From 8f68445e7a9a3323a8007e6efae65d8f4841df1f Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Sun, 3 Dec 2023 02:46:52 +0100 Subject: [PATCH] Fix #969 --- .../AntiMalwareABP.txt | 39 ++++++++++++++----- .../AntiMalwareAdGuard.txt | 27 +++++++++---- .../AntiMalwareAdGuardHome.txt | 23 ++++++++--- .../AntiMalwareDomains.txt | 19 ++++++++- .../AntiMalwareHosts.txt | 19 ++++++++- .../AntiMalwarePrivoxy.action | 22 +++++++++-- .../AntiMalwareTPL.tpl | 19 +++++++-- 7 files changed, 134 insertions(+), 34 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index 46248331f..afa5c0fc2 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus and AdBlock) -! Version: 22November2023v1 +! Version: 33November2023v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -14222,6 +14222,8 @@ zombooru.com##a[href="http://www.hard55.com"] ! Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread ||link.sv^$popup ||4.fo^$popup +||kckb.st^ +||kckb.st^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 ||*-trk.xyz^ ||*-trk.xyz^$popup @@ -34129,6 +34131,18 @@ zombooru.com##a[href="http://www.hard55.com"] ||crackzoom.com^$popup ||activators4windows.com^ ||activators4windows.com^$popup +||cfgy6tg.pro^ +||cfgy6tg.pro^$popup +||hji98ik.click^ +||hji98ik.click^$popup +||ko04rf8.cfd^ +||ko04rf8.cfd^$popup +||i3edtgyu.cfd^ +||i3edtgyu.cfd^$popup +||pqlbh88z7.cfd^ +||pqlbh88z7.cfd^$popup +||i3s5qfuvs.cfd^ +||i3s5qfuvs.cfd^$popup ! ——— Standard malware that I stumbled upon on my own ——— ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -38001,15 +38015,11 @@ toorgle.net##.join ||csgogf*.xyz^$popup ||csgogift*.xyz^ ||csgogift*.xyz^$popup -||discord*.gift^ -||discord*.gift^$popup -@@||discord.gift^ -@@||discord.gift^$popup +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup -||discord*.gift^ -||discord*.gift^$popup -@@||discord.gift^ -@@||discord.gift^$popup +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup ||discord*.gifts^ ||discord*.gifts^$popup @@ -44996,11 +45006,20 @@ tumblr.com#?#div[tabindex][style]:has(a[href*="tinyurl."]:has-text(_1+8_)) ||ybd001.com^ ||ybd001.com^$popup tumblr.com#?#:is(.post,div[data-cell-id][style]:not([data-cell-id*=carousel]),div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has-text( click & chat me ):has-text(🔞) -tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has(a[rel=author]:has-text(/^[a-z]{2,6}-[a-z]{2,6}[0-9]{2}$/i)):has-text(/18|sex/i) +tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has(a[rel=author]:has-text(/^[a-z]{2,6}-[a-z]{2,8}[0-9]{2}$/i)):has-text(/18|sex|squirt|booty|/i) +||deltacorriher.best^ +||deltacorriher.best^$popup +||104.21.82.132^$popup +||172.67.158.57^$popup +||[2606:4700:3030::6815:5284]^$popup +||[2606:4700:3037::ac43:9e39]^$popup ! Google results for «SodaStream site:no cranberry» /^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/ ||adservice.google.*/ddm/clk/ /ad_click/q?&url= +! Laughably blatant fraud site +||cosercosplay.com^ +||cosercosplay.com^$popup ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 9474f0225..02929fc02 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ [AdGuard] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 22November2023v1 +! Version: 33November2023v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -7624,6 +7624,7 @@ zombooru.com##a[href="http://www.hard55.com"] ! Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread ||link.sv^$document,popup ||4.fo^$document,popup +||kckb.st^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 ||*-trk.xyz^$all ||loadingnow.me^$all @@ -17625,6 +17626,12 @@ zombooru.com##a[href="http://www.hard55.com"] ||wazusoft.com^$all ||crackzoom.com^$all ||activators4windows.com^$all +||cfgy6tg.pro^$all +||hji98ik.click^$all +||ko04rf8.cfd^$all +||i3edtgyu.cfd^$all +||pqlbh88z7.cfd^$all +||i3s5qfuvs.cfd^$all ! ——— Standard malware that I stumbled upon on my own ——— ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -19580,13 +19587,10 @@ toorgle.net##.join ||csgocup.ru^$all ||csgogf*.xyz^$all ||csgogift*.xyz^$all -||discord*.gift^$all -@@||discord.gift^$important +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$all !