From bfe3f0c88fa8d51826da7a68e7e5da0ecb47321f Mon Sep 17 00:00:00 2001 From: Imre Eilertsen Date: Mon, 7 Oct 2024 01:07:17 +0200 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 79 +++++++------------ .../AntiMalwareAdGuard.txt | 79 +++++++------------ .../AntiMalwareAdGuardHome.txt | 79 +++++++------------ .../AntiMalwareDomains.txt | 79 +++++++------------ .../AntiMalwareHosts.txt | 79 +++++++------------ .../AntiMalwarePrivoxy.action | 26 +----- .../AntiMalwareTPL.tpl | 79 +++++++------------ 7 files changed, 176 insertions(+), 324 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index cc482dd30..d5885470f 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox) -! Version: 05October2024v1 +! Version: 06October2024v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -30,7 +30,7 @@ !!!||ooo^$domain=~toast.ooo ! (https://github.com/DandelionSprout/adfilt/issues/999) !!!@@://oo*.ooo/ -! https://bgp.he•net/AS202492#_prefixes (17/07/2022) +! https://bgp•he•net/AS202492#_prefixes (17/07/2022) !!!||monster^$domain=~egybest.monster|~yts.monster|~cloudcdn.monster|~fedi.monster|~rollenspiel.monster|~tts.monster|~geometry.monster ! https://github.com/AdguardTeam/AdguardFilters/issues/131156 !!!||sbs^$domain=~ecopulse.sbs @@ -373,27 +373,6 @@ msn.com##.irisbanner ||gamesgx.net^ coolrom.com.au,coolrom.com##.download_link -! ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ——— -||afobal.cl^ -||alvoportas.com.br^ - -||bright.su^ -||domnicpeter.in.net^ -||dzitech.net^ -||fadzulani.com^ -||hruner.com^ -||interlogistics.com.vn^ -||ivansaru.418.com1.ru^ -||jangasm.org^ -||ns511849.ip-192-99-19.net^ -||ns513726.ip-192-99-148.net^ -||servmill.com^ -||ssl.sinergycosmetics.com^ -||telefonfiyatlari.org^ -||update.rifugiopontese.it^ -||vodahelp.sytes.net^ -||witkey.com^ - ! ——— Browser extension store entries for notoriously poor or malicious adblocker forks ——— ! Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages ! Chrome Web Store @@ -8600,7 +8579,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://www•huorong.cn/info/1598957552515.html ||dabaicai.com^ ||dabaicai.com^$popup -! https://www•huorong.cn/info/1617368984641.html +! https://www•huorong•cn/info/1617368984641.html ||qqfzn.com^ ||qqfzn.com^$popup ! https://github.com/uBlockOrigin/uAssets/pull/10017 @@ -8616,13 +8595,13 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||chess-progress.ru^ ||ouhastay.net^ ||ouhastay.net^$popup -! https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 +! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 ||askara.super.site^ ||askara.super.site^$popup ||cdn.discordapp.com/attachments/916361798763053136/917187511053320202/Askara.exe^ ||cdn.discordapp.com/attachments/916361798763053136/917187511053320202/Askara.exe^$popup ||discord.com/invite/askara^ -! https://scammer.info/t/fake-facebook-login-page/84939 +! https://scammer•info/t/fake-facebook-login-page/84939 ||royyer.us/R8cWuvQjhtM^ ||royyer.us/R8cWuvQjhtM^$popup ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908 @@ -8643,7 +8622,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||34.201.22.10^ ||34.201.22.10^$popup -! https://scammer.info/t/crypto-scammers-onceagain/85354 +! https://scammer•info/t/crypto-scammers-onceagain/85354 ||business.google.com/website/billyandscapedesign^ ||business.google.com/website/billyandscapedesign^$popup ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community @@ -8677,7 +8656,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DevSpen/links/pull/3 ||systemupdatecontrol.com^ ||systemupdatecontrol.com^$popup -! https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ +! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ ||mozicrack.com^ ||mozicrack.com^$popup ||download-srvr.xyz^ @@ -8699,7 +8678,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||supersong.nl/upload/6277.rar^ ||supersong.nl/upload/6277.rar^$popup -! https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ +! https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ ||freeprosoftz.com^ ||freeprosoftz.com^$popup ||mediafire.com/file/pu0m2luacc3fh8h/file-password___2345.rar/file @@ -8765,7 +8744,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sites.google.com/mytv/maintenance^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 /(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$popup,domain=~malware-redirection-trains.* -! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# +! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^ ||pccrackworld.com^$popup ||calsign.xyz^ @@ -8811,7 +8790,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||newsdeals.xyz^$popup ||dreamdigimedia.blogspot.com^ ||dreamdigimedia.blogspot.com^$popup -! https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ +! https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ ||activatorwin.com^ ||activatorwin.com^$popup ||freeversioncrack.com^ument @@ -8820,7 +8799,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||198.199.120.251^ ||198.199.120.251^$popup -! https://www•telia.no/kundeservice/mobil/malware-flubot-android/ +! https://www•telia•no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/ ! A Discord conversation I had about Throneful @@ -9565,7 +9544,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||95.211.26.202^ ||95.211.26.202^$popup -! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 +! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 ||bzsx.link^ ||bzsx.link^$popup ||dfvd.link^ @@ -9595,10 +9574,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||165.227.168.212^ -! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ +! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ ://162.241.115. -! https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599 +! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 ||k-yw.com^ ||k-yw.com^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/125285 @@ -14113,7 +14092,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub.ument,popup -! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 +! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 ||adblock-chrome.net^ ||adblock-chrome.net^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/137635 @@ -18247,7 +18226,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||194.110.247.242^ ||194.110.247.242^$popup -! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ +! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ ||ups-addressed.me^ ||ups-addressed.me^$popup ||ups-quote.me^ @@ -18256,7 +18235,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||meta-whatsapp.me^$popup ||54.219.218.169^ -! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ +! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^ ||0365alert.com^$popup ||0365online.com^ @@ -19118,7 +19097,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||64.132.201.92^ ||64.132.201.92^$popup -! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener +! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||acessmygov.online^ ||acessmygov.online^$popup ||centerlinkmygov.com^ @@ -20561,7 +20540,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||54.204.83.105^$popup ! https://github.com/DandelionSprout/adfilt/issues/808 -! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) +! https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) ||jonathanbartz.com^ ||jonathanbartz.com^$popup ||jp.imonitorsoft.com^ @@ -21926,7 +21905,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||vuegebjexe.click^$popup ||xauhusjexe.click^ ||xauhusjexe.click^$popup -! https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ +! https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ ||tzn03.me^ ||tzn03.me^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/156573 @@ -33238,7 +33217,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] /(//|\.|^)github\.[a-z]{2,20}(/|$)/$~third-party,domain=github.*|~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev|~archive.* ||github.sale^ ||github.sale^$popup -! https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ +! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ ||0nedr1ved0cumentonline.com^ ||0nedr1ved0cumentonline.com^$popup ||88godetailsvc.com^ @@ -33685,7 +33664,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||no-oppdatert.$popup,domain=~no ||179.43.189.62 ||179.43.189.62$popup -! https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/ +! https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/ ||authde.us^ ||authde.us^$popup ||dc-r.us^ @@ -45096,7 +45075,7 @@ toorgle.net##.join ! The Jerma985 Discord server ||crazycrabreedville.com^ ||crazycrabreedville.com^$popup -! https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021) +! https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021) ||messium.info^ ||messium.info^$popup ! Various Google searches @@ -48266,7 +48245,7 @@ toorgle.net##.join /^(https?://)?192\.243\.59\.\d{1,3}($|/)/ -! rule34hentai.net when uBlock Filters and AdGuard Base are turned off +! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^ ||eivbjsegbino.com^$popup ||jpjmpqaupc.com^ @@ -49582,11 +49561,11 @@ toorgle.net##.join ||medicinehelp.news^ ||147.135.16.27^ -! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img +! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^ ! Spambot posts on Tumblr (19/09/2022) tumblr.com#?#div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://bit.ly/"]) -! https://scambiofigu.forumcommunity•net/?t=57482915 +! https://scambiofigu•forumcommunity•net/?t=57482915 ||scambiofigu.net^ ||scambiofigu.net^$popup ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious @@ -49866,20 +49845,20 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||8ebtdbsjsu.click^$popup ||eicxz6jfjaw.click^ ||eicxz6jfjaw.click^$popup -! https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2 +! https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2 ||ru-torproject.ru^ ||ru-torproject.ru^$popup ||anapatformacion.org/modules/file/tor/tor-browser.zip^ ||anapatformacion.org/modules/file/tor/tor-browser.zip^$popup ! https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required) ! https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required) -! https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 +! https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 ||123secure.org^ ||123secure.org^$popup ! https://github.com/RPiList/specials/issues/948#issuecomment-1458739160 ||yuppdownload.com^ ||yuppdownload.com^$popup -! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) +! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) ||34.80.59.191^ ||34.80.59.191^$popup diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 29e290a0d..cd8fee717 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 05October2024v1 +! Version: 06October2024v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -29,7 +29,7 @@ !!!||ooo^$document,domain=~toast.ooo ! (https://github.com/DandelionSprout/adfilt/issues/999) !!!@@://oo*.ooo/$document -! https://bgp.he•net/AS202492#_prefixes (17/07/2022) +! https://bgp•he•net/AS202492#_prefixes (17/07/2022) !!!||monster^$document,domain=~egybest.monster|~yts.monster|~cloudcdn.monster|~fedi.monster|~rollenspiel.monster|~tts.monster|~geometry.monster ! https://github.com/AdguardTeam/AdguardFilters/issues/131156 !!!||sbs^$document,domain=~ecopulse.sbs @@ -358,27 +358,6 @@ msn.com##.irisbanner ||gamesgx.net^$document coolrom.com.au,coolrom.com##.download_link -! ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ——— -||afobal.cl^$document -||alvoportas.com.br^$document - -||bright.su^$document -||domnicpeter.in.net^$document -||dzitech.net^$document -||fadzulani.com^$document -||hruner.com^$document -||interlogistics.com.vn^$document -||ivansaru.418.com1.ru^$document -||jangasm.org^$document -||ns511849.ip-192-99-19.net^$document -||ns513726.ip-192-99-148.net^$document -||servmill.com^$document -||ssl.sinergycosmetics.com^$document -||telefonfiyatlari.org^$document -||update.rifugiopontese.it^$document -||vodahelp.sytes.net^$document -||witkey.com^$document - ! ——— Browser extension store entries for notoriously poor or malicious adblocker forks ——— ! Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages ! Chrome Web Store @@ -5047,7 +5026,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||daque.cn^$all ! https://www•huorong.cn/info/1598957552515.html ||dabaicai.com^$all -! https://www•huorong.cn/info/1617368984641.html +! https://www•huorong•cn/info/1617368984641.html ||qqfzn.com^$all ! https://github.com/uBlockOrigin/uAssets/pull/10017 ||flash.cn^$all @@ -5060,11 +5039,11 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 ||chess-progress.ru^$document ||ouhastay.net^$all -! https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 +! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 ||askara.super.site^$all ||cdn.discordapp.com/attachments/916361798763053136/917187511053320202/Askara.exe^$all ||discord.com/invite/askara^$document -! https://scammer.info/t/fake-facebook-login-page/84939 +! https://scammer•info/t/fake-facebook-login-page/84939 ||royyer.us/R8cWuvQjhtM^$all ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908 ! https://www•tek.no/i/lVeQAe/ @@ -5080,7 +5059,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||34.201.22.10^$all !+ PLATFORM(windows, mac, android) 34.201.22.10$network -! https://scammer.info/t/crypto-scammers-onceagain/85354 +! https://scammer•info/t/crypto-scammers-onceagain/85354 ||business.google.com/website/billyandscapedesign^$all ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community ||123.10.225.196^$all @@ -5111,7 +5090,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||onemacusa.net^$all ! https://github.com/DevSpen/links/pull/3 ||systemupdatecontrol.com^$all -! https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ +! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ ||mozicrack.com^$all ||download-srvr.xyz^$all ||134.122.115.190^$all @@ -5127,7 +5106,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||findes.co^$document ||supersong.nl/upload/6277.rar^$all -! https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ +! https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ ||freeprosoftz.com^$all ||mediafire.com/file/pu0m2luacc3fh8h/file-password___2345.rar/file$all ||mediafire.com/coe39m9f9tyg/pu0m2luacc3fh8h/file-password___2345%282%29.rar$all @@ -5174,7 +5153,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||sites.google.com/mytv/maintenance^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 /(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$document,popup,domain=~malware-redirection-trains.