diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 86ab26ab6..203c62bb9 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,29 +1,31 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Domains list version) # Version: 29December2023v2 # Expires: 2 days +# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. +!#if !env_mv3 # β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. # When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. # Tokelau (Put on break due to too many whitelistings being needed) - +!!!||tk # Mali (Put on break due to too many and too frequent whitelistings being needed) - +!!!||ml # Equatorial Guinea # Central African Republic # Palau (Put on break due to too many whitelistings being needed) - +!!!||pw # Legitimate use is almost non-existent, but has a tiny userbase in Japan. Its extreme common-ness in malware redirections means that the entry will be kept forever. # International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. +!!!||agency - - +!!!||monster @@ -34,25 +36,21 @@ - +!#if !env_mobile # β€”β€”β€” Attempted removal of Google search result entries that lead to the above top-level domains (Advanced adblockers only) β€”β€”β€” - # β€”β€”β€” You know those ultra-fraudulent auto-generated things that clutter up Google searches? These entries should remove some of them. β€”β€”β€” +!#endif - - +!#if env_mobile # β€”β€”β€” Attempted removal of Google search result entries that lead to the above top-level domains (For Google Mobile) β€”β€”β€” - - +!#endif # β€”β€”β€” For DuckDuckGo β€”β€”β€” - # β€”β€”β€” For Bing β€”β€”β€” - # β€”β€”β€” Old dead tech-related domains β€”β€”β€” # Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. adblock.gjtech.net @@ -281,10 +279,10 @@ discordap.com +!#if false - - +!#endif @@ -1133,12 +1131,12 @@ yulanoltunna.store zimmisballet.tech +!#if !ext_ublock - - +!#endif abbotinexperienced.com abedwithdrawalautograph.com abnegateexcavator.com @@ -3512,12 +3510,12 @@ zealsalts.com zeroclampentice.com zillionable.com zonedummy.com +!#if !ext_ublock - - +!#endif deviuser.com @@ -3928,7 +3926,7 @@ d2m2wsoho8qq12.cloudfront.net findanswersnow.net gpush.cogocast.net info.leadid.com - +!!!||listrakbi.com partner.mediawallahscript.com signupandturnyourscreenoffsafepowernow.date tag.cogocast.net @@ -4076,7 +4074,7 @@ news-back.org kokotrokot.com - +!!!? mugrikees.com alpha-news.org @@ -4211,7 +4209,7 @@ dabaicai.com qqfzn.com flash.cn dundeehills.group - +!+ NOT_OPTIMIZED 132.148.220.142 chess-progress.ru ouhastay.net @@ -4313,7 +4311,7 @@ top3hostngc.xyz 198.199.120.251 - +!+ NOT_OPTIMIZED # A Discord conversation I had about Throneful lover-finder.life @@ -4363,11 +4361,11 @@ cpmverdirect.com telemetry-urs-microsoft.com winrar-desktop.com +!#if !ext_ublock - - +!#endif trafredirtds.com pu020ev.com @@ -4678,6 +4676,7 @@ z-loading.icu z-prize.icu zfcurqe.art zuginmw.art +!#if !ext_ublock @@ -4686,8 +4685,7 @@ zuginmw.art - - +!#endif 85.17.31.152 95.211.26.202 bzsx.link @@ -4704,9 +4702,9 @@ ujtj.link wznp.link 158.247.212.220 165.227.168.212 +!#if !ext_ublock - - +!#endif k-yw.com fearconic.com atobunderevenes.com @@ -4947,9 +4945,9 @@ motherpipe.net 51.178.76.105 147.135.253.55 bnbdeal.net +!+ NOT_OPTIMIZED - - +!+ NOT_OPTIMIZED 146.19.169.98 146.19.169.99 @@ -8214,10 +8212,10 @@ zalesglobaljewelry.com zamberlanireland.com zapatillasvejacl.com zapatosaldochile.org +!#if !ext_ublock - - +!#endif @@ -8956,6 +8954,7 @@ tiendadieselchile.com vans-finland.com martensbratislava.sk zapatillasmcqueen.com +!#if !ext_ublock @@ -8964,8 +8963,7 @@ zapatillasmcqueen.com - - +!#endif @@ -9989,9 +9987,9 @@ zelrulte.com zevaimsu.net zewoagoo.com zoozistu.net +!