[Adblock Plus 2.0]
! Title: The malicious website blocklist
! Homepage: https://github.com/iam-py-test/my_filters_001
! Expires: 1 day
! Last updated: 12/5/2024
! Version: 1252024-1
! Description: This list aims to protect against scams, phishing, malware, some stalkerware, and potentially unwanted programs (PUPs). It includes a version of vxvault.net's list, modified by me to work in adblockers.
! Special thanks to all of the people who have helped me maintain this list! Check out https://github.com/iam-py-test/my_filters_001/blob/main/CONTRIBUTORS.md
! Issues url: https://github.com/iam-py-test/my_filters_001/issues
! GitLab issues url (not checked as often): https://gitlab.com/iam-py-test/my_filters_001/-/issues
! Note: This list includes a version of VXVault.net's malware distribution url list, formatted for adblockers, which is at https://github.com/iam-py-test/vxvault_filter

! ---- Malware and Phishing ----

! A Facebook phishing website
! https://www.siteadvisor.com/sitereport.html?url=xn--faebook-64a.com
! https://www.fortiguard.com/webfilter?q=xn--faebook-64a.com
! https://virustotal.com/gui/domain/xn--faebook-64a.com/detection
! https://safeweb.norton.com/report/show?url=xn--faebook-64a.com
||xn--faebook-64a.com^

! https://www.joesandbox.com/analysis/422872/0/html
! https://www.siteadvisor.com/sitereport.html?url=strawberry6532210.brizy.site
! https://virustotal.com/gui/url/ac7399fe8dda64a75a77ffc107219fcd90dc9bf2af6bc0893bef5d63b348dfe2/detection
! https://virustotal.com/gui/domain/strawberry6532210.brizy.site/detection
! https://transparencyreport.google.com/safe-browsing/search?url=strawberry6532210.brizy.site
! https://www.urlvoid.com/scan/strawberry6532210.brizy.site/
! https://www.fortiguard.com/webfilter?q=strawberry6532210.brizy.site
! https://sitecheck.sucuri.net/results/strawberry6532210.brizy.site
! https://quttera.com/detailed_report/strawberry6532210.brizy.site
! https://www.google.com/s2/favicons?domain=strawberry6532210.brizy.site
||strawberry6532210.brizy.site^
! https://quttera.com/detailed_report/strawberry6532210.brizy.site
! https://www.siteadvisor.com/sitereport.html?url=starlangbank.com
! https://transparencyreport.google.com/safe-browsing/search?url=starlangbank.com
! https://quttera.com/detailed_report/starlangbank.com
! https://www.fortiguard.com/webfilter?q=starlangbank.com
! https://virustotal.com/gui/domain/starlangbank.com/detection
||starlangbank.com^

! https://www.joesandbox.com/analysis/424179/0/html
! https://virustotal.com/gui/url/7182b03efde39bf8355a8c9e3ab40e9918a799863b51ead503e212c6b56fcbae/detection
! https://virustotal.com/gui/domain/aloha-news.net/detection
! https://www.siteadvisor.com/sitereport.html?url=http%3A%2F%2Faloha-news.net
! https://safeweb.norton.com/report/show?url=http%3A%2F%2Faloha-news.net
! https://sitecheck.sucuri.net/results/aloha-news.net
! https://www.urlvoid.com/scan/aloha-news.net/
! https://www.fortiguard.com/webfilter?q=aloha-news.net
||aloha-news.net^

! https://cyberwarzone.com/whatsapp-phishing/
! https://www.fortiguard.com/webfilter?q=cht-whatsappz.zzux.com
! https://www.fortiguard.com/webfilter?q=zzux.com
! https://www.mywot.com/en/scorecard/zzux.com
! https://www.urlvoid.com/scan/zzux.com/
! https://sitecheck.sucuri.net/results/zzux.com
! https://transparencyreport.google.com/safe-browsing/search?url=zzux.com
! https://safeweb.norton.com/report/show?url=zzux.com
! https://virustotal.com/gui/url/993fb0a37ec2e4b3503bac3b38066dabd040f43a3f47ca99c6839df9bf5dd018/detection
! https://safeweb.norton.com/report/show?url=cht-whatsappz.zzux.com
! https://virustotal.com/gui/url/f89e84af4a187e413fd85b2cc7b604ef1b0b5b3e94c18f039ba1539d593eb898/detection
||cht-whatsappz.zzux.com^

! https://github.com/uBlockOrigin/uAssets/issues/8466
! https://virustotal.com/gui/ip-address/91.241.60.117/relations
! https://virustotal.com/gui/url/08e979bb4cde20ad8b711920f0fa604de67911559013f0fc60560990fbbad239/detection
! https://www.siteadvisor.com/sitereport.html?url=91.241.60.117
||91.241.60.117^

! https://www.reddit.com/r/mildlyinfuriating/comments/nc9zpe/got_a_paypal_or_should_i_say_paypl_phishing_email/
! https://virustotal.com/gui/url/c0e5466cd2843f75d522093d93cf949259ca618ca2f00aa4952e7700cbf59384/detection
||paypl.com^
! https://virustotal.com/gui/url/4531df5b01e2c58f9307fabecc9a17b03c6157bafc8e9af736b278e95c182dc5/community
||payapl.com^
! https://virustotal.com/gui/url/91aecb78868044183cbe47614fb43a7e5aecd4b4ae89294a215354bdda2c3602/detection
! https://www.fortiguard.com/webfilter?q=paypaI.com
! https://www.mywot.com/en/scorecard/paypaI.com
! https://safeweb.norton.com/report/show?url=paypaI.com
||paypaI.com^

! Used to infect and redirect domains
! https://labs.sucuri.net/signatures/sitecheck/malware-rks_injection/
! https://blog.sucuri.net/2011/01/malware-update-co-cc.html
! https://www.fortiguard.com/webfilter?q=http%3A%2F%2Fgoogle-analytisc.co.cc&version=8
! https://safeweb.norton.com/report/show?url=http%3A%2F%2Fgoogle-analytisc.co.cc
! https://virustotal.com/gui/url/6cc9c5dbd531e82102590df163142db0c248de81b831372a35fb281d90a6c768/detection
! https://www.urlvoid.com/scan/google-analytisc.co.cc/
! https://www.mywot.com/en/scorecard/google-analytisc.co.cc
! https://sitecheck.sucuri.net/results/google-analytisc.co.cc
! Appears offline but per https://github.com/uBlock-LLC/uBlock/issues/1839#issuecomment-852183358 adding anyway
||google-analytisc.co.cc^
! https://virustotal.com/gui/url/b3565bedd215978dc3f0e60c82e20f600f4b404343d8a4c89dd336986c941c65/community
! https://www.fortiguard.com/webfilter?q=http%3A%2F%2Foiwdd.co.cc&version=8
! https://safeweb.norton.com/report/show?url=http://oiwdd.co.cc
! https://virustotal.com/gui/url/b0ccfa7eaf148df692177674f5aafeb27792399f4b03d1a75951533f6b7e7e52/detection
! https://www.urlvoid.com/scan/oiwdd.co.cc/
! https://www.mywot.com/scorecard/oiwdd.co.cc
||oiwdd.co.cc^
! https://www.fortiguard.com/webfilter?q=http%3A%2F%2Fpojdue.co.cc&version=8
! https://virustotal.com/gui/url/2ba73f2605b7dff79153f65cf94aee57f68e476c92234d0b4d46e29d8c4eaa12/detection
! https://virustotal.com/gui/domain/pojdue.co.cc/detection
! https://www.urlvoid.com/scan/pojdue.co.cc/
! https://www.mywot.com/scorecard/pojdue.co.cc
||pojdue.co.cc^

! https://labs.sucuri.net/signatures/sitecheck/malware-magento_shoplift-38-1/
! https://virustotal.com/gui/domain/mcloudjs.com/detection
! https://virustotal.com/gui/url/01a9b775e89304d7ebce8e7e5822d730b043868e09994a17786da0a71ec49691/community
! https://www.siteadvisor.com/sitereport.html?url=mcloudjs.com
! https://www.fortiguard.com/webfilter?q=mcloudjs.com
! https://www.urlvoid.com/scan/mcloudjs.com/
! https://safeweb.norton.com/report/show?url=mcloudjs.com
! https://sitecheck.sucuri.net/results/mcloudjs.com
! https://labs.sucuri.net/blacklist/info/?domain=mcloudjs.com
! https://transparencyreport.google.com/safe-browsing/search?url=mcloudjs.com
||mcloudjs.com^

! https://labs.sucuri.net/signatures/sitecheck/malware-redkit/
! https://virustotal.com/gui/url/26a7a5909ca372bc57d68df966fc03b887451a7cf8ae58c5cea92639b4ce2594/detection
! https://virustotal.com/gui/url/78eca70299b830e87ed8f6b3d276e231f2147d5c2817a3586b1ceb5310ea89fa/detection
! https://virustotal.com/gui/domain/wherewedev.com/detection
! https://www.fortiguard.com/webfilter?q=wherewedev.com
! https://www.urlvoid.com/scan/wherewedev.com/
! https://www.mywot.com/en/scorecard/wherewedev.com
! https://safeweb.norton.com/report/show?url=wherewedev.com
! https://sitecheck.sucuri.net/results/wherewedev.com
||wherewedev.com^
! https://virustotal.com/gui/url/a9e68e1b4cdd0e2f58dadf4cd5a93a9983a79b600f1423f86cc5f68b0fec729f/detection
! https://www.fortiguard.com/webfilter?q=infinitypr.in
! https://sitecheck.sucuri.net/results/infinitypr.in
||infinitypr.in^$third-party
! https://virustotal.com/gui/url/86e9efc17750d2885c940cf6ff08820aee1bf35f23fc0faac71a05467b13c0e3/detection
! https://www.fortiguard.com/webfilter?q=integra-lernwerkstatt.de
! https://www.mywot.com/en/scorecard/integra-lernwerkstatt.de
! https://safeweb.norton.com/report/show?url=integra-lernwerkstatt.de
! https://sitecheck.sucuri.net/results/integra-lernwerkstatt.de
! https://labs.sucuri.net/blacklist/info/?domain=integra-lernwerkstatt.de
! https://labs.sucuri.net/blacklist/details/?domain=integra-lernwerkstatt.de
||integra-lernwerkstatt.de^

! https://virustotal.com/gui/file/5e6c167fc70aee2438f92ac0391dcba5905d989a20134dbb4bc9c3c40f805e74/relations
! https://virustotal.com/gui/url/a0fba2a31b88b8e1d6607971bd05440ee43702327e19d93ba91c705f7189c533/detection
! https://virustotal.com/gui/domain/kjwre77638dfqwieuoi.info/detection
! https://virustotal.com/gui/url/7d1b788cd3afd004b36421ad288b17ca4f2c5ad8e37363022b4f8573c7b77e03/detection
||kjwre77638dfqwieuoi.info^
! https://virustotal.com/gui/domain/kukutrustnet777.info/detection
||kukutrustnet777.info^
! https://virustotal.com/gui/url/38e39cdaa4d595968e55e4bcaa45818c887257e81ae6020bf2cb77c34a2e55be/detection
! https://www.fortiguard.com/webfilter?q=moch.forweb.pl
! https://safeweb.norton.com/report/show?url=moch.forweb.pl
||moch.forweb.pl^

! https://www.joesandbox.com/analysis/431924/0/html#domains
! https://virustotal.com/gui/url/254b1fd9f7536ece07cf5a3747aa2adeccc76e61b1f4e5994c0dc683d0a6db03/detection
! https://virustotal.com/gui/url/be44f0113500882e27eb730cfdad7687fe75ad56c8e9d9b2426273a0eb13e201/detection
! https://www.siteadvisor.com/sitereport.html?url=alphastand.win
! https://www.fortiguard.com/webfilter?q=alphastand.win
! https://safeweb.norton.com/report/show?url=alphastand.win
! https://sitecheck.sucuri.net/results/alphastand.win
! https://quttera.com/detailed_report/alphastand.win
||alphastand.win^
! https://www.siteadvisor.com/sitereport.html?url=alphastand.trade
! https://www.fortiguard.com/webfilter?q=alphastand.trade
! https://safeweb.norton.com/report/show?url=alphastand.trade
! https://sitecheck.sucuri.net/results/alphastand.trade
! https://virustotal.com/gui/domain/alphastand.trade/detection
||alphastand.trade^

! https://www.joesandbox.com/analysis/413824/0/html#domains
! https://virustotal.com/gui/url/9c1f4fd3af06c7eff8fa0c96c0386acdea17225b7202b87044a5e7895d80f694/detection
! https://virustotal.com/gui/domain/saywowshow.com/detection
! https://safeweb.norton.com/report/show?url=saywowshow.com
||saywowshow.com^

! https://forum.mywot.com/reputation-discussions-f5/ridiculous-eth-bitcoin-giveaways-or-instant-invest-t86210.html
||btc-promo.czweb.org^
||eth24win.co.nf^
||giveaway-eth-btc.webz.cz^

! https://www.bleepingcomputer.com/news/security/phishing-impersonates-global-recruitment-firm-to-push-malware/
! https://twitter.com/InQuest/status/1385324245891182592
! https://virustotal.com/gui/url/81913a8a7fa758d7476a13ff03395f31f665addf973adf253c5123fbb8a4caf4/detection
! https://virustotal.com/gui/url/cd77c6e39b0ca34cb7bd0106e769f2a4a019b05f96d608582f4ad7693b604f6a/detection
! https://safeweb.norton.com/report/show?url=powerhousetoys.com
! https://www.siteadvisor.com/sitereport.html?url=https://powerhousetoys.com/opp.txt
||powerhousetoys.com^

! https://virustotal.com/gui/url/3961877189248724c33e9d6b0e590b9e11607d27de88cd7f130487719c2e8efd/detection
! https://www.fortiguard.com/webfilter?q=crypto-loot.com
! https://www.mywot.com/en/scorecard/crypto-loot.com
! https://safeweb.norton.com/report/show?url=crypto-loot.com
! https://quttera.com/detailed_report/crypto-loot.com
! https://sitecheck.sucuri.net/results/crypto-loot.com
||crypto-loot.com^
! https://www.fortiguard.com/webfilter?q=crypto-loot.org
! https://virustotal.com/gui/url/bed5db125302663b090d4dcf170873a5ff60bbe44d72e451801497751e5a78df/detection
! https://safeweb.norton.com/report/show?url=crypto-loot.org
! https://sitecheck.sucuri.net/results/crypto-loot.org
||crypto-loot.org^

! https://github.com/webcompat/web-bugs/issues/74703
! https://www.siteadvisor.com/sitereport.html?url=mysecrethoookup.com
! https://www.fortiguard.com/webfilter?q=mysecrethoookup.com&version=8
! https://virustotal.com/gui/url/ad652f0b682616bb75b6ab31ed6be38fddf4c46b2d2405ea738bbee1a80e85c7/detection
! https://safeweb.norton.com/report/show?url=mysecrethoookup.com
! https://sitecheck.sucuri.net/results/mysecrethoookup.com
||mysecrethoookup.com^

! https://virustotal.com/gui/ip-address/104.236.14.145/relations
! https://www.mywot.com/en/scorecard/blogsopt.com
! https://virustotal.com/gui/url/6d9e9d347f3578fe8fea973820a40a0ab760165e613af323b4a025dee339c73e/detection
||blogsopt.com^

! https://www.urlvoid.com/ip/103.224.212.247/
! https://www.urlvoid.com/scan/dacenete.com/
! https://www.mywot.com/en/scorecard/dacenete.com
! https://virustotal.com/gui/url/1edf1ec0e4f299ec94a3c4cdfc882795a0a0e77031c866f595e8354120bee802/community
! https://www.siteadvisor.com/sitereport.html?url=Dacenete.com
! https://www.fortiguard.com/webfilter?q=Dacenete.com
! https://safeweb.norton.com/report/show?url=Dacenete.com
! https://yandex.com/safety/?l10n=en&url=dacenete.com
! https://sitecheck.sucuri.net/results/Dacenete.com
||dacenete.com^
! https://www.siteadvisor.com/sitereport.html?url=Coolstats1.net
! https://www.urlvoid.com/scan/coolstats1.net/
! https://www.fortiguard.com/webfilter?q=Coolstats1.net
! https://www.mywot.com/en/scorecard/Coolstats1.net
! https://virustotal.com/gui/url/44e1091f194808820ef787750737232f95e7e9ecb17d1605246715645573158e/detection
! https://sitecheck.sucuri.net/results/Coolstats1.net
||coolstats1.net^
! https://www.siteadvisor.com/sitereport.html?url=http://ww38.coolstats1.net/?subid1=20210616-0828-13e0-974a-e3edd89fe7ec
! https://virustotal.com/gui/url/4b2c524cd265adaccc0bb0a4ec10f84cbb13f1920a9138f12cc7d87c65c5ca63/detection
||ww38.coolstats1.net^

! https://www.pcrisk.com/removal-guides/15423-adf-ly-ads
! https://virustotal.com/gui/url/f984d9289494b526bbac5cb57fc5b9edae210a3f980f3d784f6d1fbb80c0bcb5/detection
! https://virustotal.com/gui/url/300f1d4d3cf0782f029aec0af02817906ecc57d30a61e78b2c01c8e8b693f5d7/detection
! https://safeweb.norton.com/report/show?url=eyourcom.fun
! https://www.fortiguard.com/webfilter?q=eyourcom.fun
||eyourcom.fun^
||xcrke.eyourcom.fun^
! https://virustotal.com/gui/url/8d91b224b62e8002ab9bfa5314717fc61a2cd2c74e228f26093decdd070bfb0a/detection
! https://safeweb.norton.com/report/show?url=blastnotificationx.com
||blastnotificationx.com^

! https://virustotal.com/gui/url/f645599a31b833dcebbfec890361e28a5fb14ba86e6f730d74688d11cfe7f52f/details
! https://www.joesandbox.com/analysis/436433/0/html#deviceScreen
! https://www.mywot.com/scorecard/googe.com
! https://safeweb.norton.com/reviews?url=googe.com
||googe.com^
! https://virustotal.com/gui/url/9a34eeed10b62d3aa3698efc8a128e6e87f937982bbcd3d03e50a8ab53b27da9/community
! https://www.mywot.com/scorecard/proasdf.com
! https://safeweb.norton.com/report/show_mobile?name=proasdf.com
||proasdf.com^

! https://forum.mywot.com/24626-whatsmyipaddress-com
! https://virustotal.com/gui/url/c8bc45a00aeb7be3ccc68a0cf17e4a6175db761393dee57de32a49338b77ca45/detection
! https://www.fortiguard.com/webfilter?q=appple.com&version=8
||appple.com^
||ww1.appple.com^

! https://blog.sucuri.net/2021/05/woocommerce-credit-card-skimmer.html
! https://blog.sucuri.net/2018/04/malicious-activities-google-tag-manager.html
! https://blog.sucuri.net/2017/09/hacked-websites-mine-crypocurrencies.html
! https://virustotal.com/gui/ip-address/34.98.99.30/community
! https://pastebin.com/FzHDkSW7
! https://www.fortiguard.com/webfilter?q=albumzips.xyz
! https://safeweb.norton.com/report/show?url=albumzips.xyz
! https://sitecheck.sucuri.net/results/albumzips.xyz
! https://virustotal.com/gui/url/cd2a97abe31697bf1822c505ee9ad267772463230a943fe3fb680af2ba74b327/detection
||ww16.albumzips.xyz^
! https://sitecheck.sucuri.net/results/camillesanz.com
! https://safeweb.norton.com/report/show?url=camillesanz.com
! https://virustotal.com/gui/url/f542034f339f53a70bbb0c40a662d49cc37806bc112ef403bac8b4a5d1c02b03/detection
||camillesanz.com^
||www.camillesanz.com^
! https://labs.sucuri.net/blacklist/details/?domain=africangrey.top
! https://virustotal.com/gui/url/d3feabeb546851be8e449074eaddf2c72e687b92754693aba97f3ae27772a796/detection
! https://virustotal.com/gui/url/917d555cce2e2e6791704d64812cbb203c57201bac559478c334c74c8e392330/detection
! https://www.siteadvisor.com/sitereport.html?url=ribinski.us
! https://safeweb.norton.com/report/show?url=ribinski.us
! https://sitecheck.sucuri.net/results/ribinski.us
! https://labs.sucuri.net/blacklist/info/?domain=ribinski.us
||ribinski.us^

! https://twitter.com/gorhill/status/1293239879887970305
!   - via https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-704235803
! https://virustotal.com/gui/url/085d0bd9451920bd97eb099fb14e42b8ceccadf79cdf70da0d29e31900262ce1/detection
! https://www.siteadvisor.com/sitereport.html?url=fly-analytics.com
! https://www.fortiguard.com/webfilter?q=fly-analytics.com
! https://safeweb.norton.com/report/show?url=fly-analytics.com
! https://sitecheck.sucuri.net/results/fly-analytics.com
||fly-analytics.com^

! https://virustotal.com/gui/user/Placebo
! https://virustotal.com/gui/file/3ff26dfe049d6ea2d608eaf0914e527a798ae018e3918b9d1f025ca47700cb6f/community
! https://virustotal.com/gui/domain/thoughtplus.in/community
! https://virustotal.com/gui/url/626f2608d12b9bddc0ac5148b653290b192b45a79db85c7243b04f5374cd3e67/detection
! https://www.siteadvisor.com/sitereport.html?url=thoughtplus.in
! https://www.fortiguard.com/webfilter?q=thoughtplus.in
! https://safeweb.norton.com/report/show?url=thoughtplus.in
! https://sitecheck.sucuri.net/results/thoughtplus.in
! https://transparencyreport.google.com/safe-browsing/search?url=thoughtplus.in
||thoughtplus.in^

! https://www.bleepingcomputer.com/virus-removal/remove-toksearches.xyz-search-redirect
! https://virustotal.com/gui/url/f6e174e4f27f27f27b5f8c3516fcdbea555d9128d50d6e20f6ca2ca8fbf0d37f/detection
! https://www.fortiguard.com/webfilter?q=toksearches.xyz
||toksearches.xyz^
! https://www.bleepingcomputer.com/virus-removal/remove-smashappsearch.com-search-redirect
! https://www.bleepingcomputer.com/virus-removal/remove-smashapps.net-search-redirect
! https://www.bleepingcomputer.com/virus-removal/remove-bipapp-chrome-extension
||smashapps.net^
||smashappsearch.com^

! https://www.bleepingcomputer.com/virus-removal/remove-please-allow-to-watch-the-video
! https://virustotal.com/gui/url/ef88006f1f5beab8ded6b8786870209c1651db831c19e4f49e5ef829c267cac1/detection
! https://www.siteadvisor.com/sitereport.html?url=new-message.live
! https://www.fortiguard.com/webfilter?q=new-message.live
! https://safeweb.norton.com/report/show?url=new-message.live
! https://sitecheck.sucuri.net/results/new-message.live
||new-message.live^
! https://virustotal.com/gui/url/098cc8fed90c43af3a4afb4df0d7da9c68b1b2c8a3c73fb9d4506c7f062547f1/detection
! https://virustotal.com/gui/ip-address/95.168.170.165/relations
! https://virustotal.com/gui/url/6a23b2b07941322f9ad5555d97bfd020c2681264d71b5ed6c621f0a6cad6277c/detection
! https://www.fortiguard.com/webfilter?q=private-message.live
! https://safeweb.norton.com/report/show?url=private-message.live
! https://www.mywot.com/scorecard/private-message.live
||private-message.live^

! https://blog.malwarebytes.com/a-week-in-security/2021/06/a-week-in-security-june-21-2021-june-27-2021/
! https://virustotal.com/gui/url/d668d18f1cd3b32eea6d717af4655a7e511d5b92403ed71a66d366a4c971c826/detection
! https://therecord.media/dirtymoe-malware-has-infected-more-than-100000-windows-systems/
! https://decoded.avast.io/martinchlumecky/dirtymoe-1/
! https://www.siteadvisor.com/sitereport.html?url=1qw.us
! https://www.fortiguard.com/webfilter?q=1qw.us
! https://safeweb.norton.com/report/show?url=1qw.us
! https://virustotal.com/gui/url/8e4d54adb8cc9b6fe443f17da6b29ef8e367ca1dacae6ac2cf9b2cc665268bde/detection
||1qw.us^
! https://www.siteadvisor.com/sitereport.html?url=rpc.1qw.us
! https://www.fortiguard.com/webfilter?q=rpc.1qw.us
! https://safeweb.norton.com/report/show?url=rpc.1qw.us
! https://virustotal.com/gui/domain/rpc.1qw.us/relations
! https://virustotal.com/gui/url/f21b269b690aac8338399bb40408aa8cefa3591dcc9a3f84f5a911f647c8d2f7/detection
||rpc.1qw.us^
! https://www.proofpoint.com/us/blog/threat-insight/purple-fox-ek-adds-exploits-cve-2020-0674-and-cve-2019-1458-its-arsenal
! https://virustotal.com/gui/url/5769102f270c1b16ebdc663ad63010d69de2d159117b3736d562dc59944fc6dc/detection
! https://virustotal.com/gui/url/35e34ac62d1ac12fe3146a8a2d6d60300f7a1b97e2922fedb91154243e950cb1/detection
! https://virustotal.com/gui/url/e88a950b22a8582a4761c8b6a26546cd7e92b3175c16bd32d1dd8f61f45a1c58/detection
! https://virustotal.com/gui/url/2bb2d79e789ba930b36960a8a0fbb008ed5cb594406e89507033832da2668870/detection
! https://virustotal.com/gui/url/326384fb6f6e393f8fde813c9cf2be668b68780c0a036d977fc6482fd6364ca1/detection
! ||raw.githack.xyz/SdTC8df7vmDNIUuV1.jpg$all
! https://www.siteadvisor.com/sitereport.html?url=raw.githack.xyz
! https://www.fortiguard.com/webfilter?q=raw.githack.xyz
! https://safeweb.norton.com/report/show?url=raw.githack.xyz
||raw.githack.xyz^

! https://virustotal.com/gui/user/Site.safetychecker
! https://virustotal.com/gui/url/7108cfe6953cab08696ae1f9ab2c777b749fb53e7beb5c003756ea522c880f17/detection
||yotube.com^
! https://redirectdetective.com
! https://virustotal.com/gui/url/82e7188109152e27f51a97c1bcb935a1cc302736ed20a41ababa6d9239c7f85d/community
! https://safeweb.norton.com/report/show?url=gloos-ves.com
||gloos-ves.com^
! https://virustotal.com/gui/ip-address/54.174.112.67/relations
! https://virustotal.com/gui/url/85e357a917a886c9b2791d0c08199c95cd8a50ad003340a8140c04347777ee74/detection
! https://www.fortiguard.com/webfilter?q=zeroredirect1.com
! https://www.mywot.com/en/scorecard/zeroredirect1.com
! https://safeweb.norton.com/reviews?url=zeroredirect1.com
||zeroredirect1.com^

! https://www.bleepingcomputer.com/virus-removal/remove-power-app-chrome-extension
! https://virustotal.com/gui/url/6dd9e3edd772497d3db7f61fa0cbd6b81b888dc1e01f95c693edfb3e696b702e/detection
! https://www.fortiguard.com/webfilter?q=searchpowerapp.com
! https://safeweb.norton.com/report/show?url=searchpowerapp.com
||searchpowerapp.com^
! https://virustotal.com/gui/url/4cb33835d45743431d20b4c019e09dd1861953440572bf40dd4b2745cb391082/detection
! https://www.fortiguard.com/webfilter?q=lp.searchdimension.com
! https://safeweb.norton.com/report/show?url=lp.searchdimension.com
! https://www.mywot.com/en/scorecard/lp.searchdimension.com
||lp.searchdimension.com^
! https://virustotal.com/gui/url/ac7e2f7f5557d6cac58a5250eedb78e5a647b5be6814d595df6b84bf9687e934/detection
! https://www.fortiguard.com/webfilter?q=searchdimension.com
! https://www.mywot.com/en/scorecard/searchdimension.com
! https://safeweb.norton.com/report/show?url=searchdimension.com
||searchdimension.com^

! https://blog.malwarebytes.com/exploits-and-vulnerabilities/2020/04/copycat-criminals-abuse-malwarebytes-brand-in-malvertising-campaign/
! https://virustotal.com/gui/url/8faba8050b38887c13c044743c789d9a8e1795098b2c20250bfae80f5d1d2a4f/detection
! https://www.fortiguard.com/webfilter?q=malwarebytes-free.com
! https://safeweb.norton.com/report/show?url=malwarebytes-free.com
||malwarebytes-free.com^

! https://forums.malwarebytes.com/topic/276364-please-help-to-remove-jingermycom/
! https://virustotal.com/gui/url/5538837550b6bf93ad0fd8be30a9061d43b8f2097dcdfb6a7d959eaebf6b92f1/detection
! https://www.fortiguard.com/webfilter?q=jingermy.com
! https://safeweb.norton.com/report/show?url=jingermy.com
||jingermy.com^


! https://thehackernews.com/2021/07/hackers-spread-biopass-malware-via.html
! https://virustotal.com/gui/url/97b4ed1e2788217aa186f26dbdd13a36544dde101e53ea3382e6a5aa1b9f4081/detection
! https://virustotal.com/gui/ip-address/47.57.140.149/relations
! https://virustotal.com/gui/url/0025d5ba5569ba2ecc29c39236a9b559a212e3ac7404b9af7be62e143175cf5f/detection
! https://virustotal.com/gui/url/94a7b6d048720fe4e837d6027f5019c775d20e5ea761ad03236f85070f08838a/detection
! https://virustotal.com/gui/url/ade8073339365eed03d142d5e57ec528d54294c40fdac08e71d5363d3ba634d0/detection
||update.flash-installer.com^
! https://virustotal.com/gui/url/98962a3086cc694e1d62667a718edd6738b233b2b348b1197c141a8ecb251336/detection
||flash-installer.com^

! https://virustotal.com/gui/file/4bf58623f91ff9a19c2893061a2a14660f61b2294f976a9d80ab6b3d023c9892/relations
! https://virustotal.com/gui/url/a21f89ebf6c4835a504a92359d23be518b80b9b7bd5417541087d60751d41694/detection
||paymetconfirm.com^

! Tech support scammers
! https://www.youtube.com/watch?v=Ooh6bV8FwTo
! https://virustotal.com/gui/url/02071a7a5b71526d41e0f4547b4912368ee6a0920e7d7aaade16fd3f5ca01a87/detection
! https://safeweb.norton.com/report/show?url=systemini-com.tk
||systemini-com.tk^
! https://virustotal.com/gui/url/fb85efbc7bf81b10869ddaddd9b3b9471a916b9f8d820d2ccee48712c3e58b9e/detection
! https://www.siteadvisor.com/sitereport.html?url=micropcsupport.com
||micropcsupport.com^

! Browser locker
! https://virustotal.com/gui/url/44f957f9350dfc3d9b8ccac23074301c3c20278a787af25a28edd8e15eacb7e1/detection
! https://github.com/DandelionSprout/adfilt/issues/228
||helooworld.us^
! Which redirects to 
||www.helooworld.us^

! https://virustotal.com/gui/file/081618f7d9c6c92271f8d6bc65c8e13f33dfe9e5022f06aaec95664ee31fead4/relations
! https://virustotal.com/gui/url/efc1177d474e3efe2e9e53fcfbb012c9ae86f64467e38824f6d974d5504647f0/detection
||properlysolutionsco.com^

! https://virustotal.com/gui/file/6f236e253720a0b3cf1fdafd111f99ba84e0a2b03ff8453fd747c3d9c8973403/relations
! https://virustotal.com/gui/file/13e8d4557870179e70b7d4f580c9183e9a6eead777af04fc226feb70d9ce76cb/relations
! https://virustotal.com/gui/url/e3fb5d2d13d34c94468df0ecd5825ed28861ccee9f1a1703e4b37a01af2f7caf/detection
! https://safeweb.norton.com/report/show?url=os.telechargercdn.com
! https://www.siteadvisor.com/sitereport.html?url=os.telechargercdn.com
||os.telechargercdn.com^

! https://github.com/DandelionSprout/adfilt/issues/244
! The original website
||rblxexploits.net^
||www.rblxexploits.net^
! Fake notifications 
||usegetmarketings.com^
||bestappever4you.com^
! This was loaded by a malware extension that was installed
||thecrs.club^

! https://virustotal.com/gui/file/67b1a7835687bf5851cf29539b2d0ce90ab30d373edfcf9ee54237026c67df33/relations
! https://virustotal.com/gui/url/1912779d4b9bfd7713239cf6e2ede751c40b38541404b21adb0c595b65356c75/detection
! https://www.siteadvisor.com/sitereport.html?url=uehge4g6gh.2ihsfa.com
! https://safeweb.norton.com/report/show?url=uehge4g6gh.2ihsfa.com
! https://metadefender.opswat.com/results/domain/dWVoZ2U0ZzZnaC4yaWhzZmEuY29t/overview?lang=en
||uehge4g6gh.2ihsfa.com^
! https://virustotal.com/gui/url/faee0c9a2d3786dda120ce8b99381878ebf05ca2b4d4a4437118ab2ca8ab49bd/detection
! https://www.siteadvisor.com/sitereport.html?url=2ihsfa.com
! https://safeweb.norton.com/report/show?url=2ihsfa.com
||2ihsfa.com^
! https://virustotal.com/gui/url/5cfe3add8396356f1757449074e95fab7b77aeabc405ca0fcebab5b699198d7f/detection
! https://www.siteadvisor.com/sitereport.html?url=listincode.com
! https://safeweb.norton.com/report/show?url=listincode.com
||listincode.com^
! https://virustotal.com/gui/url/9ac802ac997e44f7daf814ce163a17884ae59e3dd99e0c39432449af195f90b6/detection
||www.listincode.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/88280
! https://virustotal.com/gui/url/5ac4b9c907ee714f1163331bcb9840a472f85809e9730edc03dd88e9d706bcbb/detection
! https://safeweb.norton.com/report/show?url=update-portal.com
! https://www.siteadvisor.com/sitereport.html?url=update-portal.com
||update-portal.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/88270
! https://safeweb.norton.com/report/show?url=tw-goldenwinner-57.com
! https://virustotal.com/gui/url/ddec939917a016338c34597563962b9baa10080f62ea0320d8e4b8b21156007e/detection
||tw-goldenwinner-57.com^
||www.tw-goldenwinner-57.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/80390
! https://virustotal.com/gui/url/1b63e3d8a99633582446d6c095e9350b869dc60716187f714bbdb85d9f06122f/detection
! https://safeweb.norton.com/report/show?url=artebythesea.com
||artebythesea.com^
! https://virustotal.com/gui/url/16534bfc6c24e0c30dbac08ea5297ae24f9f9ae90411bc3b608659e1767317a7/detection
! https://safeweb.norton.com/report/show?url=microsoftpods.com
||microsoftpods.com^
! https://virustotal.com/gui/url/94b361a89a5c3a43d6013fb8f971e40c9bd3493042343a0ee3626375b4552267/detection
! https://safeweb.norton.com/report/show?url=nashvillegems.com
||nashvillegems.com^
! https://virustotal.com/gui/url/2dbc2cf61fa22eec22629f31b731c04eeb4cdc86d589ab36c0c7719b26e60ede/detection
! https://safeweb.norton.com/report/show?url=flawlessdrinking.com
||flawlessdrinking.com^
! https://virustotal.com/gui/url/2a213601051b43f18c3f6b6faadf5b65b8375f5c9ffe5cb9fe2c18fe13b0bd2a/detection
! https://safeweb.norton.com/report/show?url=findmyautoparts.com
||findmyautoparts.com^
! https://virustotal.com/gui/url/fcd7962a77ae7836f84789452b77d293de0e1a47e91ecfe2c2508bead500197b/detection
! https://safeweb.norton.com/report/show?url=grandpaurbanfarm.net
||grandpaurbanfarm.net^
! https://safeweb.norton.com/report/show?url=guide4idiots.com
! https://virustotal.com/gui/url/2f9dfbbc3cde41756691a0b741eb605c7ed81d55733f912dc590808f6ec2cb5e/detection
||guide4idiots.com^
! https://safeweb.norton.com/report/show?url=identityofplace.com
! https://virustotal.com/gui/url/987c5c40192b3e6049a8c2523a7f4bba374db1ab7a1418f25dccdba7379674c6/detection
||identityofplace.com^
! https://virustotal.com/gui/url/6fb68516452024785cbdb664f5363c7e49ed6a9fd88fe0dce79a157560ec0701/detection
! https://safeweb.norton.com/report/show?url=shpwmy.com
||shpwmy.com^

! https://github.com/easylist/easylist/pull/6164
! https://github.com/DandelionSprout/adfilt/blob/a0f6bdcc309cab585502c76ebd70c088995a3d17/Dandelion%20Sprout's%20Anti-Malware%20List.txt#L955-L5713
! https://virustotal.com/gui/url/59077166c998073d0f809f35fb035256e8ee263f2136e783c82cd6017aad4029/detection
! https://virustotal.com/gui/ip-address/192.243.59.12/relations
! https://virustotal.com/gui/url/8041adaabbd884df4712bdfa8794bdbcf37dfaa8f06164bbe6df2ba79c2eaa72/detection
! https://www.siteadvisor.com/sitereport.html?url=dustymural.com
! https://safeweb.norton.com/report/show?url=dustymural.com
||dustymural.com^
! https://virustotal.com/gui/ip-address/192.243.59.13/community
! https://virustotal.com/gui/url/5eca62948cb380e8b8def8a250d91210df2c7385799fcc3b9f0b0df28b1fdd1b/community
! https://www.siteadvisor.com/sitereport.html?url=disappearanceinspiredscan.com
! https://safeweb.norton.com/report/show?url=disappearanceinspiredscan.com
||disappearanceinspiredscan.com^

! https://forums.malwarebytes.com/topic/277965-your-system-is-infected-with-3-viruses/
! https://github.com/DandelionSprout/adfilt/issues/262
||lucdream.com^
||beastbuying.com^
||kokotrokot.com^
! contains porn
||pesoaniz.com^
! Fake popups
||rtb-8.novitrk1.com^
||cu27t-evo29lution.xyz^
||doneonline.xyz^
||possessedcrackinghart.com^
||typiccor.com^
||apsolutamente.com^
||time4news.net^
||secureleadsforever.com^
||pushmeup.art^
||eu.pushmeup.art^
||trc.artofads.co^
||pc-my-protection.xyz^

! https://forums.malwarebytes.com/topic/278166-my-website-is-labelled-as-dangerous-by-malwarebytes/
! https://virustotal.com/gui/url/68ccee4530342ae6ea690a0ef786f040a3d9a0d1bfc08c4b857af71ac8e90954/detection
! https://virustotal.com/gui/url/14cfdccc23aac9ffaf051675efcda240f2e83a5cd34403e412f0f2959e42a536/detection
! https://www.siteadvisor.com/sitereport.html?url=serena-west.com
||serena-west.com^
||www.serena-west.com^

! https://forums.malwarebytes.com/topic/278209-removal-instructions-for-socialsearchconverter/
||socialsearchconverter.com^
||install.socialsearchconverter.com^
||feed.socialsearchconverter.com^
||api.socialsearchconverter.com^
||notify-service.com^
||install.stream-all.com^
||stream-all.com^

! Malware - see https://github.com/DandelionSprout/adfilt/issues/267
||codedexchange.com^
||trkk4.com^
||us1.trkk4.com^

! https://www.youtube.com/watch?v=xOw1vct-wHg
! https://virustotal.com/gui/url/95f8db6ff866ba200658f9c25c8a5484ca4f771ae3ac3aba8694129a7f18ec0f/detection
! Dead
||hpprintersupportservice.com^
||how.hpprintersupportservice.com^
! Not dead yet - https://github.com/uBlockOrigin/uAssets/issues/9933
||1redirb.com^
! https://github.com/uBlockOrigin/uAssets/issues/9933#issuecomment-913677276
||greenadblocker.com^

! https://github.com/blocklistproject/Lists/issues/456
! https://virustotal.com/gui/url/383e601492df662f7612beea0e02d336a3ee39e864db40d03fe72d4f3fe4c2e4/detection
||discorcl.link^

! https://blog.malwarebytes.com/threat-intelligence/2021/09/the-many-tentacles-of-magecart-group-8/
||adaptivestyles.com^
||anduansury.com^
||bootstrapmag.com^
||cdncontainer.com^
||fileskeeper.org^
||foodandcot.com^
||freshdepor.com^
||hottrackcdn.com^
||mechat.info^
||paypaypay.org^
||gctatic.com^
||googletagmanages.com^
||gstaticx.com^
||googletagmaneger.com^
||googleusescontent.com^
||googlutagmanager.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/95582
! https://virustotal.com/gui/url/3323920fe31aaa6724441edc7bd395232194c52967480a95039fb35bcb3d7ac2
! https://virustotal.com/gui/url/93011523cfdd4defbccbe5fff351acac2bb6fdddba6420cc69d81cc9f9dd7f61
||discord-give.com^
||www.discord-give.com^
! https://virustotal.com/gui/url/145c4bdadca86dfb9560668f2cec835f75c248af41b8842687ad89dce8d2aed0
||communitytradeoffer.com.ru^
! https://www.siteadvisor.com/sitereport.html?url=dlscord-app.info
||dlscord-app.info^
! https://virustotal.com/gui/url/51da56828b0cd9d4d4514feb74038aefb01dc4188da398f1666983766914c156
||steamcommnity.com.ru^
! https://virustotal.com/gui/url/83ce8c920a22c9550591e52839fd540ee7a37b941e3419780b17e195fcfb9b28
! https://virustotal.com/gui/url/81880d767bab8515cf71ce37ebe7b56d8448184b96999f6cc4ce70d2b6c68949
||steamdiscord.com^
! https://virustotal.com/gui/url/0a8ea816672728b0e9869f65e4788471880746a65f3f8f2215789d0edfe278d3
||discord-app.net^
! https://virustotal.com/gui/url/0314bd2bb4874cad7a39346c83c421d87208be4bca6c0dc2f804f0a902b18cfc
||steancommynitu.com^
! Copied over from https://github.com/DandelionSprout/adfilt/commit/260f840b773b04d7397c6c40d86cf7e2887768d8 (credit to https://github.com/DandelionSprout)
||cabura.loan^
||csgocup.ru^
||discord.foundation^
||discrod.ru^
||eslpro.ru^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-927151458
! https://virustotal.com/gui/url/a7fb846c9f8aefecbe0ffda1aecbb6a3d257f0b31a9b922aa49d494af0f0c112
||findyour-realsex2.com^
! https://virustotal.com/gui/url/0680f0ae763476f2aa0b844b6f64a1ca4b6c63e0c7f6880ab5f121ad406b2d2e/detection
||your-dreams-girls2.com^
! https://virustotal.com/gui/url/4047b3b1b6af03839835b31cffbc5d52eff7c6f01c23cf3330a1000c61b66c0f
! https://virustotal.com/gui/url/4a2cff70405ed300ad14b2294eb06c9adff5354911f70229085deecc7048637b
||yourbigexplosivewin.life^
! https://virustotal.com/gui/url/ff99d9ba468539c01896ef8b380819c07b8af40792d83beccea2d76064ebf781
! https://virustotal.com/gui/url/134a3e4324ca33c19c529aa554ff193a96b48ae6213323a957f5752641a8014e
||bestdatinglocal1.com^
! https://virustotal.com/gui/url/385edcca4e25f51083f593a4041f834fee5c903a93f5f66eab50f65df61c811c
||sexcontact-store1.com^
! https://virustotal.com/gui/url/7574cd8789b7ac7b78e4efe778ab6228a8b8c79301740247b5738bc62f208883
||superdatenow3.com^
! https://virustotal.com/gui/url/a7f1c2d1c02cc824bb93c1ba1d147d9fc1464bb3a4aeb937922d6bbdec84ffff
||findlocalgirlnow.com^
! https://virustotal.com/gui/url/c5126c3b175c6fa50d96443ecca99b75c881420248ec020c7cd567715839410a
! https://github.com/uBlockOrigin/uAssets/issues/10075
||the-crypto-genius.net^
||www.the-crypto-genius.net^
! Redirect
||learning-base.club^

! https://github.com/DandelionSprout/adfilt/issues/287#issue-1013759704
||youtuba.com^
||polyhymnia-mar.com^
||virpropcnow.xyz^
||avprotectionoverview.com^

! https://virustotal.com/gui/file/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc/relations
! https://virustotal.com/gui/ip-address/160.202.163.100/relations
! https://virustotal.com/gui/url/3818bac5233b17d11c0744005712a5761596f33ac54c23565eb08b5496323d48
||microsoftkernel.com^
||update.microsoftkernel.com^
! https://virustotal.com/gui/url/7709e9dff92c359c920e31866268a04489a67fc2e415bbc8c20cea8604387121
||hksupd.com^
||amazon.hksupd.com^
! https://virustotal.com/gui/url/c8da0d48ea7be9444411840955f2a658c3f6fbfd3dcc87df29fe0c13a6b9b604
||microsofthk.com^
||update.microsofthk.com^

! https://virustotal.com/gui/url/956c451fe61038377026bee53c4eeff67ab3efe69f5c4c6e22b3c1dbde10ced1
! https://virustotal.com/gui/url/8c1e1a8a80c515d411b4e22d36ddb0535427c73f2b7c8b3ae7a672ad208c89b2
! https://virustotal.com/gui/url/681dfdb12bcaa2facfb6eefe51d671387f111134f1661e336d63c5e6b207aa10
||bilalimtyaz.co^

! https://virustotal.com/gui/url/efdaf6927a66f267f8e834a1d685e76025f3c8ad29b8d950289ceb43c18a3477
||machinesalaver.net^
! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-938682090
||eliteexteriorsystems.com^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-940500664
! redirect chain
||captcha-smart.top^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-944642656
||allblock.net^

! https://hybrid-analysis.com/sample/691fb304c88929435950c157c1789bc7004e2163a3188cf2fff1124cfa5f00f8/60f6dbfae50e5603767b8f32
! https://virustotal.com/gui/url/b141c859a1246a250183b212cea2e6ed30d90477adc5ae8f3277516f68071396
! https://virustotal.com/gui/url/5b4dc980802a96c630e76148aab4f2cbe7a196d39ffce9a7e3c95bcdc082b64a
||micuenta01.github.io^

! https://virustotal.com/gui/url/64babbfb323b40df5b768265183886fbed60ea92234da1a2e4b85acfdceaf0aa
! https://virustotal.com/gui/url/4f827d8be6d25fa88c1ebe74800b6743d7e289b0f904b6f3445486b3ccac2797
||tristreamstv.com^

! https://blog.malwarebytes.com/threat-intelligence/2021/10/q-logger-skimmer-keeps-magecart-attacks-going/
||pinokio.online^
||sitetraffic.site^
||spacecom.site^

! https://github.com/uBlockOrigin/uAssets/issues/10181
||nbryb.com^
||onemacusa.com^
||realnetnews.com^
||rogueleader.org^
||suggestive.com^

! found when searching for "iam-py-test" on Google - starts at hxxpx[:]//google-yandex[.]info[/]iam-py-test
! https://github.com/iam-py-test/investigations/blob/main/2021/10/24/1.md
! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-950351144
||google-yandex.info^
||cloud-apps.store^

! https://virustotal.com/gui/url/2e874f308e1202ce4deb4068d029675c8487bed465f3bd34aeefb4a84c6b767f
! https://virustotal.com/gui/url/859be64d71834dba1693b079ec85f77edcd06124031c65178838555fea31efd7
||dliscord.com^

! https://github.com/blocklistproject/Lists/issues/537
! https://github.com/blocklistproject/Lists/issues/538
||gosuslugi.contact^
||gosulugl.ru^
||gosuslugee.ru^
||gosmslugi.ru^
||gosuslugji.ru^
||gosuslugi.agency^
||gosulgi.ru^
||gosoogi.com^
||gosulvgi.ru^
||gosusnugi.ru^
||gosuslugi-kultura.ru^
||ciel-goshugi.com^
||www-gos-uslugi.ru^
||gosusluslugi.ru^
||gosuslugi.xyz^
||gosushlugi.ru^
||vgosuslugi.ru^
||gos-uslug.ru^
||gosuslugigov.ru^
||gosuslugi.uk^

! https://threatpost.com/chrome-deliver-malware-as-legit-win-10-app/175884/
! https://www.rapid7.com/blog/post/2021/10/28/sneaking-through-windows-infostealer-malware-masquerades-as-windows-application/
||cleancrack.tech^
||s4.cleancrack.tech^
||clickmatters.biz^

! https://forums.malwarebytes.com/topic/280266-removal-instructions-for-search-streamly/
||search-streamly.com^
||feed.search-streamly.com^
||api.search-streamly.com^

! https://virustotal.com/gui/file/574a56656b6cf687d912baeedeeb176f0a7e58ad15ad4ab43c3cd630d9cceab2/relations
! https://virustotal.com/gui/url/8cb8c13da88b7b50a7cae47233a3c385a0208f0dccf119044f775e0a464de3a2
||telegraf.top^

! https://github.com/iam-py-test/investigations/blob/main/2021/11/3/1.md#domains
||youutube.com^
||youvetube.com^
||www.youvetube.com^
||mediadlvr.com^
||safejokesearch.com^
||www.safejokesearch.com^

! https://blog.malwarebytes.com/threat-intelligence/2021/11/credit-card-skimmer-evades-virtual-machines/
! https://virustotal.com/gui/url/229181849ae5d036ff997645e9cf708d4fe96337d6e68e780777aee382fdccf1
||webflows.net^
||web.webflows.net^
||librarysetr.com^
||js.rawgit.net^
||rawgit.net^
||iofrontcloud.com^
||alligaturetrack.com^
||getambassador.net^
||st.adsrvr.biz^

! https://virustotal.com/gui/file/f657dd8b99b9fa047c524f055984dfb1f9886cc97c788c8ebb9e63537f327c1a/community
! https://virustotal.com/gui/file/676de5f6ff737af6e73a00caf93767cc9af16e6e6bd50016b5bd03ffa097c373/community
||dl02.s3.amazonaws.com/installers/693123/oi_agree-free-dvd-ripper-platinum.exe
||dl02.s3.amazonaws.com/installers/852091/oi_swfdeczip.exe
||dl02.s3.amazonaws.com/installers/415643/m1btpwzw9bc.exe
||dl02.s3.amazonaws.com/installers/388327/ycf45qdlvsc.exe
||dl02.s3.amazonaws.com/installers/848253/InfraRecorder.exe
||dl02.s3.amazonaws.com/installers/630249/oi_calctime4f.exe
||dl02.s3.amazonaws.com/installers/790203/crazy-ball.exe
||dl02.s3.amazonaws.com/installers/760905/tmnttheme.exe
||dl02.s3.amazonaws.com/installers/

! https://virustotal.com/gui/ip-address/2.56.59.42/relations
||cha1se.my03.com^

! https://virustotal.com/gui/file/c465550320e3625e430f8745c8c8b8664a202e24dbe51ed4e5dcd0af25960420/community
||caenet.s3.amazonaws.com/apps/dexway/dexway.setup.msi^

! https://virustotal.com/gui/url/a2524bba49ae71297d2b408b30d058700d9c80b5b1154924cafe190ec3e605a6/detection
||newrrb.bid^

! https://virustotal.com/gui/file/6146dfe56dcb49e1b843624a44e204754e15625a4f94b230b59a5cafc924f618/community
||bursakulis.com^

! https://github.com/iam-py-test/investigations/blob/main/2021/11/24/1.md
||macsoftwarez.com^
||namilon.xyz^
! C2s
||toa.mygametoa.com^
||mygametoa.com^

! https://forums.malwarebytes.com/topic/281074-pup-mysearchengineco-firtefox/
! https://virustotal.com/gui/ip-address/172.67.222.254/relations
! https://virustotal.com/gui/url/781a2d763b034c9610ab9832bdc2692aced3d86c6b7296ea72579da7b68dc073
||631e69eb.ainans.com^

! https://scammer.info/t/quantum-ad-blocker-trojan/84204
||quantumadblocker.com^

! https://github.com/uBlockOrigin/uAssets/pull/10662
||api.crm.duominuo.com^
||static.duominuo.com^
||wnl.duominuo.com^
||duominuo.com^

! https://virustotal.com/gui/url/269d374b629d7896da1f9e7449bd5afecf6284a9a564244f96a71e5192363635
||lowseelan.com^

! https://virustotal.com/gui/file/50fd813cf8fe981e6aee179f8ba394e5527c5128b84c328f9f8347cd994bbc42/community
||dl02.s3.amazonaws.com/installers/747947/oi_picasa38-setupexe.exe^
! https://virustotal.com/gui/file/2ea599605c4d65902943f12e1114a71af7a40fa7dffbf018b0ee3e7a61aaeaa3/community
||dl02.s3.amazonaws.com/installers/424531/2gzbsoj4gxb.exe^

! https://forums.malwarebytes.com/topic/281264-malware-bytes-scam-number-1-315-996-0560/
||tradeford.com/us853558/malwarebytes-customer-service-1-315-996-o56o_p1049357.html^

! https://github.com/DandelionSprout/adfilt/pull/395
! https://www.huorong.cn/info/1531309921141.html
||kuaizip.com^
! https://www.huorong.cn/info/1618397948649.html
! ||zhuangjizhuli.com^$all
! ||zhuangjizhuli.net^$all
! https://github.com/uBlockOrigin/uAssets/pull/9656
||geekotg.com^
||qq789.com.cn^
! https://www.huorong.cn/info/1526627586130.html
||xiaobaixitong.com^
! https://www.huorong.cn/info/1577158839403.html
||daque.cn^
! https://www.huorong.cn/info/1598957552515.html
||dabaicai.com^
! https://www.huorong.cn/info/1617368984641.html
||qqfzn.com^
! https://github.com/uBlockOrigin/uAssets/pull/10017
||flash.cn^

! https://virustotal.com/gui/file/1d29ecde092f21ea0dd05b9f42531be1ed2207d6ebb9b463517f4c9508ff24a7/community
||fire.hypersys-server.com.ar^

! https://github.com/uBlockOrigin/uAssets/pull/10774
! https://bbs.kafan.cn/thread-2222478-1-1.html
! https://bbs.kafan.cn/thread-2221903-1-1.html
! https://bbs.kafan.cn/thread-2221781-1-1.html
! https://bbs.kafan.cn/thread-2220230-1-1.html
||ts-group.com^
! https://bbs.kafan.cn/thread-2221419-1-1.html
||2345.eyunsou.com^
! https://www.huorong.cn/info/1627034201698.html
! https://bbs.kafan.cn/thread-2217785-1-1.html
||win.zjwhr.top^

! https://twitter.com/Cryptolaemus1/status/1468266929014157316
||lartmana.com^

! https://github.com/blocklistproject/Lists/issues/588
||procrackerz.org^
||freeprosoftz.com^
||pccrackbox.com^
||365crack.com^
||cracklabel.com^
||keystool.com^
||pcwarezbox.com^
||installcracks.com^
||10crack.com^
||reallcrack.com^
||hit4crack.com^
||crackproductkey.com^
||profullversion.com^
||vcracks.com^
||crackswall.com^
||crackthere.com^
||crackpcsoft.net^
||crackserialkey.co^
||keygenfile.net^
||maliksofts.com^
||proappcrack.com^
||flstudiocrack.org^
||scracked.com^
||crackpropc.com^
||crackwinz.com^
||cyberspc.com^
||crackedpcs.com^
||ayeshapc.com^
||crackintopc.com^
||crackhomes.com^
||zslicensekey.com^
||cracksmad.com^
||iamactivator.com^
||crackproduct.com^
||excrack.com^
||mahcrack.com^
||get4pcs.com^
||genuineactivator.com^
||keygenwin.com^
||thiscrack.com^
||crackedroot.com^
||crackspro.co^
||topcracked.com^
||mycrackfree.com^
||crackfullpro.com^
||starcrack.net^
||procrackpc.com^
||crackknow.com^
||crackpro.org^
||4howcrack.com^
||crackshere.com^
||crackdj.com^
||cracksray.com^
||crackkits.com^
||trycracksoftware.com^
||fullcrackedpc.com^
||cracktopc.com^
||crackkey4u.com^
||rootcracks.org^
||idmfullcrack.info^
||fileserialkey.com^
||licensekeyup.com^
||thecrackbox.com^
||rootcracks.co^
||cracksway.com^
||clevercracks.com^
||shahzifpc.com^
||idmpatched.com^
||getprocrack.co^
||autocracking.com^
||productkeyfree.org^
||chcracked.com^
||cracksdat.com^
||patchcracks.com^
||activationkeys.co^
||serialsofts.com^
||piratpc.com^
||prosoftlink.com^
||cracksole.com^
||finalcracked.com^
||activatorpros.com^
||organiccrack.com^
||zscracked.com^
||abbaspc.org^
||allsoftwarekeys.com^
||genuineserials.com^
||pfcbwp.com^
||softwar2crack.com^
||xforce-cracks.com^
||procracks.net^
||productkeyforfree.com^
||crackgrid.com^
||licensekeysfree.com^
||goharpc.com^
||crackedmod.com^
||crackvip.com^
||crackedpc.org^
||activatorwin.com^
||whitecracked.com^
||softwarance.com^
||kalicrack.com^
||bypassapp.com^
||ziapc.org^
||zgamespc.com^
||cracksoon.com^
||boxcracked.com^
||procrackkey.co^
||activationkey.org^
||newproductkey.com^
||protoolscrack.net^
||download4mac.com^
||serialkeypatch.org^
||premiumsforum.com^
||profreefiles.com^
||filespremium.com^

! https://github.com/uBlockOrigin/uAssets/pull/10854
||37.1.209.213^

! https://forums.malwarebytes.com/topic/281936-malware-campaing-distribuition-malicious-link/
||10dimensions.com^

! malware - https://bazaar.abuse.ch/sample/a12d74b1756d49531e21f755fef2049ab6c83626f0834cb945c781c39d40a177/
||crackedable.com^

! hxxpx[:]//crackpropc[.]com/winrar-crack/ - https://bazaar.abuse.ch/sample/4f4376563cfc35d3fb0b4f857674729727b5f959235fe39daa928a1d4a28649a/
||wastyuioytryiuoytryiuopuytryuioewr5t678i.s3.amazonaws.com^

! https://github.com/uBlockOrigin/uAssets/pull/10997
||jinshanduba.org.cn^
||phpstat.cntcm.com.cn/phpstat/count/abceffgh/abceffgh.js^

! https://bazaar.abuse.ch/sample/357226dff2f3309f8271b5a7c2cc816aa8fb779275357dce9b98b30357951210/
||download-srvr.xyz^
||cybermicto768jubileejhsye6yt6543.s3.us-east-1.amazonaws.com^

! https://bazaar.abuse.ch/sample/932fcccda7c8e576eb914b446646883cfdb439fe4c7306905ea005555be5e2bb/
||hopelandishomeground1098alone43jk.s3.amazonaws.com^

! https://bazaar.abuse.ch/sample/9dfd1e4d88c586107f341620c9682710a414f34e2086aab363661f8eb8031202/
||gigapurbalingga.net^
||rigrosehostingz.xyz^

! https://forums.malwarebytes.com/topic/282207-how-to-remove-pupoptionalbrowserhijack-and-pupoptionallockhomepage/
! (20/12/2022) https://github.com/AdguardTeam/AdguardFilters/issues/137498
||find-it.pro^

! fake Flash Player
||new-meet-dating.life^
||wellhello.com^

! https://github.com/blocklistproject/Lists/issues/600
||avomas.me/rbBvg78^
||choicemonitor.top^
||italtrack.checkitemtt.top^
||checkitemtt.top^
||conv-alida-recapiro-com.preview-domain.com^

! https://forums.malwarebytes.com/topic/282353-peruvian-netflix-phishing/
||juandfar.github.io^

! https://bazaar.abuse.ch/sample/d696d27429f51199a8b88b7a332cfa2c05d6cf6a875a88046a8764a290bf588f/
||slidehostdowny.xyz^

! https://twitter.com/TheDFIRReport/status/1477687477821489157
||rest.healthy2fit.com^
||api.healthy2fit.com^
||rest.mcghealthcare.org^
||rest.neckbackpainrelief.org^

! https://github.com/uBlockOrigin/uAssets/issues/11157
||sideload.net^
||stcverify.com^
||verify.stc.tools^
||1980s.click^
||0x41414141.net^
||yatsura.0x41414141.net^
||chrome.google.com/webstore/detail/ultimate-ad-eraser/hkmfdialkjnljbcnincgpollobclebaf^
||ultimate-eraser.com^

! https://virustotal.com/gui/url/747b8465c517261eb6c5bc1a6c4fa281dc309caecf4a283f9bfb4fe2ba795bd0
||mailsecure-helpdesk.azurefd.net^

! https://scammer.info/t/discord-nitro-scam-23/87273
||discqrdapp.com^

! VirusTotal typosquatt
||virusttotal.com^

! https://blog.malwarebytes.com/threat-intelligence/2022/01/patchwork-apt-caught-in-its-own-web/
||bgre.kozow.com^

! https://blog.malwarebytes.com/web-threats/2022/01/card-skimmers-strike-sothebys-in-brightcove-supply-chain-attack/
||cdn-imgcloud.com^

! https://twitter.com/pr0xylife/status/1483380330652487680
||plus-x.xsrv.jp^
||senior.tims.se^
||mecaglobal.com^
||mymicrogreen.mightcode.com^
||ariesnetwork.co.uk^
||animalkingdompro.com^
||bitcoin-up.fomentomunivina.cl^
||cr.almalunatural.com^

! https://virustotal.com/gui/file/cfb15322084d6292f43038a69b0e017b809f178b7c85c310f8effdb37a3eb9a3/community
||florafawnamusic.com^

! https://virustotal.com/gui/file/63a46fa06e1bd31832daa958d3a706fd86fbe8f7a2897dc19e52516e4a2066d5/relations
||goyaluat.vmesh.in^

! https://virustotal.com/gui/file/3b0158eb80a4ce6aefbab643c3ca57253d265c8c82754c4a7e31dbd64b5aa48f/relations
||actividades.laforetlanguages.com^
||laforetlanguages.com^

! https://virustotal.com/gui/file/80b5c38471c54298259cec965619fccb435641a01ee4254a3d7c62ec47849108/relations
||111439d.com^
||intrasvp.com^
||paulbau.com^
||peninsularbottling.com^
||spoilnet.com^
||thebeardedbrocksblends.com^
||wokpy.com^
||www.111439d.com^
||www.intrasvp.com^
||www.paulbau.com^
||www.peninsularbottling.com^
||www.spoilnet.com^
||www.thebeardedbrocksblends.com^
||www.wokpy.com^

! https://www.bleepingcomputer.com/news/security/a-look-at-the-new-sugar-ransomware-demanding-low-ransoms/
||cdn2546713.cdnmegafiles.com/data23072021_1.dat^

! https://github.com/uBlockOrigin/uAssets/issues/11574
||rutracker-org.appspot.com^

! https://virustotal.com/gui/url/c25fe34c05cc8e9136027a67c277e175a5d6e35af921ee37bad98bdfeea6a2f9/community
||6201375e287cc50016414168.2go.me^
||splendid-fallacious-anaconda.glitch.me^

! https://virustotal.com/gui/file/568cfb6f770f6fbec1f18595bb78183e1fb5d2e7086f747230f2706ce29ed381/relations
||www.tzkaxh.com^

! https://github.com/uBlockOrigin/uAssets/pull/11744
||greencracks.com^
||procrackerz.com^
||crackfix.net^
||zcracked.com^
||cracksoftware.org^
||downloadpc.net^
||pcfullcrack.org^
||keygenpc.com^
||up4pc.com^
||hitproversion.com^
||cracktube.net^
||iplogger.org/2Acru6^
||yourpcnotification.com^

! https://virustotal.com/gui/url/bd46572625a7d66dac92a3674fb9b8d31ef855b3229ab8ac650e8d198981ed1e/community
||www.takiparkrb.site^

! https://github.com/uBlockOrigin/uAssets/issues/12194
||fulptube.org^

! https://bazaar.abuse.ch/sample/d7308dab0110ae3bc79fd15024f5ccfcbd6e676b7c42b27a0112506e8357a6dc/ --> https://app.any.run/tasks/bc53e7a9-5fd7-4682-894d-11e48e9ea89a#
||www.pccrackworld.com^
||pccrackworld.com^

! https://virustotal.com/gui/file/f158c883db7803a14c124e29a3adb1b72cca3168d904f7cee2a6ebbbdc535ca3/relations
||winfrey2024.com^
||www.winfrey2024.com^
||bisbenefits.solutions^

! https://virustotal.com/gui/url/a7c6db453eaaafa9450ff12b5e85d81c8fc096912f1d9c295a908bd5c02ef3bd/community
||okra-grouper-hny2.squarespace.com^

! https://virustotal.com/gui/url/34512642d5d361717a97c817fbf65c008d4cc903a2c7ae641820a9d1e0fca5e0 --> https://app.any.run/tasks/5fb54e2b-1857-45ea-9656-bb4e185d47ab
||pirate4.life^

! https://virustotal.com/gui/file/439db5f69b49091964c335c5977bc6dbf8aa41398d0240410dfeb898add7dace/relations
||891706.com^
||www.njgummys.com^

! https://virustotal.com/gui/url/48fca83cbb6dc2f75f0e8a1546d4f396a5914502ead0060a0eefb2ed580a8c09 (seems down but no reason not to block it)
||vww-robiox.com^

! https://virustotal.com/gui/url/169c42480ba36ed07c5895da489593248c6da52e54a7c382748258aa798d8ee1
||littleluxuriesshop.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/111970
||a23-trk.xyz^

! https://forums.malwarebytes.com/topic/285132-outgoing-trojan-2dodddnsnet/
||2dod.ddns.net^

! https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/
||clickstat360.com^
||statclick.net^
||staticvisit.net^
||webcachespace.net^
||syncadv.com^
||webcachestorage.com^
||parmsplace.com^
||xomosagency.com^
||lawrencetravelco.com^
||accountablitypartner.com^
||codingbit.co.in^
||fishslayerjigco.com^
||avanzatechnicalsolutions.com^
||integrativehealthpartners.com^
||wwpcrisis.com^
||markbrey.com^
||nuwealthmedia.com^
||pocketstay.com^
||fioressence.com^
||drpease.com^
||refinedwebs.com^
||spillpalletonline.com^
||altcoinfan.com^
||hill-family.us^

! https://bazaar.abuse.ch/sample/b959fb160dac2a15b8e65c15e2b1738d356c03e13623588bc70aab825c57660a/
! https://app.any.run/tasks/5fcd7eda-1f8b-4e99-80f9-5429d6044d16
||freeversioncrack.com^
||top3hostngc.xyz^

! another malware website
||gamesrar.co^

! https://virustotal.com/gui/url/e47d6ed8866072e58d28b93dd0c7b06d148e5139c1dbe219a16ba288ba14f93c/community
||nolhivaranfaruonline.com^

! https://virustotal.com/gui/url/d9a2be341e814e16c837b215cac13b30add4aba14eec06f4b6d400d0a0409ce3/community
||anthracnosis-jackscrew-rubine.s3.eu-central-003.backblazeb2.com^

! https://www.bleepingcomputer.com/news/security/unofficial-windows-11-upgrade-installs-info-stealing-malware/ (dead but may undie)
||windows11-upgrade11.com^

! https://virustotal.com/gui/url/b56536f2753c28e251a16e85e960e503e1a0fa7460225daba497734b091ef3d6/community --> https://app.any.run/tasks/0d8b025d-ba39-4f88-b83d-db3274b62f49
||codesbro.com^

! https://forums.malwarebytes.com/topic/286125-riskware-when-doing-a-google-search/
||flydogy.com^

! https://bazaar.abuse.ch/sample/a5c87433df7f9a01cd7140d0882e6f227c62076b14d92f6fd9ab3e0570b596ee/
||portabledownloads.com^
||jetiparfilezho.xyz^

! https://forums.malwarebytes.com/topic/286435-malwarebytes-reporting-riskware-through-powershell-every-minute/
||wmail-service.com^
! https://forums.malwarebytes.com/topic/292561-website-blocked-due-to-riskware/
||counter.wmail-service.com^

! https://app.any.run/tasks/f0cf926b-dd19-4209-9e0c-a1ae1855a77b/
||telegra.ph/Free-Repacks-04-30^
! https://app.any.run/tasks/4ff53b3b-551f-4a5f-a303-c5938d31c376
||telegra.ph/Injector-By-Vap-04-30^

! https://forums.malwarebytes.com/topic/286715-emailed-html-file-phish-appears-is-somehow-bypassing-browserguard/
||etools.page^

! https://bazaar.abuse.ch/sample/07a496254e53741aa86e2292f1fce40bf04690504d8cda443d000133099ca107/
||startcrack.co^
||slamicrep.cfd^
||lectedacivilia.cfd^

! https://virustotal.com/gui/url/6764a8e44b5fa318bbf85df6eb6d083a20fc7090b85b0d43068b8f934ad9b2c2 --> https://virustotal.com/gui/file/10dbb4692e34a6f3ca1cf82668a87b1204aa1548c139d88240680d3b82473510
||www.enjpc.com^
||enjpc.com^
||uploadev.org/hkoarfyqyne8^
||nholinolout.tk/0d94969df6099021ed5f897a4144a946wOXvweYgLQgLx-WSJE8uNrZlSB0R8yPrpXhu/-Download-E33Hwwp-QbvNGlXIoS^

! https://virustotal.com/gui/url/ea37961ff4ba03a3f50b537668b97e7e682a4d6c2a980504ed4be8d4f593fd96 --> https://bazaar.abuse.ch/sample/727a3154e9862b477a4d556940a8fb47fb7f8dd955102ef7738bc32b587076f5/
||latestsoftz.com^

! https://twitter.com/ankit_anubhav/status/1531258779899047938
||textbin.net/raw/2tgh7yhhzs^
||rick63.publicvm.com^

! https://twitter.com/Artilllerie/status/1534076124829036544
||bbleepingcomputer.com^
||bleepingc0mputer.com^
||bleepingccomputer.com^
||bleepingcimputer.com^
||bleepingcmoputer.com^
||bleepingcmputer.com^
||bleepingcommputer.com^
||bleepingcomouter.com^
||bleepingcompiter.com^
||bleepingcompouter.com^
||bleepingcompputer.com^
||bleepingcomptuer.com^
||bleepingcompurer.com^
||bleepingcomputee.com^
||bleepingcomputeer.com^
||bleepingcomputerr.com^
||bleepingcomputet.com^
||bleepingcomputor.com^
||bleepingcomputre.com^
||bleepingcomputrr.com^
||bleepingcomputter.com^
||bleepingcomputwr.com^
||bleepingcompuuter.com^
||bleepingcompuyer.com^
||bleepingcompyter.com^
||bleepingcomupter.com^
||bleepingconputer.com^
||bleepingcoomputer.com^
||bleepingcopmuter.com^
||bleepingcoputer.com^
||bleepingcpmputer.com^
||bleepingocmputer.com^
||bleepingvomputer.com^
||bleepingxomputer.com^

! https://blog.malwarebytes.com/threat-intelligence/2022/06/makemoney-malvertising-campaign-adds-fake-update-template/
||ankgomag.xyz^
||ankltrafficexit.xyz^
||clicksdeliveryserver.space^
||cryptosuite.pro^
||daiichisankyo-hc.live^
||gettime.xyz^
||hilllandings.xyz^
||jillstuart-floranotisjillstu.art^
||keitarotrafficdelivery.xyz^
||makemoneyeazzywith.me^
||makemoneywith.us^
||mizuno.casa^
||money365.xyz^
||nawa-store.com^
||nippon-mask.site^
||openphoto.xyz^
||selfadtracker1.online^
||traffic.selfadtracker1.online^
||zerocryptocard.shop^
||185.220.35.26^
||188.225.75.54^
||185.220.33.3^
||185.230.140.210^
||188.227.107.121^
||188.227.107.92^

! https://bazaar.abuse.ch/sample/7a1ac49143e4dc8d3e7f3d033b1b382b3120bfdebfbaf3a304ab2f086456a896/
||telegra.ph/Install-3-06-11^
||mediafire.com/file/eeqo14m9t7mqvdr/Install.rar/file^

! https://bazaar.abuse.ch/sample/fc03d6fa6787c0e6fee51af9c567bc1febf642bdfd6fd91ee99348b0a2cdf947/
||goo-gl.me/C_Cleaner^
! ads
||lulachu.com^
||zoomstreakstream.com^

! https://twitter.com/malwrhunterteam/status/1539964420607971328
||business-page-appeal-126-73125.web.app^

! https://scammer.info/t/phishing-my-account-will-be-blocked/100783
||bit.do/terewebmqil^

! https://scammer.info/t/fake-discord-nitro-generator/99942
! https://bazaar.abuse.ch/sample/afc4c49625b8c888e7e4958ec95cf0a79baf48736d71b0cac2bb2fc5f1c99279/
||importadoracandy.com^

! YouTube video on a probably hacked channel --> https://bazaar.abuse.ch/sample/786947bd41f7be120bc82fd563b5658ff319bcb45f8e3a35e9e4c62a03ef103e/
||telegra.ph/Sony-Vegas-Pro-19-Crack-06-28-3^
||mega.nz/file/nWhSiBRQ#DfJfKPJFf6EiWI3vrVp2IvbBgbsmAqIid9l0H_e3ngE^

! https://virustotal.com/gui/file/8014510ba4ca11285598396ec7f36058ce42b2fdd4fd80004c1f1c84933126f1/detection
||byltly.com/24hrsg^
||sbnue.com^

! https://forums.malwarebytes.com/topic/287876-im-posting-a-malware-to-ask-if-anyone-know-the-type-of-this-malware/
||cdn.adx1.com/df60634899739d9c8ce9ae33940358dd.jpeg^
||cdn.adx1.com/8b678aab9185cb333cc7c1bf3442adcb.jpeg^
! https://app.any.run/tasks/85cfa904-06c4-4603-82ec-7a3db8db8df9
||comfortykive.xyz^
||tjzaj.comfortykive.xyz^
||safefastfreesmart.rest^
||rewards-giant.uk^
||www.rewards-giant.uk^
! (14/11/2022) https://app.any.run/tasks/508eecd4-0573-433f-9888-ea4bfe10e5d5
||ewoverth.buzz^
||fbuww.ewoverth.buzz^
||cemgf.ewoverth.buzz^
||paylk.ewoverth.buzz^
||krtbw.ewoverth.buzz^
||lyirs.ewoverth.buzz^
||stijy.ewoverth.buzz^
||pwazc.ewoverth.buzz^
||uxdpj.ewoverth.buzz^
||jxaox.ewoverth.buzz^
||fqdbx.ewoverth.buzz^
||qakbs.ewoverth.buzz^
||wfarv.ewoverth.buzz^
||tepmv.ewoverth.buzz^
||ivuvh.ewoverth.buzz^
||rqsyl.ewoverth.buzz^
||hhqdq.ewoverth.buzz^
||eysei.ewoverth.buzz^
||jdmhf.ewoverth.buzz^
||xdgip.ewoverth.buzz^
||qdudm.ewoverth.buzz^
||xdnpv.ewoverth.buzz^
||ytsiw.ewoverth.buzz^
||aqxzv.ewoverth.buzz^
||akawl.ewoverth.buzz^
||pvrqg.ewoverth.buzz^
||oyffo.ewoverth.buzz^
||woorz.ewoverth.buzz^
||whqqm.ewoverth.buzz^
||apgib.ewoverth.buzz^
||bsrhu.ewoverth.buzz^
||lipwq.ewoverth.buzz^
||yzivj.ewoverth.buzz^
||cgwvb.ewoverth.buzz^
||zijim.ewoverth.buzz^
||fvpki.ewoverth.buzz^
||deqkr.ewoverth.buzz^
||qtngs.ewoverth.buzz^
||jgdvx.ewoverth.buzz^
||vovle.ewoverth.buzz^
||oqcqa.ewoverth.buzz^
||nruzo.ewoverth.buzz^
||cnwlv.ewoverth.buzz^
||waneo.ewoverth.buzz^
||fmrdm.ewoverth.buzz^
||pzktf.ewoverth.buzz^
||uivzc.ewoverth.buzz^
! look-alike domains on the same IP, some with AV detections
||sweredth.buzz^
||reamsan.buzz^
||ecityalittl.buzz^
||toftheussi.xyz^
||sfriend.buzz^
||ewallowi.buzz^
! trys to install extension
||antivirushub.co^

! https://virustotal.com/gui/url/081c3fe5d843567d0b5a1f7b2efd6592eded82d8a6b0a4283760c53b06b9d009/community
||coinbase-buysell-cryptocurrency.yolasite.com^

! https://virustotal.com/gui/file/b7a7b969380d611b8f21f457e3d56b472cd4634fc11b016c0f5e70a15ddd2363/community
||wearenotbbystealer.nl^

! https://virustotal.com/gui/url/88c6f47ec835274fa193c5540a570dc53421fcfdc5d0408f8a8215ff9ec561bf/community
||share.getcloudapp.com/nOuXRll9^
||nolajaymesrealtor.com^

! https://virustotal.com/gui/url/0f08c044228d8d5cf50356deeadea492d78fd691735df5438f118c52a622267b/community
||planebux.xyz^

! someone shared this SMS with me --> https://web.archive.org/web/20220707215749/https://twitter.com/iam_py_test/status/1545164642346930176
||amazon-security-info.lnk.to^

! https://bazaar.abuse.ch/sample/b41a79633a38811e378ce4e3e05cbaf086791272ae55c87eafa845eb655994a9/
||telegra.ph/Best-tutorial-04-30^
||gg.gg/11nfvn^
||mediafire.com/file/iqamfvx8teaq9y2/SoftwareInstaller.rar/file^
||77.91.102.23^

! https://bazaar.abuse.ch/sample/5c795e31f7130c2c15ed1fbcb300bea7266f64e10f68cfc9a2f139f2a25a9532/
||crackload.net^

! https://virustotal.com/gui/url/b57caaf8abc72075c0e194177af30ec2059f57ed944d23adc2e1f925bb9b4880/community
||pegaz-paragliding.com^

! https://virustotal.com/gui/url/a927a3bd0b3c6e016e29bf31d4d217977e2d41bb87fc555eb92f96ecab62e7f7/community
||jinjarsoft.com^

! https://forums.malwarebytes.com/topic/288670-im-getting-website-blocked-due-to-trojan/
||clayroot2016.linkpc.net^

! https://twitter.com/stephenlacy/status/1554697077430505473 shared by HoJeong Go
||ovz1.j19544519.pr46m.vps.myjino.ru^

