Add files via upload

This commit is contained in:
Imre Eilertsen
2026-03-24 17:29:47 +01:00
committed by GitHub
parent fe2c2b68a4
commit dc61b6639b
7 changed files with 195 additions and 13 deletions
@@ -1,6 +1,6 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List (for Adblock Plus 3.x and Adblock Plus on Firefox)
! Version: 26February2026v1
! Version: 24March2026v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -9,7 +9,7 @@
! As of June 2023, Pi-Hole FTL ≥5.22 users should rather use https://raw.githubusercontent.com/DandelionSprout/adfilt/refs/heads/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, which is a ||-type list version designed specifically for DNS tools.
! Legitimate use is almost non-existent, but has a tiny userbase in Japan and among upstart coding experiments. Its extreme common-ness in malware redirections means that the entry will be kept forever.
||top^$domain=~caitlin.top|~callmebymygender.top|~corriente.top|~gdtot.top|~nicenature.top|~reminder.top|~magocoro.top|~castlevania.top|~suiten.top|~shucks.top|~1stream.top|~ambr.top|~changlam10.top|~changlam11.top|~pdcdn1.top|~pressplay.top|~chillx.top|~strims.top|~thedesk.top|~audioforyou.top|~awavenue.top|~reyhub.top|~iboxs.top|~adrules.top|~hostingowy.top|~to|~yggtorrent.top|~asiaon.top|~voxel.top|~passt.top|~polar.top|~rifton.top|~rugaming.top|~doubledouble.top|~hedon-haven.top
||top^$domain=~caitlin.top|~callmebymygender.top|~corriente.top|~gdtot.top|~nicenature.top|~reminder.top|~magocoro.top|~castlevania.top|~suiten.top|~shucks.top|~1stream.top|~ambr.top|~changlam10.top|~changlam11.top|~pdcdn1.top|~pressplay.top|~chillx.top|~strims.top|~thedesk.top|~audioforyou.top|~awavenue.top|~reyhub.top|~iboxs.top|~adrules.top|~hostingowy.top|~to|~yggtorrent.top|~yggleak.top|~asiaon.top|~voxel.top|~passt.top|~polar.top|~rifton.top|~rugaming.top|~doubledouble.top|~hedon-haven.top
! (Loosely inspired by https://github.com/DandelionSprout/adfilt/issues/1067)
@@||masto*.top^
@@/^.*(tech|project|linux).*\.top(/[a-z0-9_-]?.*)?$/
@@ -20660,8 +20660,7 @@ http://secured21.*.com/|$popup
||adbuho.shop^$popup
||againstmor.store^
||againstmor.store^$popup
||blizzboygames.net^
||blizzboygames.net^$popup
||blizzboygames.net^$all,domain=~contains_fraudulent_fake_installer_files.*
||cherriescoil.xyz^
||cherriescoil.xyz^$popup
||cumguns.online^
@@ -25600,6 +25599,12 @@ drvhub.net##.driver-item__install
||hubygvftc.cfd^$popup
||audioza.cyou^
||audioza.cyou^$popup
! https://www.reddit.com/r/uBlockOrigin/comments/1rqgj9d/ubo_some_scamsmalware_sites_arent_blocked/
! https://app.any.run/tasks/dd05e9da-400a-4936-8ea0-d440fa0887e0
||rpcs4.com^
||rpcs4.com^$popup
||rpcs5.com^
||rpcs5.com^$popup
! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
@@ -26349,6 +26354,29 @@ www.google.com,ipv6.google.com,google.ac,google.ad,google.ae,google.af,google.ag
! Sus(picious) search results for YouTube videos that claim to have craсks for Adоbe products. (https://github.com/DandelionSprout/adfilt/issues/1197)
! Various E-mail spams' links
||statautos.com^
||statautos.com^$popup
/noo/taxx/*
||solitanh.site^
||floraltepi.site^
||arlonb.my^
||astonishedsound.com^
||avibary.com^
||buysalesclub.com^
||corlmedi.com^
||csstudyhub.com^
||hxzf4er.com^
||k2krl7zj.com^
||mcafee.sjv.io^
||ojrq.net^
||oninebest.com^
||ormediao.com^
||paramatise.com^
||watchterm.com^
||185.176.220.31^
! ——— Entries that are and/or were in "uBlock Filters — Ads" and/or "uBlock Filters — Badware Risks" but which aren't in AdGuard Base or EasyList ———
! https://github.com/DandelionSprout/adfilt/pull/395
@@ -1,6 +1,6 @@

! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard)
! Version: 26February2026v1
! Version: 24March2026v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -8,7 +8,7 @@
! Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#-english
! Legitimate use is almost non-existent, but has a tiny userbase in Japan and among upstart coding experiments. Its extreme common-ness in malware redirections means that the entry will be kept forever.
