From cd98916c4287b103c9a07371efc9017f50e72c08 Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Thu, 13 Aug 2020 03:42:15 +0200 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 85 +++++++++--------- .../AntiMalwareAdGuard.txt | 85 +++++++++--------- .../AntiMalwareAdGuardHome.txt | 85 +++++++++--------- .../AntiMalwareDomains.txt | 79 ++++++++--------- .../AntiMalwareHosts.txt | 81 ++++++++--------- .../AntiMalwarePrivoxy.action | 88 ++++++++----------- .../AntiMalwareTPL.tpl | 83 ++++++++--------- 7 files changed, 270 insertions(+), 316 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index 8fe6cf364..38b999dc1 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,12 +1,12 @@ [Adblock Plus 3.4] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdBlock and Adblock Plus) -! Version: 30July2020v1-Beta +! Version: 13August2020v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists ! For more information, details, helpful tools, and other lists that I've made, visit https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english -! β€”β€”β€” Country domains β€”β€”β€” +! β€”β€”β€” Bad top-level domains β€”β€”β€” ! You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. ! Tokelau ||tk^$domain=~coolcmd.tk|~budterence.tk|~google.tk|~transportnews.tk|~unicorncardlist.tk|~c0d3c.tk|~anonytext.tk|~tokelau-info.tk|~fakaofo.tk|~loljp-wiki.tk|~ninetail.tk|~goshujin.tk|~graph.tk|~haopro.tk|~dls2.pokeacer.tk|~nolfrevival.tk|~coppersurfer.tk @@ -20,10 +20,7 @@ ||cf^$domain=~google.cf|~rths.cf|~voitures.cf|~assembleenationale-rca.cf|~cps-rca.cf|~acap.cf ! Palau ||pw^$domain=~libgen.pw|~petridish.pw|~palaugov.pw - -! β€”β€”β€” Topical domains β€”β€”β€” -! These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. -! Presumably fake loans +! International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. ||loan^ ||agency^ ||gdn^ @@ -37,7 +34,8 @@ ! β€”β€”β€” For Google Mobile β€”β€”β€” ! Note for Firefox on Android users: I strongly recommend the use of https://addons.mozilla.org/firefox/addon/google-search-fixer/ for use on Firefox for Android, thus the entries are written for the Chrome version of Google Mobile. -! β€”β€”β€” Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +! β€”β€”β€” Old dead tech-related domains β€”β€”β€” +! Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. ||adblock.gjtech.net^ ||spam404bl.com^ ||109.201.135.46^ @@ -50,11 +48,31 @@ ||vin-plastiks.com^ ||adblock-listefr.com^ ||intr0.cf^ - -! β€”β€”β€” Old tech-related domains that have fallen into the hands of questionable new owners. β€”β€”β€” +||njabl.org^ +||dutchmega.nl^ +||juvander.net^ +! Malicious domains found in videogame manuals +||acclaimsports.com^ +||acclaimmaxsports.com^ +||hip-games.com^ +||thq.com.au^ +||gp32.com^ +! Dead router connection URΔ°s ! To log in to TP-Link routers, use tplinkwifi.net instead. ||tplinklogin.net^ ||tplinkextender.net^ +! Old Linux-related domains +! How these links still remain in Unetbootin, is anyone's guess. +||dreamlinux.com.br^ +||dreamlinux.net^ +||dreamlinux.info^ +||104.24.117.74^ +||104.24.116.74^ +||[2606:4700:30::6818:754a]^ +||[2606:4700:30::6818:744a]^ +||hacktolive.org^ +||mandriva.com^ +! Other ||ublock.org^ ||138.68.252.54^ @@ -70,19 +88,8 @@ ||test-iq.org^ ||officialiqtests.com^ -! β€”β€”β€” Old Linux-related domains that have been snapped up for ads, adware, and/or malware. β€”β€”β€” -! How these links still remain in Unetbootin, is anyone's guess. -||dreamlinux.com.br^ -||dreamlinux.net^ -||dreamlinux.info^ -||104.24.117.74^ -||104.24.116.74^ -||[2606:4700:30::6818:754a]^ -||[2606:4700:30::6818:744a]^ -||hacktolive.org^ -||mandriva.com^ - -! β€”β€”β€” ReImagePlus links (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +! β€”β€”β€” Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware β€”β€”β€” +! ReImagePlus (Also added to "uBlock Filters - Badware Risks") ! https://windowsreport.com/extend-windows-laptop-battery-life/ windowsreport.com##.code-block ! https://appuals.com/fix-error-0x800701e3-on-windows-7-8-1-10/ @@ -117,13 +124,11 @@ majorgeeks.com#?#b:-abp-has(a[target^="reimage"]) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#.nfc-bottom-right:-abp-contains(Reimage) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(Reimage) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.quick-download-button-text - -! β€”β€”β€” ScanUtilities links β€”β€”β€” +! ScanUtilities ! https://www.bynarycodes.com/fix-windows-10-update-error-0x80070006/ bynarycodes.com##div[class^="bynar-content_"] bynarycodes.com#?#.panel:-abp-contains(a[href*="scanutilities.com"]) - -! β€”β€”β€” Driver Easy links β€”β€”β€” +! Driver Easy ! https://www.drivereasy.com/knowledge/fix-critical-service-failed-blue-screen-error-on-windows-10/ drivereasy.com#?#.pakb-content ol:-abp-contains(Download and install Driver Easy) drivereasy.com#?