! https://virustotal.com/gui/file/36d0988bbecc52a81edde05ecf40562ce878dcf4eb273691a134f825bbc16f34/detection
||telegra.ph/INSTALLER-07-22-2^
||bit.ly/3b39wkA^
||mediafire.com/file/b0shvy4kbs26yro/Installer.rar/file^

! https://virustotal.com/gui/file/bf7050e71da2ed976d1298a9732c78aeba04db079848da295b4ed0ec0cac4e35/community
||telegra.ph/autotune-pro-07-16^
||telegra.ph/file/b98cb101d9b7798329580.jpg^

! https://virustotal.com/gui/file/de78cb6a65184a6011d7dee1dc1e48a60d936208718448158f656919c29856e4
||bit.ly/3PzDpaL^
||mediafire.com/file/r4fodu1r8tk0f5s/spotify_premium.rar/file^

! https://virustotal.com/gui/file/f776b6341455d570e098f76b6ca38c4e6c47603070d367885d45619795f6fe17
||robloxscript.site^

! https://virustotal.com/gui/file/601e3b16384fcfc7fc27b76f9367316fa38681b402d62569b963490496f9f17f
||software-universe-pro.space^

! https://forums.malwarebytes.com/topic/289086-antivirus-keeps-telling-me-blocked-3523615979-and-cant-find-a-solution/
! https://forums.malwarebytes.com/topic/289935-hijackautoconfigurlprxysvrrst-backdoorfarfli-in-registre-key/
||35.236.159.79^

! https://bazaar.abuse.ch/sample/78bcb53e3e0bca3655038c80eb9339d94f4a52b614b2ae072c171925099bcca8/
! https://virustotal.com/gui/file/6679a9fafa55cd95f682e35649413de7d36e81d7eb77736f888d98e5ac4ccf91
||telegra.ph/Download-Page-07-30^
! same malware?
||greponozy.com/1Gcf^
||underthfeoveu.monster^
||ndandinter.hair^

! https://forums.malwarebytes.com/topic/289257-browser-randomly-tries-to-go-to-iluhruhruxyz/
||iluhruhru.xyz^

! https://virustotal.com/gui/url/277ab53e753d552ec350aa812bc94345c84346ce52ca03f89979bfbe9a1ae000/community
||rb.gy/itouxx^
||es-sign-caieyna-b65164.ingress-florina.ewp.live^

! https://forums.malwarebytes.com/topic/289254-reoccuring-website-blocked-due-to-malwaretrojan-message/
||104.155.207.188^

! https://forums.malwarebytes.com/topic/289555-malwarebytes-reporting-riskware-and-trojan-through-powershell-every-second/
||45.227.254.52^

! https://twitter.com/MBThreatIntel/status/1567604533458780160
||hgoawa.xyz^
||31.44.6.123^

! https://virustotal.com/gui/url/d40409e8995dd91b3ab6c154cfa84a94c3a11013262825a88861d1611d9212c8/community <-- Dead
! https://virustotal.com/gui/url/52b396fc9afd28864a7c7ac91faaef4be1f001b2aa45a33ad53e0f38172fa4e3/community
||tegraokulary.pl^

! https://forums.malwarebytes.com/topic/289986-what-is-plusclick/
||plusclick.biz^

! https://virustotal.com/gui/file/fe3f662947b072546eea1183ff626e851cb99a50a406dbe28a520078f38a84df
||telegra.ph/Download-09-07-6^

! https://virustotal.com/gui/file/31172f3d213210267adccd9e625a15f9713006812a3e20538425fba996e8889a
||mediafire.com/file/kvp9izio4r4hqly/Roblox+Hack.zip/file^

! https://bazaar.abuse.ch/sample/a674c8d984fe21bdbf03a9cafabe8963f0b471155655943299ef9695b836c307/
||telegra.ph/Clip-Studio-Crack-Latest-Version-08-15^

! https://virustotal.com/gui/url/94532535b8591efdebf95cf3c463f4b6116c76a354320676d38ab1384d40d26f/community
||sukudoanalytica.com^

! https://twitter.com/UK_Daniel_Card/status/1573038624853082128
! https://twitter.com/MBThreatIntel/status/1571949584943054848
||parrable.com^
||h.parrable.com^

! https://twitter.com/MBThreatIntel/status/1573059941619081221
||guyacave.fr/js/tiny_mce/themes/modern/validate.js^

! https://web.archive.org/web/20230604181959/https://twitter.com/iam_py_test/status/1573078196010078210
||telegra.ph/An-article-on-How-To-Download-Crack-and-Hack-For-Free-08-12^

! https://bazaar.abuse.ch/sample/7205488fe5a1d3d05f0734af8b156d5c1603e9334b407845eb5545950e7b9acc/ (credit to https://bazaar.abuse.ch/user/1169961/)
! https://app.any.run/tasks/ed58332c-913b-4a8e-8d17-e55c4fb40b76 (my analysis)
||85.31.46.80^

! https://virustotal.com/gui/url/dff608d10ce1c5d441e7d3d9e848d81302e26dcce121f984f2d1c2e341852a82/community
||medijaplus.com/wp-admin/network/ATOPSpA/^

! https://forums.malwarebytes.com/topic/290797-drive-by-typosquat/
||login.mimecast.cm^

! https://web.archive.org/web/20230604182346/https://twitter.com/iam_py_test/status/1578112473768644611
||pastebin.com/DyG0qkdA^
||bit.ly/3EhFS7k^
! new
||bit.ly/3W5iqkk^
||mediafire.com/file/48babb7qlspz6dd/Adobe+Photoshop.rar/file^

! https://twitter.com/GossiTheDog/status/1582690317886578688
||www.garmin-download.com^
||garmin-download.com^

! https://virustotal.com/gui/url/d56c2ac37804bb6016c6666697b34ed0e95ad1a36ca2bd8b9db78c1e13f8ae81/community
||objectstorage.us-sanjose-1.oraclecloud.com^

! https://virustotal.com/gui/url/cf647bc81b76bd4857b34fe9a6dbec1f695b3bb8910e8cd000fa16e48d8c0c4c/community
||cgi-wscalfahostingde.bondlayer.site^
||i4rry-tiaaa-aaaag-aaycq-cai.ic0.app^

! https://bazaar.abuse.ch/sample/9d5e04f46fc4e4340b2d4c5f2044584826e016347388ec35cc9805d36c7546f1/
||bitbucket.org/nobodoimportante/diniasndiasnid/raw/f9296891a4af851f86f26f100be89a44da6958f3/limm.exe^
||bitbucket.org/nobodoimportante/diniasndiasnid/raw/f9296891a4af851f86f26f100be89a44da6958f3/route.exe^
||95.214.53.31^

! https://tria.ge/221104-xnqwhsbhfp/behavioral1
||clipper.guru^

! https://forums.malwarebytes.com/topic/291771-facebook-hacked-and-suspicious-link-sent-out/
||monkey.redirectmaster.com^
||xe2w.com^

! https://virustotal.com/gui/url/dd3ef709e1415894e7b12f3245e91fb3993b197b34e854a2bf58d5e4ff1a8768/community
||flyrine.com^

! https://virustotal.com/gui/url/6a1435a75c9199af6c37df495fb6b05965e57ada5b617e0651efa13e51ae746b/community
! https://virustotal.com/gui/url/8425e5c13e3c0ee58fc0ed21cd3695ad4ef1962a32d90f2b3d34cc280e0c248b
||chungwoo.futuroinfo.co.kr^

! https://github.com/AdguardTeam/AdguardFilters/issues/134355
! https://github.com/DandelionSprout/adfilt/commit/32ea69e5a7c632bc2cd739fba4ee256e8a9e8abf (all credit to https://github.com/DandelionSprout)
||1000girl.com^
||1000islandsinfo.com^
||100blackmenkc.org^
||10co.biz^
||10woomul.com^
||141angel.com^
||168av.com^
||1800fdlowers.com^
||1800fl9owers.com^
||1800flowerx.com^
||1800tlowers.com^
||2d-plus.com^
||2m5f.com^
||30mercantil.com^
||3mvs.com^
||4hu59.com^
||99bricks.com^
||ab-automobile.de^
||abc13news.com^
||abcyamath.com^
||aboutarc.com^
||abuhamzahfx.com^
||abwkoeln.de^
||biosaude.co^
||accessdiscounts.com^
||accountingservice.com^
||accountionline.com^
||acethematch.com^
||additude.org^
||addyourlink.net^
||adminbookings.com^
||admindiploma.co.uk^
||admiralmarket.com^
||adriod.com^
||advancaauto.com^
||aegiscrew.com^
||aerepostal.com^
||aergerforum.de^
||aetnaretriedhealth.com^
||aetnastudentehalth.com^
||aetnasyudenthealth.com^
||afshagemstone.com^
||aging.realmadridlive.in^
||air-careductcleaning.com^
||aj3000.org^
||ajmsewing.co.uk^
||akintor.com^
||alabamamedicaid.org^
||alamoinsurancegroup.com^
||allsttae.com^
||alojamientogratuito.info^
||altesino.com^
||alumacarsuncity.com^
||alvincommunitycollege.com^
||amazonaus.com^
||amcestey.com^
||amecstry.com^
||americameagle.com^
||americanghostsandhauntings.com^
||americanlegion.net^
||americanwingsnorcross.com^
||amienmelody.com^
||ammica.com^
||anabolicalternative.com^
||anactor.net^
||anandasoftbd.com^
||anccestary.com^
||anchormotor.com^
||androiddp1.com^
||andyreinold.com^
||angrydl.com^
||anheiserbusch.com^
||animerunkkari.net^
||anningten.de^
||antennebayer.de^
||antiqueforhire.com^
||childrenwish.ca^
||anuex.com^
||anugrahjaya.com^
||aouttrader.com^
||appdeploy.de^
||appe.indainbank.in^
||applebees.cm^
||appleidpassword.com^
||appleisider.com^
||appolloprism.com^
||apppleseeds.com^
||appschoolgrid.co.uk^
||apqconstruction.com^
||apv-thermotech.de^
||arcanedevice.com^
||areopostel.com^
||ari-model.com^
||arielaudio.com^
||aristokraftcabinets.com^
||arizonadollandtoymuseum.com^
||arnoldmartinezgallery.com^
||artdesignweb.com^
||artediez.com^
||artofconway.com^
||asicsrunningshoe.com^
||askalligence.com^
||asperdental.com^
||aspspider.info^
||atlassion.net^
||aturealbum.com^
||audble.co.uk^
||audiopoisk.com^
||audioquartet.com^
||auitotrader.com^
||australien-embassy.de^
||autobk.com^
||babajfinserv.in^
||autopartsguru.com^
||autoscvout24.de^
||avanteboatsales.co.uk^
||avg.cm^
||avipreview.com^
||awardsdecals.com^
||awardswlwct.com^
||b5o.com^
||ba.upyim.co^
||baadhuset.com^
||babybud.de^
||bagandbow.com^
||baileycar.com^
||bananajacks.com^
||banankofamerica.com^
||bankencryption.com^
||barrellab.com^
||barrettsoutdoor.co.uk^
||basicware.com^
||bathandbodywash.com^
||bbletche.com^
||bcbsillinois.com^
||bccstx.com^
||bcins.com^
||beachsideboatrentals.com^
||beardmiller.com^
||beatthestreak.com^
||bedbedandbeyond.com^
||befancyhair.com^
||beilgries.de^
||bejaminbluemchen.de^
||benifits.org^
||bernslaihomes.co.uk^
||berwww.com^
||bestamericanstocks.com^
||bestcanadian.com^
||besthesda.net^
||bestwestner.com^
||bext.co.uk^
||bherb.com^
||bhojpurimovie.com^
||biblioteka-bg.com^
||bilabong.de^
||biosmoothpro.com^
||biovidasaude.com^
||birdscapes.com^
||bitsize.com^
||bittrex.cm^
||blackedram.com^
||blackmendigital.com^
||blauer-engel-koeln.de^
||blissmassagetherapy.com^
||blogesupri.patons.ca^
||blogs-pot.com^
||blurau.com^
||bmwsarasota.com^
||bnbcnews.com^
||boating-ed.com^
||bobberslive.com^
||bobybuilder.com^
||bokkinmg.com^
||bolivianland.net^
||boobking.cm^
||boohoi.com^
||bookfromnet.com^
||booking.pixelextended.me^
||booksandmarks.com^
||boostbobile.com^
||bootrep.com^
||boottownusa.com^
||bootyplanet.com^
||bossmovies.com^
||bostonterrierden.com^
||bothers.com^
||bottlecapgames.com^
||boxmoviez.com^
||boy-drive.net^
||bppkoing.com^
||braillealphabet.org^
||brainlly.com^
||brigdebase.com^
||briteledtech.com^
||brosdway.com^
||brotherprinter.com^
||bsswift.com^
||bt666.com^
||burnsidedigital.com^
||bwmbank.de^
||bzp.net^
||cabesp.com^
||calebpressley.com^
||calvertschool.com^
||cambridgeebook.com^
||cannel24.de^
||cantireu.ca^
||captialonedirect.com^
||carapowersports.com^
||carecredet.com^
||carnart.com^
||carolinatrustfederalcreditunion.com^
||carthorsemachinery.com^
||cartridgesshop.co.uk^
||casinovale77.com^
||casualxl.com^
||catharijnebioscoop.nl^
||cbej.com^
||cdlebjihad.com^
||cellutissue.com^
||centerblog.com^
||centerhillhouseboatrentalandcharter.com^
||cercoamicivip.com^
||charlestywritt.com^
||chartoulette.com^
||chasefreedomvisa.com^
||chasschwab.com^
||chathopper.com^
||chaumiereonline.com^
||cheapnikeshoes.com^
||chefsouls.com^
||chengsgardenct.com^
||childrencare.com^
||chinaautoparts.com^
||chlipfih.de^
||choctawwildlife.com^
||choicepriveleges.ca^
||choigame24h.net^
||christianbooksummaries.com^
||christiansocialnetwork.net^
||chuckychesse.com^
||cicda.com^
||cinemavf.org^
||citimortgage.cm^
||clarin.cm^
||clarires.com^
||claritta.net^
||clashofclanhacks.com^
||classmatess.com^
||clerverbot.com^
||clikurl.com^
||cloudbar.org^
||cloudmail.ontatio.ca^
||clubemusicas.com^
||clubterracan.net^
||cogeca.ca^
||collectioncentre.com^
||collegeoftheozarks.com^
||colonnialpenn.com^
||colordrives.com^
||columbusstoreeq.com^
||comcmast.net^
||comicstee.com^
||comkp.org^
||commomlit.com^
||comstaples.com^
||confusion.co.uk^
||consunercellular.com^
||continentalcredito.com^
||convertapdftoword.com^
||cookiecliker.com^
||coolgearing.com^
||correo.foot-news.co^
||costcobusinessphone.com^
||cottagechicbymargie.com^
||cottonflower.com^
||countrybros.com^
||countrylifegifts.com^
||courtreporting.com^
||covermania.com^
||covid-10.onario.ca^
||cps-pc.de^
||crackact.org^
||craigsdlist.com^
||crazynudistbeach.com^
||creativemindsacademyfl.com^
||credditonebank.com^
||cricket.info^
||crowddream.com^
||cruiseadventures.com^
||crystaldiskinfo.com^
||crystallinks.com^
||cstress.net^
||cumonlucy.co.uk^
||cumsex.com^
||cumsnap.com^
||cursodeunhasdecoradas.com^
||cvs.cm^
||cvshealthsurcey.com^
||cyberhostvpn.com^
||d25.net^
||dafearsoft.org^
||daftzex.com^
||dailynation.co.uk^
||dakofurniture.co.uk^
||damagedpictures.com^
||datingwall.com^
||davesandbusters.com^
||davidaustinroses.de^
||davidsonfirealarms.com^
||davinailsandspa.com^
||dealaday.com^
||debain.org^
||debide.com^
||defloreation.com^
||degowo.de^
||dekstophut.com^
||demo.europadonna.de^
||demo.halimcan.de^
||dentistfinder.com^
||desicorner.net^
||destokage.com^
||detailreviews.com^
||detroitk12.com^
||detroitlion.com^
||deutschewell.de^
||europadonna.de^
||gesundheitkatalog.de^
||hanseatischesweinkontor.de^
||hbo.cm^
||hypoverensbank.de^
||academicassociation.in^
||deviantaet.com^
||dgumarket.com^
||dhifaaf.com^
||dibujosdelos80.com^
||dicoverycove.com^
||dictionarg.com^
||dieaertze.de^
||diebahnd.de^
||diesimsens.de^
||digitaldigsads.com^
||dippegucker.de^
||directnergy.com^
||disany.com^
||discdb.com^
||disconcerting.com^
||discountrires.com^
||discunttire.com^
||disnneychannel.com^
||distorwatch.com^
||dixks.com^
||diycondensermics.com^
||djwacho.de^
||dkroger.com^
||dlv4.com^
||com-download-stat.us^
||docteach.org^
||documany.com^
||documentodoestudante.com^
||dofant.com^
||dolcegabanna.com^
||dollarentacar.com^
||dollygals.com^
||domionspizza.com^
||donaldrussel.com^
||donvenmuehle.com^
||dotcomdirectory.com^
||doversaddley.com^
||drbbble.com^
||drivenmotorsportsales.com^
||drocherway.com^
||droplox.com^
||droptv.com^
||drssbarn.com^
||ds4you.de^
||dsca85.com^
||dsneyland.com^
||ducusign.com^
||durgapurgovtcollege.org^
||dutchbilbs.com^
||dvrv.com^
||dyptiqueparis.com^
||dysma.de^
||dzlibrary.com^
||easternbikes.de^
||ebieomachines.com^
||ebookbinary.com^
||ecentennialcollege.ca^
||ecoediciones.com^
||ecoinspeed.com^
||ecread.com^
||edge.metropcs.co^
||educacionbc.com^
||eduparkpublishinghouse.com^
||eevb.com^
||efsll.com^
||einv.com^
||eknigu.org^
||elcactus.com^
||eletterhead.com^
||elevationsj.com^
||ellasontreeservice.com^
||ellisiland.org^
||elreydelfalafel.com^
||elwinpure.com^
||empak.de^
||emperorinfo.com^
||emulespana.net^
||enbto.com^
||energybrokerconsultants.com^
||enfmail.com^
||engineerbob.com^
||enigaluce.com^
||enyergy.com^
||eoonext.com^
||epicgamis.com^
||epph.com^
||eppicard.cm^
||erotic-flowers.com^
||erotic99.com^
||es-toyaqui.com^
||esmallbusinessgrants.net^
||esperiqn.com^
||esty.com^
||esuracnce.com^
||eternityflowercreations.com^
||ethioporn.com^
||ethtrada.com^
||etimology.com^
||euronets.com^
||events.compres.us^
||everdaycarry.com^
||evil-unveiled.com^
||evtools.info^
||exberian.com^
||excelmission.com^
||3daxis.co^
||exiperan.com^
||experianokta.com^
||expertworx.com^
||expieeian.com^
||explorors.com^
||expreien.com^
||exragazze.com^
||exrpessscripts.com^
||eyebuidirect.com^
||ezbiodiesel.com^
||ezgreatoffers.com^
||ezprogram.com^
||eztvseries.com^
||ezzpassmd.com^
||fabswiingers.com^
||faceb00k.com^
||facialsgalleries.com^
||facilisoft.com^
||faircompaines.com^
||fairplayhorse.com^
||fakehab.com^
||faketaxi.org^
||fashionchurchsuits.com^
||fashiondressstore.com^
||fashionsnetwork.com^
||fasilhd.com^
||fastcash500.com^
||fastlaneltd.com^
||fatbike-motor.com^
||fatwa1.com^
||faxsports.com^
||fcbs-inc.com^
||fedbizopps.org^
||fellfootfarm.co.uk^
||ferel.com^
||fertagus.com^
||ffrontgate.com^
||fiars.com^
||fightmove.co.uk^
||filecloud.monster^
||filezila.com^
||filmfreestream.net^
||filmox.org^
||findmymobike.com^
||findrc.com^
||finleyfurst.com^
||fionagary.com^
||fireking.us^
||firhouse.com^
||firstnationalc.com^
||firstthirdbank.com^
||fivestarautomotiverepair.com^
||fivethirteight.com^
||flagstarwholesale.com^
||flightconsolidator.com^
||flightlcub.com^
||flipkartjob.com^
||flipnormals.com^
||flixbruns.de^
||floormakers.com^
||florida-fishingcharters.com^
||flowermodels.com^
||flugzeugsupermarkt.de^
||fluxrp.com^
||flygpoolen.com^
||fmhogar.com^
||fmword.net^
||fnsbsd.com^
||focusbangla.com^
||fodocuments.info^
||followx.com^
||food-stamps-apply.com^
||foosewheels.com^
||footballflags.com^
||forceporn.com^
||foreverybella.com^
||forexclient.com^
||forexengines.com^
||formacioncorreos.com^
||formaua.com^
||forslaebyowner.com^
||forstinger.de^
||fotobugil.com^
||fotoescalera.com^
||fotoporst.de^
||foyerjeansturm.com^
||fraigslist.com^
||franciscajoias.com^
||franklhammondiii.com^
||frebmd.org.uk^
||freddiesfinespirits.com^
||free-iphone6s.com^
||freeconferenceline.com^
||freedomkia.com^
||freefre.com^
||freelanceeditors.com^
||freemovie.com^
||freemovies.net^
||freemoviesonline.com^
||freenortonsecurity.com^
||freeplaysex.com^
||freeprogz.com^
||freeshoutbox.com^
||friedmanshoes.com^
||friendsinfo.net^
||fronteerair.com^
||frontgatd.com^
||fsuwebmail.com^
||ftrontgate.com^
||fuckhoes.com^
||fudelidade.com^
||fullyloadednews.com^
||fumformobile.com^
||funkysexycool.com^
||furnitureking.com^
||furukawa-cooking.com^
||futaplay.com^
||gadisbandung.com^
||galerievitesse.com^
||gallagherstudents.com^
||gallerialighting.com^
||gameartisan.com^
||gamesloft.com^
||garden-flags.com^
||garndinroad.com^
||gastrodocs.info^
||gautengonline.com^
||gaylar.com^
||gbbox.com^
||geacorn.com^
||geamail.com^
||geapplaince.com^
||gedichtsbilder.de^
||gemini-usa.com^
||gemvera.com^
||generadordememes.com^
||genwigs.com^
||geogiaboot.com^
||geometro.com^
||geoxkorea.com^
||gerardfashion.com^
||getchaselnk.com^
||getjeeping.com^
||getmsguide.com^
||getmypopcornnow.com^
||getmytranscrpit.com^
||gettereward.com^
||ggodyear.com^
||ghostsearch.com^
||gibsonrv.net^
||gidonline.net^
||giftsforunow.com^
||giganits.com^
||giphy.cm^
||girls-party.com^
||glamrockbeauty.com^
||glassdoir.com^
||glasssoor.com^
||glendeedogrescue.co.uk^
||globalifeinc.com^
||glomp.com^
||gmauo.com^
||gmboree.com^
||gmglobalconnec.com^
||gmsexp.com^
||gnctraining.com^
||gnet7.com^
||gnpschandigarh.com^
||go-guy.com^
||gobdeals.com^
||goldclubslot.com^
||gomiyashiki-osouji.com^
||goodcheat.com^
||googglemail.com^
||google.ssvt.se^
||googlecal.com^
||googlefish.com^
||googleidle.de^
||goole.com.vn^
||goopgle.com^
||goracertech.com^
||goralpolishdeli.com^
||gordanfoodservice.com^
||got-corgis.com^
||gottorent.ca^
||graberbkinds.com^
||grabetblinds.com^
||gracehillision.com^
||granddentalpc.com^
||grassrootsmeasures.com^
||greandhra.com^
||greatbulletin.com^
||greatlesson.com^
||greatrating.com^
||greenvaporco.com^
||greyhoundbuslines.com^
||grillsandgreens.com^
||grinandbakeit.com^
||grupograncolombia.com^
||grupomnemon.com^
||gsmatena.com^
||gtuts.com^
||guicc.com^
||gulfmonster.com^
||hack-game.net^
||halilou.com^
||hallsdawghouse.com^
||halys.com^
||hamburgschool.org^
||handrbloock.com^
||hangkhung.com^
||hao1131.com^
||harfordlife.com^
||harpers-property.co.uk^
||hatventures.net^
||haveringfireplaces.co.uk^
||hawaiianaor.com^
||hboow.com^
||hcomicbooks.com^
||hd-sex-videos.com^
||hdmedicalexams.com^
||hdmovi3s.com^
||hdsupplsolutions.com^
||hdwallpaperslist.com^
||hdww.com^
||healthtechni.com^
||healthypetstore.net^
||heaphotels.com^
||heathyliving.com^
||helixcharter.com^
||hellsangelsusa.com^
||hensly.com^
||hermesairport.com^
||hewittresorce.com^
||highcash.org^
||hillcountrysanmarcos.com^
||hiwaytractor.com^
||hobbylobby.cm^
||hobyto.com^
||holidayproperty.com^
||holidycheck.at^
||hollywoodmoviez.net^
||homescapeonline.com^
||hongkongsthelens.co.uk^
||hoopsuite.com^
||hosfordbrothersconcrete.com^
||hot-deal.co.uk^
||hotelcentr.com^
||hotelesdoux.com^
||hotelsit.com^
||hotnewhiphoo.com^
||hotnsil.com^
||hottwitterwives.com^
||houseofnightseries.co.uk^
||howisavedthousands.com^
||hpinstankink.co.uk^
||hpsupportphonenumber.com^
||hqjt.com^
||htmail.co.uk^
||httpexample.com^
||hu0.com^
||humaneassocofclarkcounty.com^
||humouron.com^
||hvanah.com^
||hxymall.com^
||i80auto.com^
||ibuycard.com^
||iclovd.com^
||ideed.ca^
||identtyguard.com^
||idlebrsin.com^
||idoline.org^
||ifetel.com^
||igansupport.org^
||iheartmandalas.com^
||iidcgwalior.com^
||imageshake.de^
||importadoravehicular.com^
||inchirieriregimhotelier.net^
||indonesiaigo.com^
||infonavid.com^
||infoum.com^
||innotech-maschinenbau.de^
||inrussia.org^
||insectflix.com^
||insidewireman.com^
||insovenz.de^
||inssigniaproducts.com^
||instantsteetview.com^
||investopidia.com^
||inwexcel.com^
||iphonedevtools.com^
||iraresource.com^
||irlanguge.com^
||ishifusion.com^
||islandbluecoffee.net^
||islandsresturants.com^
||isseg.com^
||issstenet.com^
||itcompraenusa.com^
||iteachkinder.com^
||itunse.com^
||izak.com^
||jackwolfkins.de^
||jacobsfuneralhome.com^
||jailbait-gallery.net^
||janethepsychic.co.uk^
||jaspe.com^
||jcpenmey.com^
||jcpenneybenefits.com^
||jcpenneyey.com^
||jd.cm^
||jehblue.com^
||jeporady.com^
||jerrysappliancecenter.com^
||jewelpak.com^
||jimmygaorestaurant.com^
||jimmysfarmtoys.com^
||jira.hannoverscheallgemeinezeitung.de^
||jkhols.com^
||jlibrary.org^
||jmxded100.net^
||joannamartinewoolfolk.com^
||joaobidu.com^
||joblana.com^
||joovideo.us^
||journeykids.com^
||jquerylenslider.com^
||jspecialjapan.com^
||juanselaverde.com^
||jumpstar.com^
||juzzbunker.com^
||kascarpet.net^
||kayoutlets.com^
||kbshengyi.com^
||kelleyservices.com^
||keyrug.com^
||keysschools.net^
||keystonehoops.com^
||keywebtracker.com^
||keywordadvisetoolplus.com^
||kholsrebates.com^
||kickoff.cm^
||kindfirls.com^
||kit-co2.com^
||kitchenmusings.com^
||kiwihelme.de^
||klana.co.uk^
||klaser.com^
||kobemo.com^
||kodiakproduce.com^
||koklsfeedback.com^
||komunitaspeduliumatdalung.com^
||koon.net^
||kootra.com^
||kpry.com^
||krca.net^
||kusakabehifuka.com^
||kyxc.com^
||kzdress.com^
||laarsens-basingstoke.co.uk^
||laguiadelocio.com^
||lakecumberlandfishingguide.com^
||lakeserenespa.com^
||landgirlscookeryschool.co.uk^
||landhausmitpfiff.de^
||lankantunes.com^
||lapels.org^
||larka.de^
||lasierratiresutah.com^
||latexanzug.com^
||laubergeduvieuxcrozet.com^
||lawh.com^
||leakz.net^
||leapinginto5thgrade.com^
||learn.movibaz.us^
||learnpack.co.uk^
||legavy.com^
||legumeloyalist.com^
||leipomokauppa.com^
||lepac.com^
||lesbiot.com^
||lezgame.com^
||lianasims2.de^
||lifellinescreening.com^
||lightyearapp.live^
||likoer43.de^
||linkbaru.com^
||linkdin.ca^
||linuxdeal.com^
||liqudition.com^
||liscensecoach.com^
||livescom.com^
||livetvonlinefree.com^
||livingcomforts.com^
||llivet.com^
||loandaministration.com^
||login.reserveamerica.co^
||loitech.de^
||lojabau2mao.com^
||lojaodoreal.com^
||lorenagostosa.com^
||losingface.com^
||louisvuitten.com^
||louisvuittin.com^
||loveherbal.com^
||loverscaughtontape.com^
||lowcostparceldelivery.com^
||lowe4s.com^
||lpaodata.net^
||lunettesde.com^
||lutherancommunitygrace.net^
||luxerycard.com^
||lyncdiscoverinternal.ualbera.ca^
||lynes-shoes.com^
||lyodsbank.com^
||m2e6.com^
||mabcalculo.com^
||maderaplasticamx.com^
||madereriasaltillo.com^
||maestriasinternacionales.org^
||magento.expedia.cm^
||magento.fanmail2u.de^
||magento.gibco.de^
||magento.trannydating.nl^
||magoosfurniture.com^
||mahabaliexpress.com^
||makingfreinds.com^
||makisushi.net^
||malrboro.com^
||maluch.com^
||mamapho1.com^
||manage.polka-dot.co^
||mandourpharmacy.com^
||maneige.ca^
||manheimauto.com^
||manitobaparks.ca^
||mannakbbq.com^
||manoffashion.com^
||mantrafilms.com^
||manytears.com^
||manyvidd.com^
||marisaodonto.com^
||maritimeway.com^
||marketpalce.com^
||marketplace.biosaude.co^
||marrottvacationclub.com^
||maruces.com^
||mascy.com^
||mathrubhmi.com^
||matomefun.net^
||mauriciodenassau.com^
||maximcolombia.co^
||mbenzusa.com^
||mbwjk.de^
||mcatbui.net^
||mceyecenter.com^
||mcgraww-hill.com^
||mcjrotc.com^
||mckinleyspubri.com^
||mdtp.us^
||meaganslaw.com^
||medherb.de^
||medialine.org^
||mediasenso.com^
||mediationcenter.com^
||medicinelodgepom.com^
||medigov.com^
||medschoolhell.com^
||meficare.com^
||mega-hookup.com^
||megacinemaflix.com^
||melbourneactingstudio.com^
||mellatmobile.com^
||meloxicamsideeffects.org^
||metalartsinc.com^
||meubelmarkt.com^
||meuconsorciobb.com^
||mic-river.com^
||midasbuy.co^
||midiuser.net^
||mightylayoutboys.com^
||migranteducation.com^
||mijaliscomexrestaurant.com^
||mijntoeslagen.com^
||mili010.com^
||minecraft2.com^
||minicottage.com^
||minnesotagoldendoodles.com^
||missgided.com^
||mitkindernwachsen.de^
||mixreqq.com^
||mlgn3usa.com^
||mmrafricanfashions.com^
||mnspeoplesystem.co.uk^
||mobileblitz.com^
||mobilehacktool.com^
||mobilehomepartstore.com^
||mobilr.com^
||modestogold.com^
||modsey.com^
||moenygram.com^
||mojsng.com^
||mollinsburncarsales.co.uk^
||momentsoflife.com^
||momsrings.com^
||monasteriodepoio.com^
||monesupermarket.com^
||monyorder.com^
||mortgae.com^
||motogris.com^
||motorjacket.com^
||motorradcenter.de^
||motorradpartner.com^
||motosu.de^
||mountaincrestapartments.com^
||mountviewchandigarh.com^
||moviestube10.com^
||mp3juicess.biz^
||mpcclubcard.com^
||mrtravelers.com^
||msephora.com^
||muisjes.com^
||mujerlunabella.net^
||muktimap.co.uk^
||multipicatoin.com^
||multiquality.tech^
||multuimap.co.uk^
||mundoftp.com^
||musicans-place.de^
||musleblaze.com^
||mutedvods.com^
||blackberry.cm^
||carfax.cm^
||myaarpmwdocare.com^
||myancesty.com^
||myanthropologie.com^
||myapclassroom.com^
||mybkexpiernce.com^
||mybodysoul.com^
||mybooing.com^
||mycarrer.com^
||mycips.com^
||mycreditonecard.com^
||mydicksportinggoods.com^
||myebookmaster.com^
||myeverydayrewards.com^
||myfappening.org^
||myfinco.com^
||myfirstdegree.com^
||myftdi.com^
||myhbc.com^
||myherbelife.com^
||myjobsscotland.co.uk^
||mykohs.com^
||mylacountybenefit.com^
||myliferouch.com^
||mynait.ca^
||myoceanictwc.com^
||mypaneras.com^
||mypayback.de^
||myqnascloud.com^
||myscence.com^
||mysunywcc.com^
||mythaistlouis.com^
||mytruidenity.com^
||myvglicredential.com^
||myvirtualterminal.com^
||myvweizon.com^
||myxrt.com^
||nactar.com^
||nados.co.uk^
||nahro.com^
||nalcbp.com^
||nanacalistar.com^
||nanitv.com^
||nanoxnutriceuticals.com^
||naoffroad.com^
||napkimcuong.com^
||nartube.com^
||nationpage.com^
||naturebois.com^
||navyfereral.org^
||nbkonline.com^
||ncscu.com^
||neckheavy.com^
||nedspipeandsteel.com^
||nehalembay.com^
||nehra.org^
||neipets.com^
||neopoets.com^
||nesecitountrabajo.com^
||nesteggtrailers.com^
||netflflix.com^
||netflifx.com^
||networkredundancy.com^
||neuropsicologiacordoba.com^
||nevadaspca.com^
||newkindofmotherhood.com^
||nextflex.com^
||nflflagfootball.com^
||niagaragazette.com^
||nichewines.com^
||nigerialatestnews.com^
||nikene.com^
||nissenusa.com^
||niuqiu.com^
||njtutoriales.net^
||noborobo.com^
||nodesjs.org^
||nomorerobocalls.com^
||nooder.com^
||northpoleicecreamshop.com^
||norto.com^
||nortofn.com^
||norwoodcadillac.com^
||novadevelooment.com^
||novorojencek.com^
||carmax.cm^
||skyteam.cm^
||pcmag.cm^
||nexxt.cm^
||tillys.cm^
||nuken.com^
||nursingsa.com^
||nutricroq.com^
||nutriksystem.com^
||nylottery.com^
||nyulangoners.com^
||o-shohousen.com^
||o2tvseriea.com^
||obesityonline.org^
||obobettermann.de^
||oceach.org^
||octupus-versand.de^
||odincoin-ag.com^
||odrivers.com^

! https://virustotal.com/gui/url/ca6883e44a103ed205b6225d866719bc51a9301aca937d336dc38610e46c7ea2/community
||58.252.203.71^

! a "Yahoo" email claiming I will be locked out if I don't "correct my email"
||yahooo-mail-service.webflow.io^

! https://app.any.run/tasks/1dafbc8d-84d8-4e42-a96a-fffdc9d644e7/
||kmspico-official.xyz^

! https://forums.malwarebytes.com/topic/292016-keep-getting-outbound-website-blocked-due-to-trojan-cant-find-threats/
||humman.art^

! https://www.fortinet.com/blog/threat-research/new-rapperbot-campaign-ddos-attacks
||185.216.71.149^

! I misspelled virtualbox's website, landed here
||virutalbox.org^
||get.safety-search.com^
||safety-search.com^

! https://app.any.run/tasks/2de64615-6df3-457f-bfb8-3e207b44667c
||mega.nz/file/2kIAhSSS#RfpDvKxaabLwA-3WA9Qm7HOsYHQg1_g3oMEykkNrZMY^
||mega.nz/file/2kIAhSSS^
||116.202.5.101^

! https://forums.malwarebytes.com/topic/292218-malwarebytes-says-that-vbcexe-is-a-virus-please-help/
! https://threatfox.abuse.ch/ioc/840342/
||193.106.191.160^

! https://github.com/AdguardTeam/AdguardFilters/issues/134903
||znakomy.club^
||smartlink.name^

! https://app.any.run/tasks/2309c8ba-3e9f-41f2-8a5c-f15f7411ac58#
||www.sadeempc.com^
||sadeempc.com^
||iplogger.org/2AnXe7^
||bit.ly/Password-1234-FullSetups^
||iplogger.com/Sadeempcfullversins^

! https://www.youtube.com/watch?v=xwJJkvIsEJQ
||torrent-protection.com^
||downloadfilearea.com^

! https://app.any.run/tasks/e5ba6bf3-98ee-46bf-b9ee-406b1bbebe1f
||u8gr576y.cfd^
||rotf.lol/BDFG-KZTP-QAYW^
||88.198.106.9^
! https://app.any.run/tasks/89b3e663-ea70-43fe-89f0-af05c1c9af2e
||95.217.31.208^

! https://forums.malwarebytes.com/topic/292452-strange-malwareconnections/
||ns1usaupload.myphotos.cc^

! https://github.com/AdguardTeam/AdguardFilters/issues/135924
! https://github.com/DandelionSprout/adfilt/commit/31a32bcef8cfef97a6403f308d64c1991c6b4e8b
! credit to https://github.com/DandelionSprout
||abazelfan.com^
||abburmyer.com^
||abyamaskor.com^
||acelacien.com^
||adsvids.com^
||agaenteitor.com^
||ajestigie.com^
||almareepom.com^
||alspearowa.com^
||amexcadrillon.com^
||amgardevoirtor.com^
||amoddishor.com^
||ardsdusknoiron.com^
||arrlnk.com^
||arswabluchan.com^
||arwartortleer.com^
||arwhismura.com^
||aslaironer.com^
||aslaprason.com^
||asnoibator.com^
||astkyureman.com^
||astoecia.com^
||atgallader.com^
||attrapincha.com^
||audmrk.com^
||augnolru.com^
||ausoafab.net^
||bechatotan.com^
||belickitungchan.com^
||benumelan.com^
||beskittyan.com^
||betalonflamechan.com^
||betimbur.com^
||betjoltiktor.com^
||betotodileon.com^
||bett2you.org^
||bigsport.today^
||breakingfeedz.com^
||businessenviron.com^
||byambipoman.com^
||cadbitff.com^
||chemitug.net^
||civadsoo.net^
||clicktracklink.com^
||comivolo.com^
||consoupow.com^
||countriesnews.com^
||daizoode.com^
||davaifoa.com^
||desabrator.com^
||dfsdkkka.com^
||dodurantom.com^
||doflygonan.com^
||domakuhitaor.com^
||dosamurottom.com^
||dugothitachan.com^
||dukirliaon.com^
||dulillipupan.com^
||duponytator.com^
||ewoutosh.com^
||eyenider.com^
||faestara.com^
||fdiirjong.com^
||fiinann.com^
||fiinnancesur.com^
||finance2you.org^
||finnnann.com^
||flymob.com^
||forlumineontor.com^
||forunfezanttor.com^
||forzigzagoonom.com^
||fregtrsatnt.com^
||funnysack.com^
||gdasaasnt.com^
||geedoovu.net^
||geejooji.com^
||getsurv2youu.com^
||gfsdloocn.com^
||ggetsurveey.com^
||gggtrenks.com^
||gillynn.com^
||gkjoanks.com^
||glersakr.com^
||gloaphoo.net^
||gloolrey.com^
||gloudsel.net^
||goomaphy.com^
||groguzoo.net^
||growebads.com^
||gtoonfd.com^
||haunigre.net^
||higheurest.com^
||hoanoola.net^
||hrenbjkdas.com^
||inabsolor.com^
||inboldoreer.com^
||incorphishor.com^
||inkingleran.com^
||inpage-push.com^
||interdfp.com^
||intorterraon.com^
||itemolgaer.com^
||itgiblean.com^
||itnuzleafan.com^
||ittorchicer.com^
||itzekromom.com^
||jeehathu.com^
||karsauwi.xyz^
||koapsuha.net^
||kogutcho.net^
||lauhoosh.net^
||leethalo.net^
||leezoama.net^
||loralana.com^
||lowdodrioon.com^
||lowdurantom.com^
||lowlatiasan.com^
||lowstaryur.com^
||mauchopt.net^
||meagplin.com^
||meet4youu.com^
||mekstolande.com^
||moakaumo.com^
||moksoxos.com^
||mygtmn.com^
||naisoops.net^
||newprofitcontrol.com^
||nieveni.com^
||oackoubs.com^
||oaphoace.net^
||offmachopor.com^
||omanala.com^
||omasatra.com^
||omchimcharchan.com^
||omnidokingon.com^
||onclickads.net^
||onclickrev.com^
||onclickserver.com^
||onelivetra.com^
||onwasrv.com^
||onxatutor.com^
||oodrampi.com^
||oopsoans.xyz^
||opcharizardon.com^
||opchikoritaan.com^
||opchikoritar.com^
||opclauncheran.com^
||osspalkiaom.com^
||ossrhydonr.com^
||otrwaram.com^
||outaipoma.com^
||outseylor.com^
||overonixa.com^
||overswaloton.com^
||overzoruaon.com^
||overzubatan.com^
||paiwhoki.com^
||parumal.com^
||pipeschannels.com^
||propvideo.net^
||psaudous.com^
||psoukesh.com^
||ptewarin.net^
||qarewien.com^
||rhendam.com^
||ridsilry.net^
||rmndme.com^
||rndchandelureon.com^
||rndmusharnar.com^
||roduster.com^
||roosteem.net^
||rouinfernapean.com^
||rtmark.net^
||rtrgt2.com^
||saimifoa.net^
||seevustu.xyz^
||serconmp.com^
||shoubsee.net^
||show-review.com^
||sportevents.news^
||staixooh.com^
||stastips.net^
||surv2you.net^
||survey2you.org^
||tauvoojo.net^
||teefuthe.com^
||thoamike.xyz^
||timecrom.com^
||toateeli.net^
||toglooman.com^
||toshelmeton.com^
||tosuicunea.com^
||totentacruelor.com^
||totogetica.com^
||touroumu.com^
||tovanillitechan.com^
||trads.io^
||trenhsmp.com^
||trewnhiok.com^
||ugroocuw.net^
||unampharostor.com^
||unbeedrillom.com^
||unexeggutorer.com^
||ungolbator.com^
||untimburra.com^
||uparceuson.com^
||uplucarioon.com^
||uponarticunoer.com^
||upregisteelon.com^
||urmavite.com^
||uwhuglup.net^
||vamsoupowoa.com^
||vethojoa.net^
||vuftouks.com^
||whaxanso.net^
||whizista.xyz^
||wumpeeps.net^
||wynather.com^
||yacurlik.com^
||yarlnk.com^
||yonabrar.com^
||zagtertda.com^
||zoawufoy.net^
||139.45.197.239^

! https://forums.malwarebytes.com/topic/292537-phishing-x-3/ (account required, credit to https://forums.malwarebytes.com/profile/126832-bradraynor/)
||13ee53.codesandbox.io^

! https://forums.malwarebytes.com/topic/292570-malwarebytes-blocked-trojanexe-am-i-safe/
! https://threatfox.abuse.ch/ioc/1024382/
||185.234.247.238^

! https://forums.malwarebytes.com/topic/292568-ironmodalcom/
||ironmodal.com^

! https://app.any.run/tasks/fbb04c5d-ce57-4eaa-937b-20b014ed7c19#
||rsmerchantservices.com^
||oolomos.com^
||privacy-tools-for-you-453.com^
||gcrpgqhhmf.com^
||bestsmartfind.com^

! https://app.any.run/tasks/df07016b-df4a-47d2-8ef4-3764547ccb7b (website)
! https://app.any.run/tasks/30bb18a1-ea92-4208-91a1-e1b964930fa5 (file)
! https://threatfox.abuse.ch/ioc/1028938/
||rebrand.ly/McAfeeSecurity2022ActivateDownload^
||45.15.157.132^

! this is totally not what online malware sandboxes are for, but
! https://tria.ge/221205-15q5dsfb9z/behavioral1#network
||adthereis.buzz^
||ftrec.adthereis.buzz^
! subdomains
||czudf.adthereis.buzz^
||dlaho.adthereis.buzz^
||uyfox.adthereis.buzz^
||bukwg.adthereis.buzz^
||vriuj.adthereis.buzz^
||qcfhr.adthereis.buzz^
||vmvyu.adthereis.buzz^
||sxvne.adthereis.buzz^
||tzoca.adthereis.buzz^
||vqzao.adthereis.buzz^
||stypo.adthereis.buzz^
||rzukq.adthereis.buzz^
||buvaf.adthereis.buzz^
||kmkab.adthereis.buzz^
||ecgax.adthereis.buzz^
||tfseo.adthereis.buzz^
||pydqn.adthereis.buzz^
||jspov.adthereis.buzz^
||xdaxi.adthereis.buzz^
||cxyyv.adthereis.buzz^
||rzhxs.adthereis.buzz^
||ihclh.adthereis.buzz^
||mzqyv.adthereis.buzz^
||ovanj.adthereis.buzz^
||nnkjm.adthereis.buzz^
||zcuea.adthereis.buzz^
||mnqre.adthereis.buzz^
||vnzdj.adthereis.buzz^
||bxauc.adthereis.buzz^
||drauy.adthereis.buzz^
||gkgfw.adthereis.buzz^
||ribsl.adthereis.buzz^
||czhif.adthereis.buzz^
||cupyx.adthereis.buzz^
||ypnjk.adthereis.buzz^
||agexq.adthereis.buzz^
||ojhjn.adthereis.buzz^
||mrmgk.adthereis.buzz^
||hwkjq.adthereis.buzz^
||povvx.adthereis.buzz^
||pkciz.adthereis.buzz^
||drpgq.adthereis.buzz^
||inrtc.adthereis.buzz^
||tifrl.adthereis.buzz^
||lqgqc.adthereis.buzz^
||hlrjd.adthereis.buzz^
||dqnib.adthereis.buzz^
||ydhet.adthereis.buzz^
||izszd.adthereis.buzz^
||lshph.adthereis.buzz^
||cclct.adthereis.buzz^
||mzstz.adthereis.buzz^
||hzuhg.adthereis.buzz^
||qkefc.adthereis.buzz^
||furbf.adthereis.buzz^
||aealu.adthereis.buzz^
||imolc.adthereis.buzz^
||gjzsn.adthereis.buzz^
||rvoko.adthereis.buzz^
||jfope.adthereis.buzz^
||kngev.adthereis.buzz^
||fkpbd.adthereis.buzz^
||atyqv.adthereis.buzz^
||tfkbt.adthereis.buzz^
||ghevg.adthereis.buzz^
||mtvam.adthereis.buzz^
||zsa0i.adthereis.buzz^
||pxzib.adthereis.buzz^
||bbpky.adthereis.buzz^
||xtfaq.adthereis.buzz^
||ggyjx.adthereis.buzz^
||wqweo.adthereis.buzz^
||ycxds.adthereis.buzz^
||vpemr.adthereis.buzz^
||updsl.adthereis.buzz^
||pnwut.adthereis.buzz^
||svgpj.adthereis.buzz^
||afmqv.adthereis.buzz^
||fcwli.adthereis.buzz^
||bejnh.adthereis.buzz^
||uzvfz.adthereis.buzz^
||eapmj.adthereis.buzz^
||hiaxn.adthereis.buzz^
||nglkk.adthereis.buzz^
||04pl0.adthereis.buzz^
||xbufq.adthereis.buzz^
||kfchx.adthereis.buzz^
||eqtzo.adthereis.buzz^
||xkrws.adthereis.buzz^
||rabyl.adthereis.buzz^
||vrrip.adthereis.buzz^
||yrjrq.adthereis.buzz^
||oimxs.adthereis.buzz^
||mnlnd.adthereis.buzz^
||lubpm.adthereis.buzz^
||uvcbk.adthereis.buzz^
||bhqgv.adthereis.buzz^
||jzewf.adthereis.buzz^
||edbek.adthereis.buzz^
||bmvbj.adthereis.buzz^
||wmsxu.adthereis.buzz^
||mfxzk.adthereis.buzz^

! https://scammer.info/t/i-made-a-game-can-you-test-play-discord-trojan/114861
! https://tria.ge/221208-n68plshh69/behavioral1
||mediafire.com/file/bu394h0oi025wpt/ExtremeUpdate.exe/file^
||kqnfkpoccicxiudstqonfotuwsrhuxkwhqjjfsbjhonoubrccy.nl^

! https://app.any.run/tasks/82e6d95e-3fd5-4bf6-873e-3d7379d495e3
! https://app.any.run/tasks/25665331-97a5-49a8-9381-eda377347ee5/
||bit.ly/fitgirl-repacks-site^
||fitgirl-repacks-site.org^
||bluemediafiles.top^

! https://forums.malwarebytes.com/topic/292825-outgoing-connection-blocked-due-to-trojan-vbcexe/
||na.luckpool.net^

! https://forums.malwarebytes.com/topic/292876-detected-trojan-windowsmicrosoftnetframeworkv4030319applaunchexe/
||tininshassama.xyz^

! https://forums.malwarebytes.com/topic/292840-file-detected-windowsmicrosoftnetframeworkv4030319aspnet_compileexe/
||line.publicvm.com^
||209.209.41.33^
||onedrive.live.com/Download?cid=8BDBA39CCF6B0487&resid=8BDBA39CCF6B0487%21115&authkey=AKzKYXDKF87dXao^

! https://bazaar.abuse.ch/sample/a3cafe7d2d20180460c2e581b215d63519a691de2781a66349fd57ea3e5fcfdf/ (https://bazaar.abuse.ch/user/86185858/)
||194.58.108.112^

! https://github.com/uBlockOrigin/uAssets/issues/15990
||vlcdownloads.com^

! https://github.com/uBlockOrigin/uAssets/issues/16017
! https://app.any.run/tasks/5474c73a-c247-4837-bfd1-a35d08332a5a
! https://app.any.run/tasks/213d5660-7bba-4da6-b9a4-9539201b213c
||t20boltmig.click^
||offsebike.cyou^

! https://virustotal.com/gui/url/2eeeeba08305b13c205d66f7d9cd6a853bc491688d0e91c0381613066b2566a3/community
||storageapi.fleek.co/65d6137a-aa68-4f10-9b8d-3763e277f165-bucket/fav/indexxxxxx.html^

! https://virustotal.com/gui/url/f297b1523c8c0ac766edeccbc5fb099f1c7bd031c29f837a1701e0a1f71a8651/community
||desinvca.ru^

! https://github.com/AdguardTeam/AdguardFilters/issues/136390
||glthub.org^

! https://forums.malwarebytes.com/topic/293043-fake-notepad-website-with-fake-installer/ (login required)
! credit to https://forums.malwarebytes.com/profile/284536-liteiton/
||nothfnw.shop^

! https://github.com/uBlockOrigin/uAssets/pull/16038
||microauth.ru^

! https://forums.malwarebytes.com/topic/293076-google-docs-extension-malware/
||goog.goodsearchez.com^
||goodsearchez.com^

! https://forums.malwarebytes.com/topic/293086-i-keep-getting-data-crypto-mining-trojans-in-my-chrome-extensions-folder/
||daggerhashimoto.eu.nicehash.com^

! https://virustotal.com/gui/url/02dc78a55d22ccb88c5609813f90be62723531ba26be696df8259f9820dcae3b/community
||plazaboulevard.com.br^
! https://virustotal.com/gui/url/e932836ffec1abf152162b20f97292111a5d7c02cd6b3f2d91916c0821227ac2/community
||authentication-vmail.us-east-1.linodeobjects.com^

! https://bazaar.abuse.ch/sample/dd022ea963e777dec7fbb6c3f84893961c60a0b72fa26152416a9e75e9879c5d/
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_DownloadApp.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeLoader_All_In_One.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeSubstanceDesigner.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeSubstanceSampler.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeAcrobat.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeAftereffects.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeIllustrator.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeLightroom.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobePhotoshop.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobePremiere_Pro.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeAudition.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeXD.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeAnimate.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AdobeInDesign.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_KMS_Auto.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AutodeskSketchbook.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_WondershareFilmora.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_WondershareDataRecovery.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AnyDesk.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Winrar.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_VMware.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_FL_Studio.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Ableton_Live_11_Suite.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Bandicam.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Bluestacks.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Autocad.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AutodeskMaya.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Autodesk_Civil_3D.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Autodesk_3DS_MAX.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_SonyVegasPro.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_IObit_Driver_Booster_PRO.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Movavi_VideoEditor.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_CorelDraw.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_AffinityDesigner.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_TeamViewer.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_TradingView.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_PDF_Editor.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Proxifier.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_SketchUp_PRO.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_MicrosoftOffice.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_DaVinciResolve.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_SpotifyPremium.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Camtasia.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_WaveLab_Pro_11.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_RevoUninstallerPro.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Zbrush.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_ExpressVPN.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_CyberGhost.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_ProtonVPN.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_NordVPN.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_PlanetVPN.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_Surfshark.rar^
||bitbucket.org/edidervishid46/facebooker/downloads/Passw_wesoft_NortonVPN.rar^
||142.93.198.232^

! https://virustotal.com/gui/file/9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd/detection
||bit.ly/3zKpp8y^
||mediafire.com/folder/bftfjxk7na4m8/Setup^
||mediafire.com/file/kfjdexcnso6l3uk/Installer.rar/file^

! https://virustotal.com/gui/file/8b526ce6c0637c72799d1f1944f5d77a821d896c2ffe01cd8c391ed37a175f76
||telegra.ph/TeamViewer-11-16^
||gg.gg/teamviewer-prem-free^
||mediafire.com/file/z0mvgi2bjbotamf/TeamViewerPremium.rar/file^

! https://virustotal.com/gui/file/1727a5f6484628f4493ac2befaf48b47d88376128992c2787959c00b306da048/detection
||bit.ly/3VtsAd2^
||mediafire.com/file/umf43herutudu71/After+Effects.rar/file^

! https://github.com/DandelionSprout/adfilt/discussions/163#discussioncomment-4502840 (with no adblocker, I got an ad which downloaded https://virustotal.com/gui/file/7c4c570fb381176736d956ee84c5fb01b6e4638fe122e7a2e1f7335d08edb1d6/detection)
||ecomefuk.xyz^

! https://app.any.run/tasks/f4e39100-c15b-4cd3-9a2c-3401df4435d4
! https://tria.ge/221227-3mk7jagg99
||thyr65qw.cfd^
||5rd5tgh.cfd^
||116.203.121.167^

! https://www.hybrid-analysis.com/sample/f2e12223da0ae00323260f8dadbdd1596f7ce8fcd2e2520fde0aefc6fd19a88b
! https://tria.ge/221228-3ez1qabh74/behavioral2
! https://virustotal.com/gui/file/0814d32e07768c5387774d03108ea27ff132d4aee72d3f1fc98a6d78ab74d628
||wkcrack.com^
||neonhost.click^
||157.230.87.146^
||sigmarole.cyou^
! https://threatfox.abuse.ch/ioc/847757/
||77.73.134.24^
! https://app.any.run/tasks/acb995d6-45ba-4680-8c39-b96b7a8574d8
||rotf.lol/2p9fmd8k^
||65.108.249.43^

! https://github.com/iam-py-test/investigations/blob/main/malware/oceanofgames.com.md
||oceanofgames.com^
||easy-learn-tech.info^
||51.68.154.128^

! https://virustotal.com/gui/url/c4c4913c27814d34be86ee1394ba7706190a2b9f59adade86eaa05126b3258fc/community
||securewebauths.com^

! https://virustotal.com/gui/url/25c1299a47deee16de446a1e984b668779afe55cd5429639a112fe8cb6509b68/community
||colorflys.com^

! https://app.any.run/tasks/5bdcb423-d8a6-4c4a-bee0-e4817415d96e
! https://virustotal.com/gui/file/f82251f78347ba9a0a0fe6efee7fdfb4a07ef133ec29d4fb816116b194c4f4a2/detection
||116.203.3.152^

! shared by https://github.com/JobcenterTycoon
||funnycrack.com^

! https://app.any.run/tasks/5f9ddba3-9d5d-45a6-8ab1-37eaca832b2a/
! https://tria.ge/230103-s79qhsfb2z/behavioral2
||gigapurbalinggaa.com^
||cutt.ly/V2fZo0l^
||bit.ly/3Z8fkxh^
||stone10.xyz^
||143.198.211.93^
||blakbooot.click^
||p1nkroze.click^
||5.75.173.242^

! https://github.com/AdguardTeam/AdguardFilters/issues/139106 (credit to DandelionSprout)
||loadingnow.me^
||gsecurecontent.com^
||pressizer.net^
||sapino.net^
||44.236.213.34^
||52.24.156.12^
||52.25.6.134^
||100.20.13.49^

! https://tria.ge/230104-qdn6lsfh34/behavioral2
! https://tria.ge/230104-qcf4lsbb81/behavioral2
! https://www.hybrid-analysis.com/sample/a2f1e5de0f6a32a2b202a973b4deebb0f3f3fd0c16001a010594ced932b17a07
! https://virustotal.com/gui/file/a2f1e5de0f6a32a2b202a973b4deebb0f3f3fd0c16001a010594ced932b17a07/detection
||1weset6y.cfd^
! https://threatfox.abuse.ch/ioc/1064537/
! https://threatfox.abuse.ch/ioc/1064536/
! https://threatfox.abuse.ch/ioc/1064660/
||88.119.161.188^
||88.119.161.19^

! https://forums.malwarebytes.com/topic/293448-brute-force-password-attack-on-email-server-from-ip-address-9820013539/?do=findComment&comment=1547922 (account required)
! https://www.abuseipdb.com/check/68.60.77.128 
! delist once there have been no new reports in one week. Probably pointless to list in the first place
||68.60.77.128^

! https://app.any.run/tasks/37850881-daef-455e-a60d-7b1a11438955 (just a 7zip download???)
||fitgirlrepack.games^
||floppyredirect.click^
||losstub.icu^

! https://app.any.run/tasks/bdf92208-3c4b-4673-b4f4-4d59299d1201
||fitgirl-repacks.proxy2link.com^

! https://app.any.run/tasks/73e0b109-7648-4d44-ac89-c2abd5c0b8f0
||nortvpn-app.com^

! https://github.com/hagezi/dns-blocklists/issues/166
||nielviok.cf^
||kallarann.gq^
||jandin.gq^
||web.quoabide.top^
||milfme.com^
||web.zoneimage.site^
||dylacha.tk^
||waumari.tk^
||web.tumbleceq.in^
||web.squirmaccess.site^
||track.findb.news^
||web.zoombleat.top^
||web.grittyago.xyz^
||wineshasi.cf^
||web.spywax.site^
||xonanere.ga^
||karindal.ga^
||web.aeratevenal.site^
||web.cannondate.top^
||deugahat.gq^
||web.acidicadorn.top^
||leelabea.cf^
||beladra.cf^
||web.actgrovel.site^
||ysiquaarac.ga^
||web.grincanis.site^
||web.spurtparole.top^
||llantana.ml^
||web.datelovetime.xyz^
||lhamad.gq^
||web.jazztunnel.top^
||quinete.ga^
||web.blandfain.site^
||web.hanfallow.online^
||web.groupabet.site^
||tracking.lovematchflirt.com^
||tracking.latedreamdate.com^
||web.gristwattle.online^

! https://bazaar.abuse.ch/sample/971a53dd3d17c44c1f4b21e33c0c161aed411ebb8c4d7f5a47c3cc68849340a5/
||skynetx.com.br^
! https://app.any.run/tasks/45e3bc2d-8e87-47b6-b233-cf8bfecbd5b7
||cdt2023.ddns.net^

! https://app.any.run/tasks/425c595f-3f93-4d54-abaf-29b7d8c78e1b#
||bit.ly/3G1xJTO^
||upload.ee/files/14795098/Installer.rar.html^
||upload.ee/download/14795098/e163e4d865031c40167f/Installer.rar^

! https://github.com/uBlockOrigin/uAssets/pull/16283
||galeden.cn^

! https://virustotal.com/gui/url/ba238fade1efae3c4a22a777ea6d8e7876911ba2762a38e9068be025dae64642/community
! https://app.any.run/tasks/fc749190-7a49-4f62-bfcb-b4262ba6fe8b (my analysis)
||coda.io/d/_dgQ7smav5EW/AP_suCWI^

! https://virustotal.com/gui/url/d53cb0004ee89defa498483920b97ff3b414748e05ce7a5af65136b06b19ef6f/community
||tidy-mark.com^
||grethychashi.pro^
||www.grethychashi.pro^

! https://forums.malwarebytes.com/topic/293729-help-please-a-file-trojan-keeps-coming-back-when-i-reboot-my-computer/
||phtgnx.top^
||cdn.phtgnx.top^
||progriu.top^
||cdn.progriu.top^

! https://tria.ge/230114-ra56dsch4w/behavioral2
||er76njy.click^
||vghu896yh.cfd^
! https://threatfox.abuse.ch/ioc/1068340/ and https://threatfox.abuse.ch/ioc/1068341/
||146.70.86.11^
||69.46.15.158^

! https://github.com/uBlockOrigin/uAssets/issues/16339
||dgemanowhot.com.ua^
||onandeggsiswe.com.ua^
||ormoredeta.xyz^

! https://forums.malwarebytes.com/topic/293881-hijackautoconfigurlprxysvrrst-backdoorfarfli/
||g.agametog.com^
||agametog.com^

! https://bazaar.abuse.ch/sample/13b4cf644bcb21bc1fe99e77bc919b8114ce44e6f0cca5872b689185c57606bc/
! my analysis (all credit to whoever originally reported this)
! https://www.hybrid-analysis.com/sample/3e79dfe786d64834eca9f37d68c01d433ebbe90bb6f2ca58c0daaf9f8a85f059
! https://tria.ge/230116-1vskgaeb63/behavioral2
! https://threatfox.abuse.ch/ioc/1062895/ and https://threatfox.abuse.ch/ioc/1062522/
||domifybot.com^
||79.137.206.138^

! https://blog.sucuri.net/2023/01/finding-removing-malware-from-weebly-sites.html
||circuitingratitude.com^

! https://forums.malwarebytes.com/topic/294262-fake-firefox-update/ (account required)
! credit to https://forums.malwarebytes.com/profile/3800-porthos/
||84df4578bffsd.info^

! https://forums.malwarebytes.com/topic/294335-repeated-blocked-website-trojan-compromised-logs/
||dellenshop.top^

! https://forums.malwarebytes.com/topic/294253-infected-paranoid/#comments
||fuzionblox.com^

! https://forums.malwarebytes.com/topic/294374-might-have-a-virus/
! https://forums.malwarebytes.com/topic/294372-suspicious-file/
! https://threatfox.abuse.ch/ioc/1073271/
! (my analysis) https://app.any.run/tasks/96fff8ad-199e-4a03-aea3-410214ed18f4
||194.36.177.164^

! https://github.com/blocklistproject/Lists/issues/918 (all but one appear dead but added anyway)
||notldoy.xyz^
||blendepr.org^
||blendevr.org^
||blender3d-software.net^

! https://github.com/uBlockOrigin/uAssets/issues/16558
! (my analysis) https://tria.ge/230130-pl42csac69/static1
||driveusercontent.us^

! https://forums.malwarebytes.com/topic/294473-malware-not-detected-in-malwarebytes/ (account required)
! (my analysis) https://app.any.run/tasks/14b9da67-7f1e-49ff-b73d-26a5d263efbf/
||135.181.41.147^

! https://github.com/DesktopECHO/T95-H616-Malware
||ycxrl.com^
||ycxrldow.com^
||cbphe.com^
||cbpheback.com^

! https://bazaar.abuse.ch/sample/89da2eee6af1c267e164bd9b24866bcac56588fe67efaf3bdb9aa98afa8cf990/
! https://bazaar.abuse.ch/sample/7df24f04c4df829cd9e643cd9be596d0996b79d1fbb9422c75a17741f10414a4/ (all credit to abusech)
||pusgpaxnddw.top^
||qlmhxmwlyhr.top^
||qmudnleqjjx.top^

! https://github.com/AdguardTeam/AdguardFilters/issues/141376
||watch-online.7oc5b1i3v4iu.top^
||7oc5b1i3v4iu.top^

! from internal discussion
! https://urlhaus.abuse.ch/url/2524904/
! (my analysis) https://tria.ge/230201-nxx7hsda77/behavioral2
! https://threatfox.abuse.ch/ioc/1067729/
||82.115.223.46^

! https://forums.malwarebytes.com/topic/294558-google-customer-reward-program/
||21bustqisw2.top^

! from search results
||331454283.jirikrcmar-photography.cz^
||jirikrcmar-photography.cz^
||dh4jf8fjs.affiliatemarketing.news^
||affiliatemarketing.news^

! https://forums.malwarebytes.com/topic/294619-trojan-hijack-browser/
! https://app.any.run/tasks/9cdd662f-9642-4406-8797-03f021ce6370
! https://tria.ge/230203-pmtl1saf9t/behavioral1
||ccleaner-download.xyz^
||35.181.110.225^
||service-domain.xyz^

! https://twitter.com/KesaGataMe0/status/1621321884012019712 (https://github.com/AdguardTeam/AdguardFilters/commit/cc46c1f0f0c2a71e989c697fb382cdd68621d366)
||www-biccamera-com.jycfmf.com^

! https://virustotal.com/gui/url/7edda570d0f8fae48fac53194950c93137721d5535829d88add851c9bf42a0e2
! (my analysis) https://app.any.run/tasks/1da745f3-0a79-44b4-9490-0ce55609f1e2
||un-titled.co/remain/DNS/index.php

! https://virustotal.com/gui/url/7aa7958a7cb1509cd70a8c935c6c3eb96c46f2fc7b05cb3862f9bd9299308627/community
! (my analysis) https://app.any.run/tasks/e795f6aa-589a-4b6f-8352-403b055bdf5d
||hotmail-107217.weeblysite.com^

! NSFW: https://app.any.run/tasks/84fe2ec3-067b-4095-8a4f-e74636671351
||message.okaynotification.com^
||okaynotification.com^
||notice.okaynotification.com^
||click.okaynotification.com^
||update.okaynotification.com^
||now.okaynotification.com^
||readnow.okaynotification.com^

! https://app.any.run/tasks/04b2bc07-923b-4890-8587-02e360d01ae0
||morecash.click^
||gamebee.club^

! https://forums.malwarebytes.com/topic/294675-mygov-scamfraudpersonal-detail-theft-alert/ (account required)
! (my analysis) https://app.any.run/tasks/463e490a-12bb-4afd-a496-f5500177b794/
||quickttax.top^

! https://github.com/AdguardTeam/AdguardFilters/issues/142226
! https://app.any.run/tasks/91ca9115-952b-479f-8f9d-360e096e558b
||qfdsq.inghesatin.com^
||blockadsez.info^
||wickedhumankindbarrel.com^
||videoadblockerpro.com^
||watchadfree.info^
||stop-adblocker.info^
||ia9j0.top^
||yk946.top^
||ayybt.top^
||8b947.top^
||yz9iy.top^
||9sgqi.top^
||pivoms.live^
||ys2fr.top^
||9elo3.top^
||zjvw7.top^
||z4r0w.top^
||8yqet.top^
||wheeshoo.net^
||justquiz39.pushalert.co^
||easyadblocker.info^
||wbofc.top^
||x435f.top^
||w6got.top^
||xk9tx.top^
||wiruv.top^
||xpdep.top^
||shoesauto3.xyz^

! https://forums.malwarebytes.com/topic/294740-trojans-will-not-disappear-and-mb-wont-stop-blocking-websites/
! https://threatfox.abuse.ch/ioc/1078147/
||194.87.216.194^
! https://www.malware-traffic-analysis.net/2023/02/03/index.html
||yes2food.com^
||advertising-check.ru^
||softs-lab.ru^
||62.204.41.176^
||176.113.115.177^

! https://threatfox.abuse.ch/ioc/1078856/
! https://twitter.com/1ZRR4H/status/1623067548781539339
||79.137.248.136^
||79.137.206.31^
||85.192.40.253^
||mediafire.com/file/4n5bc37ank892fh/Expert-PC_2023.rar/file^

! https://github.com/uBlockOrigin/uAssets/issues/16704
! https://app.any.run/tasks/dbfbbaca-9fd5-4466-8a29-9e0519b77589
! https://virustotal.com/gui/file/f202337f99c730eef56d3be2a7fb92d74c9b5adac799fb0564bc9264f2784f5c/relations
||vserpg.ru^

! https://github.com/hagezi/dns-blocklists/issues/324
||teslacar.io^

! https://app.any.run/tasks/bcd4633b-931e-4bfc-a874-24d04a136036
||wlbss.inghesatin.com^
||xe5j8.inghesatin.com^
||ggjt8.inghesatin.com^
||world-games.click^
||bynsd.top^
||8eatj.top^
||7ya1q.top^
||bhnx4.top^
||899h3.top^
! https://app.any.run/tasks/53948f39-666f-4083-aa4e-bd5f215d29e2
||dykbo.inghesatin.com^
||cqw59.top^
||ajfgq.top^
||8lmm7.top^
||ifmom.top^
||yhvua.top^
||dejig.live^

! https://github.com/iam-py-test/my_filters_001/issues/109
||btc.latest-articles.com^
||en.firstgooal.com^
||en.rawafedpor.com^
||news.istisharaat.com^
||ust.aly2um.com^
||filestack.live^
||0-4.top^
||012.bond^
||5pm.am^
||77w.pw^
||7la.la^
||9ge.ge^
||b-d.bond^
||b-i-t-l-y.co^
||b-ly.link^
||b-y.by^
||bit-ly.is^
||bit-ly.mobi^
||bitly.best^
||bitly.email^
||bitly.gold^
||bitly.network^
||c-lick.click^
||c-you.cyou^
||cc-z.cz^
||co-o.co^
||cr-7.cc^
||cutlinks.biz^
||cutlinks.ca^
||cutlinks.mobi^
||cutlinks.org^
||cuturls.net^
||d-ev.dev^
||fco.to^
||fmo.fm^
||g-l.gl^
||g-y.gy^
||gob.co.il^
||gov-cn.cloud^
||gov.co.ve^
||h-air.hair^
||i-cu.icu^
||i-io.io^
||i-n-fo.info^
||i-s.is^
||icx.cx^
||ii-ii.ru^
||ilc.lc^
||isn.is^
||isx.sx^
||j-e.je^
||l-o.loan^
||l-ol.lol^
||lbz.bz^
||m-n.mn^
||mvc.vc^
||n-g.ng^
||n-z.nz^
||obz.bz^
||oo-o.co^
||oo.coffee^
||psu.su^
||qis.is^
||s-k.sk^
||s-b.sb^
||s-sh.sh^
||sy-s.systems^
||t-o.to^
||tiny-url.mobi^
||ufox.info^
||u-mu.mu^
||uxe.luxe^
||vms.ms^
||vv-vip.vip^
||vvg.vg^
||w-me.me^
||w-tw.tw^
||w-ws.ws^
||wac.ac^
||wci.ci^
||wst.st^
||xx-yz.xyz^

! https://github.com/blocklistproject/Lists/issues/933
||jNKmS0zFuEh.click^
||pjljo54uk.click^
||v1asy4ncr.click^
||p5tvhrlw30h.click^
||8narwi309.click^
||sbjjzdwqg41ps.click^
||lrhxz60alkjtik.click^
||tvbxrr4ym3.click^
||8ebtdbsjsu.click^
||eicxz6jfjaw.click^

! https://virustotal.com/gui/url/90ec9d3b01d045ba7917ba09722d9063803cf318d08de907e77d421800ed1cc4/community
! (my analysis) https://app.any.run/tasks/f14b7082-e3b1-4a98-84fc-e3c5e3d3b35c
||s44-fhvb.web.app^

! https://app.any.run/tasks/77b6a223-4c81-4798-9dc0-a747de6e0f6d
||crackshash.com^
||czgovd.com^
||pufgilsofp.sbs^
||bstnwswrld.com^
||news-wobuda.com^
||ztzguv.com^
||thbstvd.com^
||notyfrom.info^
||flymylife.info^
||ms-82.flymylife.info^
||ms-52.flymylife.info^
||54trck.xyz^
||cxvfh.gesgloven.com^
||jorjfordmust.sbs^

! https://app.any.run/tasks/f03aaba8-7c21-4316-a6db-cbb9bdbb1db6
! https://app.any.run/tasks/d142bf7d-0363-4bf2-9795-66423bbc9eac
||origincrack.com^
||uerqelim91ut.click^
||klwukospapf.click^
||9bghqk3avg2gnh.click^
||6t09fag307ep.click^
||bit.ly/3S7o1VK^
||mega.nz/file/5w4QWZCR#pYyDSqxzjS4LzhLW9ZYvAWzxhuM3rPGh0wl7r64tDLs^
||mega.nz/file/AwQghbKa#GAcaJZR9cIRl3lRWYZhD5gkHtGL8Y63fKOAnCbM-9FU^
! https://tria.ge/230216-sgsz3shg3w/behavioral2
! https://threatfox.abuse.ch/ioc/1077934/
||83.217.11.27^
! https://virustotal.com/gui/ip-address/77.73.134.35/relations
||77.73.134.35^
! https://twitter.com/TrackerC2Bot/status/1620944031030075392
! https://threatfox.abuse.ch/ioc/1077935/
||83.217.11.28^

! https://forums.malwarebytes.com/topic/295115-trojan-downloaders-not-detected-by-malwarebytes/ (account required)
! https://virustotal.com/gui/file/a0626a283b6e2cbcacfbcc06c21691aff5e3386d43a76909304b2b0bacf8f45a/relations
||176.57.150.117^

! fake tor browser - https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448
! https://tria.ge/230217-xd8nksgc9x/behavioral2
||ru-torproject.ru^
||anapatformacion.org/modules/file/tor/tor-browser.zip^

! https://github.com/uBlockOrigin/uAssets/issues/17400
! https://github.com/uBlockOrigin/uAssets/pull/16764#issuecomment-1493992669
! https://app.any.run/tasks/15000d62-df3c-41c4-95fa-b27480049e2d#
||dwnfile.fun^
||mpraven.org^
||xfiley.me^

! https://github.com/uBlockOrigin/uAssets/issues/15937
! https://github.com/uBlockOrigin/uAssets/issues/15937
! https://virustotal.com/gui/url/a70d88ffc974f8d9cc5c3561938e95435d20a12a555e8c10d638d2bee5292165
||install1nstall1.com^
||kochava.com^
||neptunclicks.com^
||arakusus.com^
||imgfil.com^
||urlcod.com^
||tiurll.com^
||neppe.studio^
||startex3download.com^
||gowtos.com^
||lomogd.com^
||nosnou.com^

! https://virustotal.com/gui/url/8ffac07f327a1bc605278ac9cdbc1f6a00ae2efd9d7111ad38790e6031e74072/community
! (my analysis) https://app.any.run/tasks/69b1e739-fa82-487f-92c8-5ba368b25481
||steam.steampoweredartwork.com^
||steampoweredartwork.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/142771
||wgreplay.fun^

! https://virustotal.com/gui/file/aaa1beed5908f05cd7e4dc405ec763deecd6177b0bf78f0faa9cd54eed14bc34/detection
||mesoftwares.vip^
||drive.google.com/uc?export=download&confirm=no_antivirus&id=11WhDE3Xy7c5AkKS24P0EzS8S8LUNjIAY^

! https://app.any.run/tasks/82180609-bf2b-4565-88cd-e3cb2c8e6456/ (someone else's anyrun, credit to them)
||rebrand.ly/30p0zqg^
||telegra.ph/Download-Link-11-24-17^
||mediafire.com/file/3sdq84zpxzmoio5/Setup_%2528PAS%2524_5577%2529.rar/file^
||95.217.14.200^

! https://app.any.run/tasks/1aa45c59-b90f-47a2-8fb9-7915a377055a/
||46.48.76.120^

! https://forums.malwarebytes.com/topic/295202-windows-powershell-keeps-popping-up-randomly-and-closing/
! https://virustotal.com/gui/file/d3c9371a1456fd7c4551e18b0c1172a597f86c97e2864bc0b1be632c48da9697/relations
||ahoravideo-blog.com^
||ahoravideo-cdn.com^
||ahoravideo-endpoint.com^
||ahoravideo-endpoint.xyz^
||ahoravideo-schnellvpn.com^
||ahoravideo-schnellvpn.xyz^
||bideo-blog.com^
||bideo-cdn.com^
||bideo-chat.com^
||bideo-chat.xyz^
||bideo-endpoint.com^
||bideo-endpoint.xyz^
||bideo-schnellvpn.com^
||bideo-schnellvpn.xyz^
||fairu-blog.com^
||fairu-cdn.com^
||fairu-chat.com^
||fairu-chat.xyz^
||fairu-endpoint.com^
||fairu-endpoint.xyz^
||fairu-schnellvpn.com^
||fairu-schnellvpn.xyz^
||privatproxy-blog.xyz^
||privatproxy-cdn.xyz^
||privatproxy-chat.com^
||privatproxy-endpoint.xyz^
||privatproxy-schnellvpn.com^
||wmail-blog.xyz^
||wmail-cdn.xyz^
||wmail-chat.xyz^
||wmail-endpoint.xyz^
||wmail-schnellvpn.com^
||wmail-schnellvpn.xyz^

! http://vxvault.net/ViriFiche.php?ID=44753
||adobetmcdn.net^

! https://forums.malwarebytes.com/topic/295239-unsure-if-anything-has-been-done/
||tiktok.ti3fsaa.cloud^
||ti3fsaa.cloud^
! https://app.any.run/tasks/fc4768ad-8cc8-4af7-bd44-d91f5d8c258e
||polo.thegadgetguru.club^
||thegadgetguru.club^
||setupspeedyhighlyinfo-file.info^
||startd0wnload22x.com^
||skillfactsim.com^
||burningpushing.info^$third-party
! https://urlscan.io/result/ff16e3ca-7cc9-48aa-9028-dae2e7769419/
||catomernsuents.com^

