diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index 9f473de16..433329229 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox) -! Version: 16July2025v2 +! Version: 17August2025v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -51532,6 +51532,21 @@ http://secured21.*.com/|$popup ||worthyboxersympathy.com^$popup ||yummyadvertiseexploded.com^ ||yummyadvertiseexploded.com^$popup +! https://github.com/AdguardTeam/AdguardFilters/issues/211351 +||update-macosx.com^ +||update-macosx.com^$popup +||updates-macos.com^ +||updates-macos.com^$popup +||update-macos.com^ +||update-macos.com^$popup +||unesmunbrebers.com^$popup +||filinnetirt.com^$popup +||freshsubz.com^ + +52.15.34.25 +52.15.34.25$popup + + ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -62163,6 +62178,7 @@ www.tumblr.com#?#div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([h ||datedate.today^$popup ||go.dealslandz.com^ ||go.dealslandz.com^$popup +||awecrptjmp.com^$popup ||172.240.41.32^ ||172.240.41.32^$popup diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 833a63f7c..c92402e38 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 16July2025v2 +! Version: 17August2025v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -27623,6 +27623,18 @@ http://secured21.*.com/|$all ||winemeaslesnab.com^$all ||worthyboxersympathy.com^$all ||yummyadvertiseexploded.com^$all +! https://github.com/AdguardTeam/AdguardFilters/issues/211351 +||update-macosx.com^$all +||updates-macos.com^$all +||update-macos.com^$all +||unesmunbrebers.com^$document,popup +||filinnetirt.com^$document,popup +||freshsubz.com^$document +!#if !adguard_app_windows +52.15.34.25$all +!#endif +!+ PLATFORM(windows, mac, android, cli) +52.15.34.25$network ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -33589,6 +33601,7 @@ www.tumblr.com##div[data-timeline-id] div[style="margin-top: 0px;"]:has(a:is([hr ||playanimenow.com^$document,popup ||datedate.today^$all ||go.dealslandz.com^$all +||awecrptjmp.com^$document,popup !#if !adguard_app_windows !+ NOT_PLATFORM(windows, mac, android, cli) ||172.240.41.32^$all diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 19b823dab..421991225 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,12 +1,10 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22) -! Version: 16July2025v2 +! Version: 17August2025v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists - - ! Legitimate use is almost non-existent, but has a tiny userbase in Japan and among upstart coding experiments. Its extreme common-ness in malware redirections means that the entry will be kept forever. ||*.top^$dnstype=~CNAME,denyallow=caitlin.top|callmebymygender.top|corriente.top|gdtot.top|nicenature.top|reminder.top|magocoro.top|castlevania.top|suiten.top|shucks.top|1stream.top|ambr.top|changlam10.top|changlam11.top|pdcdn1.top|pressplay.top|chillx.top|strims.top|thedesk.top|audioforyou.top|awavenue.top|reyhub.top|iboxs.top|adrules.top|hostingowy.top|to|yggtorrent.top|asiaon.top|voxel.top|passt.top|polar.top ! (Loosely inspired by https://github.com/DandelionSprout/adfilt/issues/1067) @@ -22,72 +20,23 @@ ||*.loan^$dnstype=~CNAME ||*.bid^$dnstype=~CNAME ! Experimental attempt to cover a few hardcore spam ASNs - - - - ! https://github.com/AdguardTeam/AdguardFilters/issues/139667 - - ! ——— You know those ultra-fraudulent auto-generated things that clutter up Google searches? These entries should remove some of them. ——— - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ! ——— Old dead tech-related domains ——— ! Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. ||adblock.gjtech.net^ ||spam404bl.com^ - 109.201.135.46 - - ||fredfiber.no^ ||securemecca.com^ - - ||everythingisnt.com^ ||vin-plastiks.com^ ||adblock-listefr.com^ - ||njabl.org^ ||dutchmega.nl^ ||juvander.net^ ||ssl.bblck.me^ ||allblock.net^ - ! Malicious or purchaseable domains found in videogame manuals, title screens, or game driver/patch sites ||acclaimsports.com^ ||acclaimmaxsports.com^ @@ -114,29 +63,12 @@ ||mandriva.com^ ! Fraudulent browser extensions ||ublock.org^ - 138.68.252.54 - - ||useragentswitch.com^ ||dev-nano.com^ ||adblocker-app.info^ ||block-ads-now.com^ ! Presumed to be fraudulent antivirus extensions on app/extension sites where it's perfectly probable that everyday people could install them. - - - - - - - - - - - - - - ! Other ||inside3d.com^ ||viaarena.com^ @@ -146,7 +78,6 @@ ||fileplanet.com^ ||inputmapper.com^$denyallow=stolen_by_casino_spammers.* ||henrypp.org^$denyallow=stolen_by_casino_spammers.* - ! ——— IQ test sites that make you waste heaps of time by taking the test, and then try to charge you to see the results. ——— ||funeducation.com^ ||iq-research.info^ @@ -157,178 +88,52 @@ ||iqtestonline24.com^ ||test-iq.org^ ||officialiqtests.com^ - ! ——— Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware ——— ! ¤¤¤ ReImagePlus (Also added to "uBlock Filters - Badware Risks") ¤¤¤ ! https://windowsreport•com/extend-windows-laptop-battery-life/ - ! https://appuals•com/fix-error-0x800701e3-on-windows-7-8-1-10/ - - ! https://ugetfix•com/ask/how-to-fix-windows-store-error-0x8000ffff/ - - - - - - - - - ! https://www•thewindowsclub•com/fix-windows-update-error-0xc1900130-on-windows-10 - - ! https://www•majorgeeks•com/files/details/patch_my_pc•html - - ! https://www•2-spyware•com/remove-redirector-gvt1-com•html - - - - - - - - - - - - ! ¤¤¤ ScanUtilities ¤¤¤ ! https://www•bynarycodes•com/fix-windows-10-update-error-0x80070006/ - - ! ¤¤¤ Driver Easy ¤¤¤ ! https://www•drivereasy•com/knowledge/fix-critical-service-failed-blue-screen-error-on-windows-10/ - - - ! https://www•drivereasy•com/knowledge/fixed-how-to-fix-stop-error-0x0000001e/ - - - ! https://www•drivereasy•com/knowledge/download-gigabyte-audio-driver/ - - - ! https://www•drivereasy•com/knowledge/epson-xp-420-driver-update-for-windows-7-8-and-10/ - - - ! https://www•drivereasy•com/knowledge/solved-this-display-does-not-support-hdcp/ - ! ¤¤¤ Slimware DriverUpdate ¤¤¤ ! https://forums•windowscentral•com/ - ! ¤¤¤ Driverpack Online (Accidentally also fixed in EasyPrivacy and «AdGuard Mobile Ads») ¤¤¤ - ! ¤¤¤ SpyHunter links ¤¤¤ ! https://howtoremove•guide/redirector-gvt1-com-virus-malware-chrome-removal/ - - ! https://www•2-spyware•com/remove-redirector-gvt1-com•html - - - - - - - - - - - ! https://www•cyclonis•com/how-to-create-gmail-account-without-phone-number/ - ! https://www•2-viruses•com/remove-ad-spam-press-allow-to-continue - - ! https://github.com/iam-py-test/my_filters_001/issues/119 - - - - - - - - - - - - - - - - - - - - - - - - - - - - ! ¤¤¤ Restoro ¤¤¤ ! https://www•windowsdispatch•com/fix-system-restore-0x81000203-error-code/ - ! https://dlldownloads•com/xlive-dll/ - ! https://windowsreport•com/find-remove-duplicate-files-windows-10/ - ! https://windowsreport•com/how-to-update-roblox/ (08/12/2022) - - ! https://appuals•com/pr-connect-reset-error/ - - - - ! ¤¤¤ "Driver" download sites that instead download PUP tools ¤¤¤ ||driver-soft.com^ ! ¤¤¤ Outbyte ¤¤¤ - - - - - - - - - - - - - - - - - ||outbyte.com^ ||testedforyou.net^ ! ¤¤¤ PC Reviver ¤¤¤ - ! ¤¤¤ FixMyPC ¤¤¤ - ! ¤¤¤ "DLL Helper" ¤¤¤ - ! ¤¤¤ WinThruster ¤¤¤ ||solvusoft.com^ - - - ! Common scam domain patterns /^https?://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live).*$/ - ! https://github•com/AdguardTeam/AdguardFilters/issues/58737 /^https?:\/\/(?:www\.)?[-0-9a-z]{14,}\.(?:biz|fun|live)\/[a-zA-Z]{10,}\.php$/domain=biz|fun|live - ! ——— Banner for "MSN New Tab" ——— - - ! ——— Download sites that felt shoddy to me (Most of which, if not all of which, had real non-ad download links that contained malware .exe files) ——— ! If you're in a situation where you need to torrent something, such as for hard-to-buy or region-locked games, or games that you own for consoles that lack accessible rip tools, you can at least try to use sites that have legit downloads with the actual game files. ||freeroms.com^ @@ -341,168 +146,36 @@ ||ps1games.online^ ||roms-download.com^ ||gamesgx.net^ - - ! ——— Browser extension store entries for notoriously poor or malicious adblocker forks ——— ! Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages ! Chrome Web Store - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ! Mozilla Add-ons ! These entries can be used in Firefox with regular browser extensions (uBO|AdGuard Browser Extension|ABP) by opening about:config, removing the "addons.mozilla.com" part from "extensions.webextensions.restrictedDomains", and then creating a new string called "privacy.resistFingerprinting.block_mozAddonManager" (That exact capitalisation must be used) set to (Boolean) true. - - - - - - ! Homepages ||the1adblocker.com^ ! Other sites - - - - - - - - - - ! ——— Typo squatting, misspellings, and honest TLD address bar mistakes ——— ||ubuntu.org^$denyallow=you-were-likely-looking-for-ubuntu.com - 103.224.212.249 - - ||speedtest.com^$denyallow=you-were-likely-looking-for-speedtest.net ||snapchat.cm^$denyallow=malware-typo-squatter-of-snapchat.com ||facebook.cm^$denyallow=malware-typo-squatter-of-facebook.com ||wix.cm^$denyallow=malware-typo-squatter-of-wix.com - 199.59.243.222 - - |http://ww01.$denyallow=very_very_extremely_frequently_used_in_malware_redirections.* - - 173.208.96.42 - - - 173.208.96.43 - - - 173.208.96.44 - - - 173.208.96.45 - - - 173.208.96.46 - - - 213.227.149.208 - - - 213.227.149.211 - - - - - - - - - - ! https://github.com/DevSpen/links/blob/master/src/links.txt - - - - - - - - ||steamcommin*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com - - - - - - - - - - ||steamconnu*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com ||steancomm*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com - - - - ||free-discordnitro. - - /^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/.