starred/adfilt
1
0
Fork 0
mirror of https://github.com/DandelionSprout/adfilt.git synced 2026-09-24 22:03:36 +01:00
Code Issues Packages Projects Releases 4 Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Imre Kristoffer Eilertsen
2024-01-08 01:38:19 +01:00
committed by GitHub
parent f9e75edeee
commit a25ce67890
3 changed files with 132 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Alternate versions Anti-Malware List/AntiMalwareDomains.txt
+62 -64
View File
@@ -1,29 +1,31 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version)
# Version: 29December2023v2
# Expires: 2 days
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
!#if !env_mv3
# ——— Bad top-level domains ———
# You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you.
# When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
# Tokelau (Put on break due to too many whitelistings being needed)
!!!||tk
# Mali (Put on break due to too many and too frequent whitelistings being needed)
!!!||ml
# Equatorial Guinea
# Central African Republic
# Palau (Put on break due to too many whitelistings being needed)
!!!||pw
# Legitimate use is almost non-existent, but has a tiny userbase in Japan. Its extreme common-ness in malware redirections means that the entry will be kept forever.
# International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent.
!!!||agency
!!!||monster
@@ -34,25 +36,21 @@
!#if !env_mobile
# ——— Attempted removal of Google search result entries that lead to the above top-level domains (Advanced adblockers only) ———
# ——— You know those ultra-fraudulent auto-generated things that clutter up Google searches? These entries should remove some of them. ———
!#endif
!#if env_mobile
# ——— Attempted removal of Google search result entries that lead to the above top-level domains (For Google Mobile) ———
!#endif
# ——— For DuckDuckGo ———
# ——— For Bing ———
# ——— Old dead tech-related domains ———
# Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them.
adblock.gjtech.net
@@ -281,10 +279,10 @@ discordap.com
!#if false
!#endif
@@ -1133,12 +1131,12 @@ yulanoltunna.store
zimmisballet.tech
!#if !ext_ublock
!#endif
abbotinexperienced.com
abedwithdrawalautograph.com
abnegateexcavator.com
@@ -3512,12 +3510,12 @@ zealsalts.com
zeroclampentice.com
zillionable.com
zonedummy.com
!#if !ext_ublock
!#endif
deviuser.com
@@ -3928,7 +3926,7 @@ d2m2wsoho8qq12.cloudfront.net
findanswersnow.net
gpush.cogocast.net
info.leadid.com
!!!||listrakbi.com
partner.mediawallahscript.com
signupandturnyourscreenoffsafepowernow.date
tag.cogocast.net
@@ -4076,7 +4074,7 @@ news-back.org
kokotrokot.com
!!!?
mugrikees.com
alpha-news.org
@@ -4211,7 +4209,7 @@ dabaicai.com
qqfzn.com
flash.cn
dundeehills.group
!+ NOT_OPTIMIZED
132.148.220.142
chess-progress.ru
ouhastay.net
@@ -4313,7 +4311,7 @@ top3hostngc.xyz
198.199.120.251
!+ NOT_OPTIMIZED
# A Discord conversation I had about Throneful
lover-finder.life
@@ -4363,11 +4361,11 @@ cpmverdirect.com
telemetry-urs-microsoft.com
winrar-desktop.com
!#if !ext_ublock
!#endif
trafredirtds.com
pu020ev.com
@@ -4678,6 +4676,7 @@ z-loading.icu
z-prize.icu
zfcurqe.art
zuginmw.art
!#if !ext_ublock
@@ -4686,8 +4685,7 @@ zuginmw.art
!#endif
85.17.31.152
95.211.26.202
bzsx.link
@@ -4704,9 +4702,9 @@ ujtj.link
wznp.link
158.247.212.220
165.227.168.212
!#if !ext_ublock
!#endif
k-yw.com
fearconic.com
atobunderevenes.com
@@ -4947,9 +4945,9 @@ motherpipe.net
51.178.76.105
147.135.253.55
bnbdeal.net
!+ NOT_OPTIMIZED
!+ NOT_OPTIMIZED
146.19.169.98
146.19.169.99
@@ -8214,10 +8212,10 @@ zalesglobaljewelry.com
zamberlanireland.com
zapatillasvejacl.com
zapatosaldochile.org
!#if !ext_ublock
!#endif
@@ -8956,6 +8954,7 @@ tiendadieselchile.com
vans-finland.com
martensbratislava.sk
zapatillasmcqueen.com
!#if !ext_ublock
@@ -8964,8 +8963,7 @@ zapatillasmcqueen.com
!#endif
@@ -9989,9 +9987,9 @@ zelrulte.com
zevaimsu.net
zewoagoo.com
zoozistu.net
!#if !ext_ublock
!#endif
academic-information.com
academicvast.com
amused-ground.com
@@ -10112,7 +10110,7 @@ zogrepsili.com
208.88.225.116
208.88.225.117
208.88.225.119
