From bd7142fe72676a9f4e3b7d2112acd69f2630f069 Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Wed, 1 Dec 2021 05:21:12 +0100 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 114 ++++++++++++------ .../AntiMalwareAdGuard.txt | 78 ++++++++---- .../AntiMalwareAdGuardHome.txt | 73 +++++++---- .../AntiMalwareDomains.txt | 56 ++++++--- .../AntiMalwareHosts.txt | 56 ++++++--- .../AntiMalwarePrivoxy.action | 50 +++++--- .../AntiMalwareTPL.tpl | 68 ++++++++--- ...out's and other adblocker lists' IPs.ipset | 10 +- 8 files changed, 351 insertions(+), 154 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index c84477708..03d6e2d64 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.6] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdBlock and Adblock Plus) -! Version: 27November2021v3-Beta +! Version: 01December2021v1-Beta ! Expires: 5 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -112,7 +112,7 @@ bing.com##.b_algo:-abp-has(a[href*=".top/"]:not([href*="corriente.top"], [href*= ||ssl.bblck.me^ ||allblock.net^ ||microsoftedge.microsoft.com/addons/detail/allblock/nkllnmjaaifdphkfbmedklkimjmnjeen^ -! Malicious domains found in videogame manuals and title screens +! Malicious or purchaseable domains found in videogame manuals and title screens ||acclaimsports.com^ ||acclaimmaxsports.com^ ||hip-games.com^ @@ -650,7 +650,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||new-message.today^ ||new-notification.live^ ||new-notifications.live^ -||notified-today.com^ ||notified-today.live^ ||notified-today.xyz^ ||stay-notified.com^ @@ -1497,7 +1496,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||secure-0*.ddnss.ch^$popup ||lucdream.com^ ||beastbuying.com^ -||kokotrokot.com^ ||07ca17vejqqej990.inteo.xyz^ ||pesoaniz.com^ ||plarium.com^ @@ -1524,7 +1522,8 @@ zombooru.com##a[href="http://www.hard55.com"] ||secureleadsforever.com^$popup ||renewal-software-update.com^ ||renewal-software-update.com^$popup -||pushmeup.art^ +||pushmeup.art^ +||pushmeup.art^$popup ||covercenter.xyz^ ||covercenter.xyz^$popup ||gettrk.xyz^ @@ -1833,7 +1832,8 @@ zombooru.com##a[href="http://www.hard55.com"] ||safelyonline.net^ ||browse-safe.net^ ||btpnative.com^ -||mybetterdl.com^ +||mybetterdl.com^ +||mybetterdl.com^$popup ||besty-deals.com^ ||besty-deals.com^$popup ||data-px.services^ @@ -1868,8 +1868,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||www.kqzyfj.com^ ||www.kqzyfj.com^$popup ||kqzyfj.com^ -||cj.dotomi.com^ -||cj.dotomi.com^$popup ||mcafee12.tt.omtrdc.net^ ||trolleydrop.info^ ||jaynordan.digital^ @@ -2152,22 +2150,14 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains ||yotube.com^ ||yotube.com^$popup -||mybetterdl.com^ -||mybetterdl.com^$popup -||p185689.mybetterdl.com^ -||p185689.mybetterdl.com^$popup ||r-tb.com^ ||r-tb.com^$popup ||cdn.hoood.info^ ||cdn.hoood.info^$popup -||data-px.services^ -||data-px.services^$popup ||barah-flo.com^ ||barah-flo.com^$popup ||beta-one.net^ ||beta-one.net^$popup -||beastbuying.com^ -||beastbuying.com^$popup ||pisism.com^ ||pisism.com^$popup ||czyzd.xyz^ @@ -2186,8 +2176,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||welcomejohncena.pro^$popup ||security-scanner.xyz^ ||security-scanner.xyz^$popup -||pushmeup.art^ -||pushmeup.art^$popup ||c2egp.xyz^ ||c2egp.xyz^$popup ||ese40.xyz^ @@ -2513,6 +2501,67 @@ zombooru.com##a[href="http://www.hard55.com"] ||163.125.31.46^$popup ||163.179.168.44^ ||163.179.168.44^$popup +! https://github.com/uBlockOrigin/uAssets/pull/10647 +! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md +||updsec.builtfromzero.com^ +||updsec.builtfromzero.com^$popup +||money-mod.com^ument +||gospelchor.info^ument + +||new.bestlifeoffer20.com^ument +||reykijnoac.com^ument +||totalnicefeed.com^ +||totalnicefeed.com^$popup +! