starred/adfilt
1
0
Fork 0
mirror of https://github.com/DandelionSprout/adfilt.git synced 2026-09-24 22:03:36 +01:00
Code Issues Packages Projects Releases 4 Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Imre Eilertsen
2024-10-07 01:07:17 +02:00
committed by GitHub
parent 93c69b7106
commit bfe3f0c88f
7 changed files with 176 additions and 324 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Alternate versions Anti-Malware List/AntiMalwareABP.txt
+29 -50
View File
@@ -1,6 +1,6 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox)
! Version: 05October2024v1
! Version: 06October2024v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -30,7 +30,7 @@
!!!||ooo^$domain=~toast.ooo
! (https://github.com/DandelionSprout/adfilt/issues/999)
!!!@@://oo*.ooo/
! https://bgp.he•net/AS202492#_prefixes (17/07/2022)
! https://bgp•he•net/AS202492#_prefixes (17/07/2022)
!!!||monster^$domain=~egybest.monster|~yts.monster|~cloudcdn.monster|~fedi.monster|~rollenspiel.monster|~tts.monster|~geometry.monster
! https://github.com/AdguardTeam/AdguardFilters/issues/131156
!!!||sbs^$domain=~ecopulse.sbs
@@ -373,27 +373,6 @@ msn.com##.irisbanner
||gamesgx.net^
coolrom.com.au,coolrom.com##.download_link
! ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
||afobal.cl^
||alvoportas.com.br^
||bright.su^
||domnicpeter.in.net^
||dzitech.net^
||fadzulani.com^
||hruner.com^
||interlogistics.com.vn^
||ivansaru.418.com1.ru^
||jangasm.org^
||ns511849.ip-192-99-19.net^
||ns513726.ip-192-99-148.net^
||servmill.com^
||ssl.sinergycosmetics.com^
||telefonfiyatlari.org^
||update.rifugiopontese.it^
||vodahelp.sytes.net^
||witkey.com^
! ——— Browser extension store entries for notoriously poor or malicious adblocker forks ———
! Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages
! Chrome Web Store
@@ -8600,7 +8579,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! https://www•huorong.cn/info/1598957552515.html
||dabaicai.com^
||dabaicai.com^$popup
! https://www•huorong.cn/info/1617368984641.html
! https://www•huorong•cn/info/1617368984641.html
||qqfzn.com^
||qqfzn.com^$popup
! https://github.com/uBlockOrigin/uAssets/pull/10017
@@ -8616,13 +8595,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||chess-progress.ru^
||ouhastay.net^
||ouhastay.net^$popup
! https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
||askara.super.site^
||askara.super.site^$popup
||cdn.discordapp.com/attachments/916361798763053136/917187511053320202/Askara.exe^
||cdn.discordapp.com/attachments/916361798763053136/917187511053320202/Askara.exe^$popup
||discord.com/invite/askara^
! https://scammer.info/t/fake-facebook-login-page/84939
! https://scammer•info/t/fake-facebook-login-page/84939
||royyer.us/R8cWuvQjhtM^
||royyer.us/R8cWuvQjhtM^$popup
! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908
@@ -8643,7 +8622,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||34.201.22.10^
||34.201.22.10^$popup
! https://scammer.info/t/crypto-scammers-onceagain/85354
! https://scammer•info/t/crypto-scammers-onceagain/85354
||business.google.com/website/billyandscapedesign^
||business.google.com/website/billyandscapedesign^$popup
! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community
@@ -8677,7 +8656,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! https://github.com/DevSpen/links/pull/3
||systemupdatecontrol.com^
||systemupdatecontrol.com^$popup
! https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
||mozicrack.com^
||mozicrack.com^$popup
||download-srvr.xyz^
@@ -8699,7 +8678,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||supersong.nl/upload/6277.rar^
||supersong.nl/upload/6277.rar^$popup
! https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
! https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
||freeprosoftz.com^
||freeprosoftz.com^$popup
||mediafire.com/file/pu0m2luacc3fh8h/file-password___2345.rar/file
@@ -8765,7 +8744,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||sites.google.com/mytv/maintenance^$popup
! https://github.com/AdguardTeam/AdguardFilters/issues/111970
/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$popup,domain=~malware-redirection-trains.*
! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
||pccrackworld.com^
||pccrackworld.com^$popup
||calsign.xyz^
@@ -8811,7 +8790,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||newsdeals.xyz^$popup
||dreamdigimedia.blogspot.com^
||dreamdigimedia.blogspot.com^$popup
! https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
! https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
||activatorwin.com^
||activatorwin.com^$popup
||freeversioncrack.com^ument
@@ -8820,7 +8799,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||198.199.120.251^
||198.199.120.251^$popup
! https://www•telia.no/kundeservice/mobil/malware-flubot-android/
! https://www•telia•no/kundeservice/mobil/malware-flubot-android/
!+ NOT_OPTIMIZED
/^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/
! A Discord conversation I had about Throneful
@@ -9565,7 +9544,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||95.211.26.202^
||95.211.26.202^$popup
! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
||bzsx.link^
||bzsx.link^$popup
||dfvd.link^
@@ -9595,10 +9574,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||165.227.168.212^
! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
://162.241.115.