! https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
||xrepositoryx.name^
||erdjknfweklsgwfmewfgref.com^
||harrysucksdick.com^
||heikickgn.com^
||frassirishiproc.com^
||myrepository.name^
||egscorp.net^

! https://forums.malwarebytes.com/topic/295534-rtp-outbound-connection-on-googlewikipedia/
||eatablehelprut.com^

! https://forums.malwarebytes.com/topic/295590-malwarebyes-blocks-webite/
||mignished-sility.com^

! https://forums.malwarebytes.com/topic/295626-hyjecrgernebultcom-malware-removal-disguised-as-mcafee/
||hyjecr.gernebult.com^

! https://forums.malwarebytes.com/topic/295631-blocked-website/
||curvyalpaca.cc^$third-party

! domains farmed from adfly
||zxbfm.ooumoughtcall.com^
||ooumoughtcall.com^
||s2cp.xyz^

! https://github.com/RPiList/specials/issues/948#issuecomment-1458739160
||yuppdownload.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/145513
||4b34eusvcxsdublb6f.runoj.click^
||runoj.click^
! https://github.com/AdguardTeam/AdguardFilters/issues/145513#issuecomment-1468676678
||aesch-mko.com^
||agapios-gla.com^
||ahura-maz.com^
||altwi-cha.com^
||artax-evn.com^
||balor-ghn.com^
||ermin-oxj.info^
||gargi-xba.com^
||gloos-zus.info^
||gronw-zis.com^
||harib-eir.info^
||heily-nin.com^
||iorwe-qmf.com^
||kuno-gae.com^
||laurentia-kor.com^
||menelaus-col.com^
||nicomachus-mac.com^
||orige-duo.com^
||phara-gte.com^
||quinctus-isb.com^
||sindr-yet.com^
||redirect.newprogrammatic.click^
||3.231.116.86^
||54.237.193.255^

! random malware
||moresknock.click^
||b7iexw24.cfd^
||u1500oyc.cfd^
||nzjal5ou.cfd^
||krimahoriz.click^
||telegra.ph/Software-2023-02-21-6^
||en.bestadultdatinglist-com.ru^
||fuckbookmobile.org^
||theparlornextthef.com^
||dtsdr.theparlornextthef.com^
||palons.live^
||alertci.click^
||9ijgfdc4rf56.click^
||nbsb7nr44.cfd^
||pingatinga.click^
||srinaboglad.click^
||bvnie.taitlastwebegan.com^
||taitlastwebegan.com^
||162.243.164.175^
||jikabotlan.click^
||trackyouswin.com^
||tgbhi8i.click^
||justfreesetuphere.xyz^
||hit5k.one^
||zdr566yh.click^
||getnomadtblog.com^
||urhandups.xyz^
||qtgsr.taitlastwebegan.com^
||yt93231mn.click^
||aswedfcv6ty.click^
||i3edtgyu.cfd^
||ko04rf8.cfd^
||dr6ghyu7.click^
||entry4hide.cyou^
||ovhoq.nkingwitheaam.com^
||nkingwitheaam.com^
||niceelitdating.top^
||b.niceelitdating.top^
||bigosext1s.com^

! https://github.com/DandelionSprout/adfilt/issues/808
||jonathanbartz.com^
||jp.imonitorsoft.com^
||junk-bros.com^
||kepw.org^
||kristinee.com^
||lakeside-fishandchips.com^
||108.61.242.65^
||146.70.78.43^
||87.120.254.39^
||45.150.108.213^
||92.204.160.240^

! https://www.reddit.com/r/uBlockOrigin/comments/1212vbf/badware_risks_fake_tor_browser_site/
||tor-browser-rus.ru^

! https://www.reddit.com/r/uBlockOrigin/comments/1204r6t/this_should_probably_be_blocked_if_i_must_say/
||adblockers.b-cdn.net^
||pleasetrack.com^

! https://github.com/hagezi/dns-blocklists/issues/809
||getsupport-lcloud.com^

! https://github.com/uBlockOrigin/uAssets/pull/17424
||octopus-warriors.com^

! https://forums.malwarebytes.com/topic/296601-syswow64cmdexe-continous-alert-from-malwarebytes/
||doorspa.shop^

! malware
||official-expert.org^
||file-uploud.site^

! https://github.com/durablenapkin/scamblocklist/issues/31
||balkeryswep.online^

! https://github.com/durablenapkin/scamblocklist/issues/29
||youtubee.com^
||youtunbe.com^
||twiiiter.com^
||twitterr.com^
||goglle.com^
||toyrube.com^
||yahhhoo.com^

! https://forums.malwarebytes.com/topic/296944-malware-blocked-when-doing-a-google-search/
||prodfliying.com^

! https://threatfox.abuse.ch/ioc/1104536/
||js.msedgeupdate.com^
||msedgeupdate.com^

! https://app.any.run/tasks/00d5d80b-3924-4421-8780-7ba796d7b825
! https://tria.ge/230420-anfn8agb9z/behavioral1
||portalproveedores.com.mx^
! https://threatfox.abuse.ch/ioc/1063263/ https://threatfox.abuse.ch/ioc/1028975/
||45.15.157.131^

! https://github.com/durablenapkin/scamblocklist/issues/36
||ledgerlivewallets.com^
||nanoweb3-rarityledgertech.com^
||ledger-liveweb3app.com^
||shop-nanox.com^
||ledgerlive.mobi^
||ledgerlives.live^
||ledgers.network^

! https://blog.morphisec.com/in2al5d-p3in4er
||cv-builder.site^
||siamaster.com.mx^
||chatgptex.us^
||45.15.156.182^
||45.15.156.70^
||45.132.106.77^
||199.127.62.3^
||94.142.138.73^
||94.142.138.84^
||94.142.138.218^
||199.247.24.79^
||5.34.180.208^

! https://www.reddit.com/r/uBlockOrigin/comments/1304khl/badware_sites/
||actionclassicgames.com^
||allin1convert.com^
||allinonedocs.com^
||anytimeastrology.com^
! https://github.com/uBlockOrigin/uAssets/blob/fc2d7bd065b3e79d945fcfdc0da73ff33f6ea089/filters/badware.txt#L3038-L3044 (hopefully I understood the license right, if not, I can delete this)
||myway.com^

! https://forums.malwarebytes.com/topic/297334-our-company-website-shows-riskware-from-a-different-domain/
||life.judyfay.com^
||xjquery.com^

! https://virustotal.com/gui/url/f68044fcf6f1a22b4b1d06cae0dddefa4bd7282377ba16a2a6222379414a6073/community
! https://app.any.run/tasks/ea625e50-b943-4e69-ae48-03231219b07f (my analysis)
||139.224.13.184^

! https://www.bleepingcomputer.com/news/security/new-atomic-macos-info-stealing-malware-targets-50-crypto-wallets/
||amos-malware.ru^

! https://app.any.run/tasks/5fddd235-4433-4376-9a75-39a28b018f6b
||realtorstrust.com^

! https://app.any.run/tasks/d40fc871-4942-4acd-8d6a-d8f4baae1f32
||kuyhaa-me.id^
||omnicad.click^
||oppodlfile.click^
||bit.ly/40K0ug0^
||mediafire.com/file/ztx9xrm611hw3z1/NewSetup_Use_2023_Password.rar/file^
||37.220.87.68^

! https://github.com/durablenapkin/scamblocklist/issues/37
! (my analysis) https://app.any.run/tasks/21412739-6fc1-4a9e-9b35-ad2d8224bb46
! (my analysis) https://tria.ge/230502-nebwkaag58/behavioral1
! (my analysis) https://www.hybrid-analysis.com/sample/d293ec55b0425e8731b17b814b5d9c9abe73b9ee10f8ae808f1ec0f4a969aebe
||youtubebplan.com^
||www.youtubebplan.com^

! https://forums.malwarebytes.com/topic/297425-annoying-outbound-443-malware/
||87cibrsm009t2lj.buzz^

! https://forums.malwarebytes.com/topic/297570-phishing/ (account required)
||0.drroham.ir^
||drroham.ir^

! shared by ryan
||updatefreecompletelytheproduct.vip^

! https://github.com/hagezi/dns-blocklists/issues/1013
||revanced.io^

! https://www.reddit.com/r/uBlockOrigin/comments/139u3yf/malicious_domain_to_block_used_by_hacked_manga/
||gdpr.web0.eu^$third-party

! https://forums.malwarebytes.com/topic/297655-malware-and-popup-in-my-pc/?do=findComment&comment=1566331
||threatdetect.org^

! https://www.malwarebytes.com/blog/threat-intelligence/2023/05/fake-system-update-drops-new-highly-evasive-loader
||qqtube.ru^
||xxxxxxxxxxxxxxx.ru^
||activehdd.ru^
||oled8kultra.ru^
||xhamster-18.ru^
||activessd6.ru^
||activedebian.ru^
||shluhapizdec.ru^
||04042023.ru^
||clickaineasdfer.ru^
||moskovpizda.ru^
||pochelvpizdy.ru^
||evatds.ru^
||click7adilla.ru^

! https://virustotal.com/gui/file/dd45a0f40e75b051871fefd4ddb1ce6dcf130d4e172010c0753e01c1a6523666/relations
||zexeq.com^
||colisumy.com^

! https://virustotal.com/gui/url/4cbb55b62fe8bc2acdaa79d3c4fd3a6d33c0d5eed287bbe655fc117c6bdeb0a3/community
! (my analysis) https://app.any.run/tasks/2de7c1a5-bfe4-4b48-a1e5-b7d8c059cbd0
! (my analysis) https://tria.ge/230512-xhsg6agd4v/static1
||0ffice-3-6-5.ltd^
||87.121.221.106^

! https://tria.ge/230512-tj6jmadg34
||37.220.87.66^
||45.9.74.99^

! https://github.com/hagezi/dns-blocklists/issues/1039
||revolut-pl-id.com^

! https://github.com/durablenapkin/scamblocklist/issues/47
||elontesla23.pro^
||join2musk.com^
||teslabrc.com^

! https://forums.malwarebytes.com/topic/297825-not-sure-if-i-am-being-hacked/?do=findComment&comment=1567599
||redirection-to-the-offer.info^

! https://github.com/uBlockOrigin/uAssets/issues/18115
||maxstream.video/*.php
||needyscarcasserole.com^

! https://github.com/durablenapkin/scamblocklist/issues/52
||baltic79.wordpress.com^
||visoedifica.com^
||balticpipe.wordpress.com^
||baltic-pipe-finansowy.blogspot.com^
||kneel-offers.com^
||dunkansp.info^
||finnews7.wordpress.com^
||tbg-lmtd.com^
||crm2.tbg-lmtd.xyz^
||tbg-lmtd.xyz^
||polish-money-matters.blogspot.com^
||fazpowerdenet.tumblr.com^
||dgbdhvqpwvplersqjytw.dunkansp.info^

! (my analysis) https://tria.ge/230519-1bgzmagd36/behavioral1
! (not my analysis) https://threatfox.abuse.ch/ioc/1115696/
||drive.google.com/uc?export=download&confirm=no_antivirus&id=1A9NdUYUf5k-qcrYlGfffVBqql6g4bLfv^
||195.123.227.138^

! https://github.com/uBlockOrigin/uAssets/issues/18141
||skytils.net^
||skyblockmaniacs.net^
||fragbots.net^

! https://virustotal.com/gui/url/36d76f53c996bad26ba5656fb33557814a0ddbb55f43c8836daa964d3815db9e/community
! (my analysis) https://app.any.run/tasks/76eeda9c-a72f-4743-83b3-a49f80d0a1ce
||steelseries.club^

! https://github.com/badmojr/1Hosts/issues/1407
||easynavigation.site^

! https://forums.malwarebytes.com/topic/298168-domclickextxyz
||domclickext.xyz^

! https://github.com/hagezi/dns-blocklists/issues/1071
||hard-configurator.com^

! https://github.com/uBlockOrigin/uAssets/issues/18206
||fitgirl.cc^

! https://github.com/uBlockOrigin/uAssets/issues/18205
||fitgirlrepacksite.com^

! https://tria.ge/230525-z8rpnacd92/behavioral2
! https://bazaar.abuse.ch/sample/a76c4f346a0f72cc1fcf8c471abb0ecd2e914c5863a4f4556d884212f8d3b2fb/
||185.209.161.89^
||telegra.ph/FL-Studio-05-10^

! spam on Malwarebytes forums (taken down)
! https://app.any.run/tasks/c084b570-6946-4878-ab48-8db1dc4ed659
! https://tria.ge/230530-m4zhgshb97/behavioral2
||activatorscrack.com^
||ed5tfdhjy.click^
||mjko06yh.cfd^
||bh998ik.click^
||maper.info^
||79.137.202.161^
||78.46.248.198^
||78.47.9.120^
||162.55.212.236^
||45.159.189.105^

! https://www.reddit.com/r/uBlockOrigin/comments/134b450/please_add_adblock_badware/
||softronline.click^

! https://github.com/mitchellkrogza/phishing/pull/232#issuecomment-1570214480
||bibtu.com^
||xajibur.ru^
||ponafet.ru^
||baarspo.ru^
||crophysi.ru^
||gimoguvi.ru^

! https://github.com/uBlockOrigin/uAssets/issues/18332
||goglel.com^

! https://virustotal.com/gui/url/0ed4615c9ee045c652ae76001f55252a665cacbea0ed623909f8a780cbfd564d/community
! my analysis: https://app.any.run/tasks/0d2fac2a-6485-4d2d-941c-782acfddd966
||mreilly.s3.eu-central-003.backblazeb2.com^
||zen-leakey.138-68-80-63.plesk.page^

! https://tria.ge/230601-z9q5hsha6v/behavioral1
||softwave.cc^

! https://github.com/uBlockOrigin/uAssets/issues/18353
||easylist.club^
||ww38.easylist.club^

! https://virustotal.com/gui/url/36a5536b1c4ca42b01b31bce4ec0be95192c7204cd83461c3dddff151266ba7b/community
! my analysis: https://tria.ge/230602-t1vhpach4z/behavioral1
||jp6yze3jwx6462c537686e2.inetpr.ru^

! https://virustotal.com/gui/url/cb86e12e4d066b4f7b497bf7c9cef0f264db0161cdd55daf91589fd10e97c659/community
! my analysis: https://urlscan.io/result/d059b7b2-f30b-4930-8afd-b0a0fddef658/
||transporting-api-dlhl.crufaoci.org^

! https://palant.info/2023/06/02/how-malicious-extensions-hide-running-arbitrary-code/
||tryimv3srvsts.com^

! https://forums.malwarebytes.com/topic/298691-my-aspnet-website-infected-with-some-wired-malware/
||usaday.biz^
||abu.usaday.biz^
||us.usaday.biz^
||onepro.club^
||c822c1b63853ed273b89687ac505f9fa.onepro.club^
||738aa8d3bc02eb8712acd0eb2cf6dfd5.onepro.club^
||241fe8af1e038118cd817048a65f803e.onepro.club^
||ba9bf05693b9fa202d922dd43a08f281.onepro.club^
! https://tria.ge/230607-m9fmkaac6w/behavioral1
||rewardarium.com^
! https://tria.ge/230607-m9fmkaac6w/behavioral2
||acarcheartheles.com^

! malware on youtube - https://bazaar.abuse.ch/sample/4d152234f168692459b482981f469e96e4f933360295cd64f5089370a4b07118/
||boraflow.click^
! https://tria.ge/230607-zarl1aff36/behavioral1
||65.21.240.228^

! more malware on YT - https://bazaar.abuse.ch/sample/bb02043cb749f91364f655b35404dc37e517d6aa7cdcbf474bee1fa6be5abe5f/
! https://tria.ge/230607-z5gqaaga69/behavioral2
||telegra.ph/T-Soft-06-02^

! https://github.com/StevenBlack/hosts/issues/2250#issuecomment-1582846967
! my analysis: https://app.any.run/tasks/b359cc64-2f3b-44e9-8d60-ebe6f9788bf8
||skinport.com.mx^

! https://virustotal.com/gui/file/c1fd1add4ffabaa9e5ab244b5fa4b14aba53af379d5d59ae38f9e16e27fc1360/community (shared by JaffaCakes118)
||doenerium.kqnfkpoccicxiudstqonfotuwsrhuxkwhqjjfsbjhonoubrccy.nl^

! https://forums.malwarebytes.com/topic/298978-potential-threat-blocked-website-appears-malicious-scan-says-virus-free/
||garuq.com^

! https://bazaar.abuse.ch/sample/d41166f1c8bbd3c6bbac0f5c96c4dc867d501c3ce5aeb056686ffa28652facef/ (not my sample, credit to r3dbU7z)
! my analysis (dropped file): https://tria.ge/230611-paf56ahg4v/behavioral2
! my analysis (dropped file): https://app.any.run/tasks/e1f1f0fa-8d92-4270-b422-801cfe91d189
||josemonila.ddnsfree.com^

! https://github.com/StevenBlack/hosts/issues/2358
||assistant-chronopost.com^
! https://virustotal.com/gui/ip-address/213.226.123.202/relations
||canadapost-tracking.net^

! https://github.com/badmojr/1Hosts/issues/1482
||aoikerala.in^

! https://virustotal.com/gui/file/7840cb8d12d3a20f265802531f19e7d58928167a37a58b631fa468d78e417a14/community
! my analysis: https://app.any.run/tasks/864669a8-c96e-4971-9810-1427b4343120
||promo-cccleaner.org^
||5.42.66.3^

! https://tria.ge/230623-r72t8sfe33
||45.15.159.27^

! https://tria.ge/230623-25exssae3x/behavioral1
! https://app.any.run/tasks/036fbeb1-adc1-4f00-93ec-aa337f7b05dd
||scholadvice.com^
||pejik.com^
||bthp.com.pk^
||dokumentasoluciones.com^
||208.67.104.60^

! https://forums.malwarebytes.com/topic/299263-claims-to-be-google-bard-ai/ (account required)
||sites.google.com/view/newbardai^

! https://forums.malwarebytes.com/topic/299557-malware-sample-suspected-crypto-stealer/ (account required)
! my analysis: https://tria.ge/230629-tq712aeb59/behavioral1
||infinitycrypto.app^
||store1.gofile.io/download/direct/d8c2a667-c088-4a39-9cdd-efe0b47d735c/InfinityWallet-Setup.exe^
||infinitywallet-dapps.b-cdn.net^
||167.86.74.95^

! https://github.com/uBlockOrigin/uAssets/pull/18686
||roundyearfun.com^

! https://github.com/uBlockOrigin/uAssets/issues/18678
||nekogram.org^
||t188telegram.xyz^
||websocket40001.hgspz.com^
||netkefu.hgspz.com^
||imganalyze.hgspz.com^
||www.tellegrom.xyz^

! https://forums.malwarebytes.com/topic/299589-suspicious-file/ (account required)
! my analysis: https://tria.ge/230630-tngfaseg9t/behavioral1
||biustargamez.itch.io^
||213.255.247.174^

! https://forums.malwarebytes.com/topic/299435-help-with-redirects-on-my-google-browser/
||searchokay.com^
||srvtrck.com^
||r.srvtrck.com^
! malware infection:
! Edge Extension: (Apps) - C:\Users\User2\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pejhfhcoekcajgokallhmklcjkkeemgj [2023-06-24] [UpdateUrl:hxxps://extappupdate.com/crx/updates.xml] <==== ATTENTION
! Edge HKLM\...\Edge\Extension: [pejhfhcoekcajgokallhmklcjkkeemgj] - C:\\apps.crx [2022-11-27]
! CHR Extension: (Apps) - C:\Users\User2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pejhfhcoekcajgokallhmklcjkkeemgj [2023-06-24] [UpdateUrl:hxxps://extappupdate.com/crx/updates.xml] <==== ATTENTION
||extappupdate.com^
! CHR DefaultSearchURL: Profile 1 -> hxxps://find.fnavigate-now.com/results.aspx?d=092122&n=9998&q={searchTerms}&gd=RD1002806&searchsource=58
||find.fnavigate-now.com^

! https://tria.ge/230707-zfx1zacf4s/behavioral1
! https://tria.ge/230709-z9e29aga59/behavioral1
! https://tria.ge/230711-xsyf6abf3y/behavioral2
||5.42.86.86^
||77.105.147.158^

! https://virustotal.com/gui/url/ff883d9b80c27b78b2b303c12d3e57d5a2664ac35ccf41fdd6bbdbfbb97b613f/community (credit to IceFlame)
! my analysis: https://app.any.run/tasks/c386fa43-f566-4df4-a7d9-61f387da92f3
||southbayleadgen.com^

! https://app.any.run/tasks/2e736410-ed5d-4c7e-9eb2-79ee3c578f37
||ezsoftware.fun^
! https://tria.ge/230710-yhtkwsec9y/behavioral2
||185.106.93.193^

! https://github.com/AdguardTeam/AdguardFilters/issues/155936
||truanet.com^

! https://www.malwarebytes.com/blog/threat-intelligence/2023/07/malicious-ad-for-usps-phishes-for-jpmorgan-chase-credentials
||logictrackngs.com^
||super-trackings.com^
||web-trackings.com^
||tracks4me.biz^
||forgetrackng.com^

! https://virustotal.com/gui/url/18581d709d6be180d2cd174b888202020b54b086aa1efc9365ea6ebf742d0217
! my analysis: https://app.any.run/tasks/827c21c1-e63b-4fad-9000-2955bc5b81e3
||chijkkkll.pages.dev^
||decentrall.online^

! https://tria.ge/230711-tmceyshg22/behavioral2
||thepcworlds.com^
||tdamassoficial.com^
||t.me/rifbef734frbe43jfef^
||t.me/eagl3z^
||193.27.90.10^
||5.75.211.167^

! https://tria.ge/230711-yl3yqsaf52/behavioral1
! https://tria.ge/230711-1gyjkaag79/behavioral1
||reserchvpn.com^

! https://app.any.run/tasks/5de2b47e-fc4e-489b-a6b6-04454c4b61de
! https://tria.ge/230711-1xcxssbh5z/behavioral1
||razesoft.mdetecnologia.com^

! infected VM
||lvsgj.ourmarketingefi.info^
||allcommonstories.com^
||m.allcommonstories.com^

! https://github.com/uBlockOrigin/uAssets/issues/18963
||fitgirl-repack.com^

! https://forums.malwarebytes.com/topic/300219-outbound-traffic-alerts-from-malwarebytes/
! not my analysis: https://app.any.run/tasks/586f952d-141e-4dae-a4c4-73523cde2f5a/
! not my analysis: https://app.any.run/tasks/523b7f48-dae3-4854-b944-1facb01f8645/
||62.182.156.148^
! https://forums.malwarebytes.com/topic/301834-pretty-sure-i-have-a-nasty-rat-msbuild-outgoing-being-blocked-constantly/
||spexjs.com^

! https://app.any.run/tasks/1aabe39d-a1f9-41e4-81b3-9e84a174ffc5
||95.216.94.138^

! malware download
||kellmda.click^

! many malware YouTube videos
||te.legra.ph/Download-07-02-11^
||telegra.ph/Download-07-02-11^

! malware
||lorealis.vip^

! https://tria.ge/230717-phq1bscd4y/behavioral2
||85.208.139.35^
||95.216.94.138^

! https://urlhaus.abuse.ch/url/2684551/
||updateadobeflash.website^

! https://www.bleepingcomputer.com/news/security/hackers-exploiting-critical-wordpress-woocommerce-payments-bug/
||194.169.175.93^

! https://github.com/hagezi/dns-blocklists/issues/1327
||bgrfmi.com^
||bpdnct.com^
||bphfmm.com^
||eweukr.com^
||gycqna.com^
||hcafpg.com^
||ingzhe.com^
||irtvro.com^
||jggjh.com^
||mnawew.com^
||nlxini.com^
||nvcrcf.com^
||qmsvnh.com^
||ritedn.com^
||rrtype.com^
||vgrcxa.com^
||vgsksc.com^
||whcfmp.com^
||xyzgnc.com^
||ybcgju.com^
||jhzhis.com^
||udwuyw.com^
||zayatr.com^

! https://forums.malwarebytes.com/topic/300300-inbound-connections-attempts-sfc-found-corrupt-files-am-i-infected/
||zappiehost.com^
||tchangway.hk^

! https://virustotal.com/gui/url/044d4e3d1e58f48e42cfb936d6ce3ab244bc85b8f0b1d5a84f3916584156bbd2/community
! my analysis: https://app.any.run/tasks/9ead09a0-6f56-477b-8a27-9a85c5a803e6
||bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou.ipfs.dweb.link^
||lkalzzop.online^

! https://virustotal.com/gui/url/1696219caa54a048bb1fa0c1e95aaf80b7336ddcbdcca5a2c24ae2847a62cd03/community
! https://app.any.run/tasks/bce8c275-c977-46ee-bf0b-df5b0d9b2386
||softwarextra.com^
! https://tria.ge/230720-29xy6sba84/behavioral1
||tds-packages-update.com^
||168.119.178.159^

! https://virustotal.com/gui/url/b3657b1279397010fa1735997ddd8605ff2093d50147387b5bf2ef5abace0509/community
! my analysis: https://tria.ge/230720-3lb78sbb48/behavioral1
||tracking-express-ups.com^

! malware download: https://virustotal.com/gui/url/8d6014420a75e2f33b9a2c1c2e33984df5e6ce0a178c8275af498251f02f1500/detection
||nht42we.click^
||3efrewss.click^
! https://tria.ge/230721-y239fahc9y/behavioral2
||gstatic-node.io^
! https://virustotal.com/gui/url/ad56257de36b1955113d7894423cc4d5b37d07ed5ade66b1fad5e73b830b1467/detection
||freesoftonic.cc^
||kitchx.click^
||ki8hy78.click^

! not my analysis: https://tria.ge/230721-bh1mwaca9x/behavioral2 (credit to Neiki)
||cdn-prok.site^

! https://tria.ge/230719-sww1aahh3z/behavioral2
||igsufb.top^

! https://app.any.run/tasks/87d4e9bb-6697-4a2e-9323-fa5b403ed161/ (not my analysis)
! my analysis: https://tria.ge/230723-pzsv9aef9y/behavioral2
||45.9.74.141^
||45.9.74.166^

! not my analysis: https://tria.ge/230723-zxzacshc8y/behavioral1
||168.119.51.197^

! https://github.com/blocklistproject/Lists/issues/1051
||posthu-parcel.com^

! https://tria.ge/230724-w9z6mshb5t/behavioral1
||fast.dope.autos^
||gesmart.site^
||sanseemp.com^
||upgrade-phone.club^
! https://virustotal.com/gui/ip-address/207.154.243.69/relations
||update-smart.club^
||cleaner-update.club^
||speedupdate.club^
||good-update.club^

! https://forums.malwarebytes.com/topic/300624-trojan-scr/ (account required)
||eclatearns.documentbusinesses.online^
||documentbusinesses.online^

! https://virustotal.com/gui/url/f62b759f779f1c100fb67073edc12ccf1c955466603fbecac871e8942d1d6c04/community
! my analysis: https://app.any.run/tasks/d8e8ee8f-9132-4adf-a656-db398ff6570b/
||formulagile.xyz^

! https://forums.malwarebytes.com/topic/300693-fake-steam-login/ (account required)
||csgofloat.br.com^

! https://virustotal.com/gui/file/48987d9c89542a8cb4f8d34eb34902a4762cc8643c0e491deb6115907db4887b/detection
||licensevilla.com^
||kemmakhao.click^
||24.199.69.78^
! https://tria.ge/230730-23lybsbf53/behavioral2
||trapmusics.xyz^
||hopvibestravel.co.za^
||49.13.60.242^

! https://github.com/uBlockOrigin/uAssets/issues/19248
! https://www.reddit.com/r/uBlockOrigin/comments/15hxgnd/why_ublock_blocks_revanced/
||revanced.net^

! https://forums.malwarebytes.com/topic/300835-infected-android-chrome-popups-sycaratecom-and-psequeldegastecom/
||psequeldegaste.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/648114
! https://tria.ge/230805-s5szzsde27/behavioral1
||thehipsteragency.com^

! https://github.com/uBlockOrigin/uAssets/issues/19287
||keen-chaussure.fr^
||keen-france.fr^
||keenshoesfrance.com^
||keenfrance.fr^
||keen-fr.com^
||keen-chaussures.com^
||keenfrancefr.com^
||keenfr.com^
||keen-chaussures.fr^

! https://github.com/hagezi/dns-blocklists/pull/1405
||pnsys.info^
||drto.info^

! https://tria.ge/230810-1l7ysshc39/behavioral1
||dowloadkeepfilezzz.website^
||dowloadslek2.website^$popup

! https://virustotal.com/gui/url/5e2bca9dd17e62cc262c1b690311a5585dc8833be8907012560f875948cd1b56/community
||firebasestorage.googleapis.com/v0/b/atualizarcontratos.appspot.com/o/WEBLOCK01.html
! my analysis: https://tria.ge/230815-ntkr1scd9z/behavioral1
||gerentesbp.live^

! https://forums.malwarebytes.com/topic/301391-can-you-check-if-im-infected/
! https://forums.malwarebytes.com/topic/301390-possible-malware-ransomware-targetting-digital-ads-managers/ (account required)
! https://tria.ge/230819-mm3htaaf9x/behavioral1
||dropbox.com/scl/fi/r3firsxixp8h4qv69gurt/A.Objectives-of-Facebook-Marketing-AD-Campaign-2023-NEW-Obag-Handbags.zip

! https://0xacab.org/my-privacy-dns/matrix/-/issues/651731
! https://tria.ge/230819-2dtlwaeb3w/behavioral1
||ttschmidt.de^
||ionos.es.ttschmidt.de^
||mail.ionos.es.ttschmidt.de^
||www.mail.ionos.es.ttschmidt.de^

! https://virustotal.com/gui/url/1047e6ba16911079c6d9864f20014160a6f8595fcc9bec477e969ea9aee02e75/community
! my analysis: https://tria.ge/230821-m1ph4seb6w/behavioral1
||tfdee.tempurl.host^

! https://github.com/hagezi/dns-blocklists/issues/1467
! https://tria.ge/230824-njm5dsdg2z/behavioral1
||revanced.info^

! https://virustotal.com/gui/url/9a4ac61a77f8bbf751b94f4ba1d0196cce57cf3bb5cb05fb030033ae42c7e67d/community
! my analysis: https://tria.ge/230829-mw1qksfa41/behavioral1
||changzhoujijinxuexi.cn^
||qftwpl.icu^

! https://www.bleepingcomputer.com/news/security/childrens-snack-recalled-after-its-website-caught-serving-porn/
||appykidsco.com^

! https://github.com/hagezi/dns-blocklists/issues/1532
||corrpls-it-cl.top^

! https://www.youtube.com/watch?v=DUbemJF_3zE

! https://www.bleepingcomputer.com/news/security/evil-telegram-android-apps-on-google-play-infected-60k-with-spyware/
||telegrnm.org^
||sg.telegrnm.org^

! https://www.bleepingcomputer.com/news/security/free-download-manager-site-redirected-linux-users-to-malware-for-years/
||fdmpkg.org^
||deb.fdmpkg.org^

! from DandelionSprout
||mobiilipaivitys.com^

! https://github.com/hagezi/dns-blocklists/issues/1574
||blogspot.edolio5.com^
||pdfviewer.app^
||efsyn.news^
||zougla.news^
||tvxs.news^
||lubentv.com^
||emvolio-gov.gr^

! https://github.com/AdguardTeam/AdguardFilters/issues/161711
||yourfirstfunnelchallenge.com^

! https://github.com/libre-tube/LibreTube/issues/4409#issuecomment-1722268425
||libretube.app^

! https://virustotal.com/gui/url/51a5c613fa07f8301aa68fa16e7307dbf3bf0b0dcfa015632895d7ebf7ca36d3/community
! my analysis: https://tria.ge/230918-nj1eqagh7x/behavioral1
||bookingcomdetails.blogspot.com^

! from alex-302 (https://listauthorschat.slack.com/archives/C010PK1A022/p1695126381709399)
||urnigarted.com^

! from ryanbr (https://listauthorschat.slack.com/archives/C05G8V3NERH/p1695384508520369)
! https://infosec.exchange/@iampytest1/111110261616364360
! https://github.com/AdguardTeam/AdGuardSDNSFilter/issues/1488
!!! ||bsc-dataseed1.binance.org^
||ioiubby73b1n.com^

! https://github.com/hagezi/dns-blocklists/issues/1615
||zlibrary-africa.se^

! https://infosec.exchange/@iampytest1/111128685460057192
||uspscd.com^

! https://github.com/hagezi/dns-blocklists/issues/1631
||nightnitroglass.com^
||whitelinetosplit.com^
||from.whitelinetosplit.com^
||bluesmallbutterfly.com^
||0.bluesmallbutterfly.com^

! https://www.bleepingcomputer.com/news/security/fake-bitwarden-sites-push-new-zenrat-password-stealing-malware/
||bitwariden.com^
||crazygameis.com^

! https://github.com/hagezi/dns-blocklists/issues/1640
||uskjnx.top^
||usplod.top^

! https://github.com/DandelionSprout/adfilt/discussions/779#discussioncomment-7137675
||pl.coe777.com^
||86pmafno21mst.com^
||ostrowlubelski.pl^$removeheader=location

! https://virustotal.com/gui/domain/login-office365.info/community
||login-office365.info^

! https://virustotal.com/gui/url/69605c3cbd15c8e60dd1f96874f84ae23c73c87bcba7e2b9273e43262f38f2c9/community
! my analysis: https://tria.ge/231002-nx5xcshg8s/behavioral1
||tr22k8eo3d4l9rtt7ezm.uv2y.ru^

! https://web.archive.org/web/20231002133931/https://forums.malwarebytes.com/topic/302965-rtp-detection-trojan/
||178.20.47.114^

! https://github.com/dhowe/AdNauseam/issues/2405
! my analysis: https://tria.ge/231002-r1qtdsbf71/behavioral1
||reepittens.com^
! my analysis: https://tria.ge/231002-r3eh5sbf9y/behavioral1
||torixibre.com^
||qyt8pi.torixibre.com^
! my analysis: https://tria.ge/231002-r6zcqadd47/behavioral1
||anybodyproper.com^
||violationphysics.click^
! my analysis: https://tria.ge/231002-r8fndsdd57/behavioral1
||buadss.com^
||dateadore.com^

! https://github.com/hagezi/dns-blocklists/issues/1652
||scribdbook.top^
||librilibs.com^
||dleggere.com^
||mujib-store28.blogspot.com^
! my analysis: https://tria.ge/231002-w6m2xadg3s/behavioral1
||xn4iqv.succyarthyry.com^
! https://virustotal.com/gui/domain/succyarthyry.com/relations
||kxkxgw.succyarthyry.com^
||581358.succyarthyry.com^
||2ntrfi.succyarthyry.com^
||fjvv2i.succyarthyry.com^
||hyjecr.succyarthyry.com^
||mkhvuv.succyarthyry.com^
||37yito.succyarthyry.com^
||0wvghk.succyarthyry.com^
||invv7n.succyarthyry.com^
||nze0xw.succyarthyry.com^
||ixzc4t.succyarthyry.com^
||bdhze4.succyarthyry.com^
||hzgsp3.succyarthyry.com^
||qwwnvw.succyarthyry.com^

! https://urlhaus.abuse.ch/url/2716031/
! my analysis: https://tria.ge/231003-neebpaca39/behavioral1
||meshitislaw.com^
||uploaddeimagens.com.br^
||coloradokibosafarihostel.co.tz^

! https://urlhaus.abuse.ch/url/2716407/
! my analysis: https://tria.ge/231004-va4t4sdb3x/behavioral1
||qpurrybeatmecamtest.ddns.net^
||www.transportesevaristomadero.com/profilecontent/*.exe

! https://virustotal.com/gui/file/3b08d4a26c787252cf1a485ae91982e9afd5bee4324402737dcb519b68a1c224/relations
! added after email - unsure where I found this in the first place
||millionjobs.works^

! https://github.com/libre-tube/LibreTube/issues/4409
||libretube.net^
||libretube.
||libretubeapk.

! https://securityintelligence.com/posts/x-force-uncovers-global-netscaler-gateway-credential-harvesting-campaign/
||jscloud.ink^
||jscloud.live^
||jscloud.biz^
||jscdn.biz^
||cloudjs.live^

! https://virustotal.com/gui/url/c7f655bd7dfc420f022a96a30214460372a6ab74d6ed24ada16809bb9bf3dfa8/community
! my analysis: https://web.archive.org/web/https://tria.ge/231008-w9akzsfb7v/behavioral1
||weibo-b5game.com^

! https://tria.ge/231009-m46lssed76/behavioral1 (cloudflared)
||videocampaign.co^
||myreloads.com^
||viimsical.com^
||s.viimsical.com^$popup
||inroadslab.com^
||happeningurinepomposity.com^
||instantgreenapp.com^
||free.instantgreenapp.com^
||secure.instantgreenapp.com^

! https://github.com/uBlockOrigin/uAssets/issues/20036
||www.ssp.sp.gov.br/ead/report/video/video_
||www.ssp.sp.gov.br/ead/auth/video/video_
||googleseo.life^
||js.eventbr.xyz/vip/crazy.js
||br.zmdesf.cn/br.js
||a5jogo.club^
||v37870.com^
||coe777.com^
||sites.uft.edu.br/topama/news.php
||pmf.sc.gov.br/arquivos/br.php^
! https://web.archive.org/web/20231010220704/https://tria.ge/231010-1rdl5sfg68/behavioral1
||tiger.qnews.media^$third-party
||imbolexabc.top^
||s8bet.com^

! https://www.fortinet.com/blog/threat-research/Iz1h9-campaign-enhances-arsenal-with-scores-of-exploits
||194.180.48.100^
||2.56.59.215^
||212.192.241.72^

! https://tria.ge/231014-mgpprscc8y/behavioral1
||unawarelinkedlaid.com^
||unacceptableironicaldrone.com^
||suchbasementdarn.com^
||beakerweedjazz.com^
||pcsafetysurvey.com^
||veritiesgarlejobade.com^
||amazingcontent.site^
||loading.amazingcontent.site^
||6chd.loading.amazingcontent.site^
||cadrctlnk.com^
||clickmint3.online^
||e9a53154b4.com^
||50b1f7a005.e9a53154b4.com^
||systemsecurity.click^
||i39ay.top^
||pupur.pro^
||alleubreakyailb.click^
||karoon.xyz^
||eu.karoon.xyz^
||kident.xyz^
||news-sitogi.com^

! https://github.com/hagezi/dns-blocklists/issues/1703
||metabrastaxenis.com^
||ouisuamprert.com^
||scincormatize.com^
||nobistech.net^

! https://github.com/hagezi/dns-blocklists/issues/1706
||qlsn5.ru.com^

! https://github.com/durablenapkin/scamblocklist/issues/66
||arduino.uk.eu.org^

! https://github.com/hagezi/dns-blocklists/issues/1708
||bestcrutches.com^

! https://infosec.exchange/@briankrebs/111261826129123343
! https://arstechnica.com/security/2023/10/google-hosted-malvertising-leads-to-fake-keepass-site-that-looks-genuine/
||ķeepass.info^
||ķeepass.

! https://forums.malwarebytes.com/topic/303708-worried-about-drive-by-download-from-typoed-address/ (parked)
||oldreddit.com^

! https://virustotal.com/gui/url/7fac2ed0a0a33321bb46c53455d754d0275f23f747d437aa7fb5080dc722c59e/community
||qrone1vs.top^

! https://forums.malwarebytes.com/topic/303710-caspolexe-causing-website-blocked-due-to-riskware-in-malwarebytes/
||iniwork.4cloud.click^

! https://tria.ge/231022-r7pjxahh3w/behavioral1
||idolforloves.sbs^

! https://github.com/hagezi/dns-blocklists/issues/1744
! https://github.com/uBlockOrigin/uAssets/pull/20247
||magiskzip.net^
||magiskmanagerroot.com^
! https://github.com/topjohnwu/Magisk/issues/3435
||magisk.download^
||magiskmanager.com^
||magisk.
||magiskzip.
||magiskmanagerroot.
||magiskmanager.
||magiskcn.
||magiskroot.
||magiskapp.
! something I found
||magisk.info^

! https://github.com/hagezi/dns-blocklists/issues/1743
||securescanmtde.com^

! fake

! https://github.com/durablenapkin/scamblocklist/issues/68
! https://tria.ge/231023-1xm3rsaa86/behavioral1
||ninzatool.pw^
||powerboostup.com^
||www.ontajdu3js.com^
||arty2night.com^
||p.arty2night.com^
||quiztionnaire.biz^
||iphone.quiztionnaire.biz^
||offer-select.com^
||rewardflux.com^
||app.rewardflux.com^

! https://infosec.exchange/@iampytest1/111292640449421381
! https://tria.ge/231024-3lc5jace3w/behavioral1
||herew-lmq.com^
||findbestop.com^
||kenant.xyz^
||thefinanceadvice.com^
||adblock1.com^
||install.adblock1.com^
||newupdatesnow.com^

! https://forums.malwarebytes.com/topic/303782-new-threat-it-downloads-two-rar-files/#comment-1596622 (account required)
! https://forums.malwarebytes.com/topic/303784-malicious-script/ (account required)
! my analysis: https://tria.ge/231025-ner8jsgh51/behavioral1
||dms1708.art^
||154.223.16.114^$third-party
||oliga.canadacentral.cloudapp.azure.com^
||dropbox.com/scl/fi/q0wq1lha5o0rkgdy9rdr4/m.zip

! https://tria.ge/231025-nk2zyagh81/behavioral1
||set4theupdatesforever.click^
||supportversion.set4theupdatesforever.click^
||goads.pro^

! https://github.com/paulgb/BarbBlock/issues/41
||bblck.me^

! https://github.com/braveinnovators/url-blocklist/issues/3#issuecomment-1783421420
||perevod-a.shop^

! https://tria.ge/231027-2hkvjaae4w/behavioral1
||ad-blocking24.net^
||dwnld-here.com^
||thatmonkeybites3.com^
||download-portal-now.com^
||kerant.xyz^

! https://forums.malwarebytes.com/topic/303877-trojanbitcoinminer-cant-be-removed/
! https://virustotal.com/gui/file/1045127280b64e5d8e7af1efc347089f759860222f1373349d8c4aa1449918db/relations
||stratum-eu.rplant.xyz^

! https://tria.ge/231102-m8cjhsch24/behavioral1
||walknotice.com^
||thedentadsi24.com^

! https://github.com/uBlockOrigin/uAssets/issues/20389
||ruiukp.top^

! https://virustotal.com/gui/url/6afece7c72420223ae6f1700d02c8bee4806a335d23ab120522accba5e45250d
! my analysis: https://tria.ge/231102-nctnlach68/behavioral1
||synergyproz.com^
||apparaatbeheer-online-abnamro-icscards.codeanyapp.com^
||apparaatbeheer-online-abnamro-icscards.

! https://bazaar.abuse.ch/sample/b842080ef401cb64de4b9c7d823ef60b0ed4f4bbd42431fbf26db940ece9f4f1/
! my analysis: https://tria.ge/231102-nggjtsch93/behavioral2
||mouseoiet.fun^

! https://bazaar.abuse.ch/sample/9fbd818dc28ea5561278e873bd9b6deb896d4fbaac86209903bdeaad55c6c31a/
! my analysis: https://tria.ge/231102-npbnjsda74/behavioral2
||ddos.dnsnb8.net^

! https://www.bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey
||109.230.199.181^
||185.141.63.172^
||193.242.211.141^
||212.8.242.211^
||109.236.85.145^
||190.2.135.77^
||151.80.38.159^
||217.23.6.51^
||217.23.9.168^
||37.187.122.227^
||51.159.66.125^
||109.236.88.134^
||datasheet.fun^
||109.236.81.104^
||176.31.254.229^
||185.141.63.2^
||185.141.63.4^
||185.141.63.84^
||185.141.63.85^
||188.165.192.126^
||188.165.192.18^
||188.165.195.130^
||195.154.174.130^
||195.154.176.206^
||195.154.176.209^
||195.154.178.238^
||195.154.188.211^
||195.154.235.51^
||195.154.241.165^
||195.154.242.37^
||195.154.243.38^
||195.154.251.21^
||195.154.251.99^
||195.154.252.221^
||195.154.253.49^
||37.187.142.187^
||37.187.143.172^
||37.187.148.204^
||62.210.204.131^
||88.80.145.110^
||88.80.145.142^
||88.80.147.200^
||88.80.147.205^
||88.80.147.36^
||88.80.148.219^
||88.80.148.33^
||88.80.148.8^
||91.121.171.208^
||91.92.111.131^
||91.92.111.132^
||91.92.111.133^
||91.121.30.185^
||94.23.58.173^
||217.23.5.14^

! https://github.com/durablenapkin/scamblocklist/issues/69
||98kk89.com^
||42gixk.98kk89.com^
||9vzn29.98kk89.com^
||nzxsxn.98kk89.com^
||aaodp.com^
||9vyzdk8.lvditoys.com^
||p8ydfra.lvditoys.com^
||qz94.com^

! https://virustotal.com/gui/url/c80163bbcc0ddd2e27263730a2a2f65ab0f0ede295d8ce0d6c4dc012ca158e44/community
! my analysis: https://tria.ge/231108-15zfrsfd77/behavioral1
||arzo.ge^
||0nlinesigning.groupletter.io^

! https://forums.malwarebytes.com/topic/304272-browser-guard-claiming-malware-on-regular-google-search-pages/
||matchgoalsam.com^

! https://www.malwarebytes.com/blog/threat-intelligence/2023/11/malvertiser-copies-pc-news-site-to-deliver-infostealer
! https://github.com/hagezi/dns-blocklists/issues/1823
||argenferia.com^
||realvnc.pro^
||corporatecomf.online^
||cilrix-corp.pro^
||thecoopmodel.com^
||winscp-apps.online^
||wireshark-app.online^
||cilrix-corporate.online^
||workspace-app.online^
||11234jkhfkujhs.site^
||11234jkhfkujhs.top^
||94.131.111.240^
||81.177.136.179^
||74.119.192.188^

! https://github.com/uBlockOrigin/uAssets/issues/20553
! https://tria.ge/231110-pftcnsgg26/behavioral1
||donwnaloadezzal.cfd^
||downloadlekem.sbs^
||stopadblocker.pro^
||chaffewerbureaks.com^
||videoadblocker-pro.net^

! https://github.com/avast/ioc/pull/56
||bombay.com.ar^
||ultracomb.com.ar^
||limpiadorpucho.com.mx^
||coacalco.gob.mx^
||navarro.gob.ar^
||pruebasbonsai.com.ar^
||pnt.info.pl^
||ilogicinstitute.com^
||my.hoqer.com^
||chapasanpedro.com^
||usesoft.net^
||calzadosiris.com^
||ingenieriainsitu.com^
||paolomorettifurs.com^
||www.fefoncrecer.com^
||autoscuola-momo.ch^
||tcastro.com^
||www.steadyrun.com^
||moussedanslabouche.com^

! https://tria.ge/231112-pprv7sfb9v/behavioral1
||paxert.xyz^
||track.local-hotsite.com^
||downloading-free.com^

! https://github.com/hagezi/dns-blocklists/issues/1819
||anacondastoresaleau.com^
||anacondasale.com^

! https://github.com/hagezi/dns-blocklists/issues/1825
||youcineapp.com^
||magistv.video^
||tele-latino.com^
||telelatino.app^
||youcineapk.org^
||btvapp.net^
||youcine.one^
||youcinetv.app^
||youcinetv.page.link^
||latino9.com^
||fadfatest.pneydn.com^
||pandoramain-1794008345.us-west-2.elb.amazonaws.com^
||romatotti520.oicp.io^
||pandorabackup-1322908155.us-west-2.elb.amazonaws.com^
||pcn.panddna.com^
||ok3.mflve.com^
||apz.bsaldo.com^
||abcr.ftsym1.com^
||fadfa.gdalieyw.com^

! https://github.com/hagezi/dns-blocklists/issues/1824
||more-power-tool.com^
||ryzen-master.com^
||atiflash.ru^
||polaris-bios-editor.ru^
||btc-tools.ru^
||techpowerup-gpu-z.com^
||sapphiretrixx.com^
||srbpolaris.ru^
||clockgen64.com^
||balena-etcher.com^
||nvidiainspector.ru^
||evga-precision.com^
||riva-tuner.com^
||nvflash.ru^
||atikmdagpatcher.com^
||overdriventool.ru^

! https://virustotal.com/gui/url/caf096b6a0f7abe29ad126a21545f49418cc003c298a56ac6c967053483d2748/community
||185.196.9.161^
! https://tria.ge/231118-wbk9tsfb86/behavioral1
||49.13.94.153^
||steamcommunity.com/profiles/76561199571056594^

! https://virustotal.com/gui/domain/miccrossoffit.online/community
||miccrossoffit.online^

! https://github.com/uBlockOrigin/uAssets/issues/20760
||cloudtrck.com^

! https://tria.ge/231119-pvcngaag41/behavioral2
||badbull.pro^

! https://virustotal.com/gui/url/009ab0b4a357017cb0c3f948c04f6a79e5252f4a91511ad28f8a411ec7f4adfb/community
! my analysis: https://tria.ge/231120-pn8gkagg71/behavioral1
||server31.weebly.com^

! https://www.eff.org/deeplinks/2023/11/low-budget-should-not-mean-high-risk-kids-tablet-came-preloaded-sketchyware
||adups.com^
||fota5p.adups.com^

! https://research.checkpoint.com/2023/malware-spotlight-into-the-trash-analyzing-litterdrifter/
||ozaharso.ru^
||nubiumbi.ru^
||acaenaso.ru^
||atonpi.ru^
||suizibel.ru^
||dakareypa.ru^
||ahmozpi.ru^
||nebtoizi.ru^
||squeamish.ru^
||nahtizi.ru^
||crisiumbi.ru^
||arabianos.ru^
||gayado.ru^
||quyenzo.ru^
||credomched.ru^
||lestemps.ru^
||urdevont.ru^
||hoanzo.ru^
||absorbeni.ru^
||aethionemaso.ru^
||aychobanpo.ru^
||ayzakpo.ru^
||badrupi.ru^
||barakapi.ru^
||boskatrem.ru^
||brudimar.ru^
||decorous.ru^
||dumerilipi.ru^
||heartbreaking.ru^
||judicious.ru^
||karoanpa.ru^
||lamentable.ru^
||procellarumbi.ru^
||ragibpo.ru^
||raidla.ru^
||ramizla.ru^
||samiseto.ru^
||superficial.ru^
||talehgi.ru^
||undesirable.ru^
||valefgo.ru^
||vasifgo.ru^
||vilaverde.ru^
||vloperang.ru^
||zerodems.ru^
||geminiso.ru^
||sabirpo.ru^
||andamanos.ru^
||triticumos.ru^

! account required: https://forums.malwarebytes.com/topic/304730-cryptocurrency-scam-12/
||tesla3-model.com^

! https://virustotal.com/gui/url/1af9948601134e81fabeecd7eb553524153396b6f98f26f3062ba0a2f9b3e91f/community
! https://virustotal.com/gui/url/e0bada977a3a1e2da13785d8ab03ebe2111f517aa0431e0162296a3cad739452/community
||213.248.43.54^

! https://virustotal.com/gui/file/e09af83cfccf4bcc8a51fda76e5fa10e9d0d838aededb6f339551f8363797dc2/community (credit to JaffaCakes118)
||listpoints.online^
||retghrtgwtrgtg.bounceme.net^
||listpoints.click^
||datastream.myvnc.com^
||gservicese.com^
||center.onthewifi.com^

! https://virustotal.com/gui/url/a2daa5d31b78d2c0c0fd62acc4eec2c8168f1314a13c4c6be8a3d6a5e3520677/community
! my analysis: https://tria.ge/231121-r47ajsfb34/behavioral1
||activat-webmail-serivico.top^

! https://forums.malwarebytes.com/topic/304802-malware-affecting-chrome/
||abyssalforge.top^
||qltuh.abyssalforge.top^

! https://github.com/RPiList/specials/issues/1353
||khw6g09fx28k.cfd^
||49gw5gonj143k.click^
||djxd2ox30l7.click^
||vtreanext.click^
||theratgamez.com^
||fwkldh.click^
||gyhguflo.click^
||hfjdfurhhd.xyz^
||4rf5tgfdfy.click^
||rt54erdfgh.pro^
||dew3hy6.cfd^
||bgtrjuy6.cfd^
||mjiu876tyh.pro^
||lsdkjh.xyz^
||nafsdwas.click^
||ki987yth.pro^
||d589nenr.cfd^
||mi5cr46kg.click^
||9iujhfre3.cfd^
||asdhkl.click^
||se5vy6.click^
||9iuh5tyh.cfd^
||cvasdf.click^
||vgcj2rzjd.cfd^
||jgtek990e.click^
||nnnsjhsh.click^
||clabzeroby.net^
||cvbnrtgf8u.cfd^
||juy6asert67.click^
||jkghfdt.xyz^
||dfhduh.xyz^
||k50c8s2p7.cfd^
||p0jrmnpr7.cfd^
||jnh4afbw7.click^
||xzr9uauq.cfd^
||1lu98dcf0.cfd^
||bn6h9d7tr.cfd^
||hyt5ytr.click^
||t67uyhgf.co^
||crack4hit.com^
||hit4pc.click^
||4vz6ew1li.cfd^
||exs7oilq14cz6.click^
||3zo0grlgm.cfd^
||7nalhxb28rmm.cfd^
||hjdhhfdh.click^
||dk9vqq64cp14e.click^
||losf8uo304l.click^
||ntxkddng28vq7.cfd^
||kjr3y14yt.click^
||a1lky06jn.cfd^
||l97hha31f8h.cfd^
||cwz20w14xn0.click^
||tnzcwlf284.cfd^
||dialogfosti.click^
||myonlyland.com^
||kinovizbx.xyz^
||hw1ip330zc.click^
||ix1n0li6u7273.cfd^
||vgfrrtc.click^
||vablecable.click^
||jiuppppml.click^
||zvotg9ceh.cfd^
||huqiinxy.click^
||wtechfullsetup.xyz^
||closerscopy.net^
||freeinstallcpc.xyz^
||l1ihpb0dz521ol.cfd^
||nccenbkdr1063.cfd^
||a18n5nh14xos.click^
||b5mtuo30dqu.click^
||galvu301.click^
||5tbyvf27hc.cfd^
||gotechfiles.xyz^
||getintopcc.pro^
||poiqhawq.click^
||ygabgga.click^
||eyhdjyst.click^
||rosterfile4u.click^
||cfmarker.click^
||azxdr4erf.xyz^
||xitrbgq.click^
||ym2f4o2f.cfd^
||cfgy6tg.pro^
||hji98ik.click^
||pqlbh88z7.cfd^
||i3s5qfuvs.cfd^
! missing from list
||topkeygen.com^
||piratesfile.com^
||rootscrack.com^
||cracksmat.com^
||crackedsoft.org^
||crackxpoint.com^
||crackerzpro.org^
||crackfinal.com^
||wazusoft.com^
||crackzoom.com^
||activators4windows.com^

! https://github.com/RPiList/specials/issues/1351
||klassischefahrschule.com^

! not my analysis: https://tria.ge/231123-1wzp6sde7z/behavioral1
||marinhoassessoria.com^

! https://github.com/hagezi/dns-blocklists/issues/1864
||revanced.to^

! https://virustotal.com/gui/url/ecf1a475d84de38187831b4fb25167812117ea7b4ab22ce46dc6d36d822004fd/community
! https://virustotal.com/gui/url/fbc0e8828a4d86410e1c3fbf698bdda7e3e3c8d0ff1785adcfec181c967426ca/community
||67.217.57.54^
||89.190.156.180^

! https://virustotal.com/gui/url/f28bcf22fbd189fd87322da0b915ce32a700ed1bccd53f1e21552c04a8c2d229/community
||servegame.com^
||modulo.servegame.com^

! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7694946
||easypark-id.com^
||easypark-no.org^

! https://www.malwarebytes.com/blog/threat-intelligence/2023/11/associated-press-espn-cbs-among-top-sites-serving-fake-virus-alerts
||octob.azureedge.net^
||lzi.azureedge.net^
||tinlc.azureedge.net^
||bm-rb.azureedge.net^
||foluo.azureedge.net^
||vpv-ger.azureedge.net^
||trackmaster.cc^
||protectsystemtools.life^
||securitypatch.life^
||real-time-system-monitoring.life^
||threatdetectorhub.life^
||threatdetectorhub.online^
||vulnerabilityassessments.life^
||strike-it-lucky.space^
||golden-opportunity.xyz^
||stroke-of-luck.xyz^
||blessed-with-luck.space^
||system-scan-tool.space^
||system-security-scan.buzz^
||system-security-scan.net^
||system-scan-tool.online^
||trk6.kokamedia.com^
||tracklinker.space^
||trackmenow.life^
||trackify.world^
||trackinghub.info^
||trkmyclk.xyz^
||trk-server.xyz^
||34.74.68.195^
||systemmeasures.life^
||xyzcreators.xyz^

! https://github.com/AdguardTeam/AdguardFilters/issues/167470 (from ghajini)
||hotkabachok.com^

! https://github.com/durablenapkin/scamblocklist/issues/71
||dbmobile-phototan.de^

! https://virustotal.com/gui/url/69a1570512a5694049a9444ab6c0dd73432f3685894eb3d4d1e7dba7ce99766d/community
||ne-correos.top^

! account required: https://forums.malwarebytes.com/topic/305116-fake-software-homepage/
||unikey.vn^

! https://cert.gov.ua/article/6276584
||104.194.130.185^
||109.234.156.180^
||128.140.123.187^
||149.248.76.158^
||152.89.198.77^
||193.106.175.11^
||195.85.115.195^
||212.193.48.80^
||213.227.154.170^
||217.12.206.218^
||45.129.14.157^
||45.143.136.123^
||45.144.28.76^
||45.87.154.158^
||78.24.222.162^
||85.208.107.228^
||91.203.193.162^

! https://github.com/hagezi/dns-blocklists/issues/1893
||register.akamaized.ca^

! https://github.com/hagezi/dns-blocklists/issues/1899
||online-cloud.info^
||store5.gofile.io^

! https://github.com/RPiList/specials/issues/1373
||tintinsolve.fun^

! https://github.com/RPiList/specials/issues/1372
||marricoyes.online^

! https://github.com/hagezi/dns-blocklists/issues/1905
||ycybdp.com^

! https://forums.malwarebytes.com/topic/305420-website-blocked-due-to-malware-microsoft-windows-as-stopped-responding/
! https://threatfox.abuse.ch/ioc/1140249/
||194.26.135.180^

! https://github.com/hagezi/dns-blocklists/issues/1932
||demoncitygame.000webhostapp.com^

! https://github.com/hagezi/dns-blocklists/issues/1909
||up-nowservice.com^

! https://github.com/hagezi/dns-blocklists/issues/1935
||ihrkontosichern.eu^

! https://infosec.exchange/@iampytest1/111568435119045533
||fraavy.com^

! https://virustotal.com/gui/domain/base-usps.top/community
||base-usps.top^

! https://virustotal.com/gui/url/2670873ba07eea2c617ad3e34284bdea56730cd83ae70dd84b7c333b027f4ce7/community
||121.37.215.155^

! https://github.com/RPiList/specials/issues/1377
||pertidose.site^

! https://github.com/RPiList/specials/issues/1378
||verstolini.site^

! https://virustotal.com/gui/file/c9491f5eb282daf6b536f515cc9e1032af62919e727442c4e7ecbca2e9d8f8b0/community
||91.215.85.23^
||89.23.98.92^

! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7872103
||betzykrisesenter.no^
||citra2010oslo.no^
||digiter.no^
||easydisplay.no^
||kjaerra.no^
||kontrast1.no^
||norskmatkultur.no^
||norskoffroadteknikk.no^
||nyematoghelse.no^
||securmarksykkel.no^
||thecoolgirl.no^
||topshineauto.no^
||vossblues.no^
||yttersiden.no^

! https://github.com/gchq/CyberChef/issues/1668
||forensicswiki.xyz^

! https://virustotal.com/gui/url/c367518781d3ec29f156e24ee04c24c0f54bd5c3467812f6cd56dc791f8beea8/community
||thumbzoner.com^
! https://tria.ge/231220-abydhaadfn/behavioral1
||offalrouts.xyz^
||mirrorvine.store^
! https://tria.ge/231220-abydhaadfn/behavioral2
||pushub.net^

! https://github.com/DandelionSprout/adfilt/discussions/932#discussioncomment-7873648
||monetrizer.online^
||monetrizer.com^

! https://github.com/RPiList/specials/issues/1398
||deutschebank-kundendienst.comidrekt.net^
||comidrekt.net^

! https://github.com/hagezi/dns-blocklists/issues/1977
||energie-portal-24.de^

! https://github.com/RPiList/specials/issues/1395
||streamjumpstart.com^

! https://github.com/RPiList/specials/issues/1396
||thebeneclinic.com^

! https://github.com/hagezi/dns-blocklists/issues/1986
||energieausweis-online-erstellen.de^

! https://tria.ge/231227-yrr4esfbh5/behavioral1 (cloudflared)
||givelabs.monster^

! https://www.bleepingcomputer.com/news/security/blockchain-devs-wallet-emptied-in-job-interview-using-npm-package/
||flickthebean.onrender.com^

! https://tria.ge/231228-w2dyfafadq/behavioral1
||fitgirl-repacks.to^
||fitgirl-repacks.
||mediatrackerr.com^

! https://github.com/RPiList/specials/issues/1405
||casinos-austria.install-app.com^

! https://tria.ge/231229-pvf1wshae9/behavioral1 (CloudFlared)
||haxnode.net^
||cleinpuz.cfd^
||tech-pros.pro^

! https://github.com/uBlockOrigin/uAssets/pull/21658
||fitgirlrepackz.com^
||fitgirlrepackz.

! https://threatfox.abuse.ch/ioc/1226308/
||updates.adobe-soft.

! https://tria.ge/231229-2sx8lscch5/behavioral2 (CloudFlared)
||liwishacks.com^
||reviveincapablewew.pw^
||opposesicknessopw.pw^
||politefrightenpowoa.pw^
||chincenterblandwka.pw^

! https://forums.malwarebytes.com/topic/306164-phishing-wells-fargo/ (account required)
||lnformationalerts.info^

! https://github.com/RPiList/specials/issues/1407
||zustellungkontrolle.net^

! https://github.com/RPiList/specials/issues/1411
||sanityflash.mom^

! https://virustotal.com/gui/url/c7677f1b43e9b266a4542936cd947e0ccc89cf59c6270aaf2baad4de47e3ae8f/community
||89.23.96.177^
! https://tria.ge/240106-v9k62secc5/behavioral1
||91.215.85.23^

! https://github.com/RPiList/specials/issues/1413
||msdownloadhub.mdx-ux.com^

! https://github.com/hagezi/dns-blocklists/issues/2017
! https://github.com/badmojr/1Hosts/issues/1655
! https://github.com/StevenBlack/hosts/issues/2552
||duchessefit.com^

! https://github.com/Dogino/Discord-Phishing-URLs/pull/25
||steamcommuaity.com^

! https://virustotal.com/gui/domain/booking.com-panel.com
! https://virustotal.com/gui/url/c81a065a1344395a7329764a30729280dfd01f6ccb18fedb692d1b21590e614c
||com-panel.com^
||booking.com-panel.com^
||mail.com-panel.com^
! https://virustotal.com/gui/ip-address/158.160.5.182/relations
||account-booking-pulseapp.com^
||admin-login-account.com^
||extranet-admin.com^
||booking-admins.com^
||158.160.5.182^

! https://github.com/RPiList/specials/issues/1420
||galactiq.life^
||mediago.io^
||sehprotokoll.com^
||smartlifeguides.top^
||kleinezeitung.co^
||gesundheitleber.com^
||oe24.co^
||busterry.com^
||bullionbreeze.xyz^

! https://github.com/avast/ioc/pull/57
||185.215.113.66^

! https://virustotal.com/gui/url/3828695bc16bb9d0bfab17eb5c15e5fe9e8b30bb6cb948655a6a55466b9dc187/community
||telegcrmz.fit^
! https://virustotal.com/gui/url/53efa35943a9b0bbcc4f966791e992052ac647a883c81a43bb86dd94bbbbd48d/community
||telegcrmz.work^
||telegcrmz.
! https://virustotal.com/gui/url/cf88de3dc23272e078a7412c64b12e038cd8b9dc1beb07be6ac3f017919aa09b/community
||telejracm.fit^
||telejracm.
! https://www.virustotal.com/gui/ip-address/103.119.3.17/relations
||www.telegreem.club^
||telejracm.work^
||telejracm.club^
||telejrzmn.cc^
||teleptrm.fit^
||teleptrm.work^
||telegzzem.club^
||telegzzem.fit^
||telegzzem.work^
||telegrnne.work^
||telegrnne.fit^
||telegrnne.club^
||telegcrmz.club^
||telegreem.club^
||telegreem.work^
||telegreem.vip^
||telejrzmn.work^
||telejrzmn.club^
||telegcrenn.fit^
||telegcrenn.club^
||telegrczm.work^
||telegrczm.fit^
||teleggcam.club^
||teleggcam.fit^
||teleggcam.work^
||www.telegceam.club^
||www.teleqpcam.club^
||teleqrinm.cn^
||teleqrinm.com.cn^
||www.teleqpamn.work^
||www.teleqrinm.club^
||www.teleqpcam.work^
||teleqpcam.work^
||teleqpcam.club^
||teleqpcam.fit^
||teleprannn.cc^
||telegbrm.work^
||telegbrm.club^
||telebriun.work^
||teleqpcn.fit^
||teleqpcn.club^
||teleqpcn.work^
||teleqrenm.cc^
||teleqpamn.fit^
||teleqpamn.club^
||teleqpamn.work^
||teleqrinm.club^
||teleqernm.cc^
||www.teleprium.fit^
||teleprannn.vip^
||teleprannn.club^
||www.teleqernm.fit^
||telegceam.club^
||telegceam.work^
||teleppram.club^
||teleqrenm.work^
||teleqrenm.club^
||www.telegczim.work^
||www.telegczim.vip^
||telegrcmn.cc^
||teletrean.cc^
||telegruim.top^
||telegczim.work^
||telegczim.club^
||telegczim.vip^
||www.telegczm.vip^
||teleprium.fit^
||teleprium.work^
||teleprium.club^
||www.telegczm.fit^
||telepamn.cc^
||telegczm.vip^
||telegczm.club^
||telegczm.fit^
||tgelegrean.cc^
||teleqriem.vip^
||telegpem.club^
||telegirmn.vip^
||telebrzm.vip^
||teleqcmn.work^
||teleqcmn.fit^
||teleqcmn.club^
||teleqernm.fit^
||teleqernm.club^
||telegirmn.cn^
||www.telegirmn.cn^
||telegwam.work^
||www.telegwam.work^
||telegcmn.cc^
||teletrpm.club^
||teleprazm.club^
||telegirm.cc^
||www.telebriun.work^
||tglegmn.work^
||telegpem.fit^
||telegpem.work^
||tgelegrean.work^
||teletrpm.fit^

! https://github.com/hagezi/dns-blocklists/issues/2041
||east-trading.shop^

! https://github.com/RPiList/specials/issues/1425
||post4at.live^

! https://github.com/Dogino/Discord-Phishing-URLs/pull/26
||steamcommuniitny.club^
||steamcommuniitny.

! https://tria.ge/240120-1dgrmshdc6/behavioral2
||mirfakpersei.top^
||alvsx.mirfakpersei.top^
||flameforgesmith.top^
||alvsx.flameforgesmith.top^
||cdnstatic.flameforgesmith.top^
||xhkls.flameforgesmith.top^
||press-here-to-continue.com^
||canopusacrux.top^
||xhkls.canopusacrux.top^

! https://github.com/hagezi/dns-blocklists/issues/2077
||apple-analyser.com^
||22.imohub.workers.dev^
||imohub.net^
||apple-health.org^

! https://cyberplace.social/@GossiTheDog/111828587052755003
||195.35.19.138^

! https://github.com/uBlockOrigin/uAssets/issues/22200
! https://github.com/hagezi/dns-blocklists/pull/2175
||privacyguides.io^
||poperblocker.com^

! https://github.com/uBlockOrigin/uAssets/issues/22268
||skinboxs.com^

! https://gist.github.com/GossiTheDog/f1079fe5486b2e7ac61d2e069caa67d4
||pq.hosting^

! https://github.com/hagezi/dns-blocklists/issues/2133
||demolishabolish.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/172569
||acareewityjh.com^
||accedenonre.xyz^
||adeditiontowritingef.net^
||adiingsinspiringt.net^
||ajorinryesoperty.com^
||alsoextraorduki.info^
||alukizeiasnin.com^
||amwoukrkskillso.com^
||anadthefoaedf.info^
||ankingwithear.com^
||aoldosgertyong.info^
||ardoqxdinqucirei.info^
||arnofourgugtj.info^
||arrowabhbtalst.info^
||arrowtoldilim.com^
||artistictastesnly.info^
||asifiwoeryjtyj.info^
||asosettoourma.info^
||aspectsofc.hair^
||asqerongtheco.info^
||astellihandl.xyz^
||atabaseiwo.top^
||atedlittleme.xyz^
||ationiamcur.com^
||ationslieemrger.info^
||atthewon.buzz^
||aukndaspirati.com^
||aysesuretobea.com^
||biscussexbug.xyz^
||blicatedlittle.xyz^
||bnfgnbheavynuo.info^
||britingsynt.xyz^
||careewituhinlarg.com^
||cathyimmediates.xyz^
||cenceevent.club^
||compathered.xyz^
||connectedithco.com^
||consukultingeca.com^
||conversitym.com^
||councernedasesium.com^
||dblueclaockbro.info^
||declinerybelfa.buzz^
||dedalloverwithth.net^
||dheircrhnerdgfd.info^
||directuklyecon.pics^
||disguishedbri.com^
||dmanas.buzz^
||dollapsedshe.info^
||dukerationpe.com^
||dwouldmakefe.info^
||eamsauknda.com^
||eastfeukufunde.com^
||ebelfarewesbegi.com^
||echildren.buzz^
||ectresultofthep.info^
||edassiumw.xyz^
||editiontowrit.info^
||edrubyglo.buzz^
||edstevermotorie.com^
||edverys.buzz^
||eesihighlyrec.xyz^
||efgrghhindhimi.info^
||efvtgbnanddescri.info^
||ehappy.buzz^
||eighing.space^
||eisasbeau.buzz^
||eitcuyjfromthe.info^
||emydreamsa.com^
||emyresumef.hair^
||endream.buzz^
||enectedithco.com^
||entoftheusysian.com^
||entsiwoulukdli.com^
||epededonemil.info^
||eretheseantyjyt.info^
||erpringash.xyz^
||erukentaspectsof.com^
||ervantasrelate.info^
||esterdayauol.info^
||etingefifort.info^
||etingplansfo.buzz^
||etorealiukzem.com^
||etyrthonrong.info^
||eukworektobe.pics^
||evenuewasadi.xyz^
||everefor.buzz^
||evermoto.xyz^
||everwiththinleav.net^
||ewmeofmukindwo.com^
||ewrevenuewasad.info^
||exibilitukydtea.xyz^
||forgotteddisgui.com^
||fortdaukthw.hair^
||fukermalasas.info^
||getnizationedr.info^
||getseavailan.xyz^
||gettllingovert.info^
||goveragemlz.club^
||gtdjidencenha.info^
||gukthwaalsoex.info^
||hableleader.xyz^
||hatwasallokmv.info^
||heinndonfgnorh.info^
||heodeidsofhnm.info^
||hereabithec.xyz^
||himloabercuacroos.info^
||historiousmor.xyz^
||hoisquit.buzz^
||houldthinkh.buzz^
||humanske.space^
||iamcurrently.com^
||iasninancuka.com^
||ibilitukydteamw.com^
||ictastesnly.buzz^
||ifefashionismscold.com^
||ileesidesu.hair^
||ingforanopportu.com^
||inghesatin.com^
||ingspondingco.com^
||iolintohimselfas.info^
||ionakasulbackgrou.com^
||ionscormatio.com^
||iratiotyuknsye.com^
||ishnfguseaches.info^
||itearamajo.com^
||jhldtogerghottulering.info^
||jlkladirtlseivi.info^
||jtffjwecouldle.info^
||kabuukimuuki.com^
||kectivetraining.info^
||kefeagreatase.info^
||kelpmetoreali.com^
||kentinedaug.xyz^
||kenwellsgrpo.com^
||kitwkuouldhukel.xyz^
||kmodukuleqasfo.info^
||kmyunderth.com^
||kolpihvfongrou.info^
||krkskillsombin.com^
||ksehinkitw.hair^
||ktobedirectu.xyz^
||ktobedirectuklye.com^
||lattemptaqwe.club^
||lemopaserawecas.com^
||leqasforsalesrep.info^
||liondolularhene.info^
||liukzemydream.com^
||llsombineukdwit.com^
||longmansuchcesu.com^
||ltingecauyuksehi.com^
||lubinoobi.com^
||majorinryes.com^
||majorinryesopert.com^
||manisation.org^
||mcurrentlysearc.com^
||mediatesupervis.com^
||mementrandingsw.com^
||mentbradshed.com^
||mentrandingswon.com^
||mentseconom.xyz^
||miredindeed.net^
||mnndnnbnn.com^
||monopolicycr.com^
||mplayeranydw.net^
||muheodeidsoan.info^
||mwoukrkskills.xyz^
||myxomater.space^
||mzsdeauxdwh.info^
||naborutmyrq.top^
||nahrghhaondb.info^
||natallcolumnsto.info^
||ncelewasgildeda.net^
||ncukanking.com^
||ndeedeisasbeautiful.net^
||ndencesch.xyz^
||ndsragedwithb.info^
||nedtolethimbevx.com^
||nereherewetem.info^
||nerewdeerofhi.info^
||nergyflexibilit.pics^
||nerybelfaste.xyz^
||neukdwithmefe.com^
||ngswonden.xyz^
||nkitwkuouldhu.com^
||nmabigyello.xyz^
||nonimoomi.com^
||nopportunitytostar.com^
||normaticalaccu.com^
||notquiteso.buzz^
||nowledconsideu.com^
||npracticalwhic.buzz^
||nryesopertyv.com^
||ntaspectsofcukorp.com^
||ntheworldw.buzz^
||ntualkentined.xyz^
||nverewereal.info^
||oathihakennails.info^
||oefanyorbesttn.info^
||ofchildr.buzz^
||offerentlyport.xyz^
||ojapanelm.xyz^
||omefukmendat.xyz^
||onalhedgelnham.com^
||onopolicycr.xyz^
||onopolicycreat.com^
||onsukultingecauy.com^
||oratefinaukn.xyz^
||oratefinauknceiwo.com^
||ordukinarilyhu.info^
||osiextantlyvfhn.info^
||otheruigfsfohi.info^
||oughtanothingfruitie.net^
||oukfareputfeablean.com^
||ouldlikukemyfu.com^
||ovogofteonafterw.info^
||panyinadiingsinspi.com^
||placugceofres.info^
||playeranydwould.info^
||ploddingtotogcb.info^
||pmetorealiukze.xyz^
||pohsoneche.info^
||precially.space^
||pringed.space^
||puldhukelpmet.com^
||racterdeilbsweet.info^
||rainingukmod.info^
||ratiotyuknsye.pics^
||rbiscussexb.xyz^
||reckedmane.xyz^
||rentlysearchin.com^
||responsidejo.xyz^
||rgentssep.xyz^
||rgyflexibilitu.com^
||ricewaterhou.xyz^
||ritingsynther.com^
||rthfeoveukrnme.com^
||runkingoutinteah.info^
||ruralled.space^
||rurelanderpurgan.com^
||salesrepreswse.info^
||sandothesooile.info^
||searchforanop.com^
||seemyresumefo.com^
||seinpoundaymid.com^
||semblyjustingex.com^
||seoopersedu.xyz^
||shoecamedmghm.info^
||smetotrea.xyz^
||smurtyards.space^
||ssdwellsgrpo.info^
||starvardsee.xyz^
||stellihandles.hair^
||subsectivexe.xyz^
||sultingcoe.buzz^
||swordhilte.buzz^
||sysianedukera.com^
||tasesetitoefany.info^
||tbrohwnmyest.info^
||tebilaterde.xyz^
||tedithconsukult.com^
||tesupervis.hair^
||texcepededo.info^
||tfoollowingba.info^
||tgandmotivat.com^
||thaitingshos.xyz^
||thaoheakolons.info^
||thegravehthh.info^
||theharityhild.buzz^
||thrememboer.info^
||ticaframeofm.xyz^
||tionpecialukizei.com^
||tivatingotheremplo.com^
||tooaastandhei.info^
||toolsahoulofd.info^
||tostaracare.com^
||tsapphires.buzz^
||tuallyenitwasbr.com^
||tunitytostara.com^
||tureukwore.xyz^
||tydevelelastic.com^
||tyyeastfeukufund.com^
||uadthenborea.info^
||uchadmir.buzz^
||uewasadirectresu.info^
||ughtsustacheds.com^
||uinground.com^
||ukelpmetoreali.pics^
||ukentaspe.xyz^
||ukindwouldm.xyz^
||ukrnmentofth.com^
||ukseseemyres.xyz^
||uktureukworekto.com^
||ukwasanasosetet.net^
||ularhenewrev.info^
||ulyhvfadchos.info^
||umeformorede.xyz^
||upervisofosev.xyz^
||uwledconside.xyz^
||uytdwhitdoe.info^
||uyuksehinkitwku.com^
||vbriverafter.xyz^
||verwiththinleave.net^
||wasanasosett.info^
||wasanasset.buzz^
||wedonhisdhiltew.info^
||withmefeyauknaly.com^
||wukbgater.buzz^
||yauknalyticafra.com^
||yhukelpfulinot.info^
||yidbyhersle.xyz^
||yremovementxv.com^
||ysearchingfo.xyz^
||yticaframeofm.com^
||yvaluationiamcur.com^
||34.195.224.242^
||54.225.185.110^

! https://cyberplace.social/@GossiTheDog/111929647559740363
||193.233.193.65^

! https://github.com/hagezi/dns-blocklists/pull/2175
||passwordfix.blogspot.com^
||97tool.github.io^
||apkzpure.com^
||wattfo.com^
||networkpcigniter.com^
||cpmpri.com^
||karan.mobi^
||manizx.com^
||mobdrovip.com^
||theapkhunter.com^
||ehallpasses.info^

! https://github.com/hagezi/dns-blocklists/pull/2173
||wtmbook.com^
||beacons.ai^

! https://github.com/hagezi/dns-blocklists/pull/2176
||kmspico.io^
||kmspico.ws^
||kms-full.com^
||kmspico.de.download.it^
||kmspico.to^
||kmspi.co^
||get-kmspico.com^
||kmsauto.info^
||official-kmspico.com^
||dlhk.acehprov.go.id^
||softwared.click^
||kmsauto.org^
||kmsauto.pw^
||kmsavto-net.ru^
||kmsauto.xyz^

! https://github.com/hagezi/dns-blocklists/pull/2184
||safety-andro1d-n0tice.co^
||unhaka.com^
||safety-andr-sys.info^

! https://github.com/hagezi/dns-blocklists/pull/2192
||13001.ru^
||ctrl02.ru^
||12001.ru^
||supos911.org^
||supos123.org^

! https://github.com/hagezi/dns-blocklists/pull/2213
! https://github.com/hagezi/dns-blocklists/pull/2212
||dhl-de-track-ui.cc^
||dhl-de-track-uo.cc^
||dhl-de-track-uu.cc^

! https://github.com/hagezi/dns-blocklists/pull/2211
||eyx092.github.io^
||davbuckgenerator.weebly.com^
||gemsforfree.com^
||hackzone.me^

! https://github.com/DandelionSprout/adfilt/commit/2b0705861bde02511e1fdd72edf470b2811ecb8c#r138964973
||githubtalentcommunity.online^
||jobs.githubtalentcommunity.online^

! https://github.com/hagezi/dns-blocklists/pull/2221
||modyolo.com^
||googlesavedata.ru^

! on url from https://github.com/easylist/easylist/issues/18489#issuecomment-1962261575, appears to be malvertising
||thaudray.com^

! https://github.com/xRuffKez/dns-blocklists/commit/9cf8a68e82a5fed10991a2e0a34bf84265960ce7
||giveawayscord.xyz^

! https://github.com/durablenapkin/scamblocklist/issues/76
||fundatingquest.fun^
||i.fundatingquest.fun^
||b.fundatingquest.fun^
||a.fundatingquest.fun^
||h.fundatingquest.fun^
||f.fundatingquest.fun^
||c.fundatingquest.fun^
||e.fundatingquest.fun^
! https://tria.ge/240224-zxewqafc9v/behavioral1
||sharlalias.click^
||mysuperdatingforyou.life^
||chat-o-live.com^
! https://tria.ge/240224-1ygx5sgc8v/behavioral1
||rozaholshouser.cfd^
! https://tria.ge/240224-2lmtasgh3v/behavioral1
||eshaalfawson.shop^
! https://tria.ge/240225-qwh3badf7t/behavioral1
||kristidamon.beauty^
! https://tria.ge/240227-njbflafh8z/behavioral1
||bethanytunks.skin^
||localdatez.com^
! https://tria.ge/240227-n4apssga94/behavioral1
||leoniaivey.site^
! https://tria.ge/240229-bc1qpahg3t/behavioral1
||brooklynalam.mom^
! https://tria.ge/240229-pc7e5age5x/behavioral1
||alisonsweigert.mom^
! https://tria.ge/240301-vmx74aaf67/behavioral1 (cloudflared)
||alexiaurlanza.skin^
! https://tria.ge/240402-nthmnagg5z/behavioral1
||lonnabritton.skin^
||datingcompass.fun^
||a.datingcompass.fun^
! fake users with profile pics stolen from porn site, payment required before contacting/replying to these users
||40PlusShag.com^
||delivery.40plusshag.com^

! https://github.com/hagezi/dns-blocklists/pull/2251
||foreverinprofitmaking.com^
||pp.45-61-158-129.cprapid.com^
||globalserviceslogistics.com^
||luxurysgift.com^
||athletic-harmony.com^
||knkpublishingsoftware.com^

! spam email -> https://tria.ge/240229-psnyqahe45/behavioral1
||obses-sion.info^

! https://github.com/AdguardTeam/AdguardFilters/issues/173830
||midsummer.pw^
||mb38.com^

! https://github.com/braveinnovators/ukrainian-security-filter/pull/7
||sportloto-1.co^
||retiva-bet777.com^
||parik24.win^
||oshad24.biz.ua^
||monoslot3.com^
||diamondclub.casino^

! email spam
! https://tria.ge/240301-xm9x1abg6s/behavioral1
||jammingdate.life^
||madchenradar.life^
||honey-love-here.com^
! https://tria.ge/240302-1sdnjahg6s/behavioral1
||hotmarydate.life^
! https://tria.ge/240305-nezbvsec94/behavioral1
||naughty-webs.life^
! https://tria.ge/240305-nq59jsef93/behavioral1
||hookarts.life^
||mx2.hookarts.life^
! https://tria.ge/240305-nyp8aseh65/behavioral1
||tacky-canopy.info^
||mail.tacky-canopy.info^
! spam sending servers
||176.123.11.26^
||141.11.178.3^
||91.199.133.104^

! https://cyberplace.social/@GossiTheDog/112031492191698112
||193.17.183.123^

! https://github.com/hagezi/dns-blocklists/pull/2271
||heytrhrerght.buzz^
||meryruytss.buzz^
||rus-loto.premium-gifts-2024.xyz^
||s7txw.removalsinrotherham.co.uk^
||suiueopzgd.dlnhighpressurecleaningservicesltd.co.uk^
||tutyutyutyu.buzz^
||v9xq2.shop^

! https://github.com/uBlockOrigin/uAssets/issues/22757
||jobs.trustaffingpartners.com^

! https://github.com/hagezi/dns-blocklists/issues/2288
||revancedapps.com^
||revancedapp.download^
||www.revancedapp.download^

! https://github.com/uBlockOrigin/uAssets/issues/22765
||free-service.hubside.fr^
||freezimail.hubside.fr^
||zimbrafreemail.hubside.fr^
||zimbra-inbox.hubside.fr^
||free-mobile241.hubside.fr^
||compte-free.hubside.fr^
||pointsfreemobile.com^
||espacefidelitefree.fr^
||free-mob2584.hubside.fr^
||web-free.hubside.fr^
||zimbra-free-com.hubside.fr^
||zimbra-free-com.
||free-mobi20i2582.hubside.fr^
||zimbra-free-email.hubside.fr^
||freezimbra.hubside.fr^
||web0mail.hubside.fr^
||free-mobile0021547.hubside.fr^
||free-information.hubside.fr^
||mobiles.hubside.fr^
||freemailzimbra.hubside.fr^
||rivita3106felibgcom.hubside.fr^
||info-free.hubside.fr^
||emails-free.hubside.fr^
||freema.hubside.fr^
||free-zimbra.hubside.fr^
||free-mobile1540478.hubside.fr^
||freewebzim.hubside.fr^
||acceder-a-mon-free.hubside.fr^
||my-acount-free.hubside.fr^
! my analysis: https://tria.ge/240305-2bg53abb8x/behavioral1
||shopflarehub.com^

! https://github.com/hagezi/dns-blocklists/issues/2293
! https://www.bleepingcomputer.com/news/security/hacked-wordpress-sites-use-visitors-browsers-to-hack-other-sites/
||dynamiclink.lol^
||dynamic-linx.com^

! https://github.com/RPiList/specials/issues/1500
||casino-ice.fun^
||fortuneadvert.com^
||lalielynaualish.com^

! https://github.com/hagezi/dns-blocklists/issues/2304
||vast-conexxion.com^
||bllthbatnthes.life^
||kuualosd.bllthbatnthes.life^

! https://tria.ge/240309-p8f8tagc55/behavioral1
||arcanecheat.com^
||www.arcanecheat.com^
||95.216.253.55^

! https://github.com/hagezi/dns-blocklists/issues/2313
||moddetail.com^
||cvbuilder.staging.standout-cv.com^
||liveinfo.xyz^
||ww3.weweekly.us^
||timesofeuropnews.com^
||cards2024.org^
||getaccess.w3spaces.com^
||ourhealthy.life^
||klospike.online^
||re-captha-version-3-16.live^
||kimona01.com^
||getspins.info^
||storage.canalblog.com^
||vbbv.store^
||vibuxion.top^
||rangerbow.world^
||qrcodes.pro^
||a.re-captha-version-3-16.live^

! https://github.com/hagezi/dns-blocklists/issues/2317
||rewards-emirates.com^

! https://blog.sucuri.net/2024/03/new-malware-campaign-found-exploiting-stored-xss-in-popup-builder-4-2-3.html
||traveltraffic.cc^
||ttincoming.traveltraffic.cc^
||cloudsonicwave.com^
||host.cloudsonicwave.com^

! https://www.virustotal.com/gui/url/f1018be1c6ed9a283196e9ecba431b24d21b74b08a005008cfc94a98cbc63cb7/community
||steam-card50.com^
! my analysis: https://tria.ge/240312-z5778sah9w/behavioral1
||stseam.ru^
||www.stseam.ru^

! https://github.com/durablenapkin/scamblocklist/issues/78
||usspaqn.top^
||uspw.usspaqn.top^

! https://github.com/hagezi/dns-blocklists/issues/2339
||9-9-8.com^
||b.9-9-8.com^

! https://infosec.exchange/@jeromesegura/112090382122783994
||aksoaiapk.com^
||trelconf.com^
||avr-energie.com^

! https://github.com/hagezi/dns-blocklists/issues/2341
! my analysis: https://tria.ge/240313-zf3apaac75/behavioral1
||uk-news.pro^

! https://github.com/hagezi/dns-blocklists/issues/2344
||bnidigital.com^
||zillify.cfd^
||today.free.nf^
||nextmrolympia.com^
||an1.is^

! https://github.com/hagezi/dns-blocklists/issues/2345
||spacex-starship.org^

! https://tria.ge/240315-p28dqagf5z/behavioral1
||spacexgive.org^

! https://tria.ge/240318-a5v58sca59/behavioral1
||ccukycu-alert.online^

! https://github.com/hagezi/dns-blocklists/issues/2365
||new-s24.click^

! https://github.com/blocklistproject/Lists/issues/1199
||steamcommumtiy.com^

! https://github.com/hagezi/dns-blocklists/issues/2381
||wwss.pages.dev^

! https://github.com/hagezi/dns-blocklists/issues/2405
||usps-delivery-a.com^

! https://github.com/uBlockOrigin/uAssets/issues/23084
||fitgirltorrent.com^
||fitgirltorrent.

