From a8291f4730fe95dc11d741d4d08c7a6788cef8a9 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sat, 16 Oct 2021 08:28:06 -0400 Subject: [PATCH 1/3] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 55 ++++++++++++++++++------ 1 file changed, 43 insertions(+), 12 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 3300965b5..2d1e8200d 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.6] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 16October2021v2-Beta +! Version: 16October2021v3-Beta ! Expires: 5 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -67,17 +67,17 @@ www.google.*##a[oncontextmenu][href^="https://books.google."]:upward(2) !#endif ! ——— For DuckDuckGo ——— -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".tk"]:not([data-domain*="coolcmd.tk"], [data-domain*="budterence.tk"], [data-domain*="google.tk"], [data-domain*="transportnews.tk"], [data-domain*="c0d3c.tk"], [data-domain*="anonytext.tk"], [data-domain*="tokelau-info.tk"], [data-domain*="fakaofo.tk"], [data-domain*="loljp-wiki.tk"], [data-domain*="ninetail.tk"], [data-domain*="goshujin.tk"], [data-domain*="graph.tk"], [data-domain*="nolfrevival.tk"], [data-domain*="coppersurfer.tk"], [data-domain*="restricted-functions.tk"], [data-domain*="bstweaker.tk"]) -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".ga"]:not([data-domain*="google.ga"], [data-domain*="filtri-dns.ga"], [data-domain*="anpigabon.ga"], [data-domain*="dgdi.ga"], [data-domain*="voitures.ga"], [data-domain*="economie-gabon.ga"]) -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".ml"]:not([data-domain*="google.ml"], [data-domain*="mobili.ml"], [data-domain*="melody.ml"], [data-domain*="dcod.ml"], [data-domain*="info-matin.ml"], [data-domain*="amap.ml"], [data-domain*="mastodon.ml"], [data-domain*="worproject.ml"], [data-domain*="nothingprivate.ml"]) -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".gq"]:not([data-domain*="deimos.gq"], [data-domain*="inege.gq"], [data-domain*="tvgelive.gq"], [data-domain*="comprarcarros.gq"]) -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".cf"]:not([data-domain*="google.cf"], [data-domain*="rths.cf"], [data-domain*="voitures.cf"], [data-domain*="assembleenationale-rca.cf"], [data-domain*="cps-rca.cf"], [data-domain*="acap.cf"], [data-domain*="miraculousladybug.cf"], [data-domain*="scrat.cf"]) -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".pw"]:not([data-domain*="libgen.pw"], [data-domain*="petridish.pw"], [data-domain*="palaugov.pw"], [data-domain*="dpc.pw"], [data-domain*="zikrap.pw"]) -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".loan"] -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".agency"] -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".gdn"] -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".bid"] -duckduckgo.com,3g2upl4pq6kufc4m.onion##[data-domain$=".top"] +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".tk"]:not([data-domain*="coolcmd.tk"], [data-domain*="budterence.tk"], [data-domain*="google.tk"], [data-domain*="transportnews.tk"], [data-domain*="c0d3c.tk"], [data-domain*="anonytext.tk"], [data-domain*="tokelau-info.tk"], [data-domain*="fakaofo.tk"], [data-domain*="loljp-wiki.tk"], [data-domain*="ninetail.tk"], [data-domain*="goshujin.tk"], [data-domain*="graph.tk"], [data-domain*="nolfrevival.tk"], [data-domain*="coppersurfer.tk"], [data-domain*="restricted-functions.tk"], [data-domain*="bstweaker.tk"]) +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".ga"]:not([data-domain*="google.ga"], [data-domain*="filtri-dns.ga"], [data-domain*="anpigabon.ga"], [data-domain*="dgdi.ga"], [data-domain*="voitures.ga"], [data-domain*="economie-gabon.ga"]) +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".ml"]:not([data-domain*="google.ml"], [data-domain*="mobili.ml"], [data-domain*="melody.ml"], [data-domain*="dcod.ml"], [data-domain*="info-matin.ml"], [data-domain*="amap.ml"], [data-domain*="mastodon.ml"], [data-domain*="worproject.ml"], [data-domain*="nothingprivate.ml"]) +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".gq"]:not([data-domain*="deimos.gq"], [data-domain*="inege.gq"], [data-domain*="tvgelive.gq"], [data-domain*="comprarcarros.gq"]) +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".cf"]:not([data-domain*="google.cf"], [data-domain*="rths.cf"], [data-domain*="voitures.cf"], [data-domain*="assembleenationale-rca.cf"], [data