgi^$all,~inline-font,domain=~malware_redirection_results.* +||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware_redirection_results.* ! Browsing around for Tajik newssites ||arhernot.live^$all ||lifelongkick.live^$all @@ -31808,7 +31808,7 @@ apkfab.com##.tip-extension ||highlandnews.com^$all ||genuinescansupport.com^$all ||diverseflowlink.com^$all -||redirectedflow.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirectedflow.com^$all,~inline-font,domain=~malware_redirection_trains.* ||pcbasicstrength.com^$all ||varietyflow.com^$all ||securecertainflow.com^$all @@ -31884,8 +31884,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] !+ PLATFORM(windows, mac, android) 34.80.59.191$network ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 -|http://www6.$document,domain=~often-used-in-malware-redirections.* -|http://www1.*&kw$document,domain=~often-used-in-malware-redirections.* +|http://www6.$document,domain=~often_used_in_malware_redirections.* +|http://www1.*&kw$document,domain=~often_used_in_malware_redirections.* ||megabooru.com^$all ||zombooru.com^$all ||kusubooru.com^$all @@ -31964,7 +31964,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||awesomewinner.com^$all ||awesomewinner.net^$all ||awesomewinners.net^$all -||b2ztrk.com^$all,~inline-font,domain=~malware-redirection-trains.* +||b2ztrk.com^$all,~inline-font,domain=~malware_redirection_trains.* ||beastgadget.net^$all ||beastoffer.net^$all ||beastoffrs.com^$all @@ -32284,7 +32284,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||winnerssite.net^$all ||xyzoffer.net^$all ||yasdoodl.com^$all -||ym3trk.com^$all,~inline-font,domain=~malware-redirection-trains.* +||ym3trk.com^$all,~inline-font,domain=~malware_redirection_trains.* ||youwanthis.com^$all ||zebramode.com^$all ||zebraoffers.net^$all @@ -32779,9 +32779,9 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||wirexapp.africa.com^$all ! Google results for «SodaStream site:no cranberry» -/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)\$/$document,domain=~malware-redirection-results.* -||adservice.google.*/ddm/clk/$document,domain=~malware-redirection-results.* -/ad_click/q?&url=$document,domain=~malware-redirection-results.* +/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)\$/$document,domain=~malware_redirection_results.* +||adservice.google.*/ddm/clk/$document,domain=~malware_redirection_results.* +/ad_click/q?&url=$document,domain=~malware_redirection_results.* ! Laughably blatant fraud site ||cosercosplay.com^$all ! Fraudulent art thefts for money on Google Image Search, e.g. 'cassandra tangled site:tumblr.com suit' @@ -33988,13 +33988,13 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. -||unofficialtwrp.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||androidweblog.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||androidgreek.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||ytechb.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||gadgetstwist.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||gadgetsfarms.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||techorfy.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||unofficialtwrp.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||androidweblog.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||androidgreek.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||ytechb.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||gadgetstwist.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||gadgetsfarms.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||techorfy.com^$document,domain=~had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* !#if false ! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ——— @@ -34010,53 +34010,53 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr !#endif ! ——— Usually used by various groups who buy old domains and display illicit ads on them ——— -://ww4.$document,domain=~ww4.ikea.com|~ww4.sig-ge.ch|~ww4.autotask.net +://ww4.$document,domain=~ww4.ikea.com|~ww4.sig-ge.ch|~ww4.autotask.net|~ww4.pornhoarder.org ://ww5.$document,domain=~ww5.ikea.com|~ww5.msu.ac.zw|~ww5.autotask.net ://ww6.$document,domain=~ww6.generali.pt|~ww6.autotask.net ://ww7.$document,domain=~ww7.be|~ww7.readsnk.com|~ww7.autotask.net !!!://ww8.$document,domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com|~ww8.autotask.net (Needed way more whitelistings than I had expected.) ://ww9.$document,domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br|~ww9.autotask.net -://ww10.$document,domain=~ww10.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww11.$document,domain=~ww11.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww12.$document,domain=~ww12.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww13.$document,domain=~ww13.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww14.$document,domain=~ww14.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww15.$document,domain=~ww15.nl|~ww15.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww16.$document,domain=~ww16.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww17.$document,domain=~ww17.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww18.$document,domain=~ww18.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww19.$document,domain=~ww19.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww20.$document,domain=~ww20.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww21.$document,domain=~ww21.