! https://github.com/durablenapkin/scamblocklist/issues/81
||sxlph.site^
||globe.sxlph.site^

! https://tria.ge/240401-nwc5ysea52/behavioral1
||doge-coin24.org^

! https://github.com/hagezi/dns-blocklists/issues/2425
||fling-trainer.com^

! https://github.com/hagezi/dns-blocklists/issues/2422
||sonicglyde.com^

! https://infosec.exchange/@jeromesegura/112214506870744443
! https://www.malwarebytes.com/blog/threat-intelligence/2024/04/bing-ad-for-nordvpn-leads-to-sectoprat
||nordivpn.xyz^
||besthord-vpn.com^
||45.141.87.216^

! https://github.com/durablenapkin/scamblocklist/issues/82
||account-cfe.mx^

! https://vid.puffyan.us/watch?v=h0_L4BApOdA
! my analysis: https://tria.ge/240409-2aenjsee49/behavioral1
! my analysis: https://tria.ge/240409-2bwnfsaa5z/behavioral1
||gooq1e.com^
||ecmokdtj.com^
||apk.ecmokdtj.com^

! https://github.com/hagezi/dns-blocklists/issues/2506
||grapheneos.fr^

! https://unit42.paloaltonetworks.com/cve-2024-3400/
||172.233.228.93^
||144.172.79.92^
||nhdata.s3-us-west-2.amazonaws.com^
||66.235.168.222^
||110.47.250.103^
||126.227.76.24^
||38.207.148.123^
||147.45.70.100^
||199.119.206.28^
||38.181.70.3^
||149.28.194.95^
||78.141.232.174^
||38.180.128.159^
||64.176.226.203^
||38.180.106.167^
||173.255.223.159^
||38.60.218.153^
||185.108.105.110^
||146.70.192.174^
||149.88.27.212^
||154.223.16.34^
||38.180.41.251^
||203.160.86.91^
||srgsd1f.842b727ba4.ipv6.1433.eu.org^
||edcjn.57fe6f5d9d.ipv6.1433.eu.org^
||srgsdf.842b727ba4.ipv6.1433.eu.org^
||45.121.51.2^

! https://github.com/jarelllama/Scam-Blocklist/issues/314
||dehoe.top^

! https://infosec.exchange/@jeromesegura/112294111264356672
! my analysis: https://tria.ge/240418-zee4rsfe2x/behavioral1
||notilon.co^
||sivaspastane.com^
||utm-adrooz.com^
||startupzonechanpatia.com^

! from Ryan Brown
||popupblocker-download.com^
||popupblockernow.com^
||popupgoldblocker.net^
||popupsblocker.org^

! https://github.com/hagezi/dns-blocklists/issues/2549
||sadostic.pl^

! https://forums.malwarebytes.com/topic/311280-hacked-by-discord-scam/
! my analysis: https://tria.ge/240425-vpgywsda35/behavioral1
! my analysis: https://www.hybrid-analysis.com/sample/15f5fd080befe91766cb1b31f3a6af15e6dfb63c80a0d00ec8b85ca0c5940504?environmentId=160
||cosmicbetrayers.com^
||www.cosmicbetrayers.com^
||4.228.216.231^

! https://github.com/RPiList/specials/issues/1554
||myhermes-sendungs.com^

! https://archive.is/EDp03
! https://tria.ge/240427-1vhehahg3x/behavioral1 (CloudFlared)
! https://www.virustotal.com/gui/file/0f810bea02ae97cb015dc0de510892f3f83a9ddc969c1f261adf8a8bd5716862
! https://bazaar.abuse.ch/sample/0f810bea02ae97cb015dc0de510892f3f83a9ddc969c1f261adf8a8bd5716862/
! https://urlhaus.abuse.ch/url/2829815/
||torontohack.fun^
||mediafire.com/folder/ux0dk7ist85e1/F0LDER^
||mediafire.com/file/7os5cx2x4rp70nm/UPL0ADER.7z/file^
||productivelookewr.shop^
||tolerateilusidjukl.shop^
||shatterbreathepsw.shop^
||shortsvelventysjo.shop^
||incredibleextedwj.shop^
||alcojoldwograpciw.shop^
||liabilitynighstjsko.shop^
||demonstationfukewko.shop^

! https://forums.malwarebytes.com/topic/311316-rtp-detection-outbound-connection-from-explorerexe/
! https://threatfox.abuse.ch/ioc/1263183/
||greatnessappreviews.com^

! https://forums.malwarebytes.com/topic/311502-windows-10-infected-with-malware-that-malwarebytes-cant-find/
||percumannue.com^

! https://infosec.exchange/@th3_protoCOL/112360917153667995
||appauthentiflcator.digital^
! TODO: Recheck (was dead when added)
||authentlcatcodes.icu^

! https://github.com/RPiList/specials/issues/1559
||dlhpostsup.top^

! https://www.virustotal.com/gui/url/52e1dc85a5cec6eb0410bfa2884ee4d55a1934dc0b451a4e29cdba26ae840b9b/community
! my analysis: https://tria.ge/240507-zpcrdsfc7w/behavioral1
||mundotatuajes.info^
||mine.mundotatuajes.info^

! https://rmceoin.github.io/malware-analysis/2024/05/07/clearfake2.html
||akademipraktik.com^
||rtattack.baqebei1.online^
||valentinedaycard.com^

! from D4niloMR
||redecanaistv.dev^

! https://github.com/StevenBlack/hosts/issues/2650
! https://tria.ge/240511-p57xcsbf55/behavioral1
||urdxh.com^

! https://github.com/uBlockOrigin/uAssets/issues/23655
||hypernitro.ru^
||nitrohunt.com^

! ---- Scams ----

! fails to disclose it's lack of connection to uBlock *Origin*
! https://infosec.exchange/@iampytest1/111306748409652707
||ublock.org^

! https://virustotal.com/gui/url/723d30dcc93ee90f8f04b5cc3c5d07492338c41f7aa62fb2723c7d8b91537338/community
! https://github.com/uBlockOrigin/uAssets/issues/5854
||ublockerext.com^

! This domain has been used for typosquatting, malware, phishing, and scams (redirects to other scam/malware sites as of 17/9/2021)
! curl on 9/5/2021 shows it is still online
! https://www.siteadvisor.com/sitereport.html?url=quatrefeuillepolonaise.xyz
! https://virustotal.com/gui/url/7319b37aff351dc0f0e71dba194b5f21972be9ad072b955a35d27d5af359d5fa/community
! https://virustotal.com/gui/domain/quatrefeuillepolonaise.xyz/detection
! https://safeweb.norton.com/report/show?url=quatrefeuillepolonaise.xyz
! https://www.fortiguard.com/webfilter?q=quatrefeuillepolonaise.xyz
! https://quttera.com/detailed_report/quatrefeuillepolonaise.xyz
! https://www.urlvoid.com/scan/quatrefeuillepolonaise.xyz/
! https://www.mywot.com/en/scorecard/quatrefeuillepolonaise.xyz
! https://github.com/DandelionSprout/adfilt/issues/188
||quatrefeuillepolonaise.xyz^
! Related to above
! https://github.com/DandelionSprout/adfilt/issues/188
! https://github.com/DandelionSprout/adfilt/commit/0af1431c8f4cf45e9c27e359edf777b0c9bfa153
||extragifis.site^
||captcharesolving-universe.com^
! https://virustotal.com/gui/ip-address/5.8.34.26/relations
! https://github.com/DandelionSprout/adfilt/issues/188
||captcharesolver.com^
! https://virustotal.com/gui/url/136909c39798eacfc82e58459684619a4b89de8d3dedbe5a3010c5152b670328/detection
! https://github.com/iam-py-test/Assets-001/blob/main/goglenet%20malware
||cpmstatsart.com^
! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-848834204
||instantfwding.com^
||103.224.182.251^
||catnip.de^
||trafcenter.us^
||fwdservice.com^
! https://securitytrails.com/list/ip/5.8.47.3
! https://safeweb.norton.com/report/show?url=gamesex.fun
! https://www.siteadvisor.com/sitereport.html?url=gamesex.fun
! https://virustotal.com/gui/url/7bedfdd70bd23869a3598186270bcca9e64870842fb95df46da9ed5519e0b41c/detection
||gamesex.fun^
! just redirects to another blocked domain
! https://github.com/DandelionSprout/adfilt/issues/188
||kmip.net^
||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^
||204.11.56.48^
||goldprize.xyz^
! More scam stuff on 27/9/2021
||smartcaptchasolve.top^
||cloud-repos.store^
||retailproductsusa.com^
||www.retailproductsusa.com^
! Even more scams - https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931700117
||findanswersnow.net^
||two.findanswersnow.net^
||diabasewoodhouse.xyz^
||signupandturnyourscreenoffsafepowernow.date^
||www.signupandturnyourscreenoffsafepowernow.date^
||best-prizes.life^
||jsontdsexit.com^
||therewardboost.com^
||t.therewardboost.com^
||natnlconsmrctr.com^
||lore.deduce.com^
||d2m2wsoho8qq12.cloudfront.net^
||jpgtrk.com^
||pnghst.com^
! domains which gogle[.]net redirects to on 17/10/2021
||positivestar.org^
||securysearchapp.com^
||www1.securysearchapp.com^
||mydealprotection.com^
||www.mydealprotection.com^
! on the same IP & just by looking at them, I can tell they are not legit
||intunes.com^
||pple.com^
||gimal.com^
! 19/11/2022: https://sitecheck.sucuri.net/results/get-the-prize-ht3.live
||get-the-prize-ht3.live^

! https://github.com/uBlockOrigin/uAssets/issues/9344
! https://github.com/iam-py-test/Assets-001/tree/main/uiz.io_scam
||uiz.io^
! More scam domains found via redirects when clicking on the fake recaptcha
! https://virustotal.com/gui/url/73dae7d74bcdc9099a54b75b904cc45995d85534a313ad65fcc4d9e401b34607/detection
||rewardsavenue.net^
! https://virustotal.com/gui/url/d6745ce01da185054bd2125858e75445783976de0e5fa4a445284243830070e7/detection
||rewardsgiantusa.com^
! https://virustotal.com/gui/url/9edd33c7a370ba96bf3a7682193e67538984eab9d1b719c2f3042599a4d3d1d5/detection
||rewardgiantztesters.com^

! https://github.com/blocklistproject/Lists/issues/513
||gooooooooogle.com^

! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#domains
||p185689.mybetterdl.com^
||r-tb.com^
||feed.r-tb.com^
||t.r-tb.com^
||cdn.hoood.info^
||barah-flo.com^
||beta-one.net^
||ny-t.r-tb.com^
||pisism.com^
||security-scanner.xyz^
! https://github.com/iam-py-test/investigations/blob/main/2021/10/26/1.md#html-captures
||news-back.org^
||www1.news-back.org^
||www2.news-back.org^
||www3.news-back.org^
||www4.news-back.org^
||www5.news-back.org^
||www6.news-back.org^
||www7.news-back.org^
||www8.news-back.org^
||www9.news-back.org^
||www10.news-back.org^

! https://github.com/DandelionSprout/adfilt/pull/289
||gogles.com^
||flexroll.online^
||army-glo.scrollingsystem.com^
! ||www.kqzyfj.com^$all
! ||kqzyfj.com^$all
! ||cj.dotomi.com^$all
||mcafee12.tt.omtrdc.net^
! https://virustotal.com/gui/ip-address/70.32.1.32/relations
||clk.rtpdn14.com^
||cd.org^

! https://github.com/uBlockOrigin/uAssets/issues/9848#issuecomment-907855092
! https://virustotal.com/gui/url/1671d2b14f2baed1438176929ba9908270f26e41f7b17c0ce0a85bd5e9c20f35/detection
! https://virustotal.com/gui/url/0eca172b2f35f81e0f222dbdf261a100c7897f734c7ba43920b67c4cddd6f8c9/detection
||get-cracked.com^
! More related domains/urls
||tinyurl.com/gp84uz2^
||www.mediafiire.com^
||mediafiire.com^
||d1xkyo9j4r7vnn.cloudfront.net^
||www.onlinepromotionsusa.com^
||onlinepromotionsusa.com^
||w.promotionsonlineusa.com^

! https://github.com/uBlockOrigin/uBlock-issues/issues/1774
! https://github.com/iam-py-test/investigations/blob/main/2021/10/28/1.md
||slobodapatient.me^
||www.slobodapatient.me^
||ppcnzi.xyz^
||www.ppcnzi.xyz^
||eritokyo.jp^
||www.cpanlyzr.co^
||cpanlyzr.co^
||rewardzoneusa.com^
||contact.rewardzoneusa.com^
||reward3spot.com^
||www.reward3spot.com^
||order-safely.com^
||www.order-safely.com^
||followlink.click^
||us.systemupdatecontrol.com^
||systemupdatecontrol.com^
||ryderftv.co^
||www.ryderftv.co^
||publishers.revenueuniverse.com^

! https://scammer.info/t/crypto-scam/82425
||gemini-horoscope-astrologer.business.site^

! https://scammer.info/t/noteit-scam/82283
||pautils.online^

! https://scammer.info/t/usps-spam/83368
||www.wutaideng.wang^

! https://scammer.info/t/crypto-scam/83168
||gemini-telephonecompany.business.site^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-974886953
||e.datingmap.top^
||datingmap.top^
||tonightshookup.com^
||members.tonightshookup.com^
||t.tonightshookup.com^
||yourladiefun.life^

! Scam and fake Roblox hacks
||gghacks.com^
! Scam websites opened - put in redirect order
||armanfiles.com/show.php?cl=true&l=971524&u=228373&id=23694
||www.rewardsgiantusa.com^
! Asks for personal data (name,address,birthdate,gender,email), claims you will get a "reward", never provides hack
||promotionsonlineusa.com^
||r.promotionsonlineusa.com^
! More scams
||displayoptoffers.com^
||www.displayoptoffers.com^
||www.yrxtrk.com^
||play.sweepstakesalerts.com^
||sweepstakesalerts.com^
||www.stash.com^
||www.qualityhealth.com^
||qualityhealth.com^
||consumerproductsusa.com^
||www.consumerproductsusa.com^

! https://github.com/iam-py-test/investigations/blob/main/2021/11/21/1.md
! https://github.com/hagezi/dns-blocklists/issues/241
! ||yasir252.com^$all
! ||www.yasir252.com^$all
||safelink.kadal.club^
! https://forums.malwarebytes.com/topic/285824-malicious-disk-image-file-iso/ --> https://virustotal.com/gui/url/20ef8f13f6ed4f2ad0f25c4d98c5ba213223dd95d18ae31494b5df4305fc7a6c
||iclickcdn.com^
||bedrapiona.com^
||dozubatan.com^
||onmarshtompor.com^
||chultoux.com^
||yonhelioliskor.com^
||ptauxofi.net^
||betshucklean.com^
||buncoswosh.com^
||b58ncoa1c07f.com^
||t.avroute01.com^
||gammamkt.com^
||leadgentrk.com^
||chirkacylal.com^
! https://github.com/AdguardTeam/AdguardFilters/issues/122055
||shoksips.com^
! https://tria.ge/230714-tf54paga3y/behavioral1
||adblock-zen-download.com^
||adblock-zen.com^
||adblockertool.com^
||supremeadblocker.info^

! https://scammer.info/t/faremart/82671
||www.faremart.com^
||faremart.com^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-977912975
! https://www.tv2.no/nyheter/14368524/
||alexstewartinternationalltd.rw^
||vps.re^

! https://www.youtube.com/watch?v=iQiVH533ncM
||avengeradblocker.com^
||poweradblocker.com^

! https://github.com/iam-py-test/investigations/blob/main/2021/11/25/1.md
||steamkeygiveaway.net^
||fasterfiles.net^
||inteledirect.com^
||turapport-strience.icu^
||americanwinnerscircle.com^
! https://github.com/uBlockOrigin/uAssets/pull/10599#issuecomment-979356358
||yunosurveys.com^

! https://github.com/iam-py-test/investigations/blob/main/2021/11/28/1.md
||reykijnoac.com^
||totalnicefeed.com^
||omnatuor.com^
! https://scammer.info/t/youtube-bot-roblox-scam-39/84530
||freeco.xyz^

! https://scammer.info/t/paypal-phishing-12/84592
||golemgreat122.000webhostapp.com^

! https://scammer.info/t/microsoft-phishing-1/84589
||aceelectricalny.com^

! https://scammer.info/t/discord-nitro-generator-7/84570
||www.appninjas.xyz^
||appninjas.xyz^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-986306768
||chess-progress.ru^
||ouhastay.net^

! https://forums.malwarebytes.com/topic/281514-scam-websites/
||812138.com^
||dk-video.xyz^
||dj-video.xyz^
||gi-video.xyz^
||hj-video.xyz^
||havmoney.xyz^

! https://github.com/uBlockOrigin/uAssets/pull/10804
! https://bbs.kafan.cn/thread-2221500-1-1.html
||88btbtt.com^
||musmentportal.com^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-988127908
! https://www.tek.no/i/lVeQAe/
! https://www.nkom.no/aktuelt/ikke-trykk-pa-lenker-i-sms--for-du-er-helt-sikker/
||eccolabgroup.com^
||galerijajava.ba^
||p-stn.net^

! scam dating sites
||casualdating.com^
||iflirts.com^
||www.iflirts.com^

! fake notification scams
||ourcoolstories.com^
||javsidblog.com^
||link-split.com/view/tnAhAq30D4^
||cagothie.net^

! https://github.com/iam-py-test/investigations/blob/main/2021/12/9/1.md
||0s.click^
||0ffer.icu^
||0pen.online^

! https://github.com/iam-py-test/investigations/blob/main/2021/12/12/1.md
||onlineenglishteacher.co^

||www.fling.com^

! either redirects to random websites or scams
||lekms.com^
||yourcoolfeed.com^

! fake MediaFire websites
||songlos.com^
||royaltees.co^
||findes.co^
||vitafox.findes.co^
||supersong.nl/upload/6277.rar^
||monkeyselite.tonick.co^
||kitago.info^
||herezfile400.weebly.com^
||hereeup447.weebly.com^
||yaihxj.knewdayfull.top^
||knewdayfull.top^
||4lgx4.bemobtrcks.com^
||hugewifesilver.top^
||ge6s.com^
||sitexchange.causeart.co^
||yellowmother374.weebly.com^
||myhayward.us^
||tiborola.info^
||artbistro.us^
||myhypeposts.com^
||onlynewstoday.com^
||payments4u.org^
||freeiphone.info^
||static.cdnativepush.com/contents/s/7f/95/8c/2488823c2d95d7162ff723c840/01192333514141.png^
||static.cdnativepush.com/contents/s/04/d8/68/c0dd305c8a79b01ae4f24672ac/01477976446043.png^
||flummer.geppe.us^
||tuckets.moanas.us^
||static.cdnativepush.com/contents/s/b8/4e/1d/153294973f0fff7258e8f43d7c/0647024544646.jpeg^
||static.cdnativepush.com/contents/s/d2/3f/93/7fe562c37a9a7a6af5df460ee7/0490618650236.png^
||ssp-creatives.askprivate.com/prod/images/33242825/en/69dcb41b14c0449dbc67b998ca5b0c94.jpeg^
||ssp-creatives.askprivate.com/prod/icons/33242825/en/8bb2cd79c7dd45eb8075d0127f8d8331.jpeg^
||zxzfic.weebly.com^
||iminna.info^
||bloghunter.aaguatemala.org^
||abated-hamate.xyz^
||api.pushnami.com/scripts/v2/pushnami-sw/5e4bf7d0e7585f1f723a7243^
||cleveradult148.weebly.com^
||forexever451.weebly.com^
||ourcoolposts.com^
||bitnew695.weebly.com^

||www.iztzo.com^
||iztzo.com^
||gomusic.info^
||myprotectionsurveys.com^
||www.myprotectionsurveys.com^
||ouphouch.com^

! https://github.com/iam-py-test/investigations/blob/main/2021/12/14/1.md
||onemacusa.net^
! random .xyz domains which just don't look legit
||cp2s.xyz^
||80302.xyz^

! https://github.com/DevSpen/links/pull/3
||d13nu0oomnx5ti.cloudfront.net^
||dgu9g3a2kzqx2.cloudfront.net^
||d13pxqgp3ixdbh.cloudfront.net^

! https://scammer.info/t/snapchat-spam-click-link-don-t-link-investigate-please/85620
||nvoddn.hotglrls.net^
||hotglrls.net^
||hushlove.com^
||jucydate.com^
||w17veh63m7o8s4ncihd1jq8i.people-wet.com^

! https://scammer.info/t/stupid-ass-scammers-lol/85601 (support[@]clickgadgets[.]club)
||bit.ly/3DWxMNv^
||clickgadgets.club^

! scam website with only fake links
||crackthisgame.com^
||pseepsie.com^

! pretty sure this is a porn scam
||carnalcams.com^
||www.carnalcams.com^
! the register form doesn't do anything after entering data, just redirect back to the start
||fbookhookups.com^
||fuckpal.com^
! seen in scam ads
||fuck-me.io^

! https://scammer.info/t/youtube-comment-spam/85737
||acceptww.com^
||0.acceptww.com^
||8.acceptww.com^

! https://github.com/DandelionSprout/adfilt/issues/288
||discordap.com^
||forwrdnow.com^
||7lyonline.com^
||safelyonline.net^
||get.safelyonline.net^
||browse-safe.net^
||get.browse-safe.net^
||btpnative.com^
||besty-deals.com^
||data-px.services^
||live.newsvot.com^
||adalgard-wol.com^
||secure-access-981cd52a6hqpm8e2.gate23.xyz^
||ny-feed.r-tb.com^
||clk.hosting-redirect.com^

! https://scammer.info/t/cyberpunk-2077-fake-generator/85772
||groups.google.com/g/cyberpunk-steam-key-generator-working-check-now-2022?
||groups.google.com/g/cyberpunk-steam-key-generator-working-check-now-2022/
||ragamer.com^

! https://scammer.info/t/indian-kotak-mahindra-bank-scam/85760
||raam-and-laxman98.000webhostapp.com^

! https://scammer.info/t/nitro-is-handed-there-for-free-scam-7-927-324-30-54/85763
||gift-discords.com^

! possible Tech Support Scam
||installmysecurity.com^

! "press allow to continue"
||shortnewsinfo.com^
! https://scammer.info/t/mcafee-phish/83725
||securefirst.us-east-1.linodeobjects.com^

! https://github.com/uBlockOrigin/uBlock-issues/issues/1774#issuecomment-1000722777
||viewty.xyz^
||landing.marketstm.com^

! https://scammer.info/t/1-month-nitro-for-free-take-it-scam/86166
||discrode-gifte.club^

! https://forums.malwarebytes.com/topic/282206-scam-websites/
||hu-video.xyz^
||bs-video.xyz^
||xa-video.xyz^
||video-cd.xyz^
||gm-video.xyz^
||iamoney.xyz^
||vbmoney.xyz^
||obmoney.xyz^
||kcmoney.xyz^
||dcmoney.xyz^
||lstmoney.xyz^
||uamoney.xyz^
||tbmoney.xyz^
||ecmoney.xyz^
||gcmoney.xyz^
||xosi.ru/shop-wallets/
! https://forums.malwarebytes.com/topic/282206-scam-websites/?do=findComment&comment=1494794
||iglookup.com^
||www.iglookup.com^

! 'click allow to continue' scam which redirects to random subdomains when the premission is blocked. Also redirects to TotalAV at the end
||8db3p.leadoesnotknowaboutkukuriko.xyz^
||leadoesnotknowaboutkukuriko.xyz^
! fake antivirus message
||mcafee5.www-safety.com^
||weledying-jessed.com^

! https://forums.malwarebytes.com/topic/282376-website-giving-spammy-popups/
||tepspr.com^
||rplnd10.com^

! https://scammer.info/t/youtube-bot/86668
||kingapp.store^
||downloadlocked.com^
||advantagecircles.com^
||iwin.rewardsadvisor.com^
||rewardsadvisor.com^

! found this while looking for Memz samples - https://user-images.githubusercontent.com/84232764/149638659-8e0e9e91-8d02-4fff-bd0f-af8423550777.png (hxxps://verify-me.club/2004cbf?s1=down1)
||tinyurl.com/45tkeyep^
||verify-me.club^
! still alive as of 11/11/2022 - https://app.any.run/tasks/f0474f51-6b14-432b-b1f0-98a1137e359c
||verifyme.za.com^
||letmik.com^
||c.atandmouse.com^
||g.atandmouse.com^
||atandmouse.com^

! "press allow to continue" popup ad
||masstech.info^
||windows-secureit.com^

! fake game cheat download buttons redirecting to "press allow to continue" and Norton
! also https://forums.malwarebytes.com/topic/287349-my-google-browser-could-be-infected-need-help-removing-it/
||anonmods.com^

! fake discord Nitro generator
||us.doctorpost.net^

! another fake Nitro generator
||pastebin.com/qwUbwYbq^
||richinfo.co^
||contact.uplevelrewards.com^

! fake download website
||tonxis19.amebaownd.com^
||hzaowj3.berilata.ru^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1025251202
! https://github.com/uBlockOrigin/uAssets/issues/11518
||libertatea.net^

! fake human verification scam
! start form - reported for abuse
||q.promotionsonlineusa.com^
||reward4spot.com^
||www.reward4spot.com^

! fake download buttons with popups
||cracked-games.org^
||prksism.com^
! https://virustotal.com/gui/ip-address/18.210.201.44/relations
||antirobotsystem.com^

! fake 'no human verification' discord nitro generator
||huffduffer.com^
||issuu.com/free-discord-nitro-codes^
! still alive as of 11/11/2022 - https://app.any.run/tasks/c4a6e7d3-21da-4274-b262-e08dee1bb3cd
||meine.belohnung24.com^
||ideen.belohnung24.com^
||iphone.belohnung24.com^

! another discord Nitro scam
||linktr.ee/FreeDiscordNitroGift^

! "press allow to continue"
||www.kuyhaa-mee.com^
||kuyhaa-mee.com^
||waystriling.com^
||nze0xw.waystriling.com^
||581358.waystriling.com^
||qyt8pi.waystriling.com^
||xiiowt.waystriling.com^
||www.upload-4ever.com^
||upload-4ever.com^
||worldcoolfeed.com^

! Fake discord nitro (still alive as of 11/11/2022)
||myget.org/feed/discord-nitro-hack/package/nuget/Free-discord-nitro-codes-2021^
||lucymods.com^
||gluegames.xyz^

! another fake site
||www.aldvingomes.com^
||aldvingomes.com^
||codegen.fun^

! fake discord nitro
||getmecodes.xyz^
||filevortex.com/1029130^
! https://app.any.run/tasks/73236419-3190-47fa-81f0-8a31bcf48a5b
||minutewinner.com^

! Yet another fake discord generator
||jellycheat.com^

! https://scammer.info/t/paste-your-discord-nitro-scams-here/89880/2
||discord.birth/kjqsSQDF4qs9f4sK456ds7^

! https://www.reddit.com/r/computerviruses/comments/swrrx8/used_a_youtube_to_mp3_downloader_today_and_these/
||unrelered.xyz^

! https://web.archive.org/web/20230604183723/https://twitter.com/iam_py_test/status/1496259425493225472
||sites.google.com/view/groundworkssolutions/contact-us^
||sites.google.com/view/groundworkssolutions/^
||sites.google.com/mytv/maintenance^

! all the RARs just contained one zero-byte file, so just blocking the confirmed scam part of it (start URL hxxpx[://]bayanhuu[.]com/microsoft-office-2016-full-download[/]
||habitum.xyz^
||news-easy.org^

! https://github.com/uBlockOrigin/uAssets/issues/11157#issuecomment-1049093327
||sideload.cc^

! survey scams
||credly.com/users/free-discord-nitro-codes/badges^
||psp-haxors.com^
||gripclicks.com^
! https://app.any.run/tasks/a3abdf35-fa15-4115-91fb-cfc5c1e45ff4
||omnioffers.com^

! https://virustotal.com/gui/url/98f0186f4d20f3138a4e05f58369019cee8e88153578e3d729b716d8b57c0857/community
||k6pay.top^
||h6pay.top^
||g6pay.top^
||n6pay.top^
||c6pay.top^

! hxxpx[://]consortiumrecords[.]co/free-tools/download-microsoft-office-365-product-key-crack-updated/
||foradream.top^
||h.therewardboost.com^
||b.therewardboost.com^
||i.therewardboost.com^
||s.therewardboost.com^
||c.therewardboost.com^
||w.therewardboost.com^
||z.therewardboost.com^
||g.therewardboost.com^
||o.therewardboost.com^
||u.therewardboost.com^
||v.therewardboost.com^
||y.therewardboost.com^
||m.therewardboost.com^
||x.therewardboost.com^
||d.therewardboost.com^
||j.therewardboost.com^
||p.therewardboost.com^
||f.therewardboost.com^
||a.therewardboost.com^
||e.therewardboost.com^
||r.therewardboost.com^
||k.therewardboost.com^
||n.therewardboost.com^
||l.therewardboost.com^
||q.therewardboost.com^
||www.therewardboost.com^

! porn scam? asks for personal info and gets stuck in a loop
||dream-singles.com^

! even more fake "human verification"
||speedboostpc.com^
||unlimitedtools.website^

! redirects to already blocked sites
||coub.com/stories/946163-free-discord-nitro-codes-list-all-valid-with-no-human-verification^

! scam browser theme
||chrome.google.com/webstore/detail/discord-free-nitro-free-d/ihdnmkbgjnpbkdcammpfokdmncnicfki^
||unlock3r.net^
||nitroboostcord.blogspot.com^
||appbase.best/dboost^

! looks very shady
||www.taixiu.bet^
||taixiu.bet^

! https://github.com/AdguardTeam/AdguardFilters/issues/111843
||cybop.net^

! https://forums.malwarebytes.com/topic/284608-crypto-giveaway-scams/
||x2-shiba.org/shiba/giveway.php^
||ark-today.com/ethgiveaway.html^
||ark-today.com/btcgiveaway.html^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1060031240
||webcams-chat.com^
||mydirtytinders.com^

! yet another fake Discord Nitro Generator
||www.everydaywinner.com^
||everydaywinner.com^
||generatekey.xyz^
||e.9nl.it^
||www.monumented.com^
! looks like Fox News, to promote something which is probably a scam
||www.livingyourbestlife.co^
||livingyourbestlife.co^
||foxnewsweatherdaily.com^

! https://virustotal.com/graph/gae4b79eddfec44439142fec34bf90890609e118340984dbd855b515b1be9cfc9
||holgerstrehlow.de/discord-nitro-code-generator-no-human-verification.html^

! auto-redirect from hxxpx://createwithkrista[.]co/windows/winrar-for-windows-10-64-bit-free-download-with-crack/
||outto.us^
! hxxpx://thecornermarket[.]co/free-crack/winrar-64-bit-download-crack/?utm_referrer=https%3A%2F%2Fwww.bing.com%2F
||merchd.rip^

! the rest is blocked
||buymeacoffee.com/getcode/discord-free-nitro-generator-no-human-verification-survey^

! YAFNG (Yet another fake Nitro generator)
||nitromexyz.xyz^
||grptrac.com^

! https://app.any.run/tasks/b43b04b3-b8c1-4384-b455-961f427f5379
||h.shyflirttalks.com^

! Yet Another fake discord generator
||pota.site-ym.com/global_engine/download_custom.aspx?fileid=c0f7d962-63d2-4ab2-82dd-7582a79c5ba0.pdf&filename=discord2021_gu-36.pdf&blnIsPublic=2&code=blog&sub=add^
||gamex.codes^
||consumerdigitalsurvey.com^

! Reddit spam --> already blocked
||reddit.com/r/Viral_Nova/comments/r1nwxg/free_discord_nitro_generator_hack_no_human/^
! Already blocked
||myget.org/feed/hermesses/package/nuget/Free-Discord-Nitro-Hack-No-Human-Verification^
||d.promotionsonlineusa.com^
! Also blocked
||replit.com/@discordnitross^

! https://forums.malwarebytes.com/topic/285189-scam-warnings-of-trojansviruses-via-web-browser-service-workers/
||yourwebshield.com^

! https://app.any.run/tasks/a8a589e0-2aee-43f5-9fbe-92dc9e4bfec4
||action.miliated.xyz^
||undrininvereb.info^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1094359634
||disq.us/p/2o9pztr^
||disq.us/p/2o9qqsl^
||disq.us/p/2o9pmyi^
||2horney-girls.life^
||localdates16s.com^
||popupchat-live.com^
||bhgfsfh.com^

! a "press allow to continue" + fake McAfee
||ultrafastultra.blogspot.com^
||tei.ai^
||forfrogadiertor.com^
||ourdailystories.com^

! Fake Discord nitro generator
||acreauburn.com/profile/kyrrwgutzctpad/profile^
||www.uplevelreward.com^
||uplevelreward.com^

! https://github.com/uBlockOrigin/uAssets/pull/12699
||ziltzwebsol.online^

! even more fake Discord Nitro generators
||coub.com/stories/946163-free-discord-nitro-codes-list-all^
||t.co/5N0H4rfCgL?DiscordNitro^
||t.co/5N0H4rfCgL^

! Google Group --> Discord Nitro generator
||groups.google.com/g/discord-nitro-generator-free-2021-without-human-verification/c/1MKZDSll9uA?msclkid=7bce476ac87a11eca172b94bbb5a5692^
||groups.google.com/g/discord-nitro-generator-free-2021-without-human-verification/c/1MKZDSll9uA^
||groups.google.com/g/discord-nitro-hack-generator-no-survey-or-verification^
||groups.google.com/g/discord-nitro-hack-generator-no-survey-or-verification?msclkid=316e2fa7c87e11ec972f52d4d5e431fd^

! https://github.com/AdguardTeam/AdguardFilters/issues/115955
||family24rx.com^
||37.187.88.137^
! https://github.com/AdguardTeam/AdguardFilters/issues/115960
||onpharmvermen.com^
! https://github.com/AdguardTeam/AdguardFilters/issues/115959
||classpharmenado.com^
! https://github.com/AdguardTeam/AdguardFilters/issues/115958
||sale24-pills.com^
! https://github.com/AdguardTeam/AdguardFilters/issues/115957
||helppharmlead.com^
! https://github.com/AdguardTeam/AdguardFilters/issues/115954
||everypdnsharmacy.com^
! https://github.com/AdguardTeam/AdguardFilters/issues/115953
||happypharmproduct.com^

! Fake Norton screen
||static.cdnativepush.com/contents/s/69/55/b8/8c4f4e3359518f986fc7970194/0201779526711.png^
||static.cdnativepush.com/contents/s/6e/aa/67/726cd9cf6ea6a525bbb628cab3/0303553451413.png^
||littlecdn.com/apps/contents/s/e1/43/b6/8d4db17f1838a03992a72e9dbf/01412844174435.png^
||gapscult.com^

! a fake MediaFire domain
||walkeryellow141.weebly.com^
||www.rewards-cards.org^
||www.dealskeeper.com^
||h.promotionsonlineusa.com^

! ads on hxxp://gestyy[.]com/es8jOv
||m.eegeeglou.com^

! Discord Nitro generator (fake)
||montaluce.com/profile/dybiivskjcrpe/profile^
||filevortex.com/show.php?cl=*&l=*&u=*&id=*^
||y.promotionsonlineusa.com^

! ads on a site --> https://virustotal.com/gui/url/0871f217f945c993d8624aadd5e718e9bb740096d13fad74d58b3fc3a4fdfda0
||ebaaa.xyz^
||uprimp.com^
||odaba.live^


! a random popup
||lifeimpressions.net^$popup
||d0063d.lifeimpressions.net^
||100800.lifeimpressions.net^
||fdb51a.lifeimpressions.net^
||3ceeb9.lifeimpressions.net^

! https://github.com/AdguardTeam/AdguardFilters/issues/121544
||trafredirtds.com^

! https://web.archive.org/web/20230604184126/https://twitter.com/iam_py_test/status/1538267982551347200
||may8forstudents.org/free-discord-nitro-codes-list-no-human-verification/^
||www.easyrobuxtoday.org^
||robloxhackv2111.blogspot.com^
||appinstallcheck.com^
||api.pushnami.com/api/push/image/id/61f58059b94aff0015c3e03c^

! weird website with some Push Allow To Continue alerts - hxxpx[://]www[.]filefixation[.]com/malwarebytes-pro-crack-serial-keygen-download.html
||filefixation.com^
||www.filefixation.com^
||deal-warriors.com^

! ads
||ffe405491d.28b67b8230.com^$popup
||german0.xyz^
||wnprt.club^
||kerbians.click^

! redirects to scams
||sharefast572.tumblr.com^
||tumblr.gotohouse.top^
||gotohouse.top^

! redirected to scams automatically
||loadingdead.netlify.app^
||down.myboxloadneed.top^
||myboxloadneed.top^

! fake download to scams
||alexisfernandez.doodlekit.com^
||doodlekit.gotorange.top^

! tech support scam - https://forums.malwarebytes.com/topic/287438-excel-macro-40-abuse-protection-prevents-opening-password-protected-files/?do=findComment&comment=1519928
||ewebprotection.info^

! hxxps://iyoutubetomp4[.]com/en/
||img.pushflow.net/creatives/11/6706/1654098151508-push-preview-img.png^
||img.pushflow.net/creatives/11/6706/1654098151508-push-body-img.png^
||img.pushflow.net/creatives/11/5543/1646745691054-push-preview-img.png^
||justtrck.net/run.php^

! https://app.any.run/tasks/8125703c-6fdb-49bc-a18c-918e64e83f4d
||nedaugha.buzz^
||jarine.co^
||nedukeratio.lol^
||lsmnz.perfordpetre.xyz^
||perfordpetre.xyz^

! Discord scam
||challonge.com/discordnitrogenerator/^

! Push-Allow-To-Continue
||ptaimpeerte.com^
! possible tech support scam, might be dead
||vyredis.bio^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1195654525
! https://github.com/DandelionSprout/adfilt/commit/5ca8e833c7817f2d5929a4adf4792fdcbb822fc0
||k-yw.com^

! McAfee-themed scam
||d3f068fvt45f1f.cloudfront.net^
||eastrk-dn.com^

! Fake giveaway
||teenmas46.tistory.com^
||teenymi.tistory.com^
||myapplesite.us^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1209782781
! https://app.any.run/tasks/a7cc86ee-a604-4a65-968c-26c237620b2b (nsfw)
||girlluscious.com^
||fuckbook.tv^

! https://www.youtube.com/watch?v=6e7MsoThffo
||loadnova898.netlify.app^
||tonrino.info^
||new.bestageoffers2022.com^
||d0zi.com^
||rewards-cards.org^
||x-delivery.icu^
||nextsoft.icu^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1218058597
||a2ics.eu^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1230875702
||youtube.com/channel/UCxpXAcML6p3Ns5T9GwEK5hQ^
||stils-top.space^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1230939213
||classicsgirl.com^

! https://app.any.run/tasks/a24d7146-479f-4b90-b4d6-c9d6e73257a8
||pogothere.xyz^
||sihighlyrecom.xyz^
||czxcm.sihighlyrecom.xyz^
||rwanf.sihighlyrecom.xyz^
||zosuc.sihighlyrecom.xyz^

! https://forums.malwarebytes.com/topic/290022-malware-from-acaptchalesstop/ <-- No proof, but the domain name looks sus
||captchaless.top^
||a.captchaless.top^
||pshmetrk.com^

! https://virustotal.com/gui/url/d86dda38f96243311df2857966c047be0b4097ed4541ebe28cdc0dfc9e4ff4d2/community
! https://app.any.run/tasks/3c8b1d38-de18-488a-9e3f-62b3354c17e8
||talkweb.org.uk/cl/36889_md/4/5055/3668/710/150935^
||haltertrailer.info^
||safesecureprotect.com^
||trk-magnam.com^
||event.trk-magnam.com^
||push.trk-deserunt.com^
||subscription.trk-deserunt.com^
||event.trk-deserunt.com^
||trk-deserunt.com^
||core.alertsx.com^
||alertsx.com^
! https://twitter.com/iam_py_test/status/1571997052900413440 (image is age restricted for some reason, thus can't archive)
||medialysticos.live^

! Porn scam
||her-cupid.com^
||hottieswantu.com^
||offers.usabangpalace.com^
||w86a5jeili53sd6j26lv71h0.find-singles-online.com^
||find-singles-online.com^

! https://forums.malwarebytes.com/topic/290348-fake-mcafee-site/
! credit to https://forums.malwarebytes.com/profile/62534-chas4/
||install-network.com^
! https://app.any.run/tasks/541d38e7-67d1-46a7-85c8-dfcba7e40761
||fatededers.com^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1257870944
||netbuilding.com.ar^

! Push scam shared by https://github.com/Yuki2718
||nextpsh.top^

! Scam shared by https://github.com/piquark6046 (https://app.any.run/tasks/c30445b3-cc48-4039-9b02-26289f798b2f)
||54.37.5.34^

! redirects from a hacked website
||rx-qualityshop.com^
||canadatrustmed.com^

! domains used by adfly for notification spam
! https://github.com/DandelionSprout/adfilt/commit/f60df9e069b404ce56727cc1b734b89ba7241849
! https://github.com/AdguardTeam/AdguardFilters/issues/132079
||davisonbarker.pro^
||www64.davisonbarker.pro^
||www31.davisonbarker.pro^
||www10.davisonbarker.pro^
||www24.davisonbarker.pro^
||www62.davisonbarker.pro^
||www87.davisonbarker.pro^
||www16.davisonbarker.pro^
||www61.davisonbarker.pro^
||www50.davisonbarker.pro^
||www77.davisonbarker.pro^
||www100.davisonbarker.pro^
||www85.davisonbarker.pro^
||www76.davisonbarker.pro^
||www39.davisonbarker.pro^
||www28.davisonbarker.pro^
||www3.davisonbarker.pro^
||www75.davisonbarker.pro^
||www78.davisonbarker.pro^
||www15.davisonbarker.pro^
||www29.davisonbarker.pro^
||www70.davisonbarker.pro^
||www21.davisonbarker.pro^
||www59.davisonbarker.pro^
||www25.davisonbarker.pro^
||www17.davisonbarker.pro^
||www74.davisonbarker.pro^
||www99.davisonbarker.pro^
||www79.davisonbarker.pro^
||www22.davisonbarker.pro^
||www94.davisonbarker.pro^
||www45.davisonbarker.pro^
||www51.davisonbarker.pro^
||www98.davisonbarker.pro^
||www35.davisonbarker.pro^
||www92.davisonbarker.pro^
||www12.davisonbarker.pro^
||www37.davisonbarker.pro^
||www33.davisonbarker.pro^
||www68.davisonbarker.pro^
||www34.davisonbarker.pro^
||davisonbarker.pro/am-push-cps.js$script
||lowrihouston.pro^
||www53.lowrihouston.pro^
||www44.lowrihouston.pro^
||www48.lowrihouston.pro^
||www91.lowrihouston.pro^
||www57.lowrihouston.pro^
||www1.lowrihouston.pro^
||www42.lowrihouston.pro^
||nathanaeldan.pro^
||www97.nathanaeldan.pro^
||www61.nathanaeldan.pro^
||www48.nathanaeldan.pro^
||www4.nathanaeldan.pro^
||www86.nathanaeldan.pro^
||www84.nathanaeldan.pro^
||www50.nathanaeldan.pro^
||www39.nathanaeldan.pro^
||www16.nathanaeldan.pro^
||www44.nathanaeldan.pro^
||freddyoctavio.pro^
||www63.freddyoctavio.pro^
||www70.freddyoctavio.pro^
||www16.freddyoctavio.pro^
||www36.freddyoctavio.pro^
||www21.freddyoctavio.pro^
||www68.freddyoctavio.pro^
||www72.freddyoctavio.pro^
||www86.freddyoctavio.pro^
! various domains farmed from adfly
! https://app.any.run/tasks/e18002cc-5207-4834-9e67-08364efb5036
||toido.arrowtoldilim.com^

! https://forums.malwarebytes.com/topic/291290-infected-with-chilichicytriecom/
||chilichicytrie.com^

! https://app.any.run/tasks/07bb037e-3180-40cd-8f59-b7854cabd601/
||linkedin.com/pulse/free-discord-nitro-generator-verification-maxpro-game-gadget-2022^
||cutt.ly/YV9jKsf^
||gamegadget2022.blogspot.com^
||easymoneysurvey.space^
||gifttopsurvey.top^
! https://app.any.run/tasks/da8a44c3-965f-4fd6-816d-b5ae16235f62
||iphone14.winnenmetje.info^
||winnenmetje.info^

! https://virustotal.com/gui/url/7b40e1b7ffc3b710640ae41c529aff18e4c8cded55391d55c34b601912c5a2a2/community
! https://app.any.run/tasks/f0a198be-f4a4-4414-94c5-21ed61ae0264
! https://app.any.run/tasks/6600c704-20f5-4643-a9b7-322673aa7eb4
||www.vbucks-goo.com^
||vbucks-goo.com^
||take.yunosurveys.com^
||www.jpnbgn.com^
||1263dcb80ec5.789offers.net^
||789offers.net^

! https://forums.malwarebytes.com/topic/291952-mb-keeps-finding-same-4-pups/#comment-1541507
||a.wilycaptcha.live^
||wilycaptcha.live^
||captchasee.live^
||captchatotal.live^

! https://app.any.run/tasks/c87a34ca-0d2f-43cb-be6d-8f48506bd723
||ftuyn.ewoverth.buzz^
||elooksjustli.one^

! https://app.any.run/tasks/6bd12a68-ef8e-4e44-9c66-9c8e82cb784c
||2.napublic.com^
||napublic.com^
||haxbyq.com^
||authookroop.com^
||dlinkrdr.com^
||s.viichxt.com^
||getsecures.com^
||s.viiqvmfb.com^

! porn-related scams
||flirtclub.life^
||bumble-me.com^
||localhookup5.com^
||i.placefordating.live^
||placefordating.live^
||eroticmadness.com^
||jtdn2.datingtopgirls.com^
||datingtopgirls.com^
||join-the-dating.com^
||18hot.pw^

! https://app.any.run/tasks/87b656b2-3fd6-4bae-9267-f918ea4189ac
||dating-hotcontacts.com^

! https://youtu.be/GiixWxddP_M?t=1237
||caren.live^

! https://scammer.info/t/discord-nitro-scam/113648
||132.226.203.60^
||www.iphonediscord.info^
||iphonediscord.info^

! popups from shady URL shorteners
||mediasama.com^
||nadjustifygas.com^
||ufacw.com^
||lyconery-readset.com^
||fralstamp-genglyric.icu^
||m1dnightclubx.com^

! https://app.any.run/tasks/a15bbdd6-64d6-4a49-8457-6fbef1d00872
||form.run/@fortnite-v-bucks-codes-hack-generator-no-human-verification^
||free-fortnitevbucksgenerator.blogspot.com^
||belohnung24.com^
||techplanet1.com^

! https://app.any.run/tasks/5a76864c-7436-4411-afc8-5937e8d1d147#
||form.run/@free-tiktok-followers-fans-likes-generator^
||dwmsurhf1svv8.cloudfront.net^
! https://app.any.run/tasks/f7cdecba-0b76-4a5f-9d19-c36a453130dc
! https://tria.ge/240411-xhwjtahh93/behavioral1
||nationalconsumerscenter.co.uk^
||contact.nationalconsumerscenter.co.uk^

! https://forums.malwarebytes.com/topic/292511-phishing-site-for-fake-usps-shipping-validation-information/ (account required)
! https://virustotal.com/gui/url/fdefaa6e73e722536cd080b4e820f8b69b6678d5f0c74268de126d2435369386
||uspftiltedt.info^

! https://www.bleepingcomputer.com/forums/t/779953/urambledcom-just-a-nuisance-or-what/
||urambled.com^

! https://tria.ge/221208-2zaqwsbg78/behavioral1
! I got some kind of miner/adware and an adware extension! All in one run!
||manualmaestro.com^
||holavpninstaller.com^
||cdn4.holavpninstaller.com^
||perr.holavpninstaller.com^
||client.holavpninstaller.com^

! https://forums.malwarebytes.com/topic/292800-posiberchoncom-%C2%A0malwarebytes-please-research-and-update-your-virus-db/
||posiberchon.com^

! https://app.any.run/tasks/68b82f9e-16f5-4514-8140-ac3df58a3114
||pastebin.com/K5YfahnC^
||fastspeed121.xyz^
||track.buzz-track.com^
||main.smile-keeper.com^

! https://app.any.run/tasks/41c5f7b2-250a-4781-86be-e03e56d1a8ed
||telegra.ph/Free-Minecraft-Hacks-No-Virus-Free-Download-08-03^
||tlgrph.gotorange.top^
||gotorange.top^
||puredating.top^

! (NSFW) https://app.any.run/tasks/e5a682c3-c4a3-4bb9-abd7-4f6c1cbd22f3
||telegra.ph/Free-Minecraft-Hacks-No-Virus-Free-Download-07-30^
||dating-schedule.com^
||onlyfucks1s.com^
||d.wonderfuldating.top^
||wonderfuldating.top^
||milf-book.com^
||www.casualdates4you.com^
||casualdates4you.com^

! an infected VM
||dreamyproducts4u.net^
||xorror.shop^
||getarrectlive.com^
||identitysecurecenter.online^
||get.securedbrowser.net^
||securedbrowser.net^
||settings.securedbrowser.net^
||www.securedbrowser.net^
||search.securedbrowser.net^
||microsoftedge.microsoft.com/addons/detail/gfbbhkcipmfiidllnalpchabihdgklnl^
||microsoftedge.microsoft.com/addons/detail/secured-browse/gfbbhkcipmfiidllnalpchabihdgklnl^
||kms-auto.site^
||phenotypeguide.com^
||onesocialimpactnow.com^
||globaledyta.com^
||topcontactinc.com^
||adsforcomputertech.com^
||pushuworld.com^
||jytibarose.xyz^
! https://app.any.run/tasks/67907c11-6877-4c38-932f-2cf09ee4e434
||adblock-chrome.net^

! https://github.com/uBlockOrigin/uAssets/issues/16000
! https://app.any.run/tasks/195b871c-b9cd-48f8-a7c1-6a53ea943a4b
||z83z9.com^
||toftheca.buzz^
||zcelv.toftheca.buzz^
||fvsuo.toftheca.buzz^
||videofon.space^
||videofen.space^
||video7top.com^
||click-videov.com^
||click-videot.com^
||click-videom.com^
||click-videok.com^
||click-videoc.com^
||video7top.site^
||videobtc.space^
||videoeth.space^
||videofun.space^
||videofan.space^
||videoton.space^
||videosol.space^
||ythjhk.com^

! https://app.any.run/tasks/e0266815-2e00-42cb-b646-fa7dffb4a5e5
||myget.org/feed/roblox-generator-no-verification/package/nuget/free-robux-generator-no-verification-or-survey-2022-v5153^
||deine.belohnung24.com^
||spr.belohnung24.com^
||expensivesurvey.click^
||af.247games.mobi^

! a "meet local girls" scam
||easy-sexxx.com^

! various scams from one site
||recodetime.com^
||updateinfoacademy.com^
||updaterglobal.com^
||phooking-nearected.com^
||deten.live^

! https://forums.malwarebytes.com/topic/293205-alexa-support-scam/
||twitter.com/smartdotsupport^
||smartdotsupport.com^
||privacysearching.com^

! probably a Tech Support scam
||bigoven.com/recipe/alexa-helpline-1-855-666-7789-alexa-customer-service-number/2897947^

! discord nicro scam
||discordnitrocodegeneratorfree2022nohumanverification.weebly.com^
||gainforfree.com^

! https://virustotal.com/gui/url/65e7a48f0f2efb758087a0d99e8482a4b3245468e959633493655754fec08f48/community
! https://app.any.run/tasks/58b76078-e35e-46c8-b15e-e187ed375be6
||bubuxflow.com^

! https://virustotal.com/gui/url/9c7b98445c0fd303be8604f383b3c940309068ea88b37d3945f4d34bb42d6c57/community
! (nsfw) https://app.any.run/tasks/a8a191ea-0e54-439f-96fd-c04a04150b06
||expresscommusa.com^
||flirtingworld.com^
||date.sofortdates69.com^
||sofortdates69.com^

! https://forums.malwarebytes.com/topic/293293-i-clicked-on-something-and-i-got-redirected-to-malicious-website-help/
! https://forums.malwarebytes.com/topic/293294-fake-onlyfans-website/ (account required)
! https://app.any.run/tasks/cb1a672e-c3ed-455a-bc84-4b8bc060ee68
! https://www.hybrid-analysis.com/sample/c3190b42a350a79f2b97af529a8bb57f39b62c9b12367419e71a2d053fb4a5fe
||sexfriendfdr.freeflirtz.com^
||freeflirtz.com^

! https://app.any.run/tasks/6c4f152f-c5b2-43ab-9b9e-06ae1480c74d
||mnla.biz/resource/dynamic/blogs/20220207_071000_31161.pdf^
||cdn.ymaws.com/www.mnla.biz/resource/dynamic/blogs/20220207_071000_31161.pdf^
||cldoffers.net^

! https://virustotal.com/gui/url/5808655d76b6ad31b7cc15fc266be2acb904ff8512fc1424103a6c54443bd272/community
! https://app.any.run/tasks/f619367b-ba77-4dbb-9046-211758a7f31a (my "analysis")
||viptips4youtoday.world^

! typical fake "discord nitro generator"
||an1.fun^
||b7ax3cyzhq.com^
||thunderfiles.co^
||g.luckycashzone.com^

! https://forums.malwarebytes.com/topic/293412-possible-fake-malwarebytes-number/
||isixsigma.com/members/malwarebytesmailcxsupport

! https://dnstwist.it/
! https://app.any.run/tasks/015824a4-f267-48df-8dde-a7ddd78f167e
||discordt.com^
||wildberriessgift.pw^

! https://scammer.info/t/viruses-need-to-be-removed-immediately-take-emergency-measures-trojan/117241/3
||install.sunlifestores.com^

! https://virustotal.com/gui/url/2dabab937f09b2892f26c995365f64402574c8aa3e2f9750047131ca7a8d73d6
! https://tria.ge/230109-14rdrsbd6t/behavioral1
||lootprime.com^
||rdr.mobiletime.net^

! https://github.com/AdguardTeam/AdguardFilters/issues/139667 (credit to DandelionSprout for some of these entries)
||500654179.kilpa2017.fi^
||yepsimmen.live^
||kilpa2017.fi^
||51.68.87.229^
! resolve to 51.68.87.229
||hillendan.live^
||intoobut.live^
||logomuado.live^
||laxthatpie.live^
||nebdanext.live^
||drewcorsit.live^
||weyeplost.live^
||loaditjew.live^
||rawsalwet.live^
||rugpinchi.live^
||tillwoonote.live^
||becashcode.live^
||absbeatsic.live^
||tooldidhurt.live^
||crypostmark.live^
||varyhurtback.live^
||toeastdue.live^
! https://github.com/AdguardTeam/AdguardFilters/issues/139667#issuecomment-1383935774
||tapwhomjay.live^
! https://github.com/AdguardTeam/AdguardFilters/issues/139667#issuecomment-1387103725
! https://virustotal.com/gui/url/5c74d63d19b8ec82321d352749977e29795a9d074fcdacce3f1c822da28a3bba/detection
||mindkneenay.live^
! https://github.com/AdguardTeam/AdguardFilters/issues/139667#issuecomment-1398421015
! https://github.com/AdguardTeam/AdguardFilters/issues/139667#issuecomment-1399002017
! https://tria.ge/230120-1tlersbg8x/behavioral1
||totalrecaptcha.top^