!+ NOT_OPTIMIZED
achilles-par.com
adrastos-eli.com
aegid-bal.com
@@ -10588,9 +10586,9 @@ your-survey-services.com
moneystartup.live
fintechbest.online
!#if !ext_ublock
!#endif
1000-dollar.cash
1000-eur.cash
algazira-updates.com
@@ -10920,9 +10918,9 @@ usedhutsold.live
truanet.com
rumadel.com
!#if !ext_ublock
!#endif
apigroup.xyz
apihouse.xyz
apiinfo.xyz
@@ -11721,9 +11719,9 @@ zzrgab.com
[2a02:b48:207:1::6]
[2a02:b48:207:1::7]
[2a02:b48:207:1::8]
!#if !ext_ublock
!#endif
abdoser.co.in
acelim.co.in
adsos.xyz
@@ -19003,9 +19001,9 @@ zzdb5p4upiug.com
192.243.59.12
192.243.59.13
192.243.59.20
!#if !ext_ublock
!#endif
# rule34hentai.net when uBlock Filters and AdGuard Base are turned off
eivbjsegbino.com
jpjmpqaupc.com
@@ -19034,6 +19032,7 @@ tradeoffer.com.ru
194.226.139.7
95.181.157.36
95.181.172.204
!#if !ext_ublock
@@ -19055,8 +19054,7 @@ tradeoffer.com.ru
!#endif
dispositionadverb.com
wednesdayexpandingbarb.com
broadslippery.com
@@ -22166,11 +22164,11 @@ zoqueanbannets.tech
zoysiasdossil.live
zunianmedici.website
zygomasnugify.uno
!#if !ext_ublock
!#endif
# Fake Gymshark webshops
gantdanmark.com
gantnorge.com
@@ -22344,7 +22342,7 @@ gadgetstwist.com
gadgetsfarms.com
techorfy.com
!#if false
# ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
# If you use AdGuard Home ≥v0.106.3, I warmly recommend manually pasting these entries into Settings → DNS Settings → Disallowed domains
version.bind
@@ -22355,7 +22353,7 @@ id.server
dominiosvision.com
hitnslab.info
1x1.cz
!#endif
# ——— Usually used by various groups who buy old domains and display illicit ads on them ———
@@ -22406,8 +22404,7 @@ hitnslab.info
!!!/\\/$doc
# ——— Spam in comment sections across the internet about "working" from "home" ———
@@ -22416,10 +22413,10 @@ hitnslab.info
# ——— Anti-'Malware comments' (Currently Disqus-specific) ———
!#if !ext_ublock
# ——— Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) ———
if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data
!#endif
# ——— Anti-PUP (WIP) ———
# This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine)
@@ -22434,7 +22431,6 @@ mip.api.mcafeewebadvisor.com
# All legitimate Pac-Man games would use "pac-man" links with a dash
@@ -22443,6 +22439,9 @@ s.free.fr
trmff.wpengine.com
212.27.60.108
!#if !adguard
!#include uBO%20list%20extensions/AdGuardSafeBrowsing-ReverseEngineered.txt
!#endif
@@ -22450,20 +22449,19 @@ trmff.wpengine.com
!#if !ext_ublock
# Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests
!#endif
!#endif
!#if !ext_ublock
!#endif
Alternate versions Anti-Malware List/AntiMalwareHosts.txt
+62 -64
View File
@@ -1,28 +1,30 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version)
# Expires: 2 days
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
!#if !env_mv3
# ——— Bad top-level domains ———
# You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you.
# When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
# Tokelau (Put on break due to too many whitelistings being needed)
!!!||tk
# Mali (Put on break due to too many and too frequent whitelistings being needed)
!!!||ml
# Equatorial Guinea
# Central African Republic
# Palau (Put on break due to too many whitelistings being needed)
!!!||pw
# Legitimate use is almost non-existent, but has a tiny userbase in Japan. Its extreme common-ness in malware redirections means that the entry will be kept forever.
# International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent.
!!!||agency
!!!||monster
@@ -33,25 +35,21 @@
!#if !env_mobile
# ——— Attempted removal of Google search result entries that lead to the above top-level domains (Advanced adblockers only) ———
# ——— You know those ultra-fraudulent auto-generated things that clutter up Google searches? These entries should remove some of them. ———
!#endif
!#if env_mobile
# ——— Attempted removal of Google search result entries that lead to the above top-level domains (For Google Mobile) ———
!#endif
# ——— For DuckDuckGo ———
# ——— For Bing ———
# ——— Old dead tech-related domains ———
# Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them.