#if !ext_ublock - - +!#endif academic-information.com academicvast.com amused-ground.com @@ -10112,7 +10110,7 @@ zogrepsili.com 208.88.225.116 208.88.225.117 208.88.225.119 - +!+ NOT_OPTIMIZED achilles-par.com adrastos-eli.com aegid-bal.com @@ -10588,9 +10586,9 @@ your-survey-services.com moneystartup.live fintechbest.online +!#if !ext_ublock - - +!#endif 1000-dollar.cash 1000-eur.cash algazira-updates.com @@ -10920,9 +10918,9 @@ usedhutsold.live truanet.com rumadel.com +!#if !ext_ublock - - +!#endif apigroup.xyz apihouse.xyz apiinfo.xyz @@ -11721,9 +11719,9 @@ zzrgab.com [2a02:b48:207:1::6] [2a02:b48:207:1::7] [2a02:b48:207:1::8] +!#if !ext_ublock - - +!#endif abdoser.co.in acelim.co.in adsos.xyz @@ -19003,9 +19001,9 @@ zzdb5p4upiug.com 192.243.59.12 192.243.59.13 192.243.59.20 +!#if !ext_ublock - - +!#endif # rule34hentai.net when uBlock Filters and AdGuard Base are turned off eivbjsegbino.com jpjmpqaupc.com @@ -19034,6 +19032,7 @@ tradeoffer.com.ru 194.226.139.7 95.181.157.36 95.181.172.204 +!#if !ext_ublock @@ -19055,8 +19054,7 @@ tradeoffer.com.ru - - +!#endif dispositionadverb.com wednesdayexpandingbarb.com broadslippery.com @@ -22166,11 +22164,11 @@ zoqueanbannets.tech zoysiasdossil.live zunianmedici.website zygomasnugify.uno +!#if !ext_ublock - - +!#endif # Fake Gymshark webshops gantdanmark.com gantnorge.com @@ -22344,7 +22342,7 @@ gadgetstwist.com gadgetsfarms.com techorfy.com - +!#if false # β€”β€”β€” If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions β€”β€”β€” # If you use AdGuard Home β‰₯v0.106.3, I warmly recommend manually pasting these entries into Settings β†’ DNS Settings β†’ Disallowed domains version.bind @@ -22355,7 +22353,7 @@ id.server dominiosvision.com hitnslab.info 1x1.cz - +!#endif # β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” @@ -22406,8 +22404,7 @@ hitnslab.info - - +!!!/\\/$doc # β€”β€”β€” Spam in comment sections across the internet about "working" from "home" β€”β€”β€” @@ -22416,10 +22413,10 @@ hitnslab.info # β€”β€”β€” Anti-'Malware comments' (Currently Disqus-specific) β€”β€”β€” - +!#if !ext_ublock # β€”β€”β€” Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) β€”β€”β€” if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data - +!#endif # β€”β€”β€” Anti-PUP (WIP) β€”β€”β€” # This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine) @@ -22434,7 +22431,6 @@ mip.api.mcafeewebadvisor.com - # All legitimate Pac-Man games would use "pac-man" links with a dash @@ -22443,6 +22439,9 @@ s.free.fr trmff.wpengine.com 212.27.60.108 +!#if !adguard +!#include uBO%20list%20extensions/AdGuardSafeBrowsing-ReverseEngineered.txt +!#endif @@ -22450,20 +22449,19 @@ trmff.wpengine.com +!#if !ext_ublock +# Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests +!#endif +!#endif +!#if !ext_ublock - - - - - - - +!#endif diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index ac6b91092..4dd817caa 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,28 +1,30 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Β«hostsΒ» file version) # Expires: 2 days +# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. +!#if !env_mv3 # β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. # When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. # Tokelau (Put on break due to too many whitelistings being needed) - +!!!||tk # Mali (Put on break due to too many and too frequent whitelistings being needed) - +!!!||ml # Equatorial Guinea # Central African Republic # Palau (Put on break due to too many whitelistings being needed) - +!!!||pw # Legitimate use is almost non-existent, but has a tiny userbase in Japan. Its extreme common-ness in malware redirections means that the entry will be kept forever. # International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. +!!!