! https://github.com/DandelionSprout/adfilt/issues/747
! https://github.com/DandelionSprout/adfilt/commit/f055f89a51e7f9b1bcc58a0013b6207f89594ebe (all credit to DandlionSprout)
||2022crucialcatch.store^
||adidascostarica.com^
||adidasencostarica.com^
||adidasfactoryoutlet-uk.com^
||adidasfactoryoutletonline.com^
||adsoutletusa.com^
||adulttoysale.top^
||airjordanshoes.store^
||airjordansneakers.store^
||alabamacollege.store^
||alabamacrimsontide.store^
||aldo-sale.com^
||aldofactoryoutletcanada.com^
||aldoukshoes.com^
||allinclearance.com^
||aloyogaaustria.com^
||aloyogacz.com^
||altrafactoryoutletonline.com^
||approachmall.com^
||arastockistsuk.com^
||arizonacollege.store^
||arkansascollege.store^
||arkansasrazorbacks.store^
||asiacenter.sk^
||asicousutlet.com^
||asicrunningus.com^
||asics-outlet-greece.com^
||asicscolombiaoutlet.com^
||asicsfalabella.com^
||asicsoutletnl.com^
||asicsoutletsireland.com^
||asicssgonline.com^
||asicsskosneakers.com^
||astroshat.store^
||astrosjersey.store^
||astrosworldseries.store^
||astroswschampions.store^
||atl-braves.shop^
||atlantabraves.store^
||auburncollege.store^
||aukarenmillenbest.net^
||balansukcheap.com^
||baseballhat.store^
||baseballjerseys.store^
||basketballshoe.store^
||bayaayakkabi.com^
||baylorbears.shop^
||baylorbearsncaa.store^
||baylorcollege.store^
||begaborschoenensale.com^
||bestsclothingsale.com^
||billabong-turkiye.com^
||billabong-us.com^
||billabongoutletstore.com^
||billabongoutletuk.com^
||billabongromania.com^
||billabonguruguay.com^
||blundstonefactoryoutletus.com^
||bogsoutletie.com^
||bossoutletsau.com^
||bosssalescheap.com^
||bossukcheaps.com^
||bossusaclearan.com^
||bossusaoutlet.com^
||bossusbest.com^
||bossusclearan.com^
||bostoncollegecollege.store^
||bostoncollegeeagles.store^
||bostonjersey.store^
||bravesjersey.store^
||bravesworldseries.shop^
||broncosnfl.store^
||buccaneersjersey.store^
||bucsjersey.com^
||bucsjersey.sale^
||buffalopolska.net^
||bugattishoessaleuk.com^
||butypumaoutlet.com^
||californiasports.shop^
||camperportugal.com^
||camperskonorge.com^
||camperzapatochile.com^
||camperzapatoschile.com^
||canadagoosebrasil.com^
||cancercatch.store^
||carharttfactory-store.com^
||cariuma-australia.com^
||cariumafactoryoutlet.com^
||celticsfan.store^
||celticsjersey.shop^
||celticsjersey.store^
||chacofootwearusa.com^
||chaconewzealand.com^
||chacooutletswebsite.com^
||chacosandalsaustralia.com^
||chacoshoesuk.com^
||cheapdiesesale.com^
||cheappumuk.com^
||cheapsclothingus.com^
||chgaborschuhe.com^
||cincinnatibearcats.shop^
||cincinnaticollege.store^
||cipomagyarorszag.com^
||cipooutlethungary.com^
||cityconnect.pro^
||cityconnect.shop^
||cityconnect.store^
||cityconnecthat.shop^
||cityconnecthat.store^
||cityconnectjersey.store^
||cityconnectmlb.store^
||clarkcheapuk.com^
||clarkclearanus.com^
||clarkdiscountus.com^
||clarks-ar.com^
||clarks-dk.com^
||clarks-pe.com^
||clarksirelandshop.com^
||clarksoutlet-philippines.com^
||clarksoutletecuador.com^
||clarkssaleturkiye.com^
||clarksskonorge.com^
||clarksuy.com^
||clarkusoutlets.com^
||clarusaoutet.com^
||clearanclarkusa.com^
||clearanlacostus.com^
||clearanlacostusa.com^
||clearanskecheusa.com^
||clearantumius.com^
||clearantumus.com^
||clemsoncollege.store^
||clemsontigers.online^
||clemsontigers.store^
||clipperton.sk^
||coacbestusa.com^
||coacoutletsusa.com^
||coacoutletusa.com^
||coausaclearan.com^
||collegeauburntigers.store^
||collegebuckeyes.shop^
||collegefootballshop.top^
||collegegameshop.com^
||collegejayhawks.store^
||collegejersey.store^
||collegencaa.store^
||collegepro.store^
||collegespartans.com^
||collegewolverines.store^
||coloradobuffaloes.store^
||coloradocollege.store^
||columbiafactorysusa.com^
||columbiaoutletco.com^
||columbiaoutletonlines.com^
||columbiasalemalaysia.com^
||columbisportsale.com^
||columoutletusa.com^
||columsportsale.net^
||columsportsusa.com^
||converse-finland.com^
||converse-malaysia.com^
||converseirelandshop.com^
||converseschweizshop.com^
||crucialcatch.online^
||crucialcatch.pro^
||crucialcatchhoodie.store^
||crucialcatchpro.store^
||crucialcatchshop.pro^
||crucialcatchstore.com^
||dallascowboys.sale^
||demonia--suomi.com^
||demonia-boots-australia.com^
||demonia-boots-uk.com^
||diadora-schoenen.com^
||dieseclothingus.com^
||dieselsalebests.com^
||dieselsalesfr.net^
||diesusoutlet.com^
||discountskecheus.com^
||discounttumusa.com^
||discountumius.com^
||dkgaborsneakers.com^
||dodgershat.shop^
||dodgershat.store^
||dodgersjersey.shop^
||dodgersjersey.store^
||drcanadaoutletstore.com^
||dukebluedevils.store^
||dukecollege.store^
||ecco-canadasale.com^
||ecco-turkiye.com^
||eccodanmarkwebbutik.com^
||eccofactoryoutlets.com^
||eccofactoryoutletus.com^
||eccofactoryoutletusa.com^
||eccooutletukfactory.com^
||eccoshoesnz.com^
||eccoskonorge.com^
||eccsaleusonline.com^
||ellumalls.com^
||elluthings.com^
||encompassmalls.com^
||enucuzuggbot.com^
||evolutionmalls.com^
||exynet.sk^
||fanaticsretailer.store^
||fanaticsshop.net^
||fashioninmall.com^
||fightingirish.shop^
||fightingirish.store^
||firstcoastthings.com^
||fitflop-irelandstockists.com^
||fitflop-philippines.com^
||fitflop-ukoutlet.com^
||fitflopfactoryoutlet.com^
||fjallravengreece.com^
||fjallravenitalia.com^
||fjallravenoutletpolska.com^
||fjallravenschweiz.com^
||fjallraventilbud.com^
||floridagators.sale^
||floridagators.store^
||floridagators.xyz^
||floridastatecollege.store^
||floridastateseminoles.store^
||flylondonportugal.com^
||footballstaple.store^
||fredperrylojas.com^
||fredperrymelbourne.com^
||fryefactoryoutlet.com^
||fryeshoescanada.com^
||gabor-chweiz.com^
||gaborbelgique.com^
||gaborcanadasale.com^
||gaborfactoryoutlets.com^
||gaborfactorysoutlets.com^
||gaborireland.com^
||gaborirelandsale.com^
||gaboroutlet-online.com^
||gaborpolska.com^
||gaborsaleireland.com^
||gaborschuheshop.com^
||gaborshoeespana.com^
||gaborshoesespana.com^
||gaborshoesireland.com^
||gaborshoesnz.com^
||gaborshoesuk.com^
||gaborskodanmark.com^
||gaborskonorge.com^
||gaborsneakers.com^
||gaborsuomi.com^
||gaborsverige.com^
||gaboruksale.com^
||gatorscollege.store^
||geacahellyhansenoutlet.com^
||georgiabulldogs.pro^
||georgiabulldogs.shop^
||georgiabulldogs.store^
||georgiacollege.store^
||geoxaustralia.com^
||geoxmalaysia.com^
||gheteclarksromania.com^
||gonzagabulldogs.store^
||goodr-australia.com^
||goodr-indonesia.com^
||goodrphilippines.com^
||goodrsingapore.com^
||goodrsunglassesmalaysia.com^
||goodrsunglassessaleus.com^
||goodrsunglassesuk.com^
||groundiesshoesuk.com^
||gym-shark-usa.com^
||gymshark-canada.com^
||gymshark-greece.com^
||gymshark-ireland.com^
||gymshark-southafrica.com^
||gymsharkaustria.com^
||gymsharkgreeceshop.com^
||gymsharksaleus.com^
||gymsharkunitedkingdom.com^
||gymsharkunitedstates.com^
||haglofsrea.com^
||haglofstilbud.com^
||haglofsturkiye.com^
||haglofsusastore.com^
||havenshungary.com^
||hellyhansencanadasale.com^
||hhjacketsfactoryoutlet.com^
||hitecayakkabi.com^
||hitecchaussure.com^
||hitecscarpe.com^
||hitecschoenen.com^
||hitecskonorge.com^
||hitecsouthafrica.com^
||hockeyfightscancer.store^
||hokairelandsales.com^
||hokashoesaustralia.com^
||hotsaleclearance.com^
||houstonastros.store^
||houstonastrosfan.store^
||hoyoufat.store^
||hoyoufatjersey.store^
||hugobossclearanuk.net^
||hushpuppies-uk.com^
||hushpuppiesshoesoutlet.com^
||illinoiscollege.store^
||illinoisfightingillini.shop^
||illinoisfightingillini.store^
||iowacollege.store^
||iowahawkeyes.pro^
||iowahawkeyes.shop^
||iowahawkeyes.store^
||iowastatecollege.store^
||iowastatecyclones.store^
||jackwolfskindubai.com^
||japanzarclothes.com^
||jayhawkscollege.store^
||jeweloutletshopline.com^
||jeweloutletshoplus.com^
||jewelrylimitedsr.com^
||jordanshoe.store^
||jordanshoes.store^
||josefseibelshoesuk.com^
||kamikbootsukstore.com^
||kankenportugal.com^
||kansasjayhawks.shop^
||kansasstatecollege.store^
||kansasstatewildcats.store^
||karenmillebestus.com^
||karenmillensusoutlet.com^
||karenmillenusbest.com^
||karenmilleusaclearan.com^
||karenmilleusasale.com^
||karenmilleusastore.com^
||katespusoutlet.com^
||keds-schuhe.com^
||kedsonlineshopnl.com^
||keen1uae.com^
||keenshoesfactoryoutletsuk.com^
||keenuae.com^
||kenscottshop.com^
||kenscottshopify.com^
||kentuckywildcats.shop^
||kentuckywildcats.store^
||ksgiftshopline.com^
||kubasketball.shop^
||kurtka-hhsklep.com^
||lachargers.store^
||lacostcheapuk.com^
||lacostclearances.net^
||lacostdiscountus.com^
||lacosteclearanusa.com^
||lacosteuaeonline.com^
||lacostsaleusa.com^
||lacostusabest.com^
||ladodgershat.shop^
||ladodgersjersey.store^
||lasport.shop^
||legginsmexico.com^
||lojashushpuppies.com^
||longchamp-luxembourg.com^
||longchamp-southafrica.com^
||longchampbagsonsalecanada.com^
||longchampfactoryoutletuk.com^
||longchampoutletenligne.com^
||longchampoutletsydney.com^
||longchampparissoldes.net^
||longchampuaedubai.com^
||losangelesdodgers.store^
||louisvillecardinals.store^
||louisvillecollege.store^
||lowa-boots-uk.com^
||lowakangor.com^
||lowaoutlet-usa.com^
||lowaslovensko.com^
||lsucollege.store^
||lsutigers.store^
||mango-pakistan.com^
||marmot-australia.com^
||marmot-schweiz.com^
||marylandcollege.store^
||marylandterrapins.store^
||merrell-outletfactory.com^
||merrell-sg.com^
||merrell-shoesphilippines.com^
||miamicollege.store^
||michigancollege.store^
||michiganstatecollege.store^
||michiganstatespartans.store^
||minnesotacollege.store^
||minnesotagoldengophers.store^
||mississippistatebulldogs.store^
||mississippistatecollege.store^
||mixedmalls.com^
||mizunooutletuk.com^
||mlballstar.net^
||mlballstarshop.com^
||mlbastros.store^
||mlbastrosjersey.store^
||mlbbaseballhat.store^
||mlbbraves.pro^
||mlbcap.net^
||mlbcapshop.com^
||mlbcityconnect.sale^
||mlbcityconnect.store^
||mlbfansjersey.store^
||mlbfanstore.com^
||mlbhat.sale^
||mlbhat.store^
||mlbhat.top^
||mlbhats.sale^
||mlbjersey.store^
||mlbjerseys.online^
||mlbjerseysale.shop^
||mlbjerseyshop.net^
||mlbprobraves.store^
||mlbprojersey.com^
||mlbraves.store^
||monitormalls.com^
||nba75.store^
||nba75jerseys.store^
||nbaallstarfan.store^
||nbafanjerseys.com^
||nbafansjersey.com^
||nbajerseycheap.com^
||nbajerseys.top^
||nboutletphilippines.com^
||ncaaalabama.store^
||ncaaarizona.store^
||ncaaauburntigers.store^
||ncaabasketball.store^
||ncaabaylor.store^
||ncaabaylorbears.store^
||ncaabears.store^
||ncaabluedevils.store^
||ncaabruins.store^
||ncaabuckeyes.store^
||ncaaclemsontigers.store^
||ncaacollege.store^
||ncaacollegejersey.store^
||ncaacougars.store^
||ncaacrimsontide.store^
||ncaadiablesbleus.store^
||ncaaducks.store^
||ncaaduke.store^
||ncaadukebluedevils.store^
||ncaafanshop.com^
||ncaafightingirish.store^
||ncaafightingtigers.store^
||ncaafootballjersey.store^
||ncaageorgia.store^
||ncaageorgiabulldogs.store^
||ncaahoustoncougars.store^
||ncaahurricanes.store^
||ncaaillinois.store^
||ncaaiowa.store^
||ncaajayhawks.store^
||ncaajersey.com^
||ncaajersey.pro^
||ncaajersey.sale^
||ncaajerseycollege.store^
||ncaajerseyfan.store^
||ncaajerseypro.store^
||ncaajerseys.store^
||ncaajerseysstore.com^
||ncaakentuckywildcats.store^
||ncaalonghorns.store^
||ncaalsu.store^
||ncaamiami.store^
||ncaamiamihurricanes.store^
||ncaamichigan.store^
||ncaamichiganwolverines.store^
||ncaanorthcarolina.store^
||ncaanotredame.store^
||ncaaoklahoma.store^
||ncaaolemiss.store^
||ncaaoregon.store^
||ncaaoregonducks.store^
||ncaarazorbacks.store^
||ncaashopjerseys.com^
||ncaasooners.store^
||ncaatarheels.store^
||ncaatennessee.store^
||ncaauclabruins.store^
||ncaauk.store^
||ncaavols.store^
||ncaawildcats.store^
||ncaawolverines.store^
||ncaaworldseries.store^
||ncaazags.store^
||nebraskacollege.store^
||nebraskacornhuskers.store^
||newyorksport.store^
||nfl49ers.store^
||nflbengals.store^
||nflbroncos.store^
||nflcancercatch.store^
||nflcardinals.store^
||nflchargers.store^
||nflchiefs.store^
||nflcrucialcatch.sale^
||nflcrucialcatch.store^
||nflcrucialcatch.top^
||nflcrucialcatchshop.com^
||nfldraft.shop^
||nfldrafthat.store^
||nfldraftshop.com^
||nfleagles.store^
||nflgamejersey.store^
||nflgamelimited.store^
||nflhelmet.store^
||nfljersey.fans^
||nfljersey.pro^
||nfljerseysale.shop^
||nflnikeshoes.com^
||nflnikeshoes.store^
||nflpackers.store^
||nflsaleshop.com^
||nflsalutetoservice.com^
||nflsalutetoservice.store^
||nflservice.store^
||nflshoe.store^
||nflshoes.pro^
||nflshoes.shop^
||nflshoes.store^
||nflshoesale.store^
||nflshopfan.com^
||nflsocks.com^
||nflstaple.store^
||nflstapleshop.top^
||nflstorefan.com^
||nflsts.com^
||nflstsjersey.com^
||nflstsjersey.store^
||nfltitans.store^
||nflzoompegasus.store^
||nhlallstar.pro^
||nhlauthenticpro.store^
||nhlfan.store^
||nhlfanjersey.store^
||nhlfansjersey.store^
||nhlfansjerseys.store^
||nhlfightscancer.store^
||nhlhockey.store^
||nhlhockeyjersey.store^
||nhljersey.sale^
||nhljersey.site^
||nhljersey.store^
||nhljersey.top^
||nhljerseyfan.store^
||nhljerseypro.store^
||nhljerseys.sale^
||nhljerseysale.shop^
||nhljerseysfan.store^
||nhljerseyshop.store^
||nhljerseyssale.store^
||nhlprojerseys.store^
||nhlsalejersey.store^
||nhlshopfan.com^
||nhlshopjersey.com^
||nhlstadiumseries.store^
||nhlwinterclassicjersey.store^
||nike--usa.com^
||nike-clearancestore.com^
||nikeairjordan.store^
||nikeairshoes.store^
||nikeshoesale.store^
||nikesneaker.store^
||ninewestpolska.com^
||ninewestusasale.com^
||nobull-brasil.com^
||northcarolinacollege.store^
||northcarolinashop.net^
||northcarolinatarheels.shop^
||northcarolinatarheels.store^
||northfaceoutletstoreus.com^
||notredamecollege.store^
||notredamefightingirish.store^
||off-whitecanada.com^
||off-whitecolombia.com^
||off-whitedanmark.com^
||off-whitedeutschland.com^
||off-whitegreece.com^
||off-whitehungary.com^
||off-whiteindonesia.com^
||off-whitemalaysia.com^
||off-whitemexico.com^
||off-whitenetherlands.com^
||off-whiteromania.com^
||off-whiteschweiz.com^
||off-whitesuomi.com^
||off-whitesverige.com^
||off-whiteturkey.com^
||ohiostatebuckeyes.online^
||ohiostatebuckeyes.store^
||ohiostatecollege.store^
||oklahomacollege.store^
||oklahomasooners.store^
||olemisscollege.store^
||olemissrebels.shop^
||olemissrebels.store^
||onlinejewelshopline.com^
||onlinejewelshoplus.com^
||onlinestoresshops.com^
||onlinevipshplus.com^
||oofos-ireland.com^
||oofosnorgeoutlet.com^
||oofosoutletcanada.com^
||oofosoutletmalaysia.com^
||oofosoutletonline.com^
||oofosshoeaustralia.com^
||oofosskorsveriges.com^
||operationmalls.com^
||oregoncollege.store^
||oregonducks.shop^
||oregonducks.store^
||osucowboys.shop^
||outletargentinacolumbia.com^
||outletchilecolumbia.com^
||outletgoodshopline.com^
||outletjewelshoplzza.com^
||outletjewelsvip.com^
||outletmerrellargentina.com^
||outletuksorel.com^
||outletvipshoplus.com^
||outletvipshopy.com^
||panelmalls.com^
||partnershipmalls.com^
||paulsmitfactoryus.net^
||pennstatecollege.store^
||pennstatenittanylions.store^
||philadelphiaeagles.store^
||piercemalls.com^
||pittpanthers.shop^
||pittsburghsteelersshop.com^
||planmalls.com^
||proficientmalls.com^
||psychobunnycolombia.com^
||puma-greece.com^
||puma-norge.co.no^
||puma-uy.com^
||pumachileoutlet.com^
||pumacostarica.net^
||pumaecuador.net^
||pumairelandsale.com^
||pumaoutletonlineportugal.com^
||pumaturkish.com^
||pumauruguay.com^
||pumoutletusa.com^
||pumsaleusa.com^
||pumusoutlet.com^
||purdueboilermakers.store^
||purduecollege.store^
||quicksilveruae.com^
||quiksilver-australia.com^
||quiksilver-canada.com^
||quiksilver-malaysia.com^
||quiksilver-philippines.com^
||quiksilver-southafrica.com^
||quiksilverfactoryoutlet.com^
||quiksilverindonesia.com^
||quiksilveroutletusa.com^
||quiksilveruksale.com^
||rebecamalls.com^
||reclassicsg.org^
||redwingbootsoutlets.com^
||reebok-chile.com^
||reebok-romania.com^
||reebokblackfridayoffers.com^
||reebokfactoryoutlet.com^
||riekeroutletca.com^
||riekershoessaleuk.com^
||rolltide.shop^
||romaniakanken.com^
||rothyusonline.shop^
||roxclothingusa.com^
||rritemalls.com^
||sacfjallravensoldes.com^
||saleushoka.com^
||salewaoutletschile.com^
||salomon--portugal.com^
||salomon-nederland.com^
||salomon-nederlands.com^
||salomon-norge.co.no^
||salomon-outletsturkiye.com^
||salomon-portugal.com^
||salomonaphilippines.com^
||salomonashoesnz.com^
||salomonbootsbrisbane.com^
||salomonbootsoutletusa.com^
||salomonespanas.com^
||salomonfactoryoutletmadrid.com^
||salomonmalaysiawebsite.com^
||salomonoutletgreece.com^
||salomonoutletnl.com^
||salomonoutletsfactory.com^
||salomonoutletstoresusa.com^
||salomonshoesoutletusa.com^
||salomonxapro3d.com^
||samsonclearanus.com^
||samsondiscountus.com^
||sandalitevaofferta.com^
||sanfrancisco49ers.store^
||sanuksingapore.com^
||sapatilhasallstarbaratas.com^
||sapatosclarkportugal.com^
||saucony-australia.com^
||sauconyfactoryoutletsuk.com^
||sauconyfactoryoutletuk.com^
||sauconyjazzturkey.com^
||sauconyoutletaustralia.com^
||sauconyoutletuk.com^
||seattlekraken.sale^
||sebagoshoesdubai.com^
||shoesnike.store^
||shopmksus.com^
||shopsmithsus.com^
||silentmalls.com^
||skecheausale.com^
||skecheclearanceus.com^
||skechers-israel.com^
||skechers-tenisice.com^
||skechersarchfitromania.com^
||skechersfactorysoutlet.com^
||skechersoutletpraha.cz^
||skecherstrainers-uk.com^
||skecherusaclearan.com^
||skecheukclearan.com^
||skecheusoutlet.com^
||slovenskokanken.com^
||sneakersnike.store^
||sorelfactoryoutlet.com^
||southcarolinacollege.store^
||southcarolinagamecocks.store^
||spartanscollege.shop^
||sperroutletusa.com^
||sperryfactoryoutlet.com^
||sperryonlinesatis.com^
||spinmalls.com^
||sportgear.store^
||spraygoutletus.com^
||spraygroclearanusa.com^
||spraygrousoutlet.com^
||stanfordcardinal.store^
||stanfordcollege.store^
||storeskechesale.com^
||suicokeshoessale.com^
||suicokeuk.com^
||superbowllvi.shop^
||superbowllvi.store^
||superbowlstore.com^
||swarovskichile.com^
||swarovskidubai.com^
||swarovskifactoryoutlet.com^
||swarovskioutletuk.com^
||swarovskiphilippines.com^
||swarovskisaleoutlet.com^
||tamarisfactoryoutlet.com^
||tamarisgreece.com^
||tamarisgreecer.com^
||tarheelscollege.store^
||tbeautybeauty.com^
||tcucollege.store^
||tcuhornedfrogs.store^
||tenisveja-portugal.com^
||tennesseecollege.store^
||tennesseevolunteers.store^
||teva-nederlands.com^
||tevacolombia.com^
||tevafactoryoutletuk.com^
||tevagreece.com^
||tevaromaniasandale.com^
||tevaturkey.com^
||texasamaggies.store^
||texasamcollege.store^
||texascollege.store^
||texaslonghorns.online^
||texaslonghorns.store^
||texastechcollege.store^
||texastechredraiders.store^
||thegirlfriendcollectiveaustralia.com^
||thegirlfriendcollectivenederland.com^
||thegirlfriendcollectiveuk.com^
||thorogoodfactoryoutlets.com^
||tiendacolumbiachile.com^
||tiendaunderarmourmexico.com^
||tocontrolbeauty.com^
||tombrady.store^
||tombradyshop.pro^
||tombradystore.com^
||tommyhilfigerperth.com^
||tomssingaporesale.com^
||tumibeststores.com^
||tumicheapuk.com^
||tumioutletclearan.com^
||tumusaoutlet.com^
||ua-australia.com^
||ua-canada.com^
||ua-chile.com^
||ua-greece.com^
||ukclarkcheap.com^
||ukclarkoutlets.com^
||ukcollege.store^
||ukkarenmillencheap.com^
||uklacostsale.com^
||ukskechecheap.com^
||uncbasketball.store^
||uncjersey.shop^
||uncjersey.store^
||unctarheels.shop^
||unctarheels.store^
||underarmour-costerica.com^
||underarmour-israel.com^
||underarmour-italia.com^
||underarmour-nl.com^
||underarmour-nz.com^
||underarmour-saudiarabia.com^
||underarmourhungary.com^
||underarmourosterreich.com^
||underarmouroutlet-usa.com^
||underarmouroutletromania.com^
||underarmourromania-ro.com^
||underarmourshortsuk.com^
||undergroundmalls.com^
||underrmourireland.com^
||usccollege.store^
||uscolumbsportswear.com^
||usctrojans.online^
||uspumsale.com^
||utahcollege.store^
||utahutes.shop^
||utahutes.store^
||veja-froutlet.com^
||vejafactoryoutletusa.com^
||vejajapanstore.com^
||vejaoslo.com^
||vejaosterreich.com^
||vejaromaniaoutlet.com^
||vejasale-ireland.com^
||vejasneakers-schweiz.com^
||vejatenisice-hr.com^
||vibramfive-fingers.cz^
||vibramsk.com^
||vionicshoes-southafrica.com^
||vionicshoessingapore.com^
||vionicshoesuksale.com^
||vipgiftshopline.com^
||vipgiftshoppy.com^
||vipgoodshoppy.com^
||vippgiftsonline.com^
||virginiatechcollege.store^
||virginiatechhokies.store^
||vlone-uk.com^
||wakeforestcollege.store^
||wakeforestdemondeacons.store^
||warriorsjersey.store^
||washingtoncollege.store^
||washingtonhuskies.store^
||wellness-gym.sk^
||westvirginiacollege.store^
||westvirginiamountaineers.store^
||wolverineaustralias.com^
||xn--conversemaazalar-shc44a.com^
||xn--hotiayakkab-p9a38g.com^
||xn--vansayakkab-9zb.com^
||zainofjallravenkanken.com^
||zalesglobaljewelry.com^
||zamberlanireland.com^
||zapatillasvejacl.com^
||zapatosaldochile.org^

! https://forums.malwarebytes.com/topic/293979-recent-scamware-not-recognized-by-malwarebytes/
||allreqdusa.com^

! NSFW: https://app.any.run/tasks/dff4525c-555a-479e-83ba-c5b2f2d11ab6
||baconaces.pro^
||eredhadbeen.xyz^
||twgfw.eredhadbeen.xyz^
||nugans.live^
||chrome.google.com/webstore/detail/cats-fanpage/nkhleengjihjncmbkldpfmoankdkhahg^

! NSFW: https://app.any.run/tasks/10647999-b75b-42bd-ae49-c7d596f3c797
||kdakm.eredhadbeen.xyz^
||qualitydating.top^
||a.curedating.top^
||curedating.top^
! https://virustotal.com/gui/ip-address/5.181.203.4/relations
||finestdating.top^
||goodating.top^
||datingpoint.top^
||cutiesdating.top^
||vipdatingtime.top^
! https://virustotal.com/gui/ip-address/195.201.253.131/relations
||sensualflirts.life^
||yourbestpartner.life^
||thebestdate.life^
||besttightflirts.life^
||timetopdatings.life^
||realhotmeets.life^
||dateflirt.life^
||originalspartner.life^
||loveclick.life^
||goyummdating.life^
||bestdatingsforyou.life^
||findsoulmate.life^
||instinctdating.life^
||charmingdating.life^
||datingarea.life^
||delightdatings.life^
||delightflirt.life^
||delightdating.life^
||bestflirtzone.life^
||getsexy.life^
||lover-finder.life^
||findsexy.life^

! (copied from DandelionSprout's list): https://github.com/DandelionSprout/adfilt/issues/748
||adidas-budapest.com^
||adidas-deutschland.de^
||adidas-egypt.com^
||adidas-france.fr^
||adidas-philippines.com^
||adidas-sk.sk^
||adidasenpanama.com^
||adidasfactoryshop.co.za^
||adidasguatemala.com^
||adidashonduras.com^
||adidasksa.com^
||adidasmaroc.com^
||adidasnicaragua.com^
||adidasonlineoutlet.es^
||adidasonlineuksale.com^
||adidaspakistan.com^
||adidasshoesgreece.com^
||adidasslovensko.sk^
||adidasuaesale.com^
||aerosolesportugal.com^
||aerosolesuk.com^
||alexiawrites.com^
||allbirditalia.it^
||americantouristerfactoryoutlet.com^
||aplshoeuk.com^
||aplsneakerssale.com^
||argentina-adidas.com^
||asicsayakkabitr.com^
||asicscipohungary.com^
||asicsnederland.com^
||asicswinkelnederland.com^
||billabongfactoryoutlet.ca^
||billabongfrance.com^
||billabongitalia.com^
||billabongpolska.com^
||billabongportugal.com^
||billabonguk.com^
||bogsbootsireland.com^
||bogschile.com^
||botaswolverine.com.mx^
||brooksshoesstore.us^
||bundyslovakia.com^
||butywolverlne.com^
||canada-nike.com^
||cariuma-france.fr^
||cariuma-philippines.com^
||cariumashoesportugal.com^
||cariumashoessingapore.com^
||chaussurenobull.com^
||chaussuresnobull.com^
||conversesingaporeoutlets.com^
||danskonederland.com^
||danskosaldi.it^
||demoniachaussuresparis.fr^
||demoniacipő.com^
||demoniashopberlin.de^
||demoniastopankysk.sk^
||demoniatürkiye.com^
||diesel-helsinki.com^
||docmartens-canada.com^
||docsmartensslovensko.sk^
||docsmartensthailand.com^
||doctormartensmadrid.com^
||doctormartensnederland.com^
||doctormartensromanla.com^
||drmartensosterreich.com^
||drmdanmark.com^
||ecuador-adidas.com^
||fitflop-australiasale.com^
||footjoy-portugal.com^
||footjoybelgie.com^
||footjoyfinland.com^
||footjoyindonesia.com^
||footjoypakistan.com^
||footjoyuae.com^
||gym-sharkitalia.com^
||gym-sharkportugal.com^
||gymshark-hrvatska.com^
||gymsharkjp.com^
||gymsharks-hrvatska.com^
||heydudeshoessaleuk.com^
||hhworkwearcanada.com^
||hoka-canada.ca^
||hoka-slovensko.sk^
||hokacaonsale.ca^
||hokahungarywebshop.com^
||hokaschuhekaufen.de^
||hokashoescanadasale.com^
||hokaskoshop.com^
||hrvatska-adidas.com^
||indonesia-adidas.com^
||jakkeshopdanmark.com^
||jakkeshopnorge.com^
||lojasasicslisboa.com^
||lojashellyhansenportugal.com^
||ludan102.com^
||lululemonbarcelona.es^
||martenslovensko.com^
||martensslovensko.sk^
||martensxhrvatska.com^
||martensywarszawa.com^
||martenywarszawa.com^
||merrell-canada-clearance.com^
||merrellbutysklepy.pl^
||merrellportugalshop.com^
||mizuno-italia.com^
||mizuno-mexico.com.mx^
||mizuno-peru.com^
||mizuno-shoesaustralia.com^
||mizuno-thailand.com^
||mizunoblackfridaysale.com^
||mizunodeutschland.de^
||mizunofootballbootsuk.com^
||mizunoshoescanada.ca^
||mizunosshoesindia.com^
||nb-uae.com^
||nbalancechile.com^
||nike-factoryoutletstore.com^
||nikefactorystoreuk.com^
||nobullcrossfitscarpe.com^
||nobullproiectcanada.com^
||nobullswitzeriand.com^
||nobulltrainerphilippines.com^
||nobulltrainersslngapore.com^
||nobullxespana.com^
||nobvllshoesuk.com^
||norge-adidas.com^
||northfaceindiastore.com^
||northfaceoutletargentina.com^
||northfacexhungary.com^
||northfacezurich.com^
||northfacezurlch.com^
||northxfaceindiastore.com^
||osterreich-adidas.com^
||peru-adidas.com^
||portugal-adidas.com^
||psychobunnypolo.com^
||psychobunnytshirt.com^
||puma-turkey.com.tr^
||romaniagymshark.com^
||salomon-retailers.com^
||salomonchileoutlet.com^
||salomondeutschlandsale.de^
||salomonfactoryoutletza.com^
||salomonshoesonline.us^
||salomonshop.ca^
||salomonskioutletshop.com^
||salomonspeedcrossusa.com^
||salomonspikecrosscanada.com^
||salomonxt6outletusa.com^
||salomonxt6sale.com^
||sanuk-canada.com^
||saucony-clearancecanada.com^
||saucony-portugal.org^
||sauconycanadaonsale.com^
||sauconyclearance.us^
||sauconyfactoryoutlet.us^
||sauconyirelandoutlet.com^
||sauconyløbesko.com^
||sauconymalaysiaonline.com^
||sauconyrunningshoes.us^
||sauconyshoesfactorynz.com^
||sauconysingaporeonline.com^
||sauconysneakers.us^
||scarpekeenitalia.com^
||scarpewolverine.it^
||shopsalomonsouthafrica.com^
||skechers-south-africa.co.za^
||skecherscanadaonline.ca^
||skechersoutletnz.com^
||sorelbootsoutlet.com^
||sperryonsale.com^
||sperryoutletfactory.com^
||suomi-adidas.com^
||tevadanmarkshop.com^
||tevamalaysias.com^
||tevamalaysiashop.com^
||tevanorgeshop.com^
||thenorthfacenzsale.com^
||thenorthfacexromania.com^
||thursdayboothungary.com^
||thursdayboots-ro.com^
||thursdaybootschweiz.com^
||thursdaybootsdenmark.com^
||thursdaybootsdeutschiand.com^
||thursdaybootsdeutschland.de^
||thursdaybootsgreek.com^
||thursdaybootsmalaysla.com^
||thursdaybootsnorway.com^
||thursdaybootsportugals.com^
||thursdaybootsrea.com^
||thursdaybootsturkey.com^
||thursdayshoesnz.com^
||tiendaasicsmexico.com^
||tiendasadidaschile.com^
||tiendaskecherchile.com^
||tiendasnorthfacemexico.com^
||tnfsoldes.com^
||uptsejacketsale.com^
||wolverineayakkabi.com^
||wolverineboty.cz^
||wolverinechaussure.fr^
||wolverinejapan.com^
||wolverinelaarzen.com^
||wolverineportugal.com^
||wolverineschuhe.at^
||wolverineschuhes.de^
||wolverineskonorge.com^
||wolverinestovler.com^
||wolverlnejapan.com^
||zapatillassalomoncolombia.com^
||zapatosgolffootjoy.com^
||zapatoswolverine.com^
||thenorthfacenorge.co.no^
||tnooutlet.com^
||vansnorge.co.no^
||hunternorge.co^
||hunternorge.co.no^
||hunternorgeno.com^
||hokaslippers.com^
||hokaskooutlet.co.no^
||martenssalg.com^
||martensnorge.co.no^
||hoka-sko.com^
||norgeskotilbud.com^
||hokasnorgeno.com^
||adidasbratislava.sk^
||airsuomi.com^
||asicswebshopshu.com^
||brooksrunnersireland.com^
||brooksrunningindia.co.in^
||chaussurestoms.fr^
||clarks-romania.com^
||clarksshop-hu.com^
||clarkswyprzedaz.com^
||columbiaindiasale.com^
||columbianzoutlet.com^
||crocsacheter.fr^
||deeruptrunner.me^
||desertbootshop.com^
||docmartensnewzealand.com^
||eobuvecco.sk^
||falconportugalshop.me^
||fitflopsalenederland.com^
||footwearnl.com^
||footwearsalesg.com^
||hunter-danmark.com^
||hunter-espana.com^
||hurricane-outlet.co^
||keenscarpeitalia.it^
||keentürkiye.com^
||mammutsverige.com.se^
||mammutuksale.com^
||newvanshoes.co.in^
||nikehrvatska-hr.com^
||nikeportugal.pt^
||north-face-indirim.com^
||pumarea.com.se^
||pumatennaritale.com^
||rb-greece.com^
||rbingreece.com^
||rbshopgreece.com^
||ropapuma.com^
||runninginshop.com^
||salomonbutikdanmark.com^
||salomonslovensko.sk^
||schweizch.com^
||shoesstoregreece.com^
||sportsonlineuk.com^
||sportwebaruhaz.com^
||tiendadiadoramexico.com^
||tomosterreich.com^
||toms-budapest.com^
||toms-schweiz.com^
||tomscipo.com^
||tomsdeutschland.de^
||tomsitalia.it^
||tomsosterreich.at^
||ukhikingshop.com^
||vanscipok.com^
||vanssnorge.com^
||alo-yoga-turkey.com^
||aloyoga-chile.com^
||aloyogaespana.es^
||aloyogairelandstore.com^
||aloyogaturkey.com.tr^
||asicsisverige.com^
||asolobootsireland.com^
||asolocolombia.com^
||asolodeutschland.com^
||asolofrance.com^
||asoloitaliaoutlet.com^
||asolonederland.com^
||asoloportugal.com^
||asoloskonorge.com^
||asoloskor.com^
||betseyjohnsonitalia.com^
||bootspalladiumitalia.com^
||botasasolomexico.com^
||botasasolooutlet.com^
||boutiquehunterfrance.com^
||calvinkleinchileoutlet.com^
||calvinkleinportugalpt.com^
||conversecostaricaonline.com^
||converseuaeonlinestore.com^
||gantchile.com^
||gantcolombia.com^
||gantdenmark.com^
||gantdeutschland.com^
||ganthrvatska.com^
||gantisrael.com^
||gantitalia.com^
||gantromania.com^
||gantromanias.com^
||gantschweiz.com^
||gantsrbija.com^
||gantturkey.com^
||guesskobenhavn.com^
||guessoutletslovensko.com^
||guessoutletsuomi.com^
||guesssuomi.net^
||gymsharkoutlet.com.au^
||hoka-malaysia.com^
||hoka-polska.pl^
||hoka-spain.es^
||hokabaratas.com^
||hokaencolombia.com^
||hokagermany.de^
||hokaitaliaoutlet.it^
||hokaonenorge.com^
||hokaonlineturkiye.com^
||hokaportugallojas.com^
||hokaromania.ro^
||hokashopindia.net.in^
||hokasingapore.com^
||hokasklep.com^
||hokastoregr.com^
||hunter-boots-ireland.com^
||hunter-canada.ca^
||hunter-colombia.com.co^
||hunter-costarica.com^
||hunter-cz.com^
||hunter-greece.gr^
||hunter-jp.com^
||hunter-osterreich.at^
||hunter-osterreich.com^
||hunter-portugal.pt^
||hunter-romania.ro^
||hunter-sk.sk^
||hunter-slovenija.com^
||hunter-southafrica.com^
||hunter-srbija.com^
||hunter.com.se^
||hunterargentinabotas.com^
||hunteraustraliaau.com^
||hunterbelgium.com^
||hunterbelgiumsale.com^
||hunterbootchile.com^
||hunterboots-israel.com^
||hunterboots-newzealand.com^
||hunterbootsaus.com^
||hunterbootsdubai.com^
||hunterbootsnewzealand.co.nz^
||hunterbootsslovenija.com^
||hunterbootssouthafrica.co.za^
||huntercr.com^
||hunterfrankfurt.com^
||hunterhelsinki.com^
||hunterhrhrvatska.com^
||hunterhrvatskahr.com^
||hunteritaliaoutlet.com^
||hunterjapanjp.com^
||hunterkalosze-pl.com^
||hunterlaarzennederland.com^
||hunterluxembourg.com^
||huntermalaysiamy.com^
||huntermexicomx.com^
||hunterobchod.com^
||hunteronlineshop.de^
||hunteroutlet-canada.com^
||hunterphilippinesstore.com^
||hunterpolska-pl.com^
||hunterportugalpt.com^
||hunterrainbootsaustralia.com^
||hunterrainbootsie.com^
||hunterromania.net^
||huntershopromania.com^
||huntershopschweiz.com^
||huntersingaporesg.com^
||hunterskornjislovenija.com^
||hunterslovenija.com^
||huntersoldes.com^
||huntersrbija.org^
||huntersuomifi.com^
||hunterturkiyesatis.com^
||hunteruruguay.com^
||hunterwellies-australia.com^
||hunterwellies-nz.com^
||hunterwelliesdublin.com^
||hunterwellingtonsaustralia.com^
||hunterwinkelnederland.com^
||jordan-hrvatska.com^
||jordan-nederland.com^
||jordanakcio.com^
||jordanalesuomi.com^
||jordanargentinaonline.com^
||jordanbelgiesale.com^
||jordanbelgium.com^
||jordanberlin.de^
||jordanbogota.com^
||jordanbutysklep.pl^
||jordancapetown.com^
||jordancena.com^
||jordanchileoferta.com^
||jordaneshop.cz^
||jordanfiyat.com^
||jordanieftini.ro^
||jordanindirim.com^
||jordanjapansale.com^
||jordanlisboa.com^
||jordanljubljana.com^
||jordanmalaysias.com^
||jordanmexicomx.com^
||jordanoferta.ro^
||jordanonlinecanada.com^
||jordanonlinegreece.com^
||jordanottawa.com^
||jordanoutletgreece.com^
||jordanoutletnz.com^
||jordanpatike.com^
||jordanph.com^
||jordanphilippine.com^
||jordanportugalpt.com^
||jordanpromocje.pl^
||jordanretroschweiz.com^
||jordansaldi.com^
||jordansaleau.com^
||jordansaleie.com^
||jordansaleireland.com^
||jordanschuhesale.at^
||jordanserbia.com^
||jordanshopmalaysia.com^
||jordanskooslo.com^
||jordanslovenija.co^
||jordansneakersau.com^
||jordansovensko.sk^
||jordansuomiale.com^
||jordantilbud.com^
||jordantilbuddanmark.com^
||jordanuaesale.com^
||jordanwinkel.com^
||keengermany.de^
||keensandalertilbud.com^
||keenspain.es^
||lojasskechersportugal.com^
||mizuno-germany.de^
||mizunoencolombia.com^
||mizunoteniskysk.sk^
||moncler-israel.com^
||moncler-mexico.com^
||monclercanada.ca^
||monclerchile.com^
||monclercolombia.com^
||monclergreece-outlet.com^
||monclermalaysia.com^
||moncleromania.com^
||moncleroutletschweizs.com^
||monclerphilippines.com^
||monclersingapore.com^
||monclersouthafrica.co.za^
||monclersouthafrica.com^
||nikefactoryoutletau.com^
||nikemaroc.com^
||niketurkiyeshop.com^
||nobull-colombia.com.co^
||nobull-mexico.com.mx^
||nobullenargentina.com^
||nobullespanaoutlet.com^
||nobullro.ro^
||nobullsuomiale.com^
||palladium-chile.com^
||palladium-finland.com^
||palladium-philippines.com^
||palladiumaustraliaoutlet.com^
||palladiumbootscolombia.com^
||palladiumbootsnzoutlet.com^
||palladiumbootsromania.com^
||palladiumindonesia.com^
||palladiumnederland.com^
||palladiumoutletportugal.com^
||palladiumschuheaustria.com^
||palladiumschuheoutlet.de^
||palladiumshoesuae.com^
||palladiumsingaporestore.com^
||palladiumskobutikk.com^
||palladiumskodk.com^
||palladiumskorsverige.com^
||palladiumsouthafrica.co.za^
||quiksilver-france.fr^
||quiksilver-mexico.com.mx^
||quiksilverale.com^
||quiksilverangebot.com^
||quiksilveraustralia.com^
||quiksilveraustraliasale.com^
||quiksilverbrasillojas.com^
||quiksilvercanadasale.com^
||quiksilverchile.com^
||quiksilvercolombia.com^
||quiksilverdanmark.com^
||quiksilverenargentina.com^
||quiksilverenchile.com^
||quiksilverespana.com^
||quiksilvergreece.com^
||quiksilverindia.co.in^
||quiksilverindirim.com^
||quiksilverinofferta.com^
||quiksilveritalia.com^
||quiksilverlojas.com^
||quiksilvermalaysia.com^
||quiksilvermalaysiasale.com^
||quiksilvernederland.com^
||quiksilvernewzealand.com^
||quiksilvernorge.com^
||quiksilveroutletgreece.com^
||quiksilveroutletphilippines.com^
||quiksilveroutletpolska.com^
||quiksilveroutletsingapore.com^
||quiksilverphilippines.com^
||quiksilverportugal.com^
||quiksilverpraha.cz^
||quiksilverromania.com^
||quiksilverromania.ro^
||quiksilversaleindia.com^
||quiksilversalesouthafrica.co.za^
||quiksilversingapore.com^
||quiksilversklep.com^
||quiksilversouthafrica.com^
||quiksilversuomi.com^
||quiksilversverige.com^
||quiksilvertilbud.com^
||quiksilvervyprodej.com^
||quiksilverwinkel.com^
||salomocolombia.com^
||salomon-danmark.net^
||salomon-pt.com^
||salomon-spain.es^
||salomonencolombia.com^
||salomonfrancesoldes.fr^
||salomonhungary.net^
||salomonidanmark.com^
||salomoportugalonline.com^
||salomoslovenija.com^
||salomoslovensko.sk^
||saucony-dk.com^
||sauconygermany.de^
||sauconylaufschuhe.at^
||sauconyspain.es^
||sendrabootsdeutschland.com^
||sendrabootsireland.com^
||sendrabootsitalia.com^
||sendrafrance.com^
||skecherchile.com^
||skechers-colombia.com.co^
||skechers-spain.es^
||skechersfactoryoutletau.com^
||skechersmexicotienda.com^
||skechersshoesnzoutlet.com^
||teniskyvejaobuv.sk^
||tiendahunterchile.com^
||tiendahuntermadrid.com^
||tiendajordanargentina.com^
||tiendaquiksilvercolombia.com^
||tiendaquiksilvermexico.com^
||underarmourenecuador.com^
||vejagermany.de^
||vejasneakers.se^
||vejasneakersmexico.com.mx^
||moncleritalia.com^
||alexandermcqueenboty.cz^
||alexandermcqueenskor.com.se^
||alexandermcqueentenisce.com^
||alexandermcqueentenisky.sk^
||alexandermcqueentenls.com^
||axelarigato.com.se^
||axelarigatoboty.cz^
||axelarigatokobenhavn.com^
||axelarigatos.com.se^
||axelarigatosapatilhas.com^
||axelarigatoshoesnz.com^
||axelarigatoslovakia.com^
||axelarigatosneakersnl.com^
||axelarigatozagreb.com^
||bootsonlineindia.com^
||botteshunterfrance.fr^
||cizmeshopromania.com^
||demoniasjapan.com^
||dieseljeancolombia.com^
||dieseljeanscolombia.com^
||drmarswebshop.com^
||enucuzsuperdry.com^
||gummistiefelhunter.de^
||gummistøvlerhunter.com^
||hokalopesko.com^
||hokanorgeno.com^
||hokaonelopesko.com^
||huntegummistiefeloutlet.com^
||huntegummistiefelsale.com^
||hunteranbootsindia.com^
||hunterbootcanada.com^
||hunterholinky.com^
||hunterirelandonline.com^
||hunterlaarzenbelgle.com^
||hunterlaarzendames.com^
||hunteronlinesverige.com^
||hunteroutletireland.com^
||hunterstovlersalg.com^
||hunterwelliesirelandsale.com^
||lacostemagyarorszag.com^
||marbotysleva.cz^
||martenbratislava.sk^
||martengreece.com^
||martenportugal.com^
||martensbotysleva.cz^
||martenshelsinki.net^
||martenshrvatska.co^
||mcqueen-philippines.com^
||mcqueenauckland.com^
||mcqueencolombia.com^
||mcqueenitalian.com^
||mcqueenmalaysiamy.com^
||mcqueensouthafrica.com^
||mcqueensouthafrlca.com^
||merrellespanatiendas.com^
||merrellshoeaustralia.com^
||merrellshoesoutletus.com^
||merrellwanderschuhe.de^
||merrelshoesnzsale.com^
||merrelshoesuksale.com^
||merrelturkiyetr.com^
||mizunonewzealandnz.com^
||mizunoshoesforsale.com^
||mizunoshoesingapore.com^
||nana-vypredaj.sk^
||nanasuomi.com^
||nanavypredaj.sk^
||nbpolskaonline.com^
||neweraindlacap.com^
||niketrindirim.com^
||salomomnorgeoutlet.com^
||salonomaustria.com^
||salonomireland.com^
||salonomitalia.com^
||salonomportugal.com^
||salonomslovensko.com^
||salononfranceonline.com^
||salononsverige.com^
||stivalihuntersaldi.com^
||superdryfactorysg.com^
||tenishokaoneone.com^
||tevasandalehrvatska.com^
||vans-finland.com^
||martensbratislava.sk^
||zapatillasmcqueen.com^

! https://app.any.run/tasks/8ced67f6-f4e6-4fed-b634-86fd93ac4074/
||darkinfotale.xyz^
||f.estivaltodayz.com^
||hollandcash.nl^
||exit.hollandcash.nl^
||clean-blocker.com^

! https://github.com/DandelionSprout/adfilt/issues/752
||omclyzyapf.com^
||godpvqnszo.com^$popup
||news-mapara.com^
||vipdatingtoday.top^
||mo4ckid.click^
||xxxnewvideos.com^
||iseult-aplite.xyz^
||img.pushflow.net/creatives/11/5645/1649754393755-push-preview-img.png^
||theantivirusprotection.xyz^
||1.news-mapara.com^
||battik-bowwow.xyz^
||2.news-mapara.com^
||pshsbscapr.xyz^
||cdn.pncloudfl.com/pn/f83/d57/83b/f83d5783b20e21e0de65e6f7f632cde8a29b9ef6.jpg^
||click01.pshtrkg.com^
||4bd71.trknovi.com^
||jergocast.com^
||news-pelivo.com^
||img.pushflow.net/creatives/11/5645/1649755151938-push-preview-img.png^

! https://app.any.run/tasks/cc3be172-9813-4637-914b-533ac2b72299
||getfreegem.com^
||gamingtoolz.club^

! from notification scams
||nahist.live^
||redins.live^
||carltus.click^
||www.carltus.click^
||renhadmasandbab.info^
||bestadultdatinglist-com.ru^
||findflirtpartner6.euroshoptrendingclub.ru^
||h.curedating.top^
||martoysure.live^
||goodgollygold.com^

! https://virustotal.com/gui/domain/beastws.com
! (my analysis) https://app.any.run/tasks/dc144216-7c8d-4a2b-963e-24b507124e81
||beastws.com^

! https://github.com/no-cmyk/Search-Engine-Spam-Blocklist/issues/8
! TODO: verify these entries, hopefully there aren't any more https://github.com/hagezi/dns-blocklists/issues/987
||adajobs.de^
||appart-vermietung.de^
||baderus.de^
||bermudez-portfolio.de^
||carpenteriekluc.it^
||charlotte-wilking.de^
||conradlentz.de^
||corexonline.de^
||dierhagen-ostsee.de^
||digitalplm.de^
||e-dos.pl^
||eltruciolo.it^
||essen-inline-skating.de^
||forstbetrieb-reichel.de^
||fotogruppe-iserlohn.de^
||fw-muensing.de^
||honighelmut.de^
||hostingnetwork24.de^
||hunsruecker-damwild.de^
||hypnose-kunz.de^
||ilcolibri.it^
||lhm-as.de^
||lotuslebanon.com^
||mainradweg-service.de^
||massaggisensitive.it^
||misericordiapompei.it^
||molinariprotection.it^
||new-work-in-mv.de^
||nick-duschek.de^
||officinavettoriale.it^
||schnelltests-ludwigsburg.de^
||snehpandya.me^
||spiritoemateria.it^
||stahl-rohr-moebel.de^
||tipps-staedtereisen.de^
! https://app.any.run/tasks/e90c2a06-036f-4fff-a36f-dffd0d4048ab
||doxspb.adajobs.de^
||giftaward.life^

! https://github.com/badmojr/1Hosts/issues/1098
||elon23.page.link^

! https://github.com/AdguardTeam/AdguardFilters/issues/142492 --> https://github.com/uBlockOrigin/uAssets/commit/fca5436e3e823d73541721867f42dd0712da54a0
||apkmirror.co^
||webogram.org^
||webogram.ru^
||xn--80affa3aj0al.xn--80asehdb^
||telegr.am/user_mgt/login
||tgram.ru^
||telegramm.site^
||web-telegram.net^
! other domains not in the uBo commit
||atm-receipts.neocities.org^
||apkmirror.net^
||github.me^
||yandec.ru^
||yandex.co^

! a test system
||paleks.live^
||kempus.click^
||www.kempus.click^
||webpick-cdn.s3.amazonaws.com/2%20-%20pending%20massage.jpeg

! https://app.any.run/tasks/3f79c271-f68d-48a8-af16-efd001ce7be3
||mwgtf.hintonjour.com^
||oqnvm.top^
||edkiu.top^
||mvv5i.top^
||e8tov.top^
||rvueo.top^
||up9rt.top^
||rx93u.top^
||usfo6.top^
||bdlj8.top^
||bqcqw.top^

! https://github.com/AdguardTeam/AdguardFilters/issues/143281
||understatedworking.com^
||jatostepa.com^

! https://forums.malwarebytes.com/topic/295377-false-mcaffee-warning/ (account required)
||powerpcsupport.com^

! https://github.com/hagezi/dns-blocklists/issues/598
||t-post.com^

! https://github.com/hagezi/dns-blocklists/issues/597
||stallioncredit.com^

! https://github.com/hagezi/dns-blocklists/issues/596
||www.68437w.top^

! https://github.com/hagezi/dns-blocklists/issues/595
||goldtimeinvest.com^

! https://github.com/hagezi/dns-blocklists/issues/594
||nirvezal.com^

! https://virustotal.com/gui/url/413da77a326371e24a4c334e749a54928b43ee6bcd27165167940456b9c14f52/community
||eg-ame.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/144514
||attractbonus.life^
||best-prize.life^
||bestbigbonus.life^
||bonusgift.life^
||bonusreward.life^
||bonusscore.life^
||gainquick.life^
||giftjackpot.life^
||greatbonushere.life^
||greatprizes.life^
||jackpotscore.life^
||jackpotwinning.life^
||keep-rewards.life^
||keepbonus.life^
||keepreward.life^
||mygreatprize.life^
||prizeaward.life^
||prizefast.life^
||prizegain.life^
||prizehere.life^
||prizerush.life^
||prizesenses.life^
||prizesure.life^
||realgift.life^
||rewardgains.life^
||scorereward.life^
||simpleprize.life^
||simplewin.life^
||taketheprizes.life^
||topbonusgain.life^
||win-bonus.life^
||win-prize-now.life^
||win-prize.life^
||win-touch.life^
||winbigdrip.life^
||wincorporate.life^
||winearth.life^
||winexpert.life^
||wingiftnow.life^
||winmore.life^
||winprizehere.life^
||winpulse.life^
||winregistry.life^
||winsimply.life^
||wintarget.life^
||185.155.184.98^

! https://github.com/uBlockOrigin/uAssets/issues/17075
! my analysis: https://app.any.run/tasks/ed301c03-1105-47e5-88d1-66fded6a0a9b
||myspecialdates.com^

! https://www.reddit.com/r/uBlockOrigin/comments/11s92xa/badware_risks_page_request_malware/
||s3.amazonaws.com/extpro/speed4.html
||chrome.google.com/webstore/detail/speed-dial/pbclkopbecbmkiijepgjoodiidfkbchn/
||www.addonsearch.net^

! https://app.any.run/tasks/794fc4f3-e0da-49b0-b29b-304514a8bd2d
||70k-free-robux-generator-no-human-verification.statuspage.io^
||bettertool.xyz^

! elon musk crypto scam on hacked YouTube channels
! https://app.any.run/tasks/2963db56-bd87-4b82-8b24-97e6e68aef66/
||x2-promo.net^
! https://tria.ge/230318-twrw1ach63/behavioral1
||teslasend.io^

! https://forums.malwarebytes.com/topic/296022-comment-spam-from-my-site/ (account required)
! (my analysis) NSFW https://app.any.run/tasks/cd2d1278-ad10-4c38-8f49-fa34fa675820
||f.vipcooldating.top^
||vipcooldating.top^
||i.vipcooldating.top^

! https://github.com/durablenapkin/scamblocklist/issues/10
||adzfree-watch.net^

! https://github.com/AdguardTeam/AdguardFilters/commit/57f39538070d7d5e6379da4e58bd02defffa7481
||ikouthaupi.com^
||instreamersdian.com^

! https://app.any.run/tasks/31119ba0-9bf8-42e2-8e77-eec9045be865
||applover.net^

! https://app.any.run/tasks/89a5c643-ba0f-4bb6-b953-ef08ee0213ef
||youtubgenerator.w3spaces.com^

! https://app.any.run/tasks/482b8fa1-0f24-461a-a4f5-a6996c46ccdc/
||rewards24.onlinewebshop.net^
||locked3.com^
||cdn.locked3.com^

! https://github.com/durablenapkin/scamblocklist/issues/15
||thuthuatxiaomi.com^
||petsimulator.live^
||rewardsgiantca.com^
||earnpets.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/90853
! (my analysis) https://app.any.run/tasks/029760ea-9972-4c3a-8a7e-cca3d7777c0f
||emeraldtrking.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/90813
! (my analysis) https://app.any.run/tasks/0992866b-9af2-41ba-9b91-8fe5a2917908
||bbxxvwb.tk^

! https://github.com/StevenBlack/hosts/issues/2271
||transive.top^
||warehousesale.shop^

! https://app.any.run/tasks/3137c861-185d-4037-84e9-65cc0adeba15
||econsultingcoem.com^
||bgqcb.econsultingcoem.com^
||j4352.top^
||emqu4.top^
||kp0z3.top^
||kxaie.top^
! https://app.any.run/tasks/7626fdcc-20f1-4471-a011-23108f113eca
! https://app.any.run/tasks/4bc28a83-6a39-430a-a74b-246b30ab4ae4
||fuwins.xyz^
! https://virustotal.com/gui/ip-address/157.230.4.182/relations
||157.230.4.182^
! on the same IP, I tried a few and all of them hosted the same scam page (i.e. https://app.any.run/tasks/e9fd2b7d-d8cc-40dc-aa65-daaee7bc5558)
||gedins.xyz^
||gemins.xyz^
||fofins.xyz^
||gekins.xyz^
||gegins.xyz^
||gecins.xyz^
||cebens.xyz^
||gifirs.xyz^
||cexens.xyz^
||buvers.xyz^
||lohens.xyz^
||lodens.xyz^
||luvens.xyz^
||busers.xyz^
||laxens.xyz^
||bumers.xyz^
||lazens.xyz^
||lufens.xyz^
||latens.xyz^
||bijers.xyz^
||luxens.xyz^
||lavens.xyz^
||lolens.xyz^
||lubens.xyz^
||buders.xyz^
||baxers.xyz^
||bukers.xyz^
||buwers.xyz^
||bisers.xyz^
||bipers.xyz^
||bahers.xyz^
||lotens.xyz^
||lapens.xyz^
||ladens.xyz^
||basers.xyz^
||bugers.xyz^
||loxens.xyz^
||lowens.xyz^
||baters.xyz^
||lafens.xyz^
||lutens.xyz^
||lasens.xyz^
||bupers.xyz^
||locens.xyz^
||buzers.xyz^
||bubers.xyz^
||lojens.xyz^
||biwers.xyz^
||bufers.xyz^
||buhers.xyz^
||losens.xyz^
||lopens.xyz^
||bucers.xyz^
||lagens.xyz^
||bagers.xyz^
||birers.xyz^
||lozens.xyz^
||lusens.xyz^
||biders.xyz^
||buters.xyz^
||lawens.xyz^
||burers.xyz^
||lalens.xyz^
||bafers.xyz^
||bulers.xyz^
||lacens.xyz^
||lomens.xyz^
||balers.xyz^
||luzens.xyz^
||lahens.xyz^
||bavers.xyz^
||lokens.xyz^
||baders.xyz^
||bawers.xyz^
||bihers.xyz^
||lulens.xyz^
||bacers.xyz^
||labens.xyz^
||bazers.xyz^
||bapers.xyz^
||bajers.xyz^
||bifers.xyz^
||bujers.xyz^
||barers.xyz^
||lajens.xyz^
||buners.xyz^
||babers.xyz^
||bigers.xyz^
||lobens.xyz^
||buxers.xyz^
||cevens.xyz^
||cetens.xyz^
||barins.xyz^
||bamins.xyz^
||bakins.xyz^
||biwins.xyz^
||lurens.xyz^
||lupens.xyz^
||bacins.xyz^
||luwens.xyz^
||lujens.xyz^
||luhens.xyz^
||lunens.xyz^
||lonens.xyz^
||logens.xyz^
||lanens.xyz^
||lofens.xyz^
||tesens.xyz^
||sibans.xyz^
||ricens.xyz^
||rapens.xyz^
||rorens.xyz^
||tonens.xyz^
||sowans.xyz^
||tikens.xyz^
||tilens.xyz^
||ribens.xyz^
||setans.xyz^
||rofens.xyz^
||simans.xyz^
||rarens.xyz^
||ronens.xyz^
||sefans.xyz^
||sonans.xyz^
||terens.xyz^
||sijans.xyz^
||rolens.xyz^
||sexans.xyz^
||roxens.xyz^
||tigens.xyz^
||rabens.xyz^
||toxens.xyz^
||tolens.xyz^
||sixans.xyz^
||ripens.xyz^
||rimens.xyz^
||romens.xyz^
||sidans.xyz^
||ralens.xyz^
||sizans.xyz^
||todens.xyz^
||sehans.xyz^
||rawens.xyz^
||tevens.xyz^
||rocens.xyz^
||tibens.xyz^
||sikans.xyz^
||rozens.xyz^
||rivens.xyz^
||tivens.xyz^
||rizens.xyz^
||tegens.xyz^
||sepans.xyz^
||rafens.xyz^
||rilens.xyz^
||ragens.xyz^
||sohans.xyz^
||tirens.xyz^
||rohens.xyz^
||tehens.xyz^
||rifens.xyz^
||selans.xyz^
||tixens.xyz^
||riwens.xyz^
||sirans.xyz^
||rakens.xyz^
||tofens.xyz^
||tipens.xyz^
||tepens.xyz^
||tocens.xyz^
||ratens.xyz^
||rihens.xyz^
||sorans.xyz^
||racens.xyz^
||silans.xyz^
||ticens.xyz^
||tewens.xyz^
||tojens.xyz^
||rasens.xyz^
||rahens.xyz^
||rijens.xyz^
||rokens.xyz^
||tifens.xyz^
||towens.xyz^
||tisens.xyz^
||raxens.xyz^
||serans.xyz^
||sihans.xyz^
||tizens.xyz^
||rikens.xyz^
||radens.xyz^
||sitans.xyz^
||rovens.xyz^
||sekans.xyz^
||sokans.xyz^
||sifans.xyz^
||sezans.xyz^
||ritens.xyz^
||tihens.xyz^
||rinens.xyz^
||sivans.xyz^
||ropens.xyz^
||sesans.xyz^
||tinens.xyz^
||rotens.xyz^
||sobans.xyz^
||torens.xyz^
||rirens.xyz^
||semans.xyz^
||temens.xyz^
||tovens.xyz^
||tebens.xyz^
||sigans.xyz^
||sisans.xyz^
||socans.xyz^
||risens.xyz^
||ridens.xyz^
||rixens.xyz^
||texens.xyz^
||sipans.xyz^
||siwans.xyz^
||tedens.xyz^
||rigens.xyz^
||tejens.xyz^
||senans.xyz^
||rowens.xyz^
||soxans.xyz^
||tecens.xyz^
||totens.xyz^
||tozens.xyz^
||rajens.xyz^
||ranens.xyz^
||sewans.xyz^
||tosens.xyz^
||timens.xyz^
||razens.xyz^
||somans.xyz^
||tezens.xyz^
||sogans.xyz^
||sozans.xyz^
||sicans.xyz^
||secans.xyz^
||tiwens.xyz^
||sinans.xyz^
||tohens.xyz^
||larens.xyz^
||togens.xyz^
||gicurs.xyz^
||tobens.xyz^
||tijens.xyz^
||tidens.xyz^
||sovans.xyz^
||sotans.xyz^
||sosans.xyz^
||sojans.xyz^
||hohers.xyz^
||gizurs.xyz^
||humers.xyz^
||hogers.xyz^
||mitans.xyz^
||huners.xyz^
||giwirs.xyz^
||mucans.xyz^
||hurers.xyz^
||hoders.xyz^
||gipirs.xyz^
||muxans.xyz^
||gipurs.xyz^
||movans.xyz^
||mubans.xyz^
||hicers.xyz^
||mixans.xyz^
||hipers.xyz^
||hibers.xyz^
||gibirs.xyz^
||huhers.xyz^
||monans.xyz^
||hisers.xyz^
||hozers.xyz^
||hujers.xyz^
||mizans.xyz^
||mopans.xyz^
||honers.xyz^
||gihurs.xyz^
||huders.xyz^
||gicirs.xyz^
||gikurs.xyz^
||molans.xyz^
||huters.xyz^
||holers.xyz^
||hobers.xyz^
||modans.xyz^
||gilurs.xyz^
||hiters.xyz^
||mozans.xyz^
||mupans.xyz^
||higers.xyz^
||hocers.xyz^
||mukans.xyz^
||musans.xyz^
||hizers.xyz^
||husers.xyz^
||muvans.xyz^
||gixurs.xyz^
||migans.xyz^
||givirs.xyz^
||gimurs.xyz^
||mufans.xyz^
||mipans.xyz^
||giwurs.xyz^
||ginurs.xyz^
||gifurs.xyz^
||mogans.xyz^
||munans.xyz^
||gixers.xyz^
||giwers.xyz^
||gisers.xyz^
||mumans.xyz^
||mojans.xyz^
||gidurs.xyz^
||gijers.xyz^
||gilers.xyz^
||mujans.xyz^
||gitirs.xyz^
||gifers.xyz^
||hijers.xyz^
||muwans.xyz^
||mohans.xyz^
||hiners.xyz^
||ginirs.xyz^
||moxans.xyz^
||hupers.xyz^
||huwers.xyz^
||gigers.xyz^
||gisirs.xyz^
||hucers.xyz^
||howers.xyz^
||hokers.xyz^
||gimirs.xyz^
||gipers.xyz^
||gidirs.xyz^
||mibans.xyz^
||gikirs.xyz^
||giners.xyz^
||minans.xyz^
||gizers.xyz^
||mofans.xyz^
||mulans.xyz^
||hifers.xyz^
||mutans.xyz^
||mimans.xyz^
||gizirs.xyz^
||mosans.xyz^
||hiwers.xyz^
||miwans.xyz^
||gihirs.xyz^
||mugans.xyz^
||muzans.xyz^
||gijirs.xyz^
||gilirs.xyz^
||girirs.xyz^
||gijurs.xyz^
||gimers.xyz^
||hirers.xyz^
||mudans.xyz^
||sopans.xyz^
||solans.xyz^
||giders.xyz^
||sodans.xyz^
||irejad.life^
||segans.xyz^
||sejans.xyz^
||hosers.xyz^
||hoxers.xyz^
||mijans.xyz^
||sebans.xyz^
||tetens.xyz^
||tekens.xyz^
||telens.xyz^
||tefens.xyz^
||giwens.com^
||sporens.com^
||tihens.com^
||tomens.xyz^
||givurs.xyz^
||giturs.xyz^
||bipens.xyz^
||bafens.xyz^
||bizens.xyz^
||biwens.xyz^
||hovens.xyz^
||huhens.xyz^
||guters.xyz^
||hucens.xyz^
||abirs.xyz^
||hakens.xyz^
||ahirs.xyz^
||bolens.xyz^
||botens.xyz^
||gojers.xyz^
||bagens.xyz^
||gozers.xyz^
||gulers.xyz^
||gujers.xyz^
||gomers.xyz^
||bahens.xyz^
||bixens.xyz^
||hirens.xyz^
||arirs.xyz^
||azirs.xyz^
||gohers.xyz^
||bapens.xyz^
||avors.xyz^
||ajirs.xyz^
||bisens.xyz^
||bopens.xyz^
||howens.xyz^
||gocers.xyz^
||ahors.xyz^
||husens.xyz^
||bodens.xyz^
||bigens.xyz^
||bosens.xyz^
||guvers.xyz^
||hutens.xyz^
||hafens.xyz^
||boxens.xyz^
||bijens.xyz^
||apors.xyz^
||axers.xyz^
||hoxens.xyz^
||babens.xyz^
||ajers.xyz^
||abers.xyz^
||akors.xyz^
||anirs.xyz^
||bohens.xyz^
||gufers.xyz^
||homens.xyz^
||awirs.xyz^
||huwens.xyz^
||bofens.xyz^
||adirs.xyz^
||anors.xyz^
||binens.xyz^
||bihens.xyz^
||bocens.xyz^
||huvens.xyz^
||holens.xyz^
||goders.xyz^
||hugens.xyz^
||awers.xyz^
||gugers.xyz^
||axors.xyz^
||borens.xyz^
||bicens.xyz^
||birens.xyz^
||higens.xyz^
||gurers.xyz^
||acors.xyz^
||bavens.xyz^
||barens.xyz^
||apirs.xyz^
||atirs.xyz^
||awors.xyz^
||guners.xyz^
||bibens.xyz^
||gumers.xyz^
||agirs.xyz^
||gupers.xyz^
||arors.xyz^
||alirs.xyz^
||guxers.xyz^
||guzers.xyz^
||humens.xyz^
||golers.xyz^
||hosens.xyz^
||hukens.xyz^
||bimens.xyz^
||hogens.xyz^
||goters.xyz^
||gokers.xyz^
||guwers.xyz^
||bamens.xyz^
||asirs.xyz^
||arers.xyz^
||guders.xyz^
||ators.xyz^
||bilens.xyz^
||asors.xyz^
||aders.xyz^
||avirs.xyz^
||asers.xyz^
||axirs.xyz^
||gosers.xyz^
||hipens.xyz^
||guhers.xyz^
||baxens.xyz^
||afors.xyz^
||bogens.xyz^
||gopers.xyz^
||bokens.xyz^
||goxers.xyz^
||huzens.xyz^
||gucers.xyz^
||akirs.xyz^
||amers.xyz^
||aters.xyz^
||bazens.xyz^
||gukers.xyz^
||bifens.xyz^
||gowers.xyz^
||alers.xyz^
||abors.xyz^
||gusers.xyz^
||gisurs.xyz^
||gicers.xyz^
||hihers.xyz^
||gubers.xyz^
||girurs.xyz^
||giburs.xyz^
||gorers.xyz^
||huxens.xyz^
||hurens.xyz^
||hulens.xyz^
||hupens.xyz^
||hunens.xyz^
||hujens.xyz^
||hufens.xyz^
||ahers.xyz^
||hudens.xyz^
||hubens.xyz^
||hozens.xyz^
||horens.xyz^
||bikens.xyz^
||hopens.xyz^
||honens.xyz^
||gawirs.xyz^
||gepirs.xyz^
||gesirs.xyz^
||gelirs.xyz^
||gazirs.xyz^
||disirs.xyz^
||gevirs.xyz^
||gacirs.xyz^
||gahirs.xyz^
||dovirs.xyz^
||dipirs.xyz^
||gagirs.xyz^
||gekirs.xyz^
||gajirs.xyz^
||dogirs.xyz^
||gemirs.xyz^
||getirs.xyz^
||denirs.xyz^
||gebirs.xyz^
||galirs.xyz^
||gatirs.xyz^
||gabirs.xyz^
||gamirs.xyz^
||gasirs.xyz^
||gonirs.xyz^
||garirs.xyz^
||gozirs.xyz^
||gafirs.xyz^
||ganirs.xyz^
||hawens.xyz^
||hibens.xyz^
||hocens.xyz^
||bajens.xyz^
||dozirs.xyz^
||doxirs.xyz^
||hihens.xyz^
||dojirs.xyz^
||dizirs.xyz^
||gowirs.xyz^
||hobens.xyz^
||hicens.xyz^
||dorirs.xyz^
||dotirs.xyz^
||bawens.xyz^
||dohirs.xyz^
||hilens.xyz^
||bacens.xyz^
||gecirs.xyz^
||himens.xyz^
||hikens.xyz^
||batens.xyz^
||gopirs.xyz^
||haxens.xyz^
||acirs.xyz^
||gehirs.xyz^
||bakens.xyz^
||hixens.xyz^
||hinens.xyz^
||hijens.xyz^
||dofirs.xyz^
||hanens.xyz^
||hodens.xyz^
||hazens.xyz^
||gezirs.xyz^
||hahens.xyz^
||donirs.xyz^
||goxirs.xyz^
||gobers.xyz^
||govirs.xyz^
||hofens.xyz^
||gosirs.xyz^
||dosirs.xyz^
||basens.xyz^
||gorirs.xyz^
||hizens.xyz^
||hamens.xyz^
||gewirs.xyz^
||hajens.xyz^
||hacens.xyz^
||afirs.xyz^
||hivens.xyz^
||gedirs.xyz^
||harens.xyz^
||banens.xyz^
||hadens.xyz^
||habens.xyz^
||hohens.xyz^
||hidens.xyz^
||hifens.xyz^
||afers.xyz^
||hiwens.xyz^
||gisid.live^
||gejirs.xyz^
||hokens.xyz^
||hojens.xyz^
||hisens.xyz^
||hatens.xyz^
||gotirs.xyz^
||badens.xyz^
||gerirs.xyz^
||hapens.xyz^
||hasens.xyz^
||dolirs.xyz^
||gexirs.xyz^
||dowirs.xyz^
||dokirs.xyz^
||dopirs.xyz^
||dodirs.xyz^
||repins.xyz^
||mepir.live^
||rajist.xyz^
||repis.xyz^
||mesir.live^
||ropist.xyz^
||rekis.xyz^
||rejis.xyz^
||tapins.xyz^
||mepor.live^
||tarins.xyz^
||rejins.xyz^
||metir.live^
||mefor.live^
||tewins.xyz^
||rojist.xyz^
||towins.xyz^
||rezis.xyz^
||meror.live^
||rekins.xyz^
||recins.xyz^
||mebir.live^
||rakist.xyz^
||renins.xyz^
||rerins.xyz^
||mahey.live^
||rewis.xyz^
||menor.live^
||radist.xyz^
||raxist.xyz^
||razist.xyz^
||nupges.live^
||rogist.xyz^
||retins.xyz^
||mexor.live^
||rehis.xyz^
||rocist.xyz^
||rezins.xyz^
||memir.live^
||ravist.xyz^
||nuhges.live^
||rohist.xyz^
||nujges.live^
||nuwges.live^
||refins.xyz^
||majey.live^
||rexins.xyz^
||redins.xyz^
||robist.xyz^
||relins.xyz^
||rugist.xyz^
||rewins.xyz^
||revins.xyz^
||telins.xyz^
||gokirs.xyz^
||dobirs.xyz^
||docirs.xyz^
||dicirs.xyz^
||demirs.xyz^
||rehins.xyz^
||togins.xyz^
||dexirs.xyz^
||dirirs.xyz^
||didirs.xyz^
||diwirs.xyz^
||gobirs.xyz^
||golirs.xyz^
||rusist.xyz^
||gadirs.xyz^
||gavirs.xyz^
||degirs.xyz^
||dijirs.xyz^
||dikirs.xyz^
||tevins.xyz^
||ditirs.xyz^
||rovist.xyz^
||romist.xyz^
||devirs.xyz^
||tojins.xyz^
||gapirs.xyz^
||ruzist.xyz^
||dezirs.xyz^
||girod.live^
||digirs.xyz^
||rudist.xyz^
||delirs.xyz^
||tonins.xyz^
||tofins.xyz^
||rupist.xyz^
||godirs.xyz^
||detirs.xyz^
||ruhist.xyz^
||gaxirs.xyz^
||decirs.xyz^
||gohirs.xyz^
||dilirs.xyz^
||rotist.xyz^
||gogirs.xyz^
||dewirs.xyz^
||dedirs.xyz^
||derirs.xyz^
||ruxist.xyz^
||defirs.xyz^
||dejirs.xyz^
||depirs.xyz^
||gired.live^
||tozins.xyz^
||tesins.xyz^
||difirs.xyz^
||gofirs.xyz^
||gakirs.xyz^
||dehirs.xyz^
||dihirs.xyz^
||rolist.xyz^
||rukist.xyz^
||dekirs.xyz^
||tovins.xyz^
||todins.xyz^
||torins.xyz^
||runist.xyz^
||ruvist.xyz^
||dixirs.xyz^
||divirs.xyz^
||rutist.xyz^
||desirs.xyz^
||dibirs.xyz^
||gomirs.xyz^
||gocirs.xyz^
||gojirs.xyz^
||dinirs.xyz^
||dimirs.xyz^
||regins.xyz^
||rebins.xyz^
||ruwist.xyz^
||debirs.xyz^
||totins.xyz^
||topins.xyz^
||tosins.xyz^
||rorist.xyz^
||rufist.xyz^
||rulist.xyz^
||tomins.xyz^
||tokins.xyz^
||tolins.xyz^
||tobins.xyz^
||ronist.xyz^
||tohins.xyz^
||ralist.xyz^
||tocins.xyz^
||tezins.xyz^
||texins.xyz^
||medor.live^
||rubist.xyz^
||tetins.xyz^
||temins.xyz^
||mewor.live^
||nudges.live^
||mazey.live^
||tefins.xyz^
||tacins.xyz^
||tavins.xyz^
||tejins.xyz^
||magey.live^
||tabins.xyz^
||tekins.xyz^
||mafey.live^
||rawist.xyz^
||maxey.live^
||tamins.xyz^
||roxist.xyz^
||ragist.xyz^
||rofist.xyz^
||tebins.xyz^
||makey.live^
||tanins.xyz^
||masey.live^
||marey.live^
||mevir.live^
||rucist.xyz^
||ramist.xyz^
||mezor.live^
||tenins.xyz^
||girid.live^
||tadins.xyz^
||terins.xyz^
||tawins.xyz^
||nutges.live^
||rowist.xyz^
||taxins.xyz^
||tegins.xyz^
||rahist.xyz^
||talins.xyz^
||tepins.xyz^
||rozist.xyz^
||tafins.xyz^
||melir.live^
||metor.live^
||tazins.xyz^
||tecins.xyz^
||tehins.xyz^
||maley.live^
||mapey.live^
||rodist.xyz^
||tedins.xyz^
||mamey.live^
||tasins.xyz^
||rafist.xyz^
||mezir.live^
||mexir.live^
||macey.live^
||mabey.live^
||rokist.xyz^
||tatins.xyz^
||remins.xyz^
||ratist.xyz^
||takins.xyz^
||tajins.xyz^
||nusges.live^
||nurges.live^
||ranist.xyz^
||tahins.xyz^
||tagins.xyz^
||nulges.live^
||mawey.live^
||mavey.live^
||nufges.live^
||maney.live^
||rabist.xyz^
||madey.live^
||memor.live^
||mekir.live^
||melor.live^
||kedel.live^
||gipod.live^
||megir.live^
||megor.live^
||mevor.live^
||mebor.live^
||mehir.live^
||mejir.live^
||medir.live^
||mefir.live^
||mewir.live^
||merir.live^
||mecor.live^
||menir.live^
||mehor.live^
||dixans.live^
||dilans.live^
||depans.live^
||demans.live^
||dizans.live^
||dekans.live^
||dezons.live^
||dezans.live^
||depons.live^
||delans.live^
||dihans.live^
||difans.live^
||detans.live^
||dejons.live^
||dikans.live^
||desans.live^
||diwans.live^
||devons.live^
||dibans.live^
||dipans.live^
||dehans.live^
||dinans.live^
||delons.live^
||dedans.live^
||didans.live^
||debans.live^
||derons.live^
||denans.live^
||dejans.live^
||divans.live^
||detons.live^
||disans.live^
||dekons.live^
||dewans.live^
||denons.live^
||dehons.live^
||dicans.live^
||degons.live^
||derans.live^
||dijans.live^
||dirans.live^
||ditans.live^
||desons.live^
||digans.live^
||mecir.live^
||dexons.live^
||dexans.live^
||devans.live^
||dewons.live^
||degans.live^
||defons.live^
||defans.live^
||dedons.live^
||decons.live^
||debons.live^
||decans.live^
||dakent.live^
||daxent.live^
||dapent.live^
||copux.live^
||boxis.live^
||coxix.live^
||cining.live^
||civens.live^
||cizens.live^
||bolis.live^
||bojis.live^
||cepans.live^
||cetans.live^
||botin.live^
||cagax.live^
||cicing.live^
||celans.live^
||cojux.live^
||cimens.live^
||cawex.live^
||copix.live^
||cowux.live^
||civing.live^
||citins.live^
||cefans.live^
||cogix.live^
||bosis.live^
||cohux.live^
||conix.live^
||cebans.live^
||cihins.live^
||cihens.live^
||cofux.live^
||cotux.live^
||datent.live^
||cekans.live^
||cazex.live^
||cozix.live^
||bokin.live^
||bowin.live^
||cikens.live^
||citeng.live^
||cowix.live^
||cokux.live^
||cakax.live^
||corux.live^
||bovin.live^
||bohis.live^
||cadax.live^
||cojix.live^
||cosux.live^
||cicens.live^
||cosix.live^
||cifens.live^
||botis.live^
||cobix.live^
||cibing.live^
||dahent.live^
||cazax.live^
||corix.live^
||cejans.live^
||cotix.live^
||borin.live^
||boxin.live^
||cidins.live^
||cipins.live^
||bolin.live^
||codux.live^
||cigens.live^
||cedans.live^
||ciweng.live^
||cixing.live^
||caxex.live^
||dadent.live^
||cafex.live^
||codix.live^
||colix.live^
||cokix.live^
||cogux.live^
||cohix.live^
||ciling.live^
||cinens.live^
||caxax.live^
||cavex.live^
||cawax.live^
||cavax.live^
||catex.live^
||covix.live^
||dacent.live^
||cehans.live^
||cabex.live^
||cezans.live^
||cecans.live^
||cerans.live^
||bopin.live^
||cevans.live^
||bowis.live^
||bocis.live^
||dawent.live^
||cibens.live^
||bogin.live^
||bokis.live^
||bofis.live^
||cilens.live^
||cireng.live^
||cirins.live^
||ciking.live^
||dasent.live^
||cajex.live^
||cexans.live^
||bozis.live^
||cegans.live^
||cizing.live^
||cisins.live^
||dajent.live^
||geront.live^
||gewont.live^
||givont.live^
||gizont.live^
||wicter.live^
||wedger.live^
||tuskel.live^
||tuskes.live^
||gijont.live^
||garot.live^
||tuskep.live^
||tuskeg.live^
||gikont.live^
||gorint.live^
||gibont.live^
||gowint.live^
||gitont.live^
||gigont.live^
||gicont.live^
||cewans.live^
||gihont.live^
||gesont.live^
||cijins.live^
||jedger.live^
||gilont.live^
||gexont.live^
||gifont.live^
||gedont.live^
||tusked.live^
||gisont.live^
||gipont.live^
||bogis.live^
||camax.live^
||casex.live^
||tusket.live^
||ciseng.live^
||cijens.live^
||bovis.live^
||dafent.live^
||bohin.live^
||dazent.live^
||ciwins.live^
||bofin.live^
||bodis.live^
||ciming.live^
||cenans.live^
||dalent.live^
||canax.live^
||bobin.live^
||bozin.live^
||bocin.live^
||calax.live^
||davent.live^
||casax.live^
||cipeng.live^
||capax.live^
||bopis.live^
||carax.live^
||cifins.live^
||bosin.live^
||cesans.live^
||cixens.live^
||cemans.live^
||cigins.live^
||cidens.live^
||cahax.live^
||cajax.live^
||cahex.live^
||cagex.live^
||cafax.live^
||cacax.live^
||cacex.live^
||cabax.live^
||tuskef.live^
||tuskeh.live^
||hedger.live^
||regems.live^
||gotint.live^
||ginont.live^
||gimont.live^
||darent.live^
||dabent.live^
||danent.live^
||dament.live^
||dagent.live^
||giwont.live^
||giront.live^
||tadin.live^
||sralk.live^
||slalk.live^
||smalk.live^
||tabon.live^
||gawont.live^
||gehont.live^
||gatot.live^
||gebont.live^
||getont.live^
||skalk.live^
||gapot.live^
||gecont.live^
||gepont.live^
||gevont.live^
||taton.live^
||gejont.live^
||tahin.live^
||gasont.live^
||sjalk.live^
||tacin.live^
||tagin.live^
||tazin.live^
||gafot.live^
||gadot.live^
||gasot.live^
||gawot.live^
||genont.live^
||gixont.live^
||gidont.live^
||gemont.live^
||gelont.live^
||gekont.live^
||gezont.live^
||gegont.live^
||gefont.live^
||tazon.live^
||tacon.live^
||gagot.live^
||gamont.live^
||gagont.live^
||droppa.live^
||dobbla.live^
||takon.live^
||takin.live^
||taxon.live^
||tabin.live^
||tajin.live^
||tajon.live^
||tahon.live^
||taxin.live^
||tafon.live^
||tafin.live^
||tadon.live^
||dewit.live^
||tawon.live^
||tawin.live^
||tavon.live^
||tavin.live^
||sozing.live^
||soweng.live^
||somong.live^
||soxing.live^
||soteng.live^
||soring.live^
||soning.live^
||soling.live^
||someng.live^
||soxong.live^
||sowing.live^
||sozong.live^
||sopeng.live^
||sokeng.live^
||soming.live^
||sozeng.live^
||soxeng.live^
||tatin.live^
||sovong.live^
||tarin.live^
||soveng.live^
||sojong.live^
||sonong.live^
||sogong.live^
||soleng.live^
||soreng.live^
||sowong.live^
||taron.live^
||tamon.live^
||tasin.live^
||soving.live^
||soting.live^
||tapon.live^
||tason.live^
||soging.live^
||tanon.live^
||talin.live^
||tamin.live^
||soking.live^
||sojing.live^
||sojeng.live^
||sotong.live^
||sohong.live^
||sohing.live^
||soheng.live^
||sofing.live^
||sofeng.live^
||sopong.live^
||soping.live^
||sodong.live^
||soding.live^
||gikid.live^
||giwod.live^
||gijod.live^
||sidid.live^
||sidod.live^
||giled.live^
||gined.live^
||sicid.live^
||giked.live^
||ginod.live^
||gilid.live^
||sigod.live^
||giwid.live^
||sibod.live^
||gixid.live^
||giped.live^
||gijed.live^
||sifod.live^
||ginid.live^
||gikod.live^
||gilod.live^
||gixod.live^
||gijid.live^
||sibed.live^
||sogeng.live^
||sobeng.live^
||gized.live^
||gixed.live^
||sobong.live^
||soceng.live^
||sided.live^
||gizod.live^
||sodeng.live^
||soneng.live^
||socong.live^
||socing.live^
||sobing.live^
||gizid.live^
||giwed.live^
||sigid.live^
||givod.live^
||givid.live^
||gived.live^
||gitod.live^
||siged.live^
||gitid.live^
||gited.live^
||gisod.live^
||sipid.live^
||sipod.live^
||sifid.live^
||sinod.live^
||siped.live^
||sinid.live^
||sined.live^
||fehons.live^
||grimy.live^
||luxan.live^
||moken.live^
||stohal.live^
||pibers.live^
||simod.live^
||saris.live^
||sawes.live^
||sahus.live^
||sapis.live^
||sagis.live^
||sares.live^
||sames.live^
||sates.live^
||sanus.live^
||safis.live^
||sades.live^
||sanis.live^
||saxus.live^
||sahes.live^
||sases.live^
||safes.live^
||sacus.live^
||sadus.live^
||savus.live^
||samus.live^
||sazis.live^
||savis.live^
||sahis.live^
||sasis.live^
||saves.live^
||sacis.live^
||sapus.live^
||sasus.live^
||sajes.live^
||sajis.live^
||sanes.live^
||sadis.live^
||saxis.live^
||saxes.live^
||samis.live^
||sagus.live^
||sawus.live^
||safus.live^
||sabus.live^
||sapes.live^
||sazes.live^
||salis.live^
||simid.live^
||silid.live^
||saces.live^
||siced.live^
||sijod.live^
||sihed.live^
||sakus.live^
||sikid.live^
||sijed.live^
||sihid.live^
||siked.live^
||sicod.live^
||sijid.live^
||simed.live^
||sihod.live^
||silod.live^
||afeta.live^
||sikod.live^
||siled.live^
||sabis.live^
||sakis.live^
||sibid.live^
||nised.live^
||sabes.live^
||pekog.live^
||gaxeh.live^
||gateh.live^
||sawis.live^
||renak.live^
||perog.live^
||tolfe.live^
||tolki.live^
||tolve.live^
||tolmi.live^
||tolne.live^
||tolze.live^
||tolbe.live^
||tolhi.live^
||tolji.live^
||tolsi.live^
||tolpe.live^
||tolti.live^
||tolri.live^
||tolte.live^
||tolwi.live^
||tolvi.live^
||tolde.live^
||tolse.live^
||tolzi.live^
||tolpi.live^
||tolni.live^
||tolke.live^
||tolme.live^
||tolre.live^
||tolje.live^
||tolhe.live^
||tolwe.live^
||tolgi.live^
||sazus.live^
||tolge.live^
||tolce.live^
||tolfi.live^
||toldi.live^
||tolci.live^
||sajus.live^
||tolbi.live^
||rekak.live^
||relak.live^
||rehak.live^
||rewag.live^
||renag.live^
||rerad.live^
||rerak.live^
||retak.live^
||resak.live^
||remad.live^
||rewad.live^
||repag.live^
||resad.live^
||rebak.live^
||rekag.live^
||revag.live^
||relag.live^
||repad.live^
||redak.live^
||rerag.live^
||rehad.live^
||redad.live^
||regak.live^
||rekad.live^
||relad.live^
||rebad.live^
||repak.live^
||retag.live^
||resag.live^
||revak.live^
||rejak.live^
||rejag.live^
||renad.live^
||rejad.live^
||pekot.live^
||revad.live^
||gareh.live^
||petog.live^
||pemot.live^
||pevog.live^
||pehot.live^
||gawet.live^
||pelog.live^
||pedot.live^
||pepog.live^
||penog.live^
||galeh.live^
||gaset.live^
||pelot.live^
||gaket.live^
||petot.live^
||pepot.live^
||pezot.live^
||pedog.live^
||pexog.live^
||regag.live^
||rehag.live^
||regad.live^
||pegog.live^
||gazet.live^
||pegot.live^
||refak.live^
||refag.live^
||astel.live^
||refad.live^
||recak.live^
||recag.live^
||pefog.live^
||pefot.live^
||gazeh.live^
||recad.live^
||gaxet.live^
||polik.live^
||pohik.live^
||powik.live^
||pofim.live^
||pomim.live^
||pofik.live^
||pogim.live^
||poxik.live^
||porir.live^
||posik.live^
||pocik.live^
||pomik.live^
||pogir.live^
||powir.live^
||podik.live^
||popim.live^
||ponir.live^
||pobir.live^
||posir.live^
||poxir.live^
||povim.live^
||poxim.live^
||ponik.live^
||pobim.live^
||potim.live^
||pojik.live^
||powim.live^
||pozir.live^
||pohir.live^
||povik.live^
||podir.live^
||posim.live^
||popir.live^
||pozim.live^
||popik.live^
||ponim.live^
||potir.live^
||pozik.live^
||porim.live^
||porik.live^
||polim.live^
||pohim.live^
||gaweh.live^
||pomir.live^
||pogik.live^
||pofir.live^
||gavet.live^
||pecot.live^
||polir.live^
||gaveh.live^
||podim.live^
||pocir.live^
||pocim.live^
||pokir.live^
||pecog.live^
||pebot.live^
||pojim.live^
||pehog.live^
||gatet.live^
||pebog.live^
||gaseh.live^
||pokim.live^
||pokik.live^
||pobik.live^
||pojir.live^
||pezog.live^
||pexot.live^
||pewot.live^
||pewog.live^
||pevot.live^
||becog.live^
||pesot.live^
||pejog.live^
||gapet.live^
||penot.live^
||pesog.live^
||gapeh.live^
||pejot.live^
||ganet.live^
||pemog.live^
||ganeh.live^
||dahig.live^
||gameh.live^
||galet.live^
||gakeh.live^
||gajeh.live^
||gahet.live^
||gafeh.live^
||dazig.live^
||dabig.live^
||gaget.live^
||gageh.live^
||gadeh.live^
||mowist.live^
||gaceh.live^
||gadet.live^
||gaheh.live^
||gafet.live^
||gacet.live^
||dabin.live^
||gabeh.live^
||grotus.live^
||dadin.live^
||dasig.live^
||nejirs.live^
||dajig.live^
||nenirs.live^
||momist.live^
||mokist.live^
||nesirs.live^
||dasin.live^
||mopist.live^
||movist.live^
||molest.live^
||moxist.live^
||netis.live^
||danig.live^
||momest.live^
||dadig.live^
||motest.live^
||nesis.live^
||dapig.live^
||mowest.live^
||nedis.live^
||molist.live^
||davig.live^
||damig.live^
||dahin.live^
||nekis.live^
||motist.live^
||morist.live^
||danin.live^
||dalig.live^
||daxin.live^
||nelirs.live^
||nepirs.live^
||mopest.live^
||dagig.live^
||mokest.live^
||nebis.live^
||monest.live^
||dazin.live^
||dawin.live^
||dafin.live^
||monist.live^
||dakig.live^
||daxig.live^
||morest.live^
||movest.live^
||nemirs.live^
||netirs.live^
||nejis.live^
||mozest.live^
||dagin.live^
||dafig.live^
||dacin.live^
||datig.live^
||mosist.live^
||negirs.live^
||dapin.live^
||moxest.live^
||nehis.live^
||nemis.live^
||mosest.live^
||negis.live^
||nekirs.live^
||nerirs.live^
||nenis.live^
||darig.live^
||nehirs.live^
||necis.live^
||nedirs.live^
||nefirs.live^
||nefis.live^
||mozist.live^
||necirs.live^
||nebirs.live^
||kodit.live^
||kosit.live^
||kolet.live^
||kopet.live^
||kofet.live^
||kolit.live^
||koret.live^
||kocet.live^
||kodet.live^
||konet.live^
||kovet.live^
||kotit.live^
||kofit.live^
||kokit.live^
||komet.live^
||koket.live^
||kovit.live^
||kobit.live^
||koget.live^
||korit.live^
||kojet.live^
||kotet.live^
||kohit.live^
||kowet.live^
||koset.live^
||kopit.live^
||kogit.live^
||kohet.live^
||konit.live^
||kowit.live^
||kojit.live^
||kocit.live^
||bovid.live^
||bocid.live^
||bojid.live^
||bopid.live^
||bokid.live^
||bonid.live^
||bosid.live^
||bohid.live^
||boxid.live^
||bowid.live^
||bofid.live^
||bodid.live^
||borid.live^
||bozid.live^
||bogid.live^
||bobid.live^
||sojid.live^
||socid.live^
||rofid.live^
||sobid.live^
||sofid.live^
||sohed.live^
||sopid.live^
||sobed.live^
||soded.live^
||rozed.live^
||roved.live^
||soced.live^
||rotid.live^
||rolid.live^
||sonid.live^
||sofed.live^
||sogid.live^
||roxed.live^
||ronid.live^
||sojed.live^
||soled.live^
||rozid.live^
||sohid.live^
||rowid.live^
||sosid.live^
||ropid.live^
||rosed.live^
||rojed.live^
||sokid.live^
||soked.live^
||sosed.live^
||rowed.live^
||somed.live^
||soped.live^
||roxid.live^
||rovid.live^
||roled.live^
||roped.live^
||roted.live^
||roked.live^
||rosid.live^
||rorid.live^
||rodid.live^
||roged.live^
||sodid.live^
||rohid.live^
||rored.live^
||roded.live^
||rofed.live^
||robid.live^
||bolid.live^
||rohed.live^
||rogid.live^
||rocid.live^
||roced.live^
||soged.live^
||soned.live^
||roned.live^
||robed.live^
||tijens.live^
||tisens.live^
||tikers.live^
||tigens.live^
||tilens.live^
||tijers.live^
||tiwens.live^
||timens.live^
||ticens.live^
||tipens.live^
||tifens.live^
||tirers.live^
||tihens.live^
||tivers.live^
||tibers.live^
||tiwers.live^
||tizens.live^
||tiners.live^
||tifers.live^
||tipers.live^
||tidens.live^
||tivens.live^
||tixers.live^
||tizers.live^
||tinens.live^
||titers.live^
||tirens.live^
||tisers.live^
||tixens.live^
||titens.live^
||tilers.live^
||tikens.live^
||asmer.live^
||tihers.live^
||papons.live^
||padons.live^
||roxels.live^
||rohels.live^
||rogels.live^
||rozeks.live^
||pamons.live^
||kered.live^
||roreks.live^
||pawons.live^
||pagons.live^
||rodels.live^
||kewel.live^
||rofeks.live^
||kerel.live^
||rojels.live^
||keled.live^
||kemed.live^
||keped.live^
||kexel.live^
||paxons.live^
||kehel.live^
||kemel.live^
||panons.live^
||pacons.live^
||kefel.live^
||kezed.live^
||rodeks.live^
||ketel.live^
||kefed.live^
||rozels.live^
||ronels.live^
||kened.live^
||rocels.live^
||pajons.live^
||kesed.live^
||keved.live^
||roheks.live^
||kekel.live^
||pabons.live^
||keded.live^
||kesel.live^
||pavons.live^
||rorels.live^
||kexed.live^
||roxeks.live^
||kejed.live^
||roteks.live^
||robels.live^
||kenel.live^
||rowels.live^
||kebed.live^
||rotels.live^
||rogeks.live^
||keked.live^
||kecel.live^
||ropels.live^
||rovels.live^
||kelel.live^
||keted.live^
||rolels.live^
||roseks.live^
||roweks.live^
||rofels.live^
||roceks.live^
||keged.live^
||romels.live^
||kewed.live^
||kevel.live^
||kepel.live^
||roveks.live^
||ropeks.live^
||pahons.live^
||kejel.live^
||pafons.live^
||kehed.live^
||ticers.live^
||tibens.live^
||rosels.live^
||pihers.live^
||rokels.live^
||tiders.live^
||romeks.live^
||roneks.live^
||roleks.live^
||pipens.live^
||pazons.live^
||rojeks.live^
||rokeks.live^
||kezel.live^
||krafig.live^
||kratig.live^
||krahig.live^
||krarig.live^
||kravig.live^
||krajig.live^
||krasig.live^
||kralig.live^
||kranig.live^
||krakig.live^
||krapig.live^
||krawig.live^
||kraxig.live^
||krazig.live^
||kramig.live^
||kragig.live^
||kradig.live^
||kracig.live^
||parons.live^
||krabig.live^
||ganist.live^
||folit.live^
||kiset.online^
||krafit.live^
||krajis.live^
||krapis.live^
||krasit.live^
||kranir.live^
||krawit.live^
||kramir.live^
||krawis.live^
||krarir.live^
||kradir.live^
||kramis.live^
||kraxis.live^
||krafis.live^
||kralir.live^
||kracir.live^
||kratir.live^
||krahir.live^
||kragir.live^
||krakit.live^
||krakis.live^
||krapit.live^
||kradit.live^
||krasis.live^
||kratis.live^
||kraxit.live^
||krawir.live^
||krazit.live^
||krazis.live^
||kravir.live^
||kradis.live^
||krajir.live^
||kranis.live^
||krasir.live^
||krarit.live^
||kratit.live^
||krazir.live^
||krafir.live^
||kracit.live^
||kracis.live^
||krakir.live^
||kraris.live^
||krabir.live^
||kraxir.live^
||kragis.live^
||krabis.live^
||krapir.live^
||kralis.live^
||kragit.live^
||patert.live^
||pamest.live^
||pajest.live^
||pagest.live^
||pasert.live^
||pakert.live^
||pahest.live^
||pagert.live^
||paxert.live^
||pacert.live^
||pakest.live^
||pamert.live^
||pajert.live^
||panert.live^
||pazert.live^
||pafert.live^
||parest.live^
||pahert.live^
||pavest.live^
||palert.live^
||pawert.live^
||papest.live^
||parert.live^
||pawest.live^
||paxest.live^
||pabert.live^
||padest.live^
||padert.live^
||pasest.live^
||patest.live^
||pavert.live^
||papert.live^
||pafest.live^
||kralit.live^
||mepis.live^
||krahis.live^
||darok.live^
||pimers.live^
||pazest.live^
||panest.live^
||palest.live^
||kewex.live^
||kexlex.live^
||kerex.live^
||ketlex.live^
||kepex.live^
||kerlex.live^
||kewlex.live^
||kebex.live^
||keblex.live^
||keklex.live^
||kenlex.live^
||kehex.live^
||keglex.live^
||kenex.live^
||ketex.live^
||kemex.live^
||kelex.live^
||kezlex.live^
||kefex.live^
||kemlex.live^
||kejex.live^
||kedlex.live^
||kexex.live^
||kevex.live^
||kevlex.live^
||keslex.live^
||keclex.live^
||kezex.live^
||keplex.live^
||pacest.live^
||pabest.live^
||jakin.live^
||tawigs.live^
||hunir.live^
||hulir.live^
||humir.live^
||hutir.live^
||huvir.live^
||hucer.live^
||huger.live^
||huper.live^
||hugir.live^
||huder.live^
||husir.live^
||huzir.live^
||huxir.live^
||huxer.live^
||hukir.live^
||hurer.live^
||hufir.live^
||hubir.live^
||huwer.live^
||huser.live^
||hupir.live^
||huwir.live^
||hurir.live^
||huker.live^
||huver.live^
||huter.live^
||huzer.live^
||kecex.live^
||huler.live^
||hudir.live^
||hucir.live^
||pifers.live^
||keflex.live^
||pijers.live^
||kedex.live^
||hujer.live^
||harex.live^
||kehlex.live^
||huner.live^
||hufer.live^
||kekex.live^
||drinen.live^
||kejlex.live^
||kegex.live^
||pewins.live^
||hujir.live^
||huhir.live^
||kozirs.live^
||kopiks.live^
||kohirs.live^
||kotiks.live^
||koliks.live^
||kowiks.live^
||kobirs.live^
||koriks.live^
||koxiks.live^
||kofiks.live^
||kotirs.live^
||kociks.live^
||kovirs.live^
||kosiks.live^
||kohiks.live^
||kowirs.live^
||korirs.live^
||kofirs.live^
||komirs.live^
||kosirs.live^
||konirs.live^
||kolirs.live^
||koziks.live^
||koxirs.live^
||koviks.live^
||kojirs.live^
||kokiks.live^
||kopirs.live^
||koniks.live^
||kogiks.live^
||kocirs.live^
||huher.live^
||driwer.live^
||molirs.live^
||pihens.live^
||kojiks.live^
||driber.live^
||driken.live^
||drigen.live^
||drizen.live^
||drixer.live^
||driler.live^
||drixen.live^
||driper.live^
||drisen.live^
||drifer.live^
||driger.live^
||dripen.live^
||driher.live^
||dricer.live^
||drihen.live^
||drider.live^
||driben.live^
||drimen.live^
||driden.live^
||drifen.live^
||driker.live^
||drimer.live^
||driner.live^
||drijer.live^
||driwen.live^
||drilen.live^
||drijen.live^
||drizer.live^
||driter.live^
||driren.live^
||driten.live^
||kokirs.live^
||kogirs.live^
||kodirs.live^
||pigers.live^
||kodiks.live^
||driser.live^
||kobiks.live^
||dricen.live^
||gifems.live^
||kewosi.live^
||intes.live^
||sejaks.live^
||pigens.live^
||stolal.live^
||antis.live^
||tavips.live^
||foxin.live^
||cerom.live^
||pikers.live^
||hasix.live^
||hamex.live^
||pilens.live^
||stofal.live^
||hapix.live^
||gusuf.online^
||hewet.live^
||kalip.live^
||floci.live^
||futil.live^
||agur.live^
||dohin.live^
||dogin.live^
||donin.live^
||dorin.live^
||dojen.live^
||doten.live^
||dosen.live^
||dopen.live^
||domen.live^
||dokin.live^
||doken.live^
||dodin.live^
||donen.live^
||doben.live^
||doden.live^
||dowin.live^
||doxin.live^
||dowen.live^
||dohen.live^
||dopin.live^
||dozin.live^
||doxen.live^
||dofen.live^
||dojin.live^
||docen.live^
||doren.live^
||pifens.live^
||drirer.live^
||dobin.live^
||hapex.live^
||dovin.live^
||luzar.live^
||tazins.live^
||doven.live^
||hanix.live^
||pidens.live^
||dotin.live^
||hanex.live^
||pijens.live^
||pakins.live^
||pinens.live^
||palins.live^
||pamims.live^
||pakims.live^
||moler.live^
||palims.live^
||pamins.live^
||pahins.live^
||pahims.live^
||mofer.live^
||pajins.live^
||pajims.live^
||momer.live^
||hohirs.live^
||hokims.live^
||hokins.live^
||hojirs.live^
||hojims.live^
||hokirs.live^
||hojins.live^
||hohins.live^
||tawirs.live^
||taxirs.live^
||tawins.live^
||taxins.live^
||picers.live^
||ladert.live^
||latert.live^
||lakert.live^
||lapert.live^
||lagest.live^
||ladest.live^
||lawert.live^
||lafert.live^
||laxert.live^
||lasert.live^
||lalest.live^
||lazert.live^
||labest.live^
||lahest.live^
||lacest.live^
||lavert.live^
||lajert.live^
||lanest.live^
||lamert.live^
||labert.live^
||lawest.live^
||lakest.live^
||laxest.live^
||lavest.live^
||lagert.live^
||lacert.live^
||lapest.live^
||lazest.live^
||lanert.live^
||lajest.live^
||lalert.live^
||larert.live^
||hamix.live^
||tarins.live^
||halex.live^
||havix.live^
||tavirs.live^
||lasest.live^
||pibens.live^
||havex.live^
||hatix.live^
||molen.live^
||larest.live^
||tavins.live^
||rokens.live^
||foleg.live^
||fobed.live^
||foded.live^
||fojeg.live^
||fojed.live^
||fomeg.live^
||foced.live^
||fogeg.live^
||foled.live^
||fodeg.live^
||foped.live^
||foged.live^
||fohed.live^
||fomer.live^
||fored.live^
||fofed.live^
||fozek.live^
||foned.live^
||foneg.live^
||fosed.live^
||fobeg.live^
||fopeg.live^
||foheg.live^
||fokeg.live^
||foreg.live^
||foceg.live^
||foked.live^
||fomed.live^
||fofeg.live^
||hatex.live^
||tawips.live^
||tatins.live^
||lamest.live^
||doloy.live^
||25defect.mansurdo.ru^
||stomal.live^
||tasins.live^
||tasirs.live^
||lahert.live^
||fanir.live^
||foseg.live^
||harix.live^
||tatips.live^
||tazips.live^
||bbbb.ulitron.ru^
||97deposit.mexv.ru^
||3delivered.mexv.ru^
||8descendant.erinaceuso.ru^
||enforce.interdependent23.vipertos.ru^
||perceive81.molotiras.ru^
||judgement71.nightmit.ru^
||73descendant.erinaceuso.ru^
||debts71.semashi.ru^
||mewed.ulitron.ru^
||alley.sorting88.cavalierso.ru^

