starred/adfilt
1
0
Fork 0
mirror of https://github.com/DandelionSprout/adfilt.git synced 2026-09-24 22:03:36 +01:00
Code Issues Packages Projects Releases 4 Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Imre Kristoffer Eilertsen
2024-01-08 01:25:34 +01:00
committed by GitHub
parent 70de570f52
commit f9e75edeee
8 changed files with 1119 additions and 1157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Alternate versions Anti-Malware List/AntiMalwareABP.txt
+309 -314
View File
File diff suppressed because it is too large Load Diff
Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt
+242 -247
View File
@@ -1,6 +1,6 @@
[AdGuard]
! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard)
! Version: 25December2023v1
! Version: 29December2023v2
! Expires: 2 days
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -468,11 +468,98 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href*
play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$=".adblock"])
||apps.apple.com/*/app/*/id1564900435^$document
! ——— Wrong TLDs of legitimate sites ———
||ubuntu.org^$document
! ——— Typo squatting, misspellings, and honest TLD address bar mistakes ———
||ubuntu.org^$document,domain=~you-were-likely-looking-for-ubuntu.com
103.224.212.249$network
||speedtest.com^$document
||kelkoogroup.net^$all
||speedtest.com^$document,domain=~you-were-likely-looking-for-speedtest.net
||kelkoogroup.net^$all,~inline-font,domain=~fake-malware-version-of-kelkoogroup.com
||snapchat.cm^$document,domain=~malware-typo-squatter-of-snapchat.com
||facebook.cm^$document,domain=~malware-typo-squatter-of-facebook.com
||wix.cm^$document,domain=~malware-typo-squatter-of-wix.com
199.59.243.222$network
|http://ww01.$document,domain=~very-very-extremely-frequently-used-in-malware-redirections.*
||14d.us^$all,~inline-font,domain=~malware-redirection-and-also-you-were-very-likely-looking-for-1d4.us
173.208.96.42$network
173.208.96.43$network
173.208.96.44$network
173.208.96.45$network
173.208.96.46$network
213.227.149.208$network
213.227.149.211$network
||ddscordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||diicordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||disccrdapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||dissordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||discorrapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||discordaap.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||discordapp.cam^$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||discordap.com^$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
! https://github.com/DevSpen/links/blob/master/src/links.txt
/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||discord-nltro.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||discord-app.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||discord-promo*$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||dlscord.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||dlscord-app.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
/(^|\.|://)gifts?-?discord\..*/$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||steamcommin*$document,domain=~likely-a-fake-malware-version-of-steamcommunity.com
||steamcommm*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommn*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommunet*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommunitty.$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommunnity.$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommunty.$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommuu*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommyn*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcomnu*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcomrn*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamconnu*$document,domain=~likely-a-fake-malware-version-of-steamcommunity.com
||steancomm*$document,domain=~likely-a-fake-malware-version-of-steamcommunity.com
||steanncomu*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||discord-glft.$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discordnitrogift*$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||gift-nitro.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||free-discordnitro.$all
||freediscordnitro.$all
/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$all,~inline-font,domain=~fake-malware-version-of-discord.gift
!#if false
/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/
/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup
!#endif
||discord*.gifts^$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discord-give.$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discord-nitro-gift.$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discord-nitro.$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discord-nitros.$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discord.foundation^$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discordnitro-steam.$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discordxgift.$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discordxnitro.$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||discrod.ru^$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
||nitro*.gift^$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||nitro*.gifts^$all,~inline-font,domain=~fake-malware-version-of-discord.gift
||sleanmconmunltiy.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||staemcommunty.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcomiunity.com^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommunillty.com^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommunjty.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcommunlity.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcomnnuity.com^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamconmunyty.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamconunity.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steamcumunity.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||steanmconynnuytiy.$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||stearncommynity.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com
||githubus.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com
||githubu.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com
||githu.com^$document,domain=~you-were-likely-looking-for-github.com
||wgithub.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com
||githubuser.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com
||rgithub.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com
||githubt.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com
! https://scammer.info/t/discord-nitro-scam-25/87887
||discorde-nitre.xyz^$all,~inline-font,domain=~fake-malware-version-of-discordapp.com
! ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
||netnet44.net^$all
@@ -495,7 +582,7 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$
||proserpina-zeb.com^$all
||lordagty.com^$document
||madagty.com^$document
||zeroredirect5.com^$document
||zeroredirect5.com^$document,domain=~malware-redirection-trains.*
54.209.22.226$network
54.91.125.197$network
52.202.53.245$network
@@ -506,7 +593,7 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$
3.216.243.46$network
||roamingclicks.com^$all
! Source: desidert.no
||collectfasttracks.com^$all
||collectfasttracks.com^$all,~inline-font,domain=~malware-redirection-trains.*
! Source: vn-zoom.com
||ttnrd.com^$all
||amanda.*.com^$document
@@ -518,9 +605,9 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$
35.172.40.232$network
3.90.125.85$network
! Various ex-affiliate links at www.zombooru.com
||track.vcdc.com^$all
||track.tkbo.com^$all
||track.traffic.club^$all
||track.vcdc.com^$all,~inline-font,domain=~malware-redirection-trains.*
||track.tkbo.com^$all,~inline-font,domain=~malware-redirection-trains.*
||track.traffic.club^$all,~inline-font,domain=~malware-redirection-trains.*
||lasvegas-vacations.net^$document
||ndsplitter.com^$document
||ns1.trafficclub.com^$all
@@ -536,26 +623,19 @@ zombooru.com##a[href="http://www.analbooru.com/"]
zombooru.com##a[href="http://www.hard55.com"]
! https://github.com/DandelionSprout/adfilt/pull/167
||forgoprokick.icu^$all
! Other
||ddscordapp.$all
||diicordapp.$all
||disccrdapp.$all
||dissordapp.$all
||discorrapp.$all
||discordaap.$all
! https://github.com/AdguardTeam/AdguardFilters/issues/124611
! (https://github.com/DandelionSprout/adfilt/issues/632)
?bemobdata=$all
||inbluson.com^$all
||bemobtrcks.com^$all
||bemobtrcks.com^$all,~inline-font,domain=~malware-redirection-trains.*
! ——— Found in witness reports online ———
! Adblock Plus list maintainer weekly reports
||pinoy-offers.com^
||googleboost.xyz^$document
||bemobtracks.com^$document,popup
||bemobtrk.com^$document,popup
||bemobpath.com^$document,popup
||bemobtracks.com^$document,popup,domain=~malware-redirection-trains.*
||bemobtrk.com^$document,popup,domain=~malware-redirection-trains.*
||bemobpath.com^$document,popup,domain=~malware-redirection-trains.*
||couponbybox.com^$document
||newpage.in^$document
/mcaf04/*=$document
@@ -3718,7 +3798,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||zfirst-news.com^$all
||zmp3-online.com^$all
||zmusic-online.com^$all
||zredir.com^$all
||zredir.com^$all,~inline-font,domain=~malware-redirection-trains.*
178.128.142.109$network
||findmedia.biz^$all
||backtonews.biz^$all
@@ -3797,8 +3877,8 @@ zombooru.com##a[href="http://www.hard55.com"]
||gogle.net^$all
||quatrefeuillepolonaise.xyz^$all
||extragifis.site^$all
||best-prizes-202*.com^$document
||all-best-prize-202*.com^$document
||best-prizes-202*.com^$document,domain=~malware-site.*
||all-best-prize-202*.com^$document,domain=~malware-site.*
||captcharesolving-universe.com^$all
||captcharesolver.com^$all
||instantfwding.com^$all
@@ -3806,8 +3886,8 @@ zombooru.com##a[href="http://www.hard55.com"]
||gamesex.fun^$all
||goldprize.xyz^$all
||kmip.net^$all
||0redirc.com^$all
||redirekted.com^$all
||0redirc.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirekted.com^$all,~inline-font,domain=~malware-redirection-trains.*
||rebiraert.com^$all
||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$all
5.8.34.26$network
@@ -3890,7 +3970,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||click-to-see.live^$all
||click-to-watch.live^$all
||cpa-optimizer.online^$all
||cpvlabtrk.online^$all
||cpvlabtrk.online^$all,~inline-font,domain=~malware-redirection-trains.*
||critical-alert.info^$all
||financial-message.club^$all
||free-coupons.network^$all
@@ -4017,7 +4097,6 @@ zombooru.com##a[href="http://www.hard55.com"]
||microsoftedge.microsoft.com/addons/detail/image-find/oallgpknmoodlcklmhgfpgjkdencmnfd^$document
||microsoftedge.microsoft.com/addons/detail/kpckgoaeejpoghdglooeibkoedpkgock^$document
! https://github.com/DandelionSprout/adfilt/issues/251#issue-974102211
||discordapp.cam^$all
||nanorgin.ydns.eu^$all
||thefreshstuffs.mu^$all
||cocinasintonterias.com^$all
@@ -4038,7 +4117,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||mediagetplus.com^$all
