Interesting Malware Blocklist

trish · 2 May 2022 06:46

I stumbled upon this malware blocklist, and was surprised how well documented and categorized it is.

An example would be:

Malicious or purchaseable domains found in videogame manuals and title screens

In another category I noticed a website of a good old Linux distro, which has been discontinued, and now listed as bad

Mandriva . dot com

Here is the list in a “host file” version but just for your information, I don’t think it could be used in this form with IPfire.

github.com/DandelionSprout/adfilt

Alternate%20versions%20Anti-Malware%20List/AntiMalwareHosts.txt

master

# Title: 💊 Dandelion Sprout's Anti-Malware List («hosts» file version)
# Version: 26February2026v1
# Expires: 1 day
# Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks domains and domain patterns used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
# Users of Pi-Hole FTL 5.22 and later can consider switching to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/refs/heads/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, due to an unconfirmed belief of mine that it allows better wildcarding than the Hosts and raw-domains versions.
# Users of uBlock Origin are STRONGLY RECOMMENDED to switch to the uBO list version at https://raw.githubusercontent.com/DandelionSprout/adfilt/refs/heads/master/Dandelion%20Sprout's%20Anti-Malware%20List.txt, unless otherwise proven.
# Users of AdGuard Home are STRONGLY RECOMMENDED to switch to the || version at https://raw.githubusercontent.com/DandelionSprout/adfilt/refs/heads/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuardHome.txt, unless otherwise proven.
!#if !env_mv3
# Note: When asking us to whitelist a site: Make sure the site has some sort of public content. Non-public sites and alias sites are usually not whitelisted.
# For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
# Homepage: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/General-info.md#-english

# Legitimate use is almost non-existent, but has a tiny userbase in Japan and among upstart coding experiments. Its extreme common-ness in malware redirections means that the entry will be kept forever.

# (Loosely inspired by https://github.com/DandelionSprout/adfilt/issues/1067)

# (An E-mail tip)
# https://github.com/DandelionSprout/adfilt/issues/1108
# https://github.com/DandelionSprout/adfilt/issues/1158
# International topical domains that have consistently horrendous scores on watchlists of bad TLDs, and whose use for legit purposes is practically non-existent.

This file has been truncated. show original