From f9e75edeee3a8778dd458eddafa464784dd00937 Mon Sep 17 00:00:00 2001 From: Imre Kristoffer Eilertsen Date: Mon, 8 Jan 2024 01:25:34 +0100 Subject: [PATCH] Add files via upload --- .../AntiMalwareABP.txt | 623 +++++++++--------- .../AntiMalwareAdGuard.txt | 489 +++++++------- .../AntiMalwareAdGuardHome.txt | 455 +++++++------ .../AntiMalwareDomains.txt | 176 +++-- .../AntiMalwareHosts.txt | 174 +++-- .../AntiMalwarePrivoxy.action | 175 +++-- .../AntiMalwareTPL.tpl | 183 +++-- ...out's and other adblocker lists' IPs.ipset | 1 + 8 files changed, 1119 insertions(+), 1157 deletions(-) diff --git a/Alternate versions Anti-Malware List/AntiMalwareABP.txt b/Alternate versions Anti-Malware List/AntiMalwareABP.txt index fbaa92d0a..0f2f6cb2a 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareABP.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareABP.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for Adblock Plus and AdBlock) -! Version: 25December2023v1 +! Version: 29December2023v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -483,12 +483,165 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href* play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$=".adblock"]) ||apps.apple.com/*/app/*/id1564900435^ -! β€”β€”β€” Wrong TLDs of legitimate sites β€”β€”β€” -||ubuntu.org^ +! β€”β€”β€” Typo squatting, misspellings, and honest TLD address bar mistakes β€”β€”β€” +||ubuntu.org^$domain=~you-were-likely-looking-for-ubuntu.com ||103.224.212.249^ -||speedtest.com^ +||speedtest.com^$domain=~you-were-likely-looking-for-speedtest.net ||kelkoogroup.net^ -||kelkoogroup.net^$popup +||kelkoogroup.net^$popup,~inline-font,domain=~fake-malware-version-of-kelkoogroup.com +||snapchat.cm^$domain=~malware-typo-squatter-of-snapchat.com +||facebook.cm^$domain=~malware-typo-squatter-of-facebook.com +||wix.cm^$domain=~malware-typo-squatter-of-wix.com +||199.59.243.222^ +|http://ww01.$domain=~very-very-extremely-frequently-used-in-malware-redirections.* +||14d.us^ +||14d.us^$popup,~inline-font,domain=~malware-redirection-and-also-you-were-very-likely-looking-for-1d4.us +||173.208.96.42^ +||173.208.96.42^$popup +||173.208.96.43^ +||173.208.96.43^$popup +||173.208.96.44^ +||173.208.96.44^$popup +||173.208.96.45^ +||173.208.96.45^$popup +||173.208.96.46^ +||173.208.96.46^$popup +||213.227.149.208^ +||213.227.149.208^$popup +||213.227.149.211^ +||213.227.149.211^$popup +||ddscordapp. +||ddscordapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||diicordapp. +||diicordapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||disccrdapp. +||disccrdapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||dissordapp. +||dissordapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discorrapp. +||discorrapp.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordaap. +||discordaap.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordapp.cam^ +||discordapp.cam^$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordap.com^ +||discordap.com^$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +! https://github.com/DevSpen/links/blob/master/src/links.txt +/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/ +/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/ +/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discord-nltro. +||discord-nltro.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discord-app. +||discord-app.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discord-promo* +||discord-promo*$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||dlscord. +||dlscord.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||dlscord-app. +||dlscord-app.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +/(^|\.|://)gifts?-?discord\..*/ +/(^|\.|://)gifts?-?discord\..*/$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||steamcommin*,domain=~likely-a-fake-malware-version-of-steamcommunity.com +||steamcommm* +||steamcommm*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommn* +||steamcommn*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunet* +||steamcommunet*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunitty. +||steamcommunitty.$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunnity. +||steamcommunnity.$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunty. +||steamcommunty.$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommuu* +||steamcommuu*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommyn* +||steamcommyn*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomnu* +||steamcomnu*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomrn* +||steamcomrn*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamconnu*,domain=~likely-a-fake-malware-version-of-steamcommunity.com +||steancomm*,domain=~likely-a-fake-malware-version-of-steamcommunity.com +||steanncomu* +||steanncomu*$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||discord-glft. +||discord-glft.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordnitrogift* +||discordnitrogift*$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||gift-nitro. +||gift-nitro.$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||free-discordnitro. +||free-discordnitro.$popup +||freediscordnitro. +||freediscordnitro.$popup +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup,~inline-font,domain=~fake-malware-version-of-discord.gift + +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup + +||discord*.gifts^ +||discord*.gifts^$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-give. +||discord-give.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-nitro-gift. +||discord-nitro-gift.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-nitro. +||discord-nitro.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-nitros. +||discord-nitros.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord.foundation^ +||discord.foundation^$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordnitro-steam. +||discordnitro-steam.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordxgift. +||discordxgift.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordxnitro. +||discordxnitro.$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||discrod.ru^ +||discrod.ru^$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com +||nitro*.gift^ +||nitro*.gift^$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||nitro*.gifts^ +||nitro*.gifts^$popup,~inline-font,domain=~fake-malware-version-of-discord.gift +||sleanmconmunltiy.ru^ +||sleanmconmunltiy.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||staemcommunty.ru^ +||staemcommunty.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomiunity.com^ +||steamcomiunity.com^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunillty.com^ +||steamcommunillty.com^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunjty.ru^ +||steamcommunjty.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunlity.ru^ +||steamcommunlity.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomnnuity.com^ +||steamcomnnuity.com^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamconmunyty.ru^ +||steamconmunyty.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamconunity.ru^ +||steamconunity.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcumunity.ru^ +||steamcumunity.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steanmconynnuytiy. +||steanmconynnuytiy.$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||stearncommynity.ru^ +||stearncommynity.ru^$popup,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||githubus.com^$domain=~you-were-likely-looking-for-githubusercontent.com +||githubu.com^$domain=~you-were-likely-looking-for-githubusercontent.com +||githu.com^$domain=~you-were-likely-looking-for-github.com +||wgithub.com^$domain=~you-were-likely-looking-for-githubusercontent.com +||githubuser.com^$domain=~you-were-likely-looking-for-githubusercontent.com +||rgithub.com^$domain=~you-were-likely-looking-for-githubusercontent.com +||githubt.com^$domain=~you-were-likely-looking-for-githubusercontent.com +! https://scammer.info/t/discord-nitro-scam-25/87887 +||discorde-nitre.xyz^ +||discorde-nitre.xyz^$popup,~inline-font,domain=~fake-malware-version-of-discordapp.com ! β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” ||netnet44.net^ @@ -522,7 +675,7 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$ ||proserpina-zeb.com^$popup ||lordagty.com^ ||madagty.com^ -||zeroredirect5.com^ +||zeroredirect5.com^$domain=~malware-redirection-trains.* ||54.209.22.226^ ||54.91.125.197^ ||52.202.53.245^ @@ -535,7 +688,7 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$ ||roamingclicks.com^$popup ! Source: desidert.no ||collectfasttracks.com^ -||collectfasttracks.com^$popup +||collectfasttracks.com^$popup,~inline-font,domain=~malware-redirection-trains.* ! Source: vn-zoom.com ||ttnrd.com^ ||ttnrd.com^$popup @@ -549,11 +702,11 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$ ||3.90.125.85^ ! Various ex-affiliate links at www.zombooru.com ||track.vcdc.com^ -||track.vcdc.com^$popup +||track.vcdc.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||track.tkbo.com^ -||track.tkbo.com^$popup +||track.tkbo.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||track.traffic.club^ -||track.traffic.club^$popup +||track.traffic.club^$popup,~inline-font,domain=~malware-redirection-trains.* ||lasvegas-vacations.net^ ||ndsplitter.com^ ||ns1.trafficclub.com^ @@ -571,19 +724,6 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/pull/167 ||forgoprokick.icu^ ||forgoprokick.icu^$popup -! Other -||ddscordapp. -||ddscordapp.$popup -||diicordapp. -||diicordapp.$popup -||disccrdapp. -||disccrdapp.$popup -||dissordapp. -||dissordapp.$popup -||discorrapp. -||discorrapp.$popup -||discordaap. -||discordaap.$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/124611 ! (https://github.com/DandelionSprout/adfilt/issues/632) ?bemobdata= @@ -591,15 +731,15 @@ zombooru.com##a[href="http://www.hard55.com"] ||inbluson.com^ ||inbluson.com^$popup ||bemobtrcks.com^ -||bemobtrcks.com^$popup +||bemobtrcks.com^$popup,~inline-font,domain=~malware-redirection-trains.* ! β€”β€”β€” Found in witness reports online β€”β€”β€” ! Adblock Plus list maintainer weekly reports ||pinoy-offers.com^ ||googleboost.xyz^ -||bemobtracks.com^$popup -||bemobtrk.com^$popup -||bemobpath.com^$popup +||bemobtracks.com^$popup,domain=~malware-redirection-trains.* +||bemobtrk.com^$popup,domain=~malware-redirection-trains.* +||bemobpath.com^$popup,domain=~malware-redirection-trains.* ||couponbybox.com^ ||newpage.in^ /mcaf04/*= @@ -6893,7 +7033,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||zmusic-online.com^ ||zmusic-online.com^$popup ||zredir.com^ -||zredir.com^$popup +||zredir.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||178.128.142.109^ ||findmedia.biz^ ||findmedia.biz^$popup @@ -7008,8 +7148,8 @@ zombooru.com##a[href="http://www.hard55.com"] ||quatrefeuillepolonaise.xyz^$popup ||extragifis.site^ ||extragifis.site^$popup -||best-prizes-202*.com^ -||all-best-prize-202*.com^ +||best-prizes-202*.com^$domain=~malware-site.* +||all-best-prize-202*.com^$domain=~malware-site.* ||captcharesolving-universe.com^ ||captcharesolving-universe.com^$popup ||captcharesolver.com^ @@ -7025,9 +7165,9 @@ zombooru.com##a[href="http://www.hard55.com"] ||kmip.net^ ||kmip.net^$popup ||0redirc.com^ -||0redirc.com^$popup +||0redirc.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||redirekted.com^ -||redirekted.com^$popup +||redirekted.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||rebiraert.com^ ||rebiraert.com^$popup ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^ @@ -7171,7 +7311,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||cpa-optimizer.online^ ||cpa-optimizer.online^$popup ||cpvlabtrk.online^ -||cpvlabtrk.online^$popup +||cpvlabtrk.online^$popup,~inline-font,domain=~malware-redirection-trains.* ||critical-alert.info^ ||critical-alert.info^$popup ||financial-message.club^ @@ -7404,8 +7544,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||microsoftedge.microsoft.com/addons/detail/image-find/oallgpknmoodlcklmhgfpgjkdencmnfd^ ||microsoftedge.microsoft.com/addons/detail/kpckgoaeejpoghdglooeibkoedpkgock^ ! https://github.com/DandelionSprout/adfilt/issues/251#issue-974102211 -||discordapp.cam^ -||discordapp.cam^$popup ||nanorgin.ydns.eu^ ||nanorgin.ydns.eu^$popup ||thefreshstuffs.mu^ @@ -7444,7 +7582,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||temp74.com^ ||temp74.com^$popup ||trackwebclick.com^ -||trackwebclick.com^$popup +||trackwebclick.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||23.111.31.137^ ||23.111.88.207^ ! https://github.com/DandelionSprout/adfilt/issues/254 @@ -7468,7 +7606,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||omnatuor.com^ ||omnatuor.com^$popup ||novitrk1.com^ -||novitrk1.com^$popup +||novitrk1.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||cu27t-evo29lution.xyz^ ||cu27t-evo29lution.xyz^$popup ||sothis-sayers.xyz^ @@ -7488,7 +7626,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||renewal-software-update.com^$popup ||pushmeup.art^ ||pushmeup.art^$popup -||trc.*.co^ +||trc.*.co^$domain=~malware-redirection-trains.* ||artofads.co^ ||pc-my-protection.xyz^ ||pc-my-protection.xyz^$popup @@ -7651,7 +7789,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||pcspeedup.en.softonic.com^$popup ! Copied from Β«uBlock Filters - Badware RisksΒ» because it has proven to be a very good entry ||1redirb.com^ -||1redirb.com^$popup +||1redirb.com^$popup,~inline-font,domain=~malware-redirection-trains.* ! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931700117 ||retailproductsusa.com^ ||retailproductsusa.com^$popup @@ -7659,12 +7797,12 @@ zombooru.com##a[href="http://www.hard55.com"] ||cloud-repos.store^$popup ! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931742337 (Initial batch) ||adtrk18.com^ -||adtrk18.com^$popup +||adtrk18.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||jpgtrk.com^ -||jpgtrk.com^$popup +||jpgtrk.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||pnghst.com^$popup ||pshtrk.com^ -||pshtrk.com^$popup +||pshtrk.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||diabasewoodhouse.xyz^ ||displayoptoffers.com^ ||displayoptoffers.com^$popup @@ -7713,8 +7851,6 @@ zombooru.com##a[href="http://www.hard55.com"] ! (https://github.com/DandelionSprout/adfilt/issues/904) /(^|\.|//)tkqlhce\.com/click-.*([?&][a-tv-z]{1,}(=[a-zA-Z0-9]{1,})?){1,}$/ ! https://github.com/DandelionSprout/adfilt/issues/288 -||discordap.com^ -||discordap.com^$popup ||forwrdnow.com^ ||7lyonline.com^ ||safelyonline.net^ @@ -7728,9 +7864,9 @@ zombooru.com##a[href="http://www.hard55.com"] ||newsvot.com^ ||adalgard-wol.com^ ||adalgard-wol.com^$popup -||trkk4.com^ +||trkk4.com^$domain=~malware-redirection-trains.* ||secure-access-*.gate23.xyz^ -||hosting-redirect.com^ +||hosting-redirect.com^$domain=~malware-redirection-trains.