#.pakb-content p:-abp-contains(Driver Easy) @@ -142,15 +147,12 @@ drivereasy.com#?#.pakb-content figcaption:-abp-contains(for free if you like) drivereasy.com#?#.pakb-content li:-abp-has(a:-abp-contains(Update drivers with Driver Easy)) ! https://www.drivereasy.com/knowledge/solved-this-display-does-not-support-hdcp/ drivereasy.com#?#.pakb-content p:-abp-contains(click Update All) - -! β€”β€”β€” Slimware DriverUpdate links β€”β€”β€” +! Slimware DriverUpdate ! https://forums.windowscentral.com/ forums.windowscentral.com###navbar_notice_33 - -! β€”β€”β€” Driverpack Online links (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») β€”β€”β€” +! Driverpack Online (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») ||google-analytics.com^$domain=sdi-tool.org - -! β€”β€”β€” SpyHunter links β€”β€”β€” +! SpyHunter links ! https://howtoremove.guide/redirector-gvt1-com-virus-malware-chrome-removal/ howtoremove.guide##div[style^="border:2px"] howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) @@ -158,9 +160,12 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.automatic_removal_list_w > .ar_block_description 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(SpyHunter) -! β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” +! Common scam domain patterns /(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-partyument,domain=icu|life|live -/^https://[a-z]{10,16}[0-9]{1,2}\.live/ument,domain=live +/^https://[a-z]{7,16}[0-9]{1,2}\.live/ument,domain=live +! https://github.com/AdguardTeam/AdguardFilters/issues/58737 +/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/ument,domain=fun +/^https://www\.namejp0[1-9]\.xyz/ument,popup,domain=xyz ! β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” msn.com##.irisbanner @@ -283,6 +288,7 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ||3.226.8.132^ ||3.216.243.46^ ||maowaotodowoo.net^ +||roamingclicks.com^ ! Source: demonoid.pw ||veremund-hon.com^ ! Source: desidert.no @@ -302,13 +308,6 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 ||deviuser.com^ -! β€”β€”β€” Malicious domains found in videogame manuals β€”β€”β€” -||acclaimsports.com^ -||acclaimmaxsports.com^ -||hip-games.com^ -||thq.com.au^ -||gp32.com^ - ! β€”β€”β€” Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. ||unofficialtwrp.com^ @@ -400,8 +399,4 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! https://github.com/DandelionSprout/adfilt/issues/71 ||imgvieweriri.com^ -! Japanese scam -! https://github.com/AdguardTeam/AdguardFilters/issues/58737 -/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/ument,domain=fun - ! Placeholder line for alternate list versions diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index 9b1eb38f2..cb2764a4a 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,12 +1,12 @@ [AdGuard β‰₯6] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 30July2020v1-Beta +! Version: 13August2020v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists ! For more information, details, helpful tools, and other lists that I've made, visit https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english -! β€”β€”β€” Country domains β€”β€”β€” +! β€”β€”β€” Bad top-level domains β€”β€”β€” ! You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. ! Tokelau ||tk^$empty,important,domain=~coolcmd.tk|~budterence.tk|~google.tk|~transportnews.tk|~unicorncardlist.tk|~c0d3c.tk|~anonytext.tk|~tokelau-info.tk|~fakaofo.tk|~loljp-wiki.tk|~ninetail.tk|~goshujin.tk|~graph.tk|~haopro.tk|~dls2.pokeacer.tk|~nolfrevival.tk|~coppersurfer.tk @@ -20,10 +20,7 @@ ||cf^$empty,important,domain=~google.cf|~rths.cf|~voitures.cf|~assembleenationale-rca.cf|~cps-rca.cf|~acap.cf ! Palau ||pw^$empty,important,domain=~libgen.pw|~petridish.pw|~palaugov.pw - -! β€”β€”β€” Topical domains β€”β€”β€” -! These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. -! Presumably fake loans +! International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. ||loan^$empty,important ||agency^$empty,important ||gdn^$empty,important @@ -61,7 +58,8 @@ google.*#?#*:has(> * > a[oncontextmenu][href*=".bid/"]) google.*#?#*:has(> * > a[oncontextmenu][href*=".top/"]) google.*#?#*:has(> * > a[oncontextmenu][href*=".php?xxx="]) -! β€”β€”β€” Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +! β€”β€”β€” Old dead tech-related domains β€”β€”β€” +! Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. ||adblock.gjtech.net^$empty,important ||spam404bl.com^$empty,important 109.201.135.46$network @@ -74,11 +72,31 @@ google.*#?