From 4e5095cfae6d39a2e828965b625f5adefbc1be85 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sun, 5 Sep 2021 13:01:52 -0400 Subject: [PATCH 1/4] Add domains (Part 1) --- Dandelion Sprout's Anti-Malware List.txt | 72 +++++++++++++++++++++++- 1 file changed, 71 insertions(+), 1 deletion(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 154557d44..18972f83c 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.6] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 02September2021v2-Beta +! Version: 05September2021v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -1003,6 +1003,76 @@ zombooru.com##a[href="http://www.hard55.com"] ||artofads.co^$doc ||pc-my-protection.xyz^$all ||beta-news.org^$doc +! (Will add PR link later) +! https://www.virustotal.com/gui/domain/kirstialechulbard.space/relations +! https://www.virustotal.com/gui/ip-address/198.54.117.244/relations +||easywebverification2.info^$all +||mywalletsconnectonline.com^$all +||dashwoodestates.com^$all +||tdcanadasecurityweb54761.info^$all +||ghshb.com^$all +||conncorrd.com^$all +||youtubepremiumuk.com^$all +||mobileapp-members.com^$all +||jumperctin.com^$all +||vm-business.online^$all +||apple-map.help^$all +||recover-delivery.com^$all +! http://vxvault.net/ViriFiche.php?ID=44013 +! https://www.virustotal.com/gui/url/8066b87ad10ddb5466bc307bb48454139572f6c8c8f80a9734275ac89cf966af/detection +! https://www.virustotal.com/gui/url/826c451929420c4da32552f967fb1cab6467405a29c65b23802aaadb6a8c7505/detection +! https://safeweb.norton.com/report/show?url=192.3.110.170 +||192.3.110.170^$all +! https://www.virustotal.com/gui/file/0f242e89dd3f1685ace979a248300f7f414932b8a2a75af88585c427f2758c10/community +! https://www.virustotal.com/gui/url/f66829e7fd9e897db874d352ef7c7b46fce80d070bc24917bc7300559d29d014/detection +! https://www.virustotal.com/gui/url/75676a0f8d715afa318f380e214bbe7bc1f7b08c66740a320a888c8912212ad9/detection +! https://safeweb.norton.com/report/show?url=tochmini.mooo.com +! https://www.siteadvisor.com/sitereport.html?url=tochmini.mooo.com +||tochmini.mooo.com^$all +! https://www.virustotal.com/gui/url/ce7a42f35eca4072ab018cb7f5f7fbaaa7f17c10f982a2fa2baa24122385a805/detection +! https://www.virustotal.com/gui/url/9324c63cab60da5f60dacb4b2b37a02f5a7e2a5b932d96440415a232da6ec0c2/detection +! https://safeweb.norton.com/report/show?url=leavemylinkpls.mooo.com +! https://www.siteadvisor.com/sitereport.html?url=leavemylinkpls.mooo.com +||leavemylinkpls.mooo.com^$all +! https://forums.malwarebytes.com/topic/278209-removal-instructions-for-socialsearchconverter/ +||socialsearchconverter.com^$document +||install.socialsearchconverter.com^$all +||feed.socialsearchconverter.com^$all +||api.socialsearchconverter.com^$all +||install1.notify-service.com^$all +||notify-service.com^$all +||install.stream-all.com^$all +! copied over from https://github.com/uBlockOrigin/uAssets/issues/9848 +||gghacks.com^$all +||rewardsgiantusa.com^$document +||promotionsonlineusa.com^$document +||qualityhealth.com^$document +||consumerproductsusa.com^$document +||get-cracked.com^$all +||tinyurl.com/gp84uz2$document +||www.mediafiire.com^$all +||mediafiire.com^$document +||d1xkyo9j4r7vnn.cloudfront.net^$all +||onlinepromotionsusa.com^$document +||w.promotionsonlineusa.com^$all +! https://securelist.com/apkpure-android-app-store-infected/101845/ +! https://www.virustotal.com/gui/url/866a25343864f03dc5a10105fda523bfbb6ed09c486d07fd31ca2b5306440089/detection +||wcf.seven1029.com^$all +! https://www.virustotal.com/gui/url/1636952e7dd793f4edbe0014615d76685264464aeb5cb574b580f932f0907dd9/detection +! https://www.virustotal.com/gui/url/9c66e331e455dc5c5c9d06e1a537580c9e4db279182d2285c07783e837806a16/detection +! https://safeweb.norton.com/report/show?url=foodin.site +! https://www.siteadvisor.com/sitereport.html?url=foodin.site +||foodin.site^$all +! https://github.com/AdguardTeam/AdguardFilters/issues/90947 +! https://www.virustotal.com/gui/url/07466d5d29da0af49d185e69ca35b996917c429d7b2f38b24607bbe708306177/detection +||hourfeedoil.top^$all +||b0dk11t.hourfeedoil.top^$all +! https://www.virustotal.com/gui/file/f29908da1b8065356704e746f9e282378a7e5ae65c753e2e9fe02b214b5b792b/community +! https://www.virustotal.com/gui/url/cea7b7ccd54fabd22b14cff5521f13b9dca4fd06d47d0bc2119dac6b77ecc04d/detection +! https://www.siteadvisor.com/sitereport.html?url=http://serrtjw256jw565w.gq/ +serrtjw256jw565w.gq$all +! https://github.com/AdguardTeam/AdguardFilters/issues/91506#issuecomment-904080849 +totalav.com$all ! ——— Standard malware that I stumbled upon on my own ——— ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 From e70ece557869921963b21f3b4addd096b7ce107c Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sun, 5 Sep 2021 13:44:31 -0400 Subject: [PATCH 2/4] Add more domains --- Dandelion Sprout's Anti-Malware List.txt | 48 +++++++++++++++++++----- 1 file changed, 38 insertions(+), 10 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 18972f83c..9c42a6421 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1035,7 +1035,7 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://www.siteadvisor.com/sitereport.html?url=leavemylinkpls.mooo.com ||leavemylinkpls.mooo.com^$all ! https://forums.malwarebytes.com/topic/278209-removal-instructions-for-socialsearchconverter/ -||socialsearchconverter.com^$document +||socialsearchconverter.com^$doc ||install.socialsearchconverter.com^$all ||feed.socialsearchconverter.com^$all ||api.socialsearchconverter.com^$all @@ -1044,16 +1044,16 @@ zombooru.com##a[href="http://www.hard55.com"] ||install.stream-all.com^$all ! copied over from https://github.com/uBlockOrigin/uAssets/issues/9848 ||gghacks.com^$all -||rewardsgiantusa.com^$document -||promotionsonlineusa.com^$document -||qualityhealth.com^$document -||consumerproductsusa.com^$document +||rewardsgiantusa.com^$doc +||promotionsonlineusa.com^$doc +||qualityhealth.com^$doc +||consumerproductsusa.com^$doc ||get-cracked.com^$all -||tinyurl.com/gp84uz2$document +||tinyurl.com/gp84uz2$doc ||www.mediafiire.com^$all -||mediafiire.com^$document +||mediafiire.com^$doc ||d1xkyo9j4r7vnn.cloudfront.net^$all -||onlinepromotionsusa.com^$document +||onlinepromotionsusa.com^$doc ||w.promotionsonlineusa.com^$all ! https://securelist.com/apkpure-android-app-store-infected/101845/ ! https://www.virustotal.com/gui/url/866a25343864f03dc5a10105fda523bfbb6ed09c486d07fd31ca2b5306440089/detection @@ -1070,9 +1070,37 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://www.virustotal.com/gui/file/f29908da1b8065356704e746f9e282378a7e5ae65c753e2e9fe02b214b5b792b/community ! https://www.virustotal.com/gui/url/cea7b7ccd54fabd22b14cff5521f13b9dca4fd06d47d0bc2119dac6b77ecc04d/detection ! https://www.siteadvisor.com/sitereport.html?url=http://serrtjw256jw565w.gq/ -serrtjw256jw565w.gq$all +! https://www.virustotal.com/gui/file/2c53f5d5862861cc72639e0d50ec568fa337c4e24ea6d17f72c09cdb9b53498b/community +||serrtjw256jw565w.gq^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/91506#issuecomment-904080849 -totalav.com$all +||totalav.com^$all +! https://www.virustotal.com/gui/file/c683bc3da4966110b419ac54d09a54ce798efdb51be398331d9ce011e2636fa9/community +! https://www.virustotal.com/gui/url/5618023ed5a768d7f879c0d599b9ba7cff0e9171201981256eeaf5ce8eb09fdb/detection +! https://www.virustotal.com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection +||91.241.19.38^$all +! https://www.virustotal.com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection +! https://safeweb.norton.com/report/show?url=telete.in +! https://www.siteadvisor.com/sitereport.html?url=telete.in +||telete.in^$all +! https://www.virustotal.com/gui/file/e63b2d03e3fee2d538f8bd721b61dd3641284fa941087d846dea6f15cab40308/community +! https://www.virustotal.com/gui/url/fbbc8a671bff32539bd829a76f6df9f364a21ac2279922e64e3ec494a1669dd3/detection +||kiff.tech^$all +! https://www.virustotal.com/gui/domain/kiff.tech/relations +! https://www.virustotal.com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection +! https://www.ipvoid.com/ip-blacklist-check/ +! https://safeweb.norton.com/report/show?url=45.90.58.90 +! https://www.siteadvisor.com/sitereport.html?url=45.90.58.90 +||45.90.58.90^$doc +! https://www.virustotal.com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community +! https://www.virustotal.com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection +! https://www.ipvoid.com/ip-blacklist-check/ +! https://www.siteadvisor.com/sitereport.html?url=95.85.89.98 +||95.85.89.98^$all +! https://www.virustotal.com/gui/url/fa1e39a425d65e8ae4e10a0c1552edd9d9e22ec3057cc7feccca114ee469303c/community +! https://www.virustotal.com/gui/url/d2efdd72a368b2573e3fb8b10f4058c0d41403c2fee829457390be07bb608ba6/detection +! https://safeweb.norton.com/report/show?url=physic-craft.us +! https://www.siteadvisor.com/sitereport.html?url=physic-craft.us +||physic-craft.us^$all ! ——— Standard malware that I stumbled upon on my own ——— ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 From e25430bb3ea834653528ec31f0183f0301359100 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sun, 5 Sep 2021 15:52:51 -0400 Subject: [PATCH 3/4] Correct based on https://github.com/DandelionSprout/adfilt/pull/266#issuecomment-913217043 --- Dandelion Sprout's Anti-Malware List.txt | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 9c42a6421..26a1e0af3 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1026,13 +1026,9 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://www.virustotal.com/gui/file/0f242e89dd3f1685ace979a248300f7f414932b8a2a75af88585c427f2758c10/community ! https://www.virustotal.com/gui/url/f66829e7fd9e897db874d352ef7c7b46fce80d070bc24917bc7300559d29d014/detection ! https://www.virustotal.com/gui/url/75676a0f8d715afa318f380e214bbe7bc1f7b08c66740a320a888c8912212ad9/detection -! https://safeweb.norton.com/report/show?url=tochmini.mooo.com -! https://www.siteadvisor.com/sitereport.html?url=tochmini.mooo.com ||tochmini.mooo.com^$all ! https://www.virustotal.com/gui/url/ce7a42f35eca4072ab018cb7f5f7fbaaa7f17c10f982a2fa2baa24122385a805/detection ! https://www.virustotal.com/gui/url/9324c63cab60da5f60dacb4b2b37a02f5a7e2a5b932d96440415a232da6ec0c2/detection -! https://safeweb.norton.com/report/show?url=leavemylinkpls.mooo.com -! https://www.siteadvisor.com/sitereport.html?url=leavemylinkpls.mooo.com ||leavemylinkpls.mooo.com^$all ! https://forums.malwarebytes.com/topic/278209-removal-instructions-for-socialsearchconverter/ ||socialsearchconverter.com^$doc @@ -1049,7 +1045,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||qualityhealth.com^$doc ||consumerproductsusa.com^$doc ||get-cracked.com^$all -||tinyurl.com/gp84uz2$doc +||tinyurl.com/gp84uz2^$doc ||www.mediafiire.com^$all ||mediafiire.com^$doc ||d1xkyo9j4r7vnn.cloudfront.net^$all @@ -1058,10 +1054,7 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://securelist.com/apkpure-android-app-store-infected/101845/ ! https://www.virustotal.com/gui/url/866a25343864f03dc5a10105fda523bfbb6ed09c486d07fd31ca2b5306440089/detection ||wcf.seven1029.com^$all -! https://www.virustotal.com/gui/url/1636952e7dd793f4edbe0014615d76685264464aeb5cb574b580f932f0907dd9/detection ! https://www.virustotal.com/gui/url/9c66e331e455dc5c5c9d06e1a537580c9e4db279182d2285c07783e837806a16/detection -! https://safeweb.norton.com/report/show?url=foodin.site -! https://www.siteadvisor.com/sitereport.html?url=foodin.site ||foodin.site^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/90947 ! https://www.virustotal.com/gui/url/07466d5d29da0af49d185e69ca35b996917c429d7b2f38b24607bbe708306177/detection @@ -1069,8 +1062,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||b0dk11t.hourfeedoil.top^$all ! https://www.virustotal.com/gui/file/f29908da1b8065356704e746f9e282378a7e5ae65c753e2e9fe02b214b5b792b/community ! https://www.virustotal.com/gui/url/cea7b7ccd54fabd22b14cff5521f13b9dca4fd06d47d0bc2119dac6b77ecc04d/detection -! https://www.siteadvisor.com/sitereport.html?url=http://serrtjw256jw565w.gq/ -! https://www.virustotal.com/gui/file/2c53f5d5862861cc72639e0d50ec568fa337c4e24ea6d17f72c09cdb9b53498b/community ||serrtjw256jw565w.gq^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/91506#issuecomment-904080849 ||totalav.com^$all @@ -1087,19 +1078,12 @@ zombooru.com##a[href="http://www.hard55.com"] ||kiff.tech^$all ! https://www.virustotal.com/gui/domain/kiff.tech/relations ! https://www.virustotal.com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection -! https://www.ipvoid.com/ip-blacklist-check/ -! https://safeweb.norton.com/report/show?url=45.90.58.90 -! https://www.siteadvisor.com/sitereport.html?url=45.90.58.90 ||45.90.58.90^$doc ! https://www.virustotal.com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community ! https://www.virustotal.com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection -! https://www.ipvoid.com/ip-blacklist-check/ -! https://www.siteadvisor.com/sitereport.html?url=95.85.89.98 ||95.85.89.98^$all ! https://www.virustotal.com/gui/url/fa1e39a425d65e8ae4e10a0c1552edd9d9e22ec3057cc7feccca114ee469303c/community ! https://www.virustotal.com/gui/url/d2efdd72a368b2573e3fb8b10f4058c0d41403c2fee829457390be07bb608ba6/detection -! https://safeweb.norton.com/report/show?url=physic-craft.us -! https://www.siteadvisor.com/sitereport.html?url=physic-craft.us ||physic-craft.us^$all ! ——— Standard malware that I stumbled upon on my own ——— From 3714101d8a4b7f2df4c5f9fe70db7556ddae0da6 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sun, 5 Sep 2021 15:55:26 -0400 Subject: [PATCH 4/4] I forgot about that --- Dandelion Sprout's Anti-Malware List.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 26a1e0af3..453305d9b 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1003,7 +1003,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||artofads.co^$doc ||pc-my-protection.xyz^$all ||beta-news.org^$doc -! (Will add PR link later) +! https://github.com/DandelionSprout/adfilt/pull/266 ! https://www.virustotal.com/gui/domain/kirstialechulbard.space/relations ! https://www.virustotal.com/gui/ip-address/198.54.117.244/relations ||easywebverification2.info^$all