* ||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^ ! https://github.com/DandelionSprout/adfilt/pull/289 ||gogles.com^ @@ -7983,7 +8119,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||news-back.org^$popup ! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md &url_bnm_redirect= -&url_bnm_redirect=$popup +&url_bnm_redirect=$popup,~inline-font,domain=~malware-redirection-trains.* /mcafeedirect.jsp /mcafeedirect.jsp$popup,domain=~mcafee.com /beep.mp3^$domain=xyz|club|pro @@ -8096,7 +8232,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||holy-ruddy-brace.glitch.me^ ||holy-ruddy-brace.glitch.me^$popup ||instagramcomphoto212paaatrk.glitch.me^ -||instagramcomphoto212paaatrk.glitch.me^$popup +||instagramcomphoto212paaatrk.glitch.me^$popup,~inline-font,domain=~malware-redirection-trains.* ||instafollow.glitch.me^ ||instafollow.glitch.me^$popup ||loving-discovered-swordfish.glitch.me^ @@ -8110,54 +8246,6 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://scammer.info/t/mcafee-phish/83725 ||securefirst.us-east-1.linodeobjects.com^ ||securefirst.us-east-1.linodeobjects.com^$popup -! https://github.com/DevSpen/links/blob/master/src/links.txt -/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/ -/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/$popup -/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/ -/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/$popup -||discord-nltro. -||discord-nltro.$popup -||discord-app. -||discord-app.$popup -||discord-promo* -||discord-promo*$popup -||dlscord. -||dlscord.$popup -||dlscord-app. -||dlscord-app.$popup -/(^|\.|://)gifts?-?discord\..*/ -/(^|\.|://)gifts?-?discord\..*/$popup -||steamcommin* -||steamcommm* -||steamcommm*$popup -||steamcommn* -||steamcommn*$popup -||steamcommunet* -||steamcommunet*$popup -||steamcommunitty. -||steamcommunitty.$popup -||steamcommunnity. -||steamcommunnity.$popup -||steamcommunty. -||steamcommunty.$popup -||steamcommuu* -||steamcommuu*$popup -||steamcommyn* -||steamcommyn*$popup -||steamcomnu* -||steamcomnu*$popup -||steamcomrn* -||steamcomrn*$popup -||steamconnu* -||steancomm* -||steanncomu* -||steanncomu*$popup -||discord-glft. -||discord-glft.$popup -||discordnitrogift* -||discordnitrogift*$popup -||gift-nitro. -||gift-nitro.$popup ! https://www.virustotal.com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community ||39.65.72.211^ ||39.65.72.211^$popup @@ -8428,9 +8516,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||ru.com^$popup ||141.8.226.34^ ||141.8.226.34^$popup -! https://scammer.info/t/discord-nitro-scam-25/87887 -||discorde-nitre.xyz^ -||discorde-nitre.xyz^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/108571 ||ston-app.com^ ||ston-app.com^$popup @@ -8477,7 +8562,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||sites.google.com/mytv/maintenance^ ||sites.google.com/mytv/maintenance^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 -/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$popup +/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$popup,domain=~malware-redirection-trains.* ! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ β†’ https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^ ||pccrackworld.com^$popup @@ -8586,24 +8671,24 @@ zombooru.com##a[href="http://www.hard55.com"] ||specgoal.com^$popup ||sandhyapi.online^ ||sandhyapi.online^$popup -/trk2/*?lddomain= +/trk2/*?lddomain=,domain=~very-likely-a-malware-redirection.* ||rtbrvdirect.com^ -||rtbrvdirect.com^$popup +||rtbrvdirect.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||goprotectpc.com^ ||goprotectpc.com^$popup ||mybetterck.com^ ||mybetterck.com^$popup ||matildawu.online^ ||matildawu.online^$popup -||cpmrevdirect.com^ -||rtbverdirect.com^ +||cpmrevdirect.com^$domain=~malware-redirection-trains.* +||rtbverdirect.com^$domain=~malware-redirection-trains.* ||fsalfrwdr.com^ -||cpmvrdirect.com^ -||fadverdirect.com^ -||cpmrvdirect.com^ -||rtbrevdirect.com^ -||rtbvrdirect.com^ -||cpmverdirect.com^ +||cpmvrdirect.com^$domain=~malware-redirection-trains.* +||fadverdirect.com^$domain=~malware-redirection-trains.* +||cpmrvdirect.com^$domain=~malware-redirection-trains.* +||rtbrevdirect.com^$domain=~malware-redirection-trains.* +||rtbvrdirect.com^$domain=~malware-redirection-trains.* +||cpmverdirect.com^$domain=~malware-redirection-trains.* ||15.197.244.48^ ||96.47.230.67^ ||96.47.230.68^ @@ -8629,7 +8714,7 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 ||trafredirtds.com^ -||trafredirtds.com^$popup +||trafredirtds.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||com/landers/iphone*_spin ! https://github.com/AdguardTeam/AdguardFilters/issues/121772 ||pu020ev.com^ @@ -8637,7 +8722,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||kadam.net^ ||kadam.net^$popup ||kdtrk.net^ -||kdtrk.net^$popup +||kdtrk.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||clcpb.net^ ||clcpb.net^$popup ||kadam.ru^ @@ -8683,10 +8768,10 @@ zombooru.com##a[href="http://www.hard55.com"] ://adbrbk. ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 ||saferedirects.xyz^ -||saferedirects.xyz^$popup +||saferedirects.xyz^$popup,~inline-font,domain=~malware-redirection-trains.* ||online-guard.com^ ||online-guard.com^$popup -/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=,popup +/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=,popup,domain=~fake-site-with-malware.* ! https://twitter.com/iam_py_test/status/1545164642346930176 ||amazon-security-info.lnk.to^ ||amazon-security-info.lnk.to^$popup @@ -9171,13 +9256,13 @@ zombooru.com##a[href="http://www.hard55.com"] ||tov49ro5ep.art^ ||tov49ro5ep.art^$popup ||track2it4.icu^ -||track2it4.icu^$popup +||track2it4.icu^$popup,~inline-font,domain=~malware-redirection-trains.* ||trackerry.com^ -||trackerry.com^$popup +||trackerry.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||trackgdi.com^ -||trackgdi.com^$popup +||trackgdi.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||trckrry.com^ -||trckrry.com^$popup +||trckrry.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||udlwwle.site^ ||udlwwle.site^$popup ||uij5nn-ta.cyou^ @@ -9723,7 +9808,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||vooculok.com^ ||vooculok.com^$popup ||mobytrks.com^ -||mobytrks.com^$popup +||mobytrks.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||139.45.197.236^ ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^ @@ -9769,7 +9854,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||146.19.169.98^ ||146.19.169.99^ ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 -/pushredirect/? +/pushredirect/?,domain=~malware-redirection-trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 ||1000girl.com^ ||1000girl.com^$popup @@ -11356,7 +11441,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||keystonehoops.com^ ||keystonehoops.com^$popup ||keywebtracker.com^ -||keywebtracker.com^$popup +||keywebtracker.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||keywordadvisetoolplus.com^ ||keywordadvisetoolplus.com^$popup ||kickoff.cm^ @@ -13433,7 +13518,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||civadsoo.net^ ||civadsoo.net^$popup ||clicktracklink.com^ -||clicktracklink.com^$popup +||clicktracklink.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||comivolo.com^ ||comivolo.com^$popup ||consoupow.com^ @@ -14217,8 +14302,8 @@ zombooru.com##a[href="http://www.hard55.com"] ||kckb.st^ ||kckb.st^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 -||*-trk.xyz^ -||*-trk.xyz^$popup +-trk.xyz^ +-trk.xyz^$popup,~inline-font,domain=~malware-redirection-trains.* ||loadingnow.me^ ||loadingnow.me^$popup ||gsecurecontent.com^ @@ -20237,10 +20322,10 @@ zombooru.com##a[href="http://www.hard55.com"] ||uthyr-que.com^ ||uthyr-que.com^$popup ||zeroredirect1.com^ -||zeroredirect1.com^$popup +||zeroredirect1.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||zp-dom.com^ ||zp-dom.com^$popup -||redirect.newprogrammatic.click^ +||redirect.newprogrammatic.click^$domain=~likely-a-malware-redirection.* ||arcad-hoh.com^ ||arcad-hoh.com^$popup ||eadri-fnr.com^ @@ -20320,7 +20405,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||92.204.160.240^ ||92.204.160.240^$popup ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 -/land/*&afftrack= +/land/*&afftrack=,domain=~likely-a-malware-redirection.* ! Comments on Slack ||antivirussprotection.com^ ||antivirussprotection.com^$popup @@ -20897,9 +20982,9 @@ zombooru.com##a[href="http://www.hard55.com"] ||jump-path2.com^ ||jump-path2.com^$popup ||redirect-path1.com^ -||redirect-path1.com^$popup +||redirect-path1.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||redirect-path2.com^ -||redirect-path2.com^$popup +||redirect-path2.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||your-online-casino.com^ ||your-online-casino.com^$popup ||hot-girls-around.com^ @@ -20953,9 +21038,9 @@ zombooru.com##a[href="http://www.hard55.com"] ||pw-show-test.com^ ||pw-show-test.com^$popup ||pwredir-*.com^ -||pwredir-*.com^$popup +||pwredir-*.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||redir-pw*.com^ -||redir-pw*.com^$popup +||redir-pw*.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||rich-people-club.com^ ||rich-people-club.com^$popup ||search-top-videos.com^ @@ -21223,7 +21308,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||cpa-optimizer.online^ ||cpa-optimizer.online^$popup ||cpvlabtrk.online^ -||cpvlabtrk.online^$popup +||cpvlabtrk.online^$popup,~inline-font,domain=~malware-redirection-trains.* ||critical-alert.info^ ||critical-alert.info^$popup ||daily-breaking-news.one^ @@ -21397,7 +21482,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||pclkpackg.xyz^ ||pclkpackg.xyz^$popup ||pclkredrct.xyz^ -||pclkredrct.xyz^$popup +||pclkredrct.xyz^$popup,~inline-font,domain=~malware-redirection-trains.* ||popular-messages.com^ ||popular-messages.com^$popup ||premium-news-for.me^ @@ -21413,7 +21498,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||private-show.live^ ||private-show.live^$popup ||pushapitracker.com^ -||pushapitracker.com^$popup +||pushapitracker.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||read-and-reveal.com^ ||read-and-reveal.com^$popup ||read-before-the-rest.com^ @@ -21549,7 +21634,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||trends-celebs.com^ ||trends-celebs.com^$popup ||ts-tracker.me^ -||ts-tracker.me^$popup +||ts-tracker.me^$popup,~inline-font,domain=~malware-redirection-trains.* ||updates-news-magazine.com^ ||updates-news-magazine.com^$popup ||very-important.online^ @@ -21618,29 +21703,29 @@ zombooru.com##a[href="http://www.hard55.com"] ||puredi.net^ ||puredi.net^$popup ||redic.net^ -||redic.net^$popup +||redic.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||redic2.net^ -||redic2.net^$popup +||redic2.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||redic3.com^ -||redic3.com^$popup +||redic3.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||redic4.com^ -||redic4.com^$popup +||redic4.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||redir2.net^ -||redir2.net^$popup +||redir2.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||redir3.net^ -||redir3.net^$popup +||redir3.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||redir4.net^ -||redir4.net^$popup +||redir4.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||redir5.net^ -||redir5.net^$popup +||redir5.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||redir6.net^ -||redir6.net^$popup +||redir6.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||redir7.net^ -||redir7.net^$popup +||redir7.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||redir8.net^ -||redir8.net^$popup +||redir8.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||redir9.net^ -||redir9.net^$popup +||redir9.net^$popup,~inline-font,domain=~malware-redirection-trains.* ||rejco.online^ ||rejco.online^$popup ||rejco2.store^ @@ -22214,7 +22299,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||gliceebe.xyz^$popup ||gloacmug.net^ ||gloacmug.net^$popup -||go.redirected*/click?^$popup +||go.redirected*/click?^$popup,domain=~malware-redirection-trains.* ||goldfishka-casino.xyz^ ||goldfishka-casino.xyz^$popup ||gousauhu.xyz^ @@ -22816,7 +22901,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||rcqmrz.com^ ||rcqmrz.com^$popup ||redirected1.com^ -||redirected1.com^$popup +||redirected1.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||rfduik.com^ ||rfduik.com^$popup ||rgitpv.com^ @@ -23954,7 +24039,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||searchexcellent.com^ ||searchexcellent.com^$popup ||searchingredirect.com^ -||searchingredirect.com^$popup +||searchingredirect.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||searchinquire.com^ ||searchinquire.com^$popup ||searchsimilars.com^ @@ -33108,7 +33193,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||zapprecisionadmire.com^$popup ||zealousstraitcommit.com^ ||zealousstraitcommit.com^$popup -://trk.*.run/ +://trk.*.run/,domain=~very-likely-a-malware-redirection-train.* ! https://github.com/AdguardTeam/AdguardFilters/issues/159157 ||apbbjmp.com^ ||apbbjmp.com^$popup @@ -33282,7 +33367,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||cloud-network.online^ ||cloud-network.online^$popup ||cmcmdirrect.com^ -||cmcmdirrect.com^$popup +||cmcmdirrect.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||coltersaidas.com^ ||coltersaidas.com^$popup ||com-96-hours.com^ @@ -33532,7 +33617,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||qc1.site^ ||qc1.site^$popup ||redirect2url.com^ -||redirect2url.com^$popup +||redirect2url.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||revoiut-cy.com^ ||revoiut-cy.com^$popup ||revoke.money^ @@ -33963,17 +34048,17 @@ zombooru.com##a[href="http://www.hard55.com"] ||204.44.92.187 ||204.44.92.187$popup ://ap-trk. -://ap-trk.$popup +://ap-trk.$popup,~inline-font,domain=~malware-redirection-trains.* ://cw-trk. -://cw-trk.$popup +://cw-trk.$popup,~inline-font,domain=~malware-redirection-trains.* ://cw-trak. -://cw-trak.$popup +://cw-trak.$popup,~inline-font,domain=~malware-redirection-trains.* ://ktraks. -://ktraks.$popup +://ktraks.$popup,~inline-font,domain=~malware-redirection-trains.* ://flow-clck. -://flow-clck.$popup +://flow-clck.$popup,~inline-font,domain=~malware-redirection-trains.* ://apps-trk. -://apps-trk.$popup +://apps-trk.$popup,~inline-font,domain=~malware-redirection-trains.* ! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103 ||betzykrisesenter.no^ ||citra2010oslo.no^ @@ -37856,7 +37941,7 @@ toorgle.net##.join ||spizzicopizza.net^ ||spizzicopizza.net^$popup ! Other -||redirectme.net^ +||redirectme.net^$domain=~malware-redirection-trains.* ||anthargo.com^ ! Domains on IPs known to host Discord Nitro spambots @@ -37867,42 +37952,12 @@ toorgle.net##.join ||csgogf*.xyz^$popup ||csgogift*.xyz^ ||csgogift*.xyz^$popup -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup - -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup - -||discord*.gifts^ -||discord*.gifts^$popup -||discord-give. -||discord-give.$popup -||discord-nitro-gift. -||discord-nitro-gift.