! https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599
! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599
||k-yw.com^
||k-yw.com^$popup
! https://github.com/AdguardTeam/AdguardFilters/issues/125285
@@ -14113,7 +14092,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! https://github.com/AdguardTeam/AdguardFilters/issues/136390
||glthub.ument,popup
! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
||adblock-chrome.net^
||adblock-chrome.net^$popup
! https://github.com/AdguardTeam/AdguardFilters/issues/137635
@@ -18247,7 +18226,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||194.110.247.242^
||194.110.247.242^$popup
! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/
! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/
||ups-addressed.me^
||ups-addressed.me^$popup
||ups-quote.me^
@@ -18256,7 +18235,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||meta-whatsapp.me^$popup
||54.219.218.169^
! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/
! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/
||0365alert.com^
||0365alert.com^$popup
||0365online.com^
@@ -19118,7 +19097,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||64.132.201.92^
||64.132.201.92^$popup
! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
||acessmygov.online^
||acessmygov.online^$popup
||centerlinkmygov.com^
@@ -20561,7 +20540,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||54.204.83.105^$popup
! https://github.com/DandelionSprout/adfilt/issues/808
! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
! https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
||jonathanbartz.com^
||jonathanbartz.com^$popup
||jp.imonitorsoft.com^
@@ -21926,7 +21905,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||vuegebjexe.click^$popup
||xauhusjexe.click^
||xauhusjexe.click^$popup
! https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
! https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
||tzn03.me^
||tzn03.me^$popup
! https://github.com/AdguardTeam/AdguardFilters/issues/156573
@@ -33238,7 +33217,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
/(//|\.|^)github\.[a-z]{2,20}(/|$)/$~third-party,domain=github.*|~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev|~archive.*
||github.sale^
||github.sale^$popup
! https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
||0nedr1ved0cumentonline.com^
||0nedr1ved0cumentonline.com^$popup
||88godetailsvc.com^
@@ -33685,7 +33664,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||no-oppdatert.$popup,domain=~no
||179.43.189.62
||179.43.189.62$popup
! https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/
! https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/
||authde.us^
||authde.us^$popup
||dc-r.us^
@@ -45096,7 +45075,7 @@ toorgle.net##.join
! The Jerma985 Discord server
||crazycrabreedville.com^
||crazycrabreedville.com^$popup
! https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021)
! https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021)
||messium.info^
||messium.info^$popup
! Various Google searches
@@ -48266,7 +48245,7 @@ toorgle.net##.join
/^(https?://)?192\.243\.59\.\d{1,3}($|/)/
! rule34hentai.net when uBlock Filters and AdGuard Base are turned off
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
||eivbjsegbino.com^
||eivbjsegbino.com^$popup
||jpjmpqaupc.com^
@@ -49582,11 +49561,11 @@ toorgle.net##.join
||medicinehelp.news^
||147.135.16.27^
! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
||ingeniovirtual.com^
! Spambot posts on Tumblr (19/09/2022)
tumblr.com#?#div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://bit.ly/"])
! https://scambiofigu.forumcommunity•net/?t=57482915
! https://scambiofigu•forumcommunity•net/?t=57482915
||scambiofigu.net^
||scambiofigu.net^$popup
! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
@@ -49866,20 +49845,20 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||8ebtdbsjsu.click^$popup
||eicxz6jfjaw.click^
||eicxz6jfjaw.click^$popup
! https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2
! https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2
||ru-torproject.ru^
||ru-torproject.ru^$popup
||anapatformacion.org/modules/file/tor/tor-browser.zip^
||anapatformacion.org/modules/file/tor/tor-browser.zip^$popup
! https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required)
! https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required)
! https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
! https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
||123secure.org^
||123secure.org^$popup
! https://github.com/RPiList/specials/issues/948#issuecomment-1458739160
||yuppdownload.com^
||yuppdownload.com^$popup
! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
||34.80.59.191^
||34.80.59.191^$popup
Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt
+29 -50
View File
@@ -1,6 +1,6 @@
! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard)
! Version: 05October2024v1
! Version: 06October2024v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -29,7 +29,7 @@
!!!||ooo^$document,domain=~toast.ooo
! (https://github.com/DandelionSprout/adfilt/issues/999)
!!!@@://oo*.ooo/$document
! https://bgp.he•net/AS202492#_prefixes (17/07/2022)
! https://bgp•he•net/AS202492#_prefixes (17/07/2022)
!!!||monster^$document,domain=~egybest.monster|~yts.monster|~cloudcdn.monster|~fedi.monster|~rollenspiel.monster|~tts.monster|~geometry.monster
! https://github.com/AdguardTeam/AdguardFilters/issues/131156
!!!||sbs^$document,domain=~ecopulse.sbs
@@ -358,27 +358,6 @@ msn.com##.irisbanner
||gamesgx.net^$document
coolrom.com.au,coolrom.com##.download_link
! ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
||afobal.cl^$document
||alvoportas.com.br^$document
||bright.su^$document
||domnicpeter.in.net^$document
||dzitech.net^$document
||fadzulani.com^$document
||hruner.com^$document
||interlogistics.com.vn^$document
||ivansaru.418.com1.ru^$document
||jangasm.org^$document
||ns511849.ip-192-99-19.net^$document
||ns513726.ip-192-99-148.net^$document
||servmill.com^$document
||ssl.sinergycosmetics.com^$document
||telefonfiyatlari.org^$document
||update.rifugiopontese.it^$document
||vodahelp.sytes.net^$document
||witkey.com^$document
! ——— Browser extension store entries for notoriously poor or malicious adblocker forks ———
! Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages
! Chrome Web Store
@@ -5047,7 +5026,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||daque.cn^$all
! https://www•huorong.cn/info/1598957552515.html
||dabaicai.com^$all
! https://www•huorong.cn/info/1617368984641.html
! https://www•huorong•cn/info/1617368984641.html
||qqfzn.com^$all
! https://github.com/uBlockOrigin/uAssets/pull/10017
||flash.cn^$all
@@ -5060,11 +5039,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768
||chess-progress.ru^$document
||ouhastay.net^$all
! https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
||askara.super.site^$all
||cdn.discordapp.com/attachments/916361798763053136/917187511053320202/Askara.exe^$all
||discord.com/invite/askara^$document
! https://scammer.info/t/fake-facebook-login-page/84939
! https://scammer•info/t/fake-facebook-login-page/84939
||royyer.us/R8cWuvQjhtM^$all
! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908
! https://www•tek.no/i/lVeQAe/
@@ -5080,7 +5059,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||34.201.22.10^$all
!+ PLATFORM(windows, mac, android)
34.201.22.10$network
! https://scammer.info/t/crypto-scammers-onceagain/85354
! https://scammer•info/t/crypto-scammers-onceagain/85354
||business.google.com/website/billyandscapedesign^$all
! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community
||123.10.225.196^$all
@@ -5111,7 +5090,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||onemacusa.net^$all
! https://github.com/DevSpen/links/pull/3
||systemupdatecontrol.com^$all
! https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
||mozicrack.com^$all
||download-srvr.xyz^$all
||134.122.115.190^$all
@@ -5127,7 +5106,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||findes.co^$document
||supersong.nl/upload/6277.rar^$all
! https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
! https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
||freeprosoftz.com^$all
||mediafire.com/file/pu0m2luacc3fh8h/file-password___2345.rar/file$all
||mediafire.com/coe39m9f9tyg/pu0m2luacc3fh8h/file-password___2345%282%29.rar$all
@@ -5174,7 +5153,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||sites.google.com/mytv/maintenance^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/111970
/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$document,popup,domain=~malware-redirection-trains.*
! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
||pccrackworld.com^$all
||calsign.xyz^$all
||jwq98u.xyz^$all
@@ -5199,14 +5178,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||maanews.xyz^$all
||newsdeals.xyz^$all
||dreamdigimedia.blogspot.com^$all
! https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
! https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
||activatorwin.com^$all
||freeversioncrack.com^$document
||top3hostngc.xyz^$all
||198.199.120.251^$all
!+ PLATFORM(windows, mac, android)
198.199.120.251$network
! https://www•telia.no/kundeservice/mobil/malware-flubot-android/
! https://www•telia•no/kundeservice/mobil/malware-flubot-android/
!+ NOT_OPTIMIZED
/^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}\$/$document
! A Discord conversation I had about Throneful
@@ -5618,7 +5597,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||95.211.26.202^$all
!+ PLATFORM(windows, mac, android)
95.211.26.202$network
! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
||bzsx.link^$all
||dfvd.link^$all
||dsvs.link^$all
@@ -5638,10 +5617,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
!+ PLATFORM(windows, mac, android)
165.227.168.212$network
!#if !ext_ublock
! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
://162.241.115.$document
!#endif
! https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599
! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599
||k-yw.com^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/125285
||fearconic.com^$all
@@ -7950,7 +7929,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
139.45.197.239$network
! https://github.com/AdguardTeam/AdguardFilters/issues/136390
||glthub.$document,popup
! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
||adblock-chrome.net^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/137635
||aaolh.icu^$all
@@ -10061,14 +10040,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||194.110.247.242^$all
!+ PLATFORM(windows, mac, android)
194.110.247.242$network
! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/
! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/
||ups-addressed.me^$all
||ups-quote.me^$all
||meta-whatsapp.me^$all
||54.219.218.169^$document
!+ PLATFORM(windows, mac, android)
54.219.218.169$network
! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/
! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/
||0365alert.com^$all
||0365online.com^$all
||365-notifcation.com^$all
@@ -10501,7 +10480,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||64.132.201.92^$all
!+ PLATFORM(windows, mac, android)
64.132.201.92$network
! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
||acessmygov.online^$all
||centerlinkmygov.com^$all
||centierssl.us^$all
@@ -11242,7 +11221,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
!+ PLATFORM(windows, mac, android)
54.204.83.105$network
! https://github.com/DandelionSprout/adfilt/issues/808
! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
! https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
||jonathanbartz.com^$all
||jp.imonitorsoft.com^$all
||junk-bros.com^$all
@@ -11963,7 +11942,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||tiujejhexe.click^$all
||vuegebjexe.click^$all
||xauhusjexe.click^$all
! https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
! https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
||tzn03.me^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/156573
||707.su^$all
@@ -17648,7 +17627,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497)
/(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~third-party,domain=github.*|~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev|~archive.*
||github.sale^$all
! https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
||0nedr1ved0cumentonline.com^$all
||88godetailsvc.com^$all
||amexmobileupdate.cc^$all
@@ -17872,7 +17851,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"]
||no-oppdatere.$all
||no-oppdatert.$all,domain=~no
||179.43.189.62$all
! https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/
! https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/
||authde.us^$all
||dc-r.us^$all
||de-po.us^$all
@@ -23663,7 +23642,7 @@ toorgle.net##.join
||amoxycillin1st.com^$all
! The Jerma985 Discord server
||crazycrabreedville.com^$all
! https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021)
! https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021)
||messium.info^$all
! Various Google searches
://hullcitytigers.com^$document
@@ -25265,7 +25244,7 @@ toorgle.net##.join
!#if !ext_ublock
/^(https?://)?192\.243\.59\.\d{1,3}($|/)/$document
!#endif
! rule34hentai.net when uBlock Filters and AdGuard Base are turned off
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
||eivbjsegbino.com^$all
||jpjmpqaupc.com^$all
||qrclevrfjw.com^$all
@@ -25977,11 +25956,11 @@ toorgle.net##.join
||147.135.16.27^$document
!+ PLATFORM(windows, mac, android)
147.135.16.27$network
! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
||ingeniovirtual.com^$document
! Spambot posts on Tumblr (19/09/2022)
tumblr.com##div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://bit.ly/"])
! https://scambiofigu.forumcommunity•net/?t=57482915
! https://scambiofigu•forumcommunity•net/?t=57482915
||scambiofigu.net^$all
! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
apkfab.com##.tip-extension
@@ -26144,16 +26123,16 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||tvbxrr4ym3.click^$all
||8ebtdbsjsu.click^$all
||eicxz6jfjaw.click^$all
! https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2
! https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2
||ru-torproject.ru^$all
||anapatformacion.org/modules/file/tor/tor-browser.zip^$all
! https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required)
! https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required)
! https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
! https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
||123secure.org^$all
! https://github.com/RPiList/specials/issues/948#issuecomment-1458739160
||yuppdownload.com^$all
! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
||34.80.59.191^$all
!+ PLATFORM(windows, mac, android)
34.80.59.191$network
Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt
+29 -50
View File
@@ -1,6 +1,6 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22)
! Version: 05October2024v1
! Version: 06October2024v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -29,7 +29,7 @@