||agency - - +!!!||monster @@ -33,25 +35,21 @@ - +!#if !env_mobile # β€”β€”β€” Attempted removal of Google search result entries that lead to the above top-level domains (Advanced adblockers only) β€”β€”β€” - # β€”β€”β€” You know those ultra-fraudulent auto-generated things that clutter up Google searches? These entries should remove some of them. β€”β€”β€” +!#endif - - +!#if env_mobile # β€”β€”β€” Attempted removal of Google search result entries that lead to the above top-level domains (For Google Mobile) β€”β€”β€” - - +!#endif # β€”β€”β€” For DuckDuckGo β€”β€”β€” - # β€”β€”β€” For Bing β€”β€”β€” - # β€”β€”β€” Old dead tech-related domains β€”β€”β€” # Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. 127.0.0.1 adblock.gjtech.net @@ -273,10 +271,10 @@ +!#if false - - +!#endif @@ -1125,12 +1123,12 @@ 127.0.0.1 zimmisballet.tech +!#if !ext_ublock - - +!#endif 127.0.0.1 abbotinexperienced.com 127.0.0.1 abedwithdrawalautograph.com 127.0.0.1 abnegateexcavator.com @@ -3504,12 +3502,12 @@ 127.0.0.1 zeroclampentice.com 127.0.0.1 zillionable.com 127.0.0.1 zonedummy.com +!#if !ext_ublock - - +!#endif 127.0.0.1 deviuser.com @@ -3920,7 +3918,7 @@ 127.0.0.1 findanswersnow.net 127.0.0.1 gpush.cogocast.net 127.0.0.1 info.leadid.com - +!!!||listrakbi.com 127.0.0.1 partner.mediawallahscript.com 127.0.0.1 signupandturnyourscreenoffsafepowernow.date 127.0.0.1 tag.cogocast.net @@ -4068,7 +4066,7 @@ 127.0.0.1 kokotrokot.com - +!!!? 127.0.0.1 mugrikees.com 127.0.0.1 alpha-news.org @@ -4203,7 +4201,7 @@ 127.0.0.1 qqfzn.com 127.0.0.1 flash.cn 127.0.0.1 dundeehills.group - +!+ NOT_OPTIMIZED 127.0.0.1 132.148.220.142 127.0.0.1 chess-progress.ru 127.0.0.1 ouhastay.net @@ -4305,7 +4303,7 @@ 127.0.0.1 198.199.120.251 - +!+ NOT_OPTIMIZED # A Discord conversation I had about Throneful 127.0.0.1 lover-finder.life @@ -4355,11 +4353,11 @@ 127.0.0.1 telemetry-urs-microsoft.com 127.0.0.1 winrar-desktop.com +!#if !ext_ublock - - +!#endif 127.0.0.1 trafredirtds.com 127.0.0.1 pu020ev.com @@ -4670,6 +4668,7 @@ 127.0.0.1 z-prize.icu 127.0.0.1 zfcurqe.art 127.0.0.1 zuginmw.art +!#if !ext_ublock @@ -4678,8 +4677,7 @@ - - +!#endif 127.0.0.1 85.17.31.152 127.0.0.1 95.211.26.202 127.0.0.1 bzsx.link @@ -4696,9 +4694,9 @@ 127.0.0.1 wznp.link 127.0.0.1 158.247.212.220 127.0.0.1 165.227.168.212 +!#if !ext_ublock - - +!#endif 127.0.0.1 k-yw.com 127.0.0.1 fearconic.com 127.0.0.1 atobunderevenes.com @@ -4939,9 +4937,9 @@ 127.0.0.1 51.178.76.105 127.0.0.1 147.135.253.55 127.0.0.1 bnbdeal.net +!+ NOT_OPTIMIZED - - +!+ NOT_OPTIMIZED 127.0.0.1 146.19.169.98 127.0.0.1 146.19.169.99 @@ -8206,10 +8204,10 @@ 127.0.0.1 zamberlanireland.com 127.0.0.1 zapatillasvejacl.com 127.0.0.1 zapatosaldochile.org +!#if !ext_ublock - - +!#endif @@ -8948,6 +8946,7 @@ 127.0.0.1 vans-finland.com 127.0.0.1 martensbratislava.sk 127.0.0.1 zapatillasmcqueen.com +!#if !ext_ublock @@ -8956,8 +8955,7 @@ - - +!#endif @@ -9981,9 +9979,9 @@ 127.0.0.1 zevaimsu.net 127.0.0.1 zewoagoo.com 127.0.0.1 zoozistu.net +!#if !ext_ublock - - +!#endif 127.0.0.1 academic-information.com 127.0.0.1 academicvast.com 127.0.0.1 amused-ground.com @@ -10104,7 +10102,7 @@ 127.0.0.1 208.88.225.116 127.0.0.1 208.88.225.117 127.0.0.1 208.88.225.119 - +!+ NOT_OPTIMIZED 127.0.0.1 achilles-par.com 127.0.0.1 adrastos-eli.com 127.0.0.1 aegid-bal.com @@ -10580,9 +10578,9 @@ 127.0.0.1 moneystartup.live 127.0.0.1 fintechbest.online +!#if !ext_ublock - - +!#endif 127.0.0.1 1000-dollar.cash 127.0.0.1 1000-eur.cash 127.0.0.1 algazira-updates.com @@ -10912,9 +10910,9 @@ 127.0.0.1 truanet.com 127.0.0.1 rumadel.com +!#if !ext_ublock - - +!