From a57faa758ae8c21668fdec2f8a32cf36ffea541f Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Thu, 13 Aug 2020 03:02:24 +0200 Subject: [PATCH] Combined many of the categories --- Dandelion Sprout's Anti-Malware List.txt | 84 +++++++++++------------- 1 file changed, 37 insertions(+), 47 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 0b323db00..ecfa35f8b 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,12 +1,12 @@ [Adblock Plus 3.4] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List -! Version: 11August2020v1-Beta +! Version: 13August2020v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists ! For more information, details, helpful tools, and other lists that I've made, visit https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english -! β€”β€”β€” Country domains β€”β€”β€” +! β€”β€”β€” Bad top-level domains β€”β€”β€” ! You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. ! Tokelau ||tk^$doc,domain=~coolcmd.tk|~budterence.tk|~google.tk|~transportnews.tk|~unicorncardlist.tk|~c0d3c.tk|~anonytext.tk|~tokelau-info.tk|~fakaofo.tk|~loljp-wiki.tk|~ninetail.tk|~goshujin.tk|~graph.tk|~haopro.tk|~dls2.pokeacer.tk|~nolfrevival.tk|~coppersurfer.tk|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers. @@ -20,10 +20,7 @@ ||cf^$doc,domain=~google.cf|~rths.cf|~voitures.cf|~assembleenationale-rca.cf|~cps-rca.cf|~acap.cf|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers. ! Palau ||pw^$doc,domain=~libgen.pw|~petridish.pw|~palaugov.pw|~ Warning displayed due to: It's a top-level domain that allows free website registration; which made it abused by scammers. - -! β€”β€”β€” Topical domains β€”β€”β€” -! These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. -! Presumably fake loans +! International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. ||loan^$doc,domain=~ Warning displayed due to: It's a topical domain whose sites have an unusally big chance of being fraudulent. ||agency^$doc,domain=~ Warning displayed due to: It's a topical domain whose sites have an unusally big chance of being fraudulent. ||gdn^$doc,domain=~ Warning displayed due to: It's a topical domain whose sites have an unusally big chance of being fraudulent. @@ -61,7 +58,8 @@ google.*##a[oncontextmenu][href*=".bid/"]:upward(2) google.*##a[oncontextmenu][href*=".top/"]:upward(2) google.*##a[oncontextmenu][href*=".php?xxx="]:upward(2) -! β€”β€”β€” Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +! β€”β€”β€” Old dead tech-related domains β€”β€”β€” +! Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. ||adblock.gjtech.net^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and has been picked up by malware pushers. ||spam404bl.com^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. ||109.201.135.46^$doc,domain=~ Warning displayed due to: Malware pushers. @@ -77,11 +75,28 @@ google.*##a[oncontextmenu][href*=".php?xxx="]:upward(2) ||njabl.org^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. ||dutchmega.nl^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. ||juvander.net^$doc,domain=~ Warning displayed due to: That site does no longer host adblock lists and may have been picked up by malware pushers. - -! β€”β€”β€” Old tech-related domains that have fallen into the hands of questionable new owners. β€”β€”β€” +! Malicious domains found in videogame manuals +||acclaimsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now pushing malware. +||acclaimmaxsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now promoting fake consumer loans. +||hip-games.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. +||thq.com.au^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. +||gp32.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. +! Dead router connection URΔ°s ! To log in to TP-Link routers, use tplinkwifi.net instead. ||tplinklogin.net^$doc,domain=~ Warning displayed due to: TP-Link embarrasingly losing the rights to that router login domain; and it may have been snapped up by malware pushers. Please try tplinkwifi.net instead. ||tplinkextender.net^$doc,domain=~ Warning displayed due to: TP-Link embarrasingly losing the rights to that router login domain; and it has been snapped up by malware pushers. Please try tplinkwifi.net instead. +! Old Linux-related domains +! How these links still remain in Unetbootin, is anyone's guess. +||dreamlinux.com.br^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. +||dreamlinux.net^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. +||dreamlinux.info^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. +||104.24.117.74^$doc,domain=~ Warning displayed due to: Malware pushers +||104.24.116.74^$doc,domain=~ Warning displayed due to: Malware pushers +||[2606:4700:30::6818:754a]^$doc,domain=~ Warning displayed due to: Malware pushers +||[2606:4700:30::6818:744a]^$doc,domain=~ Warning displayed due to: Malware pushers +||hacktolive.org^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. +||mandriva.com^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. +! Other ||ublock.org^$doc,domain=~ Warning displayed due to: It playing on its old similarities with uBlock Origin to solicit large donations for limited work effort. ||138.68.252.54^$doc,domain=~ Warning displayed due to: It playing on its old similarities with uBlock Origin to solicit large donations for limited work effort. @@ -97,19 +112,8 @@ google.