! https://github.com/durablenapkin/scamblocklist/issues/18
||q3i5q2r6.stackpathcdn.com^

! https://github.com/uBlockOrigin/uAssets/pull/17530
||rblx.land^

! https://forums.malwarebytes.com/topic/296891-malwarebytes-fake-website-scam-website/#comment-1563262 (account required)
||webstore.getsecuredsetup.com^
||www.webstore.getsecuredsetup.com^

! https://github.com/uBlockOrigin/uAssets/issues/17602
||allprizesforme.com^

! https://github.com/durablenapkin/scamblocklist/issues/28
||muskai.net^
||tslawill.com^
||xrp-give.pro^

! https://github.com/durablenapkin/scamblocklist/issues/32
||spacexmusk.io^

! https://www.reddit.com/r/uBlockOrigin/comments/12r255v/gamingnewsanalystcom_badware/
! https://github.com/uBlockOrigin/uAssets/pull/17655
||gamingnewsanalyst.com^
||gamingdebates.com^

! https://www.reddit.com/r/uBlockOrigin/comments/12q5o60/repost_fake_dating_site_badware/
||flirt4free.com^
||entrance.flirt4free.com^$popup

! https://www.reddit.com/r/uBlockOrigin/comments/12pues7/fake_123movies_site_leading_to_redirect/
||123moviesgo.ga^

! https://github.com/durablenapkin/scamblocklist/issues/35
||tslaget.live^
||musk-aigpt.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/121793
||cjtrade4.xyz^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/121792
||rplnd60.com^
||news-pewuce.com^
||djpjwf.com^
! from notifications (sandbox: )
||totalprotection-2023.store^
||closingday2.xyz^
||s.viifogyp.com^
||viifogyp.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/121816
||tradersuper4.xyz^

! nitro scam 
||tronite.xyz^
||locked4.com^
||www.locked4.com^

! https://www.reddit.com/r/uBlockOrigin/comments/12wqrv5/steamunlockednet_badware/ <-- have not verified sites to be malware! These are just domains ads in my analysis
! https://app.any.run/tasks/9ed7df61-f0a9-49cc-91bc-a3fcc2c59ae1/
||antivirusgaming.com^
||aluationiamcur.com^
||xrlbq.aluationiamcur.com^
||awesome-blocker.com^

! https://app.any.run/tasks/c9657f58-f49e-4e9e-80bf-9704f0eaa32a (NSFW)
||gbcok.aluationiamcur.com^
||www6.renhadmasandbab.info^$popup
||mobilesecuremail.com^

! https://github.com/durablenapkin/scamblocklist/issues/38
||miningpror.top^
||paypartc.top^
||bitcllpay.top^
||tdsintegrations11.online^
||crypto030.online^

! NSFW: https://app.any.run/tasks/a1a425ca-7b5d-4774-95bf-c11f8f25685a
||webpick-cdn.s3.us-west-2.amazonaws.com/getlaid.jpeg^
||uuksehinkitwkuo.com^
||wzzzs.uuksehinkitwkuo.com^

! https://app.any.run/tasks/d576fecb-3250-4a18-82de-eba82ac7ba6d
||click2code.xyz^

! https://github.com/durablenapkin/scamblocklist/issues/40
||dischargebackhanded.com^
||zech-company.com^
||govmedcareers.com^
||talentmaster.bio^
||radiatorcrate.com^
||theniemannbest.com^
||jellyfishstat.live^

! https://github.com/durablenapkin/scamblocklist/issues/42
||intgblockchain.online^

! https://github.com/uBlockOrigin/uAssets/issues/17947
||pccdirect.site^

! youtube typosquatt I found
||you8tube.com^
||getluckyprize2023.com^
! https://app.any.run/tasks/494077d1-478b-47e0-871c-b22788a455b6
||pingleflavor.xyz^
||funprizeali.site^

! other notification spam
||datenow.losbestbsdating2023.com^
||losbestbsdating2023.com^

! discord nitro scam 
||techsoftglobals.com^

! https://github.com/durablenapkin/scamblocklist/issues/43
||555sq.com.cn^
||prorify.de^
||milgenial.uy^
||swuso.com^
||cebubestbuy.com^
||buyyeezy2023.com^
||casavec.com^
||kingcampoutdoors.co.jp^
||imlb2c.com^
||wareeb.pk^
||loepwatch.com^
||fiewatch.com^
||felara.com.do^
||posehee.com^
||beautyt.shop^
||lomoor.com^
||morlyes.com^
||ajcenteruss.com^
||bitiiy.com^
||storagestory.com^
||ihuers.com^
||bloomessentialsbrand.com^
||quitasueno.com^
||lifestyletrading.co.za^
||yyderfreap.shop^
||audiosg.com.sg^
||fujibikes.com^
||walmartchina.top^
||geldencosmeticos.com^
||sellfox.com^
||parklaneupholstemk.com^
||iteeus.com^
||monark-store.com^
||shapeden.com^
||andamente.pt^
||staging.zendrop.com^
||courier-tracking.com^
||yofi-yofi.com^
||stellara.de^
||innomediacreate.com^
||sehaleservices.com^
||magnite.shop^
||decompraschile.com^
||salimusic.com^
||open-cbd.de^
||onrunningshop.com^
||bygigi.mx^
||vkeys.online^
||teevpower.com^
||caraci.it^
||easyshopper.org^
||oncloudrun.shop^
||shopperexpress.shop^
||aoocib.com^
||7s4c.top^
||chandeco.com^
||networksfishing.com^
||millabay.com^
||mila-vica.de^
||ballsbags.com^
||vinisay.com^
||tinkleo.com^
||draxu.com^
||headsets4business.co.uk^
||kielorelief.io^
||olaoffer.shop^
||nosdaarte.com^
||pairmate.se^
||babybeddingdesign.com^
||coco-vip-shop.com^
||xunlei.it^
||botsuanah.com^
||lojaacasa.com.br^
||dashracegear.net^
||youthfy.shop^
||smartokids.com^
||pipopi.com^
||k-tozluxury.shop^
||zuozuoshoe.shop^
||vip-yuki-shop.com^
||c-tozluxury.shop^
||lasercutjewelry.net^
||sleepyfull.com^
||expofstore.com^
||watchmark.shop^
||carsaratek.com^
||xajzfwgs.com^
||uange.shop^
||imagemotorcycles.co.nz^
||twinsbio.com^
||snapchaty.com^
||tomfordgo.com^
||worthas.shop^
||microgull.com^

! https://github.com/hagezi/dns-blocklists/issues/1025
||msmcompare.com^

! https://github.com/durablenapkin/scamblocklist/issues/45
||teslatucker.com^

! https://www.reddit.com/r/uBlockOrigin/comments/13e53jy/badware_movie_sites/
! https://github.com/uBlockOrigin/uAssets/issues/18333
||filmshngjbzix.blogspot.com^
||mopiez.com^
! NSFW: https://tria.ge/230511-1g9xlada3x/behavioral1
||lynku.mingotime.com^
||secret-list.yasdoodl.com^
||smcdsecure.com^

! https://github.com/durablenapkin/scamblocklist/issues/46
||teslalive23.pro^
||muskbtc.io^

! https://github.com/hagezi/dns-blocklists/issues/1053
||i-grade.online^

! https://github.com/durablenapkin/scamblocklist/issues/49
||successglossary.com^
||mybestautologin567.com^
||microngroup.pro^

! https://github.com/durablenapkin/scamblocklist/issues/50
||abncbp.com^

! spam
||hotgirlsj8k8.com^
||locasualx.com^
||web.locasualx.com^
||datingcentral.top^
||i.datingcentral.top^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/418503
||tushura.life^
||0a317d9d6b.79c4215c89.com^

! https://tria.ge/230520-nthbwseg41/behavioral1
||ugpe.krokwbok.pl^
||37.1.213.100^
||tabloidquantitycosts.com^
||newsfrcity.azurewebsites.net^

! https://forums.malwarebytes.com/topic/298178-google-security-alert-google-cloud-hacked-viruses-found-3-etc/
||undectia.com^

! account required: https://forums.malwarebytes.com/topic/298281-genshin-impact-scam-websites-to-avoid/
! my analysis: https://tria.ge/230524-wfaznadg93/behavioral1
||hoyolab.help^
||hoylab.firebaseapp.com^
||cloudfront.net/public/dynamo/lockerClick.php?offer=*offer_position
||visitor-country.info^
||weletmim.com/click?pid=*&offer_id=*&
||go.letmimy.com^

! https://github.com/hagezi/dns-blocklists/issues/1075
||factorysale2023.com^
||onlinestores.factorysale2023.com^
||si.factorysale2023.com^
||augusthenri.be^

! https://github.com/durablenapkin/scamblocklist/issues/54
||haceroberomaste.com^
||nze0xw.haceroberomaste.com^

! https://github.com/hagezi/dns-blocklists/issues/1079
! my analysis: https://app.any.run/tasks/4d88f2f5-5446-4980-8bc9-15e520e96651
! my analysis: https://app.any.run/tasks/060171c5-6a0f-41db-ba01-27bd8c61e326
||onlyfanstake.pro^
||filedenzu.com^

! https://tria.ge/230524-m6b5zacg3y/behavioral2
||85.192.63.194^

! https://github.com/hagezi/dns-blocklists/issues/1089
||elonmix.org^
||musklink.org^
||muskbot.io^

! https://github.com/badmojr/1Hosts/issues/1429
||thelabourforce.com^
||v5o.disktopic.com^

! https://www.reddit.com/r/uBlockOrigin/comments/13ub824/trojan_scam_ads_to_block/
! my analysis: https://app.any.run/tasks/e3720726-f650-434c-b34c-68ce718977ff
||goo.googoodee.com^
||vipsupport.festivalmarqueecompany.cyou^
||festivalmarqueecompany.cyou^

! https://app.any.run/tasks/ed28f343-c1f8-48c2-acea-3088eae6fc0b
||gz1nzy3x-d147-v9.saithinaya.best^

! https://app.any.run/tasks/c66b7f3b-9400-4cdf-8a94-0c834c13cb3c
||a6j355tu-d148-v9.wrathgrove.best^

! nsfw: https://app.any.run/tasks/4fd09c13-0e01-4f6a-9d0b-627e24d86293
||yaglkpxae-d148-api-v1.silverscar.shop^

! https://app.any.run/tasks/f1c3cc87-16d7-4c79-9b10-7163b398c2f9/
||fbhack.blaow.pro^

! https://app.any.run/tasks/484b97da-3dff-466a-99c7-c1a7fe4ac385
||fbshredder.com^
||softwaredlfast.top^
||softwarebaze.top^
||rapidfilesbase.top^
! https://tria.ge/230530-3b6zvscd5x/behavioral1
||fastfilesdls.top^

! https://app.any.run/tasks/e9aa7e83-283f-4ef3-bb6f-cd98d7df2e1e
||hypercracker.com^

! https://github.com/hagezi/dns-blocklists/issues/1098
||jakedstake.com^
||improtants.space^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/551938
! my analysis: https://tria.ge/230531-2tegwsbh3v/behavioral1
||azmovies.io^
||pdtrax.g2afse.com^
||tr.trackingit.site^
||trackingit.site^

! https://github.com/uBlockOrigin/uAssets/issues/18366
! my analysis: https://app.any.run/tasks/cf36d3ac-bedd-4cb9-bc9f-ac389b769d20
||globaladblocker.info^
! my analysis: https://app.any.run/tasks/7696196c-7c36-4dcc-aace-cb09f14b6685
||ourcommonwords.com^
||supapush.net^

! https://github.com/uBlockOrigin/uAssets/issues/18375
! nsfw: https://app.any.run/tasks/e3da5e5e-8b6d-4a7f-8165-6439ff68d940
||www.fulltimesecurityguard.com^
||fulltimesecurityguard.com^
||tepirg.xyz^

! https://github.com/uBlockOrigin/uAssets/issues/18380
||lgpc.bestextensionegde.com^
||bestextensionegde.com^
! nsfw: https://app.any.run/tasks/49927d07-3f8e-4115-a6e3-476e6aec62c0
||onevenadvnow.com^
||nodritsissub.com^

! https://github.com/uBlockOrigin/uAssets/pull/18388
||roundyearfun.org^
||anyplacehere.me^
||funaroundy.click^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/594269
! my analysis: https://tria.ge/230604-x8gtcadd85/behavioral1
||darkskin.world^

! https://tria.ge/230605-nfg4zagb63/behavioral2
||errors.pro^
||donwloadkeepet.buzz^
||stucktimeoutvexed.com^
||sembilme.com^

! https://forums.malwarebytes.com/topic/298628-specific-adwarephishing-attack-whats-the-source/
||axufcs.space^

! https://github.com/hagezi/dns-blocklists/issues/718
||leverage-btc.com^

! https://www.malwarebytes.com/blog/threat-intelligence/2023/06/thousands-of-malicious-google-cloud-run-instances-deployed-to-scam-facebook-users
||trendingentertainers.com^
||trendingfilmreviews.com^
||trendingshowbiz.com^
||trendingtvshows.com^
||usunveiled.net^
||viralcelebrityzone.com^
||viralfamezone.com^
||virallaughtrack.com^
||viralstargossip.com^
||viralfunnylaugh.com^

! https://www.youtube.com/watch?v=3Vy2l1kv7Cc
||sirisangabofoundation.org^

! https://github.com/DandelionSprout/adfilt/discussions/779#discussioncomment-6141190
||SEXUS.ML^
||c.dateperfectly.top^
||dateperfectly.top^

! https://github.com/uBlockOrigin/uAssets/issues/18452
||geminifond.com^

! https://virustotal.com/gui/url/7df0f1873fb746b2eb98a9fc8245000222a31db82506d9988adc83f145c80b3a
! my analysis: https://app.any.run/tasks/eb63e697-9df1-425a-814d-5e23858c146f
||gvcyk.mobiledir.us^
||umbrellacorporation.id^
||push-gabjbib-9138.boustahe.com^
||memesfunny.org^
||dudialgator.com^
||coustaushaw.com^

! https://dnstwist.it/ for slack.com
! https://app.any.run/tasks/14cafa37-652e-47dc-b08f-39843f7ef022
||slackk.com^
||galotop1.com^

! https://github.com/uBlockOrigin/uAssets/issues/18527
||together.com^
||maturedating.com^

! https://github.com/uBlockOrigin/uAssets/issues/18537
! https://tria.ge/230617-ar39pahb3w/behavioral2
||whaujimisurvey.top^
||eehuzaih.com^
! https://tria.ge/230617-ar39pahb3w/behavioral3
||toodownload.com^
||subscribe-notifications.com^
||user0.subscribe-notifications.com^
||user1.subscribe-notifications.com^

! clicked on an ad: https://tria.ge/230617-m6144abb3z/behavioral2
||yourstented.azurewebsites.net^

! https://github.com/hagezi/dns-blocklists/issues/1193
||coinaps.com^

! https://www.bleepingcomputer.com/forums/t/786537/mcafee-popup/
||www.mistiotia.com^

! https://virustotal.com/gui/url/73d9ff9f34da3e716e5b549746d789655bb42bfaadbdeaf13d70cae63768f8cb/community
! my analysis: https://app.any.run/tasks/f5abc08a-802f-4560-9ae2-ee107fee1a2b
||winkcap.net^

! https://tria.ge/230624-phdd8scc7t/behavioral1
||discordnitro.live^
||www.discordnitro.live^
||rapidownload.online^
||qoaaa.com^
||d.rapidownload.online^

! https://tria.ge/230624-pw6ypsbc94/behavioral1
||freevbucks2022.online^
||letmimy.com^

! https://tria.ge/230624-p3xcvabd24/behavioral2
! https://www.hybrid-analysis.com/sample/9cdcea08ed2d28f0618a032fdcac2a0f070020035d54d0e63ae3b90ba9a8cfa3
||ufile.io/p4nduixt^
! unrelated malware ads on the download link
! https://app.any.run/tasks/426cbd81-f441-436c-b227-15224316ce4b
||ereallywasnoth.com^
||czpcc.nereherewetem.info^
! https://tria.ge/230624-pzryysbc98/behavioral1
||free.premiumworldapp.com^
||chromnius.com^
||www.chromnius.com^

! https://github.com/DandelionSprout/adfilt/discussions/779#discussioncomment-6298369
||anglebank.space^
! https://tria.ge/230701-q2qdksgh48/behavioral1
||crummygoddess.com^

! https://github.com/uBlockOrigin/uAssets/pull/18736
||funtwitter.games^
||twitter-circle.com^

! https://github.com/uBlockOrigin/uAssets/issues/18664
||family-simulators.io^
||familyfornicate.com^

! https://github.com/blocklistproject/Lists/issues/1015
||bigosext9s.com^

! musk-themed crypto scam
||muskday.org^

! popups
||xmegaxvideox.com^
||neeglashsurvey.top^

! https://github.com/MetaMask/eth-phishing-detect/pull/12959
||l0ktf.com^
||babydegods.com^

! https://github.com/hagezi/dns-blocklists/issues/1244
||soaplooparrowstereo.click^

! https://github.com/MetaMask/eth-phishing-detect/pull/12960
||apecoin.group^
||app.uniswap.cam^
||bbhjb.com^
||blur-nft.xyz^
||bridge-claim.xyz^
||claim-booster.xyz^
||claim-pepe-airdrop.xyz^
||claimairdrop.online^
||crypto-claims.io^
||dev851.d3710yoqrad6y3.amplifyapp.com^
||email-metamask.com^
||enter-uniswap.net^
||get-uniswap.org^
||join-whatisthissorcery.com^
||lensprotocols-claim.com^
||live-update-security.com^
||loyaldrops.life^
||metamaskdrop.fun^
||metamasks.best^
||newsletter-metamask.com^
||nft-free.store^
||notify-metamask.com^
||psydex.gl^
||register-ether.com^
||whitelist-ether.site^

! https://github.com/MetaMask/eth-phishing-detect/pull/12983
||rabbit.claims^

! https://github.com/hagezi/dns-blocklists/issues/1255
||beze.co^
||laro.co^
||haso.co^
||fessy.co^
||zatte.co^
||lanno.co^
||detty.co^
||durro.co^

! https://tria.ge/230708-zw13kaab69/behavioral2
||rightsapphiresand.info^
||aonforhaving.info^
||download7locked.com^
||install-check.com^
||zz6av.top^
||ptrmx.top^
||p5s12.top^
||pnw9r.top^
! stuff from a VM
||kn3vp.top^
||eyq2w.top^
||edsn6.top^
||c8pjg.top^
||kwptr.top^
||ese04.top^
||uldmakefeagre.com^
||ourmarketingefi.info^
||goph.club^
||ebutiseemedlikea.com.ua^
||alargeredrubygsw.info^
! https://app.any.run/tasks/561c592f-07c8-4954-95c7-1201da83e2f5
||dacins.xyz^

! https://github.com/hagezi/dns-blocklists/issues/1266
||zat.io^

! https://github.com/durablenapkin/scamblocklist/issues/57
||navi0.com^
||navi1.com^
||navi2.com^
||navi3.com^
||navi4.com^
||navi5.com^
||navi6.com^
||navi7.com^
||navi8.com^
||navi9.com^
||navi10.com^
||navi11.com^
||navi12.com^
||navi13.com^
||navi14.com^
||navi15.com^
||navi16.com^
||navi17.com^
||navi18.com^
||navi19.com^
||navi20.com^
||navi21.com^
||navi22.com^
||navi23.com^
||navi24.com^
||navi25.com^
||navi26.com^
||navi27.com^
||navi28.com^
||navi29.com^
||navi30.com^
||navi31.com^
||navi32.com^
||navi33.com^
||navi34.com^
||navi35.com^
||navi36.com^
||navi37.com^
||navi38.com^
||navi39.com^
||navi40.com^
||navi41.com^
||navi42.com^
||navi43.com^
||navi44.com^
||navi45.com^
||navi46.com^
||navi47.com^
||navi48.com^
||navi49.com^
||navi50.com^
||navi51.com^
||navi52.com^
||navi53.com^
||navi54.com^
||navi55.com^
||navi56.com^
||navi57.com^
||navi58.com^
||navi59.com^
||navi60.com^
||navi61.com^
||navi62.com^
||navi63.com^
||navi64.com^
||navi65.com^
||navi66.com^
||navi67.com^
||navi68.com^
||navi69.com^
||navi70.com^
||navi71.com^
||navi72.com^
||navi73.com^
||navi74.com^
||navi75.com^
||navi76.com^
||navi77.com^
||navi78.com^
||navi79.com^
||navi80.com^
||navi81.com^
||navi82.com^
||navi83.com^
||navi84.com^
||navi85.com^
||navi86.com^
||navi87.com^
||navi88.com^
||navi89.com^
||navi90.com^
||navi91.com^
||navi92.com^
||navi93.com^
||navi94.com^
||navi95.com^
||navi96.com^
||navi97.com^
||navi98.com^
||navi99.com^
||navi100.com^
||faze0.com^
||faze1.com^
||faze2.com^
||faze3.com^
||faze4.com^
||faze5.com^
||faze6.com^
||faze7.com^
||faze8.com^
||faze9.com^
||faze10.com^
||faze11.com^
||faze12.com^
||faze13.com^
||faze14.com^
||faze15.com^
||faze16.com^
||faze17.com^
||faze18.com^
||faze19.com^
||faze20.com^
||faze21.com^
||faze22.com^
||faze23.com^
||faze24.com^
||faze25.com^
||faze26.com^
||faze27.com^
||faze28.com^
||faze29.com^
||faze30.com^
||faze31.com^
||faze32.com^
||faze33.com^
||faze34.com^
||faze35.com^
||faze36.com^
||faze37.com^
||faze38.com^
||faze39.com^
||faze40.com^
||faze41.com^
||faze42.com^
||faze43.com^
||faze44.com^
||faze45.com^
||faze46.com^
||faze47.com^
||faze48.com^
||faze49.com^
||faze50.com^
||faze51.com^
||faze52.com^
||faze53.com^
||faze54.com^
||faze55.com^
||faze56.com^
||faze57.com^
||faze58.com^
||faze59.com^
||faze60.com^
||faze61.com^
||faze62.com^
||faze63.com^
||faze64.com^
||faze65.com^
||faze66.com^
||faze67.com^
||faze68.com^
||faze69.com^
||faze70.com^
||faze71.com^
||faze72.com^
||faze73.com^
||faze74.com^
||faze75.com^
||faze76.com^
||faze77.com^
||faze78.com^
||faze79.com^
||faze80.com^
||faze81.com^
||faze82.com^
||faze83.com^
||faze84.com^
||faze85.com^
||faze86.com^
||faze87.com^
||faze88.com^
||faze89.com^
||faze90.com^
||faze91.com^
||faze92.com^
||faze93.com^
||faze94.com^
||faze95.com^
||faze96.com^
||faze97.com^
||faze98.com^
||faze99.com^
||faze100.com^
||navi0.ru^
||navi1.ru^
||navi2.ru^
||navi3.ru^
||navi4.ru^
||navi5.ru^
||navi6.ru^
||navi7.ru^
||navi8.ru^
||navi9.ru^
||navi10.ru^
||navi11.ru^
||navi12.ru^
||navi13.ru^
||navi14.ru^
||navi15.ru^
||navi16.ru^
||navi17.ru^
||navi18.ru^
||navi19.ru^
||navi20.ru^
||navi21.ru^
||navi22.ru^
||navi23.ru^
||navi24.ru^
||navi25.ru^
||navi26.ru^
||navi27.ru^
||navi28.ru^
||navi29.ru^
||navi30.ru^
||navi31.ru^
||navi32.ru^
||navi33.ru^
||navi34.ru^
||navi35.ru^
||navi36.ru^
||navi37.ru^
||navi38.ru^
||navi39.ru^
||navi40.ru^
||navi41.ru^
||navi42.ru^
||navi43.ru^
||navi44.ru^
||navi45.ru^
||navi46.ru^
||navi47.ru^
||navi48.ru^
||navi49.ru^
||navi50.ru^
||navi51.ru^
||navi52.ru^
||navi53.ru^
||navi54.ru^
||navi55.ru^
||navi56.ru^
||navi57.ru^
||navi58.ru^
||navi59.ru^
||navi60.ru^
||navi61.ru^
||navi62.ru^
||navi63.ru^
||navi64.ru^
||navi65.ru^
||navi66.ru^
||navi67.ru^
||navi68.ru^
||navi69.ru^
||navi70.ru^
||navi71.ru^
||navi72.ru^
||navi73.ru^
||navi74.ru^
||navi75.ru^
||navi76.ru^
||navi77.ru^
||navi78.ru^
||navi79.ru^
||navi80.ru^
||navi81.ru^
||navi82.ru^
||navi83.ru^
||navi84.ru^
||navi85.ru^
||navi86.ru^
||navi87.ru^
||navi88.ru^
||navi89.ru^
||navi90.ru^
||navi91.ru^
||navi92.ru^
||navi93.ru^
||navi94.ru^
||navi95.ru^
||navi96.ru^
||navi97.ru^
||navi98.ru^
||navi99.ru^
||navi100.ru^
||nip0.com^
||nip1.com^
||nip2.com^
||nip3.com^
||nip4.com^
||nip5.com^
||nip6.com^
||nip7.com^
||nip8.com^
||nip9.com^
||nip10.com^
||nip11.com^
||nip12.com^
||nip13.com^
||nip14.com^
||nip15.com^
||nip16.com^
||nip17.com^
||nip18.com^
||nip19.com^
||nip20.com^
||nip21.com^
||nip22.com^
||nip23.com^
||nip24.com^
||nip25.com^
||nip26.com^
||nip27.com^
||nip28.com^
||nip29.com^
||nip30.com^
||nip31.com^
||nip32.com^
||nip33.com^
||nip34.com^
||nip35.com^
||nip36.com^
||nip37.com^
||nip38.com^
||nip39.com^
||nip40.com^
||nip41.com^
||nip42.com^
||nip43.com^
||nip44.com^
||nip45.com^
||nip46.com^
||nip47.com^
||nip48.com^
||nip49.com^
||nip50.com^
||nip51.com^
||nip52.com^
||nip53.com^
||nip54.com^
||nip55.com^
||nip56.com^
||nip57.com^
||nip58.com^
||nip59.com^
||nip60.com^
||nip61.com^
||nip62.com^
||nip63.com^
||nip64.com^
||nip65.com^
||nip66.com^
||nip67.com^
||nip68.com^
||nip69.com^
||nip70.com^
||nip71.com^
||nip72.com^
||nip73.com^
||nip74.com^
||nip75.com^
||nip76.com^
||nip77.com^
||nip78.com^
||nip79.com^
||nip80.com^
||nip81.com^
||nip82.com^
||nip83.com^
||nip84.com^
||nip85.com^
||nip86.com^
||nip87.com^
||nip88.com^
||nip89.com^
||nip90.com^
||nip91.com^
||nip92.com^
||nip93.com^
||nip94.com^
||nip95.com^
||nip96.com^
||nip97.com^
||nip98.com^
||nip99.com^
||nip100.com^

! https://github.com/hagezi/dns-blocklists/issues/1310
||bcb.game^

! scam? notification spam & weird pharmaceutical ads
||us-trendingtoday.com^

! https://tria.ge/230718-vydmtscf83/behavioral1
||truebuyerreview.com^
||areyourealhuman.com^
||cdn.areyourealhuman.com^

! not my analysis: https://app.any.run/tasks/5bc3d455-486d-4d74-9cae-557eeaf69f27/
! my analysis: https://app.any.run/tasks/fc24d271-a114-4c43-b99b-8bf8e9f6c704
||eu.gtrxlnd7.com^
||gtrxlnd7.com^

! https://github.com/durablenapkin/scamblocklist/issues/58
! https://github.com/hagezi/dns-blocklists/issues/1330
||hotdebrid.com^
||debridlink.com^
||maxdebrid.com^
! https://github.com/hagezi/dns-blocklists/issues/409
||anydebrid.com^

! https://tria.ge/230720-3qya9sbh2t/behavioral2
||performintenselydevelopedinfo-product.info^

! https://tria.ge/230721-yjxzpsgg84/behavioral1
||qk0im.top^

! https://github.com/durablenapkin/scamblocklist/issues/59
! https://github.com/hagezi/dns-blocklists/issues/1335
||primeleech.com^
||www.primeleech.com^

! https://app.any.run/tasks/cc0dd977-97e3-4b4a-833b-dfc4d5f0be55/
||ak.deephicy.net^$popup
||qr-captcha.com^
||haffnetworkmm.com^
||cdn4.haffnetworkmm.com^
||im2easy.site^
||downlon.com^

! https://tria.ge/230724-z8hfzsha64/behavioral1
||zubajuroo.com^
||singlewomenmeet.com^
||only2date.online^
||amnotification.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/646177
||desbiens123.net^
||sex-dating.qbig.site^
! https://0xacab.org/my-privacy-dns/matrix/-/issues/646175
||anesthesia2000.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/646174
||balladoron.life^
||avprotect.store^
||www.pioxe.live^
||pioxe.live^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/646168
||86ff56b6d5.com^
||030e9b0efb.47aead8f05.com^
||47aead8f05.com^$3p
||systemoon.co.in^
||moontrck.xyz^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/644873
||donemileliondol.info^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/644871
||inarilyhukel.info^

! https://forums.malwarebytes.com/topic/300664-malwarebytes-premium-subscription-fails-to-detect-infection/
||prizehub.top^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/646602
||antiques-spb.ru^

! https://tria.ge/230729-a8fjysba31/behavioral1
||vcyx4.top^
||hfe0t.top^
||ambrs.online^
||www.ambrs.online^

! infected system
||dojtxl6jydd7s.cloudfront.net/*/*/indexp.html
||jokekroako.com^
||gokend.xyz^
||push-ebfhafd-7996.boustahe.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/646845
||pacosystem.es^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/646600
||74les.ru^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/646179
||zaffirosas.it^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/646173
||alimentasegovia.es^

! https://github.com/durablenapkin/scamblocklist/issues/60
||upstrick.com^

! fake robux generator
||waratlas.org^
||cpabuild.com^
! https://tria.ge/230731-x1nlxsae69/behavioral2
||94.142.138.131^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/647492
||krasnaya-talka-sanatoriy-gelendzhik.ru^
||p9a3g5g2.stackpathcdn.com^

! https://tria.ge/230731-w9769aad25/behavioral2
||fixextremelyoriginalinfo-product.info^
||dfxtg.top^
||d7s62.top^
||dlvur.top^
||dcnhx.top^
||ops7s.top^
! https://tria.ge/230731-w9769aad25/behavioral1
||downloadelz.website^
||downloadelz.buzz^
! https://tria.ge/230731-3n8n8abh28/behavioral2
||downloadfilekee.lol^

! anonfiles ads
||browser-app.co^$popup
||golend.xyz^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/647478
||seduction-simple.fr^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/649522
! https://tria.ge/230802-vtcjzaga38/behavioral1
||farmrrlendsee.ru^
||mokha.top^
||voecf.top^
||a7afn.top^
||zn4hk.top^
||t0hgf.top^
||kuq2s.top^
||o8he3.top^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/649521
! https://tria.ge/230802-v5brtahd4w/behavioral1
||expressionsvegetales.fr^
||kfl86.top^
||aroyf.top^
||aord3.top^

! https://www.bleepingcomputer.com/news/security/fake-flipperzero-sites-promise-free-devices-after-completing-offer/
||flipperzero.at^
||trkrspace.com^

! anonfiles ads
||kncecafvdeuk.info^
||karbe.live^
||downloadpeso.space^
||rewovucikaf.shop^
||outhjkm.ezasutuduwife.online^
||wtfgep.xyz^

! https://forums.malwarebytes.com/topic/300873-i-keep-getting-pop-ups-from-eudmailcom/
||eudmail.com^

! crypto scams
||musk-x.org^
||give2x.net^
! https://tria.ge/230804-15hs1sfh6t/behavioral1
||2xtesla.net^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/649649
! https://tria.ge/230805-rb1bjaee3x/behavioral1
||master2gppp-assas.fr^
||12f01e3591.com^
||1472f9a583.12f01e3591.com^
||thewinjackpot.life^
||us.secureonlineinternet.com^
||secureonlineinternet.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/649556
! https://tria.ge/230805-rk4qbadb96/behavioral1
||gavihuginn.best^
||dtc5a.top^
||8a4uj.top^
||lytf0.top^
||w2kp0.top^
||7xxqg.top^
||e7vld.top^
||82vor.top^
||j42za.top^
||w3cxi.top^
||imgot.info^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/649306
! https://tria.ge/230805-s3g5psdd99/behavioral1
||eternitonline.it^

! https://github.com/uBlockOrigin/uAssets/issues/19271
! https://tria.ge/230805-1pnz4agc7w/behavioral1
||wbilvnmool.com^$popup
||metriumoldeb.com^
||www.metriumoldeb.com^
||hyjecr.metriumoldeb.com^
||fjvv2i.metriumoldeb.com^
||581358.metriumoldeb.com^
||theod-omq.com^
||goatmod.xyz^
||mkhvuv.metriumoldeb.com^
! https://tria.ge/231022-p48ghaab87/behavioral1
||qyt8pi.metriumoldeb.com^
||vjr2ws.metriumoldeb.com^
||propolixte.com^
||quinc-rdk.com^
||burbolore.xyz^
||12ezo5v60.com^
||2ntrfi.metriumoldeb.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/649771
! https://tria.ge/230806-v2fatsbc57/behavioral1
||sex-girls.khayyamfestival.com^

! https://github.com/easylist/easylist/pull/16955
! https://tria.ge/230806-xd58fsdc4t/behavioral1
||lands.ninja^
||6.lands.ninja^
||19.lands.ninja^

! https://web.archive.org/web/20230806191228/https://spamlogger.com/t/congrats-claim-your-500-walmart-gift-card/295
! https://tria.ge/230806-xteenscb23/behavioral1
||usadailysweepswinners.com^

! https://github.com/durablenapkin/scamblocklist/issues/61
! https://github.com/hagezi/dns-blocklists/issues/1390
||okdebrid.com^
||youdebrid.com^

! https://github.com/uBlockOrigin/uAssets/issues/19316
! https://tria.ge/230810-zq62maag9y/behavioral1
||graduatedgroan.com^
||oudguide.com^
||uidhealth.com^
||repairmostspeedyinfo-product.info^

! https://tria.ge/230810-zzlr2sah5y/behavioral1
||popgoldblocker.info^
||adblockology.net^
||download-adblock-zen.com^
||blockadsology.net^

! https://github.com/hagezi/dns-blocklists/issues/1411
||lido-pass.org^

! https://web.archive.org/web/20230813181452/https://www.bleepingcomputer.com/news/security/uk-gov-keeps-repeating-its-voter-registration-website-is-not-a-scam/
||householdresponses.com^

! https://infosec.exchange/@briankrebs/110889813735728083
||equity-invest.ch^
||diligere.co.uk^

! https://github.com/MetaMask/eth-phishing-detect/pull/13289
||optimismtokens-drop.com^
||optimisim.io^
! https://tria.ge/230815-nlmlmsad73/behavioral1
||arkhaminteiligence.com^

! https://github.com/MetaMask/eth-phishing-detect/pull/13300
! https://github.com/MetaMask/eth-phishing-detect/issues/13297
! https://tria.ge/230815-2pl16sdg78/behavioral1
||ceramic.gift^

! https://github.com/hagezi/dns-blocklists/issues/1440
! https://tria.ge/230817-nq2alaha63/behavioral1
||seasonsofficial.com^

! https://tria.ge/230817-127yqsdh56/behavioral1
||investmusk.org^

! https://github.com/uBlockOrigin/uAssets/issues/19400
! https://tria.ge/230819-nzqkfshe69/behavioral1
||adblocko-supremo.info^
||video-adblocker.pro^

! https://github.com/hagezi/dns-blocklists/issues/1452
||huuskmesser.de^
||huusk-original.com^

! https://www.malwarebytes.com/blog/threat-intelligence/2023/08/wooflocker2
||api.cloudcachestels.com^
||api.cloudseedzedo.com^
||api.imagecloudsedo.com^
||appcloudzedo.com^
||cdn.contentob.com^
||cdncontentstorage.com^
||cdnpictureasset.com^
||cloudcusersyn.com^
||cloudgertopage.com^
||cloudlogobox.com^
||csscloudstorage.com^
||datacloudasset.com^
||logosvault.com^
||miniassetcloud.com^
||furakelw.com^
||gopilofan.com^
||zemolist.com^
||besoliza.com^
||vedopixt.com^
||defolis.com^
||somawan.com^
||vulidoc.com^
||barustan.com^
||semilupa.com^
||bopiland.com^
||somalics.com^
||sebasong.com^
||molesanu.com^
||xepilondi.com^
||malubana.com^
||beeronas.com^
||lobosixt.com^
||gomoyad.com^

! https://github.com/hagezi/dns-blocklists/issues/1458
||software19797.blogspot.com^

! https://github.com/hagezi/dns-blocklists/issues/1457
||cutty.app^

! https://github.com/hagezi/dns-blocklists/issues/1455
||wintexfashions.com^

! https://github.com/AdguardTeam/AdguardFilters/issues/159825
||i7kctkutdv2c.top^
||confirm.i7kctkutdv2c.top^
! https://github.com/AdguardTeam/AdguardFilters/issues/159825#issuecomment-1688865198 (credit to dandelionsprout)
||topmoneysurvey.com^
||better-than-tinder.com^
||auvx0i9jzsmi.top^
||awarded-best-vpn.com^
||b4o464st12fk.top^
||b53guzrig84y.top^
||b5vrahtel7sz.top^
||b6xw28ref78r.top^
||best-finance-now.com^
||best-global-apps.com^
||best-hornygirls.com^
||best-official-app.com^
||best-smart-utility.com^
||big-players-club.com^
||big-prizes-site.com^
||big-winnings-spot.com^
||bj99j2au62mm.top^
||btz6uvyfth1d.top^
||bustygirls-online.com^
||by3rw1xh7j6c.top^
||c1r084b6amzz.top^
||c4avwh304gt4.top^
||c6q95rn6j9un.top^
||c8edreiad0nz.top^
||c9nd4gwexaqc.top^
||campwredir.com^
||cehv8gvifhdr.com^
||check-you-device.com^
||chikasinapp.com^
||chualtc2ooie.top^
||cleanpwredir.com^
||cq33llquanhe.top^
||cqm8eg25pw9a.top^
||crazy-win-casino.com^
||cute-wet-babes.com^
||protect-your-phone.com^
||cz66d6c46u7r.top^
||d18u76n9gm98.top^
||d3qav78466c8.top^
||d635s2tbrx2h.top^
||datingpwredir.com^
||dfalfqeqgg22.top^
||dfva60q60acj.top^
||djav8bsp6w6t.top^
||dojyosxipcl9.top^
||dqtt6bkligui.top^
||dreamy-flirt.com^
||ds7w28f1zprz.top^
||dseqcfjne407.top^
||dulxwhqlq2de.top^
||e0pxjz8hh09v.top^
||e3ddj615svxo.top^
||e998mnvdywj6.top^
||e9dzfcnhd11g.top^
||easy-sex-dates.com^
||elq4xg6r2l3w.top^
||erxhbjelx5wv.top^
||eyd4fuc314z7.top^
||f0h509sczmhx.top^
||f1y4q5hm61tv.top^
||f3jxoio03eoe.top^
||f3tc0tyv7ci6.top^
||f90ggj5hvn2r.top^
||fa82zddqmzm2.top^
||fast-growing-app.com^
||fdlqehgguzrd.top^
||fi1qdfk30jwj.top^
||findyourlovesurvey.com^
||fjszwbb85d5o.top^
||fjvlj6v0au7i.top^
||fn0l242jyxkc.top^
||fnhkkel7y3og.top^
||fpz5zj8fn7zv.top^
||free-gifts-onweb.com^
||freebies-take.com^
||fs47vp8old0i.top^
||your-lucky-day.com^
||fuynmttcsohb.top^
||fxu8v4c6mq80.top^
||g2orkb3o40am.top^
||g3k7k37yxjn9.top^
||g534zx7dcasn.top^
||g61daidk439w.top^
||g6xj5yz5wmqv.top^
||g88nlluqxm2m.top^
||g8ik1wf8hi07.top^
||gambpwredir.com^
||gbfnq4g9fhu2.top^
||ggs24fwvaukc.top^
||girls-wants-you.com^
||giveaway-site.com^
||global-app-center.com^
||global-casino-gaming.com^
||gn72tksywb76.top^
||grab-your-money.com^
||gvsi0omsal46.top^
||h1almpsi2013.top^
||h5fxr7ftv7pf.top^
||hadglb7m3jcd.top^
||hd-video-app.com^
||hgbus5retewp.top^
||high-safety-vpn.com^
||hnlw731jqnxp.top^
||horny-neighbour.com^
||hornygirls-onsite.com^
||hornygirlsinapp.com^
||jump-path1.com^
||jump-path2.com^
||redirect-path1.com^
||redirect-path2.com^
||your-online-casino.com^
||hot-girls-around.com^
||hot-pretty-chiks.com^
||hotgirls-around.com^
||how2-become-rich.com^
||hrb30t7c8e0a.top^
||i1q5vfi8w133.top^
||ia2vhygm6fhd.top^
||ifnerenuy32r.top^
||ihvnba9vmh8o.top^
||ii11bbtdf6x0.top^
||ijvicnl9bpru.top^
||indiastream-online.com^
||io49xk3p5p03.top^
||ioxpykszrnda.top^
||irke75qsfkkz.top^
||izk4e35wv8dk.top^
||j1i9weeo2iuo.top^
||j5kokm8bugi1.top^
||javo66gjugr3.top^
||jjsv5goj592a.top^
||jkphv2jsv3ae.top^
||jktcxsfocwm3.top^
||jqyaoe9exubp.top^
||jrl1mj4ab9fm.top^
||js75z0ed6w9t.top^
||juicy-girls-online.com^
||k16af481n0r5.top^
||k3q8yr6p2dvw.top^
||k3r2gowkwuec.top^
||k50pc890tcit.top^
||k7urx21wxrmc.top^
||k8osvhfhm1i7.top^
||kjkiw78ywhvd.top^
||kp75aqithfwt.top^
||kpsvaqnplbq6.top^
||ksr85kcp76k7.top^
||kv5w1ykfk7pm.top^
||kzo6gw8lrw5h.top^
||l0wtzhzx78mw.top^
||l3u51wrm0wkp.top^
||l531z4rzynwq.top^
||l5972t2ufg6l.top^
||l5ibnmd3hris.top^
||l6gh6kg5ykj6.top^
||lch05jsym6a3.top^
||ler2czkh3sv6.top^
||loadingscripts.com^
||love-connectors.com^
||love-territory.com^
||m5zv7tqw0zc7.top^
||maa4ypb079ac.top^
||wheel-of-luck.com^
||mfy486imctot.top^
||mighuuh535pb.top^
||millionaires-secret-site.com^
||mobile-safe-app.com^
||moi1qwhcp7ns.top^
||most-advanced-vpn.com^
||mt2dpmyjzblr.top^
||mu7cmiqx2j20.top^
||my-casino-now.com^
||myma26oprpyz.top^
||mzgc65xkzojz.top^
||na7gykiq187e.top^
||ndj2qgw4afca.top^
||nfwak0enmo0z.top^
||nice-babes-nearby.com^
||nif9frxst27s.top^
||nkfglk0y6r97.top^
||nktlucgpgr7k.top^
||nmfc4k7q4xd2.top^
||nor-pw1.com^
||nor-pw10.com^
||nor-pw11main.com^
||nor-pw12.com^
||nor-pw13.com^
||nor-pw14.com^
||nor-pw15.com^
||nor-pw2.com^
||nor-pw3main.com^
||nor-pw4ad.com^
||nor-pw5.com^
||nor-pw6.com^
||nor-pw7.com^
||nor-pw8.com^
||nor-pw9.com^
||nqezbpv8tzda.top^
||techbytemedia.com^
||ntkb6sddoue1.top^
||nul0szte3l2n.top^
||nvl9nerngpj1.top^
||nz7mhg8micbu.top^
||nz7tn4n5e5vi.top^
||o0m4rp8sjb0g.top^
||o0nerfcw0vsd.top^
||o3kjm9z8g11w.top^
||o3oy5wfla2ez.top^
||o863tmto6ocp.com^
||oc4sjn8ziyt3.top^
||official-video-app.com^
||oj0in172pri5.com^
||online-survey-service.com^
||only-sexy-girls.com^
||oob31oj5tzxz.top^
||oq1lbcapx74f.top^
||oq3vmyauvr0s.top^
||ovajdavqp5px.top^
||ozz7d9lh1n0s.top^
||p2p9zptnpwsq.top^
||p2r2usll1jrq.top^
||p7cd8i0oi8yw.top^
||pd96ptzsjeiv.top^
||perfectbabe4you.com^
||phyn4fpu3sy2.com^
||piit9web0uza.top^
||pjtilt02qs44.top^
||pkm3d2b07do0.top^
||pp0f5ahdp0ao.top^
||pretty-girls-nearby.com^
||privacy-focused-vpn.com^
||prize-collecting-site.com^
||pw-content.com^
||pw-download.com^
||pw-red-ad.com^
||pw-red-main.com^
||pw-red-test.com^
||pw-show-ad.com^
||pw-show-main.com^
||pw-show-test.com^
||pw1waj4wyf35.top^
||pwredir-1.com^
||pwredir-2.com^
||pwredir-3.com^
||pwredir-4.com^
||pwredir-5.com^
||q1icwkripe66.top^
||q3qez4o6axco.top^
||q4rz1bidmknx.top^
||q77r1hu4ybbm.top^
||qmwzaj6opdwn.top^
||qql0iokfr3ha.top^
||qr68f2t20df4.top^
||qvu377cbhhgu.top^
||qxaq9fds4onc.top^
||qxmlg5slb5kl.top^
||qxw6m8aewx0t.top^
||qztkmf1wdo9o.top^
||r3i0a261odm9.top^
||r7ofjdfw6jlk.top^
||ra35m91dc5t6.top^
||rbq9xbepwikk.top^
||rduo2c5e0wbk.top^
||real-hot-profiles.com^
||real-hotbabes.com^
||redir-pw1.com^
||redir-pw10.com^
||redir-pw11.com^
||redir-pw12.com^
||redir-pw13.com^
||redir-pw14.com^
||redir-pw15.com^
||redir-pw2.com^
||redir-pw3main.com^
||redir-pw4ad.com^
||redir-pw5.com^
||redir-pw6.com^
||redir-pw7.com^
||redir-pw8.com^
||redir-pw9.com^
||rich-people-club.com^
||rjlzoo56cbe3.top^
||rl4unur8zam4.top^
||rl8m72ekh2gw.top^
||rpl4c8gqjjvo.top^
||rqe3sng1a868.top^
||rrusb9gs6glf.top^
||rtf3tgamk80d.top^
||ruvwsy8huein.top^
||s2lxwwc6of80.top^
||s45g8tyen11f.top^
||s6kdj237hbeq.top^
||s6n946mpdglq.top^
||sc9fa36nemke.top^
||scf2wlakwrx4.top^
||search-top-videos.com^
||secret-casino-site.com^
||secured-browsing-app.com^
||secured-connect-app.com^
||shoppwredir.com^
||sid53j82a1az.top^
||sivt0uo3es6m.top^
||siwuowtsokbp.top^
||sk2wb60ksmby.top^
||smso3ojywl3d.top^
||som9lrmw0unu.top^
||stay-secured-online.com^
||stay-virus-free.com^
||strip-hotbabes.com^
||super-protection-app.com^
||sv3kausmasgz.top^
||sweet-alone-girls.com^
||t0anbvx61s12.top^
||t2eke74qawse.top^
||t35d60ot6oi7.top^
||tdtcrzpnp309.top^
||testpwredir.com^
||thdg8po3j9gu.top^
||three-hundred-bucks.com^
||tjpihtcs4oo4.top^
||tm44074rzbu9.top^
||tn1kzdbvbqxq.top^
||top-awarded-app.com^
||top-betting-now.com^
||top-cleaner-app.com^
||top-gambling-spot.com^
||top-mobile-scanner.com^
||top-safest-vpn.com^
||top-secure-app.com^
||top-store-app.com^
||top-trend-app.com^
||top-video-content.com^
||top-wealth-secrets.com^
||top-web-secure.com^
||topwebportals.com^
||tsl8sy9ptu2i.top^
||tuyzyhchca01.top^
||tvbj45bi37ef.top^
||tvcrqp3zqfkn.top^
||u01s8m85xab9.top^
||u284afs2eylf.top^
||u2s71o09ajg2.top^
||u59dbzvklesf.top^
||u9cd76h74g34.top^
||uiffp09naazq.top^
||um0qh3tdiosr.top^
||updar0twsq6q.top^
||ur9vc9turqw8.top^
||urzv6ih2xswt.top^
||users-choice-app.com^
||utipwredir.com^
||uvvpn5h92x2t.top^
||uz8avf38y2zw.top^
||v22nxrdx9ocd.top^
||v3ubcy23nuym.top^
||v5herke93uu7.top^
||v5wvs843f2pt.top^
||ves0kz2gk9b8.top^
||video-streaming-app.com^
||vlw86oaf5962.top^
||vpbxq51rppi1.top^
||vpeybsuirx7z.top^
||vpn-risk-free.com^
||vppwredir.com^
||vwpfcn5yhlsb.top^
||vz6miiowvo2t.top^
||w01cpyjvdzmt.top^
||w0y16anfv1jz.top^
||w1e39n8e20dw.top^
||w1r493omajx4.top^
||w2bij7b58m50.top^
||w2emkqnl3ss9.top^
||w6rpcnmyqcti.top^
||w78uqmbdgdkt.top^
||wbbc2emhybvk.top^
||web-protected-app.com^
||weizu3h4dvb9.top^
||wfkcsq63ivcm.top^
||win-big-here.com^
||winwin-raffle.com^
||your-finance-now.com^
||your-survey-services.com^
||185.246.188.124^
||185.246.188.125^
||194.63.140.103^
||194.63.143.61^
||194.63.143.96^

! https://github.com/durablenapkin/scamblocklist/issues/63
||summersale.online^

! https://github.com/hagezi/dns-blocklists/issues/1469
||crackedkey.org^

! https://github.com/hagezi/dns-blocklists/issues/1470
||mixcrack.net^

! https://github.com/hagezi/dns-blocklists/issues/1471
||kingsoftz.com^

! https://github.com/hagezi/dns-blocklists/issues/1476
||msm-coop.co.uk^

! https://forums.malwarebytes.com/topic/301587-adware-not-recognized-or-deleted/
||presonsinatize.com^

! https://tria.ge/230828-zyzbraga22/behavioral1
||push-ebfhafd-6311.boustahe.com^
||push-*.boustahe.com^
||nomadsfit.com^
||mackledcity.com^
||onebiensillc.com^
||wejds.co.in^
||1c6d7sl37a5xsd90.wejds.co.in^
||1c358sl37a69r073.wejds.co.in^
||apedodo8.fun^
||derytc.click^
! https://tria.ge/230913-mb6fbsdh42/behavioral1
||65432qn1mftejdb6.wejds.co.in^
||0f4a1qn1m3znt18d.wejds.co.in^
! subdomains: https://virustotal.com/gui/domain/wejds.co.in/relations
||cc7ccqn52c82t729.wejds.co.in^
||0478dqncifndu16f.wejds.co.in^
||d1140e8j6g6e8491.wejds.co.in^
||ca767e8159zho44f.wejds.co.in^
||ba209g6a8sysc965.wejds.co.in^
||b5761e8ho9zuq301.wejds.co.in^
||dcc42duzwg617bc1.wejds.co.in^
||62ca0e8xsgxfy621.wejds.co.in^
||9c65ee8q5u3tl707.wejds.co.in^
||03546g63vib7s1f8.wejds.co.in^
||eb3fdg6qe1zx9e5d.wejds.co.in^
||85799g65mm7qe22f.wejds.co.in^
||becdbdup2a44k5b8.wejds.co.in^
||09e7bdud5hqj24d8.wejds.co.in^
||433badu9rb415cfc.wejds.co.in^
||9b853dugmfy6j373.wejds.co.in^
||517dcx91nrnbzcbc.wejds.co.in^
||689basl7swffye9d.wejds.co.in^
||663169zdum7wf642.wejds.co.in^
||9977b9zsc8ra63d2.wejds.co.in^
||33ead9zu3gx8r71f.wejds.co.in^
||a1d189zqdtla3965.wejds.co.in^
||4066f15e87vpm4d2.wejds.co.in^
||a7fd8j2ikhooc399.wejds.co.in^
||53a45j21zgxbge68.wejds.co.in^
||eaaf2j2fnp2ira2b.wejds.co.in^
||0af0cj217a9fnb0b.wejds.co.in^
||daa5doctlcint073.wejds.co.in^
||3fb3coc4kci3zf4e.wejds.co.in^
||d5a1foca4qn8p231.wejds.co.in^
||6ae094pc8pmho817.wejds.co.in^
||fce824pydg5e8ae5.wejds.co.in^
||03b5f4pnt2tdua14.wejds.co.in^
||f72a04pu3a3us28d.wejds.co.in^
||3e20f4p2tftfy00a.wejds.co.in^
||9eb7cwhg69rsy719.wejds.co.in^
||f9a9cwh374k525bf.wejds.co.in^
||b5eaewhuotwqn39b.wejds.co.in^
||5e309whbz3vvc67c.wejds.co.in^
||babetluo4p8w7e5.wejds.co.in^
||30babktqdghj2cb3.wejds.co.in^
||06709ktcihe1n8da.wejds.co.in^
||c017ekt16g6x9c93.wejds.co.in^
||3b2a3ktgxtla029d.wejds.co.in^
||0f5e3kta6a03744c.wejds.co.in^
||e999bfya5ft7ve4e.wejds.co.in^
||74b7fxrhopmb4852.wejds.co.in^
||45da6ibib4me2698.wejds.co.in^
||5956dm7uquovc6ee.wejds.co.in^
||772c2ibc8a1ghf87.wejds.co.in^
||6753fiboja8uo167.wejds.co.in^
||0b31f3vft15us8a7.wejds.co.in^
||816fe3vy9sy4k2d6.wejds.co.in^
||64511uooca2tlb01.wejds.co.in^
||fda36uoqq9la4935.wejds.co.in^
||63df6uoe8g5b4f8e.wejds.co.in^
||e995fuo8pqebzcaf.wejds.co.in^
||d3708uousscgmb53.wejds.co.in^
||c67a6fv7sqn1n05f.wejds.co.in^
||1ce9dfvbgfnm734d.wejds.co.in^
||40974fv9ra0m7caa.wejds.co.in^
||518b5fva1m7sl3cc.wejds.co.in^
||fe850fvgxj6uq8cb.wejds.co.in^
||71703ik1mdva837c.wejds.co.in^
||4583eik1mxo17240.wejds.co.in^
||75644ik6jxoq57f3.wejds.co.in^
||2b533iklp8ptl1fc.wejds.co.in^
||ce518rn3vntg5b06.wejds.co.in^
||1d8f7rna3a615187.wejds.co.in^
||efe2a37e837kt1cb.wejds.co.in^
||0b97f37dve8ike1b.wejds.co.in^
||12d7137ira6oc683.wejds.co.in^
||5f351372tojus567.wejds.co.in^
||f863d46myh9u34a7.wejds.co.in^
||66afbx9ocsysy988.wejds.co.in^
||e932asy1za5527af.wejds.co.in^
||2ad3dx9us16a74ff.wejds.co.in^
||ae3baejg6qn46094.wejds.co.in^
||8aa48sy7vlp1me37.wejds.co.in^
||50ceaeja1a3a394d.wejds.co.in^
||ae8d1c8myxrqe931.wejds.co.in^
||c7524tla1ghej592.wejds.co.in^
||9b089c88rqej619d.wejds.co.in^
||4f07ftlqqbzib86f.wejds.co.in^
||9a0d1tl4kfvuq471.wejds.co.in^
||c3060p2g6a58w074.wejds.co.in^
||d2d79p29zk2usc88.wejds.co.in^
||c8ddap2b7uq4p35e.wejds.co.in^
||2174746467vb7e0a.wejds.co.in^
||996bc465m16my3f9.wejds.co.in^
||97e2d46a1myuo949.wejds.co.in^
||e3cca1m4pb4ft86b.wejds.co.in^
||5f3f81mx9pmdva73.wejds.co.in^
||da6d21mej46fv638.wejds.co.in^
||d9b191mfta5occec.wejds.co.in^
||37f031mlp3zik447.wejds.co.in^

! https://tria.ge/230830-l7yjxseb6z/behavioral1
||push-ebfhafd-5643.boustahe.com^
||succyarthyry.com^
||foldedabstinenceconsole.com^
||unkinerecle.com^
||shwomettleye.com^
||unbalterce.com^
||gougenoticei.com^
||sys.donecperficiam.net^
||ww3.keytrack.site^$popup
||nomadsbrand.com^

! https://tria.ge/230831-zcwzhaad59/behavioral1
||system-notify.app^$third-party
||aroidssolutions.com^
||thearoids.com^
||paladiact.com^
||onebiensicenter.com^
||pupspu.com^
||cramlexad.com^
||aug3120.rednewly.com^
||browsekeeper.com^

! https://github.com/hagezi/dns-blocklists/issues/1512
||daftar-binomo.website^
||online-binomo.com^
||binomo-id.pro^
||binomoindonesia.com^
||www.binomoweb.org^
||www.binomo.vip^
||binomoweblogin.com^
||binomo2022.net^
||www.binom0-web.com^
||binomorupiah-id.com^
||binomo.broker^
||binomo-brokers.com^

! https://github.com/durablenapkin/scamblocklist/issues/64
||coinreq.com^

! https://tria.ge/230909-m91mqsaf82/behavioral1
||uplevelrewards.com^
||www.uplevelrewards.com^
||liveappsearch.com^
||www.liveappsearch.com^
||oasoomsa.top^
||wholedailyjournal.com^
||fubsoupt.top^
||adblocked-supreme.net^

! https://forums.malwarebytes.com/topic/302090-virus-found-malware/
||guartian.co.in^

! https://tria.ge/230909-tghd1scd3y/behavioral1
||5hgawd5145.monster^
||another-seem.monster^
||ptbqre.com^
||datinghere-top.life^
||h.datingcentral.top^
||cuddleyadmire.com^
||mcaverify.click^
||www.mcaverify.click^

! https://github.com/StevenBlack/hosts/issues/2436
||w61.1piecemanga.com^
||fbet.com^
||onwardrespirationcommandment.com^
! my analysis: https://tria.ge/230910-pysh4ahb47/behavioral1
! my analysis: https://tria.ge/230910-py86vahb49/behavioral1
||stemboastfulrattle.com^
||odesbest.com^
||loadoverlylatestinfo-program.info^

! https://github.com/AdguardTeam/AdguardFilters/issues/161349
! https://tria.ge/230913-mb6fbsdh42/behavioral1
||rtmladweb.com^
||best-pc-protect.xyz^

! https://tria.ge/230914-mn75paeb34/behavioral1
||odessystems.com^
||saniceproxic.com^
||derryneeptedle.com^

! https://web.archive.org/web/20230918040019/https://www.bleepingcomputer.com/news/security/tiktok-flooded-by-elon-musk-cryptocurrency-giveaway-scams/
||bitoxies.com^
||moonexio.com^
||altgetxio.com^
||cratopex.com^

! https://tria.ge/231002-nhasnsbb63
||allsidesguide.com^
||realxavounow.com^
||sulkvulnerableexpecting.com^
||reenethoname.com^
||rhoramegarate.com^
||secondquaver.com^
||gentlynudegranny.com^
||ramlexdigital.com^

! https://github.com/hagezi/dns-blocklists/issues/1658
! my analysis: https://tria.ge/231004-p3e4kabg8t/behavioral1
||z-lib.is^
! https://www.reddit.com/r/zlibrary/comments/16xtm67/if_you_cannot_download_any_books_then_youre_on/
||zlib.is^
||zlib.to^
||zlibrary.to^
||zlibrary.is^
||z-lib.to^
||z-lib.io^

! https://github.com/hagezi/dns-blocklists/issues/1662
||bridgelinering.com^
||show.bridgelinering.com^
||go.bridgelinering.com^
||daynitroglass.com^

! https://tria.ge/231005-2c2abshf76/behavioral1
||2ntrfi.torixibre.com^
||invv7n.torixibre.com^
||rmut-glo.brandandgift.com/t/clk?id=$popup,third-party

! https://tria.ge/231005-2pvy3sff9v/behavioral1
||keyimaginarycomprise.com^
||loadoriginalintenselyinfo-program.info^

! https://github.com/hagezi/dns-blocklists/issues/1724
||healy.world^
||healyworld.net^
||healy.shop^

! https://tria.ge/231021-mvvg6sff95/behavioral1
||getforupgradeandstabilizefree.click^
||setupnow.getforupgradeandstabilizefree.click^
||downloads-101.com^
||mafens.xyz^

! https://infosec.exchange/@iampytest1/111270258079028453
||metachartview.com^
||metatradebox.net^