#if false -||discord*.gift^ -||discord*.gift^$popup -@@||discord.gift^ -@@||discord.gift^$popup +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup !#endif ||discord*.gifts^$all ||discord-give.$all @@ -23156,11 +23160,18 @@ tumblr.com#?#div[tabindex][style]:has(a[href*="tinyurl."]:has-text(_1+8_)) ||shua999.com^$all ||ybd001.com^$all tumblr.com#?#:is(.post,div[data-cell-id][style]:not([data-cell-id*=carousel]),div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has-text( click & chat me ):has-text(🔞) -tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has(a[rel=author]:has-text(/^[a-z]{2,6}-[a-z]{2,6}[0-9]{2}$/i)):has-text(/18|sex/i) +tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[data-id]:not([class*=" "]),:not([style],[class]))):has(a[rel=author]:has-text(/^[a-z]{2,6}-[a-z]{2,8}[0-9]{2}$/i)):has-text(/18|sex|squirt|booty|/i) +||deltacorriher.best^$all +104.21.82.132$network +172.67.158.57$network +[2606:4700:3030::6815:5284]$network +[2606:4700:3037::ac43:9e39]$network ! Google results for «SodaStream site:no cranberry» /^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$document ||adservice.google.*/ddm/clk/$document /ad_click/q?&url=$document +! Laughably blatant fraud site +||cosercosplay.com^$all ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 02bf927ae..e4dfb63bd 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows' DNS filtering, and Pi-Hole FTL ≥5.22) -! Version: 22November2023v1 +! Version: 33November2023v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -7392,6 +7392,7 @@ ! Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread ||link.sv^ ||4.fo^ +||kckb.st^ ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 ||*-trk.xyz^ ||loadingnow.me^ @@ -17393,6 +17394,12 @@ ||wazusoft.com^ ||crackzoom.com^ ||activators4windows.com^ +||cfgy6tg.pro^ +||hji98ik.click^ +||ko04rf8.cfd^ +||i3edtgyu.cfd^ +||pqlbh88z7.cfd^ +||i3s5qfuvs.cfd^ ! ——— Standard malware that I stumbled upon on my own ——— ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -19346,12 +19353,9 @@ ||csgocup.ru^ ||csgogf*.xyz^ ||csgogift*.xyz^ -||discord*.gift^ -@@||discord.gift^ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ -||discord*.gift^ - -@@||discord.gift^ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ ||discord*.gifts^ @@ -22917,10 +22921,17 @@ ! Tumblr spambots ||shua999.com^ ||ybd001.com^ +||deltacorriher.best^ +104.21.82.132 +172.67.158.57 +2606:4700:3030::6815:5284 +2606:4700:3037::ac43:9e39 ! Google results for «SodaStream site:no cranberry» +! Laughably blatant fraud site +||cosercosplay.com^ ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 070ed2d23..1b0320c54 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 22November2023v1 +# Version: 33November2023v2 # Expires: 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -7144,6 +7144,7 @@ zigaahm.icu # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread link.sv 4.fo +kckb.st loadingnow.me gsecurecontent.com pressizer.net @@ -17090,6 +17091,12 @@ crackfinal.com wazusoft.com crackzoom.com activators4windows.com +cfgy6tg.pro +hji98ik.click +ko04rf8.cfd +i3edtgyu.cfd +pqlbh88z7.cfd +i3s5qfuvs.cfd # ——— Standard malware that I stumbled upon on my own ——— downloadprovider.me @@ -19041,6 +19048,9 @@ csgocup.ru + + + discord.foundation @@ -22568,10 +22578,17 @@ tachyoniums.eu.com # Tumblr spambots shua999.com ybd001.com +deltacorriher.best +104.21.82.132 +172.67.158.57 +[2606:4700:3030::6815:5284] +[2606:4700:3037::ac43:9e39] # Google results for «SodaStream site:no cranberry» +# Laughably blatant fraud site +cosercosplay.com # ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— # Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 