! Title: uBlock₀ filters – Badware risks
! Last modified: %timestamp%
! Expires: 5 days
! Description: For sites documented to put users at risk of installing adware/crapware/malware, having login credentials stolen, etc.
! The purpose is to at least ensure a user is warned of the risks ahead.
! License: https://github.com/uBlockOrigin/uAssets/blob/master/LICENSE
! Homepage: https://github.com/uBlockOrigin/uAssets
!
! GitHub issues: https://github.com/uBlockOrigin/uAssets/issues
! GitHub pull requests: https://github.com/uBlockOrigin/uAssets/pulls
!
! Each entry has to be well enough sourced, see the comments above each entry for sources

! Using request of type `document` will cause the whole site to be blocked through
! strict blocking, yet the site will render properly if a user still decides to
! go ahead.

! 2014-10-22: https://assiste.com/01Net.html
! 2013-03-25: https://www.malekal.com/pctutotuto4pc-association-avec-01net/
! 2012-10-31: https://www.journaldunet.com/solutions/dsi/des-malwares-sur-telecharger-com-01net-1012.shtml
! 2012-10-30: https://www.lesnumeriques.com/appli-logiciel/telecharger-depuis-01net-nuit-gravement-a-sante-pc-n26763.html
! 2012-06-17: https://www.malekal.com/01net-pc-optimizer-pour-ne-pas-optimiser-son-pc/
! 2012-02-17: http://neosting.net/logiciels/01net-et-softonic-ajoutent-aussi-un-installeur-publicitaire.html (Dead page)
||01net.com/telecharger/$doc

! 2015-03-11: https://blog.emsisoft.com/en/12678/mind-the-pup-top-download-portals-to-avoid/
! 2015-01-21: https://www.howtogeek.com/207692/yes-every-freeware-download-site-is-serving-crapware-heres-the-proof/
! 2015-01-11: https://www.howtogeek.com/198622/heres-what-happens-when-you-install-the-top-10-download.com-apps/
! 2012-06-27: https://insecure.org/news/download-com-fiasco.html
! 2011-12-05: https://seclists.org/nmap-announce/2011/5
! 2011-08-22: https://www.extremetech.com/computing/93504-download-com-wraps-downloads-in-bloatware-lies-about-motivations
! https://github.com/uBlockOrigin/uAssets/issues/926
! ||download.cnet.com^$doc

! https://github.com/uBlockOrigin/uAssets/issues/79
||flexytalk.net^

! https://github.com/uBlockOrigin/uAssets/issues/1547
||vlc.de^$doc

! https://github.com/uBlockOrigin/uAssets/issues/1738
||audacity.de^$doc

! https://github.com/uBlockOrigin/uAssets/issues/1853
||havenworks.com^$doc

! https://github.com/gorhill/uBlock/wiki/Badware-risks#ublockorg
! ||ublock.org^$doc
~support.ublock.org,ublock.org##main::before:style(content: 'uBlock is unrelated to the well-known uBlock Origin.' !important; font-size: 32px !important; color: red !important; font-weight: bold !important;)
support.ublock.org##div.hero-unit > div.search-box--hero-unit::before:style(content: 'uBlock is unrelated to the well-known uBlock Origin.' !important; font-size: var(--font-size-h2) !important; color: red !important; font-weight: bold !important;)