*##a[oncontextmenu][href*=".php?xxx="]:upward(2) ||test-iq.org^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. ||officialiqtests.com^$doc,domain=~ Warning displayed due to: The IQ test will ask for money at the end to show you your result. -! β€”β€”β€” Old Linux-related domains that have been snapped up for ads, adware, and/or malware. β€”β€”β€” -! How these links still remain in Unetbootin, is anyone's guess. -||dreamlinux.com.br^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. -||dreamlinux.net^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. -||dreamlinux.info^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. -||104.24.117.74^$doc,domain=~ Warning displayed due to: Malware pushers -||104.24.116.74^$doc,domain=~ Warning displayed due to: Malware pushers -||[2606:4700:30::6818:754a]^$doc,domain=~ Warning displayed due to: Malware pushers -||[2606:4700:30::6818:744a]^$doc,domain=~ Warning displayed due to: Malware pushers -||hacktolive.org^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. -||mandriva.com^$doc,domain=~ Warning displayed due to: Its Linux distro having been discontinued and forfeiting their domains; which may have been snapped up by malware pushers. - -! β€”β€”β€” ReImagePlus links (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +! β€”β€”β€” Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware β€”β€”β€” +! ReImagePlus (Also added to "uBlock Filters - Badware Risks") ! https://windowsreport.com/extend-windows-laptop-battery-life/ windowsreport.com##.code-block ! https://appuals.com/fix-error-0x800701e3-on-windows-7-8-1-10/ @@ -144,13 +148,11 @@ majorgeeks.com#?#b:-abp-has(a[target^="reimage"]) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#.nfc-bottom-right:-abp-contains(Reimage) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(Reimage) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.quick-download-button-text - -! β€”β€”β€” ScanUtilities links β€”β€”β€” +! ScanUtilities ! https://www.bynarycodes.com/fix-windows-10-update-error-0x80070006/ bynarycodes.com##div[class^="bynar-content_"] bynarycodes.com#?#.panel:-abp-contains(a[href*="scanutilities.com"]) - -! β€”β€”β€” Driver Easy links β€”β€”β€” +! Driver Easy ! https://www.drivereasy.com/knowledge/fix-critical-service-failed-blue-screen-error-on-windows-10/ drivereasy.com#?#.pakb-content ol:-abp-contains(Download and install Driver Easy) drivereasy.com#?#.pakb-content p:-abp-contains(Driver Easy) @@ -169,15 +171,12 @@ drivereasy.com#?#.pakb-content figcaption:-abp-contains(for free if you like) drivereasy.com#?#.pakb-content li:-abp-has(a:-abp-contains(Update drivers with Driver Easy)) ! https://www.drivereasy.com/knowledge/solved-this-display-does-not-support-hdcp/ drivereasy.com#?#.pakb-content p:-abp-contains(click Update All) - -! β€”β€”β€” Slimware DriverUpdate links β€”β€”β€” +! Slimware DriverUpdate ! https://forums.windowscentral.com/ forums.windowscentral.com###navbar_notice_33 - -! β€”β€”β€” Driverpack Online links (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») β€”β€”β€” +! Driverpack Online (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») ||google-analytics.com^$domain=sdi-tool.org - -! β€”β€”β€” SpyHunter links β€”β€”β€” +! SpyHunter links ! https://howtoremove.guide/redirector-gvt1-com-virus-malware-chrome-removal/ howtoremove.guide##div[style^="border:2px"] howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) @@ -185,9 +184,12 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.automatic_removal_list_w > .ar_block_description 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(SpyHunter) -! β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” -/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$1p,document,domain=icu|life|live -/^https://[a-z]{7,16}[0-9]{1,2}\.live/$document,domain=live +! Common scam domain patterns +/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$1p,document,domain=icu|life|live|~ Warning shown due to: Fraudulently claiming you have won a new phone +/^https://[a-z]{7,16}[0-9]{1,2}\.live/$document,domain=live|~ Warning shown due to: Fraudulently claiming you have won a new phone +! https://github.com/AdguardTeam/AdguardFilters/issues/58737 +/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$document,domain=fun +/^https://www\.namejp0[1-9]\.xyz/$document,popup,domain=xyz ! β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” msn.com##.irisbanner @@ -331,13 +333,6 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 ||deviuser.com^$doc -! β€”β€”β€” Malicious domains found in videogame manuals β€”β€”β€” -||acclaimsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now pushing malware. -||acclaimmaxsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now promoting fake consumer loans. -||hip-games.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. -||thq.com.au^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. -||gp32.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. - ! β€”β€”β€” Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. ||unofficialtwrp.com^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones. @@ -431,9 +426,4 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! https://github.com/DandelionSprout/adfilt/issues/71 ||imgvieweriri.com^$all,domain=~ Warning shown due to: Used for Instagram credential thefts. -! Japanese scam -! https://github.com/AdguardTeam/AdguardFilters/issues/58737 -/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$document,domain=fun -/^https://www\.namejp0[1-9]\.xyz/$document,popup,domain=xyz - ! Placeholder line for alternate list versions