!!!||ooo^$denyallow=toast.ooo
! (https://github.com/DandelionSprout/adfilt/issues/999)
!!!@@://oo*.ooo/
! https://bgp.he•net/AS202492#_prefixes (17/07/2022)
! https://bgp•he•net/AS202492#_prefixes (17/07/2022)
!!!||monster^$denyallow=egybest.monster|yts.monster|cloudcdn.monster|fedi.monster|rollenspiel.monster|tts.monster|geometry.monster
! https://github.com/AdguardTeam/AdguardFilters/issues/131156
!!!||sbs^$denyallow=ecopulse.sbs
@@ -201,27 +201,6 @@
||roms-download.com^
||gamesgx.net^
! ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
||afobal.cl^
||alvoportas.com.br^
||bright.su^
||domnicpeter.in.net^
||dzitech.net^
||fadzulani.com^
||hruner.com^
||interlogistics.com.vn^
||ivansaru.418.com1.ru^
||jangasm.org^
||ns511849.ip-192-99-19.net^
||ns513726.ip-192-99-148.net^
||servmill.com^
||ssl.sinergycosmetics.com^
||telefonfiyatlari.org^
||update.rifugiopontese.it^
||vodahelp.sytes.net^
||witkey.com^
! ——— Browser extension store entries for notoriously poor or malicious adblocker forks ———
! Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages
! Chrome Web Store
@@ -4622,7 +4601,7 @@
||daque.cn^
! https://www•huorong.cn/info/1598957552515.html
||dabaicai.com^
! https://www•huorong.cn/info/1617368984641.html
! https://www•huorong•cn/info/1617368984641.html
||qqfzn.com^
! https://github.com/uBlockOrigin/uAssets/pull/10017
||flash.cn^
@@ -4634,11 +4613,11 @@
! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768
||chess-progress.ru^
||ouhastay.net^
! https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
||askara.super.site^
! https://scammer.info/t/fake-facebook-login-page/84939
! https://scammer•info/t/fake-facebook-login-page/84939
! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908
! https://www•tek.no/i/lVeQAe/
@@ -4652,7 +4631,7 @@
34.201.22.10
! https://scammer.info/t/crypto-scammers-onceagain/85354
! https://scammer•info/t/crypto-scammers-onceagain/85354
! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community
123.10.225.196
@@ -4675,7 +4654,7 @@
||onemacusa.net^
! https://github.com/DevSpen/links/pull/3
||systemupdatecontrol.com^
! https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
||mozicrack.com^
||download-srvr.xyz^
134.122.115.190
@@ -4690,7 +4669,7 @@
||findes.co^
! https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
! https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
||freeprosoftz.com^
@@ -4735,7 +4714,7 @@
! https://github.com/AdguardTeam/AdguardFilters/issues/111970
/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/
! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
||pccrackworld.com^
||calsign.xyz^
||jwq98u.xyz^
@@ -4760,13 +4739,13 @@
||maanews.xyz^
||newsdeals.xyz^
||dreamdigimedia.blogspot.com^
! https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
! https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
||activatorwin.com^
||freeversioncrack.com^$document
||top3hostngc.xyz^
198.199.120.251
! https://www•telia.no/kundeservice/mobil/malware-flubot-android/
! https://www•telia•no/kundeservice/mobil/malware-flubot-android/
!+ NOT_OPTIMIZED
/^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/
! A Discord conversation I had about Throneful
@@ -5168,7 +5147,7 @@
95.211.26.202
! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
||bzsx.link^
||dfvd.link^
||dsvs.link^
@@ -5186,10 +5165,10 @@
165.227.168.212
! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
://162.241.115.
! https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599
! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599
||k-yw.com^
! https://github.com/AdguardTeam/AdguardFilters/issues/125285
||fearconic.com^
@@ -7487,7 +7466,7 @@
! https://github.com/AdguardTeam/AdguardFilters/issues/136390
||glthub.$document,popup
! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
||adblock-chrome.net^
! https://github.com/AdguardTeam/AdguardFilters/issues/137635
||aaolh.icu^
@@ -9585,13 +9564,13 @@
194.110.247.242
! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/
! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/
||ups-addressed.me^
||ups-quote.me^
||meta-whatsapp.me^
54.219.218.169
! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/
! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/
||0365alert.com^
||0365online.com^
||365-notifcation.com^
@@ -10023,7 +10002,7 @@
||yourorderupdate.com^
64.132.201.92
! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
||acessmygov.online^
||centerlinkmygov.com^
||centierssl.us^
@@ -10756,7 +10735,7 @@
54.204.83.105
! https://github.com/DandelionSprout/adfilt/issues/808
! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
! https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
||jonathanbartz.com^
||jp.imonitorsoft.com^
||junk-bros.com^
@@ -11459,7 +11438,7 @@
||tiujejhexe.click^
||vuegebjexe.click^
||xauhusjexe.click^
! https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
! https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
||tzn03.me^
! https://github.com/AdguardTeam/AdguardFilters/issues/156573
||707.su^
@@ -17130,7 +17109,7 @@
! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497)
/(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~third-party,github.*|com|org|net|co|blog|community|host|io|microsoft|office|uk|us|xn--fiqs8s|dev|archive.*
||github.sale^
! https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
||0nedr1ved0cumentonline.com^
||88godetailsvc.com^
||amexmobileupdate.cc^
@@ -17354,7 +17333,7 @@
||no-oppdatere.
||no-oppdatert.
||179.43.189.62
! https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/
! https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/
||authde.us^
||dc-r.us^
||de-po.us^
@@ -23103,7 +23082,7 @@
||amoxycillin1st.com^
! The Jerma985 Discord server
||crazycrabreedville.com^
! https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021)
! https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021)
||messium.info^
! Various Google searches
://hullcitytigers.com^
@@ -24702,7 +24681,7 @@
/^(https?://)?192\.243\.59\.\d{1,3}($|/)/
! rule34hentai.net when uBlock Filters and AdGuard Base are turned off
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
||eivbjsegbino.com^
||jpjmpqaupc.com^
||qrclevrfjw.com^
@@ -25408,10 +25387,10 @@
||medicinehelp.news^
147.135.16.27
! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
||ingeniovirtual.com^
! Spambot posts on Tumblr (19/09/2022)
! https://scambiofigu.forumcommunity•net/?t=57482915
! https://scambiofigu•forumcommunity•net/?t=57482915
||scambiofigu.net^
! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022)
@@ -25563,16 +25542,16 @@
||tvbxrr4ym3.click^
||8ebtdbsjsu.click^
||eicxz6jfjaw.click^
! https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2
! https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2
||ru-torproject.ru^
! https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required)
! https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required)
! https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
! https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
||123secure.org^
! https://github.com/RPiList/specials/issues/948#issuecomment-1458739160
||yuppdownload.com^
! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
34.80.59.191
! Various domains on https://securitytrails•com/list/ip/72•14•178•174
Alternate versions Anti-Malware List/AntiMalwareDomains.txt
+29 -50
View File
@@ -1,5 +1,5 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version)
# Version: 05October2024v1
# Version: 06October2024v1
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway.