127.0.0.1 adblock.gjtech.net
@@ -273,10 +271,10 @@
!#if false
!#endif
@@ -1125,12 +1123,12 @@
127.0.0.1 zimmisballet.tech
!#if !ext_ublock
!#endif
127.0.0.1 abbotinexperienced.com
127.0.0.1 abedwithdrawalautograph.com
127.0.0.1 abnegateexcavator.com
@@ -3504,12 +3502,12 @@
127.0.0.1 zeroclampentice.com
127.0.0.1 zillionable.com
127.0.0.1 zonedummy.com
!#if !ext_ublock
!#endif
127.0.0.1 deviuser.com
@@ -3920,7 +3918,7 @@
127.0.0.1 findanswersnow.net
127.0.0.1 gpush.cogocast.net
127.0.0.1 info.leadid.com
!!!||listrakbi.com
127.0.0.1 partner.mediawallahscript.com
127.0.0.1 signupandturnyourscreenoffsafepowernow.date
127.0.0.1 tag.cogocast.net
@@ -4068,7 +4066,7 @@
127.0.0.1 kokotrokot.com
!!!?
127.0.0.1 mugrikees.com
127.0.0.1 alpha-news.org
@@ -4203,7 +4201,7 @@
127.0.0.1 qqfzn.com
127.0.0.1 flash.cn
127.0.0.1 dundeehills.group
!+ NOT_OPTIMIZED
127.0.0.1 132.148.220.142
127.0.0.1 chess-progress.ru
127.0.0.1 ouhastay.net
@@ -4305,7 +4303,7 @@
127.0.0.1 198.199.120.251
!+ NOT_OPTIMIZED
# A Discord conversation I had about Throneful
127.0.0.1 lover-finder.life
@@ -4355,11 +4353,11 @@
127.0.0.1 telemetry-urs-microsoft.com
127.0.0.1 winrar-desktop.com
!#if !ext_ublock
!#endif
127.0.0.1 trafredirtds.com
127.0.0.1 pu020ev.com
@@ -4670,6 +4668,7 @@
127.0.0.1 z-prize.icu
127.0.0.1 zfcurqe.art
127.0.0.1 zuginmw.art
!#if !ext_ublock
@@ -4678,8 +4677,7 @@
!#endif
127.0.0.1 85.17.31.152
127.0.0.1 95.211.26.202
127.0.0.1 bzsx.link
@@ -4696,9 +4694,9 @@
127.0.0.1 wznp.link
127.0.0.1 158.247.212.220
127.0.0.1 165.227.168.212
!#if !ext_ublock
!#endif
127.0.0.1 k-yw.com
127.0.0.1 fearconic.com
127.0.0.1 atobunderevenes.com
@@ -4939,9 +4937,9 @@
127.0.0.1 51.178.76.105
127.0.0.1 147.135.253.55
127.0.0.1 bnbdeal.net
!+ NOT_OPTIMIZED
!+ NOT_OPTIMIZED
127.0.0.1 146.19.169.98
127.0.0.1 146.19.169.99
@@ -8206,10 +8204,10 @@
127.0.0.1 zamberlanireland.com
127.0.0.1 zapatillasvejacl.com
127.0.0.1 zapatosaldochile.org
!#if !ext_ublock
!#endif
@@ -8948,6 +8946,7 @@
127.0.0.1 vans-finland.com
127.0.0.1 martensbratislava.sk
127.0.0.1 zapatillasmcqueen.com
!#if !ext_ublock
@@ -8956,8 +8955,7 @@
!#endif
@@ -9981,9 +9979,9 @@
127.0.0.1 zevaimsu.net
127.0.0.1 zewoagoo.com
127.0.0.1 zoozistu.net
!#if !ext_ublock
!#endif
127.0.0.1 academic-information.com
127.0.0.1 academicvast.com
127.0.0.1 amused-ground.com
@@ -10104,7 +10102,7 @@
127.0.0.1 208.88.225.116
127.0.0.1 208.88.225.117
127.0.0.1 208.88.225.119
!+ NOT_OPTIMIZED
127.0.0.1 achilles-par.com
127.0.0.1 adrastos-eli.com
127.0.0.1 aegid-bal.com
@@ -10580,9 +10578,9 @@
127.0.0.1 moneystartup.live
127.0.0.1 fintechbest.online
!#if !ext_ublock
!#endif
127.0.0.1 1000-dollar.cash
127.0.0.1 1000-eur.cash
127.0.0.1 algazira-updates.com
@@ -10912,9 +10910,9 @@
127.0.0.1 truanet.com
127.0.0.1 rumadel.com
!#if !ext_ublock
!#endif
127.0.0.1 apigroup.xyz
127.0.0.1 apihouse.xyz
127.0.0.1 apiinfo.xyz
@@ -11713,9 +11711,9 @@
!#if !ext_ublock
!#endif
127.0.0.1 abdoser.co.in
127.0.0.1 acelim.co.in
127.0.0.1 adsos.xyz
@@ -18995,9 +18993,9 @@
127.0.0.1 192.243.59.12
127.0.0.1 192.243.59.13
127.0.0.1 192.243.59.20
!#if !ext_ublock
!#endif