||top^$document,domain=~caitlin.top|~callmebymygender.top|~corriente.top|~gdtot.top|~nicenature.top|~reminder.top|~magocoro.top|~castlevania.top|~suiten.top|~shucks.top|~1stream.top|~ambr.top|~changlam10.top|~changlam11.top|~pdcdn1.top|~pressplay.top|~chillx.top|~strims.top|~thedesk.top|~audioforyou.top|~awavenue.top|~reyhub.top|~iboxs.top|~adrules.top|~hostingowy.top|~to|~yggtorrent.top|~asiaon.top|~voxel.top|~passt.top|~polar.top|~rifton.top|~rugaming.top|~doubledouble.top|~hedon-haven.top
||top^$document,domain=~caitlin.top|~callmebymygender.top|~corriente.top|~gdtot.top|~nicenature.top|~reminder.top|~magocoro.top|~castlevania.top|~suiten.top|~shucks.top|~1stream.top|~ambr.top|~changlam10.top|~changlam11.top|~pdcdn1.top|~pressplay.top|~chillx.top|~strims.top|~thedesk.top|~audioforyou.top|~awavenue.top|~reyhub.top|~iboxs.top|~adrules.top|~hostingowy.top|~to|~yggtorrent.top|~yggleak.top|~asiaon.top|~voxel.top|~passt.top|~polar.top|~rifton.top|~rugaming.top|~doubledouble.top|~hedon-haven.top
! (Loosely inspired by https://github.com/DandelionSprout/adfilt/issues/1067)
@@||masto*.top^$document
@@/^.*(tech|project|linux).*\.top(/[a-z0-9_-]?.*)?$/$document
@@ -11927,7 +11927,7 @@ http://secured21.*.com/|$all
23.22.126.183$all,ipaddress
||adbuho.shop^$all
||againstmor.store^$all
||blizzboygames.net^$all
||blizzboygames.net^$all,domain=~contains_fraudulent_fake_installer_files.*
||cherriescoil.xyz^$all
||cumguns.online^$all
||floridistor.icu^$all
@@ -15049,6 +15049,10 @@ drvhub.net##.driver-item__install
||edweasdxf.pro^$all
||hubygvftc.cfd^$all
||audioza.cyou^$all
! https://www.reddit.com/r/uBlockOrigin/comments/1rqgj9d/ubo_some_scamsmalware_sites_arent_blocked/
! https://app.any.run/tasks/dd05e9da-400a-4936-8ea0-d440fa0887e0
||rpcs4.com^$all
||rpcs5.com^$all
! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
@@ -15705,6 +15709,30 @@ www.google.*,ipv6.google.com##div[data-attrid^="images "]:has(a[href*=".aspx?cna
! Sus(picious) search results for YouTube videos that claim to have craсks for Adоbe products. (https://github.com/DandelionSprout/adfilt/issues/1197)
google.*###rso > div[class]:has(h3:has-text(/^.*(H\ow\st\o|fre{2})\s(\instal{2}|d\ownl\oad).*$/i):has-text(/^.*(ph\ot\osh\op|dav\inc\i|\il{2}ustrat\or).*$/i):has-text(/^.*(fre{2}|(cr|h)ack).*$/i))
! Various E-mail spams' links
||statautos.com^$all
/noo/taxx/*$document
||solitanh.site^$document
||floraltepi.site^$document
||arlonb.my^$document
||astonishedsound.com^$document
||avibary.com^$document
||buysalesclub.com^$document
||corlmedi.com^$document
||csstudyhub.com^$document
||hxzf4er.com^$document
||k2krl7zj.com^$document
||mcafee.sjv.io^$document
||ojrq.net^$document
||oninebest.com^$document
||ormediao.com^$document
||paramatise.com^$document
||watchterm.com^$document
!+ NOT_PLATFORM(windows, mac, android, cli)
||185.176.220.31^$document
!+ PLATFORM(windows, mac, android, cli)
185.176.220.31$network
!#if !ext_ublock
! ——— Entries that are and/or were in "uBlock Filters — Ads" and/or "uBlock Filters — Badware Risks" but which aren't in AdGuard Base or EasyList ———
! https://github.com/DandelionSprout/adfilt/pull/395
@@ -1,12 +1,12 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows/macOS' DNS filtering, and Pi-Hole FTL ≥5.22)
! Version: 26February2026v1
! Version: 24March2026v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
! Legitimate use is almost non-existent, but has a tiny userbase in Japan and among upstart coding experiments. Its extreme common-ness in malware redirections means that the entry will be kept forever.