* -! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# +! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^$all ||calsign.xyz^$all ||jwq98u.xyz^$all @@ -5199,14 +5178,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||maanews.xyz^$all ||newsdeals.xyz^$all ||dreamdigimedia.blogspot.com^$all -! https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ +! https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ ||activatorwin.com^$all ||freeversioncrack.com^$document ||top3hostngc.xyz^$all ||198.199.120.251^$all !+ PLATFORM(windows, mac, android) 198.199.120.251$network -! https://www•telia.no/kundeservice/mobil/malware-flubot-android/ +! https://www•telia•no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}\$/$document ! A Discord conversation I had about Throneful @@ -5618,7 +5597,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||95.211.26.202^$all !+ PLATFORM(windows, mac, android) 95.211.26.202$network -! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 +! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 ||bzsx.link^$all ||dfvd.link^$all ||dsvs.link^$all @@ -5638,10 +5617,10 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !+ PLATFORM(windows, mac, android) 165.227.168.212$network !#if !ext_ublock -! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ +! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ ://162.241.115.$document !#endif -! https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599 +! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 ||k-yw.com^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/125285 ||fearconic.com^$all @@ -7950,7 +7929,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] 139.45.197.239$network ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub.$document,popup -! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 +! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 ||adblock-chrome.net^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/137635 ||aaolh.icu^$all @@ -10061,14 +10040,14 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||194.110.247.242^$all !+ PLATFORM(windows, mac, android) 194.110.247.242$network -! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ +! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ ||ups-addressed.me^$all ||ups-quote.me^$all ||meta-whatsapp.me^$all ||54.219.218.169^$document !+ PLATFORM(windows, mac, android) 54.219.218.169$network -! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ +! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^$all ||0365online.com^$all ||365-notifcation.com^$all @@ -10501,7 +10480,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||64.132.201.92^$all !+ PLATFORM(windows, mac, android) 64.132.201.92$network -! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener +! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||acessmygov.online^$all ||centerlinkmygov.com^$all ||centierssl.us^$all @@ -11242,7 +11221,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] !+ PLATFORM(windows, mac, android) 54.204.83.105$network ! https://github.com/DandelionSprout/adfilt/issues/808 -! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) +! https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) ||jonathanbartz.com^$all ||jp.imonitorsoft.com^$all ||junk-bros.com^$all @@ -11963,7 +11942,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||tiujejhexe.click^$all ||vuegebjexe.click^$all ||xauhusjexe.click^$all -! https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ +! https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ ||tzn03.me^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/156573 ||707.su^$all @@ -17648,7 +17627,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) /(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~third-party,domain=github.*|~com|~org|~net|~co|~blog|~community|~host|~io|~microsoft|~office|~uk|~us|~xn--fiqs8s|~dev|~archive.* ||github.sale^$all -! https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ +! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ ||0nedr1ved0cumentonline.com^$all ||88godetailsvc.com^$all ||amexmobileupdate.cc^$all @@ -17872,7 +17851,7 @@ zombooru.com##a[href$="ttp://www.hard55.com"] ||no-oppdatere.$all ||no-oppdatert.$all,domain=~no ||179.43.189.62$all -! https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/ +! https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/ ||authde.us^$all ||dc-r.us^$all ||de-po.us^$all @@ -23663,7 +23642,7 @@ toorgle.net##.join ||amoxycillin1st.com^$all ! The Jerma985 Discord server ||crazycrabreedville.com^$all -! https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021) +! https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021) ||messium.info^$all ! Various Google searches ://hullcitytigers.com^$document @@ -25265,7 +25244,7 @@ toorgle.net##.join !#if !ext_ublock /^(https?://)?192\.243\.59\.\d{1,3}($|/)/$document !#endif -! rule34hentai.net when uBlock Filters and AdGuard Base are turned off +! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^$all ||jpjmpqaupc.com^$all ||qrclevrfjw.com^$all @@ -25977,11 +25956,11 @@ toorgle.net##.join ||147.135.16.27^$document !+ PLATFORM(windows, mac, android) 147.135.16.27$network -! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img +! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^$document ! Spambot posts on Tumblr (19/09/2022) tumblr.com##div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://bit.ly/"]) -! https://scambiofigu.forumcommunity•net/?t=57482915 +! https://scambiofigu•forumcommunity•net/?t=57482915 ||scambiofigu.net^$all ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious apkfab.com##.tip-extension @@ -26144,16 +26123,16 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||tvbxrr4ym3.click^$all ||8ebtdbsjsu.click^$all ||eicxz6jfjaw.click^$all -! https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2 +! https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2 ||ru-torproject.ru^$all ||anapatformacion.org/modules/file/tor/tor-browser.zip^$all ! https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required) ! https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required) -! https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 +! https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 ||123secure.org^$all ! https://github.com/RPiList/specials/issues/948#issuecomment-1458739160 ||yuppdownload.com^$all -! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) +! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) ||34.80.59.191^$all !+ PLATFORM(windows, mac, android) 34.80.59.191$network diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 780ecd9a8..d7917b8aa 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22) -! Version: 05October2024v1 +! Version: 06October2024v1 ! Expires: 1 day ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -29,7 +29,7 @@ !!!