*)?$/ - - - - - - - - - - - - - - - - - - - - - - - - ||githubus.com^$denyallow=you-were-likely-looking-for-githubusercontent.com ||githubu.com^$denyallow=you-were-likely-looking-for-githubusercontent.com ||githu.com^$denyallow=you-were-likely-looking-for-github.com @@ -511,8 +184,6 @@ ||rgithub.com^$denyallow=you-were-likely-looking-for-githubusercontent.com ||githubt.com^$denyallow=you-were-likely-looking-for-githubusercontent.com ! https://scammer•info/t/discord-nitro-scam-25/87887 - - ! ——— Frequently or previously frequently used to infiltrate and maliciously redirect sites ——— ||lucretius-ada.com^ ||hippolyte-hag.com^ @@ -526,103 +197,43 @@ ||lordagty.com^ ||madagty.com^ ||zeroredirect5.com^$denyallow=malware_redirection_trains.* - 54.209.22.226 - - - 54.91.125.197 - - - 52.202.53.245 - - - 35.175.38.64 - - - 35.168.147.213 - - - 34.230.160.215 - - - 3.226.8.132 - - - 3.216.243.46 - - ||roamingclicks.com^ ! Source: desidertNO - ! Various ex-affiliate links at www•zombooru•com - - - ||lasvegas-vacations.net^ ||ndsplitter.com^ ||ns1.trafficclub.com^ ||satcom1.co.uk^ ||splitter.microxml.net^ - 94.130.185.237 - - - 94.130.186.231 - - - 144.76.0.242 - - - 144.76.1.130 - - - 195.201.92.254 - - - - - ! https://github.com/DandelionSprout/adfilt/pull/167 ||forgoprokick.icu^ ! https://github.com/AdguardTeam/AdguardFilters/issues/124611 ! (https://github.com/DandelionSprout/adfilt/issues/632) ?bemobdata= ||inbluson.com^ - ! ——— Found in witness reports online ——— ! Adblock Plus list maintainer weekly reports ||pinoy-offers.com^ ||googleboost.xyz^ ||couponbybox.com^ ||newpage.in^ - - 34.204.214.165 - - - 54.85.113.62 - - - 54.205.83.61 - - - 54.210.193.115 - - 2600:1f18:43d1:2a04:ee05:261e:d408:7ba1 ||ailkeyair.com^ ||amulagaudish.cam^ @@ -649,82 +260,28 @@ ||strownstramp.cam^ ||witlayvet.com^ ||adblockerapp.com^ - 172.255.6.107 - - - 172.255.6.147 - - - 172.255.6.219 - - - 172.255.6.225 - - - 188.42.129.108 - - - 188.42.129.116 - - - 188.42.141.100 - - - 188.42.141.92 - - - 23.109.82.144 - - - 23.109.82.41 - - - 23.109.82.43 - - - 23.109.82.65 - - - 23.109.82.66 - - - 23.109.87.169 - - - 23.109.87.207 - - - 23.109.87.208 - - ||entwithou.xyz^ ||chedstimaarr.pics^ ||blueoyster.click^ ||qocvicklgcgr.com^ - 216.21.13.14 - - - 216.21.13.15 - - /^.*\.(xyz|pics)/[a-zA-Z0-9]{130,}$/script,subdocument,image /^.*\.(cloudfront\.net|xyz|pics)/[a-zA-Z0-9]{20,}/[a-zA-Z0-9]{25,}\+[a-zA-Z0-9+]{90,}$/script,subdocument,image ||abaphosis.guru^ @@ -3405,12 +2962,10 @@ ||zealpickup.com^ ||zeroclampentice.com^ ||zillionable.com^ - /^173\.233\.137\.[12]?\d?\d$/ /^173\.233\.139\.[12]?\d?\d$/ /^192\.243\.59\.[12]?\d?\d$/ /^192\.243\.61\.[12]?\d?\d$/ - ! https://twitter•com/SUNgoddessOKAMI/status/1221295265195405315 ||deviuser.com^ ! https://github.com/AdguardTeam/AdguardFilters/issues/61838 @@ -3427,11 +2982,7 @@ ||zfirst-news.com^ ||zmp3-online.com^ ||zmusic-online.com^ - - 178.128.142.109 - - ||findmedia.biz^ ||backtonews.biz^ ||bagclick.biz^ @@ -3449,10 +3000,7 @@ ||virnews.club^ ||vviewpoint.biz^ /^https?://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/ - 134.209.136.174 - - ||whiteclick.biz^ ||gonews2.com^ ||mediadate.net^ @@ -3462,22 +3010,10 @@ ||startmode.biz^ ||texterra.me^ ||worldtxt.club^ - 62.210.6.153 - - - 62.210.7.209 - - - 62.210.9.92 - - - 62.210.11.203 - - ||hooligapps.com^ ||best202*-games-web1.com^ ||theonlygames.com^ @@ -3492,10 +3028,7 @@ ||notified-today.xyz^ ||stay-notified.com^ ||stay-notified.xyz^ - 167.99.249.47 - - ! https://maldita•es/malditobulo/2020/12/02/lidl-regala-robot-cocina-silvercrest-monsieur-cuisine-encuesta/ ! https://maldita•es/malditobulo/2020/11/25/jordi-evole-el-hormiguero-bitcoin-revolution-timo-twitter/ ||moderncomputer.net^ @@ -3512,9 +3045,7 @@ /^https?://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/.*)?$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/73133 /^(https?://)?\d\d?\.[a-z0-9-]{1,}\.biz(/.*)?$/ - ||safe-offers.net^ - ! https://github.com/DandelionSprout/adfilt/issues/188 ||gogle.net^ ||extragifis.site^ @@ -3526,56 +3057,22 @@ ||gamesex.fun^ ||goldprize.xyz^ ||kmip.net^ - ||rebiraert.com^ ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^ - 5.8.34.26 - - - 5.8.47.3 - - - 103.224.182.251 - - ! https://github.com/DandelionSprout/adfilt/issues/193 ||holescontracting.com^ ||doggroomingnews.com^ - 5.79.71.205 - - - 5.79.71.225 - - - 85.17.31.82 - - - 85.17.31.122 - - - 178.162.203.202 - - - 178.162.203.211 - - - 178.162.203.226 - - - 178.162.217.107 - - 2a02:1668:1034::2 ! https://github.com/DandelionSprout/adfilt/issues/195 ||logicalrecord.com^ @@ -3588,22 +3085,10 @@ ||emiratenbduae.com^ ||securebankapp.online^ ||securemailbox.online^ - 66.85.156.85 - - - 66.85.156.86 - - - 108.170.31.123 - - - 108.170.52.156 - - ! https://github.com/DandelionSprout/adfilt/issues/198 ||mysecrethoookup.com^ ! https://www•bleepingcomputer•com/virus-removal/ (18/06/2021) @@ -3702,18 +3187,9 @@ ||video-update.digital^ ||watch-this.live^ ||weather-forecast.today^ - 95.168.170.165 - - - 213.227.145.147 - - - 213.227.149.216 - - ! https://twitter•com/adamziaja/status/1252234957679808513 ||wow-robotics.xyz^ ! https://blog•sucuri•net/2021/05/woocommerce-credit-card-skimmer•html @@ -3722,16 +3198,12 @@ ||intr0.cyou^ ||johndoe.icu^ ||justinstalledpanel.com^ - ||yoyoyo.cyou^ ||albumzips.xyz^ ||aleinvest.xyz^ ||fblaster.com^ ||ribinski.us^ - 5.188.62.36 - - ! https://github.com/DandelionSprout/adfilt/issues/223 ||speedupmypcfree.com^ ! https://github.com/DandelionSprout/adfilt/issues/224 @@ -3766,36 +3238,23 @@ ||untilkawan.com^ ||ssielearning.com^ ||paymetconfirm.com^ - 69.49.231.244 - - ! https://movsb•0x0•st/users/mia - ! https://github.com/DandelionSprout/adfilt/issues/228 ||helooworld.us^ ! https://github.com/DandelionSprout/adfilt/issues/241 ||vrthcobj.com^ ! https://github.com/DandelionSprout/adfilt/issues/244 ||rblxexploits.net^ - ||image-find.com^ - ||usegetmarketings.com^ ||bestappever4you.com^ ||thecrs.club^ - - - - ||nanorgin.ydns.eu^ ||cocinasintonterias.com^ ||blackpass.info^ ||yzsnw.com^ - 37.34.176.37 - - ||atvcampingtrips.com^ ||thegymmum.com^ ||pcspeedcat.com^ @@ -3813,34 +3272,15 @@ ||mediagetplus.com^ ||mgmgmg.com^ ||temp74.com^ - - 23.111.31.137 - - - 23.111.88.207 - - ! https://github.com/DandelionSprout/adfilt/issues/254 ||onesafesoftware.com^ ! https://github.com/DandelionSprout/adfilt/issues/257 - 185.158.250.239 - - - 192.169.69.25 - - - 212.192.241.72 - - - 37.0.10.83 - - ||newstepsco.com^ ||secure-0*.ddnss.ch^ ||lucdream.com^ @@ -3863,24 +3303,19 @@ ! https://www•virustotal•com/gui/url/8066b87ad10ddb5466bc307bb48454139572f6c8c8f80a9734275ac89cf966af/detection ! https://www•virustotal•com/gui/url/826c451929420c4da32552f967fb1cab6467405a29c65b23802aaadb6a8c7505/detection ! https://safeweb•norton•com/report/show?url=192•3•110•170 - 192.3.110.170 - - ! https://forums•malwarebytes•com/topic/278209-removal-instructions-for-socialsearchconverter/ ||socialsearchconverter.com^ ||install.socialsearchconverter.com^ ||feed.socialsearchconverter.com^ ||api.socialsearchconverter.com^ ! Copied over from https://github.com/uBlockOrigin/uAssets/issues/9848 - ||mediafiire.com^ ! https://securelist•com/apkpure-android-app-store-infected/101845/ ! https://www•virustotal•com/gui/url/866a25343864f03dc5a10105fda523bfbb6ed09c486d07fd31ca2b5306440089/detection ||wcf.seven1029.com^ ! https://www•virustotal•com/gui/url/9c66e331e455dc5c5c9d06e1a537580c9e4db279182d2285c07783e837806a16/detection ||foodin.site^ - ! owned by the same people ||totalwebshield.com^ ||scanguard.com^ @@ -3891,10 +3326,7 @@ ! https://www•virustotal•com/gui/file/c683bc3da4966110b419ac54d09a54ce798efdb51be398331d9ce011e2636fa9/community ! https://www•virustotal•com/gui/url/5618023ed5a768d7f879c0d599b9ba7cff0e9171201981256eeaf5ce8eb09fdb/detection ! https://www•virustotal•com/gui/url/8cf9ca3359f17cf92b9b3e5fdab30e29be23f08e66c8c5396c9410fcb91f7c3c/detection - 91.241.19.38 - - ! https://www•virustotal•com/gui/url/46e095c35d83e2dd0b98df4b5844d3d87948de0c930a618600121020a514c801/detection ! https://safeweb•norton•com/report/show?url=telete•in ! https://www•siteadvisor•com/sitereport•html?url=telete•in @@ -3904,92 +3336,39 @@ ||kiff.tech^ ! https://www•virustotal•com/gui/domain/kiff•tech/relations ! https://www•virustotal•com/gui/url/dc038496b1b5358b97f89440135ec91258b406c40859a2cd95983dc7a81e0cfa/detection - 45.90.58.90 - - ! https://www•virustotal•com/gui/file/e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730/community ! https://www•virustotal•com/gui/url/e3a9189a1e1256beba8e0fc3abfeab6acb09f7f8cabfd973e22be9f77bb6886f/detection - 95.85.89.98 - - ! https://github.com/DandelionSprout/adfilt/issues/267 - ! https://github.com/DandelionSprout/adfilt/pull/278 !! https://www.virustotal.com/gui/file/da75c85fe037f9ff9ebbbd0b37dd2ff154f5e70a0dc6870286e0d3df6b8f246f/community - 139.28.37.49 - - !! https://www.virustotal.com/gui/file/717bfbdba55f9c2d820fde170c04fd70c3e0f907b635c13d0f29678ff781f665/community - 35.194.188.37 - - !! https://www.virustotal.com/gui/file/368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792/community ||hydro-ca.link^ !! https://www.virustotal.com/gui/file/c0e40a12643436cb413235e385a6a90deeb6cc13b24458368fd7facb20ac0c81/community - 91.243.121.19 - - !! https://www.virustotal.com/gui/file/9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b/community - 103.169.90.205 - - ! https://github.com/DandelionSprout/adfilt/pull/281 ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community - 125.44.43.45 - - - 182.121.8.240 - - - 42.235.183.74 - - - 78.36.32.242 - - - 115.50.2.119 - - - 115.50.110.163 - - - 119.179.84.145 - - - 188.120.50.98 - - - 190.238.183.5 - - - 27.220.253.78 - - ! https://www•virustotal•com/gui/file/0374ead74fa807fb1737d8829fdb5bad6c93779f6b9eb7162eddabff7a64acff/community ||esetnode32-antiviru.ydns.eu^ - ||aieov.com^ ! Relations to the original domain - 192.3.194.242 - - ||w0hsyejhnbcvzaxi8euyr6tgeya5vml09jysgav27.ydns.eu^ ||hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu^ ||avira-antivirus.ydns.eu^ @@ -4001,21 +3380,17 @@ ||tweakbit.com^ ||pcspeedup.en.softonic.com^ ! Copied from «uBlock Filters - Badware Risks» because it has proven to be a very good entry - ||retailproductsusa.com^ ||cloud-repos.store^ - ||spnccrzone.com^ ||natnlconsmrctr.com^ ||therewardboost.com^ - ||best-prizes.life^ ||cloud-storage.store^ ! https://github.com/DandelionSprout/adfilt/issues/287 ||polyhymnia-mar.com^ ||virpropcnow.xyz^ ! (https://github.com/DandelionSprout/adfilt/issues/904) - ! https://github.com/DandelionSprout/adfilt/issues/288 ||safelyonline.net^ ||browse-safe.net^ @@ -4023,7 +3398,6 @@ ||adalgard-wol.com^ ||secure-access-*.gate23.xyz^ ||hosting-redirect.com^$denyallow=malware_redirection_trains.