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww22.$document,domain=~ww22.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww23.$document,domain=~ww23.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww24.$document,domain=~ww24.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww25.$document,domain=~ww25.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww26.$document,domain=~ww26.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww27.$document,domain=~ww27.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww28.$document,domain=~ww28.autotask.net|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww29.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww30.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww31.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww32.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww33.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww34.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww35.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww36.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww37.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww38.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww39.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww40.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww41.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww42.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww43.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww44.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww45.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww46.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww47.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww48.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww49.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww50.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww10.$document,domain=~ww10.autotask.net|~w10.pornhoarder.tv|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww11.$document,domain=~ww11.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww12.$document,domain=~ww12.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww13.$document,domain=~ww13.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww14.$document,domain=~ww14.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww15.$document,domain=~ww15.nl|~ww15.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww16.$document,domain=~ww16.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww17.$document,domain=~ww17.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww18.$document,domain=~ww18.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww19.$document,domain=~ww19.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww20.$document,domain=~ww20.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww21.$document,domain=~ww21.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww22.$document,domain=~ww22.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww23.$document,domain=~ww23.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww24.$document,domain=~ww24.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww25.$document,domain=~ww25.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww26.$document,domain=~ww26.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww27.$document,domain=~ww27.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww28.$document,domain=~ww28.autotask.net|~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww29.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww30.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww31.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww32.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww33.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww34.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww35.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww36.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww37.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww38.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww39.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww40.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww41.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww42.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww43.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww44.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww45.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww46.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww47.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww48.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww49.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww50.$document,domain=~practically_always_leads_to_a_domain_parking_service_known_for_malware.* ! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ——— !!!/\\/$document diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 24b002dfe..7d8cdadb1 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22) -! Version: 07February2025v1 +! Version: 11February2025v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -198,7 +198,7 @@ ||wix.cm^$denyallow=malware-typo-squatter-of-wix.com 199.59.243.222 -|http://ww01.$denyallow=very-very-extremely-frequently-used-in-malware-redirections.* +|http://ww01.$denyallow=very_very_extremely_frequently_used_in_malware_redirections.