||ooo^$denyallow=toast.ooo ! (https://github.com/DandelionSprout/adfilt/issues/999) !!!@@://oo*.ooo/ -! https://bgp.he•net/AS202492#_prefixes (17/07/2022) +! https://bgp•he•net/AS202492#_prefixes (17/07/2022) !!!||monster^$denyallow=egybest.monster|yts.monster|cloudcdn.monster|fedi.monster|rollenspiel.monster|tts.monster|geometry.monster ! https://github.com/AdguardTeam/AdguardFilters/issues/131156 !!!||sbs^$denyallow=ecopulse.sbs @@ -201,27 +201,6 @@ ||roms-download.com^ ||gamesgx.net^ -! ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ——— -||afobal.cl^ -||alvoportas.com.br^ - -||bright.su^ -||domnicpeter.in.net^ -||dzitech.net^ -||fadzulani.com^ -||hruner.com^ -||interlogistics.com.vn^ -||ivansaru.418.com1.ru^ -||jangasm.org^ -||ns511849.ip-192-99-19.net^ -||ns513726.ip-192-99-148.net^ -||servmill.com^ -||ssl.sinergycosmetics.com^ -||telefonfiyatlari.org^ -||update.rifugiopontese.it^ -||vodahelp.sytes.net^ -||witkey.com^ - ! ——— Browser extension store entries for notoriously poor or malicious adblocker forks ——— ! Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages ! Chrome Web Store @@ -4622,7 +4601,7 @@ ||daque.cn^ ! https://www•huorong.cn/info/1598957552515.html ||dabaicai.com^ -! https://www•huorong.cn/info/1617368984641.html +! https://www•huorong•cn/info/1617368984641.html ||qqfzn.com^ ! https://github.com/uBlockOrigin/uAssets/pull/10017 ||flash.cn^ @@ -4634,11 +4613,11 @@ ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 ||chess-progress.ru^ ||ouhastay.net^ -! https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 +! https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 ||askara.super.site^ -! https://scammer.info/t/fake-facebook-login-page/84939 +! https://scammer•info/t/fake-facebook-login-page/84939 ! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908 ! https://www•tek.no/i/lVeQAe/ @@ -4652,7 +4631,7 @@ 34.201.22.10 -! https://scammer.info/t/crypto-scammers-onceagain/85354 +! https://scammer•info/t/crypto-scammers-onceagain/85354 ! https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community 123.10.225.196 @@ -4675,7 +4654,7 @@ ||onemacusa.net^ ! https://github.com/DevSpen/links/pull/3 ||systemupdatecontrol.com^ -! https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ +! https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ ||mozicrack.com^ ||download-srvr.xyz^ 134.122.115.190 @@ -4690,7 +4669,7 @@ ||findes.co^ -! https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ +! https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ ||freeprosoftz.com^ @@ -4735,7 +4714,7 @@ ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 /(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/ -! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# +! https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^ ||calsign.xyz^ ||jwq98u.xyz^ @@ -4760,13 +4739,13 @@ ||maanews.xyz^ ||newsdeals.xyz^ ||dreamdigimedia.blogspot.com^ -! https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ +! https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ ||activatorwin.com^ ||freeversioncrack.com^$document ||top3hostngc.xyz^ 198.199.120.251 -! https://www•telia.no/kundeservice/mobil/malware-flubot-android/ +! https://www•telia•no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED /^https?://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/ ! A Discord conversation I had about Throneful @@ -5168,7 +5147,7 @@ 95.211.26.202 -! https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 +! https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 ||bzsx.link^ ||dfvd.link^ ||dsvs.link^ @@ -5186,10 +5165,10 @@ 165.227.168.212 -! https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ +! https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ ://162.241.115. -! https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599 +! https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 ||k-yw.com^ ! https://github.com/AdguardTeam/AdguardFilters/issues/125285 ||fearconic.com^ @@ -7487,7 +7466,7 @@ ! https://github.com/AdguardTeam/AdguardFilters/issues/136390 ||glthub.$document,popup -! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 +! https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 ||adblock-chrome.net^ ! https://github.com/AdguardTeam/AdguardFilters/issues/137635 ||aaolh.icu^ @@ -9585,13 +9564,13 @@ 194.110.247.242 -! https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ +! https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ ||ups-addressed.me^ ||ups-quote.me^ ||meta-whatsapp.me^ 54.219.218.169 -! https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ +! https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ ||0365alert.com^ ||0365online.com^ ||365-notifcation.com^ @@ -10023,7 +10002,7 @@ ||yourorderupdate.com^ 64.132.201.92 -! https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener +! https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener ||acessmygov.online^ ||centerlinkmygov.com^ ||centierssl.us^ @@ -10756,7 +10735,7 @@ 54.204.83.105 ! https://github.com/DandelionSprout/adfilt/issues/808 -! https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) +! https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) ||jonathanbartz.com^ ||jp.imonitorsoft.com^ ||junk-bros.com^ @@ -11459,7 +11438,7 @@ ||tiujejhexe.click^ ||vuegebjexe.click^ ||xauhusjexe.click^ -! https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ +! https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ ||tzn03.me^ ! https://github.com/AdguardTeam/AdguardFilters/issues/156573 ||707.su^ @@ -17130,7 +17109,7 @@ ! (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) /(//|\.|^)github\.[a-z]{2,20}(/|$)/$document,match-case,~third-party,github.*|com|org|net|co|blog|community|host|io|microsoft|office|uk|us|xn--fiqs8s|dev|archive.* ||github.sale^ -! https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ +! https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ ||0nedr1ved0cumentonline.com^ ||88godetailsvc.com^ ||amexmobileupdate.cc^ @@ -17354,7 +17333,7 @@ ||no-oppdatere. ||no-oppdatert. ||179.43.189.62 -! https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/ +! https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/ ||authde.us^ ||dc-r.us^ ||de-po.us^ @@ -23103,7 +23082,7 @@ ||amoxycillin1st.com^ ! The Jerma985 Discord server ||crazycrabreedville.com^ -! https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021) +! https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021) ||messium.info^ ! Various Google searches ://hullcitytigers.com^ @@ -24702,7 +24681,7 @@ /^(https?://)?192\.243\.59\.\d{1,3}($|/)/ -! rule34hentai.net when uBlock Filters and AdGuard Base are turned off +! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off ||eivbjsegbino.com^ ||jpjmpqaupc.com^ ||qrclevrfjw.com^ @@ -25408,10 +25387,10 @@ ||medicinehelp.news^ 147.135.16.27 -! https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img +! https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ||ingeniovirtual.com^ ! Spambot posts on Tumblr (19/09/2022) -! https://scambiofigu.forumcommunity•net/?t=57482915 +! https://scambiofigu•forumcommunity•net/?t=57482915 ||scambiofigu.net^ ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious ! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022) @@ -25563,16 +25542,16 @@ ||tvbxrr4ym3.click^ ||8ebtdbsjsu.click^ ||eicxz6jfjaw.click^ -! https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2 +! https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2 ||ru-torproject.ru^ ! https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required) ! https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required) -! https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 +! https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 ||123secure.org^ ! https://github.com/RPiList/specials/issues/948#issuecomment-1458739160 ||yuppdownload.com^ -! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) +! Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) 34.80.59.191 ! Various domains on https://securitytrails•com/list/ip/72•14•178•174 diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 4f20ebd98..774164bf7 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 05October2024v1 +# Version: 06October2024v1 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway. @@ -31,7 +31,7 @@ # (https://github.com/DandelionSprout/adfilt/issues/999) -# https://bgp.he•net/AS202492#_prefixes (17/07/2022) +# https://bgp•he•net/AS202492#_prefixes (17/07/2022) # https://github.com/AdguardTeam/AdguardFilters/issues/131156 @@ -264,27 +264,6 @@ ps1games.online roms-download.com gamesgx.net -# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ——— -afobal.cl -alvoportas.com.br -blogerjijer.pw -bright.su -domnicpeter.in.net -dzitech.net -fadzulani.com -hruner.com -interlogistics.com.vn -ivansaru.418.com1.ru -jangasm.org -ns511849.ip-192-99-19.net -ns513726.ip-192-99-148.net -servmill.com -ssl.sinergycosmetics.com -telefonfiyatlari.org -update.rifugiopontese.it -vodahelp.sytes.net -witkey.com - # ——— Browser extension store entries for notoriously poor or malicious adblocker forks ——— # Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages # Chrome Web Store @@ -4681,7 +4660,7 @@ xiaobaixitong.com daque.cn # https://www•huorong.cn/info/1598957552515.html dabaicai.com -# https://www•huorong.cn/info/1617368984641.html +# https://www•huorong•cn/info/1617368984641.html qqfzn.com # https://github.com/uBlockOrigin/uAssets/pull/10017 flash.cn @@ -4693,11 +4672,11 @@ dundeehills.group # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 chess-progress.ru ouhastay.net -# https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 +# https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 askara.super.site -# https://scammer.info/t/fake-facebook-login-page/84939 +# https://scammer•info/t/fake-facebook-login-page/84939 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908 # https://www•tek.no/i/lVeQAe/ @@ -4711,7 +4690,7 @@ haxpc.net 34.201.22.10 -# https://scammer.info/t/crypto-scammers-onceagain/85354 +# https://scammer•info/t/crypto-scammers-onceagain/85354 # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community 123.10.225.196 @@ -4734,7 +4713,7 @@ haxpc.net onemacusa.net # https://github.com/DevSpen/links/pull/3 systemupdatecontrol.com -# https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ +# https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ mozicrack.com download-srvr.xyz 134.122.115.190 @@ -4749,7 +4728,7 @@ royaltees.co findes.co -# https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ +# https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ freeprosoftz.com @@ -4794,7 +4773,7 @@ gluegames.xyz # https://github.com/AdguardTeam/AdguardFilters/issues/111970 -# https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# +# https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# pccrackworld.com calsign.xyz jwq98u.xyz @@ -4819,13 +4798,13 @@ hrmaclenews.xyz maanews.xyz newsdeals.xyz dreamdigimedia.blogspot.com -# https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ +# https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ activatorwin.com freeversioncrack.com top3hostngc.xyz 198.199.120.251 -# https://www•telia.no/kundeservice/mobil/malware-flubot-android/ +# https://www•telia•no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED # A Discord conversation I had about Throneful @@ -5222,7 +5201,7 @@ zuginmw.art 95.211.26.202 -# https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 +# https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 bzsx.link dfvd.link dsvs.link @@ -5240,10 +5219,10 @@ wznp.link 165.227.168.212 -# https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ +# https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ -# https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599 +# https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 k-yw.com # https://github.com/AdguardTeam/AdguardFilters/issues/125285 fearconic.com @@ -7541,7 +7520,7 @@ zoawufoy.net # https://github.com/AdguardTeam/AdguardFilters/issues/136390 -# https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 +# https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 adblock-chrome.net # https://github.com/AdguardTeam/AdguardFilters/issues/137635 aaolh.icu @@ -9627,13 +9606,13 @@ winmacros.life 194.110.247.242 -# https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ +# https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ ups-addressed.me ups-quote.me meta-whatsapp.me 54.219.218.169 -# https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ +# https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ 0365alert.com 0365online.com 365-notifcation.com @@ -10065,7 +10044,7 @@ yourticketchance.com yourorderupdate.com 64.132.201.92 -# https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener +# https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener acessmygov.online centerlinkmygov.com centierssl.us @@ -10797,7 +10776,7 @@ wulfs-dcm.com 54.204.83.105 # https://github.com/DandelionSprout/adfilt/issues/808 -# https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) +# https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) jonathanbartz.com jp.imonitorsoft.com junk-bros.com @@ -11497,7 +11476,7 @@ tebux.info tiujejhexe.click vuegebjexe.click xauhusjexe.click -# https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ +# https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ tzn03.me # https://github.com/AdguardTeam/AdguardFilters/issues/156573 707.su @@ -17168,7 +17147,7 @@ wmptengate.com # (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) github.sale -# https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ +# https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ 0nedr1ved0cumentonline.com 88godetailsvc.com amexmobileupdate.cc @@ -17392,7 +17371,7 @@ z2i.tech -# https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/ +# https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/ authde.us dc-r.us de-po.us @@ -23141,7 +23120,7 @@ jueriy.com amoxycillin1st.com # The Jerma985 Discord server crazycrabreedville.com -# https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021) +# https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021) messium.info # Various Google searches hullcitytigers.com @@ -24740,7 +24719,7 @@ zzdb5p4upiug.com -# rule34hentai.net when uBlock Filters and AdGuard Base are turned off +# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off eivbjsegbino.com jpjmpqaupc.com qrclevrfjw.com @@ -25441,10 +25420,10 @@ medicinecoupons.xyz medicinehelp.news 147.135.16.27 -# https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img +# https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img ingeniovirtual.com # Spambot posts on Tumblr (19/09/2022) -# https://scambiofigu.forumcommunity•net/?t=57482915 +# https://scambiofigu•forumcommunity•net/?t=57482915 scambiofigu.net # Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious # Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022) @@ -25597,16 +25576,16 @@ lrhxz60alkjtik.click tvbxrr4ym3.click 8ebtdbsjsu.click eicxz6jfjaw.click -# https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2 +# https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2 ru-torproject.ru # https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required) # https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required) -# https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 +# https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 123secure.org # https://github.com/RPiList/specials/issues/948#issuecomment-1458739160 yuppdownload.com -# Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) +# Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) 34.80.59.191 # Various domains on https://securitytrails•com/list/ip/72•14•178•174 diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 11ef25b98..bc1305632 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,5 +1,5 @@ # Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version) -# Version: 05October2024v1 +# Version: 06October2024v1 # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # Users of Pi-Hole FTL 5.22 and later, and of AdGuard Home, are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven. @@ -31,7 +31,7 @@ # (https://github.com/DandelionSprout/adfilt/issues/999) -# https://bgp.he•net/AS202492#_prefixes (17/07/2022) +# https://bgp•he•net/AS202492#_prefixes (17/07/2022) # https://github.com/AdguardTeam/AdguardFilters/issues/131156 @@ -227,27 +227,6 @@ 127.0.0.1 roms-download.com 127.0.0.1 gamesgx.net -# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ——— -127.0.0.1 afobal.cl -127.0.0.1 alvoportas.com.br -127.0.0.1 blogerjijer.pw -127.0.0.1 bright.su -127.0.0.1 domnicpeter.in.net -127.0.0.1 dzitech.net -127.0.0.1 fadzulani.com -127.0.0.1 hruner.com -127.0.0.1 interlogistics.com.vn -127.0.0.1 ivansaru.418.com1.ru -127.0.0.1 jangasm.org -127.0.0.1 ns511849.ip-192-99-19.net -127.0.0.1 ns513726.ip-192-99-148.net -127.0.0.1 servmill.com -127.0.0.1 ssl.sinergycosmetics.com -127.0.0.1 telefonfiyatlari.org -127.0.0.1 update.rifugiopontese.it -127.0.0.1 vodahelp.sytes.net -127.0.0.1 witkey.com - # ——— Browser extension store entries for notoriously poor or malicious adblocker forks ——— # Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages # Chrome Web Store @@ -4630,7 +4609,7 @@ 127.0.0.1 daque.cn # https://www•huorong.cn/info/1598957552515.html 127.0.0.1 dabaicai.com -# https://www•huorong.cn/info/1617368984641.html +# https://www•huorong•cn/info/1617368984641.html 127.0.0.1 qqfzn.com # https://github.com/uBlockOrigin/uAssets/pull/10017 127.0.0.1 flash.cn @@ -4642,11 +4621,11 @@ # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 127.0.0.1 chess-progress.ru 127.0.0.1 ouhastay.net -# https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 +# https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 127.0.0.1 askara.super.site -# https://scammer.info/t/fake-facebook-login-page/84939 +# https://scammer•info/t/fake-facebook-login-page/84939 # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908 # https://www•tek.no/i/lVeQAe/ @@ -4660,7 +4639,7 @@ 127.0.0.1 34.201.22.10 -# https://scammer.info/t/crypto-scammers-onceagain/85354 +# https://scammer•info/t/crypto-scammers-onceagain/85354 # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community 127.0.0.1 123.10.225.196 @@ -4683,7 +4662,7 @@ 127.0.0.1 onemacusa.net # https://github.com/DevSpen/links/pull/3 127.0.0.1 systemupdatecontrol.com -# https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ +# https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ 127.0.0.1 mozicrack.com 127.0.0.1 download-srvr.xyz 127.0.0.1 134.122.115.190 @@ -4698,7 +4677,7 @@ 127.0.0.1 findes.co -# https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ +# https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ 127.0.0.1 freeprosoftz.com @@ -4743,7 +4722,7 @@ # https://github.com/AdguardTeam/AdguardFilters/issues/111970 -# https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# +# https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# 127.0.0.1 pccrackworld.com 127.0.0.1 calsign.xyz 127.0.0.1 jwq98u.xyz @@ -4768,13 +4747,13 @@ 127.0.0.1 maanews.xyz 127.0.0.1 newsdeals.xyz 127.0.0.1 dreamdigimedia.blogspot.com -# https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ +# https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ 127.0.0.1 activatorwin.com 127.0.0.1 freeversioncrack.com 127.0.0.1 top3hostngc.xyz 127.0.0.1 198.199.120.251 -# https://www•telia.no/kundeservice/mobil/malware-flubot-android/ +# https://www•telia•no/kundeservice/mobil/malware-flubot-android/ !+ NOT_OPTIMIZED # A Discord conversation I had about Throneful @@ -5171,7 +5150,7 @@ 127.0.0.1 95.211.26.202 -# https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 +# https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 127.0.0.1 bzsx.link 127.0.0.1 dfvd.link 127.0.0.1 dsvs.link @@ -5189,10 +5168,10 @@ 127.0.0.1 165.227.168.212 -# https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ +# https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ -# https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599 +# https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 127.0.0.1 k-yw.com # https://github.com/AdguardTeam/AdguardFilters/issues/125285 127.0.0.1 fearconic.com @@ -7490,7 +7469,7 @@ # https://github.com/AdguardTeam/AdguardFilters/issues/136390 -# https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 +# https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 127.0.0.1 adblock-chrome.net # https://github.com/AdguardTeam/AdguardFilters/issues/137635 127.0.0.1 aaolh.icu @@ -9576,13 +9555,13 @@ 127.0.0.1 194.110.247.242 -# https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ +# https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ 127.0.0.1 ups-addressed.me 127.0.0.1 ups-quote.me 127.0.0.1 meta-whatsapp.me 127.0.0.1 54.219.218.169 -# https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ +# https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ 127.0.0.1 0365alert.com 127.0.0.1 0365online.com 127.0.0.1 365-notifcation.com @@ -10014,7 +9993,7 @@ 127.0.0.1 yourorderupdate.com 127.0.0.1 64.132.201.92 -# https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener +# https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener 127.0.0.1 acessmygov.online 127.0.0.1 centerlinkmygov.com 127.0.0.1 centierssl.us @@ -10746,7 +10725,7 @@ 127.0.0.1 54.204.83.105 # https://github.com/DandelionSprout/adfilt/issues/808 -# https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) +# https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations (26/01/2023) 127.0.0.1 jonathanbartz.com 127.0.0.1 jp.imonitorsoft.com 127.0.0.1 junk-bros.com @@ -11446,7 +11425,7 @@ 127.0.0.1 tiujejhexe.click 127.0.0.1 vuegebjexe.click 127.0.0.1 xauhusjexe.click -# https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ +# https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ 127.0.0.1 tzn03.me # https://github.com/AdguardTeam/AdguardFilters/issues/156573 127.0.0.1 707.su @@ -17117,7 +17096,7 @@ # (https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2497) 127.0.0.1 github.sale -# https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ +# https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ 127.0.0.1 0nedr1ved0cumentonline.com 127.0.0.1 88godetailsvc.com 127.0.0.1 amexmobileupdate.cc @@ -17341,7 +17320,7 @@ -# https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/ +# https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/ 127.0.0.1 authde.us 127.0.0.1 dc-r.us 127.0.0.1 de-po.us @@ -23090,7 +23069,7 @@ 127.0.0.1 amoxycillin1st.com # The Jerma985 Discord server 127.0.0.1 crazycrabreedville.com -# https://flclever.weebly•com/pixie-hollow-mini-games•html (06/05/2021) +# https://flclever•weebly•com/pixie-hollow-mini-games•html (06/05/2021) 127.0.0.1 messium.info # Various Google searches 127.0.0.1 hullcitytigers.com @@ -24689,7 +24668,7 @@ -# rule34hentai.net when uBlock Filters and AdGuard Base are turned off +# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off 127.0.0.1 eivbjsegbino.com 127.0.0.1 jpjmpqaupc.com 127.0.0.1 qrclevrfjw.com @@ -25390,10 +25369,10 @@ 127.0.0.1 medicinehelp.news 127.0.0.1 147.135.16.27 -# https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img +# https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img 127.0.0.1 ingeniovirtual.com # Spambot posts on Tumblr (19/09/2022) -# https://scambiofigu.forumcommunity•net/?t=57482915 +# https://scambiofigu•forumcommunity•net/?t=57482915 127.0.0.1 scambiofigu.net # Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious # Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022) @@ -25545,16 +25524,16 @@ 127.0.0.1 tvbxrr4ym3.click 127.0.0.1 8ebtdbsjsu.click 127.0.0.1 eicxz6jfjaw.click -# https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2 +# https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria•ge/230217-xd8nksgc9x/behavioral2 127.0.0.1 ru-torproject.ru # https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required) # https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required) -# https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 +# https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 127.0.0.1 123secure.org # https://github.com/RPiList/specials/issues/948#issuecomment-1458739160 127.0.0.1 yuppdownload.com -# Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) +# Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) 127.0.0.1 34.80.59.191 # Various domains on https://securitytrails•com/list/ip/72•14•178•174 diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index e21c7c9e9..d3f05118b 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 05October2024v1-Deprecated +# Version: 06October2024v1-Deprecated # Expires: 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -173,28 +173,6 @@ .roms-download.com .gamesgx.net -{+block} -# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ——— -.afobal.cl -.alvoportas.com.br -.blogerjijer.pw -.bright.su -.domnicpeter.in.net -.dzitech.net -.fadzulani.com -.hruner.com -.interlogistics.com.vn -.ivansaru.418.com1.ru -.jangasm.org -.ns511849.ip-192-99-19.net -.ns513726.ip-192-99-148.net -.servmill.com -.ssl.sinergycosmetics.com -.telefonfiyatlari.org -.update.rifugiopontese.it -.vodahelp.sytes.net -.witkey.com - {+block} # ——— Browser extension store entries for notoriously poor or malicious adblocker forks ——— # Chrome Web Store @@ -24336,7 +24314,7 @@ -# rule34hentai.net when uBlock Filters and AdGuard Base are turned off +# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off .eivbjsegbino.com .jpjmpqaupc.com .qrclevrfjw.com diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 6a1d90700..9ba751d2d 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 05October2024v1-Deprecated +# Version: 06October2024v1-Deprecated : expires = 1 day # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -112,7 +112,7 @@ msFilterList !!!||ooo # (https://github.com/DandelionSprout/adfilt/issues/999) !!!@@://oo*.ooo/ -# https://bgp.he•net/AS202492#_prefixes/(17/07/2022) +# https://bgp•he•net/AS202492#_prefixes/(17/07/2022) !!!||monster$doc,domain= +d egybest.monster +d yts.monster @@ -308,27 +308,6 @@ msFilterList -d roms-download.com -d gamesgx.net -# ——— Entries from «abuse.ch ZeuS Blocklist», which was discontinued on the 8th of July 2019. ——— --d afobal.cl --d alvoportas.com.br --d blogerjijer.pw --d bright.su --d domnicpeter.in.net --d dzitech.net --d fadzulani.com --d hruner.com --d interlogistics.com.vn --d ivansaru.418.com1.ru --d jangasm.org --d ns511849.ip-192-99-19.net --d ns513726.ip-192-99-148.net --d servmill.com --d ssl.sinergycosmetics.com --d telefonfiyatlari.org --d update.rifugiopontese.it --d vodahelp.sytes.net --d witkey.com - # ——— Browser extension store entries for notoriously poor or malicious adblocker forks ——— # Note: Currently the Chrome Web Store entries only work properly for Chrome users on AdGuard for Windows/Mac, due to limitations placed on browser extensions; see https://github.com/gorhill/uBlock/wiki/Privileged-Pages # Chrome Web Store @@ -4716,7 +4695,7 @@ msFilterList -d daque.cn # https://www•huorong.cn/info/1598957552515.html -d dabaicai.com -# https://www•huorong.cn/info/1617368984641.html +# https://www•huorong•cn/info/1617368984641.html -d qqfzn.com # https://github.com/uBlockOrigin/uAssets/pull/10017 -d flash.cn @@ -4728,11 +4707,11 @@ msFilterList # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768 -d chess-progress.ru -d ouhastay.net -# https://scammer.info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 +# https://scammer•info/t/there-are-things-in-the-game-that-will-interest-you-trojan/84908 -d askara.super.site -d cdn.discordapp.com attachments 916361798763053136 917187511053320202 Askara.exe -d discord.com invite askara -# https://scammer.info/t/fake-facebook-login-page/84939 +# https://scammer•info/t/fake-facebook-login-page/84939 -d royyer.us R8cWuvQjhtM # https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908 # https://www•tek.no/i/lVeQAe/ @@ -4746,7 +4725,7 @@ msFilterList -d 34.201.22.10 -# https://scammer.info/t/crypto-scammers-onceagain/85354 +# https://scammer•info/t/crypto-scammers-onceagain/85354 -d business.google.com website billyandscapedesign # https://www•virustotal•com/gui/file/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef/community -d 123.10.225.196 @@ -4769,7 +4748,7 @@ msFilterList -d onemacusa.net # https://github.com/DevSpen/links/pull/3 -d systemupdatecontrol.com -# https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ +# https://bazaar•abuse•ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/ -d mozicrack.com -d download-srvr.xyz -d 134.122.115.190 @@ -4784,7 +4763,7 @@ msFilterList -d findes.co -d supersong.nl upload 6277.rar -# https://bazaar.abuse.ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ +# https://bazaar•abuse•ch/sample/84d93b2fd2597da5d611165cbad0b252569a837c56a94a42849f2bedc8af033a/ -d freeprosoftz.com -d mediafire.com file pu0m2luacc3fh8h file-password___2345.rar file -d mediafire.com coe39m9f9tyg pu0m2luacc3fh8h file-password___2345%282%29.rar @@ -4829,7 +4808,7 @@ msFilterList -d sites.google.com mytv maintenance # https://github.com/AdguardTeam/AdguardFilters/issues/111970 -# https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# +# https://bazaar•abuse•ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app•any•run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# -d pccrackworld.com -d calsign.xyz -d jwq98u.xyz @@ -4854,13 +4833,13 @@ msFilterList -d maanews.xyz -d newsdeals.xyz -d dreamdigimedia.blogspot.com -# https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ +# https://bazaar•abuse•ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/ -d activatorwin.com -d freeversioncrack.com -d top3hostngc.xyz -d 198.199.120.251 -# https://www•telia.no/kundeservice/mobil/malware-flubot-android/ +# https://www•telia•no/kundeservice/mobil/malware-flubot-android/ # A Discord conversation I had about Throneful @@ -5253,7 +5232,7 @@ msFilterList -d 95.211.26.202 -# https://kommunikasjon.ntb.no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 +# https://kommunikasjon•ntb•no/pressemelding/power-advarer-mot-sms-svindel?publisherId=17847615&releaseId=17937583 -d bzsx.link -d dfvd.link -d dsvs.link @@ -5271,9 +5250,9 @@ msFilterList -d 165.227.168.212 -# https://www•reddit.com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ +# https://new•reddit•com/r/engrish/comments/w6u4uy/received_this_text_message_yesterday_i_am_very/ -# https://dinside.dagbladet.no/mobil/ikke-la-deg-friste/76730599 +# https://dinside•dagbladet•no/mobil/ikke-la-deg-friste/76730599 -d k-yw.com # https://github.com/AdguardTeam/AdguardFilters/issues/125285 -d fearconic.com @@ -7571,7 +7550,7 @@ msFilterList # https://github.com/AdguardTeam/AdguardFilters/issues/136390 -d glthub. -# https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 +# https://app•any•run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434 -d adblock-chrome.net # https://github.com/AdguardTeam/AdguardFilters/issues/137635 -d aaolh.icu @@ -9653,13 +9632,13 @@ msFilterList -d 194.110.247.242 -# https://new.reddit.com/r/engrish/comments/10zs6f6/low_budget_scam/ +# https://new•reddit•com/r/engrish/comments/10zs6f6/low_budget_scam/ -d ups-addressed.me -d ups-quote.me -d meta-whatsapp.me -d 54.219.218.169 -# https://new.reddit.com/r/engrish/comments/10z8r2u/well_you_tried/ +# https://new•reddit•com/r/engrish/comments/10z8r2u/well_you_tried/ -d 0365alert.com -d 0365online.com -d 365-notifcation.com @@ -10091,7 +10070,7 @@ msFilterList -d yourorderupdate.com -d 64.132.201.92 -# https://www•adressa.no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener +# https://www•adressa•no/nyheter/trondheim/i/BWkdkw/trodde-hun-skulle-faa-en-pakke-i-posten-ble-lurt-for-titusener -d acessmygov.online -d centerlinkmygov.com -d centierssl.us @@ -10822,7 +10801,7 @@ msFilterList -d 54.204.83.105 # https://github.com/DandelionSprout/adfilt/issues/808 -# https://www•mandiant.com/resources/blog/tracking-evolution-gootloader-operations/(26/01/2023) +# https://www•mandiant•com/resources/blog/tracking-evolution-gootloader-operations/(26/01/2023) -d jonathanbartz.com -d jp.imonitorsoft.com -d junk-bros.com @@ -11523,7 +11502,7 @@ msFilterList -d tiujejhexe.click -d vuegebjexe.click -d xauhusjexe.click -# https://new.reddit.com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ +# https://new•reddit•com/r/engrish/comments/15080hg/a_message_i_just_got_from_a_scammer/ -d tzn03.me # https://github.com/AdguardTeam/AdguardFilters/issues/156573 -d 707.su @@ -17209,7 +17188,7 @@ msFilterList +d dev +d archive.* -d github.sale -# https://www•tv2.no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ +# https://www•tv2•no/nyheter/innenriks/advarer-ikke-klikk-pa-lenken/16040614/ -d 0nedr1ved0cumentonline.com -d 88godetailsvc.com -d amexmobileupdate.cc @@ -17433,7 +17412,7 @@ msFilterList -d no-oppdatere. -d no-oppdatert. -d 179.43.189.62 -# https://new.reddit.com/r/engrish/comments/16lg4i1/seems_legit/ +# https://new•reddit•com/r/engrish/comments/16lg4i1/seems_legit/ -d authde.us -d dc-r.us -d de-po.us @@ -23173,7 +23152,7 @@ vito.www.booking. -d amoxycillin1st.com # The Jerma985 Discord server -d crazycrabreedville.com -# https://flclever.weebly•com/pixie-hollow-mini-games•html/(06/05/2021) +# https://flclever•weebly•com/pixie-hollow-mini-games•html/(06/05/2021) -d messium.info # Various Google searches # Various search results for 'kelloggs tresor' in Norwegian (30 05 2021) @@ -24773,7 +24752,7 @@ dvancedhosters.com$doc,domain= -# rule34hentai.net when uBlock Filters and AdGuard Base are turned off +# rule34hentaiNET when uBlock Filters and AdGuard Base are turned off -d eivbjsegbino.com -d jpjmpqaupc.com -d qrclevrfjw.com @@ -25466,10 +25445,10 @@ dvancedhosters.com$doc,domain= -d medicinehelp.news -d 147.135.16.27 -# https://www•google.no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img +# https://www•google•no/search?q=mlp+g5&newwindow=1&tbm=isch&oq=mlp+g5&sclient=img -d ingeniovirtual.com # Spambot posts on Tumblr (19 09 2022) -# https://scambiofigu.forumcommunity•net/?t=57482915 +# https://scambiofigu•forumcommunity•net/?t=57482915 -d scambiofigu.net # Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious # Google results for 'Katy and Bob: Cake Café powerpc' (04 11 2022) @@ -25621,16 +25600,16 @@ dvancedhosters.com$doc,domain= -d tvbxrr4ym3.click -d 8ebtdbsjsu.click -d eicxz6jfjaw.click -# https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448/and/https://tria.ge/230217-xd8nksgc9x/behavioral2 +# https://app•any•run/tasks/679e9afa-eb19-4414-a086-e280a779a448/and/https://tria•ge/230217-xd8nksgc9x/behavioral2 -d ru-torproject.ru -d anapatformacion.org modules file tor tor-browser.zip # https://forums•malwarebytes•com/topic/295588-support-scam-supportclientexe-and-screenconnectwindowsclientexe/ (account required) # https://forums•malwarebytes•com/topic/295605-techsupport-scam/ (account required) -# https://app.any.run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 +# https://app•any•run/tasks/0f8b5786-177a-45c0-a1de-32e0d68beff2 -d 123secure.org # https://github.com/RPiList/specials/issues/948#issuecomment-1458739160 -d yuppdownload.com -# Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) +# Commonly set as a proxy on hacked devices (https://www•virustotal•com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) -d 34.80.59.191 # Various domains on https://securitytrails•com/list/ip/72•14•178•174