||mgmgmg.com^$all
||temp74.com^$all
||trackwebclick.com^$all
||trackwebclick.com^$all,~inline-font,domain=~malware-redirection-trains.*
23.111.31.137$network
23.111.88.207$network
! https://github.com/DandelionSprout/adfilt/issues/254
@@ -4054,7 +4133,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||beastbuying.com^$document
||pesoaniz.com^$document
||omnatuor.com^$all
||novitrk1.com^$all
||novitrk1.com^$all,~inline-font,domain=~malware-redirection-trains.*
||cu27t-evo29lution.xyz^$all
||sothis-sayers.xyz^$all
||doneonline.xyz^$document
@@ -4065,7 +4144,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||secureleadsforever.com^$all
||renewal-software-update.com^$all
||pushmeup.art^$all
||trc.*.co^$document
||trc.*.co^$document,domain=~malware-redirection-trains.*
||artofads.co^$document
||pc-my-protection.xyz^$all
||beta-news.org^$document
@@ -4172,15 +4251,15 @@ zombooru.com##a[href="http://www.hard55.com"]
||tweakbit.com^$all
||pcspeedup.en.softonic.com^$all
! Copied from «uBlock Filters - Badware Risks» because it has proven to be a very good entry
||1redirb.com^$all
||1redirb.com^$all,~inline-font,domain=~malware-redirection-trains.*
! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931700117
||retailproductsusa.com^$all
||cloud-repos.store^$all
! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931742337 (Initial batch)
||adtrk18.com^$all
||jpgtrk.com^$all
||adtrk18.com^$all,~inline-font,domain=~malware-redirection-trains.*
||jpgtrk.com^$all,~inline-font,domain=~malware-redirection-trains.*
||pnghst.com^$document,popup
||pshtrk.com^$all
||pshtrk.com^$all,~inline-font,domain=~malware-redirection-trains.*
||diabasewoodhouse.xyz^$document
||displayoptoffers.com^$all
||spnccrzone.com^$all
@@ -4210,7 +4289,6 @@ zombooru.com##a[href="http://www.hard55.com"]
! (https://github.com/DandelionSprout/adfilt/issues/904)
/(^|\.|//)tkqlhce\.com/click-.*([?&][a-tv-z]{1,}(=[a-zA-Z0-9]{1,})?){1,}$/$document
! https://github.com/DandelionSprout/adfilt/issues/288
||discordap.com^$all
||forwrdnow.com^$document
||7lyonline.com^$document
||safelyonline.net^$document
@@ -4221,9 +4299,9 @@ zombooru.com##a[href="http://www.hard55.com"]
||data-px.services^$document
||newsvot.com^$document
||adalgard-wol.com^$all
||trkk4.com^$document
||trkk4.com^$document,domain=~malware-redirection-trains.*
||secure-access-*.gate23.xyz^$document
||hosting-redirect.com^$document
||hosting-redirect.com^$document,domain=~malware-redirection-trains.*
||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^$document
! https://github.com/DandelionSprout/adfilt/pull/289
||gogles.com^$all
@@ -4377,7 +4455,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||security-scanner.xyz^$all
||news-back.org^$all
! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md
&url_bnm_redirect=$all
&url_bnm_redirect=$all,~inline-font,domain=~malware-redirection-trains.*
/mcafeedirect.jsp$all,domain=~mcafee.com
/beep.mp3^$domain=xyz|club|pro
||kokotrokot.com^$all
@@ -4440,7 +4518,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||delicate-tame-angora.glitch.me^$all
||secureinvoice.glitch.me^$all
||holy-ruddy-brace.glitch.me^$all
||instagramcomphoto212paaatrk.glitch.me^$all
||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware-redirection-trains.*
||instafollow.glitch.me^$all
||loving-discovered-swordfish.glitch.me^$all
||aquamarine-cotton-impala.glitch.me^$all
@@ -4448,32 +4526,6 @@ zombooru.com##a[href="http://www.hard55.com"]
||tough-numerous-lemur.glitch.me^$all
! https://scammer.info/t/mcafee-phish/83725
||securefirst.us-east-1.linodeobjects.com^$all
! https://github.com/DevSpen/links/blob/master/src/links.txt
/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/$all
/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/$all
||discord-nltro.$all
||discord-app.$all
||discord-promo*$all
||dlscord.$all
||dlscord-app.$all
/(^|\.|://)gifts?-?discord\..*/$all
||steamcommin*$document
||steamcommm*$all
||steamcommn*$all
||steamcommunet*$all
||steamcommunitty.$all
||steamcommunnity.$all
||steamcommunty.$all
||steamcommuu*$all
||steamcommyn*$all
||steamcomnu*$all
||steamcomrn*$all
||steamconnu*$document
||steancomm*$document
||steanncomu*$all
||discord-glft.$all
||discordnitrogift*$all
||gift-nitro.$all
! https://www.virustotal.com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community
39.65.72.211$network
42.238.151.197$network
@@ -4651,8 +4703,6 @@ zombooru.com##a[href="http://www.hard55.com"]
! https://github.com/AdguardTeam/AdguardFilters/issues/103475
||ru.com^$all
141.8.226.34$network
! https://scammer.info/t/discord-nitro-scam-25/87887
||discorde-nitre.xyz^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/108571
||ston-app.com^$all
! fake human verification scam
@@ -4683,7 +4733,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||sites.google.com/view/groundworkssolutions/^$all
||sites.google.com/mytv/maintenance^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/111970
/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$document,popup
/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$document,popup,domain=~malware-redirection-trains.*
! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ → https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
||pccrackworld.com^$all
||calsign.xyz^$all
@@ -4745,20 +4795,20 @@ zombooru.com##a[href="http://www.hard55.com"]
||installiq.com^$all
||specgoal.com^$all
||sandhyapi.online^$all
/trk2/*?lddomain=$document
||rtbrvdirect.com^$all
/trk2/*?lddomain=$document,domain=~very-likely-a-malware-redirection.*
||rtbrvdirect.com^$all,~inline-font,domain=~malware-redirection-trains.*
||goprotectpc.com^$all
||mybetterck.com^$all
||matildawu.online^$all
||cpmrevdirect.com^$document
||rtbverdirect.com^$document
||cpmrevdirect.com^$document,domain=~malware-redirection-trains.*
||rtbverdirect.com^$document,domain=~malware-redirection-trains.*
||fsalfrwdr.com^$document
||cpmvrdirect.com^$document
||fadverdirect.com^$document
||cpmrvdirect.com^$document
||rtbrevdirect.com^$document
||rtbvrdirect.com^$document
||cpmverdirect.com^$document
||cpmvrdirect.com^$document,domain=~malware-redirection-trains.*
||fadverdirect.com^$document,domain=~malware-redirection-trains.*
||cpmrvdirect.com^$document,domain=~malware-redirection-trains.*
||rtbrevdirect.com^$document,domain=~malware-redirection-trains.*
||rtbvrdirect.com^$document,domain=~malware-redirection-trains.*
||cpmverdirect.com^$document,domain=~malware-redirection-trains.*
15.197.244.48$network
96.47.230.67$network
96.47.230.68$network
@@ -4777,12 +4827,12 @@ zombooru.com##a[href="http://www.hard55.com"]
179.60.146.*$network
!#endif
! https://github.com/AdguardTeam/AdguardFilters/issues/121544
||trafredirtds.com^$all
||trafredirtds.com^$all,~inline-font,domain=~malware-redirection-trains.*
||com/landers/iphone*_spin$document
! https://github.com/AdguardTeam/AdguardFilters/issues/121772
||pu020ev.com^$all
||kadam.net^$all
||kdtrk.net^$all
||kdtrk.net^$all,~inline-font,domain=~malware-redirection-trains.*
||clcpb.net^$all
||kadam.ru^$all
||kadxin.net^$all
@@ -4807,9 +4857,9 @@ zombooru.com##a[href="http://www.hard55.com"]
! https://github.com/AdguardTeam/AdguardFilters/issues/122757
://adbrbk.$document
! https://github.com/AdguardTeam/AdguardFilters/issues/123544
||saferedirects.xyz^$all
||saferedirects.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
||online-guard.com^$all
/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$document,popup
/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$document,popup,domain=~fake-site-with-malware.*
! https://twitter.com/iam_py_test/status/1545164642346930176
||amazon-security-info.lnk.to^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/123968
@@ -5053,10 +5103,10 @@ zombooru.com##a[href="http://www.hard55.com"]
||tlkn45ssg.cyou^$all
||toprefgtbvatv.com^$all
||tov49ro5ep.art^$all
||track2it4.icu^$all
||trackerry.com^$all
||trackgdi.com^$all
||trckrry.com^$all
||track2it4.icu^$all,~inline-font,domain=~malware-redirection-trains.*
||trackerry.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trackgdi.com^$all,~inline-font,domain=~malware-redirection-trains.*
||trckrry.com^$all,~inline-font,domain=~malware-redirection-trains.*
||udlwwle.site^$all
||uij5nn-ta.cyou^$all
||uqujzco.xyz^$all
@@ -5339,7 +5389,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||astogepian.com^$all
||influencer2020.com^$all
||vooculok.com^$all
||mobytrks.com^$all
||mobytrks.com^$all,~inline-font,domain=~malware-redirection-trains.*
139.45.197.236$network
! https://github.com/AdguardTeam/AdguardFilters/issues/128029
||becovi.com^$all
@@ -5382,7 +5432,7 @@ zombooru.com##a[href="http://www.hard55.com"]
146.19.169.98$network
146.19.169.99$network
! https://github.com/AdguardTeam/AdguardFilters/issues/132079
/pushredirect/?$document
/pushredirect/?$document,domain=~malware-redirection-trains.*
! https://github.com/AdguardTeam/AdguardFilters/issues/134355
||1000girl.com^$all
||1000islandsinfo.com^$all
@@ -6176,7 +6226,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||keyrug.com^$all
||keysschools.net^$all
||keystonehoops.com^$all
||keywebtracker.com^$all
||keywebtracker.com^$all,~inline-font,domain=~malware-redirection-trains.*
||keywordadvisetoolplus.com^$all
||kickoff.cm^$all
||kindfirls.com^$all
@@ -7225,7 +7275,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||cadbitff.com^$all
||chemitug.net^$all
||civadsoo.net^$all
||clicktracklink.com^$all
||clicktracklink.com^$all,~inline-font,domain=~malware-redirection-trains.*
||comivolo.com^$all
||consoupow.com^$all
||costaquire.com^$all
@@ -7623,7 +7673,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||4.fo^$document,popup
||kckb.st^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/139106
||*-trk.xyz^$all
-trk.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
||loadingnow.me^$all
||gsecurecontent.com^$all
||pressizer.net^$all
@@ -10657,9 +10707,9 @@ zombooru.com##a[href="http://www.hard55.com"]
||thor-pom.com^$all
||thutm-bru.com^$all
||uthyr-que.com^$all
||zeroredirect1.com^$all
||zeroredirect1.com^$all,~inline-font,domain=~malware-redirection-trains.*
||zp-dom.com^$all
||redirect.newprogrammatic.click^$document
||redirect.newprogrammatic.click^$document,domain=~likely-a-malware-redirection.*
||arcad-hoh.com^$all
||eadri-fnr.com^$all
||gerhi-psv.com^$all
@@ -10702,7 +10752,7 @@ zombooru.com##a[href="http://www.hard55.com"]
45.150.108.213$network
92.204.160.240$network
! https://github.com/AdguardTeam/AdguardFilters/issues/148560
/land/*&afftrack=$document
/land/*&afftrack=$document,domain=~likely-a-malware-redirection.*
! Comments on Slack
||antivirussprotection.com^$all
||boot-upextremelyquickinfo-product.info^$all
@@ -10993,8 +11043,8 @@ zombooru.com##a[href="http://www.hard55.com"]
||hornygirlsinapp.com^$all
||jump-path1.com^$all
||jump-path2.com^$all
||redirect-path1.com^$all
||redirect-path2.com^$all
||redirect-path1.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redirect-path2.com^$all,~inline-font,domain=~malware-redirection-trains.*