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/2.md +||riteupd.mimanduca.co^ +||riteupd.mimanduca.co^$popup +||oaesso.info^ument + +||bestlifeoffer20.com^ument +! https://scammer.info/t/password-stealer/84348 +! https://bazaar.abuse.ch/sample/462a689d171f543c10efa08e963996d382585b67a6b298ec40d64f924adfb47a/ +||youtube.com/watch?v=8nY7SnvNxH4^ +||youtube.com/watch?v=8nY7SnvNxH4^$popup +||bit.ly/3p8kN5V^ument +||mediafire.com/file/at2tvnao5x6ivdo/EngineOwning.rar/ +||mediafire.com/file/at2tvnao5x6ivdo/EngineOwning.rar/$popup +||download2264.mediafire.com/pnk44f5ci9rg/at2tvnao5x6ivdo/EngineOwning.rar^ +||download2264.mediafire.com/pnk44f5ci9rg/at2tvnao5x6ivdo/EngineOwning.rar^$popup +! https://www.virustotal.com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community +||110.89.59.135^ +||110.89.59.135^$popup +||113.116.89.1^ +||113.116.89.1^$popup +||119.183.146.191^ +||119.183.146.191^$popup +||153.3.3.226^ +||153.3.3.226^$popup +||182.116.104.6^ +||182.116.104.6^$popup +||60.7.133.200^ +||60.7.133.200^$popup +||122.6.254.201^ +||122.6.254.201^$popup +||110.89.11.167^ +||110.89.11.167^$popup +||171.112.177.90^ +||171.112.177.90^$popup +||115.194.38.143^ +||115.194.38.143^$popup +||61.52.79.32^ +||61.52.79.32^$popup +! https://scammer.info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 +||ups-dk.u1537460.cp.regruhosting.ru^ +||ups-dk.u1537460.cp.regruhosting.ru^$popup +! https://www.virustotal.com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 +||lowseelan.com^ +||lowseelan.com^$popup +! https://www.virustotal.com/gui/file/50fd813cf8fe981e6aee179f8ba394e5527c5128b84c328f9f8347cd994bbc42/community +||dl02.s3.amazonaws.com/installers/747947/oi_picasa38-setupexe.exe^ +||dl02.s3.amazonaws.com/installers/747947/oi_picasa38-setupexe.exe^$popup +! https://www.virustotal.com/gui/file/2ea599605c4d65902943f12e1114a71af7a40fa7dffbf018b0ee3e7a61aaeaa3/community +||dl02.s3.amazonaws.com/installers/424531/2gzbsoj4gxb.exe^ +||dl02.s3.amazonaws.com/installers/424531/2gzbsoj4gxb.exe^$popup ! β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -12315,14 +12364,14 @@ toorgle.net##.join ||discord.foundation^$popup ||discordgift.ru^ ||discordgift.ru^$popup -||discordnitro-steam.ru^ -||discordnitro-steam.ru^$popup +||discordnitro-steam. +||discordnitro-steam.$popup ||discordnitro.space^ ||discordnitro.space^$popup -||discordxgift.xyz^ -||discordxgift.xyz^$popup -||discordxnitro.xyz^ -||discordxnitro.xyz^$popup +||discordxgift. +||discordxgift.$popup +||discordxnitro. +||discordxnitro.$popup ||discorgift.online^ ||discorgift.online^$popup ||discrocl.xyz^ @@ -12379,8 +12428,8 @@ toorgle.net##.join ||free-niltross.ru^$popup ||free-nitlross.ru^ ||free-nitlross.ru^$popup -||freediscordnitro.ru^ -||freediscordnitro.ru^$popup +||freediscordnitro. +||freediscordnitro.$popup ||freeskinsfree.pp.ua^ ||freeskinsfree.pp.ua^$popup ||from-plames.xyz^ @@ -12905,12 +12954,12 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||githubnt.com^ ! β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” -://ww4. -://ww5.$domain=~ww5.msu.ac.zw +://ww4.$domain=~ww4.ikea.com +://ww5.$domain=~ww5.ikea.com|~ww5.msu.ac.zw ://ww6.$domain=~ww6.generali.pt ://ww7.$domain=~ww7.be|~ww7.readsnk.com ://ww8.$domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com -://ww9.$domain=~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br +://ww9.$domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br ://ww10. ://ww11. ://ww12. @@ -12969,11 +13018,6 @@ facebook.com#?#div[class*=ImageBlockContent] .clearfix:-abp-contains(0nl!ne) ! β€”β€”β€” Upgrades HTTP requests to HTTPS on sites that don't do it automatically β€”β€”β€” $csp=upgrade-insecure-requests,domain=apache.org|gnu.org|washington.edu|nyu.edu|ufl.edu|oecd.org|bu.edu|wikidot.com|alternativenation.net -! β€”β€”β€” Offline-only apps trying to phone home β€”β€”β€” - -! https://fosspost.org/audacity-is-now-a-spyware/ - - ! β€”β€”β€” Anti-'Malware comments' (Currently Disqus-specific) β€”β€”β€” ! https://myip.ms/info/limitexcess @@ -12982,9 +13026,11 @@ $csp=upgrade-insecure-requests,domain=apache.org|gnu.org|washington.edu|nyu.edu| + ! β€”β€”β€” Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) β€”β€”β€” ||if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data^ + ! β€”β€”β€” Anti-PUP (WIP) β€”β€”β€” ! This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine) ||webadvisorc.rest.gti.mcafee.com^ diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 25064f7cd..50fd4e4ec 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ [AdGuard versions from β‰₯2019] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 27November2021v3-Beta +! Version: 01December2021v1-Beta ! Expires: 5 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -112,7 +112,7 @@ bing.com##.b_algo:has(a[href*=".top/"]:not([href*="corriente.top"], [href*="gdto ||ssl.bblck.me^$document ||allblock.net^$document ||microsoftedge.microsoft.com/addons/detail/allblock/nkllnmjaaifdphkfbmedklkimjmnjeen^$document -! Malicious domains found in videogame manuals and title screens +! Malicious or purchaseable domains found in videogame manuals and title screens ||acclaimsports.com^$document ||acclaimmaxsports.com^$document ||hip-games.com^$document @@ -555,7 +555,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||new-message.today^$document ||new-notification.live^$document ||new-notifications.live^$document -||notified-today.com^$document ||notified-today.live^$document ||notified-today.xyz^$document ||stay-notified.com^$document @@ -1026,7 +1025,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||secure-0*.ddnss.ch^$empty,important ||lucdream.com^$document ||beastbuying.com^$document -||kokotrokot.com^$document ||07ca17vejqqej990.inteo.xyz^$document ||pesoaniz.com^$document ||plarium.com^$document @@ -1042,7 +1040,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||pro-protection.xyz^$empty,important ||secureleadsforever.com^$empty,important ||renewal-software-update.com^$empty,important -||pushmeup.art^$document +||pushmeup.art^$empty,important ||covercenter.xyz^$empty,important ||gettrk.xyz^$empty,important ||trc.*.co^$document @@ -1235,7 +1233,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||safelyonline.net^$document ||browse-safe.net^$document ||btpnative.com^$document -||mybetterdl.com^$document +||mybetterdl.com^$empty,important ||besty-deals.com^$empty,important ||data-px.services^$document ||newsvot.com^$document @@ -1262,7 +1260,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||army-glo.scrollingsystem.com^$document ||www.kqzyfj.com^$empty,important ||kqzyfj.com^$document -||cj.dotomi.com^$empty,important ||mcafee12.tt.omtrdc.net^$document ||trolleydrop.info^$document ||jaynordan.digital^$document @@ -1432,14 +1429,10 @@ zombooru.com##a[href="http://www.hard55.com"] 159.148.186.228$network ! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains ||yotube.com^$empty,important -||mybetterdl.com^$empty,important -||p185689.mybetterdl.com^$empty,important ||r-tb.com^$empty,important ||cdn.hoood.info^$empty,important -||data-px.services^$empty,important ||barah-flo.com^$empty,important ||beta-one.net^$empty,important -||beastbuying.com^$empty,important ||pisism.com^$empty,important ||czyzd.xyz^$empty,important ||r1it6.xyz^$empty,important @@ -1449,7 +1442,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||m6ydd.xyz^$empty,important ||welcomejohncena.pro^$empty,important ||security-scanner.xyz^$empty,important -||pushmeup.art^$empty,important ||c2egp.xyz^$empty,important ||ese40.xyz^$empty,important ||e07wm.xyz^$empty,important @@ -1641,6 +1633,46 @@ zombooru.com##a[href="http://www.hard55.com"] 115.204.119.237$network 163.125.31.46$network 163.179.168.44$network +! https://github.com/uBlockOrigin/uAssets/pull/10647 +! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md +||updsec.builtfromzero.com^$empty,important +||money-mod.com^$document +||gospelchor.info^$document + +||new.bestlifeoffer20.com^$document +||reykijnoac.com^$document +||totalnicefeed.com^$empty,important +! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/2.md +||riteupd.mimanduca.co^$empty,important +||oaesso.info^$document + +||bestlifeoffer20.com^$document +! https://scammer.info/t/password-stealer/84348 +! https://bazaar.abuse.ch/sample/462a689d171f543c10efa08e963996d382585b67a6b298ec40d64f924adfb47a/ +||youtube.com/watch?v=8nY7SnvNxH4^$empty,important +||bit.ly/3p8kN5V^$document +||mediafire.com/file/at2tvnao5x6ivdo/EngineOwning.rar/$empty,important +||download2264.mediafire.com/pnk44f5ci9rg/at2tvnao5x6ivdo/EngineOwning.rar^$empty,important +! https://www.virustotal.com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community +110.89.59.135$network +113.116.89.1$network +119.183.146.191$network +153.3.3.226$network +182.116.104.6$network +60.7.133.200$network +122.6.254.201$network +110.89.11.167$network +171.112.177.90$network +115.194.38.143$network +61.52.79.32$network +! https://scammer.info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 +||ups-dk.u1537460.cp.regruhosting.ru^$empty,important +! https://www.virustotal.com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 +||lowseelan.com^$empty,important +! https://www.virustotal.com/gui/file/50fd813cf8fe981e6aee179f8ba394e5527c5128b84c328f9f8347cd994bbc42/community +||dl02.s3.amazonaws.com/installers/747947/oi_picasa38-setupexe.exe^$empty,important +! https://www.virustotal.com/gui/file/2ea599605c4d65902943f12e1114a71af7a40fa7dffbf018b0ee3e7a61aaeaa3/community +||dl02.s3.amazonaws.com/installers/424531/2gzbsoj4gxb.exe^$empty,important ! β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -6563,10 +6595,10 @@ toorgle.net##.join ||discord-spooky.ru^$empty,important ||discord.foundation^$empty,important ||discordgift.ru^$empty,important -||discordnitro-steam.ru^$empty,important +||discordnitro-steam.