From f4ffd7dd779f82d88dc7ff5863a25ca672d6a885 Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Thu, 4 Jun 2020 20:52:09 +0200 Subject: [PATCH] Update Dandelion Sprout's Anti-Malware List.txt --- Dandelion Sprout's Anti-Malware List.txt | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt index 73e829da5..5b3f55941 100644 --- a/Dandelion Sprout's Anti-Malware List.txt +++ b/Dandelion Sprout's Anti-Malware List.txt @@ -1,8 +1,9 @@ [Adblock Plus 3.4] ! Title: 💊 Dandelion Sprout's Anti-Malware List -! Version: 04June2020v1-Beta +! Version: 04June2020v2-Beta ! Expires: 5 days ! Description: Most anti-malware lists are pretty big and can cover a 5- or 6-digit amount of specific domains. But my list hereby claims to remove more than 25% of all known malware sites with just a 2-digit amount of entries. This is mostly done by blocking top-level domains that have become devastatingly abused by spammers, usually because they allowed for free and uncontrolled domain registrations. There's also additional categories that cover unusual malware and phishing domains that very few other lists seem to cover. +! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists ! For more information, details, helpful tools, and other lists that I've made, visit https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#english ! ——— Country domains ——— @@ -309,23 +310,24 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ! Source: desidert.no ||collectfasttracks.com^$doc,domain=~ Warning displayed due to: A malware redirector used in hacks of various sites. +! ——— Found in random witness reports online ——— ! https://twitter.com/SUNgoddessOKAMI/status/1221295265195405315 ||deviuser.com^$doc -! Malicious domains found in videogame manuals +! ——— Malicious domains found in videogame manuals ——— ||acclaimsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now pushing malware. ||acclaimmaxsports.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but is now promoting fake consumer loans. ||hip-games.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. ||thq.com.au^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. ||gp32.com^$doc,domain=~ Warning shown due to: Domain found in old videogame manuals; but has now been parked at a dubious domain parker. -! Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones +! ——— Gobshite copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ——— ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. ||unofficialtwrp.com^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones. ||androidweblog.com^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones. ||hardreset.info^$doc,domain=~ Warning shown due to: Very bad copypasted Android rooting guides that will most likely brick recent phones. -! If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions +! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ——— !#if !ext_ublock !#if !adguard ||version.bind^ @@ -334,16 +336,16 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) !#endif !#endif -! Zero-width spaces/hyphens in lookalike domains +! ——— Zero-width spaces/hyphens in lookalike domains ——— ­*$doc,domain=~ Warning shown due to: The domain uses at least one fake spacing; which is a very clear sign of fraud sites. ​*$doc,domain=~ Warning shown due to: The domain uses at least one fake spacing; which is a very clear sign of fraud sites. -! These DNS resolver requests lead to localhost and can't ever receive a proper request +! ——— These DNS resolver requests lead to localhost and can't ever receive a proper request ——— ! https://github.com/AdguardTeam/AdGuardHome/issues/1705 ||0.168.192.in-addr.arpa^ ||1.168.192.in-addr.arpa^ -! Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. +! ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ——— ||githubus.com^ ||githubu.com^ ||githu.com^ @@ -353,7 +355,7 @@ addons.mozilla.org#?#li.SearchResult:-abp-contains(Adblocker.Global) ||githubuser.com^ ||rgithub.com^ -! User-submitted entries +! ——— User-submitted entries ——— ! https://github.com/DandelionSprout/adfilt/issues/71 ||imgvieweriri.com^$all,domain=~ Warning shown due to: Used for Instagram credential thefts.