diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index c168c9817..2f2466afc 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -4803,7 +4803,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||daque.cn^$all,~inline-font ! https://www•huorong.cn/info/1598957552515.html ||dabaicai.com^$all,~inline-font -! https://www•huorong.cn/info/1617368984641.html +! https://www•huorong•cn/info/1617368984641.html ||qqfzn.com^$all,~inline-font ! https://github.com/uBlockOrigin/uAssets/pull/10017 ||flash.cn^$all,~inline-font @@ -4815,11 +4815,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 ||chess-progress.ru^$doc ||ouhastay.net^$all,~inline-font -! https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 +! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 ||askara.super.site^$all,~inline-font ||cdn.discordapp.com/attachments/916361798763053136/917187511053320202/Askara.exe^$all,~inline-font ||discord.com/invite/askara^$doc -! https://scammer.info/t/fake-facebook-login-page/84939 +! https://scammer•info/t/fake-facebook-login-page/84939 ||royyer.us/R8cWuvQjhtM^$all,~inline-font ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908 ! https://www•tek.no/i/lVeQAe/ @@ -4833,7 +4833,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] *$all,ipaddress=52.53.243.52 ||34.201.22.10^$all,~inline-font *$all,ipaddress=34.201.22.10 -! https://scammer.info/t/crypto-scammers-onceagain/85354 +! https://scammer•info/t/crypto-scammers-onceagain/85354 ||business.google.com/website/billyandscapedesign^$all,~inline-font ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community ||123.10.225.196^$all,~inline-font @@ -4856,7 +4856,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||onemacusa.net^$all,~inline-font ! https://github.com/DevSpen/links/pull/3 ||systemupdatecontrol.com^$all,~inline-font -! https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ +! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ ||mozicrack.com^$all,~inline-font ||download-srvr.xyz^$all,~inline-font ||134.122.115.190^$all,~inline-font @@ -4871,7 +4871,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||findes.co^$doc ||supersong.nl/upload/6277.rar^$all,~inline-font -! https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ +! https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ ||freeprosoftz.com^$all,~inline-font ||mediafire.com/file/pu0m2luacc3fh8h/file-password___2345.rar/file$all,~inline-font ||mediafire.com/coe39m9f9tyg/pu0m2luacc3fh8h/file-password___2345%282%29.rar$all,~inline-font @@ -4916,7 +4916,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sites.google.com/mytv/maintenance^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 /(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$doc,popup,domain=~malware-redirection-trains.* -! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# +! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^$all,~inline-font ||calsign.xyz^$all,~inline-font ||jwq98u.xyz^$all,~inline-font @@ -4941,13 +4941,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||maanews.xyz^$all,~inline-font ||newsdeals.xyz^$all,~inline-font ||dreamdigimedia.blogspot.com^$all,~inline-font -! https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ +! https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ ||activatorwin.com^$all,~inline-font ||freeversioncrack.com^$document ||top3hostngc.xyz^$all,~inline-font ||198.199.120.251^$all,~inline-font *$all,ipaddress=198.199.120.251 -! https://www•telia.no/kundeservice/mobil/malware-flubot-android/ +! https://www•telia•no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/$doc ! A Discord conversation I had about Throneful @@ -5349,7 +5349,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] *$all,ipaddress=85.17.31.152 ||95.211.26.202^$all,~inline-font *$all,ipaddress=95.211.26.202 -! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 +! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 ||bzsx.link^$all,~inline-font ||dfvd.link^$all,~inline-font ||dsvs.link^$all,~inline-font @@ -5367,10 +5367,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||165.227.168.212^$doc *$all,ipaddress=165.227.168.212 !#if !ext_ublock -! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ +! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ ://162.241.115.$doc !#endif -! https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599 +! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 ||k-yw.com^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/125285 ||fearconic.com^$all,~inline-font @@ -7668,7 +7668,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] *$all,ipaddress=139.45.197.239 ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub.$document,popup -! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 +! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 ||adblock-chrome.net^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/137635 ||aaolh.icu^$all,~inline-font @@ -9766,13 +9766,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] *$all,ipaddress=185.155.184.98 ||194.110.247.242^$all,~inline-font *$all,ipaddress=194.110.247.242 -! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ +! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ ||ups-addressed.me^$all,~inline-font ||ups-quote.me^$all,~inline-font ||meta-whatsapp.me^$all,~inline-font ||54.219.218.169^$doc *$all,ipaddress=54.219.218.169 -! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ +! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^$all,~inline-font ||0365online.com^$all,~inline-font ||365-notifcation.com^$all,~inline-font @@ -10204,7 +10204,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||yourorderupdate.com^$all,~inline-font ||64.132.201.92^$all,~inline-font *$all,ipaddress=64.132.201.92 -! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener +! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||acessmygov.online^$all,~inline-font ||centerlinkmygov.com^$all,~inline-font ||centierssl.us^$all,~inline-font @@ -10937,7 +10937,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||54.204.83.105^$all,~inline-font *$all,ipaddress=54.204.83.105 ! https://github.com/DandelionSprout/adfilt/issues/808 -! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) +! https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) ||jonathanbartz.com^$all,~inline-font ||jp.imonitorsoft.com^$all,~inline-font ||junk-bros.com^$all,~inline-font @@ -11640,7 +11640,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||tiujejhexe.click^$all,~inline-font ||vuegebjexe.click^$all,~inline-font ||xauhusjexe.click^$all,~inline-font -! https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ +! https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ ||tzn03.me^$all,~inline-font ! https://github.com/AdguardTeam/AdguardFilters/issues/156573 ||707.su^$all,~inline-font @@ -17311,7 +17311,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) /(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~third-party,domain=github.*|~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev|~archive.* ||github.sale^$all,~inline-font -! https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ +! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ ||0nedr1ved0cumentonline.com^$all,~inline-font ||88godetailsvc.com^$all,~inline-font ||amexmobileupdate.cc^$all,~inline-font @@ -17535,7 +17535,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||no-oppdatere.$all,~inline-font ||no-oppdatert.$all,domain=~no ||179.43.189.62$all,~inline-font -! https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/ +! https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/ ||authde.us^$all,~inline-font ||dc-r.us^$all,~inline-font ||de-po.us^$all,~inline-font @@ -23286,7 +23286,7 @@ toorgle.net##.join ||amoxycillin1st.com^$all,~inline-font ! The Jerma985 Discord server ||crazycrabreedville.com^$all,~inline-font -! https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021) +! https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021) ||messium.info^$all,~inline-font ! Various Google searches ://hullcitytigers.com^$doc @@ -24885,7 +24885,7 @@ toorgle.net##.join !#if !ext_ublock /^(https?://)?192\.243\.59\.\d{1,3}($|/)/$doc !#endif -! rule34hentai.net when uBlock Filters and AdGuard Base are turned off +! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^$all,~inline-font ||jpjmpqaupc.com^$all,~inline-font ||qrclevrfjw.com^$all,~inline-font @@ -25591,11 +25591,11 @@ toorgle.net##.join ||medicinehelp.news^$doc ||147.135.16.27^$doc *$all,ipaddress=147.135.16.27 -! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img +! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^$doc ! Spambot posts on Tumblr (19/09/2022) tumblr.com##div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://bit.ly/"]) -! https://scambiofigu.forumcommunity•net/?t=57482915 +! https://scambiofigu•forumcommunity•net/?t=57482915 ||scambiofigu.net^$all,~inline-font ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious apkfab.com##.tip-extension @@ -25749,16 +25749,16 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||tvbxrr4ym3.click^$all,~inline-font ||8ebtdbsjsu.click^$all,~inline-font ||eicxz6jfjaw.click^$all,~inline-font -! https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2 +! https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2 ||ru-torproject.ru^$all,~inline-font ||anapatformacion.org/modules/file/tor/tor-browser.zip^$all,~inline-font ! https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required) ! https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required) -! https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 +! https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 ||123secure.org^$all,~inline-font ! https://github.com/RPiList/specials/issues/948#issuecomment-1458739160 ||yuppdownload.com^$all,~inline-font -! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) +! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) ||34.80.59.191^$all,~inline-font *$all,ipaddress=34.80.59.191 ! Various domains on https://securitytrails•com/list/ip/72•14•178•174