* - ! https://github.com/DandelionSprout/adfilt/pull/289 ||gogles.com^ ||aquariuminn.com^ @@ -4032,230 +3406,67 @@ ! https://www•virustotal•com/gui/ip-address/70•32•1•32/relations ||cd.org^ ! https://www•virustotal•com/gui/file/78f490e503c86eaaff5760197b9ff5308ed6e03161af13194a6c1e0cd95422de/community - - 23.94.26.138 - - ! https://github.com/DandelionSprout/adfilt/pull/298 ! https://www•virustotal•com/gui/file/ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63/community - 205.185.126.200 - - ! https://www•virustotal•com/gui/file/3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078/community - 185.243.56.167 - - ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community - 123.10.224.135 - - - 59.47.187.147 - - - 39.68.172.210 - - - 122.192.177.176 - - - 112.27.124.108 - - - 123.110.176.246 - - - 219.155.105.98 - - - 171.35.161.209 - - - 60.16.255.36 - - - 112.30.4.52 - - - 182.121.191.201 - - - 121.61.48.170 - - - 39.81.68.45 - - - 27.222.220.164 - - - 113.233.215.135 - - - 151.77.100.133 - - - 125.120.13.184 - - - 120.12.138.133 - - - 27.194.115.185 - - - 104.128.199.228 - - - 183.92.123.145 - - - 110.89.8.126 - - - 125.43.211.184 - - - 1.0.218.230 - - - 221.208.4.56 - - - 60.13.60.19 - - - 171.37.29.87 - - - 124.91.237.188 - - - 115.56.137.49 - - - 115.52.240.69 - - - 112.252.132.185 - - - 117.198.240.157 - - - 42.53.240.249 - - - 116.179.138.68 - - - 110.241.119.159 - - - 115.56.31.133 - - - 103.19.128.222 - - - 202.12.80.74 - - - 61.52.8.62 - - - 182.122.252.69 - - - 219.155.26.50 - - - 120.4.141.185 - - - 119.102.7.115 - - - 72.51.127.213 - - - 111.224.199.91 - - - 119.250.236.122 - - - 112.30.110.58 - - ! https://www•virustotal•com/gui/file/715eef1fb3bbf84ade848d97d4ec05d380cf8595298b51af134385de70be9d08/community ||pcae.de^ ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community - 117.196.49.21 - - - 115.55.54.234 - - - 115.52.17.123 - - - 182.59.69.21 - - ! https://www•virustotal•com/gui/file/3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c/community ||chip-secured-download.de^ ! https://www•virustotal•com/gui/url/5b1dc9b2ec70e28b5f6cbb282a598a1b2ecd4df2aebb66953ca9194fa1c9c4fb @@ -4277,35 +3488,18 @@ ||realdefen.se^ ! Vermilion Strike ! https://www•virustotal•com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations - 160.202.163.100 - - ! https://www•virustotal•com/gui/ip-address/160•202•163•100/relations ||microsoftkernel.com^ ||microsofthk.com^ - - ||machinesalaver.net^ - - - ! https://github.com/DandelionSprout/adfilt/pull/303 ! https://www•virustotal•com/gui/file/37328efa73c248b460aba605d7745b024f31ab7ab864e1af273e9a197a188f42/community - 45.95.169.115 - - ! https://www•virustotal•com/gui/file/03e4533ba8874c2f4dcdb94bd135914fa4c22ed477d7c0395dc2322b6468e249/community - 45.148.120.80 - - ! https://www•virustotal•com/gui/file/1a782cab036efa567c2c42b7bae9452bf735be72f0b00d68f6dcba48cea526fa/community - 85.239.33.9 - - ! Relations to the domain above ||adminsys.serveftp.com^ ||amazbaidu.serveftp.com^ @@ -4322,39 +3516,22 @@ ||1log-wellsfargo.serveftp.com^ ||eposcardokubo.serveftp.com^ ! https://www•virustotal•com/gui/file/8a39f18caa77d52e80bec05f584ec50e733a3be1e33551d8902e95b9b0bfe6c0/community - 107.173.176.183 - - ! https://www•virustotal•com/gui/file/54054209c921a68f12a9b29d6e84f1b45cb417bc0b5a99356a245727e0a41e40/community - 45.148.120.171 - - ! https://twitter•com/soranker0/status/1449491402409185283 ://disordgift. - ||free-softs.net^ - ||google-yandex. ||cloud-apps.store^ /^(.*://|.*\.)?[a-z]{5,}-[a-z]{5,}-[a-z]{5,}\.xyz(/.*)?$/ - - 159.148.186.228 - - - ||yotube.com^ ||barah-flo.com^ ||beta-one.net^ ||welcomejohncena.pro^ ||security-scanner.xyz^ ! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md - - - - ?uclickhash= ! https://www•upwork•com/freelance-jobs/apply/Integarte-push-notification-for-chrome_~013c73ed9282225184/ ||mugrikees.com^ @@ -4364,155 +3541,49 @@ ||mediadlvr.com^ ! https://github.com/DandelionSprout/adfilt/pull/348 ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community - 39.83.80.247 - - - 68.197.33.124 - - - 219.157.21.37 - - - 182.123.141.17 - - - 125.47.243.187 - - - 182.122.196.203 - - - 182.117.231.182 - - - 112.31.211.135 - - - 125.106.63.93 - - - 115.59.197.46 - - - 122.159.29.192 - - - 171.40.0.127 - - - 171.80.219.160 - - - 123.10.65.201 - - - 168.90.205.46 - - - 125.47.205.109 - - - 39.80.147.239 - - - 45.224.171.130 - - - 45.5.209.75 - - - 116.17.210.157 - - - 27.45.103.240 - - - 110.167.64.171 - - - 39.81.117.73 - - - 183.15.90.156 - - - 119.113.248.74 - - - 175.0.95.85 - - - 61.52.99.109 - - - 222.142.183.194 - - - 106.86.172.194 - - - 103.233.216.77 - - - 183.188.192.55 - - ! https://www•virustotal•com/gui/file/3bf1b7e9bdaeaa4a5619cf26b59767637bc44193df2a0470df263b98b1fe47fe/community - 198.23.255.14 - - - - - ||querahinor.xyz^ ||trumops.com^ ||runmodes.com^ - 91.121.67.60 - - - 172.67.186.189 - - ! https://www•virustotal•com/gui/url/af8f443208f4e86d469549b219fccbeb43b7cae40be5f1b4c4e5083e27fc8111 ||inconclusive-pyrite-grandparent.glitch.me^ ||delicate-tame-angora.glitch.me^ ||secureinvoice.glitch.me^ ||holy-ruddy-brace.glitch.me^ - ||instafollow.glitch.me^ ||loving-discovered-swordfish.glitch.me^ ||aquamarine-cotton-impala.glitch.me^ @@ -4521,49 +3592,28 @@ ! https://scammer•info/t/mcafee-phish/83725 ||securefirst.us-east-1.linodeobjects.com^ ! https://www•virustotal•com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community - 39.65.72.211 - - - 42.238.151.197 - - - 27.213.60.53 - - - 115.56.169.134 - - ! https://github.com/iam-py-test/investigations/blob/main/2021/11/21/1.md ||yasir252.com^ ||safelink.kadal.club^ ||ultimate-detection.com^ ! https://github.com/uBlockOrigin/uAssets/issues/10536 - - ||tonightshookup.com^ ||members.tonightshookup.com^ ||t.tonightshookup.com^ ||yourladiefun.life^ ! https://www•virustotal•com/gui/url/a2524bba49ae71297d2b408b30d058700d9c80b5b1154924cafe190ec3e605a6/detection ! https://www•virustotal•com/gui/file/2b2628a50d3b39b0fa2395d487bf62b00e37cdae847ff76ee58399bbe4e9f7b3/community - 194.87.138.20 - - ! https://www•virustotal•com/gui/file/b320bc7a9151d70daca038c4356ca89bfcd4918bcd6f0f73683a27a6a72467ae/community - 103.167.92.73 - - ! https://www•virustotal•com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community ||bursakulis.com^ ! https://www•virustotal•com/gui/url/b333c49efa4d399e65c5e2d96a905b380acbca58a3e3052b7bd7cfcb3e0e81ee ||610418.selcdn.ru^ - ! https://www•tv2•no/nyheter/14368524/ ||alexstewartinternationalltd.rw^ ||vps.re^ @@ -4583,38 +3633,14 @@ ! https://github.com/uBlockOrigin/uAssets/pull/10620 ||shadyclient.net^ ! https://www•virustotal•com/gui/file/d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8/community - 58.249.74.79 - - - 27.45.14.109 - - - 27.40.101.191 - - - 27.45.119.22 - - - 27.47.73.159 - - - 115.204.119.237 - - - 163.125.31.46 - - - 163.179.168.44 - - ! https://github.com/uBlockOrigin/uAssets/pull/10647 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md ||money-mod.com^ @@ -4622,62 +3648,23 @@ ||bestlifeoffer20.com^ ! https://scammer•info/t/password-stealer/84348 ! https://bazaar•abuse•ch/sample/462a689d171f543c10efa08e963996d382585b67a6b298ec40d64f924adfb47a/ - - - - ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community - 110.89.59.135 - - - 113.116.89.1 - - - 119.183.146.191 - - - 153.3.3.226 - - - 182.116.104.6 - - - 60.7.133.200 - - - 122.6.254.201 - - - 110.89.11.167 - - - 171.112.177.90 - - - 115.194.38.143 - - - 61.52.79.32 - - ! https://scammer•info/t/pihishing-site-claiming-to-hold-a-ups-package-that-needs-payment/84466 ://ups-dk.denyallow=dk|nu|se|no|fo|gl|ups.com ! https://www•virustotal•com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635?nocache=1 ! https://www•virustotal•com/gui/file/50fd813cf8fe981e6aee179f8ba394e5527c5128b84c328f9f8347cd994bbc42/community - ! https://www•virustotal•com/gui/file/2ea599605c4d65902943f12e1114a71af7a40fa7dffbf018b0ee3e7a61aaeaa3/community - ! https://github.com/DandelionSprout/adfilt/pull/395 ! https://www•huorong.cn/info/1618397948649.html - possible malware ! ||zhuangjizhuli.com^ @@ -4687,19 +3674,11 @@ ! https://www•nrk.no/vestfoldogtelemark/1.15750360 ||dundeehills.group^ !+ NOT_OPTIMIZED - 132.148.220.142 - - - ||chess-progress.ru^ ! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 ||askara.super.site^ - - ! https://scammer•info/t/fake-facebook-login-page/84939 - - ! https://www•tek.no/i/lVeQAe/ ! https://www•nkom.no/aktuelt/ikke-trykk-pa-lenker-i-sms--for-du-er-helt-sikker/ ||eccolabgroup.com^ @@ -4707,88 +3686,44 @@ ||p-stn.net^ ! https://github.com/iam-py-test/investigations/blob/main/2021/12/13/1.md ||haxpc.net^ - 52.53.243.52 - - - 34.201.22.10 - - ! https://scammer•info/t/crypto-scammers-onceagain/85354 - ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community - 123.10.225.196 - - - 122.192.106.84 - - - 172.88.199.9 - - - 114.38.176.185 - - - 61.52.97.35 - - - 27.206.181.208 - - - 124.163.130.175 - - - 118.75.87.102 - - ! https://github.com/iam-py-test/investigations/blob/main/2021/12/14/1.md ! https://github.com/DevSpen/links/pull/3 ||systemupdatecontrol.com^ ! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ ||mozicrack.com^ ||download-srvr.xyz^ - 134.122.115.190 - - ||cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com^ - ||viewty.xyz^ ||landing.marketstm.com^ ! fake MediaFire scam domains ||songlos.com^ ||royaltees.co^ ||findes.co^ - - ! https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ ||freeprosoftz.com^ - - ! fake Flash Player ||lekms.com^ - ||new-meet-dating.life^ ! https://github.com/AdguardTeam/AdguardFilters/issues/103475 ||ru.com^ - 141.8.226.34 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/108571 ||ston-app.com^ ! fake human verification scam ! start form - reported for abuse - ||q.promotionsonlineusa.com^ ||reward4spot.com^ ||dgu9g3a2kzqx2.cloudfront.net^ @@ -4797,33 +3732,21 @@ ! https://www•virustotal•com/gui/url/c25fe34c05cc8e9136027a67c277e175a5d6e35af921ee37bad98bdfeea6a2f9/community ||splendid-fallacious-anaconda.glitch.me^ ! https://www•virustotal•com/gui/file/9d40ae0439ddc594b2cf64e21ad0fdea9bb440524298e3a6bcfcc1fb417f1ed2/relations - 91.240.118.172 - - ! "Press Allow to continue" ||kuyhaa-mee.com^ ||waystriling.com^ ||upload-4ever.com^ ||worldcoolfeed.com^ ! Fake Discord Nitro - ||lucymods.com^ ||gluegames.xyz^ ! https://twitter•com/iam_py_test/status/1496259425493225472 - - - ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 - - ||pccrackworld.com^ ||calsign.xyz^ ||jwq98u.xyz^ ||nhskuhiuscja.xyz^ - - - ||melding.link^ ! https://twitter•com/MBThreatIntel/status/1509956416311742464 ||xposednews.xyz^ @@ -4845,10 +3768,7 @@ ||activatorwin.com^ ||freeversioncrack.com^ ||top3hostngc.xyz^ - 198.199.120.251 - - ! https://www•telia•no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/ @@ -4871,20 +3791,13 @@ ||partners-space.life^ ||partners-club.life^ ||cumpussyy.uno^ - 195.201.253.130 - - - 195.201.253.131 - - ! The bottom download button on https://www•sushichop•com/ ||installiq.com^ ||specgoal.com^ ||sandhyapi.online^ /trk2/*?lddomain=domain=~very_likely_a_malware_redirection.* - ||goprotectpc.com^ ||cpmrevdirect.com^$denyallow=malware_redirection_trains.* ||rtbverdirect.com^$denyallow=malware_redirection_trains.* @@ -4894,26 +3807,11 @@ ||rtbrevdirect.com^$denyallow=malware_redirection_trains.* ||rtbvrdirect.com^$denyallow=malware_redirection_trains.* ||cpmverdirect.com^$denyallow=malware_redirection_trains.* - 15.197.244.48 - - - 96.47.230.67 - - - 96.47.230.68 - - - 96.47.230.69 - - - 96.47.230.70 - - ! https://securitytrails•com/list/ns/ns1•fastthinkingdns•com ||highercaptcha-settle. ||highercaptchasettle. @@ -4925,12 +3823,9 @@ /^78\.128\.112\.[12]?\d?\d$/ /^179\.60\.146\.[12]?\d?\d$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/121772 ||pu020ev.com^ ||kadam.net^ - ||clcpb.net^ ||kadxin.net^ ||kdmrqw.com^ @@ -4946,16 +3841,11 @@ ||viixcv.com^ ||viixes.com^ ||viiyhn.com^ - 31.220.27.134 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk. ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 - ||online-guard.com^ - ! https://twitter•com/iam_py_test/status/1545164642346930176 ||amazon-security-info.lnk.to^ ! https://github.com/AdguardTeam/AdguardFilters/issues/123968 @@ -5198,10 +4088,6 @@ ||tlkn45ssg.cyou^ ||toprefgtbvatv.com^ ||tov49ro5ep.art^ - - - - ||udlwwle.site^ ||uij5nn-ta.cyou^ ||uqujzco.xyz^ @@ -5250,14 +4136,8 @@ /^178\.253\.46\.[12]?\d?\d$/ /^178\.253\.47\.[12]?\d?\d$/ /^178\.253\.54\.[12]?\d?\d$/ - 85.17.31.152 - - - 95.211.26.202 - - ! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 ||bzsx.link^ ||dfvd.link^ @@ -5271,14 +4151,8 @@ ||szxo.link^ ||ujtj.link^ ||wznp.link^ - 158.247.212.220 - - - 165.227.168.212 - - ! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ /^162\.241\.115\.[12]?\d?\d$/ ! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 @@ -5323,10 +4197,7 @@ ||proilammix.com^ ||broburchrove.com^ ||galantinkoling.com^ - 23.81.64.183 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/125300 ||dupelipperan.com^ ||goods2you.net^ @@ -5359,10 +4230,7 @@ ||stelronsi.net^ ||tadaickaipt.com^ ||vekeltaizy.net^ - 139.45.197.236 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^ ||becovi.co.uk^ @@ -5390,34 +4258,17 @@ ||optimusquaero.com^ ||frescopartito.com^ ||motherpipe.net^ - 51.91.66.125 - - - 51.178.76.105 - - - 147.135.253.55 - - ! https://github.com/uBlockOrigin/uAssets/issues/14569 → https://www•virustotal•com/gui/url/b819586938326577d759d8024abe3e0e6de1c853d6b67824daf6f613fba0f63b/detection (https://app•any•run/tasks/5914a712-1a73-4432-b89a-ca0627a24ade) ||bnbdeal.net^ ! https://github.com/AdguardTeam/AdguardFilters/issues/129414 !+ NOT_OPTIMIZED - !+ NOT_OPTIMIZED - ! https://github.com/AdguardTeam/AdguardFilters/issues/131156 - 146.19.169.98 - - - 146.19.169.99 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 /pushredirect/?domain=~malware_redirection_trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 @@ -5904,7 +4755,6 @@ ||ffrontgate.com^ ||fiars.com^ ||fightmove.co.uk^ - ||filezila.com^ ||filmfreestream.net^ ||filmox.org^ @@ -6210,7 +5060,6 @@ ||keyrug.com^ ||keysschools.net^ ||keystonehoops.com^ - ||keywordadvisetoolplus.com^ ||kickoff.cm^ ||kindfirls.com^ @@ -7185,18 +6034,12 @@ ||zz1200.com^ ||niderschlagsradar.de^ ||2c236979-b1bb-4c7a-915c-df74dbad0d8c.s3.ap-northeast-2.amazonaws.com^ - 69.162.80.56 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/134903 ! Random Discord servers ||newntflix- ||giveawaycord. - 162.241.124.200 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/135815 ||adsstar.in^ ||clickcafe.in^ @@ -7212,10 +6055,7 @@ ||tnvalue.in^ ||usanewstoday.club^ ||webhostingtips.club^ - 157.90.71.190 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/135924 ||alspearowa.com^ ||ardsdusknoiron.com^ @@ -7223,7 +6063,6 @@ ||beskittyan.com^ ||bigsport.today^ ||cadbitff.com^ - ||comivolo.com^ ||davaifoa.com^ ||dodurantom.com^ @@ -7273,10 +6112,7 @@ ||whaxanso.net^ ||whizista.xyz^ ||wumpeeps.net^ - 139.45.197.239 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub. ! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 @@ -7476,50 +6312,25 @@ ||yugiidv.xyz^ ||zaolutd.icu^ ||zigaahm.icu^ - 44.228.230.225 - - - 50.112.124.170 - - - 100.20.104.229 - - ! Spambots who posted malware shortener links in the Legitimate URL Shortener discussion thread ||link.sv^ ||4.fo^ ||kckb.st^ ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 - ||loadingnow.me^ ||gsecurecontent.com^ ||pressizer.net^ ||sapino.net^ - 44.236.213.34 - - - 52.24.156.12 - - - 52.25.6.134 - - - 100.20.13.49 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/139667 ||goldmesoil.live^ - 51.68.87.229 - - ||f9dle.skin^ ||kilpa2017.fi^ ! https://github.com/DandelionSprout/adfilt/issues/747 @@ -7529,7 +6340,6 @@ ||adidasusa.us^ ||adsoutletusa.com^ ||adulttoyonline.shop^ - ||adulttoyvibrators.store^ ||airjordanshoes.store^ ||airjordansneakers.store^ @@ -8533,10 +7343,8 @@ ||zamberlanireland.com^ ||zapatillasvejacl.com^ ||zapatosaldochile.org^ - /^104\.160\.10\.[12]?\d?\d$/ /^165\.231\.154\.[12]?\d?\d$/ - ! https://github.com/DandelionSprout/adfilt/issues/748 ||adidas--* ||adidas-outlet* @@ -9308,19 +8116,9 @@ ||unity-download.com^ ||unity-download.org^ ||webull-download. - 185.106.94.139 - - - 45.90.109.196 - - - 91.229.23.200 - - - ! https://github.com/AdguardTeam/AdguardFilters/issues/144514 ||attractbestbonuses.life^ ||attractbonus.life^ @@ -9379,22 +8177,13 @@ ||winxlbonus.life^ ||winbest.life^ ||winmacros.life^ - 185.155.184.98 - - - 194.110.247.242 - - ! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ ||ups-addressed.me^ ||ups-quote.me^ ||meta-whatsapp.me^ - 54.219.218.169 - - ! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^ ||0365online.com^ @@ -9824,10 +8613,7 @@ ||yourlivingequity.com^ ||yourticketchance.com^ ||yourorderupdate.com^ - 64.132.201.92 - - ! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||acessmygov.online^ ||centerlinkmygov.com^ @@ -9848,10 +8634,7 @@ ||verifyauth-mtbonline.us^ ||jatcraft.com^ ||elimef.link^ - 209.141.51.49 - - ://soekpakke*.blogspot.com^ ||post-norway.web.app^ ! https://github.com/AdguardTeam/AdguardFilters/issues/142955 @@ -10043,21 +8826,11 @@ ||wooden-comfort.com^ ||worthwhile-yesterday.com^ ! Unsuited for wildcarding - 208.88.225.116 - - - 208.88.225.117 - - - 208.88.225.119 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/144823 !+ NOT_OPTIMIZED - ! https://github.com/AdguardTeam/AdguardFilters/issues/145513 ||achilles-par.com^ ||adrastos-eli.com^ @@ -10134,7 +8907,6 @@ ||thor-pom.com^ ||thutm-bru.com^ ||uthyr-que.com^ - ||zp-dom.com^ ||redirect.newprogrammatic.click^$denyallow=likely_a_malware_redirection.