* 173.208.96.42 @@ -311,7 +311,7 @@ ||proserpina-zeb.com^ ||lordagty.com^ ||madagty.com^ -||zeroredirect5.com^$denyallow=malware-redirection-trains.* +||zeroredirect5.com^$denyallow=malware_redirection_trains.* 54.209.22.226 54.91.125.197 @@ -344,7 +344,7 @@ 3.90.125.85 -! Various ex-affiliate links at www•zombooru•com +! Various ex-affiliate links at www•zombooru•com @@ -3321,8 +3321,8 @@ ! https://github.com/DandelionSprout/adfilt/issues/188 ||gogle.net^ ||extragifis.site^ -||best-prizes-202*.com^$denyallow=malware-site.* -||all-best-prize-202*.com^$denyallow=malware-site.* +||best-prizes-202*.com^$denyallow=malware_site.* +||all-best-prize-202*.com^$denyallow=malware_site.* ||captcharesolving-universe.com^ ||captcharesolver.com^ ||instantfwding.com^ @@ -3604,7 +3604,7 @@ ||apsolutamente.com^ ||renewal-software-update.com^ ||pushmeup.art^ -||trc.*.co^$denyallow=malware-redirection-trains.* +||trc.*.co^$denyallow=malware_redirection_trains.* ||artofads.co^ ||pc-my-protection.xyz^ ||beta-news.org^ @@ -3765,9 +3765,9 @@ ||data-px.services^ ||newsvot.com^ ||adalgard-wol.com^ -||trkk4.com^$denyallow=malware-redirection-trains.* +||trkk4.com^$denyallow=malware_redirection_trains.* ||secure-access-*.gate23.xyz^ -||hosting-redirect.com^$denyallow=malware-redirection-trains.* +||hosting-redirect.com^$denyallow=malware_redirection_trains.* ! https://github.com/DandelionSprout/adfilt/pull/289 ||gogles.com^ @@ -4380,18 +4380,18 @@ ||installiq.com^ ||specgoal.com^ ||sandhyapi.online^ -/trk2/*?ld~very-likely-a-malware-redirection.* +/trk2/*?ld~very_likely_a_malware_redirection.* ||goprotectpc.com^ -||cpmrevdirect.com^$denyallow=malware-redirection-trains.* -||rtbverdirect.com^$denyallow=malware-redirection-trains.* +||cpmrevdirect.com^$denyallow=malware_redirection_trains.* +||rtbverdirect.com^$denyallow=malware_redirection_trains.* ||fsalfrwdr.com^ -||cpmvrdirect.com^$denyallow=malware-redirection-trains.* -||fadverdirect.com^$denyallow=malware-redirection-trains.* -||cpmrvdirect.com^$denyallow=malware-redirection-trains.* -||rtbrevdirect.com^$denyallow=malware-redirection-trains.* -||rtbvrdirect.com^$denyallow=malware-redirection-trains.* -||cpmverdirect.com^$denyallow=malware-redirection-trains.* +||cpmvrdirect.com^$denyallow=malware_redirection_trains.* +||fadverdirect.com^$denyallow=malware_redirection_trains.* +||cpmrvdirect.com^$denyallow=malware_redirection_trains.* +||rtbrevdirect.com^$denyallow=malware_redirection_trains.* +||rtbvrdirect.com^$denyallow=malware_redirection_trains.* +||cpmverdirect.com^$denyallow=malware_redirection_trains.* 15.197.244.48 96.47.230.67 @@ -4890,7 +4890,7 @@ 146.19.169.99 ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 -/pushredirect/?~malware-redirection-trains.* +/pushredirect/?~malware_redirection_trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 ||1000girl.com^ ||1000islandsinfo.com^ @@ -9571,7 +9571,7 @@ ||uthyr-que.com^ ||zp-dom.com^ -||redirect.newprogrammatic.click^$denyallow=likely-a-malware-redirection.* +||redirect.newprogrammatic.click^$denyallow=likely_a_malware_redirection.* ||arcad-hoh.com^ ||eadri-fnr.com^ ||gerhi-psv.com^ @@ -15127,7 +15127,7 @@ ||zapdescendant.com^ ||zapprecisionadmire.com^ ||zealousstraitcommit.com^ -://trk.*.run/$document,~very-likely-a-malware-redirection-train.* +://trk.*.run/$document,~very_likely_a_malware_redirection_train.* ! https://github.com/AdguardTeam/AdguardFilters/issues/159157 ||apbbjmp.com^ ||awbbgate.com^ @@ -29485,7 +29485,7 @@ ||netpay8.com^ ||slimxketo.com^ ||works35.com^ -! Various ex-affiliate links at www•zombooru•com +! Various ex-affiliate links at www•zombooru•com ||allowandgo.com^ ||aksuu.ru^ ||allow-space.com^ @@ -30578,7 +30578,7 @@ /^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/ -! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off +! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^ ||jpjmpqaupc.com^ ||qrclevrfjw.com^ @@ -30587,7 +30587,7 @@ ||nickswheels.com^ ||spizzicopizza.net^ ! Other -||redirectme.net^$denyallow=malware-redirection-trains.* +||redirectme.net^$denyallow=malware_redirection_trains.* ||anthargo.com^ ! Domains on IPs known to host Discord Nitro spambots @@ -31307,7 +31307,7 @@ 34.80.59.191 ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 -|http://www6.$denyallow=often-used-in-malware-redirections.* +|http://www6.$denyallow=often_used_in_malware_redirections.* ||megabooru.com^ ||zombooru.com^ @@ -33363,13 +33363,13 @@ ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. -||unofficialtwrp.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||androidweblog.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||androidgreek.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||ytechb.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||gadgetstwist.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||gadgetsfarms.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* -||techorfy.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||unofficialtwrp.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||androidweblog.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||androidgreek.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||ytechb.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||gadgetstwist.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||gadgetsfarms.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* +||techorfy.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* ! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ——— @@ -33382,53 +33382,53 @@ ! ——— Usually used by various groups who buy old domains and display illicit ads on them ——— -://ww4.$denyallow=ww4.ikea.com|ww4.sig-ge.ch|ww4.autotask.net +://ww4.$denyallow=ww4.ikea.com|ww4.sig-ge.ch|ww4.autotask.net|ww4.pornhoarder.org ://ww5.$denyallow=ww5.ikea.com|ww5.msu.ac.zw|ww5.autotask.net ://ww6.$denyallow=ww6.generali.pt|ww6.autotask.net ://ww7.$denyallow=ww7.be|ww7.readsnk.com|ww7.autotask.net !!!://ww8.~ww8.co|ww8.ikea.com|ww8.tiki.ne.jp|ww8.erovoice.us|ww8.anyanime.com|ww8.bakushpal.az|ww8.tokyoghoulre.com|ww8.readonepiece.com|ww8.autotask.net (Needed way more whitelistings than I had expected.) ://ww9.$denyallow=ww9.ikea.com|ww9.tiki.ne.jp|ww9.sakura.ne.jp|ww9.generali.pt|ww9.itau.com.br|ww9.autotask.net -://ww10.$denyallow=ww10.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww11.$denyallow=ww11.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww12.$denyallow=ww12.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww13.$denyallow=ww13.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww14.$denyallow=ww14.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww15.$denyallow=ww15.nl|ww15.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww16.$denyallow=ww16.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww17.$denyallow=ww17.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww18.$denyallow=ww18.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww19.$denyallow=ww19.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww20.$denyallow=ww20.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww21.$denyallow=ww21.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww22.$denyallow=ww22.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww23.$denyallow=ww23.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww24.$denyallow=ww24.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww25.$denyallow=ww25.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww26.$denyallow=ww26.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww27.$denyallow=ww27.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww28.$denyallow=ww28.autotask.net|practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww29.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww30.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww31.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww32.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww33.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww34.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww35.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww36.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww37.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww38.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww39.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww40.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww41.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww42.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww43.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww44.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww45.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww46.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww47.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww48.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww49.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* -://ww50.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww10.$denyallow=ww10.autotask.net|w10.pornhoarder.tv|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww11.$denyallow=ww11.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww12.$denyallow=ww12.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww13.$denyallow=ww13.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww14.$denyallow=ww14.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww15.$denyallow=ww15.nl|ww15.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww16.$denyallow=ww16.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww17.$denyallow=ww17.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww18.$denyallow=ww18.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww19.$denyallow=ww19.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww20.$denyallow=ww20.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww21.$denyallow=ww21.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww22.$denyallow=ww22.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww23.$denyallow=ww23.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww24.$denyallow=ww24.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww25.$denyallow=ww25.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww26.$denyallow=ww26.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww27.$denyallow=ww27.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww28.$denyallow=ww28.autotask.net|practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww29.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww30.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww31.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww32.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww33.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww34.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww35.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww36.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww37.