$popup -||discord-nitro. -||discord-nitro.$popup -||discord-nitros. -||discord-nitros.$popup -||discord.foundation^ -||discord.foundation^$popup -||discordnitro-steam. -||discordnitro-steam.$popup -||discordxgift. -||discordxgift.$popup -||discordxnitro. -||discordxnitro.$popup -||discrod.ru^ -||discrod.ru^$popup ||dotagift*.xyz^ ||dotagift*.xyz^$popup ||eslpro.ru^ ||eslpro.ru^$popup ||fortnitebuy.com^ ||fortnitebuy.com^$popup -||free-discordnitro. -||free-discordnitro.$popup -||freediscordnitro. -||freediscordnitro.$popup ||steamcommunlty.it^ ||steamcommunlty.it^$popup ||ggtour.ru^ @@ -37913,10 +37968,6 @@ toorgle.net##.join ||idchecker.xyz^$popup ||market-csgo.ru^ ||market-csgo.ru^$popup -||nitro*.gift^ -||nitro*.gift^$popup -||nitro*.gifts^ -||nitro*.gifts^$popup ||pubggf*.xyz^ ||pubggf*.xyz^$popup ||pubggift*.xyz^ @@ -37925,30 +37976,6 @@ toorgle.net##.join ||s-arts.pro^$popup ||skinosoda.online^ ||skinosoda.online^$popup -||sleanmconmunltiy.ru^ -||sleanmconmunltiy.ru^$popup -||staemcommunty.ru^ -||staemcommunty.ru^$popup -||steamcomiunity.com^ -||steamcomiunity.com^$popup -||steamcommunillty.com^ -||steamcommunillty.com^$popup -||steamcommunjty.ru^ -||steamcommunjty.ru^$popup -||steamcommunlity.ru^ -||steamcommunlity.ru^$popup -||steamcomnnuity.com^ -||steamcomnnuity.com^$popup -||steamconmunyty.ru^ -||steamconmunyty.ru^$popup -||steamconunity.ru^ -||steamconunity.ru^$popup -||steamcumunity.ru^ -||steamcumunity.ru^$popup -||steanmconynnuytiy. -||steanmconynnuytiy.$popup -||stearncommynity.ru^ -||stearncommynity.ru^$popup ||tradeoffer.com.ru^ ||tradeoffer.com.ru^$popup ||194.226.139.121^ @@ -39349,9 +39376,9 @@ tumblr.com#?#div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://b apkfab.com##.tip-extension ! Google results for 'Katy and Bob: Cake CafΓ© powerpc' (04/11/2022) ||xxlmag.com/redirect^ -||xxlmag.com/redirect^$popup +||xxlmag.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* ||ultimateclassicrock.com/redirect^ -||ultimateclassicrock.com/redirect^$popup +||ultimateclassicrock.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* ||2y68554.cyou^ ||2y68554.cyou^$popup ||1pwk1j.cyou^ @@ -39363,13 +39390,13 @@ apkfab.com##.tip-extension ||imaot.co.il/ContentArea/BannerClick^ ||imaot.co.il/ContentArea/BannerClick^$popup ||q1065.fm/redirect^ -||q1065.fm/redirect^$popup +||q1065.fm/redirect^$popup,~inline-font,domain=~malware-redirection-results.* ||wobm.com/redirect^ -||wobm.com/redirect^$popup +||wobm.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* ||us105fm.com/redirect^ -||us105fm.com/redirect^$popup +||us105fm.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* ||wnbf.com/redirect^ -||wnbf.com/redirect^$popup +||wnbf.com/redirect^$popup,~inline-font,domain=~malware-redirection-results.* ||ynxqoc2.cyou^ ||ynxqoc2.cyou^$popup ||resurrectionlinks.online^ @@ -39382,9 +39409,9 @@ apkfab.com##.tip-extension ||zh1653.com^$popup ||45.136.49.35^ ||semex.com/popurl.cgi^ -||semex.com/popurl.cgi^$popup +||semex.com/popurl.cgi^$popup,~inline-font,domain=~malware-redirection-results.* ||pharmanimal.com/catalog/redirect.php^ -||pharmanimal.com/catalog/redirect.php^$popup +||pharmanimal.com/catalog/redirect.php^$popup,~inline-font,domain=~malware-redirection-results.* ! Browsing around for Tajik newssites ||arhernot.live^ ||arhernot.live^$popup @@ -39504,7 +39531,7 @@ apkfab.com##.tip-extension ||diverseflowlink.com^ ||diverseflowlink.com^$popup ||redirectedflow.com^ -||redirectedflow.com^$popup +||redirectedflow.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||pcbasicstrength.com^ ||pcbasicstrength.com^$popup ||conceptualizefact.com^ @@ -39630,8 +39657,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||34.80.59.191^ ||34.80.59.191^$popup ! Various domains on https://securitytrails.com/list/ip/72.14.178.174 -|http://www6. -|http://www1.*&kw +|http://www6.$domain=~often-used-in-malware-redirections.* +|http://www1.*&kw,domain=~often-used-in-malware-redirections.* ||megabooru.com^ ||megabooru.com^$popup ||zombooru.com^ @@ -39732,7 +39759,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||awesomewinners.net^ ||awesomewinners.net^$popup ||b2ztrk.com^ -||b2ztrk.com^$popup +||b2ztrk.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||beastgadget.net^ ||beastgadget.net^$popup ||beastoffer.net^ @@ -40398,7 +40425,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||yasdoodl.com^ ||yasdoodl.com^$popup ||ym3trk.com^ -||ym3trk.com^$popup +||ym3trk.com^$popup,~inline-font,domain=~malware-redirection-trains.* ||youwanthis.com^ ||youwanthis.com^$popup ||zebramode.com^ @@ -44454,22 +44481,22 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat ||[2606:4700:3030::6815:5284]^$popup ||[2606:4700:3037::ac43:9e39]^$popup ! Google results for Β«SodaStream site:no cranberryΒ» -/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|Ρ€Ρ„|%D1%80%D1%84)$/ -||adservice.google.*/ddm/clk/ -/ad_click/q?&url= +/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|Ρ€Ρ„|%D1%80%D1%84)$/$domain=~malware-redirection-results.* +||adservice.google.*/ddm/clk/$domain=~malware-redirection-results.* +/ad_click/q?&url=,domain=~malware-redirection-results.* ! Laughably blatant fraud site ||cosercosplay.com^ ||cosercosplay.com^$popup ! β€”β€”β€” Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. -||unofficialtwrp.com^ -||androidweblog.com^ -||androidgreek.com^ -||ytechb.com^ -||gadgetstwist.com^ -||gadgetsfarms.com^ -||techorfy.com^ +||unofficialtwrp.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||androidweblog.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||androidgreek.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||ytechb.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||gadgetstwist.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||gadgetsfarms.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||techorfy.com^$domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* ! β€”β€”β€” If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions β€”β€”β€” @@ -44482,15 +44509,6 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat |1x1.cz^ -! β€”β€”β€” Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. β€”β€”β€” -||githubus.com^ -||githubu.com^ -||githu.com^ -||wgithub.com^ -||githubuser.com^ -||rgithub.com^ -||githubt.com^ - ! β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” ://ww4.$domain=~ww4.ikea.com ://ww5.$domain=~ww5.ikea.com|~ww5.msu.ac.zw @@ -44498,47 +44516,47 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat ://ww7.$domain=~ww7.be|~ww7.readsnk.com ://ww8.$domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com ://ww9.$domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br -://ww10. -://ww11. -://ww12. -://ww13. -://ww14. -://ww15.$domain=~ww15.nl -://ww16. -://ww17. -://ww18. -://ww19. -://ww20. -://ww21. -://ww22. -://ww23. -://ww24. -://ww25. -://ww26. -://ww27. -://ww28. -://ww29. -://ww30. -://ww31. -://ww32. -://ww33. -://ww34. -://ww35. -://ww36. -://ww37. -://ww38. -://ww39. -://ww40. -://ww41. -://ww42. -://ww43. -://ww44. -://ww45. -://ww46. -://ww47. -://ww48. -://ww49. -://ww50. +://ww10.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww11.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww12.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww13.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww14.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww15.$domain=~ww15.nl|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww16.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww17.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww18.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww19.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww20.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww21.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww22.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww23.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww24.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww25.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww26.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww27.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww28.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww29.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww30.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww31.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww32.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww33.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww34.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww35.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww36.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww37.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww38.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww39.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww40.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww41.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww42.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww43.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww44.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww45.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww46.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww47.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww48.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww49.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww50.$domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* ! β€”β€”β€” Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 β€”β€”β€” !!!/\\/ @@ -44578,29 +44596,6 @@ get.adobe.com###offersInformationPane ! Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require Β«AdGuard for WindowsΒ») ||mb.download.gigabyte.com/FileList/Swhttp/DriverUpd/ANTIVIRUS^ -! β€”β€”β€” Potential typo-squats and directly related stuff β€”β€”β€” -||snapchat.cm^ -||facebook.cm^ -||wix.cm^ -||199.59.243.222^ -|http://ww01. -||14d.us^ -||14d.us^$popup -||173.208.96.42^ -||173.208.96.42^$popup -||173.208.96.43^ -||173.208.96.43^$popup -||173.208.96.44^ -||173.208.96.44^$popup -||173.208.96.45^ -||173.208.96.45^$popup -||173.208.96.46^ -||173.208.96.46^$popup -||213.227.149.208^ -||213.227.149.208^$popup -||213.227.149.211^ -||213.227.149.211^$popup - ! β€”β€”β€” Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control β€”β€”β€” www.microsoft.com##a[data-pfns][href*=imposter] www.microsoft.com##a[data-pfns][href*=impostor] diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt index a0c326d49..a49c2bd9b 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuard.txt @@ -1,6 +1,6 @@ [AdGuard] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard) -! Version: 25December2023v1 +! Version: 29December2023v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -468,11 +468,98 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href* play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$=".adblock"]) ||apps.apple.com/*/app/*/id1564900435^$document -! β€”β€”β€” Wrong TLDs of legitimate sites β€”β€”β€” -||ubuntu.org^$document +! β€”β€”β€” Typo squatting, misspellings, and honest TLD address bar mistakes β€”β€”β€” +||ubuntu.org^$document,domain=~you-were-likely-looking-for-ubuntu.com 103.224.212.249$network -||speedtest.com^$document -||kelkoogroup.net^$all +||speedtest.com^$document,domain=~you-were-likely-looking-for-speedtest.net +||kelkoogroup.net^$all,~inline-font,domain=~fake-malware-version-of-kelkoogroup.com +||snapchat.cm^$document,domain=~malware-typo-squatter-of-snapchat.com +||facebook.cm^$document,domain=~malware-typo-squatter-of-facebook.com +||wix.cm^$document,domain=~malware-typo-squatter-of-wix.com +199.59.243.222$network +|http://ww01.$document,domain=~very-very-extremely-frequently-used-in-malware-redirections.* +||14d.us^$all,~inline-font,domain=~malware-redirection-and-also-you-were-very-likely-looking-for-1d4.us +173.208.96.42$network +173.208.96.43$network +173.208.96.44$network +173.208.96.45$network +173.208.96.46$network +213.227.149.208$network +213.227.149.211$network +||ddscordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||diicordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||disccrdapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||dissordapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discorrapp.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordaap.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordapp.cam^$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discordap.com^$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +! https://github.com/DevSpen/links/blob/master/src/links.txt +/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discord-nltro.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discord-app.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||discord-promo*$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||dlscord.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||dlscord-app.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +/(^|\.|://)gifts?-?discord\..*/$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||steamcommin*$document,domain=~likely-a-fake-malware-version-of-steamcommunity.com +||steamcommm*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommn*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunet*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunitty.$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunnity.$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunty.$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommuu*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommyn*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomnu*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomrn*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamconnu*$document,domain=~likely-a-fake-malware-version-of-steamcommunity.com +||steancomm*$document,domain=~likely-a-fake-malware-version-of-steamcommunity.com +||steanncomu*$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||discord-glft.$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordnitrogift*$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||gift-nitro.$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||free-discordnitro.$all +||freediscordnitro.$all +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$all,~inline-font,domain=~fake-malware-version-of-discord.gift +!#if false +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup +!#endif +||discord*.gifts^$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-give.$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-nitro-gift.$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-nitro.$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord-nitros.$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discord.foundation^$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordnitro-steam.$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordxgift.$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discordxnitro.$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||discrod.ru^$all,~inline-font,domain=~fake-malware-version-of-discordapp.com +||nitro*.gift^$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||nitro*.gifts^$all,~inline-font,domain=~fake-malware-version-of-discord.gift +||sleanmconmunltiy.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||staemcommunty.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomiunity.com^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunillty.com^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunjty.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcommunlity.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcomnnuity.com^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamconmunyty.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamconunity.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steamcumunity.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||steanmconynnuytiy.$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||stearncommynity.ru^$all,~inline-font,domain=~fake-malware-version-of-steamcommunity.com +||githubus.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com +||githubu.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com +||githu.com^$document,domain=~you-were-likely-looking-for-github.com +||wgithub.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com +||githubuser.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com +||rgithub.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com +||githubt.com^$document,domain=~you-were-likely-looking-for-githubusercontent.com +! https://scammer.info/t/discord-nitro-scam-25/87887 +||discorde-nitre.xyz^$all,~inline-font,domain=~fake-malware-version-of-discordapp.com ! β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” ||netnet44.net^$all @@ -495,7 +582,7 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$ ||proserpina-zeb.com^$all ||lordagty.com^$document ||madagty.com^$document -||zeroredirect5.com^$document +||zeroredirect5.com^$document,domain=~malware-redirection-trains.* 54.209.22.226$network 54.91.125.197$network 52.202.53.245$network @@ -506,7 +593,7 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$ 3.216.243.46$network ||roamingclicks.com^$all ! Source: desidert.no -||collectfasttracks.com^$all +||collectfasttracks.com^$all,~inline-font,domain=~malware-redirection-trains.* ! Source: vn-zoom.com ||ttnrd.com^$all ||amanda.*.com^$document @@ -518,9 +605,9 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$ 35.172.40.232$network 3.90.125.85$network ! Various ex-affiliate links at www.zombooru.com -||track.vcdc.com^$all -||track.tkbo.com^$all -||track.traffic.club^$all +||track.vcdc.com^$all,~inline-font,domain=~malware-redirection-trains.* +||track.tkbo.com^$all,~inline-font,domain=~malware-redirection-trains.* +||track.traffic.club^$all,~inline-font,domain=~malware-redirection-trains.* ||lasvegas-vacations.net^$document ||ndsplitter.com^$document ||ns1.trafficclub.com^$all @@ -536,26 +623,19 @@ zombooru.com##a[href="http://www.analbooru.com/"] zombooru.com##a[href="http://www.hard55.com"] ! https://github.com/DandelionSprout/adfilt/pull/167 ||forgoprokick.icu^$all -! Other -||ddscordapp.$all -||diicordapp.$all -||disccrdapp.$all -||dissordapp.$all -||discorrapp.$all -||discordaap.$all ! https://github.com/AdguardTeam/AdguardFilters/issues/124611 ! (https://github.com/DandelionSprout/adfilt/issues/632) ?bemobdata=$all ||inbluson.com^$all -||bemobtrcks.com^$all +||bemobtrcks.com^$all,~inline-font,domain=~malware-redirection-trains.* ! β€”β€”β€” Found in witness reports online β€”β€”β€” ! Adblock Plus list maintainer weekly reports ||pinoy-offers.com^ ||googleboost.xyz^$document -||bemobtracks.com^$document,popup -||bemobtrk.com^$document,popup -||bemobpath.com^$document,popup +||bemobtracks.com^$document,popup,domain=~malware-redirection-trains.* +||bemobtrk.com^$document,popup,domain=~malware-redirection-trains.* +||bemobpath.com^$document,popup,domain=~malware-redirection-trains.* ||couponbybox.com^$document ||newpage.in^$document /mcaf04/*=$document @@ -3718,7 +3798,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||zfirst-news.com^$all ||zmp3-online.com^$all ||zmusic-online.com^$all -||zredir.com^$all +||zredir.com^$all,~inline-font,domain=~malware-redirection-trains.* 178.128.142.109$network ||findmedia.biz^$all ||backtonews.biz^$all @@ -3797,8 +3877,8 @@ zombooru.com##a[href="http://www.hard55.com"] ||gogle.net^$all ||quatrefeuillepolonaise.xyz^$all ||extragifis.site^$all -||best-prizes-202*.com^$document -||all-best-prize-202*.com^$document +||best-prizes-202*.com^$document,domain=~malware-site.* +||all-best-prize-202*.com^$document,domain=~malware-site.* ||captcharesolving-universe.com^$all ||captcharesolver.com^$all ||instantfwding.com^$all @@ -3806,8 +3886,8 @@ zombooru.com##a[href="http://www.hard55.com"] ||gamesex.fun^$all ||goldprize.xyz^$all ||kmip.net^$all -||0redirc.com^$all -||redirekted.com^$all +||0redirc.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirekted.com^$all,~inline-font,domain=~malware-redirection-trains.* ||rebiraert.com^$all ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$all 5.8.34.26$network @@ -3890,7 +3970,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||click-to-see.live^$all ||click-to-watch.live^$all ||cpa-optimizer.online^$all -||cpvlabtrk.online^$all +||cpvlabtrk.online^$all,~inline-font,domain=~malware-redirection-trains.* ||critical-alert.info^$all ||financial-message.club^$all ||free-coupons.network^$all @@ -4017,7 +4097,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||microsoftedge.microsoft.com/addons/detail/image-find/oallgpknmoodlcklmhgfpgjkdencmnfd^$document ||microsoftedge.microsoft.com/addons/detail/kpckgoaeejpoghdglooeibkoedpkgock^$document ! https://github.com/DandelionSprout/adfilt/issues/251#issue-974102211 -||discordapp.cam^$all ||nanorgin.ydns.eu^$all ||thefreshstuffs.mu^$all ||cocinasintonterias.com^$all @@ -4038,7 +4117,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||mediagetplus.com^$all ||mgmgmg.com^$all ||temp74.com^$all -||trackwebclick.com^$all +||trackwebclick.com^$all,~inline-font,domain=~malware-redirection-trains.* 23.111.31.137$network 23.111.88.207$network ! https://github.com/DandelionSprout/adfilt/issues/254 @@ -4054,7 +4133,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||beastbuying.com^$document ||pesoaniz.com^$document ||omnatuor.com^$all -||novitrk1.com^$all +||novitrk1.com^$all,~inline-font,domain=~malware-redirection-trains.* ||cu27t-evo29lution.xyz^$all ||sothis-sayers.xyz^$all ||doneonline.xyz^$document @@ -4065,7 +4144,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||secureleadsforever.com^$all ||renewal-software-update.com^$all ||pushmeup.art^$all -||trc.*.co^$document +||trc.*.co^$document,domain=~malware-redirection-trains.* ||artofads.co^$document ||pc-my-protection.xyz^$all ||beta-news.org^$document @@ -4172,15 +4251,15 @@ zombooru.com##a[href="http://www.hard55.com"] ||tweakbit.com^$all ||pcspeedup.en.softonic.com^$all ! Copied from Β«uBlock Filters - Badware RisksΒ» because it has proven to be a very good entry -||1redirb.com^$all +||1redirb.com^$all,~inline-font,domain=~malware-redirection-trains.* ! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931700117 ||retailproductsusa.com^$all ||cloud-repos.store^$all ! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931742337 (Initial batch) -||adtrk18.com^$all -||jpgtrk.com^$all +||adtrk18.com^$all,~inline-font,domain=~malware-redirection-trains.* +||jpgtrk.com^$all,~inline-font,domain=~malware-redirection-trains.* ||pnghst.com^$document,popup -||pshtrk.com^$all +||pshtrk.com^$all,~inline-font,domain=~malware-redirection-trains.* ||diabasewoodhouse.xyz^$document ||displayoptoffers.com^$all ||spnccrzone.com^$all @@ -4210,7 +4289,6 @@ zombooru.com##a[href="http://www.hard55.com"] ! (https://github.com/DandelionSprout/adfilt/issues/904) /(^|\.|//)tkqlhce\.com/click-.*([?&][a-tv-z]{1,}(=[a-zA-Z0-9]{1,})?){1,}$/$document ! https://github.com/DandelionSprout/adfilt/issues/288 -||discordap.com^$all ||forwrdnow.com^$document ||7lyonline.com^$document ||safelyonline.net^$document @@ -4221,9 +4299,9 @@ zombooru.com##a[href="http://www.hard55.com"] ||data-px.services^$document ||newsvot.com^$document ||adalgard-wol.com^$all -||trkk4.com^$document +||trkk4.com^$document,domain=~malware-redirection-trains.* ||secure-access-*.gate23.xyz^$document -||hosting-redirect.com^$document +||hosting-redirect.com^$document,domain=~malware-redirection-trains.* ||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^$document ! https://github.com/DandelionSprout/adfilt/pull/289 ||gogles.com^$all @@ -4377,7 +4455,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||security-scanner.xyz^$all ||news-back.org^$all ! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md -&url_bnm_redirect=$all +&url_bnm_redirect=$all,~inline-font,domain=~malware-redirection-trains.* /mcafeedirect.jsp$all,domain=~mcafee.com /beep.mp3^$domain=xyz|club|pro ||kokotrokot.com^$all @@ -4440,7 +4518,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||delicate-tame-angora.glitch.me^$all ||secureinvoice.glitch.me^$all ||holy-ruddy-brace.glitch.me^$all -||instagramcomphoto212paaatrk.glitch.me^$all +||instagramcomphoto212paaatrk.glitch.me^$all,~inline-font,domain=~malware-redirection-trains.* ||instafollow.glitch.me^$all ||loving-discovered-swordfish.glitch.me^$all ||aquamarine-cotton-impala.glitch.me^$all @@ -4448,32 +4526,6 @@ zombooru.com##a[href="http://www.hard55.com"] ||tough-numerous-lemur.glitch.me^$all ! https://scammer.info/t/mcafee-phish/83725 ||securefirst.us-east-1.linodeobjects.com^$all -! https://github.com/DevSpen/links/blob/master/src/links.txt -/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/$all -/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/$all -||discord-nltro.$all -||discord-app.$all -||discord-promo*$all -||dlscord.$all -||dlscord-app.$all -/(^|\.|://)gifts?-?discord\..*/$all -||steamcommin*$document -||steamcommm*$all -||steamcommn*$all -||steamcommunet*$all -||steamcommunitty.$all -||steamcommunnity.$all -||steamcommunty.$all -||steamcommuu*$all -||steamcommyn*$all -||steamcomnu*$all -||steamcomrn*$all -||steamconnu*$document -||steancomm*$document -||steanncomu*$all -||discord-glft.$all -||discordnitrogift*$all -||gift-nitro.$all ! https://www.virustotal.com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community 39.65.72.211$network 42.238.151.197$network @@ -4651,8 +4703,6 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/103475 ||ru.com^$all 141.8.226.34$network -! https://scammer.info/t/discord-nitro-scam-25/87887 -||discorde-nitre.xyz^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/108571 ||ston-app.com^$all ! fake human verification scam @@ -4683,7 +4733,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||sites.google.com/view/groundworkssolutions/^$all ||sites.google.com/mytv/maintenance^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/111970 -/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$document,popup +/(^|\.|://)[a-z0-9-]{2,}trk\.xyz(/|$)/$document,popup,domain=~malware-redirection-trains.* ! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ β†’ https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a# ||pccrackworld.com^$all ||calsign.xyz^$all @@ -4745,20 +4795,20 @@ zombooru.com##a[href="http://www.hard55.com"] ||installiq.com^$all ||specgoal.com^$all ||sandhyapi.online^$all -/trk2/*?lddomain=$document -||rtbrvdirect.com^$all +/trk2/*?lddomain=$document,domain=~very-likely-a-malware-redirection.* +||rtbrvdirect.com^$all,~inline-font,domain=~malware-redirection-trains.* ||goprotectpc.com^$all ||mybetterck.com^$all ||matildawu.online^$all -||cpmrevdirect.com^$document -||rtbverdirect.com^$document +||cpmrevdirect.com^$document,domain=~malware-redirection-trains.* +||rtbverdirect.com^$document,domain=~malware-redirection-trains.* ||fsalfrwdr.com^$document -||cpmvrdirect.com^$document -||fadverdirect.com^$document -||cpmrvdirect.com^$document -||rtbrevdirect.com^$document -||rtbvrdirect.com^$document -||cpmverdirect.com^$document +||cpmvrdirect.com^$document,domain=~malware-redirection-trains.* +||fadverdirect.com^$document,domain=~malware-redirection-trains.* +||cpmrvdirect.com^$document,domain=~malware-redirection-trains.* +||rtbrevdirect.com^$document,domain=~malware-redirection-trains.* +||rtbvrdirect.com^$document,domain=~malware-redirection-trains.* +||cpmverdirect.com^$document,domain=~malware-redirection-trains.* 15.197.244.48$network 96.47.230.67$network 96.47.230.68$network @@ -4777,12 +4827,12 @@ zombooru.com##a[href="http://www.hard55.com"] 179.60.146.*$network !#endif ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 -||trafredirtds.com^$all +||trafredirtds.com^$all,~inline-font,domain=~malware-redirection-trains.* ||com/landers/iphone*_spin$document ! https://github.com/AdguardTeam/AdguardFilters/issues/121772 ||pu020ev.com^$all ||kadam.net^$all -||kdtrk.net^$all +||kdtrk.net^$all,~inline-font,domain=~malware-redirection-trains.* ||clcpb.net^$all ||kadam.ru^$all ||kadxin.net^$all @@ -4807,9 +4857,9 @@ zombooru.com##a[href="http://www.hard55.com"] ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk.$document ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 -||saferedirects.xyz^$all +||saferedirects.xyz^$all,~inline-font,domain=~malware-redirection-trains.* ||online-guard.com^$all -/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$document,popup +/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$document,popup,domain=~fake-site-with-malware.* ! https://twitter.com/iam_py_test/status/1545164642346930176 ||amazon-security-info.lnk.to^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/123968 @@ -5053,10 +5103,10 @@ zombooru.com##a[href="http://www.hard55.com"] ||tlkn45ssg.cyou^$all ||toprefgtbvatv.com^$all ||tov49ro5ep.art^$all -||track2it4.icu^$all -||trackerry.com^$all -||trackgdi.com^$all -||trckrry.com^$all +||track2it4.icu^$all,~inline-font,domain=~malware-redirection-trains.* +||trackerry.com^$all,~inline-font,domain=~malware-redirection-trains.* +||trackgdi.com^$all,~inline-font,domain=~malware-redirection-trains.* +||trckrry.com^$all,~inline-font,domain=~malware-redirection-trains.* ||udlwwle.site^$all ||uij5nn-ta.cyou^$all ||uqujzco.xyz^$all @@ -5339,7 +5389,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||astogepian.com^$all ||influencer2020.com^$all ||vooculok.com^$all -||mobytrks.com^$all +||mobytrks.com^$all,~inline-font,domain=~malware-redirection-trains.* 139.45.197.236$network ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^$all @@ -5382,7 +5432,7 @@ zombooru.com##a[href="http://www.hard55.com"] 146.19.169.98$network 146.19.169.99$network ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 -/pushredirect/?$document +/pushredirect/?