* ||arcad-hoh.com^ @@ -10151,22 +8923,10 @@ ||wiela-kig.com^ ||wulfs-dcm.com^ /zcvisitor/*?campaignid - 3.231.116.86 - - - 54.237.193.255 - - - 3.231.137.120 - - - 54.204.83.105 - - ! https://github.com/DandelionSprout/adfilt/issues/808 ! https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) ||jonathanbartz.com^ @@ -10185,28 +8945,12 @@ ||center-main.com^ ||office-view.com^ ||i-likefood.co^ - 108.61.242.65 - - - 146.70.78.43 - - - 87.120.254.39 - - - 45.150.108.213 - - - 92.204.160.240 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 - ! Comments on Slack ||boot-upextremelyquickinfo-product.info^ ||boot-upextremelyswiftinfo-product.info^ @@ -10356,10 +9100,7 @@ ||watchprecisehighlyinfo-product.info^ ||watchrenewedcompletelyinfo-product.info^ ||watchuberdevelopedinfo-product.info^ - 34.200.46.148 - - ||abstorick.com^ ||affienness.com^ ||ailippiess.co.in^ @@ -10416,10 +9157,7 @@ ||urnigarted.com^ ||wuruclas.co.in^ ||zondeucearixes.com^ - 85.17.80.16 - - ! https://www•adressa.no/nyheter/trondheim/i/Moq2wR/svindlere-kaarer-vinnere-i-konkurranser-gir-en-daarlig-foelelse-aa-forklare-at-dette-bare-er-tull ||sitey.me^ ! https://github.com/AdguardTeam/AdguardFilters/issues/151479 @@ -10522,8 +9260,6 @@ ||pw-show-ad.com^ ||pw-show-main.com^ ||pw-show-test.com^ - - ||rich-people-club.com^ ||search-top-videos.com^ ||secret-casino-site.com^ @@ -10746,30 +9482,14 @@ ||z5v6h8recpgb.com^ ||zirze151uk5d.com^ ||zxvjn4igweb9.com^ - 185.246.188.124 - - - 185.246.188.125 - - - 194.63.140.103 - - - 194.63.143.61 - - - 194.63.143.96 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/152945 ||moneystartup.live^ ||fintechbest.online^ - /^5\.61\.60\.[12]?\d?\d$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/154701 ||algazira-updates.com^ @@ -10898,11 +9618,9 @@ ||online-notifications.com^ ||openthenotification.com^ ||pclkpackg.xyz^ - ||popular-messages.com^ ||premium-news-for.me^ ||premium-shops-around.me^ - ||read-and-reveal.com^ ||read-before-the-rest.com^ ||read-new-post.com^ @@ -10952,7 +9670,6 @@ ||trending-celeb-news.com^ ||trending-gossip.com^ ||trends-celebs.com^ - ||updates-news-magazine.com^ ||videochatonlinesite.com^ ||viralvidoes-buzz-blog.com^ @@ -10971,40 +9688,19 @@ ||yourlifestyle-blog.com^ ||zarta-news.com^ ||zorka-news.com^ - 37.48.80.112 - - ! Slack comments ||cojcdn.net^ ||collecl.cc^ ||defre.net^ ||puredi.net^ - - - - - - - - - - - - ||rejco.online^ ||spinwincas.online^ ||tapore.net^ ||totadblock.com^ ||updateasap.online^ - 109.206.168.16 - - - 109.206.168.17 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/155298 ||cadstoppam.live^ ||cottodwin.live^ @@ -11020,11 +9716,7 @@ ||rodrevtill.live^ ||showjoinnip.live^ ||usedhutsold.live^ - 57.128.71.215 - - - ! https://github.com/AdguardTeam/AdguardFilters/issues/155936 ||rumadel.com^ /^103\.224\.182\.[12]?\d?\d$/ @@ -11259,7 +9951,6 @@ ||glaingoo.xyz^ ||glefeesh.net^ ||gliceebe.xyz^ - ||goldfishka-casino.xyz^ ||gousauhu.xyz^ ||gphyvg.com^ @@ -11525,7 +10216,6 @@ ||rahfnq.com^ ||raybhi.com^ ||rcqmrz.com^ - ||rfduik.com^ ||rgitpv.com^ ||riaeqd.com^ @@ -11728,43 +10418,21 @@ ||zybnzw.com^ ||zzebuh.com^ ||zzrgab.com^ - 37.1.223.231 - - - 139.45.197.167 - - - 139.45.197.245 - - - 159.223.137.164 - - - 185.56.234.205 - - - 192.243.58.97 192.243.58.98 192.243.58.123 192.243.58.124 192.243.58.125 - 2a02:b48:207:1::2 2a02:b48:207:1::3 2a02:b48:207:1::6 2a02:b48:207:1::7 2a02:b48:207:1::8 - - - - - /^192\.243\.58\.[12]?\d?\d$/ ! https://github.com/AdguardTeam/AdguardFilters/issues/157308 ||abdoser.co.in^ @@ -11801,7 +10469,6 @@ ||alertme.org^ ||allfree.us^ ||answers.actor^ - ||answers.airforce^ ||answers.apartments^ ||answers.army^ @@ -12077,7 +10744,6 @@ ||searchassured.com^ ||searchequivalents.com^ ||searchexcellent.com^ - ||searchinquire.com^ ||searchsimilars.com^ ||searchstarters.com^ @@ -12125,19 +10791,9 @@ ||vitalityfortune.com^ ||wellnessfortune.net^ ||ztomy.com^ - 5.45.123.44 - - - 69.16.230.226 - - - 208.91.196.46 - - - ! https://github.com/AdguardTeam/AdguardFilters/issues/158316 ||abashinstructor.com^ ||abateall.com^ @@ -15715,7 +14371,6 @@ ||zapdescendant.com^ ||zapprecisionadmire.com^ ||zealousstraitcommit.com^ - ! https://github.com/AdguardTeam/AdguardFilters/issues/159157 ||apbbjmp.com^ ||awbbgate.com^ @@ -15738,14 +14393,9 @@ ||ptentry.com^ ||ptosrd.com^ ||ptwmbed.com^ - 93.93.51.223 - - - ! https://github.com/AdguardTeam/AdguardFilters/issues/161364 ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) - ||github.sale^ ! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ ||0nedr1ved0cumentonline.com^ @@ -15782,7 +14432,6 @@ ||charutboll.com^ ||chaseverifications.com^ ||cloud-network.online^ - ||coltersaidas.com^ ||com-96-hours.com^ ||com-96hours.com^ @@ -15906,7 +14555,6 @@ ||paywide.cards^ ||promo-carte-avantages.com^ ||qc1.site^ - ||revoiut-cy.com^ ||revoke.money^ ||richiediilrimborso.com^ @@ -15965,10 +14613,7 @@ ||y2w.site^ ||y3r.site^ ||z2i.tech^ - - ||no-oppdatere. - ||179.43.189.62 ! https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/ ||authde.us^ @@ -15993,10 +14638,7 @@ ||upste.us^ ||upstr.us^ ||reschedule-delivery.ups.com. - 103.174.102.240 - - ! https://github.com/libre-tube/LibreTube/issues/4409 ||libretube.app^ ||libretube.net^ @@ -16121,13 +14763,6 @@ ||usqtvc.com ||usutnr.top ||204.44.92.187 - - - - - - - ||betzykrisesenter.no^ ||citra2010oslo.no^ ||digiter.no^ @@ -16143,12 +14778,8 @@ ||vossblues.no^ ||yttersiden.no^ !!!://162.214.80. - ||monetrizer*. - 38.180.96.244 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/172569 ||acareewityjh.com^ ||accedenonre.xyz^ @@ -16171,7 +14802,6 @@ ||aspectsofc.hair^ ||asqerongtheco.info^ ||astellihandl.xyz^ - ||atedlittleme.xyz^ ||ationiamcur.com^ ||ationslieemrger.info^ @@ -16310,7 +14940,6 @@ ||mwoukrkskills.xyz^ ||myxomater.space^ ||mzsdeauxdwh.info^ - ||nahrghhaondb.info^ ||natallcolumnsto.info^ ||ncelewasgildeda.net^ @@ -16448,15 +15077,8 @@ ||ysearchingfo.xyz^ ||yticaframeofm.com^ ||yvaluationiamcur.com^ - 34.195.224.242 - - - 54.225.185.110 - - - ||githubtalentcommunity. ! https://github.com/AdguardTeam/AdguardFilters/issues/173925 ||sweedbank-help.com^ @@ -16465,10 +15087,7 @@ ||regularisierung-konto.com^ ||dhlexpress-lieferung.net^ ||pochta-ru.com^ - 91.202.233.143 - - ! Based on a tip from my secretary ||0842-3231-4323-4243-2344-1333-0595-3453-6439-7-3235-03928-2348.name^ ||1-3evlhls3yf.shop^ @@ -16544,7 +15163,6 @@ ||copybanaza.com^ ||cosmehuts.com^ ||crocezone.xyz^ - ||cumortg.com^ ||curaproxs.com^ ||daygol.com^ @@ -16824,10 +15442,7 @@ ||speednetworkchain.com^ ||systemnetworkroute.com^ ||trafficredirectchain.com^ - 108.62.157.10 - - ! https://github.com/AdguardTeam/FiltersRegistry/issues/925 ! https://github.com/AdguardTeam/FiltersRegistry/pull/927 ||avito.avito.avito. @@ -16841,46 +15456,16 @@ ||avito.avito.www.avito. ||booking.com-id* ! https://github.com/AdguardTeam/AdguardFilters/issues/179170 - 172.240.108.68 - - - 172.240.108.76 - - - 172.240.108.84 - - - 172.240.127.234 - - - 172.240.253.132 - - - 192.243.59.12 - - - 192.243.59.13 - - - 192.243.59.20 - - - 192.243.61.225 - - - 192.243.61.227 - - ||3sk7d418al8u.com^ ||abberantextending.com^ ||abdicatehorrified.com^ @@ -18229,7 +16814,6 @@ ||youtrustedprolong.com^ ||yydtbpms8tf4.com^ ! https://github.com/AdguardTeam/AdguardFilters/issues/181966 - ! https://github.com/AdguardTeam/AdguardFilters/issues/183432 ||100carbures.com^ ||123ecos.com^ @@ -19235,19 +17819,9 @@ ||zircuil.pro^ ||zoomdirectory.net^ ||zymstr.com^ - 185.149.120.161 - - - 185.149.120.163 - - - - 185.149.120.175 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/184671 ||afro-melanin.com^ ||alatterapistroke.com^ @@ -19285,7 +17859,6 @@ ||webprosystems.com^ ||worldbankdc.com^ ||yesterday-tomorrow.buzz^ - ||02helpinfo.com^ ||02rebill-pending.com^ ||0niinebankingrbcroyabank.com^ @@ -19646,7 +18219,6 @@ ||security-bankwest-app.com^ ||segurancacaixasecurept.com^ ||seguridad-aplicaciion.com^ - ||service-de-messagerie.cc^ ||service-de-messagerie.me^ ||service-de-messagerie.vip^ @@ -19719,7 +18291,6 @@ ||vrbsecuregoplus.com^ ||vrsecurego.com^ ||warehouse-ca.shop^ - ||warehouse-speed.cc^ ||warehouse-speed.me^ ||warehouse-speed.vip^ @@ -19727,83 +18298,26 @@ ||wf-securelogin.com^ ||yourtollbymailnyfile.com^ ||youweb-bpm.com^ - 45.202.32.3 - - - 45.8.92.138 - - - 79.133.46.252 - - - 82.147.85.156 - - - 91.212.166.16 - - - 94.156.64.129 - - - 94.232.249.61 - - - 94.232.249.69 - - - 94.232.249.75 - - - 94.232.249.235 - - - 176.111.174.118 - - - 176.113.115.191 - - - 191.96.224.140 - - - 193.124.185.42 - - - 193.143.1.45 - - - 193.143.1.214 - - - 193.143.1.217 - - - 208.91.189.203 - - - ://193.143.1.