$empty,important ||discordnitro.space^$empty,important -||discordxgift.xyz^$empty,important -||discordxnitro.xyz^$empty,important +||discordxgift.$empty,important +||discordxnitro.$empty,important ||discorgift.online^$empty,important ||discrocl.xyz^$empty,important ||discrod.gifts^$empty,important @@ -6595,7 +6627,7 @@ toorgle.net##.join ||free-dislcordnitrlos.ru^$empty,important ||free-niltross.ru^$empty,important ||free-nitlross.ru^$empty,important -||freediscordnitro.ru^$empty,important +||freediscordnitro.$empty,important ||freeskinsfree.pp.ua^$empty,important ||from-plames.xyz^$empty,important ||from-sparsei.ru.com^$empty,important @@ -6881,12 +6913,12 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||githubnt.com^ ! β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” -://ww4.$document -://ww5.$document,domain=~ww5.msu.ac.zw +://ww4.$document,domain=~ww4.ikea.com +://ww5.$document,domain=~ww5.ikea.com|~ww5.msu.ac.zw ://ww6.$document,domain=~ww6.generali.pt ://ww7.$document,domain=~ww7.be|~ww7.readsnk.com ://ww8.$document,domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com -://ww9.$document,domain=~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br +://ww9.$document,domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br ://ww10.$document ://ww11.$document ://ww12.$document @@ -6945,12 +6977,6 @@ facebook.com#?#div[class*=ImageBlockContent] .clearfix:-abp-contains(0nl!ne) ! β€”β€”β€” Upgrades HTTP requests to HTTPS on sites that don't do it automatically β€”β€”β€” $csp=upgrade-insecure-requests,domain=apache.org|gnu.org|washington.edu|nyu.edu|ufl.edu|oecd.org|bu.edu|wikidot.com|alternativenation.net -! β€”β€”β€” Offline-only apps trying to phone home β€”β€”β€” -!#if adguard -! https://fosspost.org/audacity-is-now-a-spyware/ -*$app=audacity.exe|audacity.app -!#endif - ! β€”β€”β€” Anti-'Malware comments' (Currently Disqus-specific) β€”β€”β€” ! https://myip.ms/info/limitexcess *#?#.post-list > .post-content:has-text(/Best girls webcam/i) @@ -6959,8 +6985,10 @@ $csp=upgrade-insecure-requests,domain=apache.org|gnu.org|washington.edu|nyu.edu| *#?#script[src*=disquscdn] + #layout .post-content:has-text(We offer unlimited) *#?#script[src*=disquscdn] + #layout .post-content:has-text(.com specialize) +!#if !ext_ublock ! β€”β€”β€” Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) β€”β€”β€” ||if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data^$document +!#endif ! β€”β€”β€” Anti-PUP (WIP) β€”β€”β€” ! This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine) diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 1cc78cb57..144764d65 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.6] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard Home, and for AdGuard for Android/Windows' DNS filtering) -! Version: 27November2021v3-Beta +! Version: 01December2021v1-Beta ! Expires: 5 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -63,7 +63,7 @@ ||ssl.bblck.me^ ||allblock.net^ -! Malicious domains found in videogame manuals and title screens +! Malicious or purchaseable domains found in videogame manuals and title screens ||acclaimsports.com^ ||acclaimmaxsports.com^ ||hip-games.com^ @@ -381,7 +381,6 @@ ||new-message.today^ ||new-notification.live^ ||new-notifications.live^ -||notified-today.com^ ||notified-today.live^ ||notified-today.xyz^ ||stay-notified.com^ @@ -852,7 +851,6 @@ ||secure-0*.ddnss.ch^ ||lucdream.com^ ||beastbuying.com^ -||kokotrokot.com^ ||07ca17vejqqej990.inteo.xyz^ ||pesoaniz.com^ ||plarium.com^ @@ -1088,7 +1086,6 @@ ||army-glo.scrollingsystem.com^ ||www.kqzyfj.com^ ||kqzyfj.com^ -||cj.dotomi.com^ ||mcafee12.tt.omtrdc.net^ ||trolleydrop.info^ ||jaynordan.digital^ @@ -1258,14 +1255,10 @@ 159.148.186.228 ! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains ||yotube.com^ -||mybetterdl.com^ -||p185689.mybetterdl.com^ ||r-tb.com^ ||cdn.hoood.info^ -||data-px.services^ ||barah-flo.com^ ||beta-one.net^ -||beastbuying.com^ ||pisism.com^ ||czyzd.xyz^ ||r1it6.xyz^ @@ -1275,7 +1268,6 @@ ||m6ydd.xyz^ ||welcomejohncena.pro^ ||security-scanner.xyz^ -||pushmeup.art^ ||c2egp.xyz^ ||ese40.xyz^ ||e07wm.xyz^ @@ -1467,6 +1459,46 @@ 115.204.119.237 163.125.31.46 163.179.168.44 +! https://github.com/uBlockOrigin/uAssets/pull/10647 +! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md +||updsec.builtfromzero.com^ +||money-mod.com^$document +||gospelchor.info^$document + +||new.bestlifeoffer20.com^$document +||reykijnoac.com^$document +||totalnicefeed.com^ +! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/2.md +||riteupd.mimanduca.co^ +||oaesso.info^$document + +||bestlifeoffer20.com^$document +! https://scammer.info/t/password-stealer/84348 +! https://bazaar.abuse.ch/sample/462a689d171f543c10efa08e963996d382585b67a6b298ec40d64f924adfb47a/ + + + + +! https://www.virustotal.com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community +110.89.59.135 +113.116.89.1 +119.183.146.191 +153.3.3.226 +182.116.104.6 +60.7.133.200 +122.6.254.201 +110.89.11.167 +171.112.177.90 +115.194.38.143 +61.52.79.32 +! https://scammer.info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 +||ups-dk.u1537460.cp.regruhosting.ru^ +! https://www.virustotal.com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 +||lowseelan.com^ +! https://www.virustotal.com/gui/file/50fd813cf8fe981e6aee179f8ba394e5527c5128b84c328f9f8347cd994bbc42/community + +! https://www.virustotal.com/gui/file/2ea599605c4d65902943f12e1114a71af7a40fa7dffbf018b0ee3e7a61aaeaa3/community + ! β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” ! http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -6387,10 +6419,10 @@ ||discord-spooky.ru^ ||discord.foundation^ ||discordgift.ru^ -||discordnitro-steam.ru^ +||discordnitro-steam. ||discordnitro.space^ -||discordxgift.xyz^ -||discordxnitro.xyz^ +||discordxgift. +||discordxnitro. ||discorgift.online^ ||discrocl.xyz^ ||discrod.gifts^ @@ -6419,7 +6451,7 @@ ||free-dislcordnitrlos.ru^ ||free-niltross.ru^ ||free-nitlross.ru^ -||freediscordnitro.ru^ +||freediscordnitro. ||freeskinsfree.pp.ua^ ||from-plames.xyz^ ||from-sparsei.ru.com^ @@ -6701,12 +6733,12 @@ ||githubnt.com^ ! β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” -://ww4. -://ww5.$denyallow=ww5.msu.ac.zw +://ww4.$denyallow=ww4.ikea.com +://ww5.$denyallow=ww5.ikea.com|ww5.msu.ac.zw ://ww6.$denyallow=ww6.generali.pt ://ww7.$denyallow=ww7.be|ww7.readsnk.com ://ww8.$denyallow=ww8.co|ww8.ikea.com|ww8.tiki.ne.jp|ww8.erovoice.us|ww8.anyanime.com|ww8.bakushpal.az|ww8.tokyoghoulre.com -://ww9.$denyallow=ww9.tiki.ne.jp|ww9.sakura.ne.jp|ww9.generali.pt|ww9.itau.com.br +://ww9.$denyallow=ww9.ikea.com|ww9.tiki.ne.jp|ww9.sakura.ne.jp|ww9.generali.pt|ww9.itau.com.br ://ww10. ://ww11. ://ww12. @@ -6759,18 +6791,15 @@ ! β€”β€”β€” Upgrades HTTP requests to HTTPS on sites that don't do it automatically β€”β€”β€” -! β€”β€”β€” Offline-only apps trying to phone home β€”β€”β€” - -! https://fosspost.org/audacity-is-now-a-spyware/ - - ! β€”β€”β€” Anti-'Malware comments' (Currently Disqus-specific) β€”β€”β€” ! https://myip.ms/info/limitexcess ! https://myip.ms/info/memberarea/My_Account.html + ! β€”β€”β€” Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) β€”β€”β€” ||if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data^ + ! β€”β€”β€” Anti-PUP (WIP) β€”β€”β€” ! This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine) ||webadvisorc.rest.gti.mcafee.com^ diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index bd5102534..17f5c1741 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 27November2021v3-Beta +# Version: 01December2021v1-Beta # Expires: 5 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -59,7 +59,7 @@ juvander.net ssl.bblck.me allblock.net -# Malicious domains found in videogame manuals and title screens +# Malicious or purchaseable domains found in videogame manuals and title screens acclaimsports.com acclaimmaxsports.com hip-games.com @@ -339,7 +339,6 @@ new-message.email new-message.today new-notification.live new-notifications.live -notified-today.com notified-today.live notified-today.xyz stay-notified.com @@ -770,7 +769,6 @@ newstepsco.com chse-security-notifications.email lucdream.com beastbuying.com -kokotrokot.com 07ca17vejqqej990.inteo.xyz pesoaniz.com plarium.com @@ -951,7 +949,6 @@ aquariuminn.com army-glo.scrollingsystem.com www.kqzyfj.com kqzyfj.com -cj.dotomi.com mcafee12.tt.omtrdc.net trolleydrop.info jaynordan.digital @@ -1088,14 +1085,10 @@ cloud-apps.store citationsherbe.at 159.148.186.228 yotube.com -mybetterdl.com -p185689.mybetterdl.com r-tb.com cdn.hoood.info -data-px.services barah-flo.com beta-one.net -beastbuying.com pisism.com czyzd.xyz r1it6.xyz @@ -1105,7 +1098,6 @@ nkb18.xyz m6ydd.xyz welcomejohncena.pro security-scanner.xyz -pushmeup.art c2egp.xyz ese40.xyz e07wm.xyz @@ -1266,6 +1258,36 @@ shadyclient.net 115.204.119.237 163.125.31.46 163.179.168.44 +updsec.builtfromzero.com +money-mod.com +gospelchor.info +smwgwa.brownbrothersilver.top +new.bestlifeoffer20.com +reykijnoac.com +totalnicefeed.com +riteupd.mimanduca.co +oaesso.info +abcwkv.naturaloffsteam.top +bestlifeoffer20.com + + + + +110.89.59.135 +113.116.89.1 +119.183.146.191 +153.3.3.226 +182.116.104.6 +60.7.133.200 +122.6.254.201 +110.89.11.167 +171.112.177.90 +115.194.38.143 +61.52.79.32 +ups-dk.u1537460.cp.regruhosting.ru +lowseelan.com + + # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” downloadprovider.me @@ -6176,10 +6198,10 @@ discord-app.net discord-spooky.ru discord.foundation discordgift.ru -discordnitro-steam.ru + discordnitro.space -discordxgift.xyz -discordxnitro.xyz + + discorgift.online discrocl.xyz discrod.gifts @@ -6207,7 +6229,7 @@ fozzytournaments.fun free-dislcordnitrlos.ru free-niltross.ru free-nitlross.ru -freediscordnitro.ru + freeskinsfree.pp.ua from-plames.xyz from-sparsei.ru.com @@ -6544,15 +6566,13 @@ githubnt.com # β€”β€”β€” Upgrades HTTP requests to HTTPS on sites that don't do it automatically β€”β€”β€” -# β€”β€”β€” Offline-only apps trying to phone home β€”β€”β€” - - - # β€”β€”β€” Anti-'Malware comments' (Currently Disqus-specific) β€”β€”β€” + # β€”β€”β€” Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) β€”β€”β€” if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data + # β€”β€”β€” Anti-PUP (WIP) β€”β€”β€” # This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine) webadvisorc.rest.gti.mcafee.com diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 08f370068..04226784f 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Β«hostsΒ» file version) -# Version: 27November2021v3-Alpha +# Version: 01December2021v1-Alpha # Expires: 5 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -59,7 +59,7 @@ 127.0.0.1 ssl.bblck.me 127.0.0.1 allblock.net -# Malicious domains found in videogame manuals and title screens +# Malicious or purchaseable domains found in videogame manuals and title screens 127.0.0.1 acclaimsports.com 127.0.0.1 acclaimmaxsports.com 127.0.0.1 hip-games.com @@ -339,7 +339,6 @@ 127.0.0.1 new-message.today 127.0.0.1 new-notification.live 127.0.0.1 new-notifications.live -127.0.0.1 notified-today.com 127.0.0.1 notified-today.live 127.0.0.1 notified-today.xyz 127.0.0.1 stay-notified.com @@ -770,7 +769,6 @@ 127.0.0.1 chse-security-notifications.email 127.0.0.1 lucdream.com 127.0.0.1 beastbuying.com -127.0.0.1 kokotrokot.com 127.0.0.1 07ca17vejqqej990.inteo.xyz 127.0.0.1 pesoaniz.com 127.0.0.1 plarium.com @@ -951,7 +949,6 @@ 127.0.0.1 army-glo.scrollingsystem.com 127.0.0.1 www.kqzyfj.com 127.0.0.1 kqzyfj.com -127.0.0.1 cj.dotomi.com 127.0.0.1 mcafee12.tt.omtrdc.net 127.0.0.1 trolleydrop.info 127.0.0.1 jaynordan.digital @@ -1088,14 +1085,10 @@ 127.0.0.1 citationsherbe.at 127.0.0.1 159.148.186.228 127.0.0.1 yotube.com -127.0.0.1 mybetterdl.com -127.0.0.1 p185689.mybetterdl.com 127.0.0.1 r-tb.com 127.0.0.1 cdn.hoood.info -127.0.0.1 data-px.services 127.0.0.1 barah-flo.com 127.0.0.1 beta-one.net -127.0.0.1 beastbuying.com 127.0.0.1 pisism.com 127.0.0.1 czyzd.xyz 127.0.0.1 r1it6.xyz @@ -1105,7 +1098,6 @@ 127.0.0.1 m6ydd.xyz 127.0.0.1 welcomejohncena.pro 127.0.0.1 security-scanner.xyz -127.0.0.1 pushmeup.art 127.0.0.1 c2egp.xyz 127.0.0.1 ese40.xyz 127.0.0.1 e07wm.xyz @@ -1266,6 +1258,36 @@ 127.0.0.1 115.204.119.237 127.0.0.1 163.125.31.46 127.0.0.1 163.179.168.44 +127.0.0.1 updsec.builtfromzero.com +127.0.0.1 money-mod.com +127.0.0.1 gospelchor.info +127.0.0.1 smwgwa.brownbrothersilver.top +127.0.0.1 new.bestlifeoffer20.com +127.0.0.1 