! https://github.com/uBlockOrigin/uAssets/issues/3060
! https://www.bleepingcomputer.com/news/security/fake-websites-for-keepass-7zip-audacity-others-found-pushing-adware/
! https://www.virustotal.com/#/file/a5616985e92ca7c1df3b132d2da2ef33c64f38ba2dca40445017037473d7d014/detection
! https://twitter.com/certbund/status/1127864403276091393
! https://github.com/uBlockOrigin/uAssets/issues/17880
||7zip.es^$doc
||7zip.fr^$doc
||7zip.it^$doc
||adblock.fr^$doc
||aresgalaxy.es^$doc
||audacity.es^$doc
||audacity.fr^$doc
||audacity.it^$doc
||audacity.pl^$doc
||azureus.es^$doc
||bittorrent.es^$doc
||bleachbit.com^$doc
||blender3d.es^$doc
||blender3d.fr^$doc
||bluestacksdownloads.com^$doc
||calibre.it^$doc
||celestia.es^$doc
||celestia.fr^$doc
||clonezilla.es^$doc
||clonezilla.fr^$doc
||clonezilla.it^$doc
||cyberduck.de^$doc
||cyberduck.es^$doc
||cyberduck.fr^$doc
||cyberduck.it^$doc
||filezilla.es^$doc
||filezilla.fr^$doc
||filezilla.it^$doc
||filezilla.net^$doc
||filezilla.pl^$doc
||freefilesync.com^$doc
||freerapid.fr^$doc
||garagebandforpc.org^$doc
||gimp.es^$doc
||gparted.fr^$doc
||gparted.it^$doc
||greenshot.fr^$doc
||greenshot.org^$doc
||handbrake.es^$doc
||handbrake.it^$doc
||inkscape.es^$doc
||inkscape.fr^$doc
||inkscape.it^$doc
||izarc.fr^$doc
||jdownloader.fr^$doc
||keepass.com^$doc
||keepass.de^$doc
||keepass.es^$doc
||keepass.fr^$doc
||keepass.it^$doc
||keepassxc.com^$doc
||notepad2.com^$doc
||office.org^$doc
||open-office.fr^$doc
||openoffice.de^$doc
||paintnet.es^$doc
||paintnet.fr^$doc
||paintnet.it^$doc
||pdfsam.com^$doc
||peazip.com^$doc
||qbittorrent.com^$doc
||scribus.fr^$doc
||scribus.it^$doc
||senuti.org^$doc
||smplayer.org^$doc
||stellarium.es^$doc
||stellarium.fr^$doc
||truecrypt.fr^$doc
||truecrypt.it^$doc
||unetbootin.net^$doc
||unetbootin.org^$doc
||utorrent.it^$doc
||virtualbox.es^$doc
||virtualbox.pl^$doc

! https://github.com/uBlockOrigin/uAssets/issues/3730
! https://blog.sucuri.net/2018/10/malicious-redirects-from-newsharecounts-com-tweet-counter.html
||newsharecounts.s3-us-west-2.amazonaws.com/nsc.js$script

! https://github.com/uBlockOrigin/uAssets/issues/4201#issuecomment-458340273
||hentaiplaytime.com^$doc

! foxload.com badware
||foxload.com^$doc

! aksia.co badware
! Ref: https://www.bleepingcomputer.com/news/security/phisher-announces-more-attacks-against-hedge-funds-and-financial-firms/
||aksia.co^$doc

! ReImagePlus links
! https://github.com/uBlockOrigin/uAssets/issues/5136
! Ref: https://forums.malwarebytes.com/topic/194200-removal-instructions-for-reimage-repair/
! https://windowsreport.com/extend-windows-laptop-battery-life/
windowsreport.com##.code-block
! https://appuals.com/fix-error-0x800701e3-on-windows-7-8-1-10/
appuals.com##.appua-reimage-top
appuals.com##.info.box
! https://ugetfix.com/ask/how-to-fix-windows-store-error-0x8000ffff/
pcseguro.es,sauguspc.lt,sichernpc.de,ugetfix.com,wyleczpc.pl##.download_button_info_texts
pcseguro.es,sauguspc.lt,sichernpc.de,ugetfix.com,wyleczpc.pl##.js-download_button_additional_links
pcseguro.es,sauguspc.lt,sichernpc.de,ugetfix.com,wyleczpc.pl##.primary_download
pcseguro.es,sauguspc.lt,sichernpc.de,ugetfix.com,wyleczpc.pl##.sidebar_download_inner
pcseguro.es,sauguspc.lt,sichernpc.de,ugetfix.com,wyleczpc.pl##div.attention-button-box-green
! https://www.thewindowsclub.com/fix-windows-update-error-0xc1900130-on-windows-10
thewindowsclub.com##.entry-content > div > strong:has-text(find & fix Windows error)
! https://www.majorgeeks.com/files/details/patch_my_pc.html
majorgeeks.com##b:has(a[target^="reimage"])
||majorgeeks.com/images/icons/red_icon_18x17px.png$image
! https://www.2-spyware.com/remove-redirector-gvt1-com.html
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.attention-button-wrap:has-text(Reimage)
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.ui-content > .win
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.sidebar_download_inner > :not(.voting-box):not(.colorbg-grey)
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##th:has-text(/^Detection$/)
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##th:has-text(/^Detection$/) + td
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.js-download_button_offer
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.primary_download
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.automatic_removal_list
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.quick-download-button-placeholder
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.nfc-bottom-right:has-text(Reimage)
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##a:has-text(Reimage)
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.quick-download-button-text
! https://windowsloop.com/network-adapters-shortcut/
||reimageplus.com^$doc