@@ -31,7 +31,7 @@
# (https://github.com/DandelionSprout/adfilt/issues/999)
# https://bgp.he•net/AS202492#_prefixes (17/07/2022)
# https://bgp•he•net/AS202492#_prefixes (17/07/2022)
# https://github.com/AdguardTeam/AdguardFilters/issues/131156
@@ -264,27 +264,6 @@ ps1games.online
roms-download.com
gamesgx.net
# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
afobal.cl
alvoportas.com.br
blogerjijer.pw
bright.su
domnicpeter.in.net
dzitech.net
fadzulani.com
hruner.com
interlogistics.com.vn
ivansaru.418.com1.ru
jangasm.org
ns511849.ip-192-99-19.net
ns513726.ip-192-99-148.net
servmill.com
ssl.sinergycosmetics.com
telefonfiyatlari.org
update.rifugiopontese.it
vodahelp.sytes.net
witkey.com
# ——— Browser extension store entries for notoriously poor or malicious adblocker forks ———
# Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages
# Chrome Web Store
@@ -4681,7 +4660,7 @@ xiaobaixitong.com
daque.cn
# https://www•huorong.cn/info/1598957552515.html
dabaicai.com
# https://www•huorong.cn/info/1617368984641.html
# https://www•huorong•cn/info/1617368984641.html
qqfzn.com
# https://github.com/uBlockOrigin/uAssets/pull/10017
flash.cn
@@ -4693,11 +4672,11 @@ dundeehills.group
# https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768
chess-progress.ru
ouhastay.net
# https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
# https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
askara.super.site
# https://scammer.info/t/fake-facebook-login-page/84939
# https://scammer•info/t/fake-facebook-login-page/84939
# https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908
# https://www•tek.no/i/lVeQAe/
@@ -4711,7 +4690,7 @@ haxpc.net
34.201.22.10
# https://scammer.info/t/crypto-scammers-onceagain/85354
# https://scammer•info/t/crypto-scammers-onceagain/85354
# https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community
123.10.225.196
@@ -4734,7 +4713,7 @@ haxpc.net
onemacusa.net
# https://github.com/DevSpen/links/pull/3
systemupdatecontrol.com
# https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
# https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
mozicrack.com
download-srvr.xyz
134.122.115.190
@@ -4749,7 +4728,7 @@ royaltees.co
findes.co
# https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
# https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
freeprosoftz.com
@@ -4794,7 +4773,7 @@ gluegames.xyz
# https://github.com/AdguardTeam/AdguardFilters/issues/111970
# https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
# https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
pccrackworld.com
calsign.xyz
jwq98u.xyz
@@ -4819,13 +4798,13 @@ hrmaclenews.xyz
maanews.xyz
newsdeals.xyz
dreamdigimedia.blogspot.com
# https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
# https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
activatorwin.com
freeversioncrack.com
top3hostngc.xyz
198.199.120.251
# https://www•telia.no/kundeservice/mobil/malware-flubot-android/
# https://www•telia•no/kundeservice/mobil/malware-flubot-android/
!+ NOT_OPTIMIZED
# A Discord conversation I had about Throneful
@@ -5222,7 +5201,7 @@ zuginmw.art
95.211.26.202
# https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
# https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
bzsx.link
dfvd.link
dsvs.link
@@ -5240,10 +5219,10 @@ wznp.link
165.227.168.212
# https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
# https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
# https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599
# https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599
k-yw.com
# https://github.com/AdguardTeam/AdguardFilters/issues/125285
fearconic.com
@@ -7541,7 +7520,7 @@ zoawufoy.net
# https://github.com/AdguardTeam/AdguardFilters/issues/136390
# https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
# https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
adblock-chrome.net
# https://github.com/AdguardTeam/AdguardFilters/issues/137635
aaolh.icu
@@ -9627,13 +9606,13 @@ winmacros.life
194.110.247.242
# https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/
# https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/
ups-addressed.me
ups-quote.me
meta-whatsapp.me
54.219.218.169
# https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/
# https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/
0365alert.com
0365online.com
365-notifcation.com
@@ -10065,7 +10044,7 @@ yourticketchance.com
yourorderupdate.com
64.132.201.92
# https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
# https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
acessmygov.online
centerlinkmygov.com
centierssl.us
@@ -10797,7 +10776,7 @@ wulfs-dcm.com
54.204.83.105
# https://github.com/DandelionSprout/adfilt/issues/808
# https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
# https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
jonathanbartz.com
jp.imonitorsoft.com
junk-bros.com
@@ -11497,7 +11476,7 @@ tebux.info
tiujejhexe.click
vuegebjexe.click
xauhusjexe.click
# https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
# https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
tzn03.me
# https://github.com/AdguardTeam/AdguardFilters/issues/156573
707.su
@@ -17168,7 +17147,7 @@ wmptengate.com
# (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497)
github.sale
# https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
# https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
0nedr1ved0cumentonline.com
88godetailsvc.com
amexmobileupdate.cc
@@ -17392,7 +17371,7 @@ z2i.tech
# https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/
# https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/
authde.us
dc-r.us
de-po.us
@@ -23141,7 +23120,7 @@ jueriy.com
amoxycillin1st.com
# The Jerma985 Discord server
crazycrabreedville.com
# https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021)
# https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021)
messium.info
# Various Google searches
hullcitytigers.com
@@ -24740,7 +24719,7 @@ zzdb5p4upiug.com
# rule34hentai.net when uBlock Filters and AdGuard Base are turned off
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
eivbjsegbino.com
jpjmpqaupc.com
qrclevrfjw.com
@@ -25441,10 +25420,10 @@ medicinecoupons.xyz
medicinehelp.news
147.135.16.27
# https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
# https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
ingeniovirtual.com
# Spambot posts on Tumblr (19/09/2022)
# https://scambiofigu.forumcommunity•net/?t=57482915
# https://scambiofigu•forumcommunity•net/?t=57482915
scambiofigu.net
# Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
# Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022)
@@ -25597,16 +25576,16 @@ lrhxz60alkjtik.click
tvbxrr4ym3.click
8ebtdbsjsu.click
eicxz6jfjaw.click
# https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2
# https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2
ru-torproject.ru
# https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required)
# https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required)
# https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
# https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
123secure.org
# https://github.com/RPiList/specials/issues/948#issuecomment-1458739160
yuppdownload.com
# Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
# Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
34.80.59.191
# Various domains on https://securitytrails•com/list/ip/72•14•178•174
Alternate versions Anti-Malware List/AntiMalwareHosts.txt
+29 -50
View File
@@ -1,5 +1,5 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version)
# Version: 05October2024v1
# Version: 06October2024v1
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Users of Pi-Hole FTL 5.22 and later, and of AdGuard Home, are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven.