||your-online-casino.com^$all
||hot-girls-around.com^$all
||how2-become-rich.com^$all
@@ -11021,8 +11071,8 @@ zombooru.com##a[href="http://www.hard55.com"]
||pw-show-ad.com^$all
||pw-show-main.com^$all
||pw-show-test.com^$all
||pwredir-*.com^$all
||redir-pw*.com^$all
||pwredir-*.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redir-pw*.com^$all,~inline-font,domain=~malware-redirection-trains.*
||rich-people-club.com^$all
||search-top-videos.com^$all
||secret-casino-site.com^$all
@@ -11159,7 +11209,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||click-to-see.live^$all
||click-to-watch.live^$all
||cpa-optimizer.online^$all
||cpvlabtrk.online^$all
||cpvlabtrk.online^$all,~inline-font,domain=~malware-redirection-trains.*
||critical-alert.info^$all
||daily-breaking-news.one^$all
||daily-buzzing-gossip.com^$all
@@ -11246,7 +11296,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||openthenotification.com^$all
||p0kerr.com^$all
||pclkpackg.xyz^$all
||pclkredrct.xyz^$all
||pclkredrct.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
||popular-messages.com^$all
||premium-news-for.me^$all
||premium-shops-around.me^$all
@@ -11254,7 +11304,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||private-message.live^$all
||private-message.online^$all
||private-show.live^$all
||pushapitracker.com^$all
||pushapitracker.com^$all,~inline-font,domain=~malware-redirection-trains.*
||read-and-reveal.com^$all
||read-before-the-rest.com^$all
||read-new-post.com^$all
@@ -11322,7 +11372,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||trending-celeb-news.com^$all
||trending-gossip.com^$all
||trends-celebs.com^$all
||ts-tracker.me^$all
||ts-tracker.me^$all,~inline-font,domain=~malware-redirection-trains.*
||updates-news-magazine.com^$all
||very-important.online^$all
||video-change.digital^$all
@@ -11357,18 +11407,18 @@ zombooru.com##a[href="http://www.hard55.com"]
||defre.net^$all
||pocrd.cc^$all
||puredi.net^$all
||redic.net^$all
||redic2.net^$all
||redic3.com^$all
||redic4.com^$all
||redir2.net^$all
||redir3.net^$all
||redir4.net^$all
||redir5.net^$all
||redir6.net^$all
||redir7.net^$all
||redir8.net^$all
||redir9.net^$all
||redic.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redic2.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redic3.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redic4.com^$all,~inline-font,domain=~malware-redirection-trains.*
||redir2.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir3.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir4.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir5.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir6.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir7.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir8.net^$all,~inline-font,domain=~malware-redirection-trains.*
||redir9.net^$all,~inline-font,domain=~malware-redirection-trains.*
||rejco.online^$all
||rejco2.store^$all
||spinwincas.online^$all
@@ -11660,7 +11710,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||glersooy.net^$all
||gliceebe.xyz^$all
||gloacmug.net^$all
||go.redirected*/click?^$document,popup
||go.redirected*/click?^$document,popup,domain=~malware-redirection-trains.*
||goldfishka-casino.xyz^$all
||gousauhu.xyz^$all
||gphyvg.com^$all
@@ -11961,7 +12011,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||rahfnq.com^$all
||raybhi.com^$all
||rcqmrz.com^$all
||redirected1.com^$all
||redirected1.com^$all,~inline-font,domain=~malware-redirection-trains.*
||rfduik.com^$all
||rgitpv.com^$all
||riaeqd.com^$all
@@ -12532,7 +12582,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||searchassured.com^$all
||searchequivalents.com^$all
||searchexcellent.com^$all
||searchingredirect.com^$all
||searchingredirect.com^$all,~inline-font,domain=~malware-redirection-trains.*
||searchinquire.com^$all
||searchsimilars.com^$all
||searchstarters.com^$all
@@ -17110,7 +17160,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||zapdescendant.com^$all
||zapprecisionadmire.com^$all
||zealousstraitcommit.com^$all
://trk.*.run/$document
://trk.*.run/$document,domain=~very-likely-a-malware-redirection-train.*
! https://github.com/AdguardTeam/AdguardFilters/issues/159157
||apbbjmp.com^$all
||apptjmp.com^$all
@@ -17200,7 +17250,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||charutboll.com^$all
||chaseverifications.com^$all
||cloud-network.online^$all
||cmcmdirrect.com^$all
||cmcmdirrect.com^$all,~inline-font,domain=~malware-redirection-trains.*
||coltersaidas.com^$all
||com-96-hours.com^$all
||com-96hours.com^$all
@@ -17325,7 +17375,7 @@ zombooru.com##a[href="http://www.hard55.com"]
||paywide.cards^$all
||promo-carte-avantages.com^$all
||qc1.site^$all
||redirect2url.com^$all
||redirect2url.com^$all,~inline-font,domain=~malware-redirection-trains.*
||revoiut-cy.com^$all
||revoke.money^$all
||richiediilrimborso.com^$all
@@ -17543,12 +17593,12 @@ zombooru.com##a[href="http://www.hard55.com"]
||usqtvc.com$all
||usutnr.top$all
||204.44.92.187$all
://ap-trk.$all
://cw-trk.$all
://cw-trak.$all
://ktraks.$all
://flow-clck.$all
://apps-trk.$all
://ap-trk.$all,~inline-font,domain=~malware-redirection-trains.*
://cw-trk.$all,~inline-font,domain=~malware-redirection-trains.*
://cw-trak.$all,~inline-font,domain=~malware-redirection-trains.*
://ktraks.$all,~inline-font,domain=~malware-redirection-trains.*
://flow-clck.$all,~inline-font,domain=~malware-redirection-trains.*
://apps-trk.$all,~inline-font,domain=~malware-redirection-trains.*
! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103
||betzykrisesenter.no^$document
||citra2010oslo.no^$document
@@ -19516,56 +19566,25 @@ toorgle.net##.join
||nickswheels.com^$all
||spizzicopizza.net^$all
! Other
||redirectme.net^$document
||redirectme.net^$document,domain=~malware-redirection-trains.*
||anthargo.com^$document
! Domains on IPs known to host Discord Nitro spambots
||csgocup.ru^$all
||csgogf*.xyz^$all
||csgogift*.xyz^$all
/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$all
!#if false
/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/
/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup
!#endif
||discord*.gifts^$all
||discord-give.$all
||discord-nitro-gift.$all
||discord-nitro.$all
||discord-nitros.$all
||discord.foundation^$all
||discordnitro-steam.$all
||discordxgift.$all
||discordxnitro.$all
||discrod.ru^$all
||dotagift*.xyz^$all
||eslpro.ru^$all
||fortnitebuy.com^$all
||free-discordnitro.$all
||freediscordnitro.$all
||steamcommunlty.it^$all
||ggtour.ru^$all
||heroes.com.ua^$all
||idchecker.xyz^$all
||market-csgo.ru^$all
||nitro*.gift^$all
||nitro*.gifts^$all
||pubggf*.xyz^$all
||pubggift*.xyz^$all
||s-arts.pro^$all
||skinosoda.online^$all
||sleanmconmunltiy.ru^$all
||staemcommunty.ru^$all
||steamcomiunity.com^$all
||steamcommunillty.com^$all
||steamcommunjty.ru^$all
||steamcommunlity.ru^$all
||steamcomnnuity.com^$all
||steamconmunyty.ru^$all
||steamconunity.ru^$all
||steamcumunity.ru^$all
||steanmconynnuytiy.$all
||stearncommynity.ru^$all
||tradeoffer.com.ru^$all
194.226.139.121$network
194.226.139.7$network
@@ -20311,26 +20330,26 @@ tumblr.com#?#div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://b
! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
apkfab.com##.tip-extension
! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022)
||xxlmag.com/redirect^$all
||ultimateclassicrock.com/redirect^$all
||xxlmag.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||2y68554.cyou^$all
||1pwk1j.cyou^$all
||986.group^$all
185.87.148.199$network
! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022)
||imaot.co.il/ContentArea/BannerClick^$all
||q1065.fm/redirect^$all
||wobm.com/redirect^$all
||us105fm.com/redirect^$all
||wnbf.com/redirect^$all
||q1065.fm/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||wobm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||us105fm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||wnbf.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
||ynxqoc2.cyou^$all
||resurrectionlinks.online^$all
||canon70x70.site^$all
||gacorhub.com^$all
||zh1653.com^$all
45.136.49.35$network
||semex.com/popurl.cgi^$all
||pharmanimal.com/catalog/redirect.php^$all
||semex.com/popurl.cgi^$all,~inline-font,domain=~malware-redirection-results.*
||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware-redirection-results.*
! Browsing around for Tajik newssites
||arhernot.live^$all
||lifelongkick.live^$all
@@ -20391,7 +20410,7 @@ apkfab.com##.tip-extension
||highlandnews.com^$all
||genuinescansupport.com^$all
||diverseflowlink.com^$all
||redirectedflow.com^$all
||redirectedflow.com^$all,~inline-font,domain=~malware-redirection-trains.*
||pcbasicstrength.com^$all
||conceptualizefact.com^$all
||varietyflow.com^$all
@@ -20463,8 +20482,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
34.80.59.191$network
! Various domains on https://securitytrails.com/list/ip/72.14.178.174
|http://www6.$document
|http://www1.*&kw$document
|http://www6.$document,domain=~often-used-in-malware-redirections.*
|http://www1.*&kw$document,domain=~often-used-in-malware-redirections.*
||megabooru.com^$all
||zombooru.com^$all
||kusubooru.com^$all
@@ -20521,7 +20540,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||awesomewinner.com^$all
||awesomewinner.net^$all
||awesomewinners.net^$all
||b2ztrk.com^$all
||b2ztrk.com^$all,~inline-font,domain=~malware-redirection-trains.*
||beastgadget.net^$all
||beastoffer.net^$all
||beastoffrs.com^$all
@@ -20854,7 +20873,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
||winnerssite.net^$all
||xyzoffer.net^$all
||yasdoodl.com^$all
||ym3trk.com^$all
||ym3trk.com^$all,~inline-font,domain=~malware-redirection-trains.*
||youwanthis.com^$all
||zebramode.com^$all
||zebraoffers.net^$all
@@ -22897,21 +22916,21 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat
[2606:4700:3030::6815:5284]$network
[2606:4700:3037::ac43:9e39]$network
! Google results for «SodaStream site:no cranberry»
/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$document
||adservice.google.*/ddm/clk/$document
/ad_click/q?&url=$document
/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$document,domain=~malware-redirection-results.*
||adservice.google.*/ddm/clk/$document,domain=~malware-redirection-results.*
/ad_click/q?&url=$document,domain=~malware-redirection-results.*
! Laughably blatant fraud site
||cosercosplay.com^$all
! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
||unofficialtwrp.com^$document
||androidweblog.com^$document
||androidgreek.com^$document
||ytechb.com^$document
||gadgetstwist.com^$document
||gadgetsfarms.com^$document
||techorfy.com^$document
||unofficialtwrp.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidweblog.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidgreek.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||ytechb.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetstwist.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetsfarms.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||techorfy.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