$document,domain=~malware-redirection-trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 ||1000girl.com^$all ||1000islandsinfo.com^$all @@ -6176,7 +6226,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||keyrug.com^$all ||keysschools.net^$all ||keystonehoops.com^$all -||keywebtracker.com^$all +||keywebtracker.com^$all,~inline-font,domain=~malware-redirection-trains.* ||keywordadvisetoolplus.com^$all ||kickoff.cm^$all ||kindfirls.com^$all @@ -7225,7 +7275,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||cadbitff.com^$all ||chemitug.net^$all ||civadsoo.net^$all -||clicktracklink.com^$all +||clicktracklink.com^$all,~inline-font,domain=~malware-redirection-trains.* ||comivolo.com^$all ||consoupow.com^$all ||costaquire.com^$all @@ -7623,7 +7673,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||4.fo^$document,popup ||kckb.st^$all ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 -||*-trk.xyz^$all +-trk.xyz^$all,~inline-font,domain=~malware-redirection-trains.* ||loadingnow.me^$all ||gsecurecontent.com^$all ||pressizer.net^$all @@ -10657,9 +10707,9 @@ zombooru.com##a[href="http://www.hard55.com"] ||thor-pom.com^$all ||thutm-bru.com^$all ||uthyr-que.com^$all -||zeroredirect1.com^$all +||zeroredirect1.com^$all,~inline-font,domain=~malware-redirection-trains.* ||zp-dom.com^$all -||redirect.newprogrammatic.click^$document +||redirect.newprogrammatic.click^$document,domain=~likely-a-malware-redirection.* ||arcad-hoh.com^$all ||eadri-fnr.com^$all ||gerhi-psv.com^$all @@ -10702,7 +10752,7 @@ zombooru.com##a[href="http://www.hard55.com"] 45.150.108.213$network 92.204.160.240$network ! https://github.com/AdguardTeam/AdguardFilters/issues/148560 -/land/*&afftrack=$document +/land/*&afftrack=$document,domain=~likely-a-malware-redirection.* ! Comments on Slack ||antivirussprotection.com^$all ||boot-upextremelyquickinfo-product.info^$all @@ -10993,8 +11043,8 @@ zombooru.com##a[href="http://www.hard55.com"] ||hornygirlsinapp.com^$all ||jump-path1.com^$all ||jump-path2.com^$all -||redirect-path1.com^$all -||redirect-path2.com^$all +||redirect-path1.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redirect-path2.com^$all,~inline-font,domain=~malware-redirection-trains.* ||your-online-casino.com^$all ||hot-girls-around.com^$all ||how2-become-rich.com^$all @@ -11021,8 +11071,8 @@ zombooru.com##a[href="http://www.hard55.com"] ||pw-show-ad.com^$all ||pw-show-main.com^$all ||pw-show-test.com^$all -||pwredir-*.com^$all -||redir-pw*.com^$all +||pwredir-*.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redir-pw*.com^$all,~inline-font,domain=~malware-redirection-trains.* ||rich-people-club.com^$all ||search-top-videos.com^$all ||secret-casino-site.com^$all @@ -11159,7 +11209,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||click-to-see.live^$all ||click-to-watch.live^$all ||cpa-optimizer.online^$all -||cpvlabtrk.online^$all +||cpvlabtrk.online^$all,~inline-font,domain=~malware-redirection-trains.* ||critical-alert.info^$all ||daily-breaking-news.one^$all ||daily-buzzing-gossip.com^$all @@ -11246,7 +11296,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||openthenotification.com^$all ||p0kerr.com^$all ||pclkpackg.xyz^$all -||pclkredrct.xyz^$all +||pclkredrct.xyz^$all,~inline-font,domain=~malware-redirection-trains.* ||popular-messages.com^$all ||premium-news-for.me^$all ||premium-shops-around.me^$all @@ -11254,7 +11304,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||private-message.live^$all ||private-message.online^$all ||private-show.live^$all -||pushapitracker.com^$all +||pushapitracker.com^$all,~inline-font,domain=~malware-redirection-trains.* ||read-and-reveal.com^$all ||read-before-the-rest.com^$all ||read-new-post.com^$all @@ -11322,7 +11372,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||trending-celeb-news.com^$all ||trending-gossip.com^$all ||trends-celebs.com^$all -||ts-tracker.me^$all +||ts-tracker.me^$all,~inline-font,domain=~malware-redirection-trains.* ||updates-news-magazine.com^$all ||very-important.online^$all ||video-change.digital^$all @@ -11357,18 +11407,18 @@ zombooru.com##a[href="http://www.hard55.com"] ||defre.net^$all ||pocrd.cc^$all ||puredi.net^$all -||redic.net^$all -||redic2.net^$all -||redic3.com^$all -||redic4.com^$all -||redir2.net^$all -||redir3.net^$all -||redir4.net^$all -||redir5.net^$all -||redir6.net^$all -||redir7.net^$all -||redir8.net^$all -||redir9.net^$all +||redic.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redic2.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redic3.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redic4.com^$all,~inline-font,domain=~malware-redirection-trains.* +||redir2.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redir3.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redir4.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redir5.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redir6.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redir7.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redir8.net^$all,~inline-font,domain=~malware-redirection-trains.* +||redir9.net^$all,~inline-font,domain=~malware-redirection-trains.* ||rejco.online^$all ||rejco2.store^$all ||spinwincas.online^$all @@ -11660,7 +11710,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||glersooy.net^$all ||gliceebe.xyz^$all ||gloacmug.net^$all -||go.redirected*/click?^$document,popup +||go.redirected*/click?^$document,popup,domain=~malware-redirection-trains.* ||goldfishka-casino.xyz^$all ||gousauhu.xyz^$all ||gphyvg.com^$all @@ -11961,7 +12011,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||rahfnq.com^$all ||raybhi.com^$all ||rcqmrz.com^$all -||redirected1.com^$all +||redirected1.com^$all,~inline-font,domain=~malware-redirection-trains.* ||rfduik.com^$all ||rgitpv.com^$all ||riaeqd.com^$all @@ -12532,7 +12582,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||searchassured.com^$all ||searchequivalents.com^$all ||searchexcellent.com^$all -||searchingredirect.com^$all +||searchingredirect.com^$all,~inline-font,domain=~malware-redirection-trains.* ||searchinquire.com^$all ||searchsimilars.com^$all ||searchstarters.com^$all @@ -17110,7 +17160,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||zapdescendant.com^$all ||zapprecisionadmire.com^$all ||zealousstraitcommit.com^$all -://trk.*.run/$document +://trk.*.run/$document,domain=~very-likely-a-malware-redirection-train.* ! https://github.com/AdguardTeam/AdguardFilters/issues/159157 ||apbbjmp.com^$all ||apptjmp.com^$all @@ -17200,7 +17250,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||charutboll.com^$all ||chaseverifications.com^$all ||cloud-network.online^$all -||cmcmdirrect.com^$all +||cmcmdirrect.com^$all,~inline-font,domain=~malware-redirection-trains.* ||coltersaidas.com^$all ||com-96-hours.com^$all ||com-96hours.com^$all @@ -17325,7 +17375,7 @@ zombooru.com##a[href="http://www.hard55.com"] ||paywide.cards^$all ||promo-carte-avantages.com^$all ||qc1.site^$all -||redirect2url.com^$all +||redirect2url.com^$all,~inline-font,domain=~malware-redirection-trains.* ||revoiut-cy.com^$all ||revoke.money^$all ||richiediilrimborso.com^$all @@ -17543,12 +17593,12 @@ zombooru.com##a[href="http://www.hard55.com"] ||usqtvc.com$all ||usutnr.top$all ||204.44.92.187$all -://ap-trk.$all -://cw-trk.$all -://cw-trak.$all -://ktraks.$all -://flow-clck.$all -://apps-trk.$all +://ap-trk.$all,~inline-font,domain=~malware-redirection-trains.* +://cw-trk.$all,~inline-font,domain=~malware-redirection-trains.* +://cw-trak.$all,~inline-font,domain=~malware-redirection-trains.* +://ktraks.$all,~inline-font,domain=~malware-redirection-trains.* +://flow-clck.$all,~inline-font,domain=~malware-redirection-trains.* +://apps-trk.$all,~inline-font,domain=~malware-redirection-trains.* ! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103 ||betzykrisesenter.no^$document ||citra2010oslo.no^$document @@ -19516,56 +19566,25 @@ toorgle.net##.join ||nickswheels.com^$all ||spizzicopizza.net^$all ! Other -||redirectme.net^$document +||redirectme.net^$document,domain=~malware-redirection-trains.* ||anthargo.com^$document ! Domains on IPs known to host Discord Nitro spambots ||csgocup.ru^$all ||csgogf*.xyz^$all ||csgogift*.xyz^$all -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$all -!#if false -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/$popup -!#endif -||discord*.gifts^$all -||discord-give.$all -||discord-nitro-gift.$all -||discord-nitro.$all -||discord-nitros.$all -||discord.foundation^$all -||discordnitro-steam.$all -||discordxgift.$all -||discordxnitro.$all -||discrod.ru^$all ||dotagift*.xyz^$all ||eslpro.ru^$all ||fortnitebuy.com^$all -||free-discordnitro.$all -||freediscordnitro.$all ||steamcommunlty.it^$all ||ggtour.ru^$all ||heroes.com.ua^$all ||idchecker.xyz^$all ||market-csgo.ru^$all -||nitro*.gift^$all -||nitro*.gifts^$all ||pubggf*.xyz^$all ||pubggift*.xyz^$all ||s-arts.pro^$all ||skinosoda.online^$all -||sleanmconmunltiy.ru^$all -||staemcommunty.ru^$all -||steamcomiunity.com^$all -||steamcommunillty.com^$all -||steamcommunjty.ru^$all -||steamcommunlity.ru^$all -||steamcomnnuity.com^$all -||steamconmunyty.ru^$all -||steamconunity.ru^$all -||steamcumunity.ru^$all -||steanmconynnuytiy.$all -||stearncommynity.ru^$all ||tradeoffer.com.ru^$all 194.226.139.121$network 194.226.139.7$network @@ -20311,26 +20330,26 @@ tumblr.com#?#div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://b ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious apkfab.com##.tip-extension ! Google results for 'Katy and Bob: Cake CafΓ© powerpc' (04/11/2022) -||xxlmag.com/redirect^$all -||ultimateclassicrock.com/redirect^$all +||xxlmag.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* +||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* ||2y68554.cyou^$all ||1pwk1j.cyou^$all ||986.group^$all 185.87.148.199$network ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022) ||imaot.co.il/ContentArea/BannerClick^$all -||q1065.fm/redirect^$all -||wobm.com/redirect^$all -||us105fm.com/redirect^$all -||wnbf.com/redirect^$all +||q1065.fm/redirect^$all,~inline-font,domain=~malware-redirection-results.* +||wobm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* +||us105fm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* +||wnbf.com/redirect^$all,~inline-font,domain=~malware-redirection-results.* ||ynxqoc2.cyou^$all ||resurrectionlinks.online^$all ||canon70x70.site^$all ||gacorhub.com^$all ||zh1653.com^$all 45.136.49.35$network -||semex.com/popurl.cgi^$all -||pharmanimal.com/catalog/redirect.php^$all +||semex.com/popurl.cgi^$all,~inline-font,domain=~malware-redirection-results.* +||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware-redirection-results.* ! Browsing around for Tajik newssites ||arhernot.live^$all ||lifelongkick.live^$all @@ -20391,7 +20410,7 @@ apkfab.com##.tip-extension ||highlandnews.com^$all ||genuinescansupport.com^$all ||diverseflowlink.com^$all -||redirectedflow.com^$all +||redirectedflow.com^$all,~inline-font,domain=~malware-redirection-trains.* ||pcbasicstrength.com^$all ||conceptualizefact.com^$all ||varietyflow.com^$all @@ -20463,8 +20482,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) 34.80.59.191$network ! Various domains on https://securitytrails.com/list/ip/72.14.178.174 -|http://www6.$document -|http://www1.*&kw$document +|http://www6.$document,domain=~often-used-in-malware-redirections.* +|http://www1.*&kw$document,domain=~often-used-in-malware-redirections.* ||megabooru.com^$all ||zombooru.com^$all ||kusubooru.com^$all @@ -20521,7 +20540,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||awesomewinner.com^$all ||awesomewinner.net^$all ||awesomewinners.net^$all -||b2ztrk.com^$all +||b2ztrk.com^$all,~inline-font,domain=~malware-redirection-trains.* ||beastgadget.net^$all ||beastoffer.net^$all ||beastoffrs.com^$all @@ -20854,7 +20873,7 @@ cdburnerxp.se##[href*="/downloadsetup.exe"] ||winnerssite.net^$all ||xyzoffer.net^$all ||yasdoodl.com^$all -||ym3trk.com^$all +||ym3trk.com^$all,~inline-font,domain=~malware-redirection-trains.* ||youwanthis.com^$all ||zebramode.com^$all ||zebraoffers.net^$all @@ -22897,21 +22916,21 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat [2606:4700:3030::6815:5284]$network [2606:4700:3037::ac43:9e39]$network ! Google results for Β«SodaStream site:no cranberryΒ» -/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|Ρ€Ρ„|%D1%80%D1%84)$/$document -||adservice.google.*/ddm/clk/$document -/ad_click/q?&url=$document +/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|Ρ€Ρ„|%D1%80%D1%84)$/$document,domain=~malware-redirection-results.* +||adservice.google.*/ddm/clk/$document,domain=~malware-redirection-results.* +/ad_click/q?&url=$document,domain=~malware-redirection-results.* ! Laughably blatant fraud site ||cosercosplay.com^$all ! β€”β€”β€” Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. -||unofficialtwrp.com^$document -||androidweblog.com^$document -||androidgreek.com^$document -||ytechb.com^$document -||gadgetstwist.com^$document -||gadgetsfarms.com^$document -||techorfy.com^$document +||unofficialtwrp.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||androidweblog.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||androidgreek.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||ytechb.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||gadgetstwist.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||gadgetsfarms.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||techorfy.com^$document,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* !#if false ! β€”β€”β€” If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions β€”β€”β€” @@ -22926,15 +22945,6 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat |1x1.cz^ !#endif -! β€”β€”β€” Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. β€”β€”β€” -||githubus.com^ -||githubu.com^ -||githu.com^ -||wgithub.com^ -||githubuser.com^ -||rgithub.com^ -||githubt.com^ - ! β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” ://ww4.$document,domain=~ww4.ikea.com ://ww5.$document,domain=~ww5.ikea.com|~ww5.msu.ac.zw @@ -22942,47 +22952,47 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat ://ww7.$document,domain=~ww7.be|~ww7.readsnk.com ://ww8.$document,domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com ://ww9.$document,domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br -://ww10.$document -://ww11.$document -://ww12.$document -://ww13.$document -://ww14.$document -://ww15.$document,domain=~ww15.nl -://ww16.$document -://ww17.$document -://ww18.$document -://ww19.$document -://ww20.$document -://ww21.$document -://ww22.$document -://ww23.$document -://ww24.$document -://ww25.$document -://ww26.$document -://ww27.$document -://ww28.$document -://ww29.$document -://ww30.$document -://ww31.$document -://ww32.$document -://ww33.$document -://ww34.$document -://ww35.$document -://ww36.$document -://ww37.$document -://ww38.$document -://ww39.$document -://ww40.$document -://ww41.$document -://ww42.$document -://ww43.$document -://ww44.