! Lapsed domains that once hosted adblock lists, several of whom are now used for bad purposes
! https://github.com/uBlockOrigin/uAssets/issues/5307
||gjtech.net^$doc

! Badware
||kuhoot.it^$doc

! Fake cloudflare screen
! https://github.com/uBlockOrigin/uAssets/issues/5305#issuecomment-484754393
! https://github.com/uBlockOrigin/uAssets/issues/5489#issuecomment-488207423
||gmboxx.com^
||mr.media-bucket.com^

! https://github.com/NanoMeow/QuickReports/issues/965#issuecomment-485274387
||pl.allsports4free.club^
||pl.allsports4u.club^

! https://github.com/uBlockOrigin/uAssets/issues/5409
||discount.s3blog.org^
||s3blog.org^$3p

! https://github.com/uBlockOrigin/uAssets/issues/5442
||tplinkextender.net^

! https://github.com/uBlockOrigin/uAssets/issues/4862#issuecomment-486941006
||upload4earn.org^$doc

! https://github.com/uBlockOrigin/uAssets/issues/5805
||newsfile.club^$doc

! https://forums.lanik.us/viewtopic.php?f=62&p=149407#p149406
||buzzadnetwork.com^$all

! https://arstechnica.com/information-technology/2019/08/google-play-app-with-100-million-downloads-executed-secret-payloads/
||abcdserver.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/6381
||americanoverlook.com^
||embols.com^
||endingthefed.com^
||goneleft.com^
||nephef.com^
||newsbreakshere.com^
||rilenews.com^
||thecontroversialfiles.net^
||voxtribune.com^

! https://blog.sucuri.net/2018/08/massive-wordpress-redirect-campaign-targets-vulnerable-tagdiv-themes-and-ultimate-member-plugins.html
||checkisreal.com^
||mysecurify.com^

! https://www.wordfence.com/blog/2019/08/malicious-wordpress-redirect-campaign-attacking-several-plugins/
||developsincelock.com^
||gabriellalovecats.com^
||jackielovedogs.com^
||tomorrowwillbehotmaybe.com^

! https://github.com/uBlockOrigin/uAssets/issues/6452
||apple.com-*.live^

! redirects
||nextyourcontent.com^$all
||doctopdftech.com^$all
||best2019-games-web4.com^$all
||searchdimension.com^$all
||beqbox.com^
||bblck.me^$all
||glinks.co^$all
/?track=*&key=$all
||getsecuritysuite.com^$all

! SpyHunter links
! Ref: https://blog.malwarebytes.com/detections/pup-optional-spyhunter/
! https://howtoremove.guide/redirector-gvt1-com-virus-malware-chrome-removal/
howtoremove.guide##div[style^="border:2px"]
howtoremove.guide##.entry-content > div:has-text(Special Offer)
! https://howtoremove.guide/redirector-gvt1-com-virus-malware-chrome-removal/ (German version only)
howtoremove.guide###solution_v2_de
howtoremove.guide###alt_content_main_div > p:has-text(SpyHunter)
howtoremove.guide###gray_de
! https://www.2-spyware.com/remove-redirector-gvt1-com.html
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##.automatic_removal_list_w > .ar_block_description
2-spyware.com,novirus.uk,faravirus.ro,uirusu.jp,virusi.hr,wubingdu.cn,avirus.hu,ioys.gr,odstranitvirus.cz,tanpavirus.web.id,utanvirus.se,virukset.fi,losvirus.es,virusler.info.tr,semvirus.pt,lesvirus.fr,senzavirus.it,dieviren.de,viruset.no,usunwirusa.pl,zondervirus.nl,bedynet.ru,virusai.lt,virusi.bg,viirused.ee,udenvirus.dk##a:has-text(SpyHunter)