!#if false
! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
@@ -22926,15 +22945,6 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat
|1x1.cz^
!#endif
! ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ———
||githubus.com^
||githubu.com^
||githu.com^
||wgithub.com^
||githubuser.com^
||rgithub.com^
||githubt.com^
! ——— Usually used by various groups who buy old domains and display illicit ads on them ———
://ww4.$document,domain=~ww4.ikea.com
://ww5.$document,domain=~ww5.ikea.com|~ww5.msu.ac.zw
@@ -22942,47 +22952,47 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat
://ww7.$document,domain=~ww7.be|~ww7.readsnk.com
://ww8.$document,domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com
://ww9.$document,domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br
://ww10.$document
://ww11.$document
://ww12.$document
://ww13.$document
://ww14.$document
://ww15.$document,domain=~ww15.nl
://ww16.$document
://ww17.$document
://ww18.$document
://ww19.$document
://ww20.$document
://ww21.$document
://ww22.$document
://ww23.$document
://ww24.$document
://ww25.$document
://ww26.$document
://ww27.$document
://ww28.$document
://ww29.$document
://ww30.$document
://ww31.$document
://ww32.$document
://ww33.$document
://ww34.$document
://ww35.$document
://ww36.$document
://ww37.$document
://ww38.$document
://ww39.$document
://ww40.$document
://ww41.$document
://ww42.$document
://ww43.$document
://ww44.$document
://ww45.$document
://ww46.$document
://ww47.$document
://ww48.$document
://ww49.$document
://ww50.$document
://ww10.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww11.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww12.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww13.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww14.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww15.$document,domain=~ww15.nl|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww16.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww17.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww18.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww19.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww20.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww21.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww22.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww23.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww24.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww25.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww26.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww27.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww28.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww29.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww30.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww31.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww32.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww33.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww34.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww35.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww36.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww37.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww38.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww39.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww40.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww41.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww42.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww43.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww44.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww45.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww46.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww47.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww48.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww49.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww50.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ———
!!!/\\/$document
@@ -23022,21 +23032,6 @@ get.adobe.com###offersInformationPane
! Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require «AdGuard for Windows»)
||mb.download.gigabyte.com/FileList/Swhttp/DriverUpd/ANTIVIRUS^
! ——— Potential typo-squats and directly related stuff ———
||snapchat.cm^$document
||facebook.cm^$document
||wix.cm^$document
199.59.243.222$network
|http://ww01.$document
||14d.us^$all
173.208.96.42$network
173.208.96.43$network
173.208.96.44$network
173.208.96.45$network
173.208.96.46$network
213.227.149.208$network
213.227.149.211$network
! ——— Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control ———
www.microsoft.com##a[data-pfns][href*=imposter]
www.microsoft.com##a[data-pfns][href*=impostor]
Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt
+225 -230
View File
@@ -1,6 +1,6 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows' DNS filtering, and Pi-Hole FTL ≥5.22)
! Version: 25December2023v1
! Version: 29December2023v2
! Expires: 2 days
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -237,11 +237,98 @@
! Other sites
! ——— Wrong TLDs of legitimate sites ———
||ubuntu.org^
! ——— Typo squatting, misspellings, and honest TLD address bar mistakes ———
||ubuntu.org^$denyallow=you-were-likely-looking-for-ubuntu.com
103.224.212.249
||speedtest.com^
||kelkoogroup.net^
||speedtest.com^$denyallow=you-were-likely-looking-for-speedtest.net
||snapchat.cm^$denyallow=malware-typo-squatter-of-snapchat.com
||facebook.cm^$denyallow=malware-typo-squatter-of-facebook.com
||wix.cm^$denyallow=malware-typo-squatter-of-wix.com
199.59.243.222
|http://ww01.$denyallow=very-very-extremely-frequently-used-in-malware-redirections.*
173.208.96.42
173.208.96.43
173.208.96.44
173.208.96.45
173.208.96.46
213.227.149.208
213.227.149.211
! https://github.com/DevSpen/links/blob/master/src/links.txt
||steamcommin*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com
||steamconnu*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com
||steancomm*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com
||free-discordnitro.
||freediscordnitro.
/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/
||githubus.com^$denyallow=you-were-likely-looking-for-githubusercontent.com
||githubu.com^$denyallow=you-were-likely-looking-for-githubusercontent.com
||githu.com^$denyallow=you-were-likely-looking-for-github.com
||wgithub.com^$denyallow=you-were-likely-looking-for-githubusercontent.com
||githubuser.com^$denyallow=you-were-likely-looking-for-githubusercontent.com
||rgithub.com^$denyallow=you-were-likely-looking-for-githubusercontent.com
||githubt.com^$denyallow=you-were-likely-looking-for-githubusercontent.com
! https://scammer.info/t/discord-nitro-scam-25/87887
! ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
||netnet44.net^
@@ -264,7 +351,7 @@
||proserpina-zeb.com^
||lordagty.com^
||madagty.com^
||zeroredirect5.com^
||zeroredirect5.com^$denyallow=malware-redirection-trains.*
54.209.22.226
54.91.125.197
52.202.53.245
@@ -275,7 +362,7 @@
3.216.243.46
||roamingclicks.com^
! Source: desidert.no
||collectfasttracks.com^
! Source: vn-zoom.com
||ttnrd.com^
||amanda.*.com^
@@ -287,9 +374,9 @@
35.172.40.232
3.90.125.85
! Various ex-affiliate links at www.zombooru.com
||track.vcdc.com^
||track.tkbo.com^
||track.traffic.club^
||lasvegas-vacations.net^
||ndsplitter.com^
||ns1.trafficclub.com^
@@ -302,26 +389,19 @@
195.201.92.254
! https://github.com/DandelionSprout/adfilt/pull/167
||forgoprokick.icu^
! Other
||ddscordapp.
||diicordapp.
||disccrdapp.
||dissordapp.
||discorrapp.
||discordaap.
! https://github.com/AdguardTeam/AdguardFilters/issues/124611
! (https://github.com/DandelionSprout/adfilt/issues/632)
||inbluson.com^
||bemobtrcks.com^
! ——— Found in witness reports online ———
! Adblock Plus list maintainer weekly reports
||pinoy-offers.com^
||googleboost.xyz^
||bemobtracks.com^
||bemobtrk.com^
||bemobpath.com^
||couponbybox.com^
||newpage.in^
@@ -3484,7 +3564,7 @@
||zfirst-news.com^
||zmp3-online.com^
||zmusic-online.com^
||zredir.com^
178.128.142.109
||findmedia.biz^
||backtonews.biz^
@@ -3563,8 +3643,8 @@
||gogle.net^
||quatrefeuillepolonaise.xyz^
||extragifis.site^
||best-prizes-202*.com^
||all-best-prize-202*.com^
||best-prizes-202*.com^$denyallow=malware-site.*
||all-best-prize-202*.com^$denyallow=malware-site.*
||captcharesolving-universe.com^
||captcharesolver.com^
||instantfwding.com^
@@ -3572,8 +3652,8 @@
||gamesex.fun^
||goldprize.xyz^
||kmip.net^
||0redirc.com^
||redirekted.com^
||rebiraert.com^
||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^
5.8.34.26
@@ -3656,7 +3736,7 @@
||click-to-see.live^
||click-to-watch.live^
||cpa-optimizer.online^
||cpvlabtrk.online^
||critical-alert.info^
||financial-message.club^
||free-coupons.network^
@@ -3783,7 +3863,6 @@
! https://github.com/DandelionSprout/adfilt/issues/251#issue-974102211
||discordapp.cam^
||nanorgin.ydns.eu^
||thefreshstuffs.mu^
||cocinasintonterias.com^
@@ -3804,7 +3883,7 @@
||mediagetplus.com^
||mgmgmg.com^
||temp74.com^
||trackwebclick.com^
23.111.31.137
23.111.88.207
! https://github.com/DandelionSprout/adfilt/issues/254
@@ -3820,7 +3899,7 @@
||beastbuying.com^
||pesoaniz.com^
||omnatuor.com^
||novitrk1.com^
||cu27t-evo29lution.xyz^
||sothis-sayers.xyz^
||doneonline.xyz^
@@ -3831,7 +3910,7 @@
||secureleadsforever.com^
||renewal-software-update.com^
||pushmeup.art^
||trc.*.co^
||trc.*.co^$denyallow=malware-redirection-trains.*
||artofads.co^
||pc-my-protection.xyz^
||beta-news.org^
@@ -3938,15 +4017,15 @@
||tweakbit.com^
||pcspeedup.en.softonic.com^
! Copied from «uBlock Filters - Badware Risks» because it has proven to be a very good entry
||1redirb.com^
! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931700117
||retailproductsusa.com^
||cloud-repos.store^
! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931742337 (Initial batch)
||adtrk18.com^
||jpgtrk.com^
||pnghst.com^
||pshtrk.com^
||diabasewoodhouse.xyz^
||displayoptoffers.com^
||spnccrzone.com^
@@ -3976,7 +4055,6 @@
! (https://github.com/DandelionSprout/adfilt/issues/904)
! https://github.com/DandelionSprout/adfilt/issues/288
||discordap.com^
||forwrdnow.com^
||7lyonline.com^
||safelyonline.net^
@@ -3987,9 +4065,9 @@
||data-px.services^
||newsvot.com^
||adalgard-wol.com^
||trkk4.com^
||trkk4.com^$denyallow=malware-redirection-trains.*
||secure-access-*.gate23.xyz^
||hosting-redirect.com^
||hosting-redirect.com^$denyallow=malware-redirection-trains.*
! https://github.com/DandelionSprout/adfilt/pull/289
||gogles.com^
@@ -4206,7 +4284,7 @@
||delicate-tame-angora.glitch.me^
||secureinvoice.glitch.me^
||holy-ruddy-brace.glitch.me^
||instagramcomphoto212paaatrk.glitch.me^
||instafollow.glitch.me^
||loving-discovered-swordfish.glitch.me^
||aquamarine-cotton-impala.glitch.me^
@@ -4214,32 +4292,6 @@
||tough-numerous-lemur.glitch.me^
! https://scammer.info/t/mcafee-phish/83725
||securefirst.us-east-1.linodeobjects.com^
! https://github.com/DevSpen/links/blob/master/src/links.txt
/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/
/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/
||discord-nltro.