# rule34hentai.net when uBlock Filters and AdGuard Base are turned off
127.0.0.1 eivbjsegbino.com
127.0.0.1 jpjmpqaupc.com
@@ -19026,6 +19024,7 @@
127.0.0.1 194.226.139.7
127.0.0.1 95.181.157.36
127.0.0.1 95.181.172.204
!#if !ext_ublock
@@ -19047,8 +19046,7 @@
!#endif
127.0.0.1 dispositionadverb.com
127.0.0.1 wednesdayexpandingbarb.com
127.0.0.1 broadslippery.com
@@ -22158,11 +22156,11 @@
127.0.0.1 zoysiasdossil.live
127.0.0.1 zunianmedici.website
127.0.0.1 zygomasnugify.uno
!#if !ext_ublock
!#endif
# Fake Gymshark webshops
127.0.0.1 gantdanmark.com
127.0.0.1 gantnorge.com
@@ -22336,7 +22334,7 @@
127.0.0.1 gadgetsfarms.com
127.0.0.1 techorfy.com
!#if false
# ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
# If you use AdGuard Home ≥v0.106.3, I warmly recommend manually pasting these entries into Settings → DNS Settings → Disallowed domains
127.0.0.1 version.bind
@@ -22347,7 +22345,7 @@
127.0.0.1 dominiosvision.com
127.0.0.1 hitnslab.info
127.0.0.1 1x1.cz
!#endif
# ——— Usually used by various groups who buy old domains and display illicit ads on them ———
@@ -22398,8 +22396,7 @@
!!!/\\/$doc
# ——— Spam in comment sections across the internet about "working" from "home" ———
@@ -22408,10 +22405,10 @@
# ——— Anti-'Malware comments' (Currently Disqus-specific) ———
!#if !ext_ublock
# ——— Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) ———
127.0.0.1 if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data
!#endif
# ——— Anti-PUP (WIP) ———
# This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine)
@@ -22426,7 +22423,6 @@
# All legitimate Pac-Man games would use "pac-man" links with a dash
@@ -22435,6 +22431,9 @@
127.0.0.1 trmff.wpengine.com
127.0.0.1 212.27.60.108
!#if !adguard
!#include uBO%20list%20extensions/AdGuardSafeBrowsing-ReverseEngineered.txt
!#endif
@@ -22442,20 +22441,19 @@
!#if !ext_ublock
# Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests
!#endif
!#endif
!#if !ext_ublock
!#endif
Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset
+8 -10
View File
@@ -1,11 +1,17 @@
# Title: Dandelion Sprout's and other adblocker lists' IPs
# Expires: 2 days
# Description: This IP set combines IP and CIDR addresses from plentiful of major adblocker lists. It contains heavily altered content from Dandelion Sprout's Anti-Malware List, Dandelion Sprout's Nordic Filters, EasyList, uBlock Filters, uBlock Filters - Badware Risks, AdGuard Base Filter, AdGuard French Filter, EasyList Germany, ABP Anti-Circumvention Filters, RU AdList, Liste AR, and EasyList Spanish.
# For more information and details about this list and other lists of mine, go to https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english
# When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
109.201.135.46
138.68.252.54
103.224.212.249
199.59.243.222
173.208.96.42
173.208.96.43
173.208.96.44
173.208.96.45
173.208.96.46
213.227.149.208
213.227.149.211
54.174.156.141
54.209.22.226
54.91.125.197
@@ -369,14 +375,6 @@
172.67.158.57
[2606:4700:3030::6815:5284]
[2606:4700:3037::ac43:9e39]
199.59.243.222
173.208.96.42
173.208.96.43
173.208.96.44
173.208.96.45
173.208.96.46
213.227.149.208
213.227.149.211
212.27.60.108
3.248.18.175
13.49.35.236