-domain*="cps-rca.cf"], [data-domain*="acap.cf"], [data-domain*="miraculousladybug.cf"], [data-domain*="scrat.cf"]) +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".pw"]:not([data-domain*="libgen.pw"], [data-domain*="petridish.pw"], [data-domain*="palaugov.pw"], [data-domain*="dpc.pw"], [data-domain*="zikrap.pw"]) +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".loan"] +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".agency"] +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".gdn"] +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".bid"] +duckduckgo.com,3g2upl4pq6kufc4m.onion,duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion##[data-domain$=".top"] ! ——— For Bing ——— bing.com##.b_algo:has(a[href*=".tk/"]:not([href*="coolcmd.tk"], [href*="budterence.tk"], [href*="google.tk"], [href*="transportnews.tk"], [href*="c0d3c.tk"], [href*="anonytext.tk"], [href*="tokelau-info.tk"], [href*="fakaofo.tk"], [href*="loljp-wiki.tk"], [href*="ninetail.tk"], [href*="goshujin.tk"], [href*="graph.tk"], [href*="nolfrevival.tk"], [href*="coppersurfer.tk"], [href*="restricted-functions.tk"], [href*="bstweaker.tk"])) @@ -228,6 +228,7 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) windowsdispatch.com##strong ! ¤¤¤ "Driver" download sites that instead download PUP tools ¤¤¤ ||driver-soft.com^ +||virustotal.com/gui/user/DriverGenius$doc ! Common scam domain patterns /(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$1p,doc @@ -1358,6 +1359,36 @@ zombooru.com##a[href="http://www.hard55.com"] ||therewardboost.com^$all ||streamamongcotton.top^$all ||termquotientbeen.top^$all +! Insert PR URL +! https://www.virustotal.com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community +||45.95.169.115^$all +! https://www.virustotal.com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community +||45.148.120.80^$all +! https://www.virustotal.com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community +||85.239.33.9^$all +||leak.serveftp.com^$all +! Relations to the domain above +||adminsys.serveftp.com^$all +||amazbaidu.serveftp.com^$all +||amazcompute.serveftp.com^$all +||httpssecure.serveftp.com^$all +||identity-auth612.serveftp.com^$all +||securd03c-acclogs.serveftp.com^$all +||secure00-account.serveftp.com^$all +||numberpresentifhh.serveftp.com^$all +||secure-auth01.serveftp.com^$all +||citionlinebk.serveftp.com^$all +||secure05h-verify.serveftp.com^$all +||secure-authlogin5.serveftp.com^$all +||c4ase-verified9932.serveftp.com^$all +||1log-wellsfargo.serveftp.com^$all +||eposcardokubo.serveftp.com^$all +! https://www.virustotal.com/gui/file/8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0/community +||107.173.176.183^$all +! https://www.virustotal.com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community +||45.148.120.171^$all +! http://vxvault.net/ViriFiche.php?ID=44058 +||sherence.ru^$all ! ——— Standard malware that I stumbled upon on my own ——— ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 From 63740c2475eeb44852ba8d724cca30b360b98940 Mon Sep 17 00:00:00 2001 From: iam-py-test <84232764+iam-py-test@users.noreply.github.com> Date: Sat, 16 Oct 2021 08:50:13 -0400 Subject: [PATCH 2/3] Add PR url --- Dandelion Sprout's Anti-Malware List.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 2d1e8200d..1f7db8c72 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1359,7 +1359,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||therewardboost.com^$all ||streamamongcotton.top^$all ||termquotientbeen.top^$all -! Insert PR URL +! https://github.com/DandelionSprout/adfilt/pull/303 ! https://www.virustotal.com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community ||45.95.169.115^$all ! https://www.virustotal.com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community From 4325be86da443532d76b72a6d6a79efe6c3295b9 Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Sun, 17 Oct 2021 06:19:06 +0200 Subject: [PATCH 3/3] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 1f7db8c72..6d1a59c39 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -228,7 +228,6 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) windowsdispatch.com##strong ! ¤¤¤ "Driver" download sites that instead download PUP tools ¤¤¤ ||driver-soft.com^ -||virustotal.com/gui/user/DriverGenius$doc ! Common scam domain patterns /(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$1p,doc