||discord-app.
||discord-promo*
||dlscord.
||dlscord-app.
/(^|\.|://)gifts?-?discord\..*/
||steamcommin*
||steamcommm*
||steamcommn*
||steamcommunet*
||steamcommunitty.
||steamcommunnity.
||steamcommunty.
||steamcommuu*
||steamcommyn*
||steamcomnu*
||steamcomrn*
||steamconnu*
||steancomm*
||steanncomu*
||discord-glft.
||discordnitrogift*
||gift-nitro.
! https://www.virustotal.com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community
39.65.72.211
42.238.151.197
@@ -4417,8 +4469,6 @@
! https://github.com/AdguardTeam/AdguardFilters/issues/103475
||ru.com^
141.8.226.34
! https://scammer.info/t/discord-nitro-scam-25/87887
||discorde-nitre.xyz^
! https://github.com/AdguardTeam/AdguardFilters/issues/108571
||ston-app.com^
! fake human verification scam
@@ -4511,20 +4561,20 @@
||installiq.com^
||specgoal.com^
||sandhyapi.online^
/trk2/*?ld
||rtbrvdirect.com^
/trk2/*?ld~very-likely-a-malware-redirection.*
||goprotectpc.com^
||mybetterck.com^
||matildawu.online^
||cpmrevdirect.com^
||rtbverdirect.com^
||cpmrevdirect.com^$denyallow=malware-redirection-trains.*
||rtbverdirect.com^$denyallow=malware-redirection-trains.*
||fsalfrwdr.com^
||cpmvrdirect.com^
||fadverdirect.com^
||cpmrvdirect.com^
||rtbrevdirect.com^
||rtbvrdirect.com^
||cpmverdirect.com^
||cpmvrdirect.com^$denyallow=malware-redirection-trains.*
||fadverdirect.com^$denyallow=malware-redirection-trains.*
||cpmrvdirect.com^$denyallow=malware-redirection-trains.*
||rtbrevdirect.com^$denyallow=malware-redirection-trains.*
||rtbvrdirect.com^$denyallow=malware-redirection-trains.*
||cpmverdirect.com^$denyallow=malware-redirection-trains.*
15.197.244.48
96.47.230.67
96.47.230.68
@@ -4543,12 +4593,12 @@
://179.60.146.
! https://github.com/AdguardTeam/AdguardFilters/issues/121544
||trafredirtds.com^
! https://github.com/AdguardTeam/AdguardFilters/issues/121772
||pu020ev.com^
||kadam.net^
||kdtrk.net^
||clcpb.net^
||kadam.ru^
||kadxin.net^
@@ -4573,7 +4623,7 @@
! https://github.com/AdguardTeam/AdguardFilters/issues/122757
://adbrbk.
! https://github.com/AdguardTeam/AdguardFilters/issues/123544
||saferedirects.xyz^
||online-guard.com^
! https://twitter.com/iam_py_test/status/1545164642346930176
@@ -4819,10 +4869,10 @@
||tlkn45ssg.cyou^
||toprefgtbvatv.com^
||tov49ro5ep.art^
||track2it4.icu^
||trackerry.com^
||trackgdi.com^
||trckrry.com^
||udlwwle.site^
||uij5nn-ta.cyou^
||uqujzco.xyz^
@@ -5105,7 +5155,7 @@
||astogepian.com^
||influencer2020.com^
||vooculok.com^
||mobytrks.com^
139.45.197.236
! https://github.com/AdguardTeam/AdguardFilters/issues/128029
||becovi.com^
@@ -5148,7 +5198,7 @@
146.19.169.98
146.19.169.99
! https://github.com/AdguardTeam/AdguardFilters/issues/132079
/pushredirect/?
/pushredirect/?~malware-redirection-trains.*
! https://github.com/AdguardTeam/AdguardFilters/issues/134355
||1000girl.com^
||1000islandsinfo.com^
@@ -5942,7 +5992,7 @@
||keyrug.com^
||keysschools.net^
||keystonehoops.com^
||keywebtracker.com^
||keywordadvisetoolplus.com^
||kickoff.cm^
||kindfirls.com^
@@ -6991,7 +7041,7 @@
||cadbitff.com^
||chemitug.net^
||civadsoo.net^
||clicktracklink.com^
||comivolo.com^
||consoupow.com^
||costaquire.com^
@@ -7389,7 +7439,7 @@
||4.fo^
||kckb.st^
! https://github.com/AdguardTeam/AdguardFilters/issues/139106
||*-trk.xyz^
||loadingnow.me^
||gsecurecontent.com^
||pressizer.net^
@@ -10423,9 +10473,9 @@
||thor-pom.com^
||thutm-bru.com^
||uthyr-que.com^
||zeroredirect1.com^
||zp-dom.com^
||redirect.newprogrammatic.click^
||redirect.newprogrammatic.click^$denyallow=likely-a-malware-redirection.*
||arcad-hoh.com^
||eadri-fnr.com^
||gerhi-psv.com^
@@ -10759,8 +10809,8 @@
||hornygirlsinapp.com^
||jump-path1.com^
||jump-path2.com^
||redirect-path1.com^
||redirect-path2.com^
||your-online-casino.com^
||hot-girls-around.com^
||how2-become-rich.com^
@@ -10787,8 +10837,8 @@
||pw-show-ad.com^
||pw-show-main.com^
||pw-show-test.com^
||pwredir-*.com^
||redir-pw*.com^
||rich-people-club.com^
||search-top-videos.com^
||secret-casino-site.com^
@@ -10925,7 +10975,7 @@
||click-to-see.live^
||click-to-watch.live^
||cpa-optimizer.online^
||cpvlabtrk.online^
||critical-alert.info^
||daily-breaking-news.one^
||daily-buzzing-gossip.com^
@@ -11012,7 +11062,7 @@
||openthenotification.com^
||p0kerr.com^
||pclkpackg.xyz^
||pclkredrct.xyz^
||popular-messages.com^
||premium-news-for.me^
||premium-shops-around.me^
@@ -11020,7 +11070,7 @@
||private-message.live^
||private-message.online^
||private-show.live^
||pushapitracker.com^
||read-and-reveal.com^
||read-before-the-rest.com^
||read-new-post.com^
@@ -11088,7 +11138,7 @@
||trending-celeb-news.com^
||trending-gossip.com^
||trends-celebs.com^
||ts-tracker.me^
||updates-news-magazine.com^
||very-important.online^
||video-change.digital^
@@ -11123,18 +11173,18 @@
||defre.net^
||pocrd.cc^
||puredi.net^
||redic.net^
||redic2.net^
||redic3.com^
||redic4.com^
||redir2.net^
||redir3.net^
||redir4.net^
||redir5.net^
||redir6.net^
||redir7.net^
||redir8.net^
||redir9.net^
||rejco.online^
||rejco2.store^
||spinwincas.online^
@@ -11727,7 +11777,7 @@
||rahfnq.com^
||raybhi.com^
||rcqmrz.com^
||redirected1.com^
||rfduik.com^
||rgitpv.com^
||riaeqd.com^
@@ -12298,7 +12348,7 @@
||searchassured.com^
||searchequivalents.com^
||searchexcellent.com^
||searchingredirect.com^
||searchinquire.com^
||searchsimilars.com^
||searchstarters.com^
@@ -16876,7 +16926,7 @@
||zapdescendant.com^
||zapprecisionadmire.com^
||zealousstraitcommit.com^
://trk.*.run/$document
://trk.*.run/$document,~very-likely-a-malware-redirection-train.*
! https://github.com/AdguardTeam/AdguardFilters/issues/159157
||apbbjmp.com^
||apptjmp.com^
@@ -16966,7 +17016,7 @@
||charutboll.com^
||chaseverifications.com^
||cloud-network.online^
||cmcmdirrect.com^
||coltersaidas.com^
||com-96-hours.com^
||com-96hours.com^
@@ -17091,7 +17141,7 @@
||paywide.cards^
||promo-carte-avantages.com^
||qc1.site^
||redirect2url.com^
||revoiut-cy.com^
||revoke.money^
||richiediilrimborso.com^
@@ -17309,12 +17359,12 @@
||usqtvc.com
||usutnr.top
||204.44.92.187
://ap-trk.