072573127..847828cb4 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version) -# Version: 22November2023v1 +# Version: 33November2023v2 # Expires: 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -7137,6 +7137,7 @@ # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread 127.0.0.1 link.sv 127.0.0.1 4.fo +127.0.0.1 kckb.st 127.0.0.1 loadingnow.me 127.0.0.1 gsecurecontent.com 127.0.0.1 pressizer.net @@ -17083,6 +17084,12 @@ 127.0.0.1 wazusoft.com 127.0.0.1 crackzoom.com 127.0.0.1 activators4windows.com +127.0.0.1 cfgy6tg.pro +127.0.0.1 hji98ik.click +127.0.0.1 ko04rf8.cfd +127.0.0.1 i3edtgyu.cfd +127.0.0.1 pqlbh88z7.cfd +127.0.0.1 i3s5qfuvs.cfd # ——— Standard malware that I stumbled upon on my own ——— 127.0.0.1 downloadprovider.me @@ -19034,6 +19041,9 @@ + + + 127.0.0.1 discord.foundation @@ -22561,10 +22571,17 @@ # Tumblr spambots 127.0.0.1 shua999.com 127.0.0.1 ybd001.com +127.0.0.1 deltacorriher.best +127.0.0.1 104.21.82.132 +127.0.0.1 172.67.158.57 + + # Google results for «SodaStream site:no cranberry» +# Laughably blatant fraud site +127.0.0.1 cosercosplay.com # ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— # Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 730d30088..87045cbc7 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 22November2023v1-Deprecated +# Version: 33November2023v2-Deprecated # Expires: 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -7139,6 +7139,7 @@ # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread .link.sv .4.fo +.kckb.st .*-trk.xyz .loadingnow.me .gsecurecontent.com @@ -17095,6 +17096,12 @@ .wazusoft.com .crackzoom.com .activators4windows.com +.cfgy6tg.pro +.hji98ik.click +.ko04rf8.cfd +.i3edtgyu.cfd +.pqlbh88z7.cfd +.i3s5qfuvs.cfd {+block} # ——— Standard malware that I stumbled upon on my own ——— @@ -19042,10 +19049,10 @@ .csgocup.ru .csgogf*.xyz .csgogift*.xyz -.discord*.gift +/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ # -.discord*.gift -.discord*.gift +/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ +/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ # .discord*.gifts .discord-give. @@ -22591,9 +22598,16 @@ # Tumblr spambots .shua999.com .ybd001.com +.deltacorriher.best +.104.21.82.132 +.172.67.158.57 +.[2606:4700:3030::6815:5284] +.[2606:4700:3037::ac43:9e39] # Google results for «SodaStream site:no cranberry» .adservice.google.*/ddm/clk/ /ad_click/q?&url= +# Laughably blatant fraud site +.cosercosplay.com {+block} # ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 778923f65..3f14bbea5 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 22November2023v1-Deprecated +# Version: 33November2023v2-Deprecated : expires = 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -7487,6 +7487,7 @@ msFilterList # Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread -d link.sv -d 4.fo +-d kckb.st # https://github.com/AdguardTeam/AdguardFilters/issues/139106 -d *-trk.xyz -d loadingnow.me @@ -17496,6 +17497,12 @@ msFilterList -d wazusoft.com -d crackzoom.com -d activators4windows.com +-d cfgy6tg.pro +-d hji98ik.click +-d ko04rf8.cfd +-d i3edtgyu.cfd +-d pqlbh88z7.cfd +-d i3s5qfuvs.cfd # ——— Standard malware that I stumbled upon on my own ——— # http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -19449,12 +19456,9 @@ msFilterList -+d discord.gift -+d discord.gift -+d discord.gift -d discord-give. @@ -23017,10 +23021,17 @@ msFilterList # Tumblr spambots -d shua999.com -d ybd001.com +-d deltacorriher.best +-d 104.21.82.132 +-d 172.67.158.57 +-d [2606:4700:3030::6815:5284] +-d [2606:4700:3037::ac43:9e39] # Google results for «SodaStream site:no cranberry» -d adservice.google.* ddm clk - ad_click q?&url= +# Laughably blatant fraud site +-d cosercosplay.com # ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— # Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and or bricking the phone.