#*:has(> * > a[oncontextmenu][href*=".php?xxx="]) ||vin-plastiks.com^$empty,important ||adblock-listefr.com^$empty,important ||intr0.cf^$empty,important - -! β€”β€”β€” Old tech-related domains that have fallen into the hands of questionable new owners. β€”β€”β€” +||njabl.org^$empty,important +||dutchmega.nl^$empty,important +||juvander.net^$empty,important +! Malicious domains found in videogame manuals +||acclaimsports.com^$empty,important +||acclaimmaxsports.com^$empty,important +||hip-games.com^$empty,important +||thq.com.au^$empty,important +||gp32.com^$empty,important +! Dead router connection URΔ°s ! To log in to TP-Link routers, use tplinkwifi.net instead. ||tplinklogin.net^$empty,important ||tplinkextender.net^$empty,important +! Old Linux-related domains +! How these links still remain in Unetbootin, is anyone's guess. +||dreamlinux.com.br^$empty,important +||dreamlinux.net^$empty,important +||dreamlinux.info^$empty,important +104.24.117.74$network +104.24.116.74$network +[2606:4700:30::6818:754a]$network +[2606:4700:30::6818:744a]$network +||hacktolive.org^$empty,important +||mandriva.com^$empty,important +! Other ||ublock.org^$empty,important 138.68.252.54$network @@ -94,19 +112,8 @@ google.*#?#*:has(> * > a[oncontextmenu][href*=".php?xxx="]) ||test-iq.org^$empty,important ||officialiqtests.com^$empty,important -! β€”β€”β€” Old Linux-related domains that have been snapped up for ads, adware, and/or malware. β€”β€”β€” -! How these links still remain in Unetbootin, is anyone's guess. -||dreamlinux.com.br^$empty,important -||dreamlinux.net^$empty,important -||dreamlinux.info^$empty,important -104.24.117.74$network -104.24.116.74$network -[2606:4700:30::6818:754a]$network -[2606:4700:30::6818:744a]$network -||hacktolive.org^$empty,important -||mandriva.com^$empty,important - -! β€”β€”β€” ReImagePlus links (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +! β€”β€”β€” Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware β€”β€”β€” +! ReImagePlus (Also added to "uBlock Filters - Badware Risks") ! https://windowsreport.com/extend-windows-laptop-battery-life/ windowsreport.com##.code-block ! https://appuals.com/fix-error-0x800701e3-on-windows-7-8-1-10/ @@ -141,13 +148,11 @@ majorgeeks.com#?#b:-abp-has(a[target^="reimage"]) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#.nfc-bottom-right:-abp-contains(Reimage) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(Reimage) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.quick-download-button-text - -! β€”β€”β€” ScanUtilities links β€”β€”β€” +! ScanUtilities ! https://www.bynarycodes.com/fix-windows-10-update-error-0x80070006/ bynarycodes.com##div[class^="bynar-content_"] bynarycodes.com#?#.panel:-abp-contains(a[href*="scanutilities.com"]) - -! β€”β€”β€” Driver Easy links β€”β€”β€” +! Driver Easy ! https://www.drivereasy.com/knowledge/fix-critical-service-failed-blue-screen-error-on-windows-10/ drivereasy.com#?#.pakb-content ol:-abp-contains(Download and install Driver Easy) drivereasy.com#?#.pakb-content p:-abp-contains(Driver Easy) @@ -166,15 +171,12 @@ drivereasy.com#?#.pakb-content figcaption:-abp-contains(for free if you like) drivereasy.com#?#.pakb-content li:-abp-has(a:-abp-contains(Update drivers with Driver Easy)) ! https://www.drivereasy.com/knowledge/solved-this-display-does-not-support-hdcp/ drivereasy.com#?#.pakb-content p:-abp-contains(click Update All) - -! β€”β€”β€” Slimware DriverUpdate links β€”β€”β€” +! Slimware DriverUpdate ! https://forums.windowscentral.com/ forums.windowscentral.com###navbar_notice_33 - -! β€”β€”β€” Driverpack Online links (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») β€”β€”β€” +! Driverpack Online (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») ||google-analytics.com^$domain=sdi-tool.org - -! β€”β€”β€” SpyHunter links β€”β€”β€” +! SpyHunter links ! https://howtoremove.guide/redirector-gvt1-com-virus-malware-chrome-removal/ howtoremove.guide##div[style^="border:2px"] howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) @@ -182,9 +184,12 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.automatic_removal_list_w > .ar_block_description 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(SpyHunter) -! β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” +! Common scam domain patterns /(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$~third-party,empty,importantument,domain=icu|life|live -/^https://[a-z]{10,16}[0-9]{1,2}\.live/$empty,importantument,domain=live +/^https://[a-z]{7,16}[0-9]{1,2}\.live/$empty,importantument,domain=live +! https://github.com/AdguardTeam/AdguardFilters/issues/58737 +/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$empty,importantument,domain=fun +/^https://www\.namejp0[1-9]\.xyz/$empty,importantument,popup,domain=xyz ! β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” msn.com##.irisbanner @@ -308,6 +313,7 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) 3.226.8.132$network 3.216.243.46$network ||maowaotodowoo.net^$empty,important +||roamingclicks.com^$empty,important ! Source: demonoid.pw ||veremund-hon.com^$empty,important ! Source: desidert.no @@ -327,13 +333,6 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 ||deviuser.com^$empty,important -! β€”β€”β€” Malicious domains found in videogame manuals β€”β€”β€” -||acclaimsports.com^$empty,important -||acclaimmaxsports.com^$empty,important -||hip-games.com^$empty,important -||thq.com.au^$empty,important -||gp32.com^$empty,important - ! β€”β€”β€” Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. ||unofficialtwrp.com^$empty,important @@ -427,8 +426,4 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! https://github.com/DandelionSprout/adfilt/issues/71 ||imgvieweriri.com^$empty,important -! Japanese scam -! https://github.com/AdguardTeam/AdguardFilters/issues/58737 -/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$empty,importantument,domain=fun - ! Placeholder line for alternate list versions diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index 150ec956b..cf7fb5d91 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,12 +1,12 @@ [Adblock Plus 3.4] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard Home) -! Version: 30July2020v1-Beta +! Version: 13August2020v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists ! For more information, details, helpful tools, and other lists that I've made, visit https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english -! β€”β€”β€” Country domains β€”β€”β€” +! β€”β€”β€” Bad top-level domains β€”β€”β€” ! You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. ! Tokelau ||tk^ @@ -58,10 +58,7 @@ @@||libgen.pw^ @@||petridish.pw^ @@||palaugov.pw^ - -! β€”β€”β€” Topical domains β€”β€”β€” -! These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. -! Presumably fake loans +! International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. ||loan^ ||agency^ ||gdn^ @@ -75,7 +72,8 @@ ! β€”β€”β€” For Google Mobile β€”β€”β€” ! Note for Firefox on Android users: I strongly recommend the use of https://addons.mozilla.org/firefox/addon/google-search-fixer/ for use on Firefox for Android, thus the entries are written for the Chrome version of Google Mobile. -! β€”β€”β€” Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +! β€”β€”β€” Old dead tech-related domains β€”β€”β€” +! Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. ||adblock.gjtech.net^ ||spam404bl.com^ 109.201.135.46 @@ -88,11 +86,31 @@ ||vin-plastiks.com^ ||adblock-listefr.com^ ||intr0.cf^ - -! β€”β€”β€” Old tech-related domains that have fallen into the hands of questionable new owners. β€”β€”β€” +||njabl.org^ +||dutchmega.nl^ +||juvander.net^ +! Malicious domains found in videogame manuals +||acclaimsports.com^ +||acclaimmaxsports.com^ +||hip-games.com^ +||thq.com.au^ +||gp32.com^ +! Dead router connection URΔ°s ! To log in to TP-Link routers, use tplinkwifi.net instead. ||tplinklogin.net^ ||tplinkextender.net^ +! Old Linux-related domains +! How these links still remain in Unetbootin, is anyone's guess. +||dreamlinux.com.br^ +||dreamlinux.net^ +||dreamlinux.info^ +104.24.117.74 +104.24.116.74 +2606:4700:30::6818:754a +2606:4700:30::6818:744a +||hacktolive.org^ +||mandriva.com^ +! Other ||ublock.org^ 138.68.252.54 @@ -108,19 +126,8 @@ ||test-iq.org^ ||officialiqtests.com^ -! β€”β€”β€” Old Linux-related domains that have been snapped up for ads, adware, and/or malware. β€”β€”β€” -! How these links still remain in Unetbootin, is anyone's guess. -||dreamlinux.com.br^ -||dreamlinux.net^ -||dreamlinux.info^ -104.24.117.74 -104.24.116.74 -2606:4700:30::6818:754a -2606:4700:30::6818:744a -||hacktolive.org^ -||mandriva.com^ - -! β€”β€”β€” ReImagePlus links (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +! β€”β€”β€” Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware β€”β€”β€” +! ReImagePlus (Also added to "uBlock Filters - Badware Risks") ! https://windowsreport.com/extend-windows-laptop-battery-life/ ! https://appuals.com/fix-error-0x800701e3-on-windows-7-8-1-10/ ! https://ugetfix.com/ask/how-to-fix-windows-store-error-0x8000ffff/ @@ -128,30 +135,28 @@ ! https://www.majorgeeks.com/files/details/patch_my_pc.html ||majorgeeks.com/images/icons/red_icon_18x17px.png ! https://www.2-spyware.com/remove-redirector-gvt1-com.html - -! β€”β€”β€” ScanUtilities links β€”β€”β€” +! ScanUtilities ! https://www.bynarycodes.com/fix-windows-10-update-error-0x80070006/ - -! β€”β€”β€” Driver Easy links β€”β€”β€” +! Driver Easy ! https://www.drivereasy.com/knowledge/fix-critical-service-failed-blue-screen-error-on-windows-10/ ! https://www.drivereasy.com/knowledge/fixed-how-to-fix-stop-error-0x0000001e/ ! https://www.drivereasy.com/knowledge/download-gigabyte-audio-driver/ ! https://www.drivereasy.com/knowledge/epson-xp-420-driver-update-for-windows-7-8-and-10/ ! https://www.drivereasy.com/knowledge/solved-this-display-does-not-support-hdcp/ - -! β€”β€”β€” Slimware DriverUpdate links β€”β€”β€” +! Slimware DriverUpdate ! https://forums.windowscentral.com/ - -! β€”β€”β€” Driverpack Online links (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») β€”β€”β€” +! Driverpack Online (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») ||google-analytics.com^$sdi-tool.org - -! β€”β€”β€” SpyHunter links β€”β€”β€” +! SpyHunter links ! https://howtoremove.guide/redirector-gvt1-com-virus-malware-chrome-removal/ ! https://www.2-spyware.com/remove-redirector-gvt1-com.html -! β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” +! Common scam domain patterns /(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/ -/^https://[a-z]{10,16}[0-9]{1,2}\.live/$document,live +/^https://[a-z]{7,16}[0-9]{1,2}\.live/$document,live| +! https://github.com/AdguardTeam/AdguardFilters/issues/58737 +/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$document,fun +/^https://www\.namejp0[1-9]\.xyz/$document,popup,xyz ! β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” @@ -246,6 +251,7 @@ 3.226.8.132 3.216.243.46 ||maowaotodowoo.net^ +||roamingclicks.com^ ! Source: demonoid.pw ||veremund-hon.com^ ! Source: desidert.no @@ -265,13 +271,6 @@ ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 ||deviuser.com^ -! β€”β€”β€” Malicious domains found in videogame manuals β€”β€”β€” -||acclaimsports.com^ -||acclaimmaxsports.com^ -||hip-games.com^ -||thq.com.au^ -||gp32.com^ - ! β€”β€”β€” Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. ||unofficialtwrp.com^ @@ -365,8 +364,4 @@ ! https://github.com/DandelionSprout/adfilt/issues/71 ||imgvieweriri.com^ -! Japanese scam -! https://github.com/AdguardTeam/AdguardFilters/issues/58737 -/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$document,fun - ! Placeholder line for alternate list versions diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index fbee1f0bb..c4054606d 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,9 +1,9 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 30July2020v1-Beta +# Version: 13August2020v1-Beta # Expires: 5 days # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. -# β€”β€”β€” Country domains β€”β€”β€” +# β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. # Tokelau @@ -17,10 +17,7 @@ # Palau - -# β€”β€”β€” Topical domains β€”β€”β€” -# These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. -# Presumably fake loans +# International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. @@ -33,7 +30,8 @@ # β€”β€”β€” For Google Mobile β€”β€”β€” -# β€”β€”β€” Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +# β€”β€”β€” Old dead tech-related domains β€”β€”β€” +# Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. adblock.gjtech.net spam404bl.com 109.201.135.46 @@ -46,11 +44,31 @@ everythingisnt.com vin-plastiks.com adblock-listefr.com intr0.cf - -# β€”β€”β€” Old tech-related domains that have fallen into the hands of questionable new owners. β€”β€”β€” +njabl.org +dutchmega.nl +juvander.net +# Malicious domains found in videogame manuals +acclaimsports.com +acclaimmaxsports.com +hip-games.com +thq.com.au +gp32.com +# Dead router connection URΔ°s # To log in to TP-Link routers, use tplinkwifi.net instead. tplinklogin.net tplinkextender.net +# Old Linux-related domains +# How these links still remain in Unetbootin, is anyone's guess. +dreamlinux.com.br +dreamlinux.net +dreamlinux.info +104.24.117.74 +104.24.116.74 +[2606:4700:30::6818:754a] +[2606:4700:30::6818:744a] +hacktolive.org +mandriva.com +# Other ublock.org 138.68.252.54 @@ -66,33 +84,19 @@ iqtestonline24.com test-iq.org officialiqtests.com -# β€”β€”β€” Old Linux-related domains that have been snapped up for ads, adware, and/or malware. β€”β€”β€” -# How these links still remain in Unetbootin, is anyone's guess. -dreamlinux.com.br -dreamlinux.net -dreamlinux.info -104.24.117.74 -104.24.116.74 -[2606:4700:30::6818:754a] -[2606:4700:30::6818:744a] -hacktolive.org -mandriva.com +# β€”β€”β€” Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware β€”β€”β€” +# ReImagePlus (Also added to "uBlock Filters - Badware Risks") -# β€”β€”β€” ReImagePlus links (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” - - -# β€”β€”β€” ScanUtilities links β€”β€”β€” - -# β€”β€”β€” Driver Easy links β€”β€”β€” - -# β€”β€”β€” Slimware DriverUpdate links β€”β€”β€” - -# β€”β€”β€” Driverpack Online links (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») β€”β€”β€” +# ScanUtilities +# Driver Easy +# Slimware DriverUpdate +# Driverpack Online (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») google-analytics.com +# SpyHunter links + +# Common scam domain patterns -# β€”β€”β€” SpyHunter links β€”β€”β€” -# β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” @@ -182,6 +186,7 @@ zeroredirect5.com 3.226.8.132 3.216.243.46 maowaotodowoo.net +roamingclicks.com # Source: demonoid.pw veremund-hon.com # Source: desidert.no @@ -195,13 +200,6 @@ ttnrd.com # β€”β€”β€” Found in random witness reports online β€”β€”β€” deviuser.com -# β€”β€”β€” Malicious domains found in videogame manuals β€”β€”β€” -acclaimsports.com -acclaimmaxsports.com -hip-games.com -thq.com.au -gp32.com - # β€”β€”β€” Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” # Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. unofficialtwrp.com @@ -242,7 +240,4 @@ rgithub.com # β€”β€”β€” User-submitted entries β€”β€”β€” imgvieweriri.com -# Japanese scam - - diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index 20b3d69bb..3c55fdb25 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,9 +1,9 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Β«hostsΒ» file version) -# Version: 30July2020v1-Alpha +# Version: 13August2020v1-Alpha # Expires: 5 days # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. -# β€”β€”β€” Country domains β€”β€”β€” +# β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. # Tokelau @@ -17,10 +17,7 @@ # Palau - -# β€”β€”β€” Topical domains β€”β€”β€” -# These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. -# Presumably fake loans +# International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. @@ -33,7 +30,8 @@ # β€”β€”β€” For Google Mobile β€”β€”β€” -# β€”β€”β€” Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +# β€”β€”β€” Old dead tech-related domains β€”β€”β€” +# Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. 127.0.0.1 adblock.gjtech.net 127.0.0.1 spam404bl.com 127.0.0.1 109.201.135.46 @@ -46,11 +44,31 @@ 127.0.0.1 vin-plastiks.com 127.0.0.1 adblock-listefr.com 127.0.0.1 intr0.cf - -# β€”β€”β€” Old tech-related domains that have fallen into the hands of questionable new owners. β€”β€”β€” +127.0.0.1 njabl.org +127.0.0.1 dutchmega.nl +127.0.0.1 juvander.net +# Malicious domains found in videogame manuals +127.0.0.1 acclaimsports.com +127.0.0.1 acclaimmaxsports.com +127.0.0.1 hip-games.com +127.0.0.1 thq.com.au +127.0.0.1 gp32.com +# Dead router connection URΔ°s # To log in to TP-Link routers, use tplinkwifi.net instead. 127.0.0.1 tplinklogin.net 127.0.0.1 tplinkextender.net +# Old Linux-related domains +# How these links still remain in Unetbootin, is anyone's guess. +127.0.0.1 dreamlinux.com.br +127.0.0.1 dreamlinux.net +127.0.0.1 dreamlinux.info +127.0.0.1 104.24.117.74 +127.0.0.1 104.24.116.74 +:: 2606:4700:30::6818:754a +:: 2606:4700:30::6818:744a +127.0.0.1 hacktolive.org +127.0.0.1 mandriva.com +# Other 127.0.0.1 ublock.org www.ublock.org demo.ublock.org 127.0.0.1 138.68.252.54 @@ -66,33 +84,19 @@ 127.0.0.1 test-iq.org 127.0.0.1 officialiqtests.com -# β€”β€”β€” Old Linux-related domains that have been snapped up for ads, adware, and/or malware. β€”β€”β€” -# How these links still remain in Unetbootin, is anyone's guess. -127.0.0.1 dreamlinux.com.br -127.0.0.1 dreamlinux.net -127.0.0.1 dreamlinux.info -127.0.0.1 104.24.117.74 -127.0.0.1 104.24.116.74 -:: 2606:4700:30::6818:754a -:: 2606:4700:30::6818:744a -127.0.0.1 hacktolive.org -127.0.0.1 mandriva.com +# β€”β€”β€” Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware β€”β€”β€” +# ReImagePlus (Also added to "uBlock Filters - Badware Risks") -# β€”β€”β€” ReImagePlus links (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” - - -# β€”β€”β€” ScanUtilities links β€”β€”β€” - -# β€”β€”β€” Driver Easy links β€”β€”β€” - -# β€”β€”β€” Slimware DriverUpdate links β€”β€”β€” - -# β€”β€”β€” Driverpack Online links (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») β€”β€”β€” +# ScanUtilities +# Driver Easy +# Slimware DriverUpdate +# Driverpack Online (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») 127.0.0.1 google-analytics.com +# SpyHunter links + +# Common scam domain patterns -# β€”β€”β€” SpyHunter links β€”β€”β€” -# β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” @@ -182,12 +186,13 @@ 127.0.0.1 3.226.8.132 127.0.0.1 3.216.243.46 127.0.0.1 maowaotodowoo.net +127.0.0.1 roamingclicks.com # Source: demonoid.pw 127.0.0.1 veremund-hon.com # Source: desidert.no 127.0.0.1 collectfasttracks.com # Source: vn-zoom.com -127.0.0.1 ttnrd.com +127.0.0.1 ttnrd.com www.ttnrd.com amanda.ttnrd.com katie.ttnrd.com briana.ttnrd.com sarah.ttnrd.com pamela.ttnrd.com 127.0.0.1 54.152.245.247 127.0.0.1 35.172.40.232 127.0.0.1 3.90.125.85 @@ -195,13 +200,6 @@ # β€”β€”β€” Found in random witness reports online β€”β€”β€” 127.0.0.1 deviuser.com -# β€”β€”β€” Malicious domains found in videogame manuals β€”β€”β€” -127.0.0.1 acclaimsports.com -127.0.0.1 acclaimmaxsports.com -127.0.0.1 hip-games.com -127.0.0.1 thq.com.au -127.0.0.1 gp32.com - # β€”β€”β€” Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” # Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. 