||*.top^$dnstype=~CNAME,denyallow=caitlin.top|callmebymygender.top|corriente.top|gdtot.top|nicenature.top|reminder.top|magocoro.top|castlevania.top|suiten.top|shucks.top|1stream.top|ambr.top|changlam10.top|changlam11.top|pdcdn1.top|pressplay.top|chillx.top|strims.top|thedesk.top|audioforyou.top|awavenue.top|reyhub.top|iboxs.top|adrules.top|hostingowy.top|to|yggtorrent.top|asiaon.top|voxel.top|passt.top|polar.top|rifton.top|rugaming.top|doubledouble.top|hedon-haven.top
||*.top^$dnstype=~CNAME,denyallow=caitlin.top|callmebymygender.top|corriente.top|gdtot.top|nicenature.top|reminder.top|magocoro.top|castlevania.top|suiten.top|shucks.top|1stream.top|ambr.top|changlam10.top|changlam11.top|pdcdn1.top|pressplay.top|chillx.top|strims.top|thedesk.top|audioforyou.top|awavenue.top|reyhub.top|iboxs.top|adrules.top|hostingowy.top|to|yggtorrent.top|yggleak.top|asiaon.top|voxel.top|passt.top|polar.top|rifton.top|rugaming.top|doubledouble.top|hedon-haven.top
! (Loosely inspired by https://github.com/DandelionSprout/adfilt/issues/1067)
@@||masto*.top^
@@/^.*(tech|project|linux).*\.top$/
@@ -12618,6 +12618,10 @@ http://secured21.*.com/|
||edweasdxf.pro^
||hubygvftc.cfd^
||audioza.cyou^
! https://www.reddit.com/r/uBlockOrigin/comments/1rqgj9d/ubo_some_scamsmalware_sites_arent_blocked/
! https://app.any.run/tasks/dd05e9da-400a-4936-8ea0-d440fa0887e0
||rpcs4.com^
||rpcs5.com^
! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
||unofficialtwrp.com^
@@ -12847,6 +12851,25 @@ http://secured21.*.com/|
185.53.178.54
! Bouncing hard-to-close (but admittedly empty) popups on NSFW sites like viperTO
! Sus(picious) search results for YouTube videos that claim to have craсks for Adоbe products. (https://github.com/DandelionSprout/adfilt/issues/1197)
! Various E-mail spams' links
||statautos.com^
||solitanh.site^
||floraltepi.site^
||arlonb.my^
||astonishedsound.com^
||avibary.com^
||buysalesclub.com^
||corlmedi.com^
||csstudyhub.com^
||hxzf4er.com^
||k2krl7zj.com^
||mcafee.sjv.io^
||ojrq.net^
||oninebest.com^
||ormediao.com^
||paramatise.com^
||watchterm.com^
185.176.220.31
! ——— Entries that are and/or were in "uBlock Filters — Ads" and/or "uBlock Filters — Badware Risks" but which aren't in AdGuard Base or EasyList ———
! https://github.com/DandelionSprout/adfilt/pull/395
! https://www•huorong•cn/info/1531309921141.html
@@ -1,5 +1,5 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version)
# Version: 26February2026v1
# Version: 24March2026v1
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Note: The very limited syntax available to raw domains lists, considering it's, well, raw, means that outright anti-MV3 measures (which'd as of February 2024 only affect Minus, a project whose name is unworthy of the uBO label; AdGuard browser extensions has no relevant support for raw domains either way) cannot be done. However, at some 20,000 entries, Team Chromium's shameful leaders aren't liking this list anyway.
@@ -13675,6 +13675,10 @@ tvgyfdtrf.pro
edweasdxf.pro
hubygvftc.cfd
audioza.cyou
# https://www.reddit.com/r/uBlockOrigin/comments/1rqgj9d/ubo_some_scamsmalware_sites_arent_blocked/
# https://app.any.run/tasks/dd05e9da-400a-4936-8ea0-d440fa0887e0
rpcs4.com
rpcs5.com
# ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
# Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
@@ -13987,6 +13991,28 @@ yellowdragon.com
# Sus(picious) search results for YouTube videos that claim to have craсks for Adоbe products. (https://github.com/DandelionSprout/adfilt/issues/1197)
# Various E-mail spams' links
statautos.com
solitanh.site
floraltepi.site
arlonb.my
astonishedsound.com
avibary.com
buysalesclub.com
corlmedi.com
csstudyhub.com
hxzf4er.com
k2krl7zj.com
mcafee.sjv.io
ojrq.net
oninebest.com
ormediao.com
paramatise.com
watchterm.com
185.176.220.31
# ——— Entries that are and/or were in "uBlock Filters — Ads" and/or "uBlock Filters — Badware Risks" but which aren't in AdGuard Base or EasyList ———
# https://github.com/DandelionSprout/adfilt/pull/395
@@ -1,5 +1,5 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version)
# Version: 26February2026v1
# Version: 24March2026v1
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Users of Pi-Hole FTL 5.22 and later can consider switching to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/refs/heads/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, due to an unconfirmed belief of mine that it allows better wildcarding than the Hosts and raw-domains versions.