! https://github.com/uBlockOrigin/uAssets/pull/6757
||tncrun.net^$all

! thepiratebay3 .com bad
thepiratebay3.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/6544#issuecomment-586763083
||procdnvids.net^

! https://github.com/NanoMeow/QuickReports/issues/2577
! https://www.reddit.com/r/uBlockOrigin/comments/12nrzng/
||mybestclick.net^$3p

! https://github.com/NanoMeow/QuickReports/issues/3205
||verified-extensions.com^

! https://github.com/NanoMeow/QuickReports/issues/3299
! https://github.com/NanoMeow/QuickReports/issues/3300
||smsiak.pl^$doc
||smsy24.pl^$doc

! redirecting domains / fraud
||video-adblock.com^$all
||vid-adblocker.com^$all
||multiadblock.com^$all
||popsads.link^$all
||adverdirect.com^$all
||bestwinexperience.com^$all
||traffic-go.com^$all
||streamssitesearch.com^$all
||trackertrak.com^$all
||bingstyle.com^$all
||redirekted.com^$all
||blockskipad.com^$all
||adpopblocker.com^$all
||trafficjunction.com^$all
||arclk.net^$all
||1111sale.us^$all
||n06.biz^$all
||um-bredirect.com^$all
||glbltraffic.com^$all
||inspirationhistorical.com^$all
||maroohost.online^$all
||amigosdetuciudad.com^$all
||bb-delivery.icu^$all
||praterage-colled.com^$all
||pwrtds.com^$all
||trackbyfast.com^$all
||trfrc.com^$all
||1ts11.top^$all
||dating.hdxvideos.ru^$all
||elevisions.biz^$all
||harzfriends.de^$all
||moviesboys.com/*.shtml$doc
||sex-is-here.com/*.shtml$doc
||sexall.net/*.shtml$doc
||urtyert.com^$all
||hsrvu.com^$all
||adtr1.com^$all
||axdsz.pro^$all
||datingapp.live^$all
.com/c/*?s1=$doc,to=com
.net/c/*?s1=$doc,to=net
/tds/ae?tds_campaign=$doc
||adating.link^$all
||benaughty.com^$all
||bnewsblite.me^$all
||ckre.net^$all
||gotohouse2.cc^$all
||letmessagenow.com^$all
||x-soft.club^$all
||apilond.com^$all
||tracklyfast.com^$all
||pupok.link^$all
||ntvpevnts.com^$all
||aditserve.com^$all
/bdv_rd.dbm?ownid=$doc
?bid=0.*&search_referrer_domain=$doc
||fecebook.com^$all
/apop/redirect/zone/*$doc,popup
/?pl=*&sm=$doc
||fortuneadvert.com^$all
||lalielynaualish.com^$all
||casino-ice.fun^$all
.com/go/*?clickid=$doc