reykijnoac.com +127.0.0.1 totalnicefeed.com +127.0.0.1 riteupd.mimanduca.co +127.0.0.1 oaesso.info +127.0.0.1 abcwkv.naturaloffsteam.top +127.0.0.1 bestlifeoffer20.com + + + + +127.0.0.1 110.89.59.135 +127.0.0.1 113.116.89.1 +127.0.0.1 119.183.146.191 +127.0.0.1 153.3.3.226 +127.0.0.1 182.116.104.6 +127.0.0.1 60.7.133.200 +127.0.0.1 122.6.254.201 +127.0.0.1 110.89.11.167 +127.0.0.1 171.112.177.90 +127.0.0.1 115.194.38.143 +127.0.0.1 61.52.79.32 +127.0.0.1 ups-dk.u1537460.cp.regruhosting.ru +127.0.0.1 lowseelan.com + + # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” 127.0.0.1 downloadprovider.me @@ -6176,10 +6198,10 @@ 127.0.0.1 discord-spooky.ru 127.0.0.1 discord.foundation 127.0.0.1 discordgift.ru -127.0.0.1 discordnitro-steam.ru + 127.0.0.1 discordnitro.space -127.0.0.1 discordxgift.xyz -127.0.0.1 discordxnitro.xyz + + 127.0.0.1 discorgift.online 127.0.0.1 discrocl.xyz 127.0.0.1 discrod.gifts @@ -6207,7 +6229,7 @@ 127.0.0.1 free-dislcordnitrlos.ru 127.0.0.1 free-niltross.ru 127.0.0.1 free-nitlross.ru -127.0.0.1 freediscordnitro.ru + 127.0.0.1 freeskinsfree.pp.ua 127.0.0.1 from-plames.xyz 127.0.0.1 from-sparsei.ru.com @@ -6544,15 +6566,13 @@ # β€”β€”β€” Upgrades HTTP requests to HTTPS on sites that don't do it automatically β€”β€”β€” -# β€”β€”β€” Offline-only apps trying to phone home β€”β€”β€” - - - # β€”β€”β€” Anti-'Malware comments' (Currently Disqus-specific) β€”β€”β€” + # β€”β€”β€” Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) β€”β€”β€” 127.0.0.1 if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data + # β€”β€”β€” Anti-PUP (WIP) β€”β€”β€” # This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine) 127.0.0.1 webadvisorc.rest.gti.mcafee.com diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 19d166d1f..403e619c5 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 27November2021v3-Alpha +# Version: 01December2021v1-Alpha # Expires: 5 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -67,7 +67,7 @@ -# Malicious domains found in videogame manuals and title screens +# Malicious or purchaseable domains found in videogame manuals and title screens @@ -373,7 +373,6 @@ - /bitcoinrevolution/lp.php @@ -877,7 +876,6 @@ - # Relations to the original domain @@ -1038,7 +1036,6 @@ - # Domains which resolve to this (already blocked) IP - for users of HOSTs/Domains/uBlock Origin @@ -1123,11 +1120,6 @@ - - - - - @@ -1265,6 +1257,36 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -6531,18 +6553,14 @@ # β€”β€”β€” Upgrades HTTP requests to HTTPS on sites that don't do it automatically β€”β€”β€” -{+block} -# β€”β€”β€” Offline-only apps trying to phone home β€”β€”β€” -# -# -# - {+block} # β€”β€”β€” Anti-'Malware comments' (Currently Disqus-specific) β€”β€”β€” +# {+block} # β€”β€”β€” Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) β€”β€”β€” +# {+block} # β€”β€”β€” Anti-PUP (WIP) β€”β€”β€” diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 2c655682f..2e4d71292 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 27November2021v3-Beta +# Version: 01December2021v1-Beta : expires = 5 # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -112,7 +112,7 @@ msFilterList -d ssl.bblck.me -d allblock.net -d microsoftedge.microsoft.com addons detail allblock nkllnmjaaifdphkfbmedklkimjmnjeen -# Malicious domains found in videogame manuals and title screens +# Malicious or purchaseable domains found in videogame manuals and title screens -d acclaimsports.com -d acclaimmaxsports.com -d hip-games.com @@ -430,7 +430,6 @@ msFilterList -d new-message.today -d new-notification.live -d new-notifications.live --d notified-today.com -d notified-today.live -d notified-today.xyz -d stay-notified.com @@ -899,7 +898,6 @@ msFilterList -d lucdream.com -d beastbuying.com --d kokotrokot.com -d 07ca17vejqqej990.inteo.xyz -d pesoaniz.com -d plarium.com @@ -1135,7 +1133,6 @@ msFilterList -d army-glo.scrollingsystem.com -d www.kqzyfj.com -d kqzyfj.com --d cj.dotomi.com -d mcafee12.tt.omtrdc.net -d trolleydrop.info -d jaynordan.digital @@ -1303,14 +1300,10 @@ msFilterList -d 159.148.186.228 # https://github.com/iam-py-test/investigations/blob/main/2021/10 26 1.md#domains -d yotube.com --d mybetterdl.com --d p185689.mybetterdl.com -d r-tb.com -d cdn.hoood.info --d data-px.services -d barah-flo.com -d beta-one.net --d beastbuying.com -d pisism.com -d czyzd.xyz -d r1it6.xyz @@ -1320,7 +1313,6 @@ msFilterList -d m6ydd.xyz -d welcomejohncena.pro -d security-scanner.xyz --d pushmeup.art -d c2egp.xyz -d ese40.xyz -d e07wm.xyz @@ -1512,6 +1504,46 @@ msFilterList -d 115.204.119.237 -d 163.125.31.46 -d 163.179.168.44 +# https://github.com/uBlockOrigin/uAssets/pull/10647 +# https://github.com/iam-py-test/investigations/blob/main/2021/11 28 1.md +-d updsec.builtfromzero.com +-d money-mod.com +-d gospelchor.info +-d smwgwa.brownbrothersilver.top +-d new.bestlifeoffer20.com +-d reykijnoac.com +-d totalnicefeed.com +# https://github.com/iam-py-test/investigations/blob/main/2021/11 28 2.md +-d riteupd.mimanduca.co +-d oaesso.info +-d abcwkv.naturaloffsteam.top +-d bestlifeoffer20.com +# https://scammer.info/t/password-stealer/84348 +# https://bazaar.abuse.ch/sample/462a689d171f543c10efa08e963996d382585b67a6b298ec40d64f924adfb47a/ +-d youtube.com watch?v=8nY7SnvNxH4 +-d bit.ly 3p8kN5V +-d mediafire.com file at2tvnao5x6ivdo EngineOwning.rar +-d download2264.mediafire.com pnk44f5ci9rg at2tvnao5x6ivdo EngineOwning.rar +# https://www.virustotal.com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community +-d 110.89.59.135 +-d 113.116.89.1 +-d 119.183.146.191 +-d 153.3.3.226 +-d 182.116.104.6 +-d 60.7.133.200 +-d 122.6.254.201 +-d 110.89.11.167 +-d 171.112.177.90 +-d 115.194.38.143 +-d 61.52.79.32 +# https://scammer.info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 +-d ups-dk.u1537460.cp.regruhosting.ru +# https://www.virustotal.com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 +-d lowseelan.com +# https://www.virustotal.com/gui/file/50fd813cf8fe981e6aee179f8ba394e5527c5128b84c328f9f8347cd994bbc42/community +-d dl02.s3.amazonaws.com installers 747947 oi_picasa38-setupexe.exe +# https://www.virustotal.com/gui/file/2ea599605c4d65902943f12e1114a71af7a40fa7dffbf018b0ee3e7a61aaeaa3/community +-d dl02.s3.amazonaws.com installers 424531 2gzbsoj4gxb.exe # β€”β€”β€” Standard malware that I stumbled upon on my own β€”β€”β€” # http://www.toorgle.net/results.php?q=fetishkitsch&security=666 @@ -6431,10 +6463,10 @@ msFilterList -d discord-spooky.ru -d discord.foundation -d discordgift.ru --d discordnitro-steam.ru +-d discordnitro-steam. -d discordnitro.space --d discordxgift.xyz --d discordxnitro.xyz +-d discordxgift. +-d discordxnitro. -d discorgift.online -d discrocl.xyz -d discrod.gifts @@ -6463,7 +6495,7 @@ msFilterList -d free-dislcordnitrlos.ru -d free-niltross.ru -d free-nitlross.ru --d freediscordnitro.ru +-d freediscordnitro. -d freeskinsfree.pp.ua -d from-plames.xyz -d from-sparsei.ru.com @@ -6757,19 +6789,15 @@ msFilterList # β€”β€”β€” Upgrades HTTP requests to HTTPS on sites that don't do it automatically β€”β€”β€” -# β€”β€”β€” Offline-only apps trying to phone home β€”β€”β€” - -# https://fosspost.org/audacity-is-now-a-spyware/ - - - # β€”β€”β€” Anti-'Malware comments' (Currently Disqus-specific) β€”β€”β€” # https://myip.ms/info/limitexcess # https://myip.ms/info/memberarea/My_Account.html + # β€”β€”β€” Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) β€”β€”β€” -d if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data + # β€”β€”β€” Anti-PUP (WIP) β€”β€”β€” # This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine) -d webadvisorc.rest.gti.mcafee.com diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset index 337183cea..c10180170 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset @@ -1,5 +1,5 @@ # Title: Dandelion Sprout's and other adblocker lists' IPs -# Version: 25November2021v1-Beta +# Version: 27November2021v3-Beta # Expires: 5 days # Description: This IP set combines IP and CIDR addresses from plentiful of major adblocker lists. It contains heavily altered content from Dandelion Sprout's Anti-Malware List, Dandelion Sprout's Nordic Filters, EasyList, uBlock Filters, uBlock Filters - Badware Risks, AdGuard Base Filter, AdGuard French Filter, EasyList Germany, ABP Anti-Circumvention Filters, RU AdList, Liste AR, and EasyList Spanish. # For more information and details about this list and other lists of mine, go to https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english @@ -184,6 +184,14 @@ 115.56.169.134 194.87.138.20 103.167.92.73 +58.249.74.79 +27.45.14.109 +27.40.101.191 +27.45.119.22 +27.47.73.159 +115.204.119.237 +163.125.31.46 +163.179.168.44 192.243.59.12 192.243.59.13 192.243.59.20