@@ -31,7 +31,7 @@
# (https://github.com/DandelionSprout/adfilt/issues/999)
# https://bgp.he•net/AS202492#_prefixes (17/07/2022)
# https://bgp•he•net/AS202492#_prefixes (17/07/2022)
# https://github.com/AdguardTeam/AdguardFilters/issues/131156
@@ -227,27 +227,6 @@
127.0.0.1 roms-download.com
127.0.0.1 gamesgx.net
# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
127.0.0.1 afobal.cl
127.0.0.1 alvoportas.com.br
127.0.0.1 blogerjijer.pw
127.0.0.1 bright.su
127.0.0.1 domnicpeter.in.net
127.0.0.1 dzitech.net
127.0.0.1 fadzulani.com
127.0.0.1 hruner.com
127.0.0.1 interlogistics.com.vn
127.0.0.1 ivansaru.418.com1.ru
127.0.0.1 jangasm.org
127.0.0.1 ns511849.ip-192-99-19.net
127.0.0.1 ns513726.ip-192-99-148.net
127.0.0.1 servmill.com
127.0.0.1 ssl.sinergycosmetics.com
127.0.0.1 telefonfiyatlari.org
127.0.0.1 update.rifugiopontese.it
127.0.0.1 vodahelp.sytes.net
127.0.0.1 witkey.com
# ——— Browser extension store entries for notoriously poor or malicious adblocker forks ———
# Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages
# Chrome Web Store
@@ -4630,7 +4609,7 @@
127.0.0.1 daque.cn
# https://www•huorong.cn/info/1598957552515.html
127.0.0.1 dabaicai.com
# https://www•huorong.cn/info/1617368984641.html
# https://www•huorong•cn/info/1617368984641.html
127.0.0.1 qqfzn.com
# https://github.com/uBlockOrigin/uAssets/pull/10017
127.0.0.1 flash.cn
@@ -4642,11 +4621,11 @@
# https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768
127.0.0.1 chess-progress.ru
127.0.0.1 ouhastay.net
# https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
# https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
127.0.0.1 askara.super.site
# https://scammer.info/t/fake-facebook-login-page/84939
# https://scammer•info/t/fake-facebook-login-page/84939
# https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908
# https://www•tek.no/i/lVeQAe/
@@ -4660,7 +4639,7 @@
127.0.0.1 34.201.22.10
# https://scammer.info/t/crypto-scammers-onceagain/85354
# https://scammer•info/t/crypto-scammers-onceagain/85354
# https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community
127.0.0.1 123.10.225.196
@@ -4683,7 +4662,7 @@
127.0.0.1 onemacusa.net
# https://github.com/DevSpen/links/pull/3
127.0.0.1 systemupdatecontrol.com
# https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
# https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
127.0.0.1 mozicrack.com
127.0.0.1 download-srvr.xyz
127.0.0.1 134.122.115.190
@@ -4698,7 +4677,7 @@
127.0.0.1 findes.co
# https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
# https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
127.0.0.1 freeprosoftz.com
@@ -4743,7 +4722,7 @@
# https://github.com/AdguardTeam/AdguardFilters/issues/111970
# https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
# https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
127.0.0.1 pccrackworld.com
127.0.0.1 calsign.xyz
127.0.0.1 jwq98u.xyz
@@ -4768,13 +4747,13 @@
127.0.0.1 maanews.xyz
127.0.0.1 newsdeals.xyz
127.0.0.1 dreamdigimedia.blogspot.com
# https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
# https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
127.0.0.1 activatorwin.com
127.0.0.1 freeversioncrack.com
127.0.0.1 top3hostngc.xyz
127.0.0.1 198.199.120.251
# https://www•telia.no/kundeservice/mobil/malware-flubot-android/
# https://www•telia•no/kundeservice/mobil/malware-flubot-android/
!+ NOT_OPTIMIZED
# A Discord conversation I had about Throneful
@@ -5171,7 +5150,7 @@
127.0.0.1 95.211.26.202
# https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
# https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
127.0.0.1 bzsx.link
127.0.0.1 dfvd.link
127.0.0.1 dsvs.link
@@ -5189,10 +5168,10 @@
127.0.0.1 165.227.168.212
# https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
# https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
# https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599
# https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599
127.0.0.1 k-yw.com
# https://github.com/AdguardTeam/AdguardFilters/issues/125285
127.0.0.1 fearconic.com
@@ -7490,7 +7469,7 @@
# https://github.com/AdguardTeam/AdguardFilters/issues/136390
# https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
# https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
127.0.0.1 adblock-chrome.net
# https://github.com/AdguardTeam/AdguardFilters/issues/137635
127.0.0.1 aaolh.icu
@@ -9576,13 +9555,13 @@
127.0.0.1 194.110.247.242
# https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/
# https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/
127.0.0.1 ups-addressed.me
127.0.0.1 ups-quote.me
127.0.0.1 meta-whatsapp.me
127.0.0.1 54.219.218.169
# https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/
# https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/
127.0.0.1 0365alert.com
127.0.0.1 0365online.com
127.0.0.1 365-notifcation.com
@@ -10014,7 +9993,7 @@
127.0.0.1 yourorderupdate.com
127.0.0.1 64.132.201.92
# https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
# https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
127.0.0.1 acessmygov.online
127.0.0.1 centerlinkmygov.com
127.0.0.1 centierssl.us
@@ -10746,7 +10725,7 @@
127.0.0.1 54.204.83.105
# https://github.com/DandelionSprout/adfilt/issues/808
# https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
# https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023)
127.0.0.1 jonathanbartz.com
127.0.0.1 jp.imonitorsoft.com
127.0.0.1 junk-bros.com
@@ -11446,7 +11425,7 @@
127.0.0.1 tiujejhexe.click
127.0.0.1 vuegebjexe.click
127.0.0.1 xauhusjexe.click
# https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
# https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
127.0.0.1 tzn03.me
# https://github.com/AdguardTeam/AdguardFilters/issues/156573
127.0.0.1 707.su
@@ -17117,7 +17096,7 @@
# (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497)
127.0.0.1 github.sale
# https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
# https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
127.0.0.1 0nedr1ved0cumentonline.com
