From c25a1b31683f3948c8a18e4166f5cd93400770c9 Mon Sep 17 00:00:00 2001 From: Yuki2718 Date: Thu, 9 Jul 2020 01:04:17 +0900 Subject: [PATCH 1/2] Update for the latest lucky visitor scam + adding Japanese scam --- Dandelion Sprout's Anti-Malware List.txt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 589996d81..79f1998e2 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -183,7 +183,8 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(SpyHunter) ! ——— Sites that fraudulently claim you've won a new phone ——— -/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$1p,doc,domain=~ Warning displayed due to: Fraudulently claims you have won a new phone. +/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)$/$1p,document,domain=icu|life|live +/^https://[a-z]{10,16}[0-9]{1,2}\.live/$document,domain=live ! ——— Banner for "MSN New Tab" ——— msn.com##.irisbanner @@ -411,4 +412,8 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! https://github.com/DandelionSprout/adfilt/issues/71 ||imgvieweriri.com^$all,domain=~ Warning shown due to: Used for Instagram credential thefts. +! Japanese scam +! https://github.com/AdguardTeam/AdguardFilters/issues/58737 +/^https://[0-9a-z]{15}\.fun/kjasdjhqwud\.php.*/$document,domain=fun + ! Placeholder line for alternate list versions From ef1a7dd7d932b2879ff04d64743508302c6bf5b6 Mon Sep 17 00:00:00 2001 From: Yuki2718 Date: Thu, 9 Jul 2020 01:06:41 +0900 Subject: [PATCH 2/2] Correction --- Dandelion Sprout's Anti-Malware List.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 79f1998e2..6c7ffe19e 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.4] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 26June2020v1-Beta +! Version: 08July2020v1-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -183,7 +183,7 @@ howtoremove.guide#?#.entry-content > div:-abp-contains(Special Offer) 2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk#?#a:-abp-contains(SpyHunter) ! ——— Sites that fraudulently claim you've won a new phone ——— -/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)$/$1p,document,domain=icu|life|live +/(apps?|best|competition|game|mobile|play|prize|reward|sweeps)[0-9]{2,8}\.[a-z-]{5,22}[0-9]{1,8}\.(icu|life|live)/$1p,document,domain=icu|life|live /^https://[a-z]{10,16}[0-9]{1,2}\.live/$document,domain=live ! ——— Banner for "MSN New Tab" ———