* - ! https://github.com/AdguardTeam/AdguardFilters/issues/189905 - ! https://github.com/AdguardTeam/AdguardFilters/issues/196657 ||ablyglossmartyr.com^ ||abolishregulation.com^ @@ -25274,10 +23788,7 @@ ||yj-huayuan.com^ ||ynjkdl.com^ ||yuxc.xyz^ - 103.155.214.207 - - ! Inspired by https://github.com/AdguardTeam/AdguardFilters/issues/197908 ||app-update.site^ ||appupdate.net^ @@ -25285,17 +23796,11 @@ ||mijndiensten.website^ ||potanschranky.com^ ||prihlasit-secure-auth.com^ - 185.196.9.214 - - ||chrome.webredirect.org^ ||captcha.webredirect.org^ .microsoft.com.chrome. - 185.196.9.222 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/201064 ||redirect12.com^ ||100urls.com^ @@ -25364,7 +23869,6 @@ ||bestdatingmeetnow2.com^ ||besthealthylivingtips.com^ ||betterdaytips.com^ - ||bishobeshoy.com^ ||blockfer.com^ ||blockxlabs.io^ @@ -25462,11 +23966,9 @@ ||fazffi.com^ ||fckavs.com^ ||fckavs2.com^ - ||filibooks.com^ ||fimmy.fun^ ||fineclouding.com^ - ||fitnessguides.org^ ||fitnessinf.com^ ||forexdemystified.com^ @@ -25497,7 +23999,6 @@ ||gooddeal.me^ ||goodplaces.store^ ||gotothe.click^ - ||gouduryx.ovh^ ||gridtrk.com^ ||gurrezape.xyz^ @@ -25645,7 +24146,6 @@ ||premium-umfragen.com^ ||primevideobonus.click^ ||privatox.com^ - ||profitnavigator.click^ ||provenhandshakecap.com^ ||pumlim.com^ @@ -25691,7 +24191,6 @@ ||simhoop.xyz^ ||singlemotherhelp.org^ ||sitebrank.com^ - ||skinbiotixnailfungus.org^ ||smalinks.com^ ||smartlifehackers.org^ @@ -25742,7 +24241,6 @@ ||topenergysaver.com^ ||topscop.online^ ||torontogamings.com^ - ||trackao.com^ ||trackbmnow.com^ ||trackhuby.com^ @@ -25790,7 +24288,6 @@ ||urclick.one^ ||urlignite.com^ ||urlstreams.com^ - ||valbexo.com^ ||velindor.com^ ||verdienst-umfragen.com^ @@ -25804,7 +24301,6 @@ ||vpnsite.online^ ||vxx2.com^ ||watchamateurcams.com^ - ||webconnectline.com^ ||webhop.me^ ||webiside.lol^ @@ -25825,7 +24321,6 @@ ||xhots.net^ ||xlifebase.com^ ||xn-9dbq2a.com^ - ||xynro.com^ ||yourbestonlinefriend.vip^ ||yourlovecompass.com^ @@ -25836,32 +24331,18 @@ ||yoursweetfantazeez.site^ ||yoursweetfantazeez.store^ ||yoursweetflirt.online^ - 3.220.51.12 44.223.210.42 52.9.43.57 52.204.19.219 100.28.19.138 108.61.99.63 - 2600:1f18:43d1:2a02:169f:dcbb:85f9:3c56 2600:1f18:43d1:2a02:b6ee:327b:545e:e578 2600:1f18:43d1:2a02:c3bd:35f3:da0a:4041 2600:1f18:43d1:2a02:c6f9:e151:e2e1:732d 2600:1f1c:57F:b502:dd8:9588:11e6:282 - - - - - - - - - - - ! https://github.com/AdguardTeam/AdguardFilters/issues/202010 - ! Various other reports ||afsrepair.com^ ||agtamzsm.com^ @@ -26025,9 +24506,6 @@ ||ztofwukt.com^ ||zufaswbu.com^ ||zuqokksa.com^ - - - ||abcradilytor.com^ ||abmagbychan.com^ ||aboglaiksezuds.net^ @@ -26196,10 +24674,7 @@ ||zauwhoapak.net^ ||zeksaigist.net^ ||zucoagorsout.com^ - 139.45.197.106 - - ! https://github.com/DandelionSprout/adfilt/issues/1129 ||password-internal.com^ ! Though not _inherently_ malware, at least 1 spambot on this repo had direct ties to that site @@ -26207,10 +24682,8 @@ ! https://github.com/DandelionSprout/adfilt/issues/1150 http://secured21.*.com/| ||docssa.online^ - ! For the raw domains/hosts list versions ||secured21.elektro-cigerli.com^ - ! https://github.com/AdguardTeam/AdguardFilters/issues/207878 ||aaa-telegram.com^ ||as-safety.org^ @@ -26405,10 +24878,7 @@ http://secured21.*.com/| ||xxx-telegram.com^ ||zc-telegran.org^ ||zzz-telegram.com^ - 43.128.142.70 - - ! https://github.com/AdguardTeam/AdguardFilters/issues/20787[2-5] ||chceshi001.com^ ||gametime.fyi^ @@ -26554,16 +25024,10 @@ http://secured21.*.com/| ||whatcsappwap.com^ ||whatstapps.com^ ||whetcsapp.com^ - 149.30.232.154 154.204.32.99 156.245.23.49 206.119.178.163 - - - - - ! https://github.com/DandelionSprout/adfilt/issues/1164 ||device-checking.com^ ||device-cleanup.com^ @@ -26573,10 +25037,7 @@ http://secured21.*.com/| ||system-noticers.com^ ||systemsnotifications.com^ ||warningnotification.com^ - 46.101.81.149 - - ||abberantdisheartenbandage.com^ ||acceleratetomb.com^ ||acceptguide.com^ @@ -26852,12 +25313,17 @@ http://secured21.*.com/| ||winemeaslesnab.com^ ||worthyboxersympathy.com^ ||yummyadvertiseexploded.com^ - +! https://github.com/AdguardTeam/AdguardFilters/issues/211351 +||update-macosx.com^ +||updates-macos.com^ +||update-macos.com^ +||unesmunbrebers.com^ +||filinnetirt.com^ +||freshsubz.com^ +52.15.34.25 ! ——— Standard malware that I stumbled upon on my own ——— ! http://www•toorgle•net/results•php?q=fetishkitsch&security=666 ||downloadprovider.me^ - - ! https://www•riverbender•com/articles/details/two-charged-in-connection-of-the-stallon-drug-raid-in-wood-river-46877•cfm ||cash93.com^ ||a4alig.com^ @@ -26914,7 +25380,6 @@ http://secured21.*.com/| ||01mspmd5yalky8.com^ ||0byv9mgbn0.com^ ||0eijh8996i.com^ - ||0h6djpk8fn.com^ ||0oaqgsk54hm5.com^ ||0pyn37dv3m.com^ @@ -26935,7 +25400,6 @@ http://secured21.*.com/| ||34pavouhj7.com^ ||39irqwnzlv.com^ ||3i1cx7b9nupt.com^ - ||421npyd4nd.com^ ||45eijvhgj2.com^ ||4cr447ewncl4.com^ @@ -26968,7 +25432,6 @@ http://secured21.*.com/| ||9itmr1lzaltn.com^ ||9kkf51ovqex1.com^ ||9purdfe9xg.com^ - ||a8rm1m4msbbh.com^ ||aaucwbe.com^ ||abhorboring.com^ @@ -27275,7 +25738,6 @@ http://secured21.*.com/| ||educationdemotediabete.com^ ||egyptpolarity.com^ ||ejurzsax.com^ - ||emailmeditateencourage.com^ ||emailwhilefactory.com^ ||encouragementsubwayfather.com^ @@ -27356,7 +25818,6 @@ http://secured21.*.com/| ||frogrugby.com^ ||fundamentalenvironmental.com^ ||futilereposerefreshments.com^ - ||g27zkdvsxl.com^ ||gadsabz.com^ ||gadsims.com^ @@ -27777,7 +26238,6 @@ http://secured21.*.com/| ||spiritedirreparablemiscarriage.com^ ||spiteaside.com^ ||spoilphysiqueteenagers.com^ - ||squirrelhissedintake.com^ ||ssiapawz.com^ ||ssl2anyone3.com^ @@ -27902,7 +26362,6 @@ http://secured21.*.com/| ||vudux.net^ ||vulnerabletan.com^ ||vwl7kia4fzz6.com^ - ||wafflesgenuine.com^ ||washedinmate.com^ ||wasplighthouse.com^ @@ -27929,7 +26388,6 @@ http://secured21.*.com/| ||wxyn0o3xmora.com^ ||wzdzht7am5.com^ ||x40u1vj75ks9.com^ - ||xmlterra.com^ ||xsjc4smhbyjf.com^ ||xu5ctufltn.com^ @@ -27948,9 +26406,7 @@ http://secured21.*.com/| ||zo7gihmry2.com^ ||zypy2h6rgfux.com^ ||zzdb5p4upiug.com^ - /^(https?://)?192\.243\.59\.\d{1,3}(/.*)?$/ - ! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^ ||jpjmpqaupc.com^ @@ -27963,7 +26419,6 @@ http://secured21.*.com/| ||redirectme.net^$denyallow=malware_redirection_trains.* ||anthargo.com^ ! Domains on IPs known to host Discord Nitro spambots - ||csgocup.ru^ ||csgogf*.xyz^ ||csgogift*.xyz^ @@ -27979,19 +26434,11 @@ http://secured21.*.com/| ||pubggift*.xyz^ ||s-arts.pro^ ||skinosoda.online^ - 194.226.139.121 194.226.139.7 95.181.157.36 - - - 95.181.172.204 - - /^194\.226\.139\.[12]?\d?\d$/ - - ://5.8.67. ://5.101.45. ://5.188.178. @@ -28012,7 +26459,6 @@ http://secured21.*.com/| /^5\.189\.21[89]\.\d{1,3}$/ /^31\.184\.20[0-3]\.\d{1,3}$/ /^185\.238\.15[2-5]\.\d{1,3}$/ - ! https://github.com/AdguardTeam/AdguardFilters/issues/120349 ||dispositionadverb.com^ ||wednesdayexpandingbarb.com^ @@ -28502,49 +26948,29 @@ http://secured21.*.com/| ||freemedicinehelp.online^ ||freemedicinehelp.press^ ||medication.coupons^ - ||medication.quest^ ||medicinecoupons.digital^ ||medicinecoupons.space^ ||medicinecoupons.xyz^ ||medicinehelp.news^ - 147.135.16.27 - - ! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^ ! https://scambiofigu•forumcommunity•net/?t=57482915 ||scambiofigu.net^ ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious - ! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022) - - ||2y68554.cyou^ ||1pwk1j.cyou^ ||986.group^ - 185.87.148.199 - - ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) - - - - - ||ynxqoc2.cyou^ ||resurrectionlinks.online^ ||canon70x70.site^ ||gacorhub.com^ ||zh1653.com^ - 45.136.49.35 - - - - ! Browsing around for Tajik newssites ||arhernot.live^ ||lifelongkick.live^ @@ -28596,31 +27022,15 @@ http://secured21.*.com/| ||fillrumrip.live^ ||cityratetod.live^ ||onlymetsure.live^ - 51.91.211.94 - - - 162.19.71.16 - - - 146.59.240.191 - - - 54.37.5.34 - - - 54.36.118.105 - - ! Work put into https://raw.githubusercontent.com/DandelionSprout/adfilt/master/GDPR%20451%20List.txt ||highlandnews.com^ ||genuinescansupport.com^ ||diverseflowlink.com^ - ||pcbasicstrength.com^ ||varietyflow.com^ ||securecertainflow.com^ @@ -28641,10 +27051,7 @@ http://secured21.*.com/| ||multilpleflow.com^ ||networkprincple.com^ ||pcnetworkdefense.com^ - 159.89.10.102 - - ! Other ||foxsportnetwork.com^ ||pksauniversity.com^ @@ -28654,23 +27061,18 @@ http://secured21.*.com/| ||greaterfiledownload.com^ ||vlcmediadownload.com^ ||quiremuken.xyz^ - ||sexy-egirls-leaked.com^ ||file2share.co^ ||erothots.co^ ||only2leaked.co^ ||only4leaked.co^ ||thotsbay-leaked.com^ - ||aphition.com^ ||inuseme.com^ ||neracti.com^ ||nuouther.com^ ||carpiesi.com^ - 104.206.252.90 - - ! https://github.com/blocklistproject/Lists/issues/933 ||jNKmS0zFuEh.click^ ||pjljo54uk.click^ @@ -28686,73 +27088,31 @@ http://secured21.*.com/| ||eicxz6jfjaw.click^ ! https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2 ||ru-torproject.ru^ - ! https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required) ! https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required) ! https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 ||123secure.org^ - ||yuppdownload.com^ ! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) - 34.80.59.191 - - ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 |http://www6.$denyallow=often_used_in_malware_redirections.* - ||megabooru.com^ ||zombooru.com^ ||kusubooru.com^ ||wh40kart.im^ - 45.33.2.79 - - - 45.33.18.44 - - - 45.33.20.235 - - - 45.33.23.183 - - - 45.33.30.197 - - - 45.56.79.23 - - - 45.79.19.196 - - - 72.14.178.174 - - - 72.14.185.43 - - - 96.126.123.244 - - - 173.255.194.134 - - - 198.58.118.167 - - ! https://hutudole•com/za-mu-%c9%93ullo-da-matakan-da-za-su-hana-al%c6%99alai-kwa%c9%97ayin-cin-hanci-ba-tinubu/ ||123chance.net^ ||123links4u.net^ @@ -28791,7 +27151,6 @@ http://secured21.*.com/| ||awesomewinner.com^ ||awesomewinner.net^ ||awesomewinners.net^ - ||beastgadget.net^ ||beastoffer.net^ ||beastoffrs.com^ @@ -29111,34 +27470,15 @@ http://secured21.*.com/| ||winnerssite.net^ ||xyzoffer.net^ ||yasdoodl.com^ - ||youwanthis.com^ ||zebramode.com^ ||zebraoffers.net^ - 34.117.199.78 - - - 94.237.103.119 - - - 94.237.84.54 - - - 94.237.93.242 - - - 94.237.99.118 - - - 139.45.197.249 - - ! https://dnpedia•com/tlds/topm•php bizarrely listing "anahitagirted•uno" as the 622th most visited domain worldwide ||acorusinfield.life^ ||acridlydebit.live^ @@ -29245,7 +27585,6 @@ http://secured21.*.com/| ||felliessubcoat.life^ ||fienttestor.guru^ ||fleamakonge.website^ - ||formatrefel.space^ ||francickabukis.life^ ||fricacedisgulf.uno^ @@ -29343,7 +27682,6 @@ http://secured21.