! https://github.com/hagezi/dns-blocklists/issues/1760
||adidassuomi-fi.com^
||alohasfinland.com^
||alohas-suomi.com^
||alohassuomi.com^
||altrafi.com^
||altrafinland.com^
||altrahelsinki.com^
||altrasuomi.com^
||altrasuomifi.com^
||altrasuomioutlet.com^
||altrasuomishop.com^
||arcteryxfi.com^
||arcteryxfinland.com^
||arcteryxoutletsuomi.com^
||arcteryxsuomiale.com^
||asicsale.com^
||asicsfi.com^
||asics-finland.com^
||asicsfinlandoutlets.com^
||asicsfi-suomi.com^
||asicshelsinki.com^
||asicshelsinki.net^
||asicsoutlet-suomi.com^
||asicsoutletsuomi.com^
||asics-suomi.com^
||asicssuomi.com^
||asicssuomioutlet.com^
||balmain-suomi.com^
||balmainsuomi.com^
||balmainsuomishop.com^
||canada-gymshark.com^
||carhartt-suomi.com^
||carharttsuomi.com^
||caterpillarfi.com^
||caterpillar-finland.com^
||caterpillarinsuomi.com^
||caterpillar-suomi.com^
||caterpillarsuomi.com^
||caterpillarsuomifi.com^
||championhelsinki.com^
||champion-suomi.com^
||championsuomi.com^
||columbiakengatsuomi.com^
||columbia-suomi.com^
||columbiasuomi-fi.com^
||columbiasuomifi.com^
||columbiasuomioutlet.com^
||columbiasuomis.com^
||comfitunderwear-suomi.com^
||converseale.com^
||conversealesuomi.com^
||conversefi.com^
||conversehelsinki.com^
||converseinsuomi.com^
||converseoutlethelsinki.com^
||converseoutlet-suomi.com^
||converseoutletsuomi.com^
||converse-suomi.com^
||conversesuomi.com^
||conversesuomi.net^
||conversesuomioutlet.com^
||conversexsuomi.com^
||crossfitsuomi.co^
||crossfitsuomi.com^
||demonia-finland.com^
||demoniafinland.com^
||demoniasuomi.com^
||demoniasuomi.net^
||demoniasuomioutlet.com^
||desigual-suomi.com^
||desigualsuomi.com^
||desigualsuomi.net^
||dopeoutletsuomi.com^
||dopesnow-finland.com^
||dopesnowfinland.com^
||dopesnow-suomi.com^
||dopesnowsuomi.com^
||dopesnowsuomi-fi.com^
||dope-suomi.com^
||dopesuomi.com^
||dopesuomi-fi.com^
||dopetakki.com^
||dopetakki-suomi.com^
||dopetakkisuomi.com^
||dubarrysuomi.com^
||eccooutlet-suomi.com^
||eccooutletsuomi.com^
||eccooutletsuomis.com^
||ecco-suomi.com^
||eccosuomi.com^
||eccosuomi.net^
||eccosuomioutlet.com^
||fjallravenoutletsuomi.com^
||fjallraven-suomi.com^
||fjallravensuomi.com^
||footjoy-finland.com^
||footjoyssuomi.com^
||footjoy-suomi.com^
||footjoysuomi.com^
||freedommoses-suomi.com^
||freedommosessuomi.com^
||gforefinland.com^
||gfore-suomi.com^
||gforesuomi.com^
||gforesuomi.net^
||groundies-finland.com^
||groundiesfinland.com^
||groundiesinsuomi.com^
||groundiesoutletsuomi.com^
||groundiessuomioutlet.com^
||gym-shark.co.za^
||gymshark.com.hr^
||gymsharkale.com^
||gymsharkalesuomi.com^
||gymsharkar.com^
||gymsharkauckland.com^
||gymsharkaustralia-au.com^
||gymsharkaustraliastores.com^
||gymsharkbutikkoslo.com^
||gym-shark-canada.com^
||gymsharkcanadafactoryoutlet.com^
||gymsharkcanadastore.com^
||gymsharkcolombia-co.com^
||gymsharkcz.cz^
||gymsharkczsale.com^
||gymshark-cz-shop.com^
||gymsharkczshop.cz^
||gym-shark-danmark.com^
||gymsharkdanmark.com^
||gymsharkdublin.com^
||gym-shark-egypt.com^
||gymsharkeufinland.com^
||gymshark-fi.com^
||gymsharkfi.com^
||gymshark-finland.com^
||gymsharkfinland.com^
||gym-sharkgreece.com^
||gym-shark-hungary.com^
||gymsharkhungarystore.com^
||gymsharkieonline.com^
||gym-shark-india.com^
||gymsharkindiashops.com^
||gymsharkinsingapore.com^
||gymsharkinsouthafrica.co.za^
||gymsharkinus.com^
||gym-shark-italia.com^
||gymshark-italia.com^
||gym-sharkmexico.com.mx^
||gymsharkmexicostore.com^
||gymsharkmexicotiendas.com.mx^
||gymshark-no.com^
||gym-sharknorge.com^
||gymsharknzsale.com^
||gymsharkostereichs.com^
||gymshark-osterreich.at^
||gymsharkosterreichshop.com^
||gymsharkoutletsuomi.com^
||gymsharkoutletwebsite.com^
||gymsharkperu.com^
||gym-shark-philippines.com^
||gymsharkportugalstore.com^
||gymsharkpt.com^
||gym-shark-romania.com^
||gymsharksbelgie.com^
||gymsharksbudapest.com^
||gym-shark-schweiz.com^
||gymsharkshop.cz^
||gym-sharksingapore.com^
||gymsharksingaporeshop.com^
||gymshark-sk.sk^
||gymsharkslovenijaeu.com^
||gymsharkslovensko.sk^
||gymsharksnorge.com^
||gymsharksouthafrica.com^
||gymsharkspainstore.com^
||gymsharkssuomi.com^
||gymsharkssverige.com^
||gymsharkstore.com.au^
||gymsharkstoreindia.com^
||gymsharkstorenyc.com^
||gym-shark-suomi.com^
||gym-sharksuomi.com^
||gymshark-suomi.com^
||gymsharksuomi.com^
||gymshark-suomiale.com^
||gymsharksuomiale.com^
||gymshark-suomi-fi.com^
||gymsharksuomi-fi.com^
||gymsharksuomifi.com^
||gymsharksuomioutlet.com^
||gymsharksuomishop.com^
||gymshark-sweden.com.se^
||gym-shark-turkiye.com^
||gymshark-turkiye-tayt.com^
||gym-sharkuaestore.com^
||gymshark-uk.com^
||gymsharkukoutlet.com^
||gymshark-uk-sale.com^
||gymsharkwinkel.com^
||gymsharkzagreb.com^
||gymsharkzurich.com^
||haglofsoutlethelsinki.com^
||haglofsoutletsuomi.com^
||haglofssuomifi.com^
||hanwag-suomi.com^
||hanwagsuomi.com^
||hanwagsuomi.net^
||hellyhansen-fi.com^
||hellyhansenfinland.com^
||hellyhansenoutletsuomi.com^
||hellyhansen-suomi.com^
||hellyhansensuomi.com^
||hellyhansensuomi.net^
||hokaale.com^
||hoka-finland.com^
||hokasuomi.com^
||hokasuomifi.com^
||icebugfinland.com^
||icebugfioutlet.com^
||icebugsfioutlet.com^
||icebugsuomi.com^
||icebugsuomi.net^
||ilsejacobsen-suomi.com^
||ilsejacobsensuomi.com^
||inov-8-suomi.com^
||inov-8suomi.com^
||jomafinland.com^
||joma-suomi.com^
||jomasuomi.com^
||kamikfinland.com^
||kamik-suomi.com^
||kamiksuomi.com^
||kamiksuomi.net^
||kappafi.com^
||kappa-suomi.com^
||kappasuomi.com^
||karhulenkkaritale.com^
||karhulenkkarithelsinki.com^
||kedsoutletsuomi.com^
||keds-suomi.com^
||kedssuomi.com^
||kedssuomishop.com^
||kickersfinland.com^
||kickers-suomi.com^
||kickerssuomi.com^
||legoale.com^
||legosuomi.com^
||loake-suomi.com^
||loakesuomi.com^
||loakesuomioutlet.com^
||lojagymsharkportugal.com^
||lornajane-suomi.com^
||lornajanesuomi.com^
||lornajanesuomi.net^
||louboutin-finland.com^
||louboutin-suomi.com^
||mizunofi.com^
||mizuno-finland.com^
||mizunofinland.com^
||mizunossuomi.com^
||mizuno-suomi.com^
||mizuno-suomis.com^
||mizunosuomishop.com^
||moonbootfi.com^
||moonbootfinland.com^
||moonboothelsinki.com^
||moonbootssuomi.com^
||moonboot-suomi.com^
||moonbootsuomi.com^
||moonbootsuomi.net^
||muckbootale.com^
||muckbootinsuomi.com^
||muckboots-suomi.com^
||muckbootssuomi.com^
||muckboot-suomi.com^
||muckbootsuomi.com^
||nautica-suomi.com^
||nauticasuomi.com^
||nikealesuomi.com^
||nikefinland.com^
||nikeinsuomi.com^
||nikeoutletsuomi.com^
||nikesuomi.com^
||nikesuomi.net^
||nikesuomi-fi.com^
||nikesuomioutlet.com^
||nikesuomishop.com^
||olukaifi.com^
||olukai-suomi.com^
||olukaisuomi.com^
||osirisfi.com^
||osirissuomi.com^
||ospreyfinland.com^
||osprey-suomi.com^
||ospreysuomi.com^
||ospreysuomi.net^
||outletadidas.com^
||outletadidasfi.com^
||outletarcteryx.com^
||outletcarhartt.com^
||outletconverse.com^
||outletdopesnow.com^
||outlethellyhansen.com^
||outletjoma.com^
||outletlego.com^
||outletmizuno.com^
||outletmuckboot.com^
||outletosprey.com^
||outletregatta.com^
||outletsalomon.com^
||outletveja.com^
||outletversace.com^
||palladiumfi.com^
||palladiumfinland.com^
||palladiumhelsinki.com^
||palladiumoutletsuomi.com^
||palladium-suomi.com^
||palladiumsuomi.com^
||palladiumsuomishop.com^
||persol-suomi.com^
||pleaserssuomi.com^
||pleasersuomi.com^
||puma-fi.com^
||pumafi.com^
||puma-finland.com^
||pumafinland.com^
||pumafi-suomi.com^
||pumainsuomi.com^
||pumaoutlet-suomi.com^
||puma-suomi.com^
||pumasuomi.com^
||pumasuomi.net^
||pumasuomiale.com^
||pumasuomioutlet.com^
||pumasuomis.com^
||redwing-suomi.com^
||redwingsuomi.com^
||regatta-suomi.com^
||regattasuomi.com^
||restockssuomi.com^
||rvca-suomi.com^
||rvcasuomi.com^
||salmingale.com^
||salmingsuomi.com^
||salomonalesuomi.com^
||salomon-finland.com^
||salomonfinland.com^
||salomonhelsinki.com^
||salomonoutletfi.com^
||salomonoutlethelsinki.com^
||salomonssuomi.com^
||salomon--suomi.com^
||salomon-suomi.com^
||salomonsuomi.com^
||salomon-suomiale.com^
||salomonsuomi-fi.com^
||salomonsuomihuijaus.com^
||salomonsuomioutlet.com^
||salomonsuomishop.com^
||samsonite-suomi.com^
||samsonitesuomi.com^
||samsonitesuomi.net^
||sanukale.com^
||sanukfinland.com^
||sanuk-suomi.com^
||sanuksuomi.com^
||sanuksuomi.net^
||sendra-suomi.com^
||sendrasuomi.com^
||sendrasuomi.net^
||sendrasuomioutlet.com^
||sendrasuomis.com^
||skimsale.com^
||skims-suomi.com^
||skimssuomi.com^
||skimssuomi.net^
||skimssuomiale.com^
||supergafi.com^
||superga-finland.com^
||superga-suomi.com^
||supergasuomi.com^
||tedbakerale.com^
||tedbakerfinland.com^
||tedbakeroutletsuomi.com^
||tedbaker-suomi.com^
||tedbakersuomi.net^
||tevafi.com^
||teva-finland.com^
||tevafinland.com^
||tevahelsinki.com^
||tevaoutletsuomi.com^
||tevassuomi.com^
||tevasuomi.com^
||timberlandfi.com^
||timberland-finland.com^
||timberlandfi-suomi.com^
||timberlandhelsinki.com^
||timberlandoutletfi.com^
||timberlandoutlethelsinki.com^
||timberland--suomi.com^
||timberland-suomi.com^
||timberlandsuomi.com^
||timberlandsuomi.net^
||timberlandsuomifi.com^
||timberlandxsuomi.com^
||timbsuomi.com^
||uniqloale.com^
||uniqlo-finland.com^
||uniqlofinland.com^
||uniqlohelsinki.com^
||uniqlo-suomi.com^
||uniqlosuomi.com^
||uniqlosuomi.net^
||uniqlosuomioutlet.com^
||vansale.net^
||vansfi.com^
||vansfioutlet.com^
||vanshelsinki.net^
||vansoutlet-suomi.com^
||vansssuomi.com^
||vanssuomi.net^
||vanssuomioutlet.com^
||veja-fi.com^
||veja-finland.com^
||vejafioutlet.com^
||vejahelsinki.com^
||vejassuomi.com^
||vejasuomi.net^
||veja-suomiale.com^
||vejasuomioutlet.com^
||versaceinsuomi.com^
||versacesuomi.net^
||vessiale.com^
||vessi-suomi.com^
||vessisuomi.com^
||vitaelight-suomi.com^
||vivobarefootale.com^
||vivobarefootalesuomi.com^
||vivobarefoot-fi.com^
||vivobarefootfi.com^
||vivobarefoot-finland.com^
||vivobarefoot-suomi.com^
||vivobarefootsuomi.com^
||vivobarefootsuomiale.com^
||xn--gymshark-espaa-2nb.com.es^
||xn--gymsharkespaaoutlet-63b.com^
||xn--gymsharkespaa-tkb.com^
||xn--gymsharksterreich-6zb.com^
||youngla-suomi.com^
||younglasuomi.com^
||younglasuomi.net^
! https://lumendatabase.org/notices/34749939
||gymsharkuswebsite.com^
||www.gymsharkuswebsite.com^
||gymsharkindiashop.com^
||www.gymsharkindiashop.com^
||gymsharkleggings-philippines.com^
||www.gymsharkleggings-philippines.com^
||gymsharkvenezuela.com^
||www.gymsharkvenezuela.com^

! https://github.com/hagezi/dns-blocklists/issues/1803
||atsholz.com^

! https://www.bleepingcomputer.com/news/security/fraudsters-make-50-000-a-day-by-spoofing-crypto-researchers/
||revoketokens.io^
||revokea.sh^

! https://www.bleepingcomputer.com/news/security/bloomberg-crypto-x-account-snafu-leads-to-discord-phishing-attack/
||altdentifiers.com^

! https://web.archive.org/web/20231120125914/https://www.bleepingcomputer.com/news/security/russian-hackers-use-ngrok-feature-and-winrar-exploit-to-attack-embassies/
! https://tria.ge/231120-qafp3aga52/behavioral1
! https://infosec.exchange/@iampytest1/111443079100649886
||cyber-wizard.com^
||iboltcyberhacker.wixsite.com^

! https://github.com/durablenapkin/scamblocklist/issues/70
||equiwarmpro.co^
||try.equiwarmpro.co^
||ekommmedia.com^
||try.ekommmedia.com^

! https://github.com/hagezi/dns-blocklists/issues/1866
||travix-works.com^
||www.travix-works.com^

! https://infosec.exchange/@iampytest1/111490361011885326
||xairdrop.biz^

! porn scam
||directchats.site^
||rose.directchats.site^
||ariana.directchats.site^
||liliana.directchats.site^
||sienna.directchats.site^
||margaret.directchats.site^
||adalynn.directchats.site^
||elliana.directchats.site^
||eliza.directchats.site^
||alina.directchats.site^
||raelynn.directchats.site^
||brielle.directchats.site^
||hadley.directchats.site^
||maria.directchats.site^
||madeline.directchats.site^
||lyla.directchats.site^
||everleigh.directchats.site^
||eden.directchats.site^
||mackenzie.directchats.site^
||sage.directchats.site^
||ximena.directchats.site^
||lydia.directchats.site^
||mlie.directchats.site^
||daisy.directchats.site^
||piper.directchats.site^
||sarah.directchats.site^
||gabriella.directchats.site^
||serenity.directchats.site^
||charlie.directchats.site^
||vivian.directchats.site^

! https://github.com/RPiList/specials/issues/1369
||qdyqdym.shop^
||buy.qdyqdym.shop^

! https://github.com/RPiList/specials/issues/1399
||schnellmpu.com^

! https://github.com/RPiList/specials/issues/1400
||america4internationalstudents.com^

! https://github.com/RPiList/specials/issues/1404
||bonprix-sale.shop^
||bonprix-sale.

! https://github.com/durablenapkin/scamblocklist/issues/73
||bite-life.com^

! scam
||medium.com/@liamm7203/hire-a-hacker-to-change-university-grades-transcripts-lee-ultimate-hac-0ea869b69aca^

! https://forums.malwarebytes.com/topic/306200-fake-fakebook-t-shirt-scam/ (account required)
||newdesing.guru^

! possible scam (fake age verification)
||pregnantsimulator.com^
||adultonlineplay.com^

! https://github.com/Dogino/Discord-Phishing-URLs/issues/24
||cryptoslugs-hubs.com^
||verify.cryptoslugs-hubs.com^

! https://virustotal.com/gui/url/dc11c48005d4e6e10f3cee13a731a131887b99ced613abd81900a2530689b94d/community
! my analysis: https://tria.ge/240106-xd1yqsdfdq/behavioral1
||fazeskins.ru^

! https://github.com/hagezi/dns-blocklists/issues/2019
||realboos.online^

! https://github.com/RPiList/specials/issues/1422
||jaynapatel.co.uk^
||nelyc5h5x.jaynapatel.co.uk^

! https://github.com/gchq/CyberChef/issues/1639#issuecomment-1893099540
||technocraterecovery.site^

! https://github.com/hagezi/dns-blocklists/issues/2049
||adidasbrasil.net^
||adidascolombia.net^
||adidasfotballsko.com^
||adidashrvatskas.com^
||adidashungaryhu.com^
||adidasihungary.com^
||adidasjapan.net^
||adidasoutletfrance.com^
||adidasoutletslovenija.com^
||adidasperu.com^
||adidasschoenen.com^
||adidasslovenijaonline.com^
||adidasslovenijaoutlet.com^
||adidassrbijaeshop.com^
||adidassrbijashop.com^
||adidasuae.net^
||adidaszagreb.com^
||aerosolesshoesoutlets.com^
||airjordanbelgique.net^
||airjordanberlin.de^
||airjordanfemme.fr^
||airjordangreece.net^
||airjordanmagasinsuisse.com^
||airjordanromania.net^
||airjordanuruguay.com^
||aldobolsasmexico.com^
||aldocanada.net^
||aldomontreal.com^
||aldonetherlands.com^
||aldosapatos.com^
||aldosouthafrica.com^
||aldozapatos.com^
||alessandrozavettijas.com^
||alessandrozavettiromania.com^
||alessandrozavettiuk.com^
||alessandrozavettiweste.de^
||allbirdsmadrid.com^
||allsaintshungary.com^
||allsaintsonlineuae.com^
||allsaintsportugal.net^
||allsaintsslovenija.com^
||aloyogaaustralia.net^
||aloyogabrasil.com^
||aloyogapraha.cz^
||aloyogasale.net^
||aloyogasuomi.net^
||alphalete-suomi.com^
||alphaletesuomi.com^
||altra.ae^
||altrabelgie.com^
||altradanmarkshop.com^
||altraroadshoesnz.com^
||altraruningpolska.com^
||altrarunnerjapan.com^
||altrashoesdk.com^
||altrasverigeshop.com^
||americantouristerpolska.pl^
||americantouristersuomi.com^
||annafieldshop.fr^
||arcterryxoutletuk.com^
||arcterxysuomi.com^
||asicskuwaitsale.com^
||asicsoutletwien.at^
||asicssuomisneakers.com^
||asicswarsaw.pl^
||asicswarszawaoutlet.pl^
||asolocipele.com^
||asolosko.com^
||asportuguesaslatvija.com^
||autrybelgique.net^
||autryboty.cz^
||autryjapan.net^
||autrymexico.net^
||autrynz.com^
||autryoutlet.com^
||autryshoes.pl^
||autryshoesjapan.com^
||autrystore.net^
||autryuae.net^
||autryvienna.at^
||axelarigatojapan.net^
||axelarigatomilano.it^
||axelarigatooslo.com^
||axelarigatotenisice.com^
||aybl.pl^
||ayblsuomi.com^
||baffinstiefel.com^
||balancecentrum.eu^
||balenciagaireland.com^
||balenciagasuomi.com^
||balmainhrvatskashop.com^
||bapebelgium.com^
||bapeberlin.de^
||bapecanadasale.com^
||bapedanmark.net^
||bapeeesti.com^
||bapeisrael.com^
||bapejapanonline.com^
||bapelietuva.com^
||bapenederland.net^
||bapenorgeoutlet.com^
||bapeparisshop.fr^
||bapeportugal.net^
||bapesklepwarszawa.pl^
||bapesuisse.com^
||bapewien.at^
||barbourfinland.com^
||barbourkurtka.com^
||barbourpolska.com^
||barbourpolska.net^
||bearpawbrazil.com^
||bearpawbuty.com^
||belenkafi.com^
||billabong-argentina.com^
||billabongcanada.net^
||billabongportugal.net^
||billabongromania.net^
||billabongwarszawa.pl^
||bocancilowa.com^
||botascolumbia.com^
||botasdemonia.com^
||botashunterargentina.com^
||botashuntermexico.com^
||botashuntermujer.com^
||botaspajar.com^
||bothunterturkiye.com^
||bottegavenetasuomi.com^
||botyadidas.cz^
||botybearpaw.com^
||botycaterpillar.cz^
||brooksfinland.com^
||brooksoutletpolska.com^
||brooksrunningindonesia.com^
||brooksshoesuk.com^
||brooksshoeuk.com^
||brookssuomi-fi.com^
||brookssuomioutlet.com^
||brookswyprzedaz.pl^
||buenobratislava.sk^
||buenoshoesuk.com^
||bugattifashionro.com^
||butydanner-polska.com^
||butykeenoutlet.pl^
||butyveja.pl^
||buyshoesmalaysiaonline.com^
||buyshoesonlinemalaysia.com^
||carharttbratislava.sk^
||carharttchile.net^
||carharttdanmark.com^
||carhartthungary.com^
||carharttlatvia.com^
||carharttparis.fr^
||carharttpolska.com^
||carharttpraha.cz^
||carharttsrbija.com^
||carharttsuisse.com^
||carharttuae.net^
||cartier-malaysia.com^
||castanerromania.com^
||caterpillarbootscanada.net^
||caterpillarchaussure.net^
||caterpillarnorge.org^
||caterpillarshoesuk.com^
||cerabone.cz^
||championargentina.net^
||championbelgique.com^
||championberlin.de^
||championbulgaria.com^
||championclchile.com^
||championcolombia.net^
||championdanmark.com^
||championeesti.com^
||championgreece.net^
||championisrael.net^
||championjapan.net^
||championkuwait.net^
||championmexico.net^
||championoutletstore.sk^
||champion-polska.pl^
||championroma.it^
||championslovenija.com^
||championuae.net^
||championuksale.com^
||championuruguay.com^
||championwarszawa.pl^
||chaussuresmusto.com^
||cizmesorel.com^
||clarksargentina.net^
||clarksbuty.pl^
||clarksmontreal.net^
||clarksportugal.net^
||clarksscarpe.it^
||clarksshoesaustralia.net^
||clarksshoesnz.net^
||coccinellepolska.com^
||colehaanbrasilsale.com^
||colehaangreece.com^
||columbiacolombiatiendas.com^
||columbiafootweargreece.com^
||columbiagreeceonline.com^
||columbianetherlands.com^
||columbiapolskaoutlet.com^
||columbiashoesmalaysia.com^
||columbiashoesph.com^
||columbiashopnederland.com^
||columbiasnetherlands.com^
||columbiaspolskasklep.com^
||columbiassuomioutlet.com^
||converseallstarisrael.com^
||converseberlin.de^
||conversebrasil.com^
||converse-chile.cl^
||conversechile.net^
||converseinespana.com^
||converseisrael.com^
||conversekuwait.com^
||converselietuva.com^
||converse-luxembourg.com^
||conversephilippines.com^
||conversepromocja.com^
||converseromestore.it^
||converseshoesmalaysia.com^
||conversesklep.com^
||conversesrbija.com^
||conversestoreperu.com^
||converseuk.com^
||conversezurich.net^
||convresefi.com^
||convresesuomi.com^
||cosabellanederland.com^
||crocskaufenwien.at^
||crocslietuva.com^
||crocsuruguay.net^
||crocswarszawa.pl^
||cycasturkey.com^
||dannerbootsaustralia.net^
||dannerbootsfrance.net^
||dannerbootsromania.com^
||dannersko.net^
||dannerwandelschoen.com^
||dc-shoesperu.com^
||demoniaboots.it^
||demoniabootscanada.com^
||demoniabootsireland.com^
||demoniabudapest.com^
||demoniajapan.com^
||demoniapolska.com^
||demoniaportugal.com^
||demoniaromania.com^
||demoniashoesnorge.com^
||demoniastiefel.de^
||demoniegreeceoutlet.com^
||demoniepolska.com^
||docsmartensfactoryoutlet.com^
||docsmartenspoland.pl^
||dopeargentina.net^
||dopebelgie.com^
||dopechile.com^
||dopedanmark.com^
||dopeeesti.com^
||dopejackeschweiz.com^
||dopelaskettelutakki.com^
||dopenorge.com^
||dopeportugal.net^
||doperomania.com^
||dopeskikleding.com^
||dopesnowboard.fr^
||dopesnownederland.com^
||dopesnowromania.com^
||dopesnowtakki.com^
||dopetakit.com^
||drmartensbatai.com^
||drmartensbot.com^
||drmartensbotas.com^
||drmartensbotasmexico.com^
||drmartensboty.cz^
||drmartensdamen.de^
||drmartensdonna.com^
||drmartensdublin.com^
||drmartenshomme.fr^
||drmartensjapan.net^
||drmartenssalg.com^
||drmartensshoesuk.com^
||drmartensskroutz.com^
||eastpaklietuva.com^
||eccohrvatskaoutlet.com^
||eccomontreal.com^
||eccooutletsklep.pl^
||eccooutletssuomi.com^
||eccorusland.com^
||eccoshoessaleaustralia.com^
||emuaustraliaromania.com^
||etniesshoesireland.com^
||extreehome.com^
||femistoriessuomi.com^
||fila-finland.com^
||fitflopparis.net^
||fitflopromania.com^
||footjoyapparelnz.com^
||footjoycanada.net^
||footjoygolfshoe-india.com^
||footjoygolfshoes-india.com^
||footjoygolfshoesuk.com^
||footjoyjapan.net^
||footjoyoutletmexico.com^
||footjoyshoesaustralia.com^
||footjoyshoessouthafrica.com^
||footjoysko.com^
||fossilirelandsale.com^
||fotbalovyfestival.cz^
||gapsuomi.com^
||geoxargentina.net^
||geoxbelgique.com^
||geoxczpraha.cz^
||geoxgreece.net^
||geox-ireland.com^
||geoxisrael.com^
||geoxkuwait.com^
||geoxlatvija.com^
||geoxmexico.com^
||geoxnederland.net^
||geoxnorge.net^
||geoxportugaloutlet.com^
||geoxschweiz.com^
||geox-shoes-india.com^
||geoxsouthafrica.com^
||geoxsrbija.com^
||geoxsuomi.com^
||geoxuk.com^
||geoxuruguay.com^
||ghdhaircanada.ca^
||gola-portugal.com^
||goldengoose-italia.com^
||groundiescanada.net^
||groundiesgreeceoutlet.com^
||groundiesgreeces.com^
||groundiesitalia.top^
||groundiesoutletchile.com^
||groundiesoutletportugal.com^
||groundiesportugal.top^
||groundiesscarpeitalia.it^
||groundiesschoenennederland.com^
||groundiestroutlet.com^
||groundieswyprzedaz.pl^
||guessfinland.com^
||gymshark-polska.pl^
||gymsharkrea.com^
||gymsharksaledk.com^
||gymsharksklep.pl^
||gymsharksoldes.net^
||gymsharkstorejapan.net^
||gymsharksverigesale.com^
||gymsharksweden.com^
||hackettsrbija.com^
||haflingerslipperswebsite.com^
||hanwagoutletstore.com^
||hanwagshoesoutlet.com^
||hellyhansenargentina.net^
||hellyhansenaustralia.net^
||hellyhansenbratislava.sk^
||hellyhansencanada.com^
||hellyhansenchile.com^
||hellyhansencolombia.com^
||hellyhanseneesti.com^
||hellyhansengreece.com^
||hellyhansenhrvatska.net^
||hellyhansenhungary.com^
||hellyhansenireland.com^
||hellyhansenjapan.com^
||hellyhansenkuwait.com^
||hellyhansenlatvija.com^
||hellyhansenmexico.com^
||hellyhansennederland.com^
||hellyhansennorge.net^
||hellyhansenoutletgreece.com^
||hellyhansenparis.net^
||hellyhansenpraha.cz^
||hellyhansenromania.net^
||hellyhansenschweiz.com^
||hellyhansensrbija.com^
||hellyhansenuk.com^
||hellyhansenuruguay.com^
||hellyhansenwarszawa.pl^
||herschelireland.com^
||heydudeforsale.com^
||hm-portugal.com^
||hoka-denmark.com^
||hoka-magyarorszag.com^
||hokanorgebutikk.com^
||hokaoneonehrvatska.com^
||hokaonept.com^
||hokaoutletparis.com^
||hokarunnershungary.com^
||hokascarpe-italia.com^
||hoka-schweiz.com^
||hoka-soldes.fr^
||hokastoreportugal.com^
||hummelchile.com^
||hunterbootscanada.com^
||hunterbootsdublin.com^
||hunterbootsjapan.com^
||hunterbootsnz.com^
||hunterbootsschweiz.net^
||hunterfinland.com^
||huntergumbootsaustralia.com^
||huntergummistiefeldamen.de^
||hunterkaloszeoutlets.pl^
||hunteroutletsuomi.com^
||hunterregenlaarzen.com^
||hushpuppiesfinland.com^
||inov8boty.cz^
||ipanemauae.com^
||johannisstein.eu^
||johnstonmurphyaustraliau.com^
||jomacdmx.com^
||jomajp.com^
||jomasportcostarica.com^
||jomavenezuela.com^
||jordansboty.cz^
||josefseibelsuomi.com^
||joyaperuventa.com^
||joyaromania.com^
||joyaschoenen.com^
||joyaschuhedeutschland.com^
||joyashoeskuwait.com^
||joyaskonorge.com^
||joyaskorstockholm.com^
||jsbackpackcanada.com^
||kaloszehunter.com^
||kappazurich.com^
||karenmillenslovensko.sk^
||karhuskor.com^
||karhusneakersnorge.net^
||karrimormexico.com^
||kedsberlin.de^
||kedscanada.net^
||kedsoutletpolska.com^
||kedspt.com^
||kedssklep.pl^
||kenzoindonesia.com^
||kickers-hungary.com^
||kiplingfrance.com^
||kipling-polska.com^
||kiplingspain.com^
||kiplingsuomi.com^
||kurtkadope.com^
||lasportivabootsnz.com^
||lasportivaclimbingshoescanada.com^
||lasportivaklatresko.com^
||lasportivamontreal.com^
||lasportivanederland.com^
||lasportivaportugal.com^
||lasportivaschuheschweiz.com^
||lasportivatenisice.com^
||lasportivawanderschuhe.de^
||lecoqsportifparis.fr^
||leggingsnvgtnitaly.com^
||legginsygymsharkpolska.com^
||lems-greece.com^
||liujoukshop.com^
||loakedanmarkshop.com^
||lojacolumbiaportugal.com^
||longchampbucharest.com^
||lornajaneaustralia.com^
||lottoargentina.net^
||lottoaustralia.org^
||lottobelgium.net^
||lottoboty.cz^
||lottobulgaria.org^
||lottocolombia.net^
||lottodanmark.net^
||lottoeesti.org^
||lottofrankfurt.de^
||lottogreece.org^
||lottohrvatska.org^
||lottohungary.org^
||lottoireland.net^
||lottokuwait.org^
||lottolithuania.org^
||lottomexico.org^
||lottonorway.net^
||lottoparis.net^
||lottoportugal.net^
||lottoschweiz.com^
||lottoserbia.org^
||lottoslovakia.sk^
||lottosouthafrica.net^
||lottosuomi.net^
||lottotokyo.org^
||lottoturkey.org^
||lottouruguay.net^
||lottowarszawa.pl^
||louboutin-polska.com^
||lowaapavi.com^
||lowabakancs.net^
||lowabatai.com^
||lowabootsaustralia.net^
||lowabootsmexico.com^
||lowabotas.com^
||lowaisrael.net^
||lowamilitarybootsuk.com^
||lowa-philippines.com^
||lowaschoenen-nl.com^
||lowasuomi.com^
||lowausastore.com^
||lowawandelschoenen.com^
||lowawinterstiefel.de^
||lululemonamsterdam.net^
||lululemoneu.cz^
||lululemonjapan.ru^
||lululemonmontreal.com^
||lululemonoutletcolombia.net^
||lululemonportugal.net^
||lululemonsale.de^
||mackagebelgique.net^
||mackagedenmark.com^
||mackagefemmeparis.com^
||mackageireland.com^
||mackagejacketcanada.com^
||mackageschweiz.com^
||magasinhokabelgique.com^
||marcjacobs-france.fr^
||marc-jacobssuomi.com^
||meindlschuhedeutschland.com^
||mephistoonsale.com^
||merrellbarbati.com^
||merrellbutysklep.com^
||merrelloutletfactoryuk.com^
||merrellsandaalit.com^
||merrellsklepy.pl^
||michaelkorsargentina.net^
||michaelkorsberlin.de^
||michaelkorsgreece.net^
||michaelkorslatvia.com^
||michaelkorssrbija.net^
||michaelkorssuisse.net^
||michaelkorsuruguay.net^
||michaelkorsvienna.at^
||michaelkorswarszawa.pl^
||mizuno-hungary.com^
||mizunonorway.com^
||mizunoonsaleuk.com^
||mizunosaleportugal.com^
||mizunosnorge.com^
||mizuno-sweden.com^
||mlbhungary.com^
||mlbshopschweiz.com^
||mollybootmexico.com^
||moonbootargentina.com^
||moonbootaustralia.net^
||moonbootbelgique.com^
||moonbootbratislava.sk^
||moonbootbulgaria.com^
||moonbootireland.net^
||moonbootisrael.net^
||moonbootjapan.net^
||moonbootlatvia.com^
||moonbootlietuva.com^
||moonbootnorge.net^
||moonboot-polska.com^
||moonbootportugal.net^
||moonbootroma.it^
||moonbootsgreece.net^
||moonbootslovenija.net^
||moonbootsouthafrica.net^
||moonbootsperu.com^
||moonbootuae.net^
||moonbootukstore.com^
||muckbootdanmark.com^
||muckboots-cz.com^
||muckbootscz.com^
||muckbootsgreece.com^
||muckbootsmagyarorszagon.com^
||muckbootsnl.com^
||muckbootsnorge.com^
||muckbootsosterreich.at^
||muckbootsoutletstore.de^
||muckbootspolska.com^
||muckbootsportugal.com^
||muckbootsromania.com^
||muckbootsschweiz.com^
||muckbootssouthafrica.com^
||muckbootssverige.com^
||nadejbaletu.sk^
||nativeshoesfrance.com^
||nauticanederland.com^
||nauticapolska.com^
||nauticaromania.com^
||nauticaukwebsite.com^
||newbalanceonline.pl^
||new-lookireland.com^
||newlooksuomi.com^
||nfiserova.cz^
||nikeaustralia.net^
||nikeayakkabiindirim.com^
||nikegreece.net^
||nikenorgesalg.com^
||nikeoutletspain.com^
||nike-philippines.com^
||nike-polska.pl^
||nike-portugal.com^
||nikeshoeoutlets.gr^
||nikeslovenija.net^
||nikesouthafricasale.co.za^
||niketrturkiye.com^
||nine-west.pl^
||nobullbelgie.net^
||nobullcanadasale.com^
||nobullcrossfitoutlet.net^
||nobulldeutschland.de^
||nobullgreece.net^
||nobullprojectireland.net^
||nobullprojectmexico.com^
||nobullshoponline.sk^
||nobullskonorge.com^
||nobullsrbija.com^
||no-bulluk.com^
||norronabunda.sk^
||obuvlasportiva.sk^
||ohpollyportugal.com^
||oliverpeoplesschweiz.com^
||olukaibe.com^
||olukaidk.com^
||olukai-france.fr^
||olukai-greece.com^
||olukainorway.com^
||olukaisaleclearance.com^
||onitsukatiger-ireland.com^
||oofossingaporestore.com^
||osirisfootwearmexico.com^
||osirisuk.com^
||palladiumargentina.com^
||palladiumbootsargentina.com^
||palladiumbootspolska.pl^
||palladium-denmark.com^
||palladiumfi.me^
||palladium-hrvatska.com^
||palladiumpolskaoutlet.com^
||panamajack-france.fr^
||panamajackonline.sk^
||panamajackoutlet.pl^
||panamajackparis.com^
||panamajackschweiz.ch^
||panamajackschweiz.net^
||panamajackslovenija.com^
||pandorajapan.net^
||pandorakorut.com^
||pandoraoslo.com^
||pandoraportugal.com^
||pandoraringsuk.com^
||parajumpersjackede.de^
||parfois-chile.com^
||parfoiscz.cz^
||parfoisdublin.com^
||parfoisosterreich.at^
||parfois-sverige.com^
||patagoniapolskasklep.pl^
||perfectmomentromania.com^
||pitviperbril.com^
||pitviperbriller.com^
||pitviperfrance.net^
||pitvipergafas.com^
||pitviperjapan.com^
||pitviperlunette.fr^
||pitviperocchiali.it^
||pitviperoculos.com^
||pitvipersunglassesnz.com^
||pleaserchaussure.com^
||pleaserchaussures.com^
||pleaserheelscanada.com^
||pleaserschweiz.com^
||portugalgroundies.com^
||procuradoresnavas.com^
||pumaoutletpolska.com^
||puma-polska.com^
||quaygreece.net^
||quayocchiali.it^
||quayonline.net^
||quayoutlet.com^
||quayparis.com^
||quayphilippines.com^
||quaysouthafrica.net^
||quaysstore.com^
||quaysuomeksi.com^
||rabclothingsouthafrica.net^
||rabdanmark.net^
||rabhungary.com^
||rabonline.net^
||rabparis.fr^
||rabromania.net^
||rabsrbija.net^
||raybanmalaysiastore.com^
||raybanslovensko.sk^
||redwingoslo.com^
||reebokaustralia.com^
||reebokuswebsite.com^
||reef-danmark.com^
||reef-polska.com^
||reef-portugal.com^
||regattafrance.com^
||regattapolska.com^
||rockportbootsireland.com^
||rockportjapan.com^
||rockportmontreal.com^
||rockportnz.com^
||rockportontario.com^
||rockportoutletortugal.com^
||rockportsaleuk.com^
||rockportschoenen.com^
||rockportshoesmexico.com^
||rockporttr.com^
||rockportzapatos.com^
||rothys-suomi.com^
||roxy-japan.com^
||russellandbromleynorge.net^
||russellandbromleyromania.net^
||russellandbromleywien.at^
||russellbromleyoutlet.net^
||russellnbromleycanada.com^
||rvcajapan.net^
||ryderwear-finland.com^
||ryderwearjapan.com^
||ryderwearjapann.com^
||ryderwear-polska.com^
||ryderwear-suomi.com^
||safenordicsolutions.com^
||saintjamesireland.com^
||salmingchile.com^
||salmingcolombia.com^
||salmingportugalpt.com^
||salmingslovenija.com^
||salomomsuomioutlet.com^
||salomonbuty.com^
||salomonenucuz.com^
||salomonfinlandoutlet.com^
||salomongermany.de^
||salomonmalaysiaonlineshop.com^
||salomonoutlet.it^
||salomonportugal.com^
||salomonpraha.com^
||salomonshoes.co.za^
||salomonshoesbulgaria.com^
||salomonshopgreece.com^
||salomonslovensko.me^
||salomonstoreuae.com^
||salomonvandreskotilbud.com^
||sanitamalaysia.com^
||sanitasverige.com^
||sanukchiletiendas.com^
||sanukdublin.com^
||sanukflipflops.de^
||sanuknederlandnl.com^
||sanuknz.com^
||sanuk-philippines.com^
||sanukromaniaro.com^
||sanuksalecanada.com^
||sanuksandalssingapore.com^
||sanukschoenen.com^
||sanukshoesschweiz.com^
||sanukzapatoscolombia.com^
||scarpejoya.com^
||scarpelowa.it^
||scarpesanuk.it^
||scotchandsodaromania.com^
||scotch-sodaromania.com^
||sebagoantwerpen.com^
||sebagobruxelles.com^
||sebagodeckshoesireland.com^
||sebagodockside.fr^
||sebagojapan.net^
||sebagosaat.com^
||sebagoschoenen.com^
||sebagoshoesgreece.com^
||sebagozapatos.com^
||shoesmalaysiastores.com^
||shoessalesmalaysia.com^
||skechersfactory.com^
||skechersinphilippines.com^
||skechersmilano.com^
||skechersoutletsverige.com^
||skechersparissale.com^
||skechersschuhe.com^
||skechersturkiyeoutlet.com.tr^
||skechersuruguayoutlet.com^
||skijakke.com^
||skijasbelgie.com^
||skimscz.cz^
||skimsgreece.com^
||skims-polska.pl^
||skimspolska.pl^
||skimsromania.com^
||skimsshoponline.com^
||sklepconversepolska.com^
||sklepyadidaspolska.com^
||sloggipolska.pl^
||snowromania.com^
||solovairargentina.com^
||solovairbelgique.com^
||solovairbelgium.net^
||solovairbrasil.com^
||solovaircanada.net^
||solovairchile.net^
||solovairgreece.net^
||solovairhrvatska.net^
||solovairpraha.cz^
||solovairschweiz.net^
||solovairshop.com^
||solovairslovenija.net^
||solovairsuomi.net^
||sorelaustraliashops.com^
||sorelbootsuk.com^
||sorelchaussures.com^
||sorel-dk.com^
||sorelportugal.com^
||sorelschoenen.com^
||sorelschweiz.com^
||sperryfactoryoutlets.com^
||sperryshoesaustralia.com^
||stevamaddenpl.com^
||stevamaddenpolska.com^
||stockxbelgique.com^
||stockxbelgium.com^
||stockxlatvia.com^
||stockxsouthafrica.com^
||stockxsuisse.com^
||stoneislandeesti.ru^
||stoneislandjapan.com^
||stoneislandlietuva.com^
||stoneislandparis.ru^
||stoneislandsouthafrica.ru^
||stoneislandsuisse.com^
||stoneislandsuomi.org^
||stussygreece.com^
||stussy-italia.com^
||suprainsuomi.com^
||suprashoescanada.com^
||tamarisdanmark.com^
||tamarissdanmark.com^
||tedbakereesti.com^
||tedbakerireland.net^
||tenisiconverseromania.com^
||tenisiconverseromania.ro^
||teniskyunderarmour.sk^
||teva-ar.com^
||teva-be.com^
||teva-colombia.com^
||teva-cz.com^
||tevaforhandler.com^
||tevahr.com^
||tevaoutletchile.com^
||teva-polska.com^
||tevasandalesrbija.com^
||tevaskor.com^
||tevaszandalbudapest.com^
||teva-turkey.com^
||thursdaycanada.com^
||thursdaynorge.com^
||thursdayuk.com^
||tiendahokaonemexico.com^
||tiendasairjordanmexico.com^
||tiffanysuomi.com^
||tiffanyturkiye.com.tr^
||timberlandmontreal.net^
||timberlandpolska.pl^
||timberlandtopanky.sk^
||tomfordsuomi.com^
||tommyhilfigerbunda.sk^
||tommyhilfigerdeutschland.de^
||tommyhilfigerdublin.com^
||tommyhilfigerjakke.com^
||tommyhilfigerjakne.com^
||tommyhilfigeronlinecanada.com^
||tommyhilfigeroutletargentina.com^
||tommyhilfigeroutletnz.com^
||tommyhilfigeroutletportugal.com^
||tommyhilfigerpatike.com^
||tommyhilfigerquebec.net^
||tommyhilfigersko.com^
||tomsjapan.net^
||tomsjapanoutlet.com^
||tomsschuhedamen.de^
||tomsshoesdubai.com^
||tomsskotilbud.com^
||tonybianconz.com^
||toryburchoutletespana.com^
||uggssklep.pl^
||umbropolska.pl^
||underarmouradidasi.com^
||underarmourchaussures.net^
||underarmourjas.com^
||underarmouroslo.com^
||underarmourschuhe.at^
||underarmourskor.se^
||underarmourskroutz.com^
||underarmourtrainersuk.com^
||undervon.com^
||uniqlopolska.pl^
||valentinocanada.com^
||vansalte.it^
||vanscolombia.net^
||vansdames.com^
||vansforsaleuk.net^
||vansindonesiastore.com^
||vansschoenenbelgie.com^
||vansshoesksa.com^
||vanssko.com^
||vansskoletaske.com^
||vanstenisice.com^
||veja.com.gr^
||vejaadidasi.com^
||vejaathensgreece.net^
||vejabelgium.com^
||vejabrasil.net^
||vejanorge.com^
||vejanz.com^
||vejaoutlet.net^
||vejapraha.cz^
||vejasfranceoutlet.com^
||vejashoes.cz^
||vejashoesuk.com^
||vejasko.org^
||vejaslovenia.com^
||vejatenis.com^
||vejazapatoscolombia.net^
||verabradleypolska.com^
||vessibelgium.com^
||vessibelglum.com^
||vessiitalia.com^
||vessijapan.net^
||vessischoenen.com^
||vessishoes.fr^
||vibram-es.com^
||vibrammagyarorszag.com^
||vibramnederland.me^
||vibramparis.com^
||vibramsalenz.com^
||vibramukstore.com^
||vibramvypredaj.sk^
||viking-cnc.com^
||viking-solutions.com^
||vineyardvines.pl^
||vineyardvinessuomi.com^
||vionicmexico.com^
||vionicshoesportugal.com^
||vioniczapatos.com^
||vivaiabuty.pl^
||vivobarefootbrasil.net^
||vivobarefootbrussel.com^
||vivobarefootchileoutlet.net^
||vivobarefooteesti.com^
||vivobarefoothrvatska.net^
||vivobarefoot-hu.com^
||vivobarefootjapan.net^
||vivobarefootkengat.com^
||vivobarefootkokotaulukko.com^
||vivobarefootkuwait.com^
||vivobarefoot-romania.ro^
||vivobarefootslovenia.com^
||vivobarefoot-slovenija.com^
||vivobarefootsrbija.net^
||vivobarefootsuisse.com^
||vivobarefootusretailers.com^
||vivobarefoot-za.com^
||vivoshoessouthafrica.com^
||wolverinefactoryoutlet.com^
||wolverinefactoryoutlets.com^
||xerobarefoot.sk^
||xerofootwearuk.com^
||xerojapan.net^
||xeroshoesaustralia.com^
||xeroshoesnz.com^
||xeroskor.com^
||xn--adidasayakkab-gbc.net^
||xn--aloyogamnchen-3ob.de^
||xn--asolokengt-y5a.com^
||xn--axelarigatokbenhavn-67b.com^
||xn--bapeespaa-s6a.com^
||xn--billabongtrkiye-8vb.com^
||xn--carharttespaa-tkb.com^
||xn--castaerespaa-ehbg.com^
||xn--clarksespaa-beb.com^
||xn--clarkszrich-zhb.com^
||xn--conversebelgi-gib.com^
||xn--dannerespaa-beb.com^
||xn--dannerstvler-2jb.com^
||xn--dopeespaa-s6a.com^
||xn--dopetrkiye-eeb.com^
||xn--drmartensstvler-gub.com^
||xn--footjoygolfkengt-9nb.com^
||xn--gillmarinetrkiye-tzb.com^
||xn--hellyhansenbelgi-prb.com^
||xn--hellyhansenespaa-lub.com^
||xn--hellyhansenper-yrb.com^
||xn--hellyhansentrkiye-e3b.com^
||xn--huntergummistvler-d1b.com^
||xn--hunterstvler-2jb.com^
||xn--joyaespaa-s6a.com^
||xn--neweraapka-j9b.com^
||xn--norronatrkiye-3ob.com^
||xn--skimstrkiye-yhb.com^
||xn--solovairmxico-jhb.com^
||xn--sorelcip-8sb.com^
||xn--tomscip-8mb.com^
||xn--underarmourayakkab-v0c.com^
||xn--vejazrich-u9a.com^
||xn--vessiespaa-19a.com^
||yeezybelgique.com^
||yeezyberlin.de^
||yeezyireland.com^
||yeezyisrael.com^
||yeezyuksale.com^
||yeti-southafrica.co.za^
||youngla-danmark.com^
||youngla-polska.pl^
||yslpolska.pl^
||zapatillasunderarmourchile.com^
||zapatossanuk.com^
||zavettiireland.com^

! https://github.com/durablenapkin/scamblocklist/issues/74
||link-etsy.com^
||etsy-verifed-shop.com^

! https://github.com/hagezi/dns-blocklists/issues/2081
||do0cd.com^
||doosd.pro^
||d0ood.com^
||doode.pro^

! SMS phishing message
! cloudflared: https://tria.ge/240127-rgd1gsdgb8/behavioral1
||bbbvnvn.com^
||usps.bbbvnvn.com^
||kai12102.top^
! https://www.virustotal.com/gui/ip-address/47.251.77.252/relations
||47.251.77.252^
||bbbnvnv.com^
||usps.bbbnvnv.com^
||bbblmlm.com^
||usps.bbblmlm.com^
||bbbkdt.com^
||usps.bbbkdt.com^
||bbbhaod.com^
||usps.bbbhaod.com^
||bbbnbnb.com^
||usps.hkjtion.com^
||usps.hjktion.com^
||bbbiiuu.com^
||usps.bbbiiuu.com^
||bbbvbvb.com^
||usps.bbbvbvb.com^
||usps.bbbnbnb.com^
||usps.bbbuuui.com^
||bbbuuui.com^
||bbbdjsgd.com^
||usps.bbbdjsgd.com^
||bbbdjdhes.com^
||usps.bbbdjdhes.com^
||bbbiuiu.com^
||usps.bbbiuiu.com^
||usps.zzzopjl.com^
||bbbouou.com^
||usps.bbbouou.com^
||zzzopjl.com^
||bbbiudhs.com^
||usps.bbbiudhs.com^

! https://github.com/hagezi/dns-blocklists/issues/2178
||guidesite.info^
||ustrack.online^

! https://github.com/hagezi/dns-blocklists/pull/2182
||cashjuice.com^
||esigningapp.com^
||fastloanassist.com^
||myrequestresults.com^
||myresources-join.resourcesify.com^
||taxreturnoptions.com^
||247lendinggroup.com^
||theconsumerhq.com^
||banktoday.de^
||secureexpressrequest.com^
||cashusa.com^
||choicecreditrepair.life^
||swagbucks.com^
||americanunsecured.com^
||grantsreach.com^

! https://github.com/hagezi/dns-blocklists/issues/2228
||z-lib.id^

! https://github.com/RPiList/specials/issues/1492
||okun.shop^
||meiguo66.okun.shop^
||de.okun.shop^

! https://www.reddit.com/r/Scams/comments/1bfbq5e/emf_neutralizer_is_this_actually_a_thing/
! https://yewtu.be/watch?v=EgvdvfOvdJs
! https://yewtu.be/watch?v=VmFzPALkFyo
! https://www.bbc.com/news/technology-55613452
! https://www.usatoday.com/story/news/factcheck/2020/07/12/fact-check-anti-radiation-shields-do-not-protect-against-emf-emission/5349018002/
||energydots.com^

! https://github.com/durablenapkin/scamblocklist/issues/80
||produktretter.com^
||produktretter.org^
||gratis-eltern-produkttests.com^
||produkttest-anmeldung.com^
||maforia-anmeldung.com^
||produkttester-anmeldung.com^
||produkttester-werden.org^
||ruecksendungen-gratis.com^

! https://github.com/RPiList/specials/issues/1515
! https://tria.ge/240320-23k12aef2v/behavioral1
||iioddoy.shop^
||shop.iioddoy.shop^
||baodan.xyz^
||img.baodan.xyz^$image
! https://tria.ge/240320-3qqanaec82/behavioral1
||ixlcrg.shop^
||shop.ixlcrg.shop^
||gagabao216.com^
||img.gagabao216.com^$image
! https://tria.ge/240321-aqql7sfb49/behavioral1
||ffuoouw.shop^
||shop.ffuoouw.shop^
! https://tria.ge/240321-a55dxagg71/behavioral1
||nnsnnqn.shop^
||shop.nnsnnqn.shop^
! https://tria.ge/240321-babc1sgh7v/behavioral1
||rrmuumm.shop^
||shop.rrmuumm.shop^

! https://github.com/jarelllama/Scam-Blocklist/issues/265
||luizeva.com^
||earnglobal.co^
||prostargift.com^
||quirkleaf.com^

! https://github.com/jarelllama/Scam-Blocklist/issues/264
||hft-fyfc.com^
||askotrade.net^
||binozy.com^
||monarchlibertygroup.cc^
||polybox.finance^
||sanexer.com^

! https://infosec.exchange/@iampytest1/112203822803380750
||toughknifes.com^
||darntoughfactory.shop^
||darnroughonline.top^
||darntoughonline.shop^
||darntoughonline-us.top^
||darntoughsales.shop^
||us-darntoughonline.top^
||vipbargainhub.com^
||vpdamai.com^

! https://github.com/jarelllama/Scam-Blocklist/issues/277
! https://dfpi.ca.gov/2024/03/25/fraudulent-bank-website-scam/
||beachcitiescommercialbank.com^
! my analysis: https://tria.ge/240404-xlg6laga74/behavioral1
! https://infosec.exchange/@iampytest1/112214528899229692
||americasfirstnationalbank.com^
||beachcitiescommercialbank.com.americasfirstnationalbank.com^
||www.beachcitiescommercialbank.com.americasfirstnationalbank.com^

! https://tria.ge/240408-bf8kpscb83/behavioral1
||spacex-invest.org^

! https://github.com/jarelllama/Scam-Blocklist/issues/289
||xcorepips.com^

! https://tria.ge/240410-31s5ashh6w/behavioral1
||x2-invest.com^

! https://github.com/RPiList/specials/issues/1532
! https://tria.ge/240411-nps8laaf48/behavioral1
||websharetday.online^

! https://tria.ge/240411-xhwjtahh93/behavioral1
||gettechreward.com^

! https://tria.ge/240411-1dm9esde97/behavioral1
||leanbiome-discount.store^

! https://tria.ge/240411-1jkqgsdh25/behavioral1
||gamersahead.com^

! https://tria.ge/240412-3g67tagc44/behavioral1
||daniellacribbs.lol^
||c.datingcompass.fun^

! https://tria.ge/240412-3jmwysgc75/behavioral1
||fatimaforaker.skin^
||i.datingcompass.fun^

! https://tria.ge/240412-3nkbmagd63/behavioral1
||oletaburford.buzz^
||hngfck.com^
||g.datingcompass.fun^

! https://tria.ge/240413-apvvjagg78/behavioral1
||mailtknnews.com^
||t.mailtknnews.com^
||russiagirlsonline.com^
||www.russiagirlsonline.com^
||charmdate.com^
||www.charmdate.com^

! https://github.com/hagezi/dns-blocklists/issues/2512
||slowmitter.top^
||d.slowmitter.top^
||singingfiles.com^

! https://github.com/jarelllama/Scam-Blocklist/issues/334
||gym-sharkfinland.com^

! https://github.com/hagezi/dns-blocklists/issues/2607
||93mobiles.com^

! spam email
||185.106.94.223^
! https://tria.ge/240511-qjc1jacc79/behavioral1
||serenespring.info^
||mta1.serenespring.info^
||naughtymatchvo1.com^
||onlyfwb.com^
||email.mg.onlyfwb.com^

! ---- PUPs ----

! https://virustotal.com/gui/url/c7e3137c4baaad64dcbbafd1938f581f264944fa1e2c1aa1ebcff77ed2959082/links
! https://safeweb.norton.com/report/show?url=https://www.totalav.com/ultra-deal?exit
! https://virustotal.com/gui/url/a15311f27a16908dfa87b8ce6cf0302d8c8260f32ce7171845fc73bd4d9769d2/detection
! https://virustotal.com/gui/url/dbc664226fd57c865f66bbaeae0d7270904c4ad735d0eb0ead4511e817392943/detection
! https://virustotal.com/gui/domain/www.totalav.com/detection
! https://quttera.com/detailed_report/totalav.com
! https://virustotal.com/gui/domain/totalav.com/community
! https://github.com/VernonStow/Filterlist/issues/3
! https://discussions.apple.com/thread/8226797
! https://malwaretips.com/threads/total-av-is-it-a-scam.80362/
! https://github.com/uBlockOrigin/uAssets/issues/9355
! https://github.com/notracking/hosts-blocklists/issues/756#issuecomment-1172973042
! https://tria.ge/230720-3qya9sbh2t/behavioral2
! https://app.any.run/tasks/cc0dd977-97e3-4b4a-833b-dfc4d5f0be55/
! https://tria.ge/230724-z8hfzsha64/behavioral1
! https://www.youtube.com/watch?v=PcS3EozgyhI
! *many* deceptive ads
||totalav.com^
||www.totalav.com^
! https://virustotal.com/gui/file/7a75c2c9695157772541cd426d057ff382d011a2791bcc3e511d94592ab0dbb7/relations
||api.totalav.com^
! Subdomains
||secure.totalav.com^
||url.totalav.com^
||support.totalav.com^
||blog.totalav.com^
||track.totalav.com^
||ajax.totalav.com^
||affiliate.totalav.com^
||livechat.totalav.com^
||advertisers.totalav.com^
||affiliates.totalav.com^
||my.totalav.com^
||assets.totalav.com^
||identity.totalav.com^
||login.totalav.com^
||download.totalav.com^
||static.totalav.com^
||adblock.totalav.com^
||sso.totalav.com^
||webshield.totalav.com^
||resources.totalav.com^
||signup.totalav.com^
||link.totalav.com^
||chat.totalav.com^
||click.totalav.com^
||stats.totalav.com^
||search.totalav.com^
||aff.totalav.com^
||news.totalav.com^
||blockpage.totalav.com^
||ext.totalav.com^
||smtpmail.totalav.com^
||articles.totalav.com^
||data.totalav.com^
||pda.totalav.com^
||firmy.totalav.com^
||portal.totalav.com^
||educa.totalav.com^
||cp.totalav.com^
||images.totalav.com^
||p.totalav.com^
||gallery.totalav.com^
||webshop.totalav.com^
||new.totalav.com^
||sklep.totalav.com^
||manitoba.totalav.com^
||wiki.totalav.com^
||pei.totalav.com^
||dl.totalav.com^
||bbs.totalav.com^
||schools.totalav.com^
||ts.totalav.com^
||hosting.totalav.com^
||test.totalav.com^
||live.totalav.com^
||eng.totalav.com^
||forums.totalav.com^
||lnx.totalav.com^
||lib.totalav.com^
||galeria.totalav.com^
||cloud.totalav.com^
||appauth.totalav.com^
||ww.totalav.com^
||email.totalav.com^
||u002fwww.totalav.com^
||shield.totalav.com^
||comassets.totalav.com^
||ru.totalav.com^
||l.totalav.com^
||lyncext.totalav.com^
||liaoning.totalav.com^
||www2.totalav.com^
||www1.totalav.com^
||imap2.totalav.com^
||internet.totalav.com^
||smtps.totalav.com^
||a.totalav.com^
||gin.totalav.com^
||supprt.totalav.com^
||mailout.totalav.com^
||imap1.totalav.com^
||mta1.totalav.com^
||eml.totalav.com^
||help.totalav.com^
||phishtest.totalav.com^
||math.totalav.com^
! other related
||totalwebshield.com^
||download.totalwebshield.com^
! This is owned by Protected[.]net, who also is responsible for the TotalAV scam. Can not get an exe as it requires me to pay first...
||scanguard.com^
||www.scanguard.com^
||my.scanguard.com^
||secure.scanguard.com^
||download.scanguard.com^
! An alias for TotalAV
! https://safeweb.norton.com/report/show?url=pcprotect.com
! https://virustotal.com/gui/url/523e692076d4eff5dba80a52bca9c01aa77b4e1dac6598aa78574cab1297497a/community
! https://www.mywot.com/scorecard/pcprotect.com
||pcprotect.com^
||www.pcprotect.com^
||secure.pcprotect.com^
! The company behind the TotalAV scam & pcprotect[.]com
! https://www.facebook.com/protectednet - they basically admitted to it. See https://www.facebook.com/protectednet/photos/a.685704165203904/1199676053806710/?type=3&theater
! Lesson to scammers: Don't post golf balls with the name of the scam product to facebook...
||protected.net^
||definition.protected.net^
||install.protected.net^
||ssprotectltd.com^
||www.ssprotectltd.com^
! scammers - now hiring
||protected-net.breezy.hr^
! A scam adblocker (use uBlock Origin, AdGuard, or even AdBlock Plus. They are all better then TotalAdBlock)
! VirusTotal scan of Android version: https://virustotal.com/gui/file/24ce64dfa6937c5ede674b2ba33d6818bfa9f8bb4d36ff8da9aff39e05b8e41c/detection
! https://apps.apple.com/app/totaladblock/id1564900435 (only two reviews?)
! https://tria.ge/231024-3lc5jace3w/behavioral1
! https://infosec.exchange/@iampytest1/111292640449421381
! https://tria.ge/231025-nk2zyagh81/behavioral1
! scam ads, as per ryanbr of EasyList 
||totaladblock.com^
||www.totaladblock.com^
||download.totaladblock.com^
||blockpage.totaladblock.com^
||stats.totaladblock.com^
||affiliates.totaladblock.com^
||affiliate.totaladblock.com^
||url.totaladblock.com^
||api.totaladblock.com^
||signup.totaladblock.com^
||track.totaladblock.com^
||my.totaladblock.com^
||support.totaladblock.com^
||login.totaladblock.com^
! https://infosec.exchange/@iampytest1/111565168288360998
||totadblock.com^
! https://app.any.run/tasks/eb07059f-c987-4366-9fed-8abfff016173
||totaladblock.protected.net^
||extension.protected.net^
||totaladblocker.xyz^
||www.totaladblocker.xyz^
! https://virustotal.com/gui/ip-address/34.117.171.15/relations
||34.117.171.15^
||totalwebshield.xyz^
||www.totalwebshield.xyz^
||secure.totalwebshield.xyz^
||login.totalwebshield.xyz^
||download.totalwebshield.xyz^

! as per https://github.com/iam-py-test/my_filters_001/issues/105, I have unblocked the main website but still block the registry cleaner, driver updater, etc
||winzipregistryoptimizer.com^
||download.winzipregistryoptimizer.com^
! WinZip ads
! https://virustotal.com/gui/url/cad59b610a95e69019638d171c2df89adb7eac183968e102e37396b806fa57bd/community
||winzipdriverupdater.com^
||slowness.winzipdriverupdater.com^
! https://virustotal.com/gui/url/e5e8624a07064fc3a296dcab3b0b578ac0ed6d841094489e8bec989653deb93c/detection
! https://virustotal.com/gui/ip-address/3.222.136.53/relations
||winzipultimatepccare.com^
||www.winzipultimatepccare.com^
||winzipdisktools.com^
||winzipsystemtools.com^

! It is a very bad sign when Windows Defender blocks a file, and it is not a false positive
! https://virustotal.com/gui/url/b27f7a631ee2bcf759ab82fa976980c2704c787ecd21abc8b591b7fc93d96ee1/detection
! https://github.com/iam-py-test/Assets-001/tree/main/PUPs/SpeedCat
! Installer
! https://virustotal.com/gui/file/3f4c860c2689984f7edab62d5a5459840dc9515ec2c7a94b6fea6878481a3992/detection
! https://www.hybrid-analysis.com/sample/3f4c860c2689984f7edab62d5a5459840dc9515ec2c7a94b6fea6878481a3992
! https://www.hybrid-analysis.com/sample/3f4c860c2689984f7edab62d5a5459840dc9515ec2c7a94b6fea6878481a3992/60f6d24211dc4473a31cd34a
! Other files and the app
! https://virustotal.com/gui/file/792bb2a2bd9f148d0b7dca1a98b4a310a30490c6523fc53a1f1e535e53d62389/detection
! https://virustotal.com/gui/file/57c40a9d2e592d968daa0f092abfa7abe2b41c47eb718adb770bd6930ec0dba4/detection
! https://virustotal.com/gui/file/f395839a00762a5e0428cb2cf596d80c56ba2be78cc3e6a3c89afb5c1f904db9/detection
! https://virustotal.com/gui/file/ff652f10ac6dbf8d4965f6624339c67e02715cf499ad8b26c1a683bd503e4136/detection
! https://quttera.com/detailed_report/pcspeedcat.com
||pcspeedcat.com^
! https://virustotal.com/gui/domain/pcspeedcat.com/relations
||cdn.pcspeedcat.com^
||vold.pcspeedcat.com^
||www.pcspeedcat.com^
||dev.pcspeedcat.com^
||access.pcspeedcat.com^
||vold-cdn.pcspeedcat.com^
||envoy.pcspeedcat.com^
||www-click-cf.pcspeedcat.com^

! Found in the shady Bing ads when searching for ADWCleaner
! Before downloading, ADWCleaner detected no adware. After downloading, ADWCleaner detected adware, which included the program. Program claims that buying the paid version (and entering private data) will fix issues with a clean VM. 
! This also adds unneeded start up tasks (why would it need start up tasks?). In total, Malwarebytes detected 99 threats.
! https://virustotal.com/gui/url/681984dd59e84ade5ad3c7b93842dd3b8b759992e7a5f5a1a2aa8dd04f4c823e/community
||mycleanpc.com^
! I saw the www in the results
||www.mycleanpc.com^
! Found using VirusTotal
||reviews.mycleanpc.com^
||m.mycleanpc.com^
||shop.mycleanpc.com^
||web.mycleanpc.com^
||blog.mycleanpc.com^
||app.mycleanpc.com^
||get.mycleanpc.com^
||dev-www.mycleanpc.com^
! related domains owned by the company used for paying - obtained when talking to the scammer
||ustechsupport.com^
||www.ustechsupport.com^$popup
||mycleanid.com^
||www.mycleanid.com^$popup
||iolostore.com^
||www.iolostore.com^$popup
! the main website for the company
||realdefen.se^
! other 'products' which all appear to be PUPs
||getmydrivers.com^
||www.getmydrivers.com^
||app.getmydrivers.com^
||dev-www.getmydrivers.com^
||qa-www.getmydrivers.com^
||stopzilla.com^
||cyberdefender.com^
||www.cyberdefender.com^$popup
||virusfix.com^
||www.virusfix.com^$popup
! Owned by them (they admit it)
! 4/12/2022: https://app.any.run/tasks/82c340da-6ab4-4398-86bd-2bd368c018ce
||iolo.com^
||www.iolo.com^
||secure1.iolo.com^

! https://github.com/DandelionSprout/adfilt/compare/c3d04d61c9...4a2d9d2efa
! link on https://www.windowsdispatch.com/fix-system-restore-0x81000203-error-code/
! https://virustotal.com/gui/url/41ada9c74d64537274173ea01f61fae7c7bdce2d660b64abb11546563fc6bf10/community
! The installer
! https://virustotal.com/gui/file/5d99408fc2f7bc85f2c4bc6dcd762008bfecd5c8dcaaacf9c9bdc2914ddd22b1/detection
! Files related to the PUP program
! https://virustotal.com/gui/file/fcf484d1009b4136c8655d32484babb0a284cbcb112ced7647194aea9e7688df/detection
! https://virustotal.com/gui/file/67252e30a59ddc58c273555bfd306343ec61e3f198a1c2d3eb30d8a93ec4fffa/detection
! https://virustotal.com/gui/file/5ef7eedfa7f283f180c1de80803e8d5c81fee09750ca044f018a098a94ad85c1/detection
! Malwarebytes detection - https://blog.malwarebytes.com/detections/pup-optional-restoro/
! Screenshots from anaysis - https://github.com/iam-py-test/Assets-001/tree/main/PUPs/Restoro (VM Env: Windows 10, Windows Defender on)
||restoro.com^
||www.restoro.com^
||techloris.com/go/restoro/
||techloris.com/lp/error8.php
||techloris.com/go/restoro-download/
! https://virustotal.com/gui/file/f019dab3172f6ce7808d45a5b5dea92354352e302219c02a84a280978f6eb166/community
||go.windowsreport.com/Restoro

! https://www.bleepingcomputer.com/virus-removal/page/2/
! https://virustotal.com/gui/url/1a381bcdd30c4fafbe50baa12a0446c18b875e2221330ffe2adec106f14904f4/community
! https://virustotal.com/gui/file/50abca232390db8eb28a17b9fa5386631857c7c14d1b43d0adcdaf90178a4f7c/community
! https://www.mywot.com/scorecard/iobit.com
! https://forums.malwarebytes.com/topic/29681-iobit-steals-malwarebytes-intellectual-property/page/5/#elControls_152972_menu
! https://virustotal.com/gui/url/1a381bcdd30c4fafbe50baa12a0446c18b875e2221330ffe2adec106f14904f4/community
! https://github.com/hagezi/dns-blocklists/issues/1794
||iobit.com^
! Subdomains
||cdn.iobit.com^
||stats.iobit.com^
||estore.iobit.com^
||update.iobit.com^
||jp.iobit.com^
||store.iobit.com^
||download.iobit.com^
||www.iobit.com^
||clouddownload.iobit.com^
||ru.iobit.com^
||search.iobit.com^
||purchase.iobit.com^
||cloud.iobit.com^
||interface.iobit.com^
||shop.iobit.com^
||mobile.iobit.com^
||m.iobit.com^
||startup.iobit.com^
||survey.iobit.com^
||checkout.iobit.com^
||sdupdate.iobit.com^
||giveaway.iobit.com^
||uninstall.iobit.com^
||de.iobit.com^
||codes.iobit.com^
||recorder.iobit.com^
||ascstats.iobit.com^
! download redirects to iobit
||windowserrorfixer.com^
||www.windowserrorfixer.com^
! itop vpn seems to be made by iobit and comes with bundled installs
||itopvpn.com^
||update.itopvpn.com^
||api.itopvpn.com^
||stats.itopvpn.com^
! https://tria.ge/231105-nq2lcsee2v/behavioral1
||itopupdate.com^
||update.itopupdate.com^
||stats.itopupdate.com^
! https://tria.ge/240511-bb4qysca5x/behavioral2
||downloaditop.com^
||update.downloaditop.com^

! https://virustotal.com/gui/file/4efd1bc1bdc12da1bbdc597cf3f37f0c65e582f42e353cf781ac1fe422dfa68c/detection
! https://virustotal.com/gui/file/69d9d162a040888164707b7e44f4709059ad45296a832c077c0dc91afed89c05/detection
! https://virustotal.com/gui/file/fd9dbb971a9995f6d146237933fbe27f18217d3cacbb6da121de4cc9590030be/relations
! https://github.com/iam-py-test/Assets-001/tree/main/PUPs/Restoro
! https://virustotal.com/gui/url/16766e8681f0bf474ec3238d4b6d7f33047f5f368abef0aac13001d2be0a757d/detection
! https://blog.malwarebytes.com/detections/pup-optional-reimage/
||2-spyware.com/reimage/download
||2-spyware.com/download/ReimageRepair
! https://virustotal.com/gui/url/16766e8681f0bf474ec3238d4b6d7f33047f5f368abef0aac13001d2be0a757d/detection
||reimageplus.com^
||cdnrep.reimageplus.com^
! More reimage - new name, new SHA256, new domain?
! https://virustotal.com/gui/url/3493793318d49332b789aba96de7937c468c5f6a20d6fdbf8da87832183c5d07/detection
! https://github.com/iam-py-test/Assets-001/tree/main/PUPs/Restoro_2
! https://virustotal.com/gui/file/fd9dbb971a9995f6d146237933fbe27f18217d3cacbb6da121de4cc9590030be/relations
||reimage.org^
||www.reimage.org^
! Nobody names their legit domain after malware and then is detected on VirusTotal
! https://virustotal.com/gui/url/deef544081c813ee971cfa78d8145e5a050ea5eccc3d5718b033d00b64c5f9f4/detection
||reimage.com^

! https://virustotal.com/gui/file/af7b36c0f9f48f35315877e3cd5efb83c1a122a043ea9228db7da9c1c3c3120b/community
! https://github.com/iam-py-test/Assets-001/blob/main/PUPs/MediaGet/mediaget_detections.jpeg
||mediaget.com^
! found by @DandelionSprout in https://github.com/DandelionSprout/adfilt/issues/253
||media-get.com^
||media-get.ru^
||mediagetplus.com^
||mgmgmg.com^
||23.111.31.137^
||23.111.88.207^

! https://virustotal.com/gui/file/05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748/detection
! https://virustotal.com/gui/url/f938821627f117b561598186343cf47ce5f75b89b8d149a3efe885f9eba51942/community
! https://virustotal.com/gui/file/a367e0562e612bc66729f3a4676bad849e5c3c32fad8223b5ea991e11604f5fe/details
! ADWCleaner detects malware after execution. File opens webpage with generic 'your system has issues' message
||driveragent.com^
! https://www.joesandbox.com/analysis/237782/0/html#domains
||secure.driveragent.com^
||driveragent-web-126513135.us-east-1.elb.amazonaws.com^$third-party

! https://virustotal.com/gui/file/61ddc79c421d13052f0acdb838d1a68d98c5e4eda0058f018f72a65474135d08/detection
! https://github.com/DandelionSprout/adfilt/issues/254
! https://blog.malwarebytes.com/detections/onesafe-software-com/
||onesafesoftware.com^
||vpn.onesafesoftware.com^
||blog.onesafesoftware.com^
||drivers.onesafesoftware.com^
||updates.onesafesoftware.com^
||support.onesafesoftware.com^
||cdn.onesafesoftware.com^
||subscriptions.onesafesoftware.com^
||notifications.onesafesoftware.com^
||stats.onesafesoftware.com^
||www.onesafesoftware.com^

! https://virustotal.com/gui/file/a6e89d2bb1c2da1d852fb8e248f39cf7b3d4b0ea05a8d8f343d1b8e74d271d43/relations
||driversupport.com^
||front.driversupport.com^
||secure.driversupport.com^
||aloha.driversupport.com^
! "SolveIQ"?
||apps.solveiq.com^
||preview.solveiq.com^
||auth.solveiq.com^

! Taken from DandelionSprout's Anti-malware list - which is at https://github.com/DandelionSprout/adfilt/blob/master/Dandelion%20Sprout's%20Anti-Malware%20List.txt and which is maintained by https://github.com/DandelionSprout -  and verified
||driver-soft.com^

! https://github.com/blocklistproject/Lists/issues/497
||pcspeedup.en.softonic.com^
||tweakbit.com^
||static.tweakbit.com^
||www.tweakbit.com^
||debuglogs.tweakbit.com^
||update.tweakbit.com^
||dynamicdownloads.tweakbit.com^
||downloads.tweakbit.com^
||store.tweakbit.com^
||cdn.tweakbit.com^
||aff.tweakbit.com^
||mail.tweakbit.com^

! Original inspection
! disable uBlock Origin and go to https://www.google.com/search?q=clean+up+computer+to+run+faster&source=hp&ei=Y4KzYIrUL-rP0PEPqM2liAc&iflsig=AINFCbYAAAAAYLOQcwKl4vglkAEcsALPhO6XEyguHxPP&oq=clean+up+comp&gs_lcp=Cgdnd3Mtd2l6EAEYATICCAAyAggAMgIIADICCAAyBQgAEMkDMgIIADICCAAyAggAMgIIADICCAA6DgguELEDEMcBEKMCEJMCOgsILhCxAxDHARCjAjoFCAAQsQM6CAgAELEDEIMBOggILhDHARCjAjoOCC4QsQMQgwEQxwEQrwE6CAgAEOoCEI8BOggILhCxAxCDAToICC4QxwEQrwE6BQguELEDOggILhCxAxCTAjoICAAQsQMQyQM6BQgAEJIDOgsILhDHARCjAhCTAjoCCC46BQguEJMCUOUoWKCDAWDakwFoAnAAeACAAYoDiAGaFJIBCDAuMTQuMC4xmAEAoAEBqgEHZ3dzLXdperABCg&sclient=gws-wiz
! https://virustotal.com/gui/url/2f44cf878800c082d5fefb8326cf384fe12393ecfcca05e64903c5888f4c762c/detection
! https://virustotal.com/gui/url/c6290089eb08d05375650bfb7778713e1e9443ac1d8d180df44bd8ddd49124f9/detection
! https://virustotal.com/gui/domain/www.pchelpsoft.com/relations
! https://www.mywot.com/scorecard/pchelpsoft.com
! https://safeweb.norton.com/report/show_mobile?name=https://www.pchelpsoft.com/pc-cleaner/lp1-ms-us/?tracking=PH_EN_PP_GO_SE_PCC_US&keyword=speed%20up%20my%20pc&campaignID=ADWORDS&gclid=EAIaIQobChMIsOqVwrTx8AIV9xmtBh17swHGEAAYASAAEgLr1fD_BwE
! https://virustotal.com/gui/url/3cfe4ec34704092b5ad0c03b1f9566b538c11e3e0434a73991cdc2694db26582/detection
! https://www.urlvoid.com/scan/pchelpsoft.com/
! https://sitecheck.sucuri.net/results/pchelpsoft.com
! https://www.fortiguard.com/webfilter?q=pchelpsoft.com
! Inspection on 23/7/2021
! https://virustotal.com/gui/url/3cfe4ec34704092b5ad0c03b1f9566b538c11e3e0434a73991cdc2694db26582/detection
! https://safeweb.norton.com/reviews?url=pchelpsoft.com
! https://www.mywot.com/en/scorecard/pchelpsoft.com
! Setup file (installer) - https://virustotal.com/gui/file/7ab506784dcc49c916cdff2076132dafc881ac268e54aba39d6af2ca6ce0c775/details
! Related files
! https://virustotal.com/gui/file/04ef20ed8a783aaa91082865ed99c079cf2bf9f67908d536fdb9e227b19401f0/detection
! https://virustotal.com/gui/file/192dc080f0c52222e03c074e3a38a8b3cc5b31605457fd6acd447bf7488a89d8/relations
! https://virustotal.com/gui/file/40157e1981b97206658667927fbdc484c7e9615591884cfed2d6cadc9e3f1b4c/detection
! A 'driver updater' it wanted me to install - https://virustotal.com/gui/file/965bf402594ee539ce61d2a593c421b1c7ed6e1969369ae4a7866c17b2281a3c/detection
! https://forums.malwarebytes.com/topic/200216-removal-instructions-for-pccleaner/
! Screenshots - https://github.com/iam-py-test/Assets-001/tree/main/PUPs/PCHelpSoft
! 19/9/2022: https://app.any.run/tasks/3c8b1d38-de18-488a-9e3f-62b3354c17e8
! 6/11/2022: https://app.any.run/tasks/da8a44c3-965f-4fd6-816d-b5ae16235f62 (https://virustotal.com/gui/file/5475c9cff70482b8b5bf2c31395f9463261313991b41743686e4c8c43e53df0b/detection)
||pchelpsoft.com^
||www.pchelpsoft.com^
||cloud.pchelpsoft.com^
||cda.pchelpsoft.com^
||cdn.pchelpsoft.com^
||webtools.pchelpsoft.com^
||pchelpsoft.net^
||www.pchelpsoft.net^