127.0.0.1 unofficialtwrp.com @@ -242,7 +240,4 @@ # β€”β€”β€” User-submitted entries β€”β€”β€” 127.0.0.1 imgvieweriri.com -# Japanese scam - - diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index db41a5ea6..93360e503 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,11 +1,11 @@ {+block} # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 30July2020v1-Alpha +# Version: 13August2020v1-Alpha # Expires: 5 days # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. {+block} -# β€”β€”β€” Country domains β€”β€”β€” +# β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. # Tokelau .tk @@ -19,11 +19,7 @@ .cf # Palau .pw - -{+block} -# β€”β€”β€” Topical domains β€”β€”β€” -# These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. -# Presumably fake loans +# International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. .loan .agency .gdn @@ -40,7 +36,8 @@ # β€”β€”β€” For Google Mobile β€”β€”β€” {+block} -# β€”β€”β€” Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +# β€”β€”β€” Old dead tech-related domains β€”β€”β€” +# Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. .adblock.gjtech.net .spam404bl.com .109.201.135.46 @@ -53,12 +50,31 @@ .vin-plastiks.com .adblock-listefr.com .intr0.cf - -{+block} -# β€”β€”β€” Old tech-related domains that have fallen into the hands of questionable new owners. β€”β€”β€” +.njabl.org +.dutchmega.nl +.juvander.net +# Malicious domains found in videogame manuals +.acclaimsports.com +.acclaimmaxsports.com +.hip-games.com +.thq.com.au +.gp32.com +# Dead router connection URΔ°s # To log in to TP-Link routers, use tplinkwifi.net instead. .tplinklogin.net .tplinkextender.net +# Old Linux-related domains +# How these links still remain in Unetbootin, is anyone's guess. +.dreamlinux.com.br +.dreamlinux.net +.dreamlinux.info +.104.24.117.74 +.104.24.116.74 +.[2606:4700:30::6818:754a] +.[2606:4700:30::6818:744a] +.hacktolive.org +.mandriva.com +# Other .ublock.org .138.68.252.54 @@ -76,40 +92,17 @@ .officialiqtests.com {+block} -# β€”β€”β€” Old Linux-related domains that have been snapped up for ads, adware, and/or malware. β€”β€”β€” -# How these links still remain in Unetbootin, is anyone's guess. -.dreamlinux.com.br -.dreamlinux.net -.dreamlinux.info -.104.24.117.74 -.104.24.116.74 -.[2606:4700:30::6818:754a] -.[2606:4700:30::6818:744a] -.hacktolive.org -.mandriva.com - -{+block} -# β€”β€”β€” ReImagePlus links (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +# β€”β€”β€” Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware β€”β€”β€” +# ReImagePlus (Also added to "uBlock Filters - Badware Risks") .majorgeeks.com/images/icons/red_icon_18x17px.png - -{+block} -# β€”β€”β€” ScanUtilities links β€”β€”β€” - -{+block} -# β€”β€”β€” Driver Easy links β€”β€”β€” - -{+block} -# β€”β€”β€” Slimware DriverUpdate links β€”β€”β€” - -{+block} -# β€”β€”β€” Driverpack Online links (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») β€”β€”β€” +# ScanUtilities +# Driver Easy +# Slimware DriverUpdate +# Driverpack Online (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») .google-analytics.com +# SpyHunter links -{+block} -# β€”β€”β€” SpyHunter links β€”β€”β€” - -{+block} -# β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” +# Common scam domain patterns /(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/ {+block} @@ -210,6 +203,7 @@ .3.226.8.132 .3.216.243.46 .maowaotodowoo.net +.roamingclicks.com # Source: demonoid.pw .veremund-hon.com # Source: desidert.no @@ -229,14 +223,6 @@ # β€”β€”β€” Found in random witness reports online β€”β€”β€” .deviuser.com -{+block} -# β€”β€”β€” Malicious domains found in videogame manuals β€”β€”β€” -.acclaimsports.com -.acclaimmaxsports.com -.hip-games.com -.thq.com.au -.gp32.com - {+block} # β€”β€”β€” Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” # Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. @@ -286,8 +272,6 @@ # β€”β€”β€” User-submitted entries β€”β€”β€” .imgvieweriri.com -# Japanese scam - {-block} # Manually updated Privoxy version of the whitelisted domains from the other versions of this list. .coolcmd.tk diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index 8a179adcd..dfdbae4a4 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,12 +1,12 @@ msFilterList # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 30July2020v1-Beta +# Version: 13August2020v1-Beta : expires = 5 # Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists # For more information, details, helpful tools, and other lists that I've made, visit https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english -# β€”β€”β€” Country domains β€”β€”β€” +# β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. # Tokelau -d tk @@ -58,10 +58,7 @@ msFilterList +d libgen.pw +d petridish.pw +d palaugov.pw - -# β€”β€”β€” Topical domains β€”β€”β€” -# These are topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. -# Presumably fake loans +# International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent. @@ -75,7 +72,8 @@ msFilterList # β€”β€”β€” For Google Mobile β€”β€”β€” # Note for Firefox on Android users: I strongly recommend the use of https://addons.mozilla.org/firefox/addon/google-search-fixer/ for use on Firefox for Android, thus the entries are written for the Chrome version of Google Mobile. -# β€”β€”β€” Dead domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +# β€”β€”β€” Old dead tech-related domains β€”β€”β€” +# Domains that used to host lists for adblockers or "hosts" tools, but which are now either used by malware pushers, or could potentially be snapped up by them. -d adblock.gjtech.net -d spam404bl.com -d 109.201.135.46 @@ -88,11 +86,31 @@ msFilterList -d vin-plastiks.com -d adblock-listefr.com -d intr0.cf - -# β€”β€”β€” Old tech-related domains that have fallen into the hands of questionable new owners. β€”β€”β€” +-d njabl.org +-d dutchmega.nl +-d juvander.net +# Malicious domains found in videogame manuals +-d acclaimsports.com +-d acclaimmaxsports.com +-d hip-games.com +-d thq.com.au +-d gp32.com +# Dead router connection URΔ°s # To log in to TP-Link routers, use tplinkwifi.net instead. -d tplinklogin.net -d tplinkextender.net +# Old Linux-related domains +# How these links still remain in Unetbootin, is anyone's guess. +-d dreamlinux.com.br +-d dreamlinux.net +-d dreamlinux.info +-d 104.24.117.74 +-d 104.24.116.74 +-d [2606:4700:30::6818:754a] +-d [2606:4700:30::6818:744a] +-d hacktolive.org +-d mandriva.com +# Other -d ublock.org -d 138.68.252.54 @@ -108,19 +126,8 @@ msFilterList -d test-iq.org -d officialiqtests.com -# β€”β€”β€” Old Linux-related domains that have been snapped up for ads, adware, and or malware. β€”β€”β€” -# How these links still remain in Unetbootin, is anyone's guess. --d dreamlinux.com.br --d dreamlinux.net --d dreamlinux.info --d 104.24.117.74 --d 104.24.116.74 --d [2606:4700:30::6818:754a] --d [2606:4700:30::6818:744a] --d hacktolive.org --d mandriva.com - -# β€”β€”β€” ReImagePlus links (Also added to "uBlock Filters - Badware Risks") β€”β€”β€” +# β€”β€”β€” Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware β€”β€”β€” +# ReImagePlus (Also added to "uBlock Filters - Badware Risks") # https://windowsreport.com/extend-windows-laptop-battery-life/ # https://appuals.com/fix-error-0x800701e3-on-windows-7-8-1-10/ # https://ugetfix.com/ask/how-to-fix-windows-store-error-0x8000ffff/ @@ -128,30 +135,28 @@ msFilterList # https://www.majorgeeks.com/files/details/patch_my_pc.html -d majorgeeks.com images icons red_icon_18x17px.png # https://www.2-spyware.com/remove-redirector-gvt1-com.html - -# β€”β€”β€” ScanUtilities links β€”β€”β€” +# ScanUtilities # https://www.bynarycodes.com/fix-windows-10-update-error-0x80070006/ - -# β€”β€”β€” Driver Easy links β€”β€”β€” +# Driver Easy # https://www.drivereasy.com/knowledge/fix-critical-service-failed-blue-screen-error-on-windows-10/ # https://www.drivereasy.com/knowledge/fixed-how-to-fix-stop-error-0x0000001e/ # https://www.drivereasy.com/knowledge/download-gigabyte-audio-driver/ # https://www.drivereasy.com/knowledge/epson-xp-420-driver-update-for-windows-7-8-and-10/ # https://www.drivereasy.com/knowledge/solved-this-display-does-not-support-hdcp/ - -# β€”β€”β€” Slimware DriverUpdate links β€”β€”β€” +# Slimware DriverUpdate # https://forums.windowscentral.com/ - -# β€”β€”β€” Driverpack Online links (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») β€”β€”β€” +# Driverpack Online (Accidentally also fixed in EasyPrivacy and Β«AdGuard Mobile AdsΒ») -d google-analytics.com - -# β€”β€”β€” SpyHunter links β€”β€”β€” +# SpyHunter links # https://howtoremove.guide/redirector-gvt1-com-virus-malware-chrome-removal/ # https://www.2-spyware.com/remove-redirector-gvt1-com.html -# β€”β€”β€” Sites that fraudulently claim you've won a new phone β€”β€”β€” +# Common scam domain patterns - (apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live) +# https://github.com/AdguardTeam/AdguardFilters/issues/58737 + + # β€”β€”β€” Banner for "MSN New Tab" β€”β€”β€” @@ -246,6 +251,7 @@ msFilterList -d 3.226.8.132 -d 3.216.243.46 -d maowaotodowoo.net +-d roamingclicks.com # Source: demonoid.pw -d veremund-hon.com # Source: desidert.no @@ -265,13 +271,6 @@ msFilterList # https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 -d deviuser.com -# β€”β€”β€” Malicious domains found in videogame manuals β€”β€”β€” --d acclaimsports.com --d acclaimmaxsports.com --d hip-games.com --d thq.com.au --d gp32.com - # β€”β€”β€” Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” # Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and or bricking the phone. -d unofficialtwrp.com @@ -317,8 +316,4 @@ msFilterList # https://github.com/DandelionSprout/adfilt/issues/71 -d imgvieweriri.com -# Japanese scam -# https://github.com/AdguardTeam/AdguardFilters/issues/58737 - - # Placeholder line for alternate list versions