@@ -13622,6 +13622,10 @@
127.0.0.1 edweasdxf.pro
127.0.0.1 hubygvftc.cfd
127.0.0.1 audioza.cyou
# https://www.reddit.com/r/uBlockOrigin/comments/1rqgj9d/ubo_some_scamsmalware_sites_arent_blocked/
# https://app.any.run/tasks/dd05e9da-400a-4936-8ea0-d440fa0887e0
127.0.0.1 rpcs4.com
127.0.0.1 rpcs5.com
# ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
# Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
@@ -13919,6 +13923,28 @@
# Sus(picious) search results for YouTube videos that claim to have craсks for Adоbe products. (https://github.com/DandelionSprout/adfilt/issues/1197)
# Various E-mail spams' links
127.0.0.1 statautos.com
127.0.0.1 solitanh.site
127.0.0.1 floraltepi.site
127.0.0.1 arlonb.my
127.0.0.1 astonishedsound.com
127.0.0.1 avibary.com
127.0.0.1 buysalesclub.com
127.0.0.1 corlmedi.com
127.0.0.1 csstudyhub.com
127.0.0.1 hxzf4er.com
127.0.0.1 k2krl7zj.com
127.0.0.1 mcafee.sjv.io
127.0.0.1 ojrq.net
127.0.0.1 oninebest.com
127.0.0.1 ormediao.com
127.0.0.1 paramatise.com
127.0.0.1 watchterm.com
127.0.0.1 185.176.220.31
# ——— Entries that are and/or were in "uBlock Filters — Ads" and/or "uBlock Filters — Badware Risks" but which aren't in AdGuard Base or EasyList ———
# https://github.com/DandelionSprout/adfilt/pull/395
@@ -1,6 +1,6 @@
{+block}
# Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy)
# Version: 26February2026v1-Deprecated
# Version: 24March2026v1-Deprecated
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -13233,6 +13233,8 @@
.edweasdxf.pro
.hubygvftc.cfd
.audioza.cyou
.rpcs4.com
.rpcs5.com
{+block}
# ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
@@ -13475,6 +13477,28 @@
.to/popconsole.php
# Various E-mail spams' links
.statautos.com
/noo/taxx/*
.solitanh.site
.floraltepi.site
.arlonb.my
.astonishedsound.com
.avibary.com
.buysalesclub.com
.corlmedi.com
.csstudyhub.com
.hxzf4er.com
.k2krl7zj.com
.mcafee.sjv.io
.ojrq.net
.oninebest.com
.ormediao.com
.paramatise.com
.watchterm.com
.185.176.220.31
{+block}
# ——— Entries that are and/or were in "uBlock Filters — Ads" and/or "uBlock Filters — Badware Risks" but which aren't in AdGuard Base or EasyList ———
@@ -1,6 +1,6 @@
msFilterList
# Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL)
# Version: 26February2026v1-Deprecated
# Version: 24March2026v1-Deprecated
: expires = 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -36,6 +36,7 @@
+d hostingowy.top
+d to
+d yggtorrent.top
+d yggleak.top
+d asiaon.top
+d voxel.top
+d passt.top
@@ -13663,6 +13664,10 @@ ed.br ?q=artstation-
-d edweasdxf.pro
-d hubygvftc.cfd
-d audioza.cyou
# https://www.reddit.com/r/uBlockOrigin/comments/1rqgj9d/ubo_some_scamsmalware_sites_arent_blocked/
# https://app.any.run/tasks/dd05e9da-400a-4936-8ea0-d440fa0887e0
-d rpcs4.com
-d rpcs5.com
# ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
# Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and or bricking the phone.
@@ -13905,6 +13910,28 @@ o popconsole.php
# Sus(picious) search results for YouTube videos that claim to have craсks for Adоbe products. (https://github.com/DandelionSprout/adfilt/issues/1197)
# Various E-mail spams' links
-d statautos.com
- noo taxx *
-d solitanh.site
-d floraltepi.site
-d arlonb.my
-d astonishedsound.com
-d avibary.com
-d buysalesclub.com
-d corlmedi.com
-d csstudyhub.com
-d hxzf4er.com
-d k2krl7zj.com
-d mcafee.sjv.io
-d ojrq.net
-d oninebest.com
-d ormediao.com
-d paramatise.com
-d watchterm.com
-d 185.176.220.31
# ——— Entries that are and or were in "uBlock Filters — Ads" and or "uBlock Filters — Badware Risks" but which aren't in AdGuard Base or EasyList ———
# https://github.com/DandelionSprout/adfilt/pull/395