://cw-trk.
://cw-trak.
://ktraks.
://flow-clck.
://apps-trk.
! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103
||betzykrisesenter.no^
||citra2010oslo.no^
@@ -19280,56 +19330,25 @@
||nickswheels.com^
||spizzicopizza.net^
! Other
||redirectme.net^
||redirectme.net^$denyallow=malware-redirection-trains.*
||anthargo.com^
! Domains on IPs known to host Discord Nitro spambots
||csgocup.ru^
||csgogf*.xyz^
||csgogift*.xyz^
/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/
/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/
||discord*.gifts^
||discord-give.
||discord-nitro-gift.
||discord-nitro.
||discord-nitros.
||discord.foundation^
||discordnitro-steam.
||discordxgift.
||discordxnitro.
||discrod.ru^
||dotagift*.xyz^
||eslpro.ru^
||fortnitebuy.com^
||free-discordnitro.
||freediscordnitro.
||steamcommunlty.it^
||ggtour.ru^
||heroes.com.ua^
||idchecker.xyz^
||market-csgo.ru^
||nitro*.gift^
||nitro*.gifts^
||pubggf*.xyz^
||pubggift*.xyz^
||s-arts.pro^
||skinosoda.online^
||sleanmconmunltiy.ru^
||staemcommunty.ru^
||steamcomiunity.com^
||steamcommunillty.com^
||steamcommunjty.ru^
||steamcommunlity.ru^
||steamcomnnuity.com^
||steamconmunyty.ru^
||steamconunity.ru^
||steamcumunity.ru^
||steanmconynnuytiy.
||stearncommynity.ru^
||tradeoffer.com.ru^
194.226.139.121
194.226.139.7
@@ -20153,7 +20172,7 @@
||highlandnews.com^
||genuinescansupport.com^
||diverseflowlink.com^
||redirectedflow.com^
||pcbasicstrength.com^
||conceptualizefact.com^
||varietyflow.com^
@@ -20224,7 +20243,7 @@
! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
34.80.59.191
! Various domains on https://securitytrails.com/list/ip/72.14.178.174
|http://www6.
|http://www6.$denyallow=often-used-in-malware-redirections.*
||megabooru.com^
||zombooru.com^
@@ -20282,7 +20301,7 @@
||awesomewinner.com^
||awesomewinner.net^
||awesomewinners.net^
||b2ztrk.com^
||beastgadget.net^
||beastoffer.net^
||beastoffrs.com^
@@ -20615,7 +20634,7 @@
||winnerssite.net^
||xyzoffer.net^
||yasdoodl.com^
||ym3trk.com^
||youwanthis.com^
||zebramode.com^
||zebraoffers.net^
@@ -22663,13 +22682,13 @@
! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
||unofficialtwrp.com^
||androidweblog.com^
||androidgreek.com^
||ytechb.com^
||gadgetstwist.com^
||gadgetsfarms.com^
||techorfy.com^
||unofficialtwrp.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidweblog.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||androidgreek.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||ytechb.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetstwist.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||gadgetsfarms.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
||techorfy.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
@@ -22681,15 +22700,6 @@
|1x1.cz^
! ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ———
||githubus.com^
||githubu.com^
||githu.com^
||wgithub.com^
||githubuser.com^
||rgithub.com^
||githubt.com^
! ——— Usually used by various groups who buy old domains and display illicit ads on them ———
://ww4.$denyallow=ww4.ikea.com
://ww5.$denyallow=ww5.ikea.com|ww5.msu.ac.zw
@@ -22697,47 +22707,47 @@
://ww7.$denyallow=ww7.be|ww7.readsnk.com
://ww8.$denyallow=ww8.co|ww8.ikea.com|ww8.tiki.ne.jp|ww8.erovoice.us|ww8.anyanime.com|ww8.bakushpal.az|ww8.tokyoghoulre.com|ww8.readonepiece.com
://ww9.$denyallow=ww9.ikea.com|ww9.tiki.ne.jp|ww9.sakura.ne.jp|ww9.generali.pt|ww9.itau.com.br
://ww10.
://ww11.
://ww12.
://ww13.
://ww14.
://ww15.$denyallow=ww15.nl
://ww16.
://ww17.
://ww18.
://ww19.
://ww20.
://ww21.
://ww22.
://ww23.
://ww24.
://ww25.
://ww26.
://ww27.
://ww28.
://ww29.
://ww30.
://ww31.
://ww32.
://ww33.
://ww34.
://ww35.
://ww36.
://ww37.
://ww38.
://ww39.
://ww40.
://ww41.
://ww42.
://ww43.
://ww44.
://ww45.
://ww46.
://ww47.
://ww48.
://ww49.
://ww50.
://ww10.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww11.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww12.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww13.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww14.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww15.$denyallow=ww15.nl|practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww16.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww17.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww18.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww19.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww20.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww21.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww22.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww23.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww24.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww25.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww26.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww27.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww28.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww29.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww30.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww31.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww32.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww33.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww34.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww35.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww36.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww37.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww38.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww39.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww40.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww41.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww42.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww43.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww44.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww45.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww46.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww47.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww48.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww49.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
://ww50.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.*
! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ———
!!!/\\/
@@ -22766,21 +22776,6 @@
! Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require «AdGuard for Windows»)
! ——— Potential typo-squats and directly related stuff ———
||snapchat.cm^
||facebook.cm^
||wix.cm^
199.59.243.222
|http://ww01.
||14d.us^
173.208.96.42
173.208.96.43
173.208.96.44
173.208.96.45
173.208.96.46
213.227.149.208
213.227.149.211
! ——— Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control ———
! All legitimate Pac-Man games would use "pac-man" links with a dash
Alternate versions Anti-Malware List/AntiMalwareDomains.txt
+85 -91
View File
@@ -1,7 +1,6 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List (Domains list version)
# Version: 25December2023v1
# Version: 29December2023v2
# Expires: 2 days
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# ——— Bad top-level domains ———
# You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you.
@@ -228,11 +227,93 @@ the1adblocker.com
# ——— Wrong TLDs of legitimate sites ———
# ——— Typo squatting, misspellings, and honest TLD address bar mistakes ———
ubuntu.org
103.224.212.249
speedtest.com
kelkoogroup.net
snapchat.cm
facebook.cm
wix.cm
199.59.243.222
14d.us
173.208.96.42
173.208.96.43
173.208.96.44
173.208.96.45
173.208.96.46
213.227.149.208
213.227.149.211
discordapp.cam
discordap.com
discord.foundation
discrod.ru
sleanmconmunltiy.ru
staemcommunty.ru
steamcomiunity.com
steamcommunillty.com
steamcommunjty.ru
steamcommunlity.ru
steamcomnnuity.com
steamconmunyty.ru
steamconunity.ru
steamcumunity.ru
stearncommynity.ru
githubus.com
githubu.com
githu.com
wgithub.com
githubuser.com
rgithub.com
githubt.com
discorde-nitre.xyz
# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
netnet44.net
@@ -281,13 +362,6 @@ splitter.microxml.net
144.76.1.130
195.201.92.254
forgoprokick.icu
# Other
inbluson.com
bemobtrcks.com
@@ -3722,7 +3796,6 @@ thecrs.club
discordapp.cam
nanorgin.ydns.eu
thefreshstuffs.mu
cocinasintonterias.com
@@ -3867,7 +3940,6 @@ polyhymnia-mar.com
virpropcnow.xyz
avprotectionoverview.com
discordap.com
forwrdnow.com
7lyonline.com
safelyonline.net
@@ -4061,31 +4133,6 @@ aquamarine-cotton-impala.glitch.me
mature-periwinkle-advantage.glitch.me
tough-numerous-lemur.glitch.me
securefirst.us-east-1.linodeobjects.com
39.65.72.211
42.238.151.197
27.213.60.53
@@ -4211,7 +4258,6 @@ new-meet-dating.life
wellhello.com
ru.com
141.8.226.34
discorde-nitre.xyz
ston-app.com
# fake human verification scam
# start form - reported for abuse
@@ -7140,6 +7186,7 @@ zigaahm.icu
link.sv
4.fo
kckb.st
loadingnow.me
gsecurecontent.com
pressizer.net
@@ -18973,24 +19020,8 @@ anthargo.com
# Domains on IPs known to host Discord Nitro spambots
cabura.loan
csgocup.ru
discord.foundation
discrod.ru
eslpro.ru
fortnitebuy.com
steamcommunlty.it
ggtour.ru
heroes.com.ua
@@ -18998,18 +19029,6 @@ idchecker.xyz
market-csgo.ru
s-arts.pro
skinosoda.online
sleanmconmunltiy.ru
staemcommunty.ru
steamcomiunity.com
steamcommunillty.com
steamcommunjty.ru
steamcommunlity.ru
steamcomnnuity.com
steamconmunyty.ru
steamconunity.ru
steamcumunity.ru
stearncommynity.ru
tradeoffer.com.ru
194.226.139.121
194.226.139.7
@@ -22338,15 +22357,6 @@ hitnslab.info
1x1.cz
# ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ———
githubus.com
githubu.com
githu.com
wgithub.com
githubuser.com
rgithub.com
githubt.com
# ——— Usually used by various groups who buy old domains and display illicit ads on them ———
@@ -22418,21 +22428,6 @@ mip.api.mcafeewebadvisor.com
# Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require «AdGuard for Windows»)
# ——— Potential typo-squats and directly related stuff ———
snapchat.cm
facebook.cm
wix.cm
199.59.243.222
14d.us
173.208.96.42
173.208.96.43
173.208.96.44
173.208.96.45
173.208.96.46
213.227.149.208
213.227.149.211
# ——— Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control ———
@@ -22459,7 +22454,6 @@ trmff.wpengine.com
# Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests
Alternate versions Anti-Malware List/AntiMalwareHosts.txt
+84 -90
View File
@@ -1,6 +1,5 @@
# Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version)
# Expires: 2 days
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# ——— Bad top-level domains ———