*.com/| ||oraeitonama.life^ ||orcinsjura.life^ ||orlesbranned.guru^ - ||outhurldorask.uno^ ||outswumovant.guru^ ||pachonsdarcy.guru^ @@ -29352,7 +27690,6 @@ http://secured21.*.com/| ||pelagicbygone.uno^ ||pendulefriezes.live^ ||penniforlay.tech^ - ||phenenetokamak.com^ ||plaiddasein.life^ ||plaitsjewelly.guru^ @@ -29526,34 +27863,13 @@ http://secured21.*.com/| *norgestores.com^ *skobutikks.com^ *butikksoslo.com^ - 196.196.153.151 - - - 158.222.7.116 - - - 196.245.152.139 - - - 165.231.251.197 - - - 196.242.16.29 - - - 165.231.4.90 - - - 158.222.7.83 - - ! A scam SMS I got ||95-214-26-78.plesk.page^ ||account-limitato.org^ @@ -29610,24 +27926,16 @@ http://secured21.*.com/| ||your-track-ups.net^ ||your-ups-track.com^ ||zoll-pakete-support.com^ - 95.214.26.78 - - ! Overly dedicated E-mail spammers ||wirexapp.africa.com^ - ! Google results for «SodaStream site:no cranberry» - - - ! Laughably blatant fraud site ||cosercosplay.com^ ! Fraudulent art thefts for money on Google Image Search, e.g. 'cassandra tangled site:tumblr.com suit' *yo.php?cname=*&cid= .aspx?iid=*&cid= .aspx?cname=*&cid= - /^.*\.[a-z]{2,18}\/Stars\.php\?.*$/$match-case ||asptryfa.info^ ||awpasslong.info^ @@ -29640,25 +27948,13 @@ http://secured21.*.com/| ||seedlogoonce.info^ ||sirdayscare.info^ ||slownansuch.info^ - 185.155.184.57 - - - 185.155.186.24 - - ||usayn.fr^ ||style-js.com^ - - 209.74.107.131 - - ||qidjrsgroup.shop^ /flying.asp?cid= - - .php?iid=*&cid= .asp?iid=*&cid= ||estudioespositoymiguel.com.ar^ @@ -29714,7 +28010,6 @@ http://secured21.*.com/| ||mb223.com^ ||mbt3st3r1.com^ ||mbt3st3r2.com^ - ||oplt20.org^ ||owliz18qmfml.com^ ||pmvhv3tpovz.com^ @@ -29727,24 +28022,10 @@ http://secured21.*.com/| ||wsdcq7wayud.com^ ||xgptw11vogsh.com^ ||zeirj14ikqwf.com^ - 69.172.200.185 - - - 77.220.214.153 - - ! More search terms than what can be counted with a supercomputer (11/03/2024) - ! Scam E-mails I've got - - - - - - - ! Visibly fake item descriptions and prices ||amaskiphirescotland.co.uk^ ! https://walyou•com/gameloft-dungeon-hunter-5-dragon-mania-legends-apple-tv-3029/ @@ -29753,20 +28034,10 @@ http://secured21.*.com/| ! https://github.com/hagezi/dns-blocklists/issues/4907 ! https://cside.dev/blog/over-5k-wordpress-sites-caught-in-wp3xyz-malware-attack ||wp3.xyz^ - ! Tumblr spammers - - - - - - - - 104.21.82.132 172.67.158.57 198.12.86.90 - ||2024ballondor.shop^ 2606:4700:3030::6815:5284 2606:4700:3037::ac43:9e39 @@ -30144,10 +28415,6 @@ http://secured21.*.com/| ||vtwdeal.com^ ||vtydeal.com^ ||ybd001.com^ - - - - ||iuxxx.com^ ||tuusi.com^ ||messageme.life^ @@ -30161,19 +28428,10 @@ http://secured21.*.com/| ||chatly.life^ ||invites.life^ ||girlselfies.online^ - ||dreamintim.com^ ! R34US - - 139.45.197.168 139.45.197.244 - - - - - - ||aikoxouftuxoun.net^ ||ajartoalsushy.com^ ||aptouste.net^ @@ -30220,7 +28478,6 @@ http://secured21.*.com/| ||okbuorftcnek.com^ ||onaibsossuck.net^ ||oobsailsaum.net^ - ||phaikrifurg.net^ ||phurdaurdougn.net^ ||piglumsout.com^ @@ -30241,7 +28498,6 @@ http://secured21.*.com/| ||weeshaubauta.xyz^ ||yxupgwthpcf.com^ ||zukeekoasaijie.net^ - ||1bestmatch.com^ ||googoodee.com^ ||supporters.eu.org^ @@ -30438,20 +28694,14 @@ http://secured21.*.com/| ||fastdatingclub.com^ ||yourdistancechick.live^ ||yoursecretchat.live^ - 185.68.16.189 - - ||huntinginukraine.com^ ||gitlab.gitlab.gitlab. ||gitlab.git.git. ||gitlab.gitlab.git. ||git.git.git.git. ||git.gitlab.gitlab. - 76.223.15.82 - - ||0interestcredit.com^ ||0w2us4hmbcnr7.buzz^ ||0w4xpj9i2gbmq.buzz^ @@ -30914,7 +29164,6 @@ http://secured21.*.com/| ||cimaq.shop^ ||cimplemobile.com^ ||cimplyaccounting.com^ - ||citipoint.church^ ||citruna-com.us^ ||cityhalloffame.com^ @@ -30944,7 +29193,6 @@ http://secured21.*.com/| ||communitymetaverse.space^ ||computersaga.com^ ||comtek.org^ - ||containist.com^ ||contestwallet.com^ ||conti.digital^ @@ -31180,7 +29428,6 @@ http://secured21.*.com/| ||futbestsk.xyz^ ||fx-spread.com^ ||fyljogt.pro^ - ||gajianonline.com^ ||galileo.blog^ ||gallery.biz^ @@ -31715,7 +29962,6 @@ http://secured21.*.com/| ||ref-control.fun^ ||registered.life^ ||relaise.com^ - ||renting.pro^ ||repipe.xyz^ ||reputablewine.com^ @@ -32060,7 +30306,6 @@ http://secured21.*.com/| ||xiluj.shop^ ||xlpm86evtqi53.buzz^ ||xm4yaui1dre0v.buzz^ - ||y71gbi0d3npws.buzz^ ||yachtasset.com^ ||yasulum.buzz^ @@ -32103,380 +30348,102 @@ http://secured21.*.com/| ||netnet33.net^ ||netnet44.net^ ||odintara.com^ - 54.174.156.141 - - ! Searched for Breaking Bad Jesse memes on Qwant (29/04/2025) ://old.sermitsiaq.ag^$denyallow=subdomain_stolen_from_sermitsiaqs_owners.* - - 85.159.213.158 - - ! Seemingly mass-generated fake "marketing company" sites that seem to serve no visible purpose (12/05/2025) - 107.161.189.164 - - - 138.128.161.250 - - - 138.128.161.251 - - - 138.128.161.252 - - - 138.128.161.253 - - - 139.99.239.47 - - - 139.99.254.243 - - - 139.99.254.244 - - - 139.99.254.245 - - - 139.99.254.246 - - - 142.147.98.208 - - - 151.236.60.142 - - - 163.172.41.31 - - - 172.245.1.36 - - - 172.245.1.38 - - - 176.117.68.141 - - - 178.238.235.145 - - - 185.169.99.112 - - - 185.38.149.111 - - - 192.142.110.10 - - - 192.142.110.11 - - - 192.142.110.7 - - - 192.142.110.8 - - - 192.142.110.9 - - - 192.186.132.66 - - - 192.186.156.13 - - - 192.186.156.14 - - - 192.186.156.27 - - - 192.186.156.3 - - - 192.186.156.8 - - - 193.188.192.196 - - - 193.29.12.90 - - - 193.32.161.58 - - - 193.32.161.61 - - - 193.32.161.62 - - - 193.32.161.63 - - - 193.34.144.235 - - - 193.37.152.80 - - - 194.180.36.92 - - - 194.180.36.93 - - - 194.180.36.94 - - - 194.180.36.95 - - - 194.180.36.96 - - - 198.251.82.186 - - - 212.129.11.38 - - - 212.129.3.145 - - - 212.129.6.248 - - - 212.83.189.206 - - - 212.83.189.252 - - - 212.83.190.41 - - - 213.202.211.30 - - - 213.202.211.38 - - - 216.245.211.18 - - - 216.245.216.178 - - - 216.245.216.179 - - - 216.245.216.180 - - - 216.245.216.181 - - - 216.245.216.182 - - - 216.246.30.80 - - - 216.246.30.81 - - - 216.246.30.82 - - - 216.246.30.83 - - - 216.246.30.84 - - - 23.170.252.196 - - - 23.229.68.43 - - - 23.229.68.44 - - - 23.229.68.45 - - - 23.229.68.46 - - - 23.229.68.47 - - - 23.229.69.124 - - - 23.229.70.48 - - - 23.82.169.37 - - - 23.82.169.38 - - - 23.82.169.39 - - - 23.82.169.40 - - - 23.82.169.41 - - - 23.94.86.123 - - - 51.15.3.223 - - - 64.28.236.188 - - - 69.162.70.109 - - - 69.64.49.203 - - - 69.64.52.249 - - - 72.11.130.164 - - - 72.11.130.170 - - - 72.11.130.171 - - - 72.11.130.173 - - - 72.11.130.174 - - - 72.9.157.254 - - - 74.208.27.239 - - - 79.143.181.251 - - 2a14:2d81:0:27::1 - ||taylorcopies.com^ ||atypicalnorms.com^ ||beastlyendeavors.com^ @@ -32512,34 +30479,24 @@ http://secured21.*.com/| ||psaitchuzaubo.com^ ||rita0.com^ ||tshfc.com^ - 139.45.195.9 - - ! Other entries ||animeplaynow.com^ ||playanimenow.com^ ||datedate.today^ ||go.dealslandz.com^ - +||awecrptjmp.com^ 172.240.41.32 172.240.41.64 172.240.41.96 - ! Spambot(s?) on R34X³ ||24hdeepnude.com^ ! gelbo²ruCOM ||debateobsoletesimply.com^ - 172.240.41.33 172.240.41.65 172.240.41.97 172.240.41.129 - - - - - ! bdsmx-pornCOM ||6traitors.com^ ||baimgfroggd.site^ @@ -32620,7 +30577,6 @@ http://secured21.*.com/| ||vpn2play.com^ ||youroffer.pro^ ||yurivideo.com^ - 62.122.168.42 109.206.163.112 109.206.163.116 @@ -32629,7 +30585,6 @@ http://secured21.*.com/| 109.206.176.75 109.206.181.2 109.206.191.198 - 2a02:128:7:4910::2 2a02:128:7:4931::2 2a02:128:7:4966::2 @@ -32637,21 +30592,6 @@ http://secured21.*.com/| 2a02:128:7:5427::2 2a02:128:7:5905::2 2a02:128:7:5940::3 - - - - - - - - - - - - - - - ||00df70f956.com^ ||063f828cf2.com^ ||097be55da0.com^ @@ -32692,14 +30632,9 @@ http://secured21.*.com/| ||sjsabb.com^ ||suybb.com^ ||zivroq.com^ - 178.63.5.120 - 2a01:4f8:c0:33d8::1 2a01:4f8:c0:2a5c::1 - - - ||013d5342d9.com^ ||03122e72f0.com^ ||047f8eefaf.com^ @@ -32925,14 +30860,9 @@ http://secured21.*.com/| ||ntvpevnts.com^ ||selecttopon.com^ ||statelinear.com^ - 167.235.163.216 - 2a01:4f8:c0:2343::2 2a01:4f8:e0:19cb::1 - - - ||a3ion.com^ ||advertrek.com^ ||cant3am.com^ @@ -32986,10 +30916,7 @@ http://secured21.*.com/| ||zlink9.com^ ||zlinkl.com^ ||zlinkv.com^ - 95.211.229.247 - - ! fetish2230•rssing•com ||agdosortione.com^ ||ashwayinvers.com^ @@ -33017,10 +30944,7 @@ http://secured21.*.com/| ||undeciliste.com^ ||unrertivermalous.com^ ||wherdiapospir.com^ - 88.208.22.1 - - ! xmegadriveCOM ||accuratephrase.com^ ||acrobaticbig.com^ @@ -33046,12 +30970,8 @@ http://secured21.*.com/| ||sotomistel.com^ ||turbulent-divide.com^ ||unripereading.com^ - 188.72.219.35 - 2a00:1178:1:4b::e - - ! Various postal credential fraud syndicates ||236956.today^ ||432987.today^ @@ -33709,7 +31629,6 @@ http://secured21.*.com/| ||zaepost.cfd^ ||zhjdauigh.xyz^ ||znauihdak.run^ - 43.100.125.58 43.159.140.215 43.162.119.45 @@ -33717,20 +31636,10 @@ http://secured21.*.com/| 109.230.237.116 147.93.63.211 154.223.16.232 - - - - - - - - ! icepornCOM /adx_iframe_$3p ! https://www•drvhub•net/devices/network/asix/ax88178a-usb-2-0-to-gigabit-ethernet-adapter ||az-partners.net^ - - ! ——— A hijacked link that had previously been on https://sims•fandom•com/wiki/Game_guide:Fog_emitter ——— ||0network.com^ ||100conversions.com^ @@ -33919,7 +31828,6 @@ http://secured21.*.com/| ||uclpointer.online^ ||vot.media^ ||webmedxml.com^ - ||wideblue.xyz^ ||widebluetrue.xyz^ ||winkleads.com^ @@ -33932,22 +31840,15 @@ http://secured21.*.com/| ||yolkclknu.com^ ||yolkdirxl.com^ ||zentrixads.com^ - 103.67.200.64 198.134.116.17 198.134.116.30 - 2a00:8860:10d:1::2:b01 - - - - ! Extreme amounts of PUP to a comical extent ||driverpack.io^$denyallow=has_extreme_amounts_of_pup_in_it.