127.0.0.1 88godetailsvc.com
127.0.0.1 amexmobileupdate.cc
@@ -17341,7 +17320,7 @@
# https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/
# https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/
127.0.0.1 authde.us
127.0.0.1 dc-r.us
127.0.0.1 de-po.us
@@ -23090,7 +23069,7 @@
127.0.0.1 amoxycillin1st.com
# The Jerma985 Discord server
127.0.0.1 crazycrabreedville.com
# https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021)
# https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021)
127.0.0.1 messium.info
# Various Google searches
127.0.0.1 hullcitytigers.com
@@ -24689,7 +24668,7 @@
# rule34hentai.net when uBlock Filters and AdGuard Base are turned off
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
127.0.0.1 eivbjsegbino.com
127.0.0.1 jpjmpqaupc.com
127.0.0.1 qrclevrfjw.com
@@ -25390,10 +25369,10 @@
127.0.0.1 medicinehelp.news
127.0.0.1 147.135.16.27
# https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
# https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
127.0.0.1 ingeniovirtual.com
# Spambot posts on Tumblr (19/09/2022)
# https://scambiofigu.forumcommunity•net/?t=57482915
# https://scambiofigu•forumcommunity•net/?t=57482915
127.0.0.1 scambiofigu.net
# Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
# Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022)
@@ -25545,16 +25524,16 @@
127.0.0.1 tvbxrr4ym3.click
127.0.0.1 8ebtdbsjsu.click
127.0.0.1 eicxz6jfjaw.click
# https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2
# https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2
127.0.0.1 ru-torproject.ru
# https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required)
# https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required)
# https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
# https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
127.0.0.1 123secure.org
# https://github.com/RPiList/specials/issues/948#issuecomment-1458739160
127.0.0.1 yuppdownload.com
# Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
# Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
127.0.0.1 34.80.59.191
# Various domains on https://securitytrails•com/list/ip/72•14•178•174
Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action
+2 -24
View File
@@ -1,6 +1,6 @@
{+block}
# Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy)
# Version: 05October2024v1-Deprecated
# Version: 06October2024v1-Deprecated
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
@@ -173,28 +173,6 @@
.roms-download.com
.gamesgx.net
{+block}
# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
.afobal.cl
.alvoportas.com.br
.blogerjijer.pw
.bright.su
.domnicpeter.in.net
.dzitech.net
.fadzulani.com
.hruner.com
.interlogistics.com.vn
.ivansaru.418.com1.ru
.jangasm.org
.ns511849.ip-192-99-19.net
.ns513726.ip-192-99-148.net
.servmill.com
.ssl.sinergycosmetics.com
.telefonfiyatlari.org
.update.rifugiopontese.it
.vodahelp.sytes.net
.witkey.com
{+block}
# ——— Browser extension store entries for notoriously poor or malicious adblocker forks ———
# Chrome Web Store
@@ -24336,7 +24314,7 @@
# rule34hentai.net when uBlock Filters and AdGuard Base are turned off
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
.eivbjsegbino.com
.jpjmpqaupc.com
.qrclevrfjw.com
Alternate versions Anti-Malware List/AntiMalwareTPL.tpl
+29 -50
View File
@@ -1,6 +1,6 @@
msFilterList
# Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL)
# Version: 05October2024v1-Deprecated
# Version: 06October2024v1-Deprecated
: expires = 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -112,7 +112,7 @@ msFilterList
!!!||ooo
# (https://github.com/DandelionSprout/adfilt/issues/999)
!!!@@://oo*.ooo/
# https://bgp.he•net/AS202492#_prefixes/(17/07/2022)
# https://bgp•he•net/AS202492#_prefixes/(17/07/2022)
!!!||monster$doc,domain=
+d egybest.monster
+d yts.monster
@@ -308,27 +308,6 @@ msFilterList
-d roms-download.com
-d gamesgx.net
# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ———
-d afobal.cl
-d alvoportas.com.br
-d blogerjijer.pw
-d bright.su
-d domnicpeter.in.net
-d dzitech.net
-d fadzulani.com
-d hruner.com
-d interlogistics.com.vn
-d ivansaru.418.com1.ru
-d jangasm.org
-d ns511849.ip-192-99-19.net
-d ns513726.ip-192-99-148.net
-d servmill.com
-d ssl.sinergycosmetics.com
-d telefonfiyatlari.org
-d update.rifugiopontese.it
-d vodahelp.sytes.net
-d witkey.com
# ——— Browser extension store entries for notoriously poor or malicious adblocker forks ———
# Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages
# Chrome Web Store
@@ -4716,7 +4695,7 @@ msFilterList
-d daque.cn
# https://www•huorong.cn/info/1598957552515.html
-d dabaicai.com
# https://www•huorong.cn/info/1617368984641.html
# https://www•huorong•cn/info/1617368984641.html
-d qqfzn.com
# https://github.com/uBlockOrigin/uAssets/pull/10017
-d flash.cn
@@ -4728,11 +4707,11 @@ msFilterList
# https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768
-d chess-progress.ru
-d ouhastay.net
# https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
# https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908
-d askara.super.site
-d cdn.discordapp.com attachments 916361798763053136 917187511053320202 Askara.exe
-d discord.com invite askara
# https://scammer.info/t/fake-facebook-login-page/84939
# https://scammer•info/t/fake-facebook-login-page/84939
-d royyer.us R8cWuvQjhtM
# https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908
# https://www•tek.no/i/lVeQAe/
@@ -4746,7 +4725,7 @@ msFilterList
-d 34.201.22.10
# https://scammer.info/t/crypto-scammers-onceagain/85354
# https://scammer•info/t/crypto-scammers-onceagain/85354
-d business.google.com website billyandscapedesign
# https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community
-d 123.10.225.196
@@ -4769,7 +4748,7 @@ msFilterList
-d onemacusa.net
# https://github.com/DevSpen/links/pull/3
-d systemupdatecontrol.com
# https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
# https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
-d mozicrack.com
-d download-srvr.xyz
-d 134.122.115.190
@@ -4784,7 +4763,7 @@ msFilterList