# You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you.
@@ -220,11 +219,93 @@
# ——— Wrong TLDs of legitimate sites ———
# ——— Typo squatting, misspellings, and honest TLD address bar mistakes ———
127.0.0.1 ubuntu.org
127.0.0.1 103.224.212.249
127.0.0.1 speedtest.com
127.0.0.1 kelkoogroup.net
127.0.0.1 snapchat.cm
127.0.0.1 facebook.cm
127.0.0.1 wix.cm
127.0.0.1 199.59.243.222
127.0.0.1 14d.us
127.0.0.1 173.208.96.42
127.0.0.1 173.208.96.43
127.0.0.1 173.208.96.44
127.0.0.1 173.208.96.45
127.0.0.1 173.208.96.46
127.0.0.1 213.227.149.208
127.0.0.1 213.227.149.211
127.0.0.1 discordapp.cam
127.0.0.1 discordap.com
127.0.0.1 discord.foundation
127.0.0.1 discrod.ru
127.0.0.1 sleanmconmunltiy.ru
127.0.0.1 staemcommunty.ru
127.0.0.1 steamcomiunity.com
127.0.0.1 steamcommunillty.com
127.0.0.1 steamcommunjty.ru
127.0.0.1 steamcommunlity.ru
127.0.0.1 steamcomnnuity.com
127.0.0.1 steamconmunyty.ru
127.0.0.1 steamconunity.ru
127.0.0.1 steamcumunity.ru
127.0.0.1 stearncommynity.ru
127.0.0.1 githubus.com
127.0.0.1 githubu.com
127.0.0.1 githu.com
127.0.0.1 wgithub.com
127.0.0.1 githubuser.com
127.0.0.1 rgithub.com
127.0.0.1 githubt.com
127.0.0.1 discorde-nitre.xyz
# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
127.0.0.1 netnet44.net
@@ -273,13 +354,6 @@
127.0.0.1 144.76.1.130
127.0.0.1 195.201.92.254
127.0.0.1 forgoprokick.icu
# Other
127.0.0.1 inbluson.com
127.0.0.1 bemobtrcks.com
@@ -3714,7 +3788,6 @@
127.0.0.1 discordapp.cam
127.0.0.1 nanorgin.ydns.eu
127.0.0.1 thefreshstuffs.mu
127.0.0.1 cocinasintonterias.com
@@ -3859,7 +3932,6 @@
127.0.0.1 virpropcnow.xyz
127.0.0.1 avprotectionoverview.com
127.0.0.1 discordap.com
127.0.0.1 forwrdnow.com
127.0.0.1 7lyonline.com
127.0.0.1 safelyonline.net
@@ -4053,31 +4125,6 @@
127.0.0.1 mature-periwinkle-advantage.glitch.me
127.0.0.1 tough-numerous-lemur.glitch.me
127.0.0.1 securefirst.us-east-1.linodeobjects.com
127.0.0.1 39.65.72.211
127.0.0.1 42.238.151.197
127.0.0.1 27.213.60.53
@@ -4203,7 +4250,6 @@
127.0.0.1 wellhello.com
127.0.0.1 ru.com
127.0.0.1 141.8.226.34
127.0.0.1 discorde-nitre.xyz
127.0.0.1 ston-app.com
# fake human verification scam
# start form - reported for abuse
@@ -7132,6 +7178,7 @@
127.0.0.1 link.sv
127.0.0.1 4.fo
127.0.0.1 kckb.st
127.0.0.1 loadingnow.me
127.0.0.1 gsecurecontent.com
127.0.0.1 pressizer.net
@@ -18965,24 +19012,8 @@
# Domains on IPs known to host Discord Nitro spambots
127.0.0.1 cabura.loan
127.0.0.1 csgocup.ru
127.0.0.1 discord.foundation
127.0.0.1 discrod.ru
127.0.0.1 eslpro.ru
127.0.0.1 fortnitebuy.com
127.0.0.1 steamcommunlty.it
127.0.0.1 ggtour.ru
127.0.0.1 heroes.com.ua
@@ -18990,18 +19021,6 @@
127.0.0.1 market-csgo.ru
127.0.0.1 s-arts.pro
127.0.0.1 skinosoda.online
127.0.0.1 sleanmconmunltiy.ru
127.0.0.1 staemcommunty.ru
127.0.0.1 steamcomiunity.com
127.0.0.1 steamcommunillty.com
127.0.0.1 steamcommunjty.ru
127.0.0.1 steamcommunlity.ru
127.0.0.1 steamcomnnuity.com
127.0.0.1 steamconmunyty.ru
127.0.0.1 steamconunity.ru
127.0.0.1 steamcumunity.ru
127.0.0.1 stearncommynity.ru
127.0.0.1 tradeoffer.com.ru
127.0.0.1 194.226.139.121
127.0.0.1 194.226.139.7
@@ -22330,15 +22349,6 @@
127.0.0.1 1x1.cz
# ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ———
127.0.0.1 githubus.com
127.0.0.1 githubu.com
127.0.0.1 githu.com
127.0.0.1 wgithub.com
127.0.0.1 githubuser.com
127.0.0.1 rgithub.com
127.0.0.1 githubt.com
# ——— Usually used by various groups who buy old domains and display illicit ads on them ———
@@ -22410,21 +22420,6 @@
# Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require «AdGuard for Windows»)
# ——— Potential typo-squats and directly related stuff ———
127.0.0.1 snapchat.cm
127.0.0.1 facebook.cm
127.0.0.1 wix.cm
127.0.0.1 199.59.243.222
127.0.0.1 14d.us
127.0.0.1 173.208.96.42
127.0.0.1 173.208.96.43
127.0.0.1 173.208.96.44
127.0.0.1 173.208.96.45
127.0.0.1 173.208.96.46
127.0.0.1 213.227.149.208
127.0.0.1 213.227.149.211
# ——— Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control ———
@@ -22451,7 +22446,6 @@
# Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests
Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action
+84 -91
View File
@@ -1,6 +1,6 @@
{+block}
# Title: 💊 Dandelion Sprout's Anti-Malware List (for Privoxy)
# Version: 25December2023v1-Deprecated
# Version: 29December2023v2-Deprecated
# Expires: 2 days
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
@@ -219,11 +219,92 @@
.apps.apple.com/*/app/*/id1564900435
{+block}
# ——— Wrong TLDs of legitimate sites ———
# ——— Typo squatting, misspellings, and honest TLD address bar mistakes ———
.ubuntu.org
.103.224.212.249
.speedtest.com
.kelkoogroup.net
.snapchat.cm
.facebook.cm
.wix.cm
.199.59.243.222
.14d.us
.173.208.96.42
.173.208.96.43
.173.208.96.44
.173.208.96.45
.173.208.96.46
.213.227.149.208
.213.227.149.211
.ddscordapp.
.diicordapp.
.disccrdapp.
.dissordapp.
.discorrapp.
.discordaap.
.discordapp.cam
.discordap.com
.discord-nltro.
.discord-app.
.discord-promo*
.dlscord.
.dlscord-app.
.steamcommin*
.steamcommm*
.steamcommn*
.steamcommunet*
.steamcommunitty.
.steamcommunnity.
.steamcommunty.
.steamcommuu*
.steamcommyn*
.steamcomnu*
.steamcomrn*
.steamconnu*
.steancomm*
.steanncomu*
.discord-glft.
.discordnitrogift*
.gift-nitro.
.free-discordnitro.
.freediscordnitro.
/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/
#
/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/
/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/
#
.discord*.gifts
.discord-give.
.discord-nitro-gift.
.discord-nitro.
.discord-nitros.
.discord.foundation
.discordnitro-steam.
.discordxgift.
.discordxnitro.
.discrod.ru
.nitro*.gift
.nitro*.gifts
.sleanmconmunltiy.ru
.staemcommunty.ru
.steamcomiunity.com
.steamcommunillty.com
.steamcommunjty.ru
.steamcommunlity.ru
.steamcomnnuity.com
.steamconmunyty.ru
.steamconunity.ru
.steamcumunity.ru
.steanmconynnuytiy.
.stearncommynity.ru
.githubus.com
.githubu.com
.githu.com
.wgithub.com
.githubuser.com
.rgithub.com
.githubt.com
.discorde-nitre.xyz
{+block}
# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
@@ -284,13 +365,6 @@
.144.76.1.130
.195.201.92.254
.forgoprokick.icu
# Other
.ddscordapp.
.diicordapp.
.disccrdapp.
.dissordapp.
.discorrapp.
.discordaap.
?bemobdata=
.inbluson.com
.bemobtrcks.com
@@ -3712,7 +3786,6 @@
.microsoftedge.microsoft.com/addons/detail/rick-roll-prank-extension/cafkeihpipimekealiblfbjcgnnchdoj
.microsoftedge.microsoft.com/addons/detail/image-find/oallgpknmoodlcklmhgfpgjkdencmnfd
.microsoftedge.microsoft.com/addons/detail/kpckgoaeejpoghdglooeibkoedpkgock
.discordapp.cam
.nanorgin.ydns.eu
.thefreshstuffs.mu
.cocinasintonterias.com
@@ -3859,7 +3932,6 @@
.virpropcnow.xyz
.avprotectionoverview.com
/(|\.|//)tkqlhce\.com/click-.*([?&][a-tv-z]{1,}(=[a-zA-Z0-9]{1,})?){1,}
.discordap.com
.forwrdnow.com
.7lyonline.com
.safelyonline.net
@@ -4053,28 +4125,6 @@
.mature-periwinkle-advantage.glitch.me
.tough-numerous-lemur.glitch.me
.securefirst.us-east-1.linodeobjects.com
.discord-nltro.
.discord-app.
.discord-promo*
.dlscord.
.dlscord-app.
.steamcommin*
.steamcommm*
.steamcommn*
.steamcommunet*
.steamcommunitty.
.steamcommunnity.
.steamcommunty.
.steamcommuu*
.steamcommyn*
.steamcomnu*
.steamcomrn*
.steamconnu*
.steancomm*
.steanncomu*
.discord-glft.
.discordnitrogift*
.gift-nitro.