* ! https://github.com/DandelionSprout/adfilt/issues/1124 ||doh-gov.com^ ||doh-gov.ph^ - ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. ||unofficialtwrp.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* @@ -33957,8 +31858,6 @@ http://secured21.*.com/| ||gadgetstwist.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* ||gadgetsfarms.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* ||techorfy.com^$denyallow=had_not_updated_their_root_guides_to_reflect_a_b_partition_phones_as_of_2021.* - - ! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ——— ! If you use AdGuard Home ≥v0.106.3, I warmly recommend manually pasting these entries into Settings → DNS Settings → Disallowed domains ||version.bind| @@ -33969,389 +31868,31 @@ http://secured21.*.com/| |dominiosvision.com| ||hitnslab.info| |1x1.cz| - - ! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ——— !!!/\\/ !!!@@/_udp\.(.*)?\\/ ! Oddly enough, there seems to be no need to couple it with "@@/:\\/", since web browsers convert Windows filenames from backwards to forwards slashes. - ! ——— Spam in comment sections across the internet about "working" from "home" ——— - - - - - - - ! ——— Upgrades HTTP requests to HTTPS on sites that don't do it automatically ——— - - ! ——— Anti-'Malware comments' (Currently Disqus-specific) ——— ! https://myip•ms/info/limitexcess - ! https://myip•ms/info/memberarea/My_Account•html - - - - - ! ——— Dummy entry used to give myself credit, for when this list is used in large compilation hosts-type files (Although they are fully allowed by my licence to use this list, it'd be nice for me and end-users to see where it's being used, as a few of them do not credit their sources) ——— ||if-a-large-hosts-file-contains-this-entry-then-it.uses-dandelion-sprouts-anti-malware-list-as-a-source-list.data^ - - ! ——— Anti-PUP (WIP) ——— ! This section covers ones that would not normally be found in EasyList or AdGuard Base, for instance McAfee WebAdvisor (which also tries to change the search engine) ||webadvisorc.rest.gti.mcafee.com^ ||mip.api.mcafeewebadvisor.com^ ! https://get•adobe•com/no/reader/ - ! Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require «AdGuard for Windows») - - ! ——— Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control ——— - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ! All legitimate Pac-Man games would use "pac-man" links with a dash - - - ! https://eclypsium•com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/ |http://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4^ - ! (Presumably anonymous) E-mail tips ||s.free.fr^ ||trmff.wpengine.com^ - 212.27.60.108 - - - - - - - ! https://github.com/AdguardTeam/AdguardFilters/issues/145513 ||amazonaws.com^$all,~inline-font,badfilter ||amazonaws.com^$all,badfilter @@ -34362,17 +31903,9 @@ http://secured21.*.com/| ://$badfilter ! Inspired by https://github.com/DandelionSprout/adfilt/issues/1095 *$badfilter - ! Yet more Google searches - - - - - ! Domains stolen by casino SEO spammers ||aussie-gamer.com^$denyallow=the-site-was-stolen-by-casino-link-spammers.* - - ! Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests |cisco.com|$dnstype=TXT |cloudflare.com|$dnstype=TXT @@ -34380,8 +31913,6 @@ http://secured21.*.com/| |atlassian.com|$dnstype=TXT |apple.com|$dnstype=TXT |google.com|$dnstype=TXT - - ! Illicit "parking" services or related to such. ://ww4.$denyallow=ww4.ikea.com|ww4.sig-ge.ch|ww4.autotask.net|ww4.pornhoarder.org ://ww5.$denyallow=ww5.ikea.com|ww5.msu.ac.zw|ww5.autotask.net|ww5.pornhoarder.tv @@ -34431,8 +31962,6 @@ http://secured21.*.com/| ://ww49.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* ://ww50.$denyallow=practically_always_leads_to_a_domain_parking_service_known_for_malware.* ! e.g. picnicnetworkORG (04/05/2025) - - ||1800sweepstakes.com^ ||2soft.com^ ||4gateway.net^ @@ -34573,7 +32102,6 @@ http://secured21.*.com/| ||xyz.cm^ ||yellowdragon.com^ ! Parking services' IP addresses - 13.248.148.254 185.53.177.50 185.53.177.51 @@ -34585,20 +32113,6 @@ http://secured21.*.com/| 185.53.178.52 185.53.178.53 185.53.178.54 - - - - - - - - - - - - - - ! ——— Entries that are and/or were in "uBlock Filters — Ads" and/or "uBlock Filters — Badware Risks" but which aren't in AdGuard Base or EasyList ——— ! https://github.com/DandelionSprout/adfilt/pull/395 ! https://www•huorong•cn/info/1531309921141.html @@ -34668,6 +32182,4 @@ http://secured21.*.com/| ||youutube.com^ ||youvetube.com^ ||zonedummy.com^ - - /^172\.255\.6\.(\d\d?|2.*|1[0-689].*|17[0-689])$/ diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 236da228e..6489f34bc 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 16July2025v2 +# Version: 17August2025v1 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway. @@ -26691,6 +26691,17 @@ windyplentiful.com winemeaslesnab.com worthyboxersympathy.com yummyadvertiseexploded.com +# https://github.com/AdguardTeam/AdguardFilters/issues/211351 +update-macosx.com +updates-macos.com +update-macos.com +unesmunbrebers.com +filinnetirt.com +freshsubz.com + + + + # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -32337,6 +32348,7 @@ animeplaynow.com playanimenow.com datedate.today go.dealslandz.com +awecrptjmp.com 172.240.41.32 172.240.41.64 diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 399856b16..ec3985cbc 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version) -# Version: 16July2025v2 +# Version: 17August2025v1 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Users of Pi-Hole FTL 5.22 and later, and of AdGuard Home, are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven. @@ -26640,6 +26640,17 @@ 127.0.0.1 winemeaslesnab.com 127.0.0.1 worthyboxersympathy.com 127.0.0.1 yummyadvertiseexploded.com +# https://github.com/AdguardTeam/AdguardFilters/issues/211351 +127.0.0.1 update-macosx.com +127.0.0.1 updates-macos.com +127.0.0.1 update-macos.com +127.0.0.1 unesmunbrebers.com +127.0.0.1 filinnetirt.com +127.0.0.1 freshsubz.com + + + + # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -32282,6 +32293,7 @@ 127.0.0.1 playanimenow.com 127.0.0.1 datedate.today 127.0.0.1 go.dealslandz.com +127.0.0.1 awecrptjmp.com 127.0.0.1 172.240.41.32 127.0.0.1 172.240.41.64 diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 521877f41..62766c914 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 16July2025v2-Deprecated +# Version: 17August2025v1-Deprecated # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -26314,6 +26314,16 @@ .winemeaslesnab.com .worthyboxersympathy.com .yummyadvertiseexploded.com +.update-macosx.com +.updates-macos.com +.update-macos.com +.unesmunbrebers.com +.filinnetirt.com +.freshsubz.com + +52.15.34.25 + + {+block} # ——— Standard malware that I stumbled upon on my own ——— @@ -31926,6 +31936,7 @@ .playanimenow.com .datedate.today .go.dealslandz.com +.awecrptjmp.com .172.240.41.32 .172.240.41.64 diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index e67900512..189d7a149 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 16July2025v2-Deprecated +# Version: 17August2025v1-Deprecated : expires = 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted. @@ -26688,6 +26688,17 @@ http://secured21.*.com/ -d winemeaslesnab.com -d worthyboxersympathy.com -d yummyadvertiseexploded.com +# https://github.com/AdguardTeam/AdguardFilters/issues/211351 +-d update-macosx.com +-d updates-macos.com +-d update-macos.com +-d unesmunbrebers.com +-d filinnetirt.com +-d freshsubz.com + + + + # ——— Standard malware that I stumbled upon on my own ——— # http://www•toorgle•net/results•php?q=fetishkitsch&security=666 @@ -32331,6 +32342,7 @@ ed.br ?q=artstation- -d playanimenow.com -d datedate.today -d go.dealslandz.com +-d awecrptjmp.com -d 172.240.41.32 -d 172.240.41.64 diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p index f00841ea0..bfcfbb06c 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs for P2P.p2p @@ -644,6 +644,11 @@ F:196.242.179.0-196.242.179.255 F:196.245.52.0-196.245.52.255 F:196.245.56.0-196.245.56.255 F:193.143.1.0-193.143.1.255 +F:164.132.74.156-164.132.74.156 +F:23.109.87.170-23.109.87.170 +F:37.1.213.100-37.1.213.100 +F:5.61.55.143-5.61.55.143 +F:91.241.60.117-91.241.60.117 F:142.91.159.0-142.91.159.255 F:213.32.115.0-213.32.115.255 F:217.182.11.0-217.182.11.255 @@ -735,8 +740,6 @@ F:34.102.137.201-34.102.137.201 F:35.227.234.222-35.227.234.222 F:35.232.188.118-35.232.188.118 F:37.1.209.213-37.1.209.213 -F:37.1.213.100-37.1.213.100 -F:5.61.55.143-5.61.55.143 F:51.77.227.100-51.77.227.100 F:51.77.227.101-51.77.227.101 F:51.77.227.102-51.77.227.102 @@ -804,9 +807,6 @@ F:51.195.115.102-51.195.115.102 F:51.89.115.13-51.89.115.13 F:35.224.227.218-35.224.227.218 F:35.238.205.163-35.238.205.163 -F:23.109.87.170-23.109.87.170 -F:164.132.74.156-164.132.74.156 -F:91.241.60.117-91.241.60.117 F:88.208.46.222-88.208.46.222 F:103.224.182.210-103.224.182.210 F:188.72.219.36-188.72.219.36 diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset index d4c0bf780..4e18063a4 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset @@ -644,6 +644,11 @@ 196.245.52.0/24 196.245.56.0/24 193.143.1.0/24 +164.132.74.156 +23.109.87.170 +37.1.213.100 +5.61.55.143 +91.241.60.117 142.91.159.0/24 213.32.115.0/24 217.182.11.0/24 @@ -735,8 +740,6 @@ 35.227.234.222 35.232.188.118 37.1.209.213 -37.1.213.100 -5.61.55.143 51.77.227.100 51.77.227.101 51.77.227.102 @@ -804,9 +807,6 @@ 51.89.115.13 35.224.227.218 35.238.205.163 -23.109.87.170 -164.132.74.156 -91.241.60.117 88.208.46.222 103.224.182.210 188.72.219.36