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww38.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww39.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww40.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww41.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww42.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww43.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww44.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww45.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww46.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww47.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww48.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww49.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* +://ww50.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* ! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ——— !!!/\\/ diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 4eca536b5..1750f7f88 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 07February2025v1 +# Version: 11February2025v1 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway. @@ -405,7 +405,7 @@ ttnrd.com 3.90.125.85 -# Various ex-affiliate links at www•zombooru•com +# Various ex-affiliate links at www•zombooru•com track.vcdc.com track.tkbo.com track.traffic.club @@ -29517,7 +29517,7 @@ money87.com netpay8.com slimxketo.com works35.com -# Various ex-affiliate links at www•zombooru•com +# Various ex-affiliate links at www•zombooru•com allowandgo.com aksuu.ru allow-space.com @@ -30610,7 +30610,7 @@ zzdb5p4upiug.com -# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off +# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off eivbjsegbino.com jpjmpqaupc.com qrclevrfjw.com diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 9deb40621..c7ca09dfd 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version) -# Version: 07February2025v1 +# Version: 11February2025v1 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Users of Pi-Hole FTL 5.22 and later, and of AdGuard Home, are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven. @@ -354,7 +354,7 @@ 127.0.0.1 3.90.125.85 -# Various ex-affiliate links at www•zombooru•com +# Various ex-affiliate links at www•zombooru•com 127.0.0.1 track.vcdc.com 127.0.0.1 track.tkbo.com 127.0.0.1 track.traffic.club @@ -29466,7 +29466,7 @@ 127.0.0.1 netpay8.com 127.0.0.1 slimxketo.com 127.0.0.1 works35.com -# Various ex-affiliate links at www•zombooru•com +# Various ex-affiliate links at www•zombooru•com 127.0.0.1 allowandgo.com 127.0.0.1 aksuu.ru 127.0.0.1 allow-space.com @@ -30559,7 +30559,7 @@ -# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off +# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off 127.0.0.1 eivbjsegbino.com 127.0.0.1 jpjmpqaupc.com 127.0.0.1 qrclevrfjw.com diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 740594330..969ec5c2f 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 07February2025v1-Deprecated +# Version: 11February2025v1-Deprecated # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -313,7 +313,7 @@ .3.90.125.85 -# Various ex-affiliate links at www•zombooru•com +# Various ex-affiliate links at www•zombooru•com .track.vcdc.com .track.tkbo.com .track.traffic.club @@ -29123,7 +29123,7 @@ .netpay8.com .slimxketo.com .works35.com -# Various ex-affiliate links at www•zombooru•com +# Various ex-affiliate links at www•zombooru•com .allowandgo.com .aksuu.ru .allow-space.com @@ -30211,7 +30211,7 @@ .zzdb5p4upiug.com -# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off +# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off .eivbjsegbino.com .jpjmpqaupc.com .qrclevrfjw.com diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 46e9fe9f1..dfd3ed7d3 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 07February2025v1-Deprecated +# Version: 11February2025v1-Deprecated : expires = 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -382,7 +382,7 @@ msFilterList -d 3.90.125.85 -# Various ex-affiliate links at www•zombooru•com +# Various ex-affiliate links at www•zombooru•com -d track.vcdc.com -d track.tkbo.com -d track.traffic.club @@ -29487,7 +29487,7 @@ icrosoft.com.chrome. -d netpay8.com -d slimxketo.com -d works35.com -# Various ex-affiliate links at www•zombooru•com +# Various ex-affiliate links at www•zombooru•com -d allowandgo.com -d aksuu.ru -d allow-space.com @@ -30582,7 +30582,7 @@ dvancedhosters.com$doc,domain= -# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off +# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off -d eivbjsegbino.com -d jpjmpqaupc.com -d qrclevrfjw.com diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset index 9b0b48668..204fd5072 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset @@ -303,8 +303,6 @@ 194.63.143.61 194.63.143.96 37.48.80.112 -95.168.170.165 -213.227.149.216 109.206.168.16 109.206.168.17 57.128.71.215 @@ -348,7 +346,6 @@ 185.149.120.163 185.149.120.173 185.149.120.175 -185.149.120.173 45.202.32.3 45.8.92.138 79.133.46.252 @@ -367,14 +364,13 @@ 193.143.1.214 193.143.1.217 208.91.189.203 -192.243.59.12 -192.243.59.13 -192.243.59.20 +103.155.214.207 +185.196.9.214 +185.196.9.222 194.226.139.121 194.226.139.7 95.181.157.36 95.181.172.204 -192.243.61.225 147.135.16.27 185.87.148.199 45.136.49.35 @@ -422,6 +418,11 @@ 198.12.86.90 [2606:4700:3030::6815:5284] [2606:4700:3037::ac43:9e39] +139.45.197.168 +139.45.197.244 +172.240.41.32 +172.240.41.64 +172.240.41.96 212.27.60.108 1.14.61.188 3.248.18.175