$document -://ww45.$document -://ww46.$document -://ww47.$document -://ww48.$document -://ww49.$document -://ww50.$document +://ww10.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww11.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww12.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww13.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww14.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww15.$document,domain=~ww15.nl|~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww16.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww17.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww18.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww19.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww20.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww21.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww22.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww23.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww24.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww25.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww26.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww27.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww28.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww29.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww30.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww31.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww32.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww33.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww34.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww35.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww36.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww37.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww38.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww39.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww40.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww41.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww42.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww43.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww44.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww45.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww46.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww47.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww48.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww49.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww50.$document,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.* ! β€”β€”β€” Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 β€”β€”β€” !!!/\\/$document @@ -23022,21 +23032,6 @@ get.adobe.com###offersInformationPane ! Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require Β«AdGuard for WindowsΒ») ||mb.download.gigabyte.com/FileList/Swhttp/DriverUpd/ANTIVIRUS^ -! β€”β€”β€” Potential typo-squats and directly related stuff β€”β€”β€” -||snapchat.cm^$document -||facebook.cm^$document -||wix.cm^$document -199.59.243.222$network -|http://ww01.$document -||14d.us^$all -173.208.96.42$network -173.208.96.43$network -173.208.96.44$network -173.208.96.45$network -173.208.96.46$network -213.227.149.208$network -213.227.149.211$network - ! β€”β€”β€” Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control β€”β€”β€” www.microsoft.com##a[data-pfns][href*=imposter] www.microsoft.com##a[data-pfns][href*=impostor] diff --git a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt index a4603fb2b..fcd13cfee 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareAdGuardHome.txt @@ -1,6 +1,6 @@ [Adblock Plus 3.13] ! Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for AdGuard Home, AdGuard for Android/Windows' DNS filtering, and Pi-Hole FTL β‰₯5.22) -! Version: 25December2023v1 +! Version: 29December2023v2 ! Expires: 2 days ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -237,11 +237,98 @@ ! Other sites -! β€”β€”β€” Wrong TLDs of legitimate sites β€”β€”β€” -||ubuntu.org^ +! β€”β€”β€” Typo squatting, misspellings, and honest TLD address bar mistakes β€”β€”β€” +||ubuntu.org^$denyallow=you-were-likely-looking-for-ubuntu.com 103.224.212.249 -||speedtest.com^ -||kelkoogroup.net^ +||speedtest.com^$denyallow=you-were-likely-looking-for-speedtest.net + +||snapchat.cm^$denyallow=malware-typo-squatter-of-snapchat.com +||facebook.cm^$denyallow=malware-typo-squatter-of-facebook.com +||wix.cm^$denyallow=malware-typo-squatter-of-wix.com +199.59.243.222 +|http://ww01.$denyallow=very-very-extremely-frequently-used-in-malware-redirections.* + +173.208.96.42 +173.208.96.43 +173.208.96.44 +173.208.96.45 +173.208.96.46 +213.227.149.208 +213.227.149.211 + + + + + + + + +! https://github.com/DevSpen/links/blob/master/src/links.txt + + + + + + + + +||steamcommin*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com + + + + + + + + + + +||steamconnu*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com +||steancomm*$denyallow=likely-a-fake-malware-version-of-steamcommunity.com + + + + +||free-discordnitro. +||freediscordnitro. + + +/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ + + + + + + + + + + + + + + + + + + + + + + + + + + +||githubus.com^$denyallow=you-were-likely-looking-for-githubusercontent.com +||githubu.com^$denyallow=you-were-likely-looking-for-githubusercontent.com +||githu.com^$denyallow=you-were-likely-looking-for-github.com +||wgithub.com^$denyallow=you-were-likely-looking-for-githubusercontent.com +||githubuser.com^$denyallow=you-were-likely-looking-for-githubusercontent.com +||rgithub.com^$denyallow=you-were-likely-looking-for-githubusercontent.com +||githubt.com^$denyallow=you-were-likely-looking-for-githubusercontent.com +! https://scammer.info/t/discord-nitro-scam-25/87887 + ! β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” ||netnet44.net^ @@ -264,7 +351,7 @@ ||proserpina-zeb.com^ ||lordagty.com^ ||madagty.com^ -||zeroredirect5.com^ +||zeroredirect5.com^$denyallow=malware-redirection-trains.* 54.209.22.226 54.91.125.197 52.202.53.245 @@ -275,7 +362,7 @@ 3.216.243.46 ||roamingclicks.com^ ! Source: desidert.no -||collectfasttracks.com^ + ! Source: vn-zoom.com ||ttnrd.com^ ||amanda.*.com^ @@ -287,9 +374,9 @@ 35.172.40.232 3.90.125.85 ! Various ex-affiliate links at www.zombooru.com -||track.vcdc.com^ -||track.tkbo.com^ -||track.traffic.club^ + + + ||lasvegas-vacations.net^ ||ndsplitter.com^ ||ns1.trafficclub.com^ @@ -302,26 +389,19 @@ 195.201.92.254 ! https://github.com/DandelionSprout/adfilt/pull/167 ||forgoprokick.icu^ -! Other -||ddscordapp. -||diicordapp. -||disccrdapp. -||dissordapp. -||discorrapp. -||discordaap. ! https://github.com/AdguardTeam/AdguardFilters/issues/124611 ! (https://github.com/DandelionSprout/adfilt/issues/632) ||inbluson.com^ -||bemobtrcks.com^ + ! β€”β€”β€” Found in witness reports online β€”β€”β€” ! Adblock Plus list maintainer weekly reports ||pinoy-offers.com^ ||googleboost.xyz^ -||bemobtracks.com^ -||bemobtrk.com^ -||bemobpath.com^ + + + ||couponbybox.com^ ||newpage.in^ @@ -3484,7 +3564,7 @@ ||zfirst-news.com^ ||zmp3-online.com^ ||zmusic-online.com^ -||zredir.com^ + 178.128.142.109 ||findmedia.biz^ ||backtonews.biz^ @@ -3563,8 +3643,8 @@ ||gogle.net^ ||quatrefeuillepolonaise.xyz^ ||extragifis.site^ -||best-prizes-202*.com^ -||all-best-prize-202*.com^ +||best-prizes-202*.com^$denyallow=malware-site.* +||all-best-prize-202*.com^$denyallow=malware-site.* ||captcharesolving-universe.com^ ||captcharesolver.com^ ||instantfwding.com^ @@ -3572,8 +3652,8 @@ ||gamesex.fun^ ||goldprize.xyz^ ||kmip.net^ -||0redirc.com^ -||redirekted.com^ + + ||rebiraert.com^ ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^ 5.8.34.26 @@ -3656,7 +3736,7 @@ ||click-to-see.live^ ||click-to-watch.live^ ||cpa-optimizer.online^ -||cpvlabtrk.online^ + ||critical-alert.info^ ||financial-message.club^ ||free-coupons.network^ @@ -3783,7 +3863,6 @@ ! https://github.com/DandelionSprout/adfilt/issues/251#issue-974102211 -||discordapp.cam^ ||nanorgin.ydns.eu^ ||thefreshstuffs.mu^ ||cocinasintonterias.com^ @@ -3804,7 +3883,7 @@ ||mediagetplus.com^ ||mgmgmg.com^ ||temp74.com^ -||trackwebclick.com^ + 23.111.31.137 23.111.88.207 ! https://github.com/DandelionSprout/adfilt/issues/254 @@ -3820,7 +3899,7 @@ ||beastbuying.com^ ||pesoaniz.com^ ||omnatuor.com^ -||novitrk1.com^ + ||cu27t-evo29lution.xyz^ ||sothis-sayers.xyz^ ||doneonline.xyz^ @@ -3831,7 +3910,7 @@ ||secureleadsforever.com^ ||renewal-software-update.com^ ||pushmeup.art^ -||trc.*.co^ +||trc.*.co^$denyallow=malware-redirection-trains.* ||artofads.co^ ||pc-my-protection.xyz^ ||beta-news.org^ @@ -3938,15 +4017,15 @@ ||tweakbit.com^ ||pcspeedup.en.softonic.com^ ! Copied from Β«uBlock Filters - Badware RisksΒ» because it has proven to be a very good entry -||1redirb.com^ + ! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931700117 ||retailproductsusa.com^ ||cloud-repos.store^ ! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931742337 (Initial batch) -||adtrk18.com^ -||jpgtrk.com^ + + ||pnghst.com^ -||pshtrk.com^ + ||diabasewoodhouse.xyz^ ||displayoptoffers.com^ ||spnccrzone.com^ @@ -3976,7 +4055,6 @@ ! (https://github.com/DandelionSprout/adfilt/issues/904) ! https://github.com/DandelionSprout/adfilt/issues/288 -||discordap.com^ ||forwrdnow.com^ ||7lyonline.com^ ||safelyonline.net^ @@ -3987,9 +4065,9 @@ ||data-px.services^ ||newsvot.com^ ||adalgard-wol.com^ -||trkk4.com^ +||trkk4.com^$denyallow=malware-redirection-trains.* ||secure-access-*.gate23.xyz^ -||hosting-redirect.com^ +||hosting-redirect.com^$denyallow=malware-redirection-trains.* ! https://github.com/DandelionSprout/adfilt/pull/289 ||gogles.com^ @@ -4206,7 +4284,7 @@ ||delicate-tame-angora.glitch.me^ ||secureinvoice.glitch.me^ ||holy-ruddy-brace.glitch.me^ -||instagramcomphoto212paaatrk.glitch.me^ + ||instafollow.glitch.me^ ||loving-discovered-swordfish.glitch.me^ ||aquamarine-cotton-impala.glitch.me^ @@ -4214,32 +4292,6 @@ ||tough-numerous-lemur.glitch.me^ ! https://scammer.info/t/mcafee-phish/83725 ||securefirst.us-east-1.linodeobjects.com^ -! https://github.com/DevSpen/links/blob/master/src/links.txt -/(^|\.|://)d[il]sc(or|ro)ds?-?g[il]ft[se]?[.-].*/ -/(^|\.|://)d[il]sc(or|ro)ds?-?n[il]tro[.-].*/ -||discord-nltro. -||discord-app. -||discord-promo* -||dlscord. -||dlscord-app. -/(^|\.|://)gifts?-?discord\..*/ -||steamcommin* -||steamcommm* -||steamcommn* -||steamcommunet* -||steamcommunitty. -||steamcommunnity. -||steamcommunty. -||steamcommuu* -||steamcommyn* -||steamcomnu* -||steamcomrn* -||steamconnu* -||steancomm* -||steanncomu* -||discord-glft. -||discordnitrogift* -||gift-nitro. ! https://www.virustotal.com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community 39.65.72.211 42.238.151.197 @@ -4417,8 +4469,6 @@ ! https://github.com/AdguardTeam/AdguardFilters/issues/103475 ||ru.com^ 141.8.226.34 -! https://scammer.info/t/discord-nitro-scam-25/87887 -||discorde-nitre.xyz^ ! https://github.com/AdguardTeam/AdguardFilters/issues/108571 ||ston-app.com^ ! fake human verification scam @@ -4511,20 +4561,20 @@ ||installiq.com^ ||specgoal.com^ ||sandhyapi.online^ -/trk2/*?ld -||rtbrvdirect.com^ +/trk2/*?ld~very-likely-a-malware-redirection.* + ||goprotectpc.com^ ||mybetterck.com^ ||matildawu.online^ -||cpmrevdirect.com^ -||rtbverdirect.com^ +||cpmrevdirect.com^$denyallow=malware-redirection-trains.* +||rtbverdirect.com^$denyallow=malware-redirection-trains.* ||fsalfrwdr.com^ -||cpmvrdirect.com^ -||fadverdirect.com^ -||cpmrvdirect.com^ -||rtbrevdirect.com^ -||rtbvrdirect.com^ -||cpmverdirect.com^ +||cpmvrdirect.com^$denyallow=malware-redirection-trains.* +||fadverdirect.com^$denyallow=malware-redirection-trains.* +||cpmrvdirect.com^$denyallow=malware-redirection-trains.* +||rtbrevdirect.com^$denyallow=malware-redirection-trains.* +||rtbvrdirect.com^$denyallow=malware-redirection-trains.* +||cpmverdirect.com^$denyallow=malware-redirection-trains.* 15.197.244.48 96.47.230.67 96.47.230.68 @@ -4543,12 +4593,12 @@ ://179.60.146. ! https://github.com/AdguardTeam/AdguardFilters/issues/121544 -||trafredirtds.com^ + ! https://github.com/AdguardTeam/AdguardFilters/issues/121772 ||pu020ev.com^ ||kadam.net^ -||kdtrk.net^ + ||clcpb.net^ ||kadam.ru^ ||kadxin.net^ @@ -4573,7 +4623,7 @@ ! https://github.com/AdguardTeam/AdguardFilters/issues/122757 ://adbrbk. ! https://github.com/AdguardTeam/AdguardFilters/issues/123544 -||saferedirects.xyz^ + ||online-guard.com^ ! https://twitter.com/iam_py_test/status/1545164642346930176 @@ -4819,10 +4869,10 @@ ||tlkn45ssg.cyou^ ||toprefgtbvatv.com^ ||tov49ro5ep.art^ -||track2it4.icu^ -||trackerry.com^ -||trackgdi.com^ -||trckrry.com^ + + + + ||udlwwle.site^ ||uij5nn-ta.cyou^ ||uqujzco.xyz^ @@ -5105,7 +5155,7 @@ ||astogepian.com^ ||influencer2020.com^ ||vooculok.com^ -||mobytrks.com^ + 139.45.197.236 ! https://github.com/AdguardTeam/AdguardFilters/issues/128029 ||becovi.com^ @@ -5148,7 +5198,7 @@ 146.19.169.98 146.19.169.99 ! https://github.com/AdguardTeam/AdguardFilters/issues/132079 -/pushredirect/? +/pushredirect/?~malware-redirection-trains.* ! https://github.com/AdguardTeam/AdguardFilters/issues/134355 ||1000girl.com^ ||1000islandsinfo.com^ @@ -5942,7 +5992,7 @@ ||keyrug.com^ ||keysschools.net^ ||keystonehoops.com^ -||keywebtracker.com^ + ||keywordadvisetoolplus.com^ ||kickoff.cm^ ||kindfirls.com^ @@ -6991,7 +7041,7 @@ ||cadbitff.com^ ||chemitug.net^ ||civadsoo.net^ -||clicktracklink.com^ + ||comivolo.com^ ||consoupow.com^ ||costaquire.com^ @@ -7389,7 +7439,7 @@ ||4.fo^ ||kckb.st^ ! https://github.com/AdguardTeam/AdguardFilters/issues/139106 -||*-trk.xyz^ + ||loadingnow.me^ ||gsecurecontent.com^ ||pressizer.net^ @@ -10423,9 +10473,9 @@ ||thor-pom.com^ ||thutm-bru.com^ ||uthyr-que.com^ -||zeroredirect1.com^ + ||zp-dom.com^ -||redirect.newprogrammatic.click^ +||redirect.newprogrammatic.click^$denyallow=likely-a-malware-redirection.* ||arcad-hoh.com^ ||eadri-fnr.com^ ||gerhi-psv.com^ @@ -10759,8 +10809,8 @@ ||hornygirlsinapp.com^ ||jump-path1.com^ ||jump-path2.com^ -||redirect-path1.com^ -||redirect-path2.com^ + + ||your-online-casino.com^ ||hot-girls-around.com^ ||how2-become-rich.com^ @@ -10787,8 +10837,8 @@ ||pw-show-ad.com^ ||pw-show-main.com^ ||pw-show-test.com^ -||pwredir-*.com^ -||redir-pw*.com^ + + ||rich-people-club.com^ ||search-top-videos.com^ ||secret-casino-site.com^ @@ -10925,7 +10975,7 @@ ||click-to-see.live^ ||click-to-watch.live^ ||cpa-optimizer.online^ -||cpvlabtrk.online^ + ||critical-alert.info^ ||daily-breaking-news.one^ ||daily-buzzing-gossip.com^ @@ -11012,7 +11062,7 @@ ||openthenotification.com^ ||p0kerr.com^ ||pclkpackg.xyz^ -||pclkredrct.xyz^ + ||popular-messages.com^ ||premium-news-for.me^ ||premium-shops-around.me^ @@ -11020,7 +11070,7 @@ ||private-message.live^ ||private-message.online^ ||private-show.live^ -||pushapitracker.com^ + ||read-and-reveal.com^ ||read-before-the-rest.com^ ||read-new-post.com^ @@ -11088,7 +11138,7 @@ ||trending-celeb-news.com^ ||trending-gossip.com^ ||trends-celebs.com^ -||ts-tracker.me^ + ||updates-news-magazine.com^ ||very-important.online^ ||video-change.digital^ @@ -11123,18 +11173,18 @@ ||defre.net^ ||pocrd.cc^ ||puredi.net^ -||redic.net^ -||redic2.net^ -||redic3.com^ -||redic4.com^ -||redir2.net^ -||redir3.net^ -||redir4.net^ -||redir5.net^ -||redir6.net^ -||redir7.net^ -||redir8.net^ -||redir9.net^ + + + + + + + + + + + + ||rejco.online^ ||rejco2.store^ ||spinwincas.online^ @@ -11727,7 +11777,7 @@ ||rahfnq.com^ ||raybhi.com^ ||rcqmrz.com^ -||redirected1.com^ + ||rfduik.com^ ||rgitpv.com^ ||riaeqd.com^ @@ -12298,7 +12348,7 @@ ||searchassured.com^ ||searchequivalents.com^ ||searchexcellent.com^ -||searchingredirect.com^ + ||searchinquire.com^ ||searchsimilars.com^ ||searchstarters.com^ @@ -16876,7 +16926,7 @@ ||zapdescendant.com^ ||zapprecisionadmire.com^ ||zealousstraitcommit.com^ -://trk.