-d findes.co
-d supersong.nl upload 6277.rar
# https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
# https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/
-d freeprosoftz.com
-d mediafire.com file pu0m2luacc3fh8h file-password___2345.rar file
-d mediafire.com coe39m9f9tyg pu0m2luacc3fh8h file-password___2345%282%29.rar
@@ -4829,7 +4808,7 @@ msFilterList
-d sites.google.com mytv maintenance
# https://github.com/AdguardTeam/AdguardFilters/issues/111970
# https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
# https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
-d pccrackworld.com
-d calsign.xyz
-d jwq98u.xyz
@@ -4854,13 +4833,13 @@ msFilterList
-d maanews.xyz
-d newsdeals.xyz
-d dreamdigimedia.blogspot.com
# https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
# https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
-d activatorwin.com
-d freeversioncrack.com
-d top3hostngc.xyz
-d 198.199.120.251
# https://www•telia.no/kundeservice/mobil/malware-flubot-android/
# https://www•telia•no/kundeservice/mobil/malware-flubot-android/
# A Discord conversation I had about Throneful
@@ -5253,7 +5232,7 @@ msFilterList
-d 95.211.26.202
# https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
# https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583
-d bzsx.link
-d dfvd.link
-d dsvs.link
@@ -5271,9 +5250,9 @@ msFilterList
-d 165.227.168.212
# https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
# https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/
# https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599
# https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599
-d k-yw.com
# https://github.com/AdguardTeam/AdguardFilters/issues/125285
-d fearconic.com
@@ -7571,7 +7550,7 @@ msFilterList
# https://github.com/AdguardTeam/AdguardFilters/issues/136390
-d glthub.
# https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
# https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
-d adblock-chrome.net
# https://github.com/AdguardTeam/AdguardFilters/issues/137635
-d aaolh.icu
@@ -9653,13 +9632,13 @@ msFilterList
-d 194.110.247.242
# https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/
# https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/
-d ups-addressed.me
-d ups-quote.me
-d meta-whatsapp.me
-d 54.219.218.169
# https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/
# https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/
-d 0365alert.com
-d 0365online.com
-d 365-notifcation.com
@@ -10091,7 +10070,7 @@ msFilterList
-d yourorderupdate.com
-d 64.132.201.92
# https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
# https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener
-d acessmygov.online
-d centerlinkmygov.com
-d centierssl.us
@@ -10822,7 +10801,7 @@ msFilterList
-d 54.204.83.105
# https://github.com/DandelionSprout/adfilt/issues/808
# https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations/(26/01/2023)
# https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations/(26/01/2023)
-d jonathanbartz.com
-d jp.imonitorsoft.com
-d junk-bros.com
@@ -11523,7 +11502,7 @@ msFilterList
-d tiujejhexe.click
-d vuegebjexe.click
-d xauhusjexe.click
# https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
# https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/
-d tzn03.me
# https://github.com/AdguardTeam/AdguardFilters/issues/156573
-d 707.su
@@ -17209,7 +17188,7 @@ msFilterList
+d dev
+d archive.*
-d github.sale
# https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
# https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/
-d 0nedr1ved0cumentonline.com
-d 88godetailsvc.com
-d amexmobileupdate.cc
@@ -17433,7 +17412,7 @@ msFilterList
-d no-oppdatere.
-d no-oppdatert.
-d 179.43.189.62
# https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/
# https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/
-d authde.us
-d dc-r.us
-d de-po.us
@@ -23173,7 +23152,7 @@ vito.www.booking.
-d amoxycillin1st.com
# The Jerma985 Discord server
-d crazycrabreedville.com
# https://flclever.weebly•com/pixie-hollow-mini-games•html/(06/05/2021)
# https://flclever•weebly•com/pixie-hollow-mini-games•html/(06/05/2021)
-d messium.info
# Various Google searches
# Various search results for 'kelloggs tresor' in Norwegian (30 05 2021)
@@ -24773,7 +24752,7 @@ dvancedhosters.com$doc,domain=
# rule34hentai.net when uBlock Filters and AdGuard Base are turned off
# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
-d eivbjsegbino.com
-d jpjmpqaupc.com
-d qrclevrfjw.com
@@ -25466,10 +25445,10 @@ dvancedhosters.com$doc,domain=
-d medicinehelp.news
-d 147.135.16.27
# https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
# https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img
-d ingeniovirtual.com
# Spambot posts on Tumblr (19 09 2022)
# https://scambiofigu.forumcommunity•net/?t=57482915
# https://scambiofigu•forumcommunity•net/?t=57482915
-d scambiofigu.net
# Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
# Google results for 'Katy and Bob: Cake Café powerpc' (04 11 2022)
@@ -25621,16 +25600,16 @@ dvancedhosters.com$doc,domain=
-d tvbxrr4ym3.click
-d 8ebtdbsjsu.click
-d eicxz6jfjaw.click
# https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448/and/https://tria.ge/230217-xd8nksgc9x/behavioral2
# https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448/and/https://tria•ge/230217-xd8nksgc9x/behavioral2
-d ru-torproject.ru
-d anapatformacion.org modules file tor tor-browser.zip
# https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required)
# https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required)
# https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
# https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2
-d 123secure.org
# https://github.com/RPiList/specials/issues/948#issuecomment-1458739160
-d yuppdownload.com
# Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
# Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
-d 34.80.59.191
# Various domains on https://securitytrails•com/list/ip/72•14•178•174