Update Dandelion Sprout's Anti-Malware List.txt

This commit is contained in:
Imre Kristoffer Eilertsen
2020-06-04 20:52:09 +02:00
committed by GitHub
parent fedc4dfb6d
commit f4ffd7dd77
+10 -8
View File
@@ -1,8 +1,9 @@
[Adblock Plus 3.4]
! Title: 💊 Dandelion Sprout's Anti-Malware List
! Version: 04June2020v1-Beta
! Version: 04June2020v2-Beta
! Expires: 5 days
! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover.
! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
! For more information, details, helpful tools, and other lists that I've made, visit https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english
! ——— Country domains ———
@@ -309,23 +310,24 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
! Source: desidert.no
||collectfasttracks.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites.
! ——— Found in random witness reports online ———
! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315
||deviuser.com^$doc
! Malicious domains found in videogame manuals
! ——— Malicious domains found in videogame manuals ———
||acclaimsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now pushing malware.
||acclaimmaxsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now promoting fake consumer loans.
||hip-games.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker.
||thq.com.au^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker.
||gp32.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker.
! Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones
! ——— Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
||unofficialtwrp.com^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones.
||androidweblog.com^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones.
||hardreset.info^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones.
! If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions
! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
!#if !ext_ublock
!#if !adguard
||version.bind^
@@ -334,16 +336,16 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
!#endif
!#endif
! Zero-width spaces/hyphens in lookalike domains
! ——— Zero-width spaces/hyphens in lookalike domains ———
­*$doc,domain=~ Warning shown due to: The domain uses at least one fake spacing; which is a very clear sign of fraud sites.
​*$doc,domain=~ Warning shown due to: The domain uses at least one fake spacing; which is a very clear sign of fraud sites.
! These DNS resolver requests lead to localhost and can't ever receive a proper request
! ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ———
! https://github.com/AdguardTeam/AdGuardHome/issues/1705
||0.168.192.in-addr.arpa^
||1.168.192.in-addr.arpa^
! Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day.
! ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ———
||githubus.com^
||githubu.com^
||githu.com^
@@ -353,7 +355,7 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global)
||githubuser.com^
||rgithub.com^
! User-submitted entries
! ——— User-submitted entries ———
! https://github.com/DandelionSprout/adfilt/issues/71
||imgvieweriri.com^$all,domain=~ Warning shown due to: Used for Instagram credential thefts.