*.run/$document +://trk.*.run/$document,~very-likely-a-malware-redirection-train.* ! https://github.com/AdguardTeam/AdguardFilters/issues/159157 ||apbbjmp.com^ ||apptjmp.com^ @@ -16966,7 +17016,7 @@ ||charutboll.com^ ||chaseverifications.com^ ||cloud-network.online^ -||cmcmdirrect.com^ + ||coltersaidas.com^ ||com-96-hours.com^ ||com-96hours.com^ @@ -17091,7 +17141,7 @@ ||paywide.cards^ ||promo-carte-avantages.com^ ||qc1.site^ -||redirect2url.com^ + ||revoiut-cy.com^ ||revoke.money^ ||richiediilrimborso.com^ @@ -17309,12 +17359,12 @@ ||usqtvc.com ||usutnr.top ||204.44.92.187 -://ap-trk. -://cw-trk. -://cw-trak. -://ktraks. -://flow-clck. -://apps-trk. + + + + + + ! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103 ||betzykrisesenter.no^ ||citra2010oslo.no^ @@ -19280,56 +19330,25 @@ ||nickswheels.com^ ||spizzicopizza.net^ ! Other -||redirectme.net^ +||redirectme.net^$denyallow=malware-redirection-trains.* ||anthargo.com^ ! Domains on IPs known to host Discord Nitro spambots ||csgocup.ru^ ||csgogf*.xyz^ ||csgogift*.xyz^ -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ - -/^(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/|$)/ - - -||discord*.gifts^ -||discord-give. -||discord-nitro-gift. -||discord-nitro. -||discord-nitros. -||discord.foundation^ -||discordnitro-steam. -||discordxgift. -||discordxnitro. -||discrod.ru^ ||dotagift*.xyz^ ||eslpro.ru^ ||fortnitebuy.com^ -||free-discordnitro. -||freediscordnitro. ||steamcommunlty.it^ ||ggtour.ru^ ||heroes.com.ua^ ||idchecker.xyz^ ||market-csgo.ru^ -||nitro*.gift^ -||nitro*.gifts^ ||pubggf*.xyz^ ||pubggift*.xyz^ ||s-arts.pro^ ||skinosoda.online^ -||sleanmconmunltiy.ru^ -||staemcommunty.ru^ -||steamcomiunity.com^ -||steamcommunillty.com^ -||steamcommunjty.ru^ -||steamcommunlity.ru^ -||steamcomnnuity.com^ -||steamconmunyty.ru^ -||steamconunity.ru^ -||steamcumunity.ru^ -||steanmconynnuytiy. -||stearncommynity.ru^ ||tradeoffer.com.ru^ 194.226.139.121 194.226.139.7 @@ -20153,7 +20172,7 @@ ||highlandnews.com^ ||genuinescansupport.com^ ||diverseflowlink.com^ -||redirectedflow.com^ + ||pcbasicstrength.com^ ||conceptualizefact.com^ ||varietyflow.com^ @@ -20224,7 +20243,7 @@ ! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection) 34.80.59.191 ! Various domains on https://securitytrails.com/list/ip/72.14.178.174 -|http://www6. +|http://www6.$denyallow=often-used-in-malware-redirections.* ||megabooru.com^ ||zombooru.com^ @@ -20282,7 +20301,7 @@ ||awesomewinner.com^ ||awesomewinner.net^ ||awesomewinners.net^ -||b2ztrk.com^ + ||beastgadget.net^ ||beastoffer.net^ ||beastoffrs.com^ @@ -20615,7 +20634,7 @@ ||winnerssite.net^ ||xyzoffer.net^ ||yasdoodl.com^ -||ym3trk.com^ + ||youwanthis.com^ ||zebramode.com^ ||zebraoffers.net^ @@ -22663,13 +22682,13 @@ ! β€”β€”β€” Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones β€”β€”β€” ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone. -||unofficialtwrp.com^ -||androidweblog.com^ -||androidgreek.com^ -||ytechb.com^ -||gadgetstwist.com^ -||gadgetsfarms.com^ -||techorfy.com^ +||unofficialtwrp.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||androidweblog.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||androidgreek.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||ytechb.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||gadgetstwist.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||gadgetsfarms.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* +||techorfy.com^$denyallow=had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.* ! β€”β€”β€” If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions β€”β€”β€” @@ -22681,15 +22700,6 @@ |1x1.cz^ -! β€”β€”β€” Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. β€”β€”β€” -||githubus.com^ -||githubu.com^ -||githu.com^ -||wgithub.com^ -||githubuser.com^ -||rgithub.com^ -||githubt.com^ - ! β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” ://ww4.$denyallow=ww4.ikea.com ://ww5.$denyallow=ww5.ikea.com|ww5.msu.ac.zw @@ -22697,47 +22707,47 @@ ://ww7.$denyallow=ww7.be|ww7.readsnk.com ://ww8.$denyallow=ww8.co|ww8.ikea.com|ww8.tiki.ne.jp|ww8.erovoice.us|ww8.anyanime.com|ww8.bakushpal.az|ww8.tokyoghoulre.com|ww8.readonepiece.com ://ww9.$denyallow=ww9.ikea.com|ww9.tiki.ne.jp|ww9.sakura.ne.jp|ww9.generali.pt|ww9.itau.com.br -://ww10. -://ww11. -://ww12. -://ww13. -://ww14. -://ww15.$denyallow=ww15.nl -://ww16. -://ww17. -://ww18. -://ww19. -://ww20. -://ww21. -://ww22. -://ww23. -://ww24. -://ww25. -://ww26. -://ww27. -://ww28. -://ww29. -://ww30. -://ww31. -://ww32. -://ww33. -://ww34. -://ww35. -://ww36. -://ww37. -://ww38. -://ww39. -://ww40. -://ww41. -://ww42. -://ww43. -://ww44. -://ww45. -://ww46. -://ww47. -://ww48. -://ww49. -://ww50. +://ww10.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww11.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww12.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww13.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww14.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww15.$denyallow=ww15.nl|practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww16.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww17.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww18.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww19.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww20.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww21.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww22.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww23.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww24.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww25.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww26.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww27.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww28.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww29.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww30.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww31.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww32.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww33.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww34.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww35.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww36.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww37.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww38.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww39.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww40.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww41.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww42.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww43.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww44.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww45.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww46.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww47.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww48.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww49.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* +://ww50.$denyallow=practically-always-leads-to-a-domain-parking-service-known-for-malware.* ! β€”β€”β€” Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 β€”β€”β€” !!!/\\/ @@ -22766,21 +22776,6 @@ ! Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require Β«AdGuard for WindowsΒ») -! β€”β€”β€” Potential typo-squats and directly related stuff β€”β€”β€” -||snapchat.cm^ -||facebook.cm^ -||wix.cm^ -199.59.243.222 -|http://ww01. -||14d.us^ -173.208.96.42 -173.208.96.43 -173.208.96.44 -173.208.96.45 -173.208.96.46 -213.227.149.208 -213.227.149.211 - ! β€”β€”β€” Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control β€”β€”β€” ! All legitimate Pac-Man games would use "pac-man" links with a dash diff --git a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt index 9417ba61f..86ab26ab6 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareDomains.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareDomains.txt @@ -1,7 +1,6 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Domains list version) -# Version: 25December2023v1 +# Version: 29December2023v2 # Expires: 2 days -# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. @@ -228,11 +227,93 @@ the1adblocker.com -# β€”β€”β€” Wrong TLDs of legitimate sites β€”β€”β€” +# β€”β€”β€” Typo squatting, misspellings, and honest TLD address bar mistakes β€”β€”β€” ubuntu.org 103.224.212.249 speedtest.com kelkoogroup.net +snapchat.cm +facebook.cm +wix.cm +199.59.243.222 + +14d.us +173.208.96.42 +173.208.96.43 +173.208.96.44 +173.208.96.45 +173.208.96.46 +213.227.149.208 +213.227.149.211 + + + + + + +discordapp.cam +discordap.com + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +discord.foundation + + + +discrod.ru +sleanmconmunltiy.ru +staemcommunty.ru +steamcomiunity.com +steamcommunillty.com +steamcommunjty.ru +steamcommunlity.ru +steamcomnnuity.com +steamconmunyty.ru +steamconunity.ru +steamcumunity.ru + +stearncommynity.ru +githubus.com +githubu.com +githu.com +wgithub.com +githubuser.com +rgithub.com +githubt.com +discorde-nitre.xyz # β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” netnet44.net @@ -281,13 +362,6 @@ splitter.microxml.net 144.76.1.130 195.201.92.254 forgoprokick.icu -# Other - - - - - - inbluson.com bemobtrcks.com @@ -3722,7 +3796,6 @@ thecrs.club -discordapp.cam nanorgin.ydns.eu thefreshstuffs.mu cocinasintonterias.com @@ -3867,7 +3940,6 @@ polyhymnia-mar.com virpropcnow.xyz avprotectionoverview.com -discordap.com forwrdnow.com 7lyonline.com safelyonline.net @@ -4061,31 +4133,6 @@ aquamarine-cotton-impala.glitch.me mature-periwinkle-advantage.glitch.me tough-numerous-lemur.glitch.me securefirst.us-east-1.linodeobjects.com - - - - - - - - - - - - - - - - - - - - - - - - - 39.65.72.211 42.238.151.197 27.213.60.53 @@ -4211,7 +4258,6 @@ new-meet-dating.life wellhello.com ru.com 141.8.226.34 -discorde-nitre.xyz ston-app.com # fake human verification scam # start form - reported for abuse @@ -7140,6 +7186,7 @@ zigaahm.icu link.sv 4.fo kckb.st + loadingnow.me gsecurecontent.com pressizer.net @@ -18973,24 +19020,8 @@ anthargo.com # Domains on IPs known to host Discord Nitro spambots cabura.loan csgocup.ru - - - - - - - - - -discord.foundation - - - -discrod.ru eslpro.ru fortnitebuy.com - - steamcommunlty.it ggtour.ru heroes.com.ua @@ -18998,18 +19029,6 @@ idchecker.xyz market-csgo.ru s-arts.pro skinosoda.online -sleanmconmunltiy.ru -staemcommunty.ru -steamcomiunity.com -steamcommunillty.com -steamcommunjty.ru -steamcommunlity.ru -steamcomnnuity.com -steamconmunyty.ru -steamconunity.ru -steamcumunity.ru - -stearncommynity.ru tradeoffer.com.ru 194.226.139.121 194.226.139.7 @@ -22338,15 +22357,6 @@ hitnslab.info 1x1.cz -# β€”β€”β€” Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. β€”β€”β€” -githubus.com -githubu.com -githu.com -wgithub.com -githubuser.com -rgithub.com -githubt.com - # β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” @@ -22418,21 +22428,6 @@ mip.api.mcafeewebadvisor.com # Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require Β«AdGuard for WindowsΒ») -# β€”β€”β€” Potential typo-squats and directly related stuff β€”β€”β€” -snapchat.cm -facebook.cm -wix.cm -199.59.243.222 - -14d.us -173.208.96.42 -173.208.96.43 -173.208.96.44 -173.208.96.45 -173.208.96.46 -213.227.149.208 -213.227.149.211 - # β€”β€”β€” Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control β€”β€”β€” @@ -22459,7 +22454,6 @@ trmff.wpengine.com -# Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests diff --git a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt index e6fe5421a..ac6b91092 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareHosts.txt +++ b/Alternate versions Anti-Malware List/AntiMalwareHosts.txt @@ -1,6 +1,5 @@ # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Β«hostsΒ» file version) # Expires: 2 days -# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # β€”β€”β€” Bad top-level domains β€”β€”β€” # You can expect these domains to have an overwhelming majority of malware domains that have nothing to do with the countries in question. Nevertheless, if you are in a situation where you have to do active business in any of the countries in question, then this list may not be ideal for you. @@ -220,11 +219,93 @@ -# β€”β€”β€” Wrong TLDs of legitimate sites β€”β€”β€” +# β€”β€”β€” Typo squatting, misspellings, and honest TLD address bar mistakes β€”β€”β€” 127.0.0.1 ubuntu.org 127.0.0.1 103.224.212.249 127.0.0.1 speedtest.com 127.0.0.1 kelkoogroup.net +127.0.0.1 snapchat.cm +127.0.0.1 facebook.cm +127.0.0.1 wix.cm +127.0.0.1 199.59.243.222 + +127.0.0.1 14d.us +127.0.0.1 173.208.96.42 +127.0.0.1 173.208.96.43 +127.0.0.1 173.208.96.44 +127.0.0.1 173.208.96.45 +127.0.0.1 173.208.96.46 +127.0.0.1 213.227.149.208 +127.0.0.1 213.227.149.211 + + + + + + +127.0.0.1 discordapp.cam +127.0.0.1 discordap.com + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +127.0.0.1 discord.foundation + + + +127.0.0.1 discrod.ru +127.0.0.1 sleanmconmunltiy.ru +127.0.0.1 staemcommunty.ru +127.0.0.1 steamcomiunity.com +127.0.0.1 steamcommunillty.com +127.0.0.1 steamcommunjty.ru +127.0.0.1 steamcommunlity.ru +127.0.0.1 steamcomnnuity.com +127.0.0.1 steamconmunyty.ru +127.0.0.1 steamconunity.ru +127.0.0.1 steamcumunity.ru + +127.0.0.1 stearncommynity.ru +127.0.0.1 githubus.com +127.0.0.1 githubu.com +127.0.0.1 githu.com +127.0.0.1 wgithub.com +127.0.0.1 githubuser.com +127.0.0.1 rgithub.com +127.0.0.1 githubt.com +127.0.0.1 discorde-nitre.xyz # β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” 127.0.0.1 netnet44.net @@ -273,13 +354,6 @@ 127.0.0.1 144.76.1.130 127.0.0.1 195.201.92.254 127.0.0.1 forgoprokick.icu -# Other - - - - - - 127.0.0.1 inbluson.com 127.0.0.1 bemobtrcks.com @@ -3714,7 +3788,6 @@ -127.0.0.1 discordapp.cam 127.0.0.1 nanorgin.ydns.eu 127.0.0.1 thefreshstuffs.mu 127.0.0.1 cocinasintonterias.com @@ -3859,7 +3932,6 @@ 127.0.0.1 virpropcnow.xyz 127.0.0.1 avprotectionoverview.com -127.0.0.1 discordap.com 127.0.0.1 forwrdnow.com 127.0.0.1 7lyonline.com 127.0.0.1 safelyonline.net @@ -4053,31 +4125,6 @@ 127.0.0.1 mature-periwinkle-advantage.glitch.me 127.0.0.1 tough-numerous-lemur.glitch.me 127.0.0.1 securefirst.us-east-1.linodeobjects.com - - - - - - - - - - - - - - - - - - - - - - - - - 127.0.0.1 39.65.72.211 127.0.0.1 42.238.151.197 127.0.0.1 27.213.60.53 @@ -4203,7 +4250,6 @@ 127.0.0.1 wellhello.com 127.0.0.1 ru.com 127.0.0.1 141.8.226.34 -127.0.0.1 discorde-nitre.xyz 127.0.0.1 ston-app.com # fake human verification scam # start form - reported for abuse @@ -7132,6 +7178,7 @@ 127.0.0.1 link.sv 127.0.0.1 4.fo 127.0.0.1 kckb.st + 127.0.0.1 loadingnow.me 127.0.0.1 gsecurecontent.com 127.0.0.1 pressizer.net @@ -18965,24 +19012,8 @@ # Domains on IPs known to host Discord Nitro spambots 127.0.0.1 cabura.loan 127.0.0.1 csgocup.ru - - - - - - - - - -127.0.0.1 discord.foundation - - - -127.0.0.1 discrod.ru 127.0.0.1 eslpro.ru 127.0.0.1 fortnitebuy.com - - 127.0.0.1 steamcommunlty.it 127.0.0.1 ggtour.ru 127.0.0.1 heroes.com.ua @@ -18990,18 +19021,6 @@ 127.0.0.1 market-csgo.ru 127.0.0.1 s-arts.pro 127.0.0.1 skinosoda.online -127.0.0.1 sleanmconmunltiy.ru -127.0.0.1 staemcommunty.ru -127.0.0.1 steamcomiunity.com -127.0.0.1 steamcommunillty.com -127.0.0.1 steamcommunjty.ru -127.0.0.1 steamcommunlity.ru -127.0.0.1 steamcomnnuity.com -127.0.0.1 steamconmunyty.ru -127.0.0.1 steamconunity.ru -127.0.0.1 steamcumunity.ru - -127.0.0.1 stearncommynity.ru 127.0.0.1 tradeoffer.com.ru 127.0.0.1 194.226.139.121 127.0.0.1 194.226.139.7 @@ -22330,15 +22349,6 @@ 127.0.0.1 1x1.cz -# β€”β€”β€” Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. β€”β€”β€” -127.0.0.1 githubus.com -127.0.0.1 githubu.com -127.0.0.1 githu.com -127.0.0.1 wgithub.com -127.0.0.1 githubuser.com -127.0.0.1 rgithub.com -127.0.0.1 githubt.com - # β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” @@ -22410,21 +22420,6 @@ # Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require Β«AdGuard for WindowsΒ») -# β€”β€”β€” Potential typo-squats and directly related stuff β€”β€”β€” -127.0.0.1 snapchat.cm -127.0.0.1 facebook.cm -127.0.0.1 wix.cm -127.0.0.1 199.59.243.222 - -127.0.0.1 14d.us -127.0.0.1 173.208.96.42 -127.0.0.1 173.208.96.43 -127.0.0.1 173.208.96.44 -127.0.0.1 173.208.96.45 -127.0.0.1 173.208.96.46 -127.0.0.1 213.227.149.208 -127.0.0.1 213.227.149.211 - # β€”β€”β€” Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control β€”β€”β€” @@ -22451,7 +22446,6 @@ -# Brazilian mobsters trying to DDoS Cisco with TXT-type DNS requests diff --git a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action index 7d2245081..72fdfb6d7 100644 --- a/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action +++ b/Alternate versions Anti-Malware List/AntiMalwarePrivoxy.action @@ -1,6 +1,6 @@ {+block} # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (for Privoxy) -# Version: 25December2023v1-Deprecated +# Version: 29December2023v2-Deprecated # Expires: 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. @@ -219,11 +219,92 @@ .apps.apple.com/*/app/*/id1564900435 {+block} -# β€”β€”β€” Wrong TLDs of legitimate sites β€”β€”β€” +# β€”β€”β€” Typo squatting, misspellings, and honest TLD address bar mistakes β€”β€”β€” .ubuntu.org .103.224.212.249 .speedtest.com .kelkoogroup.net +.snapchat.cm +.facebook.cm +.wix.cm +.199.59.243.222 +.14d.us +.173.208.96.42 +.173.208.96.43 +.173.208.96.44 +.173.208.96.45 +.173.208.96.46 +.213.227.149.208 +.213.227.149.211 +.ddscordapp. +.diicordapp. +.disccrdapp. +.dissordapp. +.discorrapp. +.discordaap. +.discordapp.cam +.discordap.com +.discord-nltro. +.discord-app. +.discord-promo* +.dlscord. +.dlscord-app. +.steamcommin* +.steamcommm* +.steamcommn* +.steamcommunet* +.steamcommunitty. +.steamcommunnity. +.steamcommunty. +.steamcommuu* +.steamcommyn* +.steamcomnu* +.steamcomrn* +.steamconnu* +.steancomm* +.steanncomu* +.discord-glft. +.discordnitrogift* +.gift-nitro. +.free-discordnitro. +.freediscordnitro. +/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ +# +/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ +/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ +# +.discord*.gifts +.discord-give. +.discord-nitro-gift. +.discord-nitro. +.discord-nitros. +.discord.foundation +.discordnitro-steam. +.discordxgift. +.discordxnitro. +.discrod.ru +.nitro*.gift +.nitro*.gifts +.sleanmconmunltiy.ru +.staemcommunty.ru +.steamcomiunity.com +.steamcommunillty.com +.steamcommunjty.ru +.steamcommunlity.ru +.steamcomnnuity.com +.steamconmunyty.ru +.steamconunity.ru +.steamcumunity.ru +.steanmconynnuytiy. +.stearncommynity.ru +.githubus.com +.githubu.com +.githu.com +.wgithub.com +.githubuser.com +.rgithub.com +.githubt.com +.discorde-nitre.xyz {+block} # β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” @@ -284,13 +365,6 @@ .144.76.1.130 .195.201.92.254 .forgoprokick.icu -# Other -.ddscordapp. -.diicordapp. -.disccrdapp. -.dissordapp. -.discorrapp. -.discordaap. ?bemobdata= .inbluson.com .bemobtrcks.com @@ -3712,7 +3786,6 @@ .microsoftedge.microsoft.com/addons/detail/rick-roll-prank-extension/cafkeihpipimekealiblfbjcgnnchdoj .microsoftedge.microsoft.com/addons/detail/image-find/oallgpknmoodlcklmhgfpgjkdencmnfd .microsoftedge.microsoft.com/addons/detail/kpckgoaeejpoghdglooeibkoedpkgock -.discordapp.cam .nanorgin.ydns.eu .thefreshstuffs.mu .cocinasintonterias.com @@ -3859,7 +3932,6 @@ .virpropcnow.xyz .avprotectionoverview.com /(|\.|//)tkqlhce\.com/click-.*([?&][a-tv-z]{1,}(=[a-zA-Z0-9]{1,})?){1,} -.discordap.com .forwrdnow.com .7lyonline.com .safelyonline.net @@ -4053,28 +4125,6 @@ .mature-periwinkle-advantage.glitch.me .tough-numerous-lemur.glitch.me .securefirst.us-east-1.linodeobjects.com -.discord-nltro. -.discord-app. -.discord-promo* -.dlscord. -.dlscord-app. -.steamcommin* -.steamcommm* -.steamcommn* -.steamcommunet* -.steamcommunitty. -.steamcommunnity. -.steamcommunty. -.steamcommuu* -.steamcommyn* -.steamcomnu* -.steamcomrn* -.steamconnu* -.steancomm* -.steanncomu* -.discord-glft. -.discordnitrogift* -.gift-nitro. .39.65.72.211 .42.238.151.197 .27.213.60.53 @@ -4199,7 +4249,6 @@ .wellhello.com .ru.com .141.8.226.34 -.discorde-nitre.xyz .ston-app.com # fake human verification scam # start form - reported for abuse @@ -7119,7 +7168,7 @@ .link.sv .4.fo .kckb.st -.*-trk.xyz +-trk.xyz .loadingnow.me .gsecurecontent.com .pressizer.net @@ -18943,49 +18992,18 @@ .csgocup.ru .csgogf*.xyz .csgogift*.xyz -/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ -# -/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ -/(.*[./])?discord[a-z0-9-]{1,}\.gifts?(/ -# -.discord*.gifts -.discord-give. -.discord-nitro-gift. -.discord-nitro. -.discord-nitros. -.discord.foundation -.discordnitro-steam. -.discordxgift. -.discordxnitro. -.discrod.ru .dotagift*.xyz .eslpro.ru .fortnitebuy.com -.free-discordnitro. -.freediscordnitro. .steamcommunlty.it .ggtour.ru .heroes.com.ua .idchecker.xyz .market-csgo.ru -.nitro*.gift -.nitro*.gifts .pubggf*.xyz .pubggift*.xyz .s-arts.pro .skinosoda.online -.sleanmconmunltiy.ru -.staemcommunty.ru -.steamcomiunity.com -.steamcommunillty.com -.steamcommunjty.ru -.steamcommunlity.ru -.steamcomnnuity.com -.steamconmunyty.ru -.steamconunity.ru -.steamcumunity.ru -.steanmconynnuytiy. -.stearncommynity.ru .tradeoffer.com.ru .194.226.139.121 .194.226.139.7 @@ -22306,16 +22324,6 @@ .1x1.cz # -{+block} -# β€”β€”β€” Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. β€”β€”β€” -.githubus.com -.githubu.com -.githu.com -.wgithub.com -.githubuser.com -.rgithub.com -.githubt.com - {+block} # β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” @@ -22346,21 +22354,6 @@ # Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require Β«AdGuard for WindowsΒ») .mb.download.gigabyte.com/FileList/Swhttp/DriverUpd/ANTIVIRUS -{+block} -# β€”β€”β€” Potential typo-squats and directly related stuff β€”β€”β€” -.snapchat.cm -.facebook.cm -.wix.cm -.199.59.243.222 -.14d.us -.173.208.96.42 -.173.208.96.43 -.173.208.96.44 -.173.208.96.45 -.173.208.96.46 -.213.227.149.208 -.213.227.149.211 - {+block} # β€”β€”β€” Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control β€”β€”β€” # diff --git a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl index e1c53bcaf..894540d8f 100644 --- a/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl +++ b/Alternate versions Anti-Malware List/AntiMalwareTPL.tpl @@ -1,6 +1,6 @@ msFilterList # Title: πŸ’Š Dandelion Sprout's Anti-Malware List (Internet Explorer TPL) -# Version: 25December2023v1-Deprecated +# Version: 29December2023v2-Deprecated : expires = 2 days # Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there. # For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists @@ -339,11 +339,97 @@ msFilterList # Other sites -d apps.apple.com * app * id1564900435 -# β€”β€”β€” Wrong TLDs of legitimate sites β€”β€”β€” +# β€”β€”β€” Typo squatting, misspellings, and honest TLD address bar mistakes β€”β€”β€” -d ubuntu.org -d 103.224.212.249 -d speedtest.com -d kelkoogroup.net +-d snapchat.cm +-d facebook.cm +-d wix.cm +-d 199.59.243.222 +-d 14d.us +-d 173.208.96.42 +-d 173.208.96.43 +-d 173.208.96.44 +-d 173.208.96.45 +-d 173.208.96.46 +-d 213.227.149.208 +-d 213.227.149.211 +-d ddscordapp. +-d diicordapp. +-d disccrdapp. +-d dissordapp. +-d discorrapp. +-d discordaap. +-d discordapp.cam +-d discordap.com +# https://github.com/DevSpen/links/blob/master/src/links.txt + + +-d discord-nltro. +-d discord-app. +-d discord-promo* +-d dlscord. +-d dlscord-app. + +-d steamcommin* +-d steamcommm* +-d steamcommn* +-d steamcommunet* +-d steamcommunitty. +-d steamcommunnity. +-d steamcommunty. +-d steamcommuu* +-d steamcommyn* +-d steamcomnu* +-d steamcomrn* +-d steamconnu* +-d steancomm* +-d steanncomu* +-d discord-glft. +-d discordnitrogift* +-d gift-nitro. +-d free-discordnitro. +-d freediscordnitro. + + + + + + +-d discord-give. +-d discord-nitro-gift. +-d discord-nitro. +-d discord-nitros. +-d discord.foundation +-d discordnitro-steam. +-d discordxgift. +-d discordxnitro. +-d discrod.ru + + +-d sleanmconmunltiy.ru +-d staemcommunty.ru +-d steamcomiunity.com +-d steamcommunillty.com +-d steamcommunjty.ru +-d steamcommunlity.ru +-d steamcomnnuity.com +-d steamconmunyty.ru +-d steamconunity.ru +-d steamcumunity.ru +-d steanmconynnuytiy. +-d stearncommynity.ru +-d githubus.com +-d githubu.com +-d githu.com +-d wgithub.com +-d githubuser.com +-d rgithub.com +-d githubt.com +# https://scammer.info/t/discord-nitro-scam-25/87887 +-d discorde-nitre.xyz # β€”β€”β€” Frequently used to infiltrate and maliciously redirect sites, e.g. ToonBarn β€”β€”β€” -d netnet44.net @@ -404,13 +490,6 @@ msFilterList -d 195.201.92.254 # https://github.com/DandelionSprout/adfilt/pull/167 -d forgoprokick.icu -# Other --d ddscordapp. --d diicordapp. --d disccrdapp. --d dissordapp. --d discorrapp. --d discordaap. # https://github.com/AdguardTeam/AdguardFilters/issues/124611 # (https://github.com/DandelionSprout/adfilt/issues/632) @@ -3876,7 +3955,6 @@ msFilterList -d microsoftedge.microsoft.com addons detail image-find oallgpknmoodlcklmhgfpgjkdencmnfd -d microsoftedge.microsoft.com addons detail kpckgoaeejpoghdglooeibkoedpkgock # https://github.com/DandelionSprout/adfilt/issues/251#issue-974102211 --d discordapp.cam -d nanorgin.ydns.eu -d thefreshstuffs.mu -d cocinasintonterias.com @@ -4069,7 +4147,6 @@ msFilterList # (https://github.com/DandelionSprout/adfilt/issues/904) # https://github.com/DandelionSprout/adfilt/issues/288 --d discordap.com -d forwrdnow.com -d 7lyonline.com -d safelyonline.net @@ -4305,32 +4382,6 @@ msFilterList -d tough-numerous-lemur.glitch.me # https://scammer.info/t/mcafee-phish/83725 -d securefirst.us-east-1.linodeobjects.com -# https://github.com/DevSpen/links/blob/master/src/links.txt - - --d discord-nltro. --d discord-app. --d discord-promo* --d dlscord. --d dlscord-app. - --d steamcommin* --d steamcommm* --d steamcommn* --d steamcommunet* --d steamcommunitty. --d steamcommunnity. --d steamcommunty. --d steamcommuu* --d steamcommyn* --d steamcomnu* --d steamcomrn* --d steamconnu* --d steancomm* --d steanncomu* --d discord-glft. --d discordnitrogift* --d gift-nitro. # https://www.virustotal.com/gui/file/4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7/community -d 39.65.72.211 -d 42.238.151.197 @@ -4507,8 +4558,6 @@ msFilterList # https://github.com/AdguardTeam/AdguardFilters/issues/103475 -d ru.com -d 141.8.226.34 -# https://scammer.info/t/discord-nitro-scam-25/87887 --d discorde-nitre.xyz # https://github.com/AdguardTeam/AdguardFilters/issues/108571 -d ston-app.com # fake human verification scam @@ -7469,7 +7518,7 @@ msFilterList -d 4.fo -d kckb.st # https://github.com/AdguardTeam/AdguardFilters/issues/139106 --d *-trk.xyz +-trk.xyz -d loadingnow.me -d gsecurecontent.com -d pressizer.net @@ -19354,25 +19403,8 @@ msFilterList - - - - - --d discord-give. --d discord-nitro-gift. --d discord-nitro. --d discord-nitros. --d discord.foundation --d discordnitro-steam. --d discordxgift. --d discordxnitro. --d discrod.ru - -d eslpro.ru -d fortnitebuy.com --d free-discordnitro. --d freediscordnitro. -d steamcommunlty.it -d ggtour.ru -d heroes.com.ua @@ -19380,22 +19412,8 @@ msFilterList -d market-csgo.ru - - -d s-arts.pro -d skinosoda.online --d sleanmconmunltiy.ru --d staemcommunty.ru --d steamcomiunity.com --d steamcommunillty.com --d steamcommunjty.ru --d steamcommunlity.ru --d steamcomnnuity.com --d steamconmunyty.ru --d steamconunity.ru --d steamcumunity.ru --d steanmconynnuytiy. --d stearncommynity.ru -d tradeoffer.com.ru -d 194.226.139.121 -d 194.226.139.7 @@ -22730,15 +22748,6 @@ msFilterList -d 1x1.cz -# β€”β€”β€” Since I very, very often have to go from "raw.githubusercontent.com" to "github.com" by means of manual address bar highlighting, I feel I could need some kind of protection insurance in case I highlight 2mm off-course one day. β€”β€”β€” --d githubus.com --d githubu.com --d githu.com --d wgithub.com --d githubuser.com --d rgithub.com --d githubt.com - # β€”β€”β€” Usually used by various groups who buy old domains and display illicit ads on them β€”β€”β€” # β€”β€”β€” Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835/β€”β€”β€” @@ -22768,20 +22777,6 @@ msFilterList # Gigabyte APP Center (which use sneaky tricks to install a Norton 360 trial period; May require Β«AdGuard for WindowsΒ») -d mb.download.gigabyte.com FileList Swhttp DriverUpd ANTIVIRUS -# β€”β€”β€” Potential typo-squats and directly related stuff β€”β€”β€” --d snapchat.cm --d facebook.cm --d wix.cm --d 199.59.243.222 --d 14d.us --d 173.208.96.42 --d 173.208.96.43 --d 173.208.96.44 --d 173.208.96.45 --d 173.208.96.46 --d 213.227.149.208 --d 213.227.149.211 - # β€”β€”β€” Carried over from "Anti-'Asset Flip Shovelware' List" in response to Microsoft Store's non-existent quality control β€”β€”β€” # All legitimate Pac-Man games would use "pac-man" links with a dash diff --git a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset index f991654df..1f4412cc4 100644 --- a/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset +++ b/Alternate versions Anti-Malware List/Dandelion Sprout's and other adblocker lists' IPs.ipset @@ -319,6 +319,7 @@ 208.91.196.46 93.93.51.223 103.174.102.240 +38.180.96.244 192.243.59.12 192.243.59.13 192.243.59.20