#endif 127.0.0.1 apigroup.xyz 127.0.0.1 apihouse.xyz 127.0.0.1 apiinfo.xyz @@ -11713,9 +11711,9 @@ +!#if !ext_ublock - - +!#endif 127.0.0.1 abdoser.co.in 127.0.0.1 acelim.co.in 127.0.0.1 adsos.xyz @@ -18995,9 +18993,9 @@ 127.0.0.1 192.243.59.12 127.0.0.1 192.243.59.13 127.0.0.1 192.243.59.20 +!#if !ext_ublock - - +!#endif # rule34hentai.net when uBlock Filters and AdGuard Base are turned off 127.0.0.1 eivbjsegbino.com 127.0.0.1 jpjmpqaupc.com @@ -19026,6 +19024,7 @@ 127.0.0.1 194.226.139.7 127.0.0.1 95.181.157.36 127.0.0.1 95.181.172.204 +!#if !ext_ublock @@ -19047,8 +19046,7 @@ - - +!#endif 127.0.0.1 dispositionadverb.com 127.0.0.1 wednesdayexpandingbarb.com 127.0.0.1 broadslippery.com @@ -22158,11 +22156,11 @@ 127.0.0.1 zoysiasdossil.live 127.0.0.1 zunianmedici.website 127.0.0.1 zygomasnugify.uno +!#if !ext_ublock - - +!#endif # Fake Gymshark webshops 127.0.0.1 gantdanmark.com 127.0.0.1 gantnorge.com @@ -22336,7 +22334,7 @@ 127.0.0.1 gadgetsfarms.com 127.0.0.1 techorfy.com - +!#if false # β€”β€”β€” If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions β€”β€”β€” # If you use AdGuard Home β‰₯v0.106.3, I warmly recommend manually pasting these entries into Settings β†’ DNS Settings β†’ Disallowed domains 127.0.0.1 version.bind @@ -22347,7 +22345,7 @@ 127.0.0.1 dominiosvision.com 127.0.0.1 hitnslab.info 127.0.0.1 1x1.cz - +!#endif # β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” @@ -22398,8 +22396,7 @@ - - +!!!/\\/$doc # β€”β€”β€” Spam in comment sections across the internet about "working" from "home" β€”β€”β€” @@ -22408,10 +22405,10 @@ # β€”β€”β€” Anti-'Malware comments' (Currently Disqus-specific) β€”β€”β€” - +!#if !ext_ublock # β€”β€”β€” Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) β€”β€”β€” 127.0.0.1 if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data - +!#endif # β€”β€”β€” Anti-PUP (WIP) β€”β€”β€” # This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine) @@ -22426,7 +22423,6 @@ - # All legitimate Pac-Man games would use "pac-man" links with a dash @@ -22435,6 +22431,9 @@ 127.0.0.1 trmff.wpengine.com 127.0.0.1 212.27.60.108 +!#if !adguard +!#include uBO%20list%20extensions/AdGuardSafeBrowsing-ReverseEngineered.txt +!#endif @@ -22442,20 +22441,19 @@ +!#if !ext_ublock +# Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests +!#endif +!#endif +!#if !ext_ublock - - - - - - - +!#endif diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset index 1f4412cc4..548811952 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset @@ -1,11 +1,17 @@ # Title: Dandelion Sprout's and other adblocker lists' IPs # Expires: 2 days -# Description: This IP set combines IP and CIDR addresses from plentiful of major adblocker lists. It contains heavily altered content from Dandelion Sprout's Anti-Malware List, Dandelion Sprout's Nordic Filters, EasyList, uBlock Filters, uBlock Filters - Badware Risks, AdGuard Base Filter, AdGuard French Filter, EasyList Germany, ABP Anti-Circumvention Filters, RU AdList, Liste AR, and EasyList Spanish. -# For more information and details about this list and other lists of mine, go to https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english # When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. 109.201.135.46 138.68.252.54 103.224.212.249 +199.59.243.222 +173.208.96.42 +173.208.96.43 +173.208.96.44 +173.208.96.45 +173.208.96.46 +213.227.149.208 +213.227.149.211 54.174.156.141 54.209.22.226 54.91.125.197 @@ -369,14 +375,6 @@ 172.67.158.57 [2606:4700:3030::6815:5284] [2606:4700:3037::ac43:9e39] -199.59.243.222 -173.208.96.42 -173.208.96.43 -173.208.96.44 -173.208.96.45 -173.208.96.46 -213.227.149.208 -213.227.149.211 212.27.60.108 3.248.18.175 13.49.35.236