! https://virustotal.com/gui/url/27307acb5b127114423ed0d7c63aaed0013d1833f56c158a3b049f8d1c98dcbc/detection
! Download button redirects to advancedsystemrepair.com
||pccleaner.com^
! The PUP from this website looks like a past one; maybe a variant or another download location
! https://github.com/iam-py-test/Assets-001/tree/main/PUPs/PCCleaner_1
||advancedsystemrepair.com^
||support.advancedsystemrepair.com^
||secure.advancedsystemrepair.com^
||lp.advancedsystemrepair.com^
||track.advancedsystemrepair.com^
||www.advancedsystemrepair.com^
||checkout.advancedsystemrepair.com^

! Found this PUP on someone else's computer, so I decided to figure more about it. It does look very old; even the UI sometimes looks like Windows 7 despite the VM running 10
! The (working) installer (from Softonic) - https://virustotal.com/gui/file/863adfe03c1ea35c424817274eabe4eef02fe4a2d6428f8718e61655fb8bc49c/detection
! The program (according to Malwarebytes's IOC report) - https://virustotal.com/gui/file/2aad06624e9b698ec0dc0276b433c606a4858d6585028cd658ae7c697358ffec/detection
! https://blog.malwarebytes.com/detections/pup-optional-slimcleanerplus/
! All the domains seem to be related to this PUP
! https://virustotal.com/gui/url/f7be15d28340acb7db31f63a62a26bad1253824f2424117a816203950e86fd22/community
||slimware.com^
! https://virustotal.com/gui/url/440e39a20d7e01064269dadfc38eafd80c8534f7391f2c1ef7ac41c10d9c4e20/detection
||slimcleaner.com^
||www.slimcleaner.com^
! https://virustotal.com/gui/url/946a5c2295cfef547f162350af93257df55d6b2103a0ce2e84b241cf727a81f6/detection
||slimwareutilities.com^
! The executable from the website (https://virustotal.com/gui/file/d9103347f6043f0266a6480b6c794a4ee9f07800db43b6301920fe97587066d2/detection) seemed broken, but this one (maybe an older/newer mirror) works
||slimcleaner-plus.en.softonic.com^
! Other TLDs
||slimcleaner-plus.softonic.com.tr^
||slimcleaner-plus.softonic.vn^

! https://github.com/iam-py-test/investigations/blob/main/2021/11/5/1.md
||windowserrorhelp.com^
||certified.windowserrorhelp.com^

! Spyhunter is far from legit - and this company sues almost anyone (i.e. Bleeping Computer - https://blog.malwarebytes.com/security-world/2016/02/bleepingcomputer-defends-freedom-of-speech/, Malwarebytes - https://press.malwarebytes.com/2021/09/29/malwarebytes-wins-dismissal-of-enigma-lawsuit-in-final-ruling/) 
! https://www.mywot.com/en/scorecard/enigmasoftware.com
! https://github.com/gorhill/uBlock/wiki/Software-known-to-have-uninstalled-uBlock-Origin
! https://en.wikipedia.org/wiki/SpyHunter_(software)
||enigmasoftware.com^
||www.enigmasoftware.com^
||installer.enigmasoftware.com^
||download.enigmasoftware.com^
||dl.enigmasoftware.com^
||instcfg.enigmasoftware.com^
||tt.web.enigmasoftware.com^
||myaccount.enigmasoftware.com^
||purchase.enigmasoftware.com^
||spyhunter.enigmasoftware.com^
||spyhunter-update.enigmasoftware.com^
||download2.enigmasoftware.com^
||spyhunter.com^
||www.spyhunter.com^
||spyhunter-download-v2.b-cdn.net^
! https://tria.ge/230810-2gkhdahd53/behavioral1
||enigmasoft.net^
||rh.downloads.enigmasoft.net^

! https://github.com/iam-py-test/my_filters_001/issues/84
||mackeeper.com^

! https://virustotal.com/gui/file/088cbcec6b80eba99eb691968e0f972935aae301e9cb6d1c6133699530dd5621/community
||secure-browser.io^
||d1z0mfyqx7ypd2.cloudfront.net/securebrowser.io/

! locks your screen and just creates a link to their website on your desktop. Malware?
||zipfileslikeapro.net^
||use.zipfileslikeapro.net^
||www.zipfileslikeapro.net^
||goto.searchproonline.com^
||searchproonline.com^

! https://github.com/uBlockOrigin/uAssets/issues/11176
||nearbyme.io^
||m.nearbyme.io^

! https://web.archive.org/web/20230604193437/https://twitter.com/iam_py_test/status/1488163521540075524
||outbyte.com^
||testedforyou.net^
! from an infected VM
||lp.pcsystemfix.com^
||pcsystemfix.com^
||download.pcsystemfix.com^
! article on perflib errors
||xoomber.com^

! https://forums.malwarebytes.com/topic/283588-mb-cant-find-malware/
! https://forums.malwarebytes.com/topic/293374-aasearchtoolshub/
||searchtoolshub.com^
||find.searchtoolshub.com^

! Some scam redirects brought me here (https://web.archive.org/web/20230604193632/https://twitter.com/iam_py_test/status/1497351777754050562 - https://virustotal.com/gui/file/2e68dbec330d7ebe567dcbb67a1dffe83f6f0c278664b60f3edeee684edfe7ff/relations)
||drivermax.com^

! adware downloader - https://app.any.run/tasks/d1918395-7080-4292-9a71-1059bc7a90cf
||sway.office.com/flj90JK1oswcTJEO^
||certatd.ru^

! Bundled installer & PUP
||sysdriverupdater.com^
||www.sysdriverupdater.com^

! This is just Advanced System Repair Pro
||regcure.com^
||www.regcure.com^
||directbrand.com/dl/asr_regcure.php^

! https://blog.malwarebytes.com/threat-analysis/2022/06/forced-chrome-extensions-keep-reappearing/
||activesearchbar.me^
||customsearchbar.me^
||securedatacorner.com^
||wincloudservice.com^
! https://forums.malwarebytes.com/topic/286395-microsoft-edge-custom-search-bar-extension-redirects-to-rbfastsearchme/
||rb.fastsearch.me^
! https://forums.malwarebytes.com/topic/287338-browser-hi-jacker-royb2fastsearchme/
||royb2.fastsearch.me^

! adware
||pdfconverterpower.net^
||downpdfpwr.com^
||searchpoweronline.com^
||goto.searchpoweronline.com^
||www.searchpoweronline.com^
! https://forums.malwarebytes.com/topic/295131-pdfpower-pdfshark-pdfsuperhero-pdftodocpro-pdfmagic/#comment-1556224
||gifsearchutils.com^
||start.gifsearchutils.com^
||pdfsharkapp.com^
||start.pdfsharkapp.com^
||searchmagiconline.com^
||start.searchmagiconline.com^
||pdfsuperhero.com^
||stats.pdfsuperhero.com^
||bl.searchpoweronline.com^

! https://forums.malwarebytes.com/topic/289030-mbam-browser-guard-identifying-malware-but-mbam-not-removing-malware/
||mysearchengine.co^

! https://github.com/AdguardTeam/AdguardFilters/issues/128029
||freddostagione.com^
||search.freddostagione.com^
||147.135.253.55^
||search.motherpipe.net^
||humanverified.net^
||video-ad-skipper.com^
||search.becovi.com^
||luminosoocchio.com^
||quick-speedtest.com^
||husmicto.com^
||splendidus.net^
||optimusquaero.com^
||potenzamano.com^
||tutatagliente.com^
||megliolavoro.com^
||osservareimmaginare.com^
||desideriosoldi.com^
||sottilesezione.com^
||alcunirisposta.com^
||www.humanverified.net^
||search.potestainsula.com^
||search.husmicto.com^
||search.splendidus.net^
||search.optimusquaero.com^
||search.potenzamano.com^
||search.tutatagliente.com^
||search.megliolavoro.com^
||search.luminosoocchio.com^
||search.osservareimmaginare.com^
||search.avantiwendo.com^
||search.desideriosoldi.com^
||search.sottilesezione.com^
||search.alcunirisposta.com^
||search.thecanem.net^

! https://github.com/AdguardTeam/AdguardFilters/issues/132840
||adblocker-app.info^

! https://blog.malwarebytes.com/detections/pup-optional-bytefence/
! https://virustotal.com/gui/file/21dfa4ed47de7007c0fb6eadb3f94d2e847b3f4e301767d2320623f02f0926ba
! https://virustotal.com/gui/file/d41405553da0287be81722125b35405ad90923e7aa0631b5e5c6ab80358355ca
! https://safeweb.norton.com/reviews?url=bytefence.com
! https://www.mywot.com/scorecard/bytefence.com
||download.cnet.com/ByteFence-Anti-Malware/
||bytefence.com^

! https://www.youtube.com/watch?v=2tW_PDVfT-E
! https://virustotal.com/gui/file/1c45ac42e4486ae5114cf287626ffb02eb03675f667d076d5c8f886ee0016d26/detection
! https://github.com/iam-py-test/Assets-001/tree/main/PUPs/Auslogics_PUP_regclean
! https://virustotal.com/gui/file/a54dffea1703732c3daf043462c289f4c9fc57fb27e1e9cc099b0cc03835940e/detection
! https://forums.malwarebytes.com/topic/199170-false-positive-with-auslogics-boostspeed/#elControls_1116195_menu
||auslogics.com^
||www.auslogics.com^

! https://virustotal.com/gui/file/1d26c8e2760b9d95e344dc93e4516c88c23bae5af1e888b2769186520f53021d/detection
! https://virustotal.com/gui/url/c9d507f4fe1720bb0b70a799abfd548f315694f59eebea676204da1cbaee4b4f/detection
! https://virustotal.com/gui/file/bba00552bb0a562a00aa70c8425e48bb1b407a72f84df6c8f69f0bf44fabf310/detection
! https://virustotal.com/gui/file/0dcf7e52492de09df39f7b1f7996d61033c6f61b43d38990f43b45dd530dcdb9/relations
! https://www.hybrid-analysis.com/sample/1d26c8e2760b9d95e344dc93e4516c88c23bae5af1e888b2769186520f53021d
! https://www.hybrid-analysis.com/sample/1d26c8e2760b9d95e344dc93e4516c88c23bae5af1e888b2769186520f53021d/60a4789f1522974edf38bd58
! https://www.hybrid-analysis.com/sample/bba00552bb0a562a00aa70c8425e48bb1b407a72f84df6c8f69f0bf44fabf310
! https://github.com/iam-py-test/Assets-001/tree/main/PUPs/ashampoo
||ashampoo.com^

! https://virustotal.com/gui/url/9979729afeff4472121a6faa8d4a4b7c885a5f391b082d50585bf16929597d4e/community --> https://virustotal.com/gui/file/c9bb2af73703f81a31ae5a3dedbf6eebf404256b679303111c1dedf0e24879db/community
! https://app.any.run/tasks/d2533d89-8e5e-4fc6-b110-bafc153c3636 (my analysis)
! walliant: https://www.youtube.com/watch?v=91w4rzBTP5o
||riversnails.club^
||walliant.com^

! clone of another screenlocker adware
||gifsmakerpro.com^
||www.gifsmakerpro.com^

! https://forums.malwarebytes.com/topic/293346-malwarebytes-not-detecting-virus-highjacking-my-search-engine-in-chrome/
! https://www.bleepingcomputer.com/forums/t/788099/howdy-yall-i-could-use-some-help-antivirus-and-self-hacking/
||mobilisearch.com^
||mobility-search.com^

! another clone of ziprar thing (Adware.SearchLightPro)
||imagelighteditor.com^
||www.imagelighteditor.com^
||downloadimglight.com^
||searchlightpro.com^
||start.searchlightpro.com^
||dsc.searchlightpro.com^

! https://forums.malwarebytes.com/topic/283015-pupoptionalwinsweeper
! https://forums.malwarebytes.com/topic/300427-unable-to-start-in-a-normal-mod-of-windows/?do=findComment&comment=1579090
||solvusoft.com^
||www.solvusoft.com^
||exefiles.com/*/recommended/winthruster/

! random ad
||totalsystemcare.com^
||www.totalsystemcare.com^
||safebytes.com^
||driverassist.com^

! browsing YouTube without an adblocker
||customsearchtool.com^
||home.customsearchtool.com^
||config.customsearchtool.com^
||hp.customsearchtool.com^
||imp.customsearchtool.com^
||d3pxa1onb1zy4q.cloudfront.net/custom_search_tool-2022.7.15-fx.xpi^

! https://forums.malwarebytes.com/topic/293616-google-doc-fake-extension-not-detected/ (account required)
||gosearches.gg^

! https://forums.malwarebytes.com/topic/293620-adwcleaner-wont-run/
||search-fine.com^

! https://github.com/uBlockOrigin/uAssets/issues/16582 (without an adblocker)
||easyprint.app^
||cdn.easyprint-cdn.app^
! https://virustotal.com/gui/url/c7cdd1eaf651fbf4446d189d91b52b0c6a5811fb70db18b3eec1fa575057163a/detection
||freshysearch.com^
||cdn.freshysearch.com^

! doesn't seem to do much, but clearly not legit
||tor-browser.app^

! two search engine hijackers
! https://virustotal.com/gui/url/1ca49bde04ac00c79b259a4a02b041d91c512ca55a6d0e839f69010d0bc32061/detection
||pdftab.com^
||cdn.pdftab.com^
||findmanualsnow.com^

! ran across this while looking for DDNS services
||ww1.pwnz.org^
||thesafersearch.com^
||get.thesafersearch.com^

! The makers of such wonderful programs like "Driver Genius 22" and "PC Cleaner"
||avanquest.com^
||www.avanquest.com^
||webtools.avanquest.com^

! 'Wave browser' which is just a scummy version of Chrome
! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-968062965
||wavebrowser.co^
||download.wavebrowser.co^
||wavebrowser.com^
||dl.gowavebrowser.com^
||gowavebrowser.com^

! DLL Helper
! https://virustotal.com/gui/file/675a72bb2b3ea39beafc73e8faf31b85b58b0dcc169b10649d5f49341936a379
||dll-helper.en.softonic.com^

! search engine hijacker
||manualsdirectory.org^
||tab.freshymanuals-site.com^
||search.freshy.com^

! https://github.com/uBlockOrigin/uAssets/issues/17568
||wigglewurm.com^
||n.wigglewurm.com^

! an infected VM --> this extension hijacks the search engine
||getsecurify.com^
||www8.getsecurify.com^
||chrome.google.com/webstore/detail/browsing-overview-by-secu/njfkgeajknkffkngdmjmjninkbgjedlo/
||mysecurify.com^
||search.mysecurify.com^
||ext.mysecurify.com^

! an infected VM --> this extension hijacks the search engine claiming it protects your searchs
||privacykeeperapp.com^
||get.privacykeeperapp.com^
||chrome.google.com/webstore/detail/privacy-keeper/acdkbikhkmpbfdmfmcogpnjchcniiipa^
||privacykeepersearch.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/121797
||speak-text-tab.com^
||search.speak-text-tab.com^

! https://github.com/uBlockOrigin/uAssets/issues/17880
||office.org^

! https://github.com/uBlockOrigin/uAssets/issues/17960
||templatesearch.org^

! https://www.bleepingcomputer.com/forums/t/785431/26-pup-found-today-what-to-do/
||securybrowse.com^
||search.securybrowse.com^
||ext.securybrowse.com^
||chrome.google.com/webstore/detail/my-family-protect-by-secu/ghaojflgonndmkaknkocggkmkbjjbgho^

! https://github.com/uBlockOrigin/uAssets/issues/18103
! (my analysis) https://app.any.run/tasks/4a29352e-fc49-4c59-bb96-0acda5544d53
||gamefabrique.com^

! https://tria.ge/230518-m51f6sae43/behavioral2
||chrome.google.com/webstore/detail/my-notes-extension/jekjflpbfegfepdioebbpanjkjhcihoi^

! https://forums.malwarebytes.com/topic/298186-accidentally-visited-potential-maliciousmalware-website/
! (my analysis) https://tria.ge/230523-zqkhmahd85/behavioral2
||doodrdash.com^
||thale-ete.com^
||fivetrafficroads.com^
||dkjfhuyd.fivetrafficroads.com^
||chrome.google.com/webstore/detail/weather-in/jpflgehebdhjjcdojdloemfeflelhmoh^
||weather-in.xyz^
||trk.weather-in.xyz^
||search.weather-in.xyz^

! linkverse PUP
||linkvertise.download^

! https://github.com/StevenBlack/hosts/issues/2339
||serasearchtop.com^

! https://tria.ge/230601-z9q5hsha6v/behavioral1
||safeplexsearch.com^
||addons.mozilla.org/*/firefox/addon/safeplex-search/^

! internal 
||fontdeterminer.com^

! https://tria.ge/230705-n3traaca92/behavioral1
||ofoseveralyea.info^
||ratefinaukncei.info^

! adware
||pdfsuperhero.azureedge.net^
||pdfconverty.com^

! chromium based adware
||gettoptemplates.com^
||downloadonelaunchnow.com^
! https://tria.ge/230805-1lv91agc6x/behavioral1
||getconvertmyfile.com^

! https://0xacab.org/my-privacy-dns/matrix/-/issues/649666
! https://tria.ge/230805-rgmydsee8s/behavioral1
||websearchextension.info^
||containers.websearchextension.info^
||cloudfront.websearchextension.info^
||websearchextension-api.info^
||api.websearchextension-api.info^

! https://github.com/StevenBlack/hosts/issues/2403
||madqudden.com^
! https://github.com/StevenBlack/hosts/issues/2408
||santknow.com^

! https://forums.malwarebytes.com/topic/301185-i-ran-galacticshooterexe/#comment-1583465
||segoonow.com^

! https://forums.malwarebytes.com/topic/301473-pupoptionalcoduit/
||conduit.com^
||search.conduit.com^

! https://github.com/hagezi/dns-blocklists/discussions/1515
||techadsology.com^

! sells driver updater snake oil
||drivereasy.com^

! https://forums.malwarebytes.com/topic/303209-need-help-with-removing-trojan-virusvirtool32/?do=findComment&comment=1594712
||trovi.com^
||www.trovi.com^

! https://github.com/iam-py-test/my_filters_001/issues/119
! https://forums.malwarebytes.com/topic/303863-cryptpkocryptpko1-and-cryptsigcryptsig1-in-registry-and-cant-delete/
||sensorstechforum.com^

! https://tria.ge/231028-pvxzeabb9z/behavioral1s
||donwnaloadeluzal.cfd^
||ivedmanyyea.org^
||townrusisedprivat.info^

! snake oil, bundles software
! https://yewtu.be/watch?v=bIpYJoE7CxA
! https://spyware.neocities.org/articles/ccleaner
||ccleaner.com^

! https://nitter.net/gorhill/status/1352651716265713665
! https://palant.info/2020/10/28/what-would-you-risk-for-free-honey/
! https://infosec.exchange/@iampytest1/111069238525172731
||joinhoney.com^

! https://tria.ge/230821-2bt5maad51/behavioral1
! https://web.archive.org/web/20231120191617/https://forums.malwarebytes.com/topic/304687-pupoptionalfortect/
! https://infosec.exchange/@iampytest1/110736203666880292
||fortect.com^
||cloud.fortect.com^

! https://tria.ge/231121-x5hw8sgc87/behavioral1
||quickdriverupdater.com^
||www.quickdriverupdater.com^
||webcf.quickdriverupdater.com^
||cf.quickdriverupdater.com^
||qip.quickdriverupdater.com^
||qdu.quickdriverupdater.com^
||d8kkkzr1spalx.cloudfront.net/win/qdu/setup/*/qdurtsetup.exe
||dpsro.com^
||www.dpsro.com^

! https://github.com/collinbarrett/FilterLists/issues/3794
||rakuten.ca^
||ebates.com^
||www.ebates.com^

! https://github.com/uBlockOrigin/uAssets/pull/17981
||aadvantageeshopping.com^

! https://github.com/iam-py-test/my_filters_001/issues/119
! https://tria.ge/230817-a16feaee47/behavioral1
||combocleaner.com^
||www.combocleaner.com^
||pcrisk.com/files/CCSetup.exe^

! tricks users into installing an allowlist - unknown source
||work-ink.github.io^

! https://www.reddit.com/r/uBlockOrigin/comments/143k8lm/
||topcashback.co.uk^
||topcashback.com^

! "free registry cleaner"
||download.freedownloadmanager.org/Windows-PC/AML-Free-Registry-Cleaner/

! https://forums.malwarebytes.com/topic/306163-silentcryptominer-removal-help-needed/
||mysearchdial.com^

! origin unknown (forgot to add a comment here)
! TODO: reverify
||driveridentifier.com^
! driverpack
||driverpack.io^
||driverpack.tilda.ws^
||dwrapper-prod.herokuapp.com^


! https://virustotal.com/gui/url/48a9e88e0b6cf59fac14588d252d9bb6b936ec2fd847e832d17fdb76322b35d3/detection
! https://virustotal.com/gui/file/e66db6f687eacf9852542ab583f4d77191965f3a8d6c2e726f4e6b8b83b4f390/detection
! https://virustotal.com/gui/file/93f1afd730eb30421d8e7cae9fc79cbee918c4b0a75d68bf64d34d2cc99d29f0/detection
! To remove, run ADWCleaner (https://malwarebytes.com/adwcleaner) and follow instructions.
||speedupmypcfree.com^
! https://virustotal.com/gui/domain/speedupmypcfree.com/relations
||www.speedupmypcfree.com^

! https://windowsreport.com/extend-windows-laptop-battery-life/
! https://www.hybrid-analysis.com/sample/0dd66edadbe93df04f6759e5549d3e76b5bfcb292ba6f6a6139903dd705ced6a
! Tested on VM: Removed by ADWCleaner
! Switched to document as per https://github.com/uBlockOrigin/uAssets/issues/9974
||driverfix.com^
||www.driverfix.com^

! https://tria.ge/240427-2e441aac8x/behavioral1
||pdfpilotapp.com^
||application.pdfpilotapp.com^
||por.pdfpilotapp.com^

! https://yewtu.be/watch?v=m9d-fXl3Z8k
! my analysis: https://tria.ge/240505-t81dxafb3s/behavioral1 (cloudflared)
||restorex360.com^
||www.restorex360.com^

! ---- Spam ----

! https://forums.malwarebytes.com/topic/281397-how-to-update-my-adwcleaner/
||24hourhtmlcafe.com^

! https://forums.malwarebytes.com/topic/281787-how-many-types-of-malware-are-there/ (https://web.archive.org/web/20211214132150/https://forums.malwarebytes.com/topic/281787-how-many-types-of-malware-are-there/) -> hxxpx[:]//ilovealgarve[.]net[/]web-football-no-agents[/])
||ilovealgarve.net^

! https://web.archive.org/web/20211222121009/https://forums.malwarebytes.com/topic/282084-keeping-laptop-safe/ -> hxxpx[:]//nbgpapartmani[.]com[/]register-web-ball-ufadeal[/]
||nbgpapartmani.com^

! https://forums.malwarebytes.com/topic/282082-hi-working-a-spreadsheet-more-than-8-years-history-mb-crashed-it/ (https://web.archive.org/web/20211222121637/https://forums.malwarebytes.com/topic/282082-hi-working-a-spreadsheet-more-than-8-years-history-mb-crashed-it/) -> hxxpx[:]//superagentconcierge[.]com[/]casino-ebet-entrance[/]
||superagentconcierge.com^

! https://forums.malwarebytes.com/topic/283348-update-ios-15/ (https://web.archive.org/web/20220202172538/https:/forums.malwarebytes.com/topic/283348-update-ios-15/)
||binaryreviewsrace.com^

! https://forums.malwarebytes.com/topic/283347-update-ios-15/ (https://web.archive.org/web/20220202172612/https:/forums.malwarebytes.com/topic/283347-update-ios-15/)
||stormlordpublishing.com^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1029244954
||quickdates1.com^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1120210042
||fuckbookmobile.com^
||www.fuckbookmobile.com^

! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-1179770663
||disqus.com/by/disqus_AIqzI15v88/^

! https://web.archive.org/web/20221007114132/https://forums.malwarebytes.com/topic/290873-whats-the-hottest-temperature-in-your-city/
||rathbunlakeassoc.com^
||ufadeal.info^

! https://web.archive.org/web/20221206113456/https://forums.malwarebytes.com/topic/292706-top-cell-phone-apps-and-games-for-your-iphoneo-verjaardagsherinnering-nu/
! https://forums.malwarebytes.com/topic/292707-spam-post-on-this-forum/ (account required)
||mhapks.com^

! GH spam, i.e. https://github.com/tesla-android/issue-tracker/discussions/162#discussioncomment-4551799
||4.fo^
||mylocaldates1s.com^
||in.sv^
||static.imghst-de.com/eb01eaf3-369a-423f-a31e-c4221a2ca42d.png^
||trk-click.pshtrk.com^
! https://github.com/DandelionSprout/adfilt/commit/e83dc45b60a61c6097b8c40605855a80e3282901
||link.sv^
! https://virustotal.com/gui/url/6bbc5fc50b84711644db9739cab16fbdd5659b3d6b82dbde0a3a82427e6f03b9/community
||to.sv^
||go.sv^

! https://virustotal.com/gui/url/1f273d4cd56060082b8a598514f975bf4592a5f6be5f77e05f7c453266edaaad/community
||scuekpza.ws^

! https://forums.malwarebytes.com/topic/273013-android-unknown-chrome-hijacker/page/3/#comment-1553668
||thedrivingtutors.com^

! tons of sites with keyword spam who link to each other
||sjs.sold.yachts^
||i.pauj0foas709824.shop^
||er.jrwgjwrgu1243thfd.shop^
||kt.rakwbiznesie.pl^
||dnar.newsnewsyes.yachts^
||rrwaee.dbbdh.top^
||gvcnm.newsnewsfor.shop^
||ts475173759.mm.bing.net^
||qwj.krowkavet.pl^
||r.util.yachts^
||ispc.chungcumoi.top^
||qmzux.usesgasek.top^
||yfvqf.changwonanma.top^
||le.krowkavet.pl^
||vxh.news1.vn.ua^
||dhqn.podrozegruzja.pl^
||hlcix.uiwangculzang.top^
||slxoy.baloon.yachts^
||b.gulospspo.top^
||uor.kabuyutannusantara.top^
||xudkkk.chungcumatphohn.top^
||r.greckieskarby.pl^
||sbqxqm.quite.yachts^
||ewe.kouzinti.shop^
||z.paseqx.top^
||nue.kevinashen.top^
||kbako.slowowarszawy.pl^
||ikdfpc.kevinashen.top^
||ikde.kabuyutannusantara.top^
||mbv.new-host.shop^
||vvf.dsgjhdsf98dsfdfs.shop^
||afatfg.sukuncl.top^
||tcln.util.yachts^
||gcz.regeokna.pl^
||hiepqu.wulktir.pl^
||yub.danielkordos.pl^
||wbhji.planetacripto.top^
||wq.chungcumatphohn.top^
||upuymn.semihangingdumptrucktractoroiltankaoheng.top^
||xkltl.jaminjos.shop^
||jgo.softwarepublicoregionalbeta.net^
||hmc.gulospspo.top^
||x.blackoakgallery.pl^
||xeezv.xuzhouzhuangxiu.top^
! similar
||fwiu.kohaito.shop^
||iwmfo.simpletalent.pl^
||kxirue.teplotrassa.yachts^
||wmwei.kukallooy.yachts^
||mv.grizli.yachts^
||eybg.bhpprotech.pl^
||ktehf.out.yachts^
||pkxj.dbbdh.top^
||clo.grizli.yachts^
||bkxhb.xiaochong2021.top^
||jyvg.news1.vinnica.ua^
||hb.slowowarszawy.pl^
||sao.24hfastplumbingservice.cyou^
||vleuet.ptnfd2020.pl^
||tbs.s88s.top^
||qua.narlofkrc.top^
||sqfjpd.colko.skin^
||tglt.adamoption.top^
||hsecx.branchmodern.news^
||wypai.alanwin.top^
||v.kabuyutannusantara.top^
||bl.jaminjos.shop^
||pmwvr.kosinka.yachts^
||wuxjqu.nasanet.top^
||qyt.dotoplo.pl^
||xnex.newsnewsyes.yachts^
||hq.nhabatang.top^
||eiiiy.fuflo.yachts^
||geraldineblog.top^
||cpp.babnews.cfd^
||hkx.new-host.shop^
||r.regeokna.pl^
||xogbx.zoxkk.top^
||kan.sdgoiyhds87.shop^
||xiaochong2021.top^
! even more
||planetacripto.top^
||yxsax.planetacripto.top^
||wrx.rakwbiznesie.pl^
||yf.news-ok.shop^
||fqzp.carolawolbrom.pl^
||qx.gzjxyy.top^
||m.dbbdh.top^
||vrqhdu.chungcumatphohn.top^
! additional ones
||wxere.grupabukko.pl^
||appwfr.rauscher-elektro.de^
||scxbumk.jj-tauben.de^
||jfanubw.david-laeuft.de^
||nxhbcfpy.hundebedarf-boettcher.de^
||guohnor.gorlice2022.pl^
||duxuu.hundebedarf-boettcher.de^
||mxzem.david-laeuft.de^
||qbfhcwvg.multig.pl^
||vcdvxl.multig.pl^
||spnb.david-laeuft.de^
||zqkgit.hundebedarf-boettcher.de^

! https://forums.malwarebytes.com/topic/286891-my-android-phone-was-connected-to-pc-with-charge-only-when-pc-was-hacked/#comment-1555237 (deleted)
||anonigstalk.com^
||bingenerator.one^

! https://forums.malwarebytes.com/topic/295956-from-another-malwarebytes-forum-spammer/ (account required)
||discord.onl^

! https://github.com/hagezi/dns-blocklists/issues/804
||venezuelabaseballjerseys.com^
||italyworldbaseballclassic.com^
||storeoregononline.com^
||tlstoreonline.com^
||storecollegeonline.com^
||shoptcuhornedonline.com^
||shopsyracuseonline.com^

! https://github.com/hagezi/dns-blocklists/issues/1169
||boooodas.com^
||m-contact.site^
||fuckmebaby.click^
||vipdeit.com^

! comment spam - endless cloudflare redirects
||getcutt.fun^

! https://infosec.exchange/@iampytest1/111485217708664748
||free-amore.online^
||t.affoth2.com^
||newfast.pics^

! https://infosec.exchange/@iampytest1/111669699558836859
||newdate32.site^

! https://infosec.exchange/@iampytest1/111669799133185795
||gimail.su^
||qimail.su^

! cryptocurrency recovery scammers
||cybergeniehackpro.xyz^
||cyberservices.com^

! X/Twitter spammer
||t.me/+8q8i5Dl-lws4NTU6^

! https://infosec.exchange/@briankrebs/111947916198756986
||forestver.se^
||discord.gg/ctkpaarr^

! https://github.com/Mastodon-DE/blocklists/issues/17
||tambayan.us^

! https://www.bleepingcomputer.com/news/security/news-farm-impersonates-60-plus-major-outlets-bbc-cnn-cnbc-guardian/
||australiannewstoday.com^
||bbcnewstoday.com^
||bloombergnewstoday.com^
||bostonnewstoday.com^
||britishnewstoday.com^
||canadiannewstoday.com^
||chinaworldnewstoday.com^
||chroniclenewstoday.com^
||cnbcnewstoday.com^
||cnnworldtoday.com^
||crunchbasenewstoday.com^
||dailyexpressnewstoday.com^
||dailyheraldnewstoday.com^
||dailymirrornewstoday.com^
||dailystarnewstoday.com^
||dailytelegraphnewstoday.com^
||dutchnewstoday.com^
||dwnewstoday.com^
||europeannewstoday.com^
||forbesnewstoday.com^
||frenchnewstoday.com^
||germaynewstoday.com^
||guardiannewstoday.com^
||headlinesworldnews.com^
||huffingtonposttoday.com^
||irishnewstoday.com^
||italiannewstoday.com^
||livemintnewstoday.com^
||maltanewstime.com^
||mirrornewstoday.com^
||nationalposttoday.com^
||neatherlandnewstoday.com^
||neweuropetoday.com^
||norwaynewstoday.com^
||oxfordnewstoday.com^
||portugalnewstoday.com^
||postgazettenewstoday.com^
||republicofchinatoday.com^
||reuterstoday.com^
||russiannewstoday.com^
||scotlandnewstoday.com^
||spanenewstoday.com^
||switzerlandnewstoday.com^
||thedailymailnewstoday.com^
||thedailytelegraphnewstoday.com^
||theexpressnewstoday.com^
||theheraldnewstoday.com^
||theindependentnewstoday.com^
||theirishtimesnewstoday.com^
||theirishtimestoday.com^
||themetronewstoday.com^
||themirrornewstoday.com^
||thequintnewstoday.com^
||thestarnewstoday.com^
||thesunnewstoday.com^
||thetelegraphnewstoday.com^
||timesofnetherland.com^
||timesofspanish.com^
||topeuropenews.com^
||topworldnewstoday.com^
||turkeynewstoday.com^
||walesnewstoday.com^
||washingtonposttoday.com^
||washingtontimesnewstoday.com^
||www.australiannewstoday.com^
||www.bbcnewstoday.com^
||www.bloombergnewstoday.com^
||www.bostonnewstoday.com^
||www.britishnewstoday.com^
||www.canadiannewstoday.com^
||www.chinaworldnewstoday.com^
||www.chroniclenewstoday.com^
||www.cnbcnewstoday.com^
||www.cnnworldtoday.com^
||www.crunchbasenewstoday.com^
||www.dailyexpressnewstoday.com^
||www.dailyheraldnewstoday.com^
||www.dailymirrornewstoday.com^
||www.dailystarnewstoday.com^
||www.dailytelegraphnewstoday.com^
||www.dutchnewstoday.com^
||www.dwnewstoday.com^
||www.europeannewstoday.com^
||www.forbesnewstoday.com^
||www.frenchnewstoday.com^
||www.germaynewstoday.com^
||www.guardiannewstoday.com^
||www.headlinesworldnews.com^
||www.huffingtonposttoday.com^
||www.irishnewstoday.com^
||www.italiannewstoday.com^
||www.livemintnewstoday.com^
||www.maltanewstime.com^
||www.mirrornewstoday.com^
||www.nationalposttoday.com^
||www.neatherlandnewstoday.com^
||www.neweuropetoday.com^
||www.norwaynewstoday.com^
||www.oxfordnewstoday.com^
||www.portugalnewstoday.com^
||www.postgazettenewstoday.com^
||www.republicofchinatoday.com^
||www.reuterstoday.com^
||www.russiannewstoday.com^
||www.scotlandnewstoday.com^
||www.spanenewstoday.com^
||www.switzerlandnewstoday.com^
||www.thedailymailnewstoday.com^
||www.thedailytelegraphnewstoday.com^
||www.theexpressnewstoday.com^
||www.theheraldnewstoday.com^
||www.theindependentnewstoday.com^
||www.theirishtimesnewstoday.com^
||www.theirishtimestoday.com^
||www.themetronewstoday.com^
||www.themirrornewstoday.com^
||www.thequintnewstoday.com^
||www.thestarnewstoday.com^
||www.thesunnewstoday.com^
||www.thetelegraphnewstoday.com^
||www.timesofnetherland.com^
||www.timesofspanish.com^
||www.topeuropenews.com^
||www.topworldnewstoday.com^
||www.turkeynewstoday.com^
||www.walesnewstoday.com^
||www.washingtonposttoday.com^
||www.washingtontimesnewstoday.com^

! ---- Resource Abuse ----

! slows browser/device to a crawl, contains no real content, and uses (attempts) to trap the user - https://github.com/uBlockOrigin/uAssets/issues/7449
||csgo.xyz^

! https://github.com/hagezi/dns-blocklists/issues/1990
! https://infosec.exchange/@iampytest1/111666367575936830 (thanks to ajayyy)
||brightdata.com^
||brightdata.de^
||bright-sdk.com^
||clientsdk.bright-sdk.com^
||perr.bright-sdk.com^

! ---- Stalkerware ----

! copied from https://github.com/AssoEchap/stalkerware-indicators/blob/adae94598f8d628a4af90f9bf323553d3ec683a4/ioc.yaml#L1-L273 - https://github.com/AssoEchap/stalkerware-indicators#license (modified to be in uBo format, removed a few domains)
||phonespying.com^
||app.phonespying.com^
||copy9.com^
||fonetracker.com^
||thetruthspy.com^
||icloudappe.com^
||spyzee.com^
||media-sync-a.copy9.com^
||media-sync-a.fonetracker.com^
||media-sync-a.thetruthspy.com^
||media-sync-a743.thetruthspy.com^
||media-sync-a748.thetruthspy.com^
||media-sync-a7xx.thetruthspy.com^
||media-sync-a825.thetruthspy.com^
||media-sync-a830.thetruthspy.com^
||media-sync-a835.thetruthspy.com^
||media-sync-a895.thetruthspy.com^
||media-sync-a8xx.thetruthspy.com^
||media-sync-a910.thetruthspy.com^
||media-sync-a915.thetruthspy.com^
||media-sync-a920.thetruthspy.com^
||media-sync-a925.thetruthspy.com^
||media-sync-a930.thetruthspy.com^
||media-sync-a935.thetruthspy.com^
||media-sync-a940.thetruthspy.com^
||media-sync-a941.thetruthspy.com^
||media-sync-a942.thetruthspy.com^
||media.thetruthspy.com^
||my.copy9.com^
||my.ispyoo.com^
||my.thetruthspy.com^
||my.thespyapp.com^
||phonetracking.net^
||protocol-a.copy9.com^
||protocol-a.fonetracker.com^
||protocol-a.ispyoo.com^
||protocol-a.mxspy.com^
||protocol-a.thetruthspy.com^
||protocol-a621.copy9.com^
||protocol-a696.copy9.com^
||protocol-a710.copy9.com^
||protocol-a743.thetruthspy.com^
||protocol-a745.thetruthspy.com^
||protocol-a748.thetruthspy.com^
||protocol-a780.copy9.com^
||protocol-a780.mxspy.com^
||protocol-a785.copy9.com^
||protocol-a811.mxspy.com^
||protocol-a910.thetruthspy.com^
||protocol-a915.thetruthspy.com^
||protocol-a920.thetruthspy.com^
||protocol-a925.thetruthspy.com^
||protocol-a930.thetruthspy.com^
||protocol-a935.thetruthspy.com^
||protocol-a940.thetruthspy.com^
||protocol-a941.thetruthspy.com^
||protocol-a942.thetruthspy.com^
||protocol-monitor.thetruthspy.com^
||protocol-viewer-a.copy9.com^
||protocol.copy9.com^
||protocol.ispyoo.com^
||protocol.thetruthspy.com^
||secondclone-2d312.firebaseio.com^
||setupmail-a.icloudappe.com^
||setupmail-a724.icloudappe.com^
||setupmail-a743.icloudappe.com^
||setupmail-a745.icloudappe.com^
||setupmail-a748.icloudappe.com^
||setupmail-a910.icloudappe.com^
||setupmail-a915.icloudappe.com^
||setupmail-a920.icloudappe.com^
||setupmail.icloudappe.com^
||sync-a.copy9.com^
||sync-a.mxspy.com^
||sync-a.thetruthspy.com^
||sync-a7xx.thetruthspy.com^
||sync-a8xx.thetruthspy.com^
||sync-a925.thetruthspy.com^
||sync-a930.thetruthspy.com^
||sync-a935.thetruthspy.com^
||sync-a940.thetruthspy.com^
||sync-a941.thetruthspy.com^
||sync-a942.thetruthspy.com^

! https://github.com/AssoEchap/stalkerware-indicators/blob/9f656217ab46b2043612808940f4387b651000a9/ioc.yaml#L3937 - under https://github.com/AssoEchap/stalkerware-indicators#license
! my analysis: https://app.any.run/tasks/57cdb248-461e-4dc5-b6b2-2235eec1e098/
! my analysis: https://virustotal.com/gui/file/5809066a109718683fa1ffe3abcd0e6c9bd5f613279e081e31bc17e628d9bfba/detection
! my analysis: https://tria.ge/230505-27f8mshd2v/behavioral1
||myspyapps.com^
||my-spy-a9c92.firebaseio.com^

! Andrews, Jean. CompTIA A+ Guide to Information Technology Technical Support. Available from: Yuzu Reader, (11th Edition). Cengage Learning US, 2022.
! confirmed
||flexispy.com^

! https://lgbtqia.space/@alice/112017041119045914
||clevguard.com^
||www.clevguard.com^
||images.clevguard.com^
||panel.clevguard.com^
||public.clevguard.com^
||account.clevguard.com^
! possible fake page, unclear if related
||clevguard.org^
||www.clevguard.org^
||images.clevguard.org^

! "Remotely Monitor Kid's Device and Activity" - textbook stalkerware
||imyfone.com^

! ---- Include other lists ----
! include rules for just uBlock Origin and AdGuard, and the VXVault list
! Included title: The malicious website blocklist - extension
! Description: This is an extension to The malicious website blocklist for uBlock Origin and AdGuard which includes rules which can not be added to the main blocklist
! WARNING: This list is _not_ intended to be used on its own, or to be manually added. This list is auto-included in the uBo/AdGuard version of The malicious website blocklist
! Last updated: 28/1/2024

! ----- threats which can not or will not be blocked in the main list -----

! YouTube spam (i.e. on https://www.youtube.com/watch?v=K2AhNVdKq-A)
||youtube.com/channel/UCWW7EjmEmZzi6N6Y7YMUnzQ^
||youtube.com/channel/UCUYkrrkUcrrnLpmejhGmCvQ^
||youtube.com/channel/UCxCLdWKpF6Q1xGF_fVW6t5g^
||youtube.com/channel/UCEBXm13iwQAXN2Kz4YV5rVQ^
||youtube.com/channel/UCtjaY3UG_5KxQRMDUczFMXQ^
||youtube.com/channel/UC3Iqfjqv79rOqZcbrUBzB8Q^
||youtube.com/channel/UCR3GagpPBSlCegUOrlWiuqQ^
||youtube.com/channel/UC9o2JoFCpUBjxLxYSNLtIqw^
||youtube.com/channel/UCLJuDTN9-RwCKZfiTQSmQNw^
||youtube.com/channel/UCcPnuqWCtMJK4rrVhTiDtlg^
||youtube.com/channel/UCC_2xhblgtcA1YoS8Rr6mOQ^
||youtube.com/channel/UCSr4quHpOpm0mwPQ4_0wz1g^
||youtube.com/channel/UCzynpoHU3QF4nw4AYTY8CsA^
||youtube.com/channel/UCXadJ8WXmlbeGbmxlY7foWg^
||youtube.com/channel/UCgSlARY1XMjOmBc_TWVIokQ^
||youtube.com/channel/UCCUbeSnqfvdhGDnavmPO7vQ^
||youtube.com/channel/UCXYuZPnivfpLQFol_-AMqEA^
||youtube.com/channel/UC4BA48f2crsX-Gf1wMcb7eg^
||youtube.com/channel/UCGWJ20THLElJxRU2EB4WBRQ^
||youtube.com/channel/UCXcYQa5hgMic4EOo4syR8Nw^
||youtube.com/channel/UC90u7VCSfmLUvMJeuvbEz1g^
||youtube.com/channel/UCqV8bLGbLKvSUVDZtfEYz8g^
||youtube.com/channel/UCUUKlL3uzVmFQ1vtd-jpAlw^
||youtube.com/channel/UCA6vBoVGTXXLNCIq2Mp1tXA^
||youtube.com/channel/UCf2aBb8v-q2jUg-kdAo_emQ^
||youtube.com/channel/UC0cDYHKKI3WuHY6PT-YsBTw^
||youtube.com/channel/UCf9PTi384IFnBjH5FbGvoag^
||youtube.com/channel/UCDTcPk8eNOP4FDTRTGFdo4A^
||youtube.com/channel/UCslhNIF-vTeYnL4W8yg9F1Q^
||youtube.com/channel/UCWjGB-2evM8AB9rj6fVxmcA^
||youtube.com/channel/UCNEuUGHoTTyt1247GzNdfbA^
||youtube.com/channel/UC1HVJDDHoSVcerD46K-J6ng^
||youtube.com/channel/UCGaMJeO7YClK_dmoHB4-BIw^
||youtube.com/channel/UCszV4lSIfrZVwZE1YiANUzw^
||youtube.com/channel/UCyeh7kwrZGgmDUmkw1Svkuw^
||youtube.com/channel/UCWaneJzQcS5WhaaerEuSg1g^
||youtube.com/channel/UC8-4-iapLTjw-MUi72kaDiQ^
||youtube.com/channel/UC3qrUm-HpLdin8q-IGQ4UMQ^
||youtube.com/channel/UCGUEvZCqa4a8S_n6UN1Vtuw^
||youtube.com/channel/UCd-l4COpGbWCxYddh6ZwLoQ^
||youtube.com/channel/UC2aUB8zP6YpfgNiy2-tNtYA^
||youtube.com/channel/UCcO6DL9RgbRo2BfBYXayP-Q^
||youtube.com/channel/UCd-l4COpGbWCxYddh6ZwLoQ^
||youtube.com/channel/UC2aUB8zP6YpfgNiy2-tNtYA^
||youtube.com/channel/UCuNFh80aT9Avdhw9jr7TX8A^
||youtube.com/channel/UCikppjadTAgFj7QFKPfE6YQ^
||youtube.com/channel/UCY-mjAhqC7-Lkv0Qv5nS1yA^
||youtube.com/channel/UCRYvu6p4-T3RCyl7tgtfC_Q^
||youtube.com/channel/UCzSW21exQQ_6DJO0GjPr8Dw^
||youtube.com/channel/UC4H0NSb0XAzRAT9NQ4h08jA^
! possible scam videos
||youtube.com/watch?v=4XsnniuVG3c^
! spam comments - if someone knows a better way to use regexs, please tell me, as I am not very experienced with them
hanoiopentourism.com##[id*=comment-] > .comment-wrap:has-text(/DINOSONTECH ON INSTAGRAM/i)
vixencrypto.com##.comment_content:has-text(/dinosontech on Instagram/i)
piped.kavin.rocks##.replies > div.uk-width-expand.uk-align-left.uk-tile-default > .uk-flex.comment:has-text(/DINOSONTECH on Instagram /i)
youtube.com###body.ytd-comment-renderer.style-scope:has-text(/DINOSONTECH on Instagram/i)
youtube.com###body.ytd-comment-renderer.style-scope:has-text(/Cytro44 on IG/i)
youtube.com###body:has-text(/hackertage on telegram/i)
youtube.com###body:has-text(/RANKINGHACKS ON TELEGRAM/i)
youtube.com###body:has-text(/DAHCYBER ON INSTAGRAM/i)
youtube.com###body:has-text(/immediatelyhacker.tech/i):has-text(y)
youtube.com###body:has-text(/william_hacktools (on|is|at)/i)
youtube.com###comment:has-text(/jacksontechie on /i)
youtube.com##ytd-comment-renderer.ytd-comment-replies-renderer.style-scope:has-text(/hackermendax (is|on|from|at) telegram/i)
youtube.com###body:has(#author-text:has-text(/Vanessa Bakery/i))
youtube.com##ytd-comment-renderer.ytd-comment-replies-renderer.style-scope:has-text(/ZhiyongFx (is|on|from|at) telegram/i)
youtube.com##ytd-comment-renderer.ytd-comment-replies-renderer.style-scope:has-text(/Godhakz01 (is|on|from|at) (telegram|Instagram)/i)
youtube.com###contents > .ytd-comment-replies-renderer.style-scope:has-text(/darkweb_DKcc (on|is|at) (telegram|instagram)/i)
youtube.com##.ytd-comment-renderer.style-scope:has-text(/rogersfloyd1998 (on|at|is) telegram/i)
youtube.com##ytd-comment-thread-renderer:has-text(/cardholders1 (on|at|is) telegram/i)
youtube.com##.ytd-comment-thread-renderer:has-text(/cashcards20 (on|os|at|is) telegram/i)
youtube.com##.ytd-comment-renderer:has-text(/Ddoncarder (os|is|when|at|on|go) telegram/i)
youtube.com##.ytd-comment-renderer:has-text(/southhack1/i):has-text(/agram/i)
youtube.com##.ytd-comment-renderer:has-text(/Beastclone (on|at|his|will|is) telegram/i)
youtube.com##.ytd-comment-renderer:has-text(/legitboss10 (at|on|is) telegram/i)
youtube.com##.ytd-comment-renderer:has-text(/Joecarder112 (or|on|at) telegram/i)
youtube.com##.ytd-comment-thread-renderer:has-text(/veehackservice (at|on|is|when|did|can|contact on|who) telegram/i)
youtube.com##.ytd-comment-thread-renderer:has-text(/Godsenthack (On|at|is|going|be|is on) telegram/i)
youtube.com##.ytd-comment-renderer:has-text(/EYEONSIGHT/i):has-text(/NET (on|gives|has|will|is)/i)
youtube.com##.ytd-comment-renderer:has-text(𝗩𝗟𝗔𝗡𝗧5)
youtube.com##.ytd-comment-renderer:has-text(/Bones_hack11/i):has-text(/instagram/i)
youtube.com##.ytd-comment-renderer:has-text(/albert__kev (on|at) (instagram|telegram)/i)
youtube.com##.ytd-comment-renderer:has-text(/with/i):has-text(/Romanhackers,com/i)
youtube.com##.ytd-comment-renderer:has-text(/Vest_hackss09 (on|at|is|go|DM|access) Instagram/i)
youtube.com##.ytd-comment-renderer:has-text(/ProJasontrade/i):has-text(/(h|i|$)/i)
youtube.com##.ytd-comment-renderer:has-text(/MARKHACKS10 (on|at|is|for|be|is on)/i)
youtube.com##.ytd-comment-renderer:has-text(/LAMOCRACK (on|at|is|for|be|is on)/i)
youtube.com##.ytd-comment-renderer:has-text(/𝐒𝐀𝐂𝐓𝐀𝐂𝐑𝐀𝐂𝐊 (on|at|is|for|be|is on)/i)
youtube.com##.ytd-comment-renderer:has-text(/KASPERSKYSUDO (on|at|is|for|be|is on)/i)
youtube.com###body:has-text(/SARZY_CRACKS (on|at) Instagram/i)
youtube.com###body:has-text(/Graysonm19 .* tele/i)
youtube.com###body:has-text(/(without any doubt,|reaching out to |I still use )Grayson/i)
youtube.com###body:has-text(/(Tobiasmeylan|Tobias Meylan)/i)
youtube.com###body:has-text(/dip in crypto/):has-text(/Vellajean Scarlett/i)
youtube.com###body:has-text(/Mrs(\.|) Deborah/i):has-text(/my life (have|has) totally changed/i)
youtube.com###body:has-text(Mrs Deborah):has-text(/handles my account/i)
youtube.com###body:has-text(/@deborah901/i)
youtube.com###body:has-text(/Jim Detterick/i):has-text(/(pro|trader)/i)
youtube.com###body:has-text(/dettericktrade/i)
youtube.com###body:has-text(/Mrs Kiana Daniel/i):has-text(/(trad|!!)/i)
youtube.com###body:has-text(𝟏𝟐𝟎𝟓𝟔𝟖𝟑𝟓𝟓𝟏𝟔)
youtube.com###body:has-text(/godwinmyers/i)
youtube.com###body:has-text(/Godwin Myers/i):has-text(/(market|gain|trad)/i)
youtube.com###body:has-text(/hackersharron/i)
youtube.com###body:has-text(/mileshacks/i)
youtube.com##.ytd-comment-replies-renderer.style-scope > .ytd-comment-renderer.style-scope:has-text(/pp♰④④⑦④③⑧⑤⑧②⑨⑦①/i)
youtube.com###comment:has-text(/VGminers [a-zA-Z]* telegram/i)
youtube.com###comment:has-text(/billhacker [A-Z]* telegram/i)
youtube.com###comment:has-text(/𝙸𝚍𝚎𝚊𝚕𝚑𝚊𝚌𝚔𝚎𝚛𝚜.𝙲𝚘𝚖/i)
youtube.com###body:has-text(/ZHAXHACK23 /i):has-text(/tele/i)
! shady website & related
||romanhackers.com^
||telegram.me/Cryptoboost01^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/469
||youtube.com/watch?v=xDC7a0aiOC4^
||youtube.com/watch?v=Akp_aLQE3fo^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/472
||youtu.be/TWMhdIuEpk4^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/478
||youtube.com/watch?v=oqL_qItz-m8^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/479
||youtube.com/watch?v=S6fj4Pzry6E^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/482
||youtube.com/watch?v=PtIVwTMcJn0^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/485
||youtube.com/watch?v=6FPVqU4n8uo^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/486
||youtube.com/watch?v=SQHNWCZNy0w^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/487
||youtube.com/channel/UCZa3tmImIR-1_hXSu6QCYyQ^
||youtube.com/channel/UCUbyp0ZFaBVHifnBR6Fa2Gw^
||youtube.com/channel/UC7jjRUjOAAhrJsS4LvpSsLg^
youtube.com###body:has(#author-text:has-text(@Julliana_beautiful_and_Single))
! https://github.com/ThioJoe/YT-Spam-Lists/issues/490
||youtube.com/watch?v=n4rDvjvyiM0^
! https://github.com/ThioJoe/YT-Spammer-Purge/issues/1071
||youtube.com/channel/UCo3fS-4D_DEgHAhLruLlP3Q^
! https://infosec.exchange/@iampytest1/111734746694485882
||youtube.com/@Everything-Network^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/495
||youtube.com/watch?v=sFTeR0rYifY^
||youtube.com/watch?v=1HwPz_Wr3a4^
! https://github.com/ThioJoe/YT-Spam-Lists/issues/497
www.youtube.com###comment:has-text( AWT99K )
||youtube.com/channel/UCmsXlnWt0T1KzM2mtbkQqQA^
||youtube.com/channel/UCSYnbUnaPfgmGHSGfQJnXKQ^

! crypto website?
cryptocurrencyvideogroup.com##.comment-body:has-text(/hackerzhiyong (on|at|is|via) telegram/i)
cryptocurrencyvideogroup.com##.comment-body:has-text(/Godhakz01 (on|at|is|via) telegram/i)
cryptocurrencyvideogroup.com##.comment-body:has-text(/Mitnickhack1 (on|at|is|via) telegram/i)
cryptocurrencyvideogroup.com##.comment-body:has-text(/HACKERMEMPHIS (on|at|is|via) telegram/i)
cryptocurrencyvideogroup.com##.comment-body:has-text(/Johnson Crypto crown0 (on|at|is|via) telegram/i)
cryptocurrencyvideogroup.com##.comment-body:has-text(/Dillard To Crypto crown0 (on|at|is|via) telegram/i)

! https://github.com/DandelionSprout/adfilt/blob/master/Dandelion%20Sprout's%20Anti-Malware%20List.txt#L315 (under https://github.com/DandelionSprout/adfilt/blob/master/LICENSE.md)
! https://github.com/AdguardTeam/AdguardFilters/issues/58737

! https://github.com/uBlockOrigin/uBOL-issues/issues/1
! there may be a better solution

! https://forums.malwarebytes.com/topic/291609-dark-reader-plugin-contains-malware-browser-hijacker/ (seems unrelated to Dark Reader, as the website continues with Dark Reader disabled/uninstalled)
rarbg.to##a[href*="furiousfar.com"]
||furiousfar.com^

! https://www.virustotal.com/gui/ip-address/5.8.47.3/relations
! domains similar to winyourprize36[.]com

! almost anything offering "Roblox hacks no virus" is bad

! https://github.com/uBlockOrigin/uAssets/issues/16000
! https://app.any.run/tasks/195b871c-b9cd-48f8-a7c1-6a53ea943a4b

! adfly (might be dead as adfly is now owned by Linkverse)

! https://github.com/AdguardTeam/AdguardFilters/issues/139667

! I doubt any legit domains will match this, if some do, I will remove/change it.

! several phishtank urls, i.e. https://phishtank.org/phish_detail.php?phish_id=7989130
||www.amazceon-co-jp.amazccen.
||www.amazconn-co-jp.amazccne.

! https://tria.ge/230708-zw13kaab69/behavioral2
||come-get-s0me.com^$image,3p
||imghst-de.com^$image,domain=expressionsvegetales.fr
! https://tria.ge/230802-vtcjzaga38/behavioral1
||clicksmint.site^$image,domain=ru

! https://github.com/uBlockOrigin/uAssets/issues/18897
startpage.com##.total-adblock-desktop
||startpage.com/sp/cdn/bundles/*/*/lib/TotalAdBlockAdultWidget.js^$script

! https://app.any.run/tasks/cc0dd977-97e3-4b4a-833b-dfc4d5f0be55

! https://github.com/AdguardTeam/AdguardFilters/issues/161349
||mmczmfgpq.com^
! https://tria.ge/230913-mb6fbsdh42/behavioral1
||ropesunfamiliar.com^$popup,third-party
||grumbletonight.com^$popup,third-party

! TotalAV ads in Google
www.google.*##[data-dtld="totalav.com"]

! TotalAdblock ads on https://allaboutcookies.org/privacy-issues-cookies
allaboutcookies.org###offer-review-widget-container

! rules based on phishing urls listed in openphish
! hxxp[://]www.coinbase-walletpro[.]com/
||www.coinbase-wallet.
! hxxp[://]steamc0ommunity[.]bos[.]ru/
||steamc0ommunity.
! hxxp[://]facebooksecuritys[.]blogspot[.]tw/
||facebooksecuritys.
! hxxp[://]feceboolk[.]blogspot[.]sk/
||feceboolk.
! hxxp[://]whatsapp-com-videoooo-viral[.]paneldeni[.]com/
! hxxp[://]www[.]barclaysnet-support[.]com/
||barclaysnet-support.
! hxxp[://]instragramsecurity[.]com/
||instragramsecurity.
! hxxpx[://]fb-account-restricted-8d535[.]web[.]app/
||fb-account-restricted-
! hxxpx[://]fb-reserve-noreply-ea078[.]web[.]app/
||fb-reserve-noreply-
! hxxpx://meta-account-review-af2d[.]firebaseapp[.]com/
||meta-account-review-
! hxxpx[://]metabusiness-support-6092[.]firebaseapp[.]com/
||metabusiness-support-
! hxxpx://resolve-user-violation-c6961[.]web[.]app/
||resolve-user-violation-
! hxxp://metamask[.]matamaskloen[.]com/
||metamask.matamaskloen.
! hxxpx[://]attcom-102582.weeblysite[.]com/
||attcom-
! hxxpx://ccoinbaselogin[.]blogspot[.]com/
||ccoinbaselogin.
! hxxpx[://]web-metamaskwallet[.]ddnss[.]eu/Q5My1hNGEyLTARgAAA3RMwAi0wMAoA/2Fn8g8ZIoTRjEMi7D3wABuGi3HAAAAA/cd4ac
||web-metamaskwallet.
! hxxp[://]sign-in-att-106455[.]weeblysite[.]com/
||sign-in-att-
! hxxp[://]account-restriction-1000967754[.]firebaseapp[.]com/
||account-restriction-
! hxxp[://]metazmskloign[.]github[.]io/
||metazmskloign.
! hxxp[://]xn--mtamask-98a[.]io/
||xn--mtamask-
! hxxp[://]apple[.]appleidto[.]top/
||apple.appleid
! hxxp[://]usps[.]com-ca[.]xyz/
||usps.com-
! hxxp[://]linkedindocumentinquiry[.]ap-south-1.linodeobjects[.]com/linkedinindex.html
! hxxpx[://]metamchromextensoin[.]gitbook[.]io/us/
||metamchromextensoin.
! hxxpx[://]www[.]lnstagram-tropicaibaiitouts[.]com/mobile.html
||www.lnstagram-
! hxxpx[://]subscription-netflix-support[.]codeanyapp[.]com/monika/jonika/account/
||subscription-netflix-support.
! hxxpx://promote-warning-meta[.]help/3b070e09e0b9ac588d6b873cb246b2ae.html
||promote-warning-meta.
! hxxpx[://]mailoutlook365login[.]us-lax-1.linodeobjects.com/link.html
||mailoutlook365login.us-
! hxxp[://]office356domainlistmaintainnance231clouding1[.]brizy[.]site/
||office356domainlistmaintainnance
! hxxp[://]me-metamasklogin[.]mystrikingly[.]com/
||me-metamasklogin.
! hxxp[://]matamask-logi[.]mystrikingly[.]com/
||matamask-logi.
! hxxp[://]optusnet-com[.]blogspot[.]md/
||optusnet-com.
! hxxp[://]met0amaskl0gin1[.]github[.]io/
||met0amaskl0gin1.

! https://urlhaus.abuse.ch/url/2722177/
! https://urlhaus.abuse.ch/url/2722146/
! https://urlhaus.abuse.ch/url/2722091/

! popups
||refusedfellow.com^$popup
||thatwasfresh.com^$popup,third-party
||thinkyouknowsports.com^$popup,third-party
||thinkyouknowsports.com^$popup,third-party

! https://github.com/uBlockOrigin/uAssets/issues/20553
! https://tria.ge/231110-pftcnsgg26/behavioral1
||offerimage.com^$domain=tii.la

! https://threatfox.abuse.ch/browse.php?search=ioc%3Adiscord-gg.duckdns.org
||discord-gg.

! ---- malware or scam browser extensions -----

! https://github.com/AdguardTeam/AdguardFilters/issues/104631 (copied - no modification)
! https://chrome.google.com/webstore/detail/total-adblock-ad-blocker/gekdekpbfehejjiecgonmgmepbdnaggp
||totaladblocker.com^
! https://chrome.google.com/webstore/detail/ublock-free-ad-blocker/epcnnfbjfcgphgdmggkamkmgojdagdnn
||ublock.org^
! https://chrome.google.com/webstore/detail/der-werbeblocker-adblock/jgpangedefoljhpijicpcbgcecpfjokn
||derwerbeblocker.com^
! https://chrome.google.com/webstore/detail/adlock-adblocker-privacy/aemffjkmgcepimloclpkecifcnipnodh
||adlock.com^
! https://chrome.google.com/webstore/detail/adblocker-genius-pro/jdiegbdfmhkofahlnojgddehhelfmadj
||djamol.com^
! https://chrome.google.com/webstore/detail/ultrablock-privacy-protec/ijnodnmgpgmgaajhagolfiemmmamfcgb
||ultrablock.org^
! https://chrome.google.com/webstore/detail/adblock-unicorn/ldjhogknogpdklogdocbicnlpljekejl
||adblock-unicorn.com^
! https://github.com/DandelionSprout/adfilt/blob/master/Dandelion%20Sprout's%20Anti-Malware%20List.txt#L361 which is maintained by https://github.com/DandelionSprout and is under https://github.com/DandelionSprout/adfilt/blob/master/LICENSE.md
! Mozilla Add-ons
! These entries can be used in Firefox with regular browser extensions (uBO|AdGuard Browser Extension|ABP) by opening about:config, removing the "addons.mozilla.com" part from "extensions.webextensions.restrictedDomains", and then creating a new string called "privacy.resistFingerprinting.block_mozAddonManager" (That exact capitalisation must be used) set to (Boolean) true.
! Homepages
||adblock.biz^
||the1adblocker.com^
||otih-oith.us.to^
! Other sites
softonic.*,softonic-ar.com,softonic-th.com##a[href*="://ad-guardian-plus."]
softonic.*,softonic-ar.com,softonic-th.com##a[href*="://adskiper."]
softonic.*,softonic-ar.com,softonic-th.com##a[href*="://ublock-firefox."]
softonic.*,softonic-ar.com,softonic-th.com##a[href*="://ublock-chrome."]
softonic.*,softonic-ar.com,softonic-th.com##a[href*="://adblock."]
||apps.apple.com/*/app/*/id1564900435^

! copied over from https://github.com/DandelionSprout/adfilt/blob/master/Dandelion%20Sprout's%20Anti-Malware%20List.txt which is maintained by https://github.com/DandelionSprout. This has been modified to change $doc to $document and remove unneeded exceptions appended to $all filters 
! ——— Links to PC "optimising" "tool" PUPs that'll most likely stuff your PC full of nagware and malware ———
! ¤¤¤ ReImagePlus (Also added to "uBlock Filters - Badware Risks") ¤¤¤
! https://windowsreport.com/extend-windows-laptop-battery-life/
windowsreport.com##.code-block
! https://appuals.com/fix-error-0x800701e3-on-windows-7-8-1-10/
appuals.com##.info.box
appuals.com##.appua-reimage-top
! https://ugetfix.com/ask/how-to-fix-windows-store-error-0x8000ffff/
ugetfix.com,sauguspc.lt,wyleczpc.pl,sichernpc.de,pcseguro.es##div.attention-button-box-green
ugetfix.com,sauguspc.lt,wyleczpc.pl,sichernpc.de,pcseguro.es##.sidebar_download_inner
ugetfix.com,sauguspc.lt,wyleczpc.pl,sichernpc.de,pcseguro.es##.primary_download
ugetfix.com,sauguspc.lt,wyleczpc.pl,sichernpc.de,pcseguro.es##.download_button_info_texts
ugetfix.com,sauguspc.lt,wyleczpc.pl,sichernpc.de,pcseguro.es##.js-download_button_additional_links
ugetfix.com,sauguspc.lt,wyleczpc.pl,sichernpc.de,pcseguro.es##.download-button-offer-header
! https://www.thewindowsclub.com/fix-windows-update-error-0xc1900130-on-windows-10
thewindowsclub.com##div[style^="float: none; margin:10px "]
! https://www.majorgeeks.com/files/details/patch_my_pc.html
||majorgeeks.com/images/icons/red_icon_18x17px.png$image
! https://www.2-spyware.com/remove-redirector-gvt1-com.html
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.ui-content > .win
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.sidebar_download_inner > :not(.voting-box, .colorbg-grey)
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.js-download_button_offer
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.primary_download
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.automatic_removal_list
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.quick-download-button-placeholder
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.quick-download-button-text
! ¤¤¤ ScanUtilities ¤¤¤
! https://www.bynarycodes.com/fix-windows-10-update-error-0x80070006/
bynarycodes.com##div[class^=bynar-content_]
! ¤¤¤ Driver Easy ¤¤¤
! https://www.drivereasy.com/knowledge/fix-critical-service-failed-blue-screen-error-on-windows-10/
! https://www.drivereasy.com/knowledge/fixed-how-to-fix-stop-error-0x0000001e/
! https://www.drivereasy.com/knowledge/download-gigabyte-audio-driver/
! https://www.drivereasy.com/knowledge/epson-xp-420-driver-update-for-windows-7-8-and-10/
! https://www.drivereasy.com/knowledge/solved-this-display-does-not-support-hdcp/
! ¤¤¤ Slimware DriverUpdate ¤¤¤
! https://forums.windowscentral.com/
forums.windowscentral.com###navbar_notice_33
! ¤¤¤ Driverpack Online (Accidentally also fixed in EasyPrivacy and «AdGuard Mobile Ads») ¤¤¤
||google-analytics.com^$domain=sdi-tool.org
! ¤¤¤ SpyHunter links ¤¤¤
! https://howtoremove.guide/redirector-gvt1-com-virus-malware-chrome-removal/
howtoremove.guide##div[style^="border:2px"]
! https://www.2-spyware.com/remove-redirector-gvt1-com.html
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.automatic_removal_list_w > .ar_block_description
guide##a[href*="download.enigmasoftware.com/spyhunter-free-download/stpl_94/SpyHunter-Installer.exe"]
! https://github.com/DandelionSprout/adfilt/issues/63#issuecomment-968070041
howtoremove.guide##[id*="newage"]
malwareguide112.com##.tdb-block-inner > div:has-text(Best Offer)
virusresearch.org##.virus-before-content
virusresearch.org##.q2w3-fixed-widget-container
virusresearch.org##.virus-after-fourth-h2
virusresearch.org##.virus-after-content
! https://www.cyclonis.com/how-to-create-gmail-account-without-phone-number/
cyclonis.com##div.rotatead-container:has(.download[data-params*="dl.enigmasoftware.com"])
! https://www.2-viruses.com/remove-ad-spam-press-allow-to-continue
2-viruses.com##.active.prods-win.prod-download
||2-viruses.com/downloads/spyhunter2^
! https://github.com/iam-py-test/my_filters_001/issues/119
||cfoc.org/go-to-spyhunter/^
||cfoc.org/spyhunter-download-and-install-instructions/^
cfoc.org###top_custom_banner
cfoc.org##.custom_banner_top_btn
cfoc.org##tr:has([href="https://cfoc.org/go-to-spyhunter/"])
cfoc.org##a[href="https://cfoc.org/spyhunter-download-and-install-instructions/"]:upward(2)
cfoc.org##.su-button[href^="https://link.safecart.com/"]:upward(3)
cfoc.org##.widget_text.widget:has([href^="https://cfoc.org/spyhunter-"])
||cfoc.org/combocleaner-download-mac/^
cfoc.org##tr:has([href="https://cfoc.org/combocleaner-download-mac/"])
cfoc.org##p:has(font:has-text( could remain on your Mac if you are not careful during removal. We recommend that you download and run a scan with Combo Cleaner now to professionally clean up your Mac in ))
cfoc.org##font:has(center:has([href="https://cfoc.org/combocleaner-download-mac/"]))
cfoc.org##.widget_text.widget:has([href^="https://cfoc.org/spyhunter-"])
||sensorstechforum.com/spyhunter-download-and-install-instructions/^
||sensorstechforum.com/spyhunter-for-mac-download-install/^
||sensorstechforum.com/wp-content/uploads/2020/04/SpyHunter-Install-And-Free-Scan-$image
||youtube.com/embed/KbGF_fvsRU4^
sensorstechforum.com##tr:has([href="https://sensorstechforum.com/spyhunter-download-and-install-instructions/"])
sensorstechforum.com##center:has([href="https://www.enigmasoftware.com/spyhunter5-eula/"])
sensorstechforum.com##[href="https://sensorstechforum.com/spyhunter-download-and-install-instructions/"]
sensorstechforum.com##.top_banner_custom
sensorstechforum.com##center:has-text(Click the button below):has-text(SpyHunter for Mac)
sensorstechforum.com##p:has([href="https://sensorstechforum.com/spyhunter-mac-review-advanced-anti-malware/"])
sensorstechforum.com##p:has([src^="https://sensorstechforum.com/wp-content/uploads/2020/04/SpyHunter-Install-And-Free-Scan-"])
sensorstechforum.com##center:has([title="Download SpyHunter for Mac"])
sensorstechforum.com##p:has([src="https://www.youtube.com/embed/KbGF_fvsRU4"])
sensorstechforum.com###win_top_new_hidden
! ¤¤¤ Restoro  ¤¤¤
! https://www.windowsdispatch.com/fix-system-restore-0x81000203-error-code/
windowsdispatch.com##strong
! https://dlldownloads.com/xlive-dll/
dlldownloads.com##.page-container > p
! https://windowsreport.com/find-remove-duplicate-files-windows-10/
windowsreport.com##.bnr-block
! https://windowsreport.com/how-to-update-roblox/ (08/12/2022)
windowsreport.com##div[class^=restoro-download] + section
windowsreport.com##div[class^=refmed]
! https://appuals.com/pr-connect-reset-error/
appuals.com##.wptp
appuals.com##p + div > div:first-of-type
! ¤¤¤ "Driver" download sites that instead download PUP tools ¤¤¤
||driver-soft.com^
! ¤¤¤ Outbyte ¤¤¤
wikidll.com,dllfile.net,dll-files.org##.detection-os
wikidll.com,dllfile.net,dll-files.org##.detection-desc
wikidll.com,dllfile.net,fix4dll.com,dll-files.org##.inner > .text
wikidll.com,dllfile.net,fix4dll.com,dll-files.org##.btn-download
wikidll.com,dllfile.net,fix4dll.com,dll-files.org##.product > .title-line
wikidll.com,dllfile.net,fix4dll.com,dll-files.org##.repair-block
windll.com##.download-block
windll.com##.dll > p
dllfile.net##.sticky-link
fix4dll.com##.file__download
winaero.com##.entry-content > div:has([href="/fix-classic-issues-performance/"])
softwaretested.com##.st-alternative
softwaretested.com##.snippet-content
processlibrary.com##.bottom > .row:last-of-type
||outbyte.com^
||testedforyou.net^
! ¤¤¤ PC Reviver ¤¤¤
! ¤¤¤ FixMyPC ¤¤¤
! ¤¤¤ "DLL Helper" ¤¤¤
azdll.net##.dllhelper-banner
! ¤¤¤ WinThruster ¤¤¤
||solvusoft.com^
exefiles.com##.panel:has([href*="/en/recommended/winthruster/"])
exefiles.com##.row:has(a[href*="/recommended/"])

! remove PUPs from software download sites and app store websites
! Download.com - this currently leaves random blank squares on the page
download.cnet.com,download.com##div.c-productCard-simple.u-flexbox-column.c-productCard:has-text(/Advanced SystemCare Free/i)
download.cnet.com,download.com##div.c-productCard-simple.u-flexbox-column.c-productCard:has-text(/driver easy/i)
download.cnet.com,download.com##div.c-productCard-simple.u-flexbox-column.c-productCard:has-text(/iobit uninstaller/i)
download.cnet.com,download.com##div.c-productCard-simple.u-flexbox-column.c-productCard:has-text(/totalav/i)
download.cnet.com,download.com##div.c-productCard-simple.u-flexbox-column.c-productCard:has-text(/PC Protect for Android/i)
download.cnet.com,download.com##div.c-productCard-simple.u-flexbox-column.c-productCard:has-text(/Scanguard/i)
download.cnet.com##div.c-productCard-search:has-text(/Advanced SystemCare/i)
download.cnet.com##div.c-productCard-search:has-text(/driver easy/i)
download.cnet.com##div.c-productCard-search:has-text(/iobit uninstaller/i)
download.cnet.com##div.c-productCard-search:has-text(/TotalAV/i)
download.cnet.com##div.c-productCard-search:has-text(/PC Protect for Android/i)
download.cnet.com##div.c-productCard-search:has-text(/Scanguard/i)
||download.cnet.com/Advanced-SystemCare-Free
||download.cnet.com/Driver-Easy
||download.cnet.com/IObit-Uninstaller
||download.cnet.com/TotalAV
||download.cnet.com/ScanGuard
||download.cnet.com/developer/SS%20Protect
||download.cnet.com/developer/Security%20Suite
! Softonic
softonic.com##.top-app:has-text(/TotalAV/i)
softonic.com##.top-app:has-text(/iobit uninstaller/i)
softonic.com##.top-app:has-text(/iobit malware fighter/i)
softonic.com##.top-app:has-text(/Driver Easy/i)
softonic.com##.top-app:has-text(/MyCleanPC/i)
softonic.com##.top-app:has-text(/PC SpeedCAT/i)
softonic.com##.top-app:has-text(/DLL Helper/i)
softonic.com##.top-app:has-text(/Advanced SystemCare/i)
softonic.com##[href="https://advanced-systemcare-ultimate.en.softonic.com"] > .app-list-item--interactive.app-list-item
softonic.com##.app-list-item:has-text(/TotalAV/)
softonic.com##.app-list-item:has-text(/iobit uninstaller/i)
softonic.com##.app-list-item:has-text(/iobit malware fighter/i)
softonic.com##.app-list-item:has-text(/Advanced SystemCare/)
softonic.com##.app-list-item:has-text(/Driver Easy/i)
softonic.com##.app-list-item:has-text(/MyCleanPC/i)
softonic.com##.app-list-item:has-text(/PC SpeedCAT/i)
softonic.com##.app-list-item:has-text(/DLL Helper/i)
||totalav-essential-antivirus.en.softonic.com^
||iobit-uninstaller.en.softonic.com^
||drivereasy.en.softonic.com^
||mycleanpc-pc-optimizer.en.softonic.com^
||pc-speedcat.en.softonic.com^
||advanced-systemcare-ultimate.en.softonic.com^
softonic.com##.modal-di__content
softonic.com##.modal-di__header
softonic.com##.modal-di__button-wrapper:has(#download-recommended-app)
||images.sftcdn.net/images/*/di/winzip-compression/
! Google Play (web only)
play.google.com##div.mpg5gc.ImZGtf:has-text(/TotalAV/i)
play.google.com##div.mpg5gc.ImZGtf:has-text(/scanguard/i):has-text(/Protected.net/i)
play.google.com##div.mpg5gc.ImZGtf:has-text(/PC Protect/i):has-text(/Protected.net/i)
||play.google.com/store/apps/details?id=com.totalav.android
||play.google.com/store/apps/details?id=com.scanguard.android
||play.google.com/store/apps/details?id=com.pcprotect.android
||play.google.com/store/apps/developer?id=Protected.net+Group+Limited
! Apple App store (web only)
||apps.apple.com/*/app/totalav/id1130411958
||apps.apple.com/*/app/total-adblock-ad-blocker/id1564900435
||apps.apple.com/*/app/pcprotect/id1130412321
||apps.apple.com/*/app/totalav-safe-site/id1403850681
||apps.apple.com/*/developer/protected-net-group-limited


! ----- a test url to make sure your protection is active -----
||iam-py-test.github.io/malware.html^

! ----- additional rules -----

! include Google Safe Browsing & M$ Smartscreen lists

! include VXVault.net's threat feed parsed for uBlock Origin



! END