starred/adfilt
1
0
Fork 0
mirror of https://github.com/DandelionSprout/adfilt.git synced 2026-10-02 22:04:28 +01:00
Code Issues Packages Projects Releases 4 Wiki Activity

Update Dandelion Sprout's Anti-Malware List.txt

Browse Source
This commit is contained in:
Imre Eilertsen
2026-03-29 00:31:34 +01:00
committed by GitHub
parent fe83a9c3ba
commit fbc17e2bb3
1 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dandelion Sprout's Anti-Malware List.txt
+13 -13
View File
@@ -1,6 +1,6 @@
[Adblock Plus 3.13]
! Title: 💊 Dandelion Sprout's Anti-Malware List
! Version: 27March2026v1
! Version: 29March2026v1
! Expires: 1 day
! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
! Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
@@ -301,10 +301,10 @@ exefiles.com##.panel:has([href*="/en/recommended/winthruster/"])
exefiles.com##.row:has(a[href*="/recommended/"])
! Common scam domain patterns
/^(https?|tcp)://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live).*$/$1p,doc
/^(https?|tcp):\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}.*$/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top
/^(https?|tcp|iquic)://(apps?|best|competition|game|mobile|play|prize|reward|sweeps)\d{2,8}\.[a-z-]{5,22}\d{1,8}\.(icu|life|live).*$/$1p,doc
/^(https?|tcp|iquic):\/\/((?!www)[a-z]{3,5}\.)?[-0-9a-z]{6,}\.(?:com|fun|guru|life|online|pw|site|space|top)\/\/?\?o=[0-9a-z]{7}&u=[0-9a-z]{7}.*$/$doc,match-case,domain=com|fun|guru|life|online|pw|site|space|top
! https://github•com/AdguardTeam/AdguardFilters/issues/58737
/^(https?|tcp):\/\/(?:www\.)?[-0-9a-z]{14,}\.(?:biz|fun|live)\/[a-zA-Z]{10,}\.php$/$doc,domain=biz|fun|live
/^(https?|tcp|iquic):\/\/(?:www\.)?[-0-9a-z]{14,}\.(?:biz|fun|live)\/[a-zA-Z]{10,}\.php$/$doc,domain=biz|fun|live
! ——— Banner for "MSN New Tab" ———
msn.com##.irisbanner
@@ -887,9 +887,9 @@ $all,ipaddress=/^192\.243\.61\.[12]?\d?\d$/
/scan-update-and-protect-your-browser.html$doc
! https://github.com/AdguardTeam/AdguardFilters/issues/61755
! https://github.com/AdguardTeam/AdguardFilters/issues/61743
/^((https?|tcp)://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$doc,popup
/^((https?|tcp|iquic)://)?(www\.)?cunt[a-z]{3,8}\.com(/.*)?$/$doc,popup
! https://github.com/easylist/easylist/issues/6111
/^(https?|tcp)://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$doc
/^(https?|tcp|iquic)://\d\d?\.[a-z0-9-]{1,}\.(club|me)(/.*)?$/$doc
||best202*-games-web1.com^$all
||bigkick.biz^$all
||findmedia.biz^$all
@@ -934,14 +934,14 @@ $all,ipaddress=167.99.249.47
! https://maldita•es/malditobulo/2020/11/18/no-no-es-cierto-que-amancio-ortega-haya-invertido-100-millones-en-bitcoin-revolution-es-una-web-falsa/
||starpowders.github.io^
! https://github.com/AdguardTeam/AdguardFilters/issues/69611
/^(https?|tcp)://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/.*)?$/
/^(https?|tcp|iquic)://[a-z0-9-]{30,}\..*\.elasticbeanstalk\.com(/.*)?$/
! https://github.com/AdguardTeam/AdguardFilters/issues/71721
! https://github.com/AdguardTeam/AdguardFilters/issues/71369
! https://github.com/AdguardTeam/AdguardFilters/issues/73623
! https://github.com/AdguardTeam/AdguardFilters/issues/73627
/^(https?|tcp)://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/.*)?$/
/^(https?|tcp|iquic)://([a-z-]{1,})?luck([a-z-]{1,})?\.club(/.*)?$/
! https://github.com/AdguardTeam/AdguardFilters/issues/73133
/^((https?|tcp)://)?\d\d?\.[a-z0-9-]{1,}\.biz(/.*)?$/$doc
/^((https?|tcp|iquic)://)?\d\d?\.[a-z0-9-]{1,}\.biz(/.*)?$/$doc
! https://github.com/DandelionSprout/adfilt/discussions/163#discussioncomment-428333
/bitcoinrevolution/lp.php^$doc
! https://github.com/DandelionSprout/adfilt/issues/188
@@ -1773,7 +1773,7 @@ $all,ipaddress=91.240.118.172
$all,ipaddress=198.199.120.251
||198.199.120.251^$all
! https://www•telia•no/kundeservice/mobil/malware-flubot-android/
/^(https?|tcp)://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/$doc
/^(https?|tcp|iquic)://(www\.)?[a-z0-9-]{1,}\.[a-z]{2,17}/[a-z0-9]/\?[a-z0-9.-]{8,}$/$doc
! A Discord conversation I had about Throneful
||datings-club.life^$all
||findsexy.life^$all
@@ -11329,7 +11329,7 @@ $all,ipaddress=94.156.232.201
||43.157.46.83^$all
||43.164.196.209^$all
||88.255.216.16^$all
/((https?|tcp)://)?204\.194\.54\.\d{1,3}([:/].*)?$/$all
/((https?|tcp|iquic)://)?204\.194\.54\.\d{1,3}([:/].*)?$/$all
!#endif
!#if env_firefox
$all,ipaddress=43.157.122.86
@@ -11535,7 +11535,7 @@ toorgle.net##.join
||yjwtolgjjeky.com^$all
||zdicbpujzjps.com^$all
!#if !ext_ublock
/^((https?|tcp)://)?192\.243\.59\.\d{1,3}(/.*)?$/$doc
/^((https?|tcp|iquic)://)?192\.243\.59\.\d{1,3}(/.*)?$/$doc
!#endif
! rule34hentaiNET when uBlock Filters and AdGuard Base are turned off
! Googling Aksel Hennie (Results for prior week) in late July 2021
@@ -11861,7 +11861,7 @@ $all,ipaddress=95.214.26.78
||wirexapp.africa.com^$all
! Google results for «SodaStream site:no cranberry»
/^(https?|tcp)://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware_redirection_results.*
/^(https?|tcp|iquic)://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware_redirection_results.*
||adservice.google.*/ddm/clk/$doc,domain=~malware_redirection_results.*
/ad_click/q?&url=$doc,domain=~malware_redirection_results.*
! Laughably blatant fraud site