.39.65.72.211
.42.238.151.197
.27.213.60.53
@@ -4199,7 +4249,6 @@
.wellhello.com
.ru.com
.141.8.226.34
.discorde-nitre.xyz
.ston-app.com
# fake human verification scam
# start form - reported for abuse
@@ -7119,7 +7168,7 @@
.link.sv
.4.fo
.kckb.st
.*-trk.xyz
-trk.xyz
.loadingnow.me
.gsecurecontent.com
.pressizer.net
@@ -18943,49 +18992,18 @@
.csgocup.ru
.csgogf*.xyz
.csgogift*.xyz
/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/
#
/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/
/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/
#
.discord*.gifts
.discord-give.
.discord-nitro-gift.
.discord-nitro.
.discord-nitros.
.discord.foundation
.discordnitro-steam.
.discordxgift.
.discordxnitro.
.discrod.ru
.dotagift*.xyz
.eslpro.ru
.fortnitebuy.com
.free-discordnitro.
.freediscordnitro.
.steamcommunlty.it
.ggtour.ru
.heroes.com.ua
.idchecker.xyz
.market-csgo.ru
.nitro*.gift
.nitro*.gifts
.pubggf*.xyz
.pubggift*.xyz
.s-arts.pro
.skinosoda.online
.sleanmconmunltiy.ru
.staemcommunty.ru
.steamcomiunity.com
.steamcommunillty.com
.steamcommunjty.ru
.steamcommunlity.ru
.steamcomnnuity.com
.steamconmunyty.ru
.steamconunity.ru
.steamcumunity.ru
.steanmconynnuytiy.
.stearncommynity.ru
.tradeoffer.com.ru
.194.226.139.121
.194.226.139.7
@@ -22306,16 +22324,6 @@
.1x1.cz
#
{+block}
# ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ———
.githubus.com
.githubu.com
.githu.com
.wgithub.com
.githubuser.com
.rgithub.com
.githubt.com
{+block}
# ——— Usually used by various groups who buy old domains and display illicit ads on them ———
@@ -22346,21 +22354,6 @@
# Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require «AdGuard for Windows»)
.mb.download.gigabyte.com/FileList/Swhttp/DriverUpd/ANTIVIRUS
{+block}
# ——— Potential typo-squats and directly related stuff ———
.snapchat.cm
.facebook.cm
.wix.cm
.199.59.243.222
.14d.us
.173.208.96.42
.173.208.96.43
.173.208.96.44
.173.208.96.45
.173.208.96.46
.213.227.149.208
.213.227.149.211
{+block}
# ——— Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control ———
#
Alternate versions Anti-Malware List/AntiMalwareTPL.tpl
+89 -94
View File
@@ -1,6 +1,6 @@
msFilterList
# Title: 💊 Dandelion Sprout's Anti-Malware List (Internet Explorer TPL)
# Version: 25December2023v1-Deprecated
# Version: 29December2023v2-Deprecated
: expires = 2 days
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -339,11 +339,97 @@ msFilterList
# Other sites
-d apps.apple.com * app * id1564900435
# ——— Wrong TLDs of legitimate sites ———
# ——— Typo squatting, misspellings, and honest TLD address bar mistakes ———
-d ubuntu.org
-d 103.224.212.249
-d speedtest.com
-d kelkoogroup.net
-d snapchat.cm
-d facebook.cm
-d wix.cm
-d 199.59.243.222
-d 14d.us
-d 173.208.96.42
-d 173.208.96.43
-d 173.208.96.44
-d 173.208.96.45
-d 173.208.96.46
-d 213.227.149.208
-d 213.227.149.211
-d ddscordapp.
-d diicordapp.
-d disccrdapp.
-d dissordapp.
-d discorrapp.
-d discordaap.
-d discordapp.cam
-d discordap.com
# https://github.com/DevSpen/links/blob/master/src/links.txt
-d discord-nltro.
-d discord-app.
-d discord-promo*
-d dlscord.
-d dlscord-app.
-d steamcommin*
-d steamcommm*
-d steamcommn*
-d steamcommunet*
-d steamcommunitty.
-d steamcommunnity.
-d steamcommunty.
-d steamcommuu*
-d steamcommyn*
-d steamcomnu*
-d steamcomrn*
-d steamconnu*
-d steancomm*
-d steanncomu*
-d discord-glft.
-d discordnitrogift*
-d gift-nitro.
-d free-discordnitro.
-d freediscordnitro.
-d discord-give.
-d discord-nitro-gift.
-d discord-nitro.
-d discord-nitros.
-d discord.foundation
-d discordnitro-steam.
-d discordxgift.
-d discordxnitro.
-d discrod.ru
-d sleanmconmunltiy.ru
-d staemcommunty.ru
-d steamcomiunity.com
-d steamcommunillty.com
-d steamcommunjty.ru
-d steamcommunlity.ru
-d steamcomnnuity.com
-d steamconmunyty.ru
-d steamconunity.ru
-d steamcumunity.ru
-d steanmconynnuytiy.
-d stearncommynity.ru
-d githubus.com
-d githubu.com
-d githu.com
-d wgithub.com
-d githubuser.com
-d rgithub.com
-d githubt.com
# https://scammer.info/t/discord-nitro-scam-25/87887
-d discorde-nitre.xyz
# ——— Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn ———
-d netnet44.net
@@ -404,13 +490,6 @@ msFilterList
-d 195.201.92.254
# https://github.com/DandelionSprout/adfilt/pull/167
-d forgoprokick.icu
# Other
-d ddscordapp.
-d diicordapp.
-d disccrdapp.
-d dissordapp.
-d discorrapp.
-d discordaap.
# https://github.com/AdguardTeam/AdguardFilters/issues/124611
# (https://github.com/DandelionSprout/adfilt/issues/632)
@@ -3876,7 +3955,6 @@ msFilterList
-d microsoftedge.microsoft.com addons detail image-find oallgpknmoodlcklmhgfpgjkdencmnfd
-d microsoftedge.microsoft.com addons detail kpckgoaeejpoghdglooeibkoedpkgock
# https://github.com/DandelionSprout/adfilt/issues/251#issue-974102211
-d discordapp.cam
-d nanorgin.ydns.eu
-d thefreshstuffs.mu
-d cocinasintonterias.com
@@ -4069,7 +4147,6 @@ msFilterList
# (https://github.com/DandelionSprout/adfilt/issues/904)
# https://github.com/DandelionSprout/adfilt/issues/288
-d discordap.com
-d forwrdnow.com
-d 7lyonline.com
-d safelyonline.net
@@ -4305,32 +4382,6 @@ msFilterList
-d tough-numerous-lemur.glitch.me
# https://scammer.info/t/mcafee-phish/83725
-d securefirst.us-east-1.linodeobjects.com
# https://github.com/DevSpen/links/blob/master/src/links.txt
-d discord-nltro.
-d discord-app.
-d discord-promo*
-d dlscord.
-d dlscord-app.
-d steamcommin*
-d steamcommm*
-d steamcommn*
-d steamcommunet*
-d steamcommunitty.
-d steamcommunnity.
-d steamcommunty.
-d steamcommuu*
-d steamcommyn*
-d steamcomnu*
-d steamcomrn*
-d steamconnu*
-d steancomm*
-d steanncomu*
-d discord-glft.
-d discordnitrogift*
-d gift-nitro.
# https://www.virustotal.com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community
-d 39.65.72.211
-d 42.238.151.197
@@ -4507,8 +4558,6 @@ msFilterList
# https://github.com/AdguardTeam/AdguardFilters/issues/103475
-d ru.com
-d 141.8.226.34
# https://scammer.info/t/discord-nitro-scam-25/87887
-d discorde-nitre.xyz
# https://github.com/AdguardTeam/AdguardFilters/issues/108571
-d ston-app.com
# fake human verification scam
@@ -7469,7 +7518,7 @@ msFilterList
-d 4.fo
-d kckb.st
# https://github.com/AdguardTeam/AdguardFilters/issues/139106
-d *-trk.xyz
-trk.xyz
-d loadingnow.me
-d gsecurecontent.com
-d pressizer.net
@@ -19354,25 +19403,8 @@ msFilterList
-d discord-give.
-d discord-nitro-gift.
-d discord-nitro.
-d discord-nitros.
-d discord.foundation
-d discordnitro-steam.
-d discordxgift.
-d discordxnitro.
-d discrod.ru
-d eslpro.ru
-d fortnitebuy.com
-d free-discordnitro.
-d freediscordnitro.
-d steamcommunlty.it
-d ggtour.ru
-d heroes.com.ua
@@ -19380,22 +19412,8 @@ msFilterList
-d market-csgo.ru
-d s-arts.pro
-d skinosoda.online
-d sleanmconmunltiy.ru
-d staemcommunty.ru
-d steamcomiunity.com
-d steamcommunillty.com
-d steamcommunjty.ru
-d steamcommunlity.ru
-d steamcomnnuity.com
-d steamconmunyty.ru
-d steamconunity.ru
-d steamcumunity.ru
-d steanmconynnuytiy.
-d stearncommynity.ru
-d tradeoffer.com.ru
-d 194.226.139.121
-d 194.226.139.7
@@ -22730,15 +22748,6 @@ msFilterList
-d 1x1.cz
# ——— Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. ———
-d githubus.com
-d githubu.com
-d githu.com
-d wgithub.com
-d githubuser.com
-d rgithub.com
-d githubt.com
# ——— Usually used by various groups who buy old domains and display illicit ads on them ———
# ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835/———
@@ -22768,20 +22777,6 @@ msFilterList
# Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require «AdGuard for Windows»)
-d mb.download.gigabyte.com FileList Swhttp DriverUpd ANTIVIRUS
# ——— Potential typo-squats and directly related stuff ———
-d snapchat.cm
-d facebook.cm
-d wix.cm
-d 199.59.243.222
-d 14d.us
-d 173.208.96.42
-d 173.208.96.43
-d 173.208.96.44
-d 173.208.96.45
-d 173.208.96.46
-d 213.227.149.208
-d 213.227.149.211
# ——— Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control ———
# All legitimate Pac-Man games would use "pac-man" links with a dash
Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset
+1
View File
@@ -319,6 +319,7 @@
208.91.196.46
93.93.51.223
103.174.102.240
38.180.96.244
192.243.59.12
192.243.59.13
192.243.59.20