! hacked and abused for redirect
||clicks.affstrack.com^
?zoneid=*&cost=0.$doc
/zcredirect?visitid=*&iframeDetected=false|$doc
*/zcvisitor/*?campaignid$doc
||tweitter.com^$all
||mqdownload.com^$all
/pop-click?sid=*&data=$doc
/click?a=*&aff_click_id=$doc
||trwl1.com^$all
||pushmeup.art^$all
||adserver*/?sdomain=$doc,popup
/click.php?data=$doc
&adspot_id=*&cost=0.$doc
||s4f.net^$all
||cleardexchange.com^$all
||lone1y.com^$all
||tr1net.com^$all
||neighborhoodsluts.com^$all
.xyz/video.php?=*&dating_xyz_0&&0$frame
/click?pid=*&sub1=$doc
! fraud => https://forums.lanik.us/viewtopic.php?f=90&t=45586
||411medias.com^$all
||internetspeedtracker.com^$all
||system-update-new-2021.com^$all
||download-app.net^$all
||pu4.biz^$all
||privatesinglesmeet.com^$all
||readytosinglesmeet.com^$all
||cleanphonefast.com^$all
||reimageplusminus.me^$all
||theshoparound.com^$all
||onlineplus.click^$all
||trafempire.com^$all
||iamnaughty.com^$all
||iwantu.com^$all
||myhotdates.com^$all
||onenightfriend.com^$doc
||buddygays.com^$all
||localsnapsext.com^$all
||heartmedia.biz^$all
.php?key=*cost=$doc,popup
||djin.site^$all
||antivirus.landerhd.com^$all
/?clck=*&sid=$doc
||love7date.info^$all
||bestsecretflirt.com^$all
||toplov.com^$all
||gegenhartz.de^$all
||marootrack.co^$all
&dci=*&tds_campaign=$doc
||revpu.sh^$all
/smartlink/?a=$doc
||date.sexpartnercommunity.com/landing/*$doc
/ll/click.php?key=$doc
/?ip=*&uclickhash=$doc
||cheaterboss.com^$all
||cumshots.com^$all
||real-women-online.com^$all
/?camp=*&cost=0.$doc
||monglitch.monster^$all
||d13nu0oomnx5ti.cloudfront.net^
||getmackeepersoftpro.xyz^$all
||familysimulator.$all
||adblockfast.com^$all
||bookofsex.com^$all
||mydirtytinders.com^$all
||fuckmore.com^$all
||greengoplatform.com^$all
||transportgoline.com^$all
||onlyfreelesbianporn.com^$all
||family-simulators.com^$all
||your-dates-tonight.com^$all
||familysimulatorgame.com^$all
||trackingboost.com^$all
||update-protection.com^$all
||asiaxdate.com^$all
||hotsimulator.com^$all
/aff.php?*&data2=$doc
/tds/ae?*&clickid=$doc
/?clickid=*&ptracker=$doc
||vehicle-insurance-quote.com^$all
^lpkey=*&uclickhash=$doc
||d135aysof2oufc.cloudfront.net^$all
/?banner=*&phone=$doc
||advidates.com^$all
||dvjqvdfujjvvkuyvhjqdvbjcmioljbhjmijq.s3.ap-northeast-1.amazonaws.com^$all
/?clickid=*&cost=0.$doc
/index.php?key=*&t1=$doc
/click?key=*&t1=$doc
||cmprotraf.club^$all
||prelandappslab.com^$all
/registration?theme=*&a_aid=$doc
.top/prize/*.php?c=$doc
||di02.biz^$all
||adultonlineplay.com^$all
||fastandslut.com^$all
&click_price=0.*&click_id=$doc
?brand=*&model=*&lptoken=$doc
?brand=*&fingerprint_=$doc
||familialsimulation.com^$all
/\/(?:[0-9a-z]{7,25}-){9,13}[0-9a-z]{10,15}\/(?:[0-9a-z]+\/)+index\.php/$doc
||datingformeeting.com^$all
/_dating\d\/index\.html\?aref=/$doc
||familysimulators.$all
^apb=*&ata=mobilemdots^$doc
||uoutube.com^$all
! kkomj.ofchildr.buzz
||celxkpdir.com^$all
^cep=*&zoneid=$doc
^cep=*&s1=$doc
.top/robot4*&a=$doc,to=top
||androidnotice.com^$all
^s=*&ssk=*&svar=*&z=$doc
^s=*&z=*&svar=*&ssk=$doc
/?cid=*&dom=$doc
/?type=*&button=2&clickid=$doc
||valrogrowth.com^$all
^device_model=*&p1=https$doc
||5.61.55.143^
.biz/sw/w1s.js|$script,3p
/click.php?key=*&cpc=0&$doc
||37.1.213.100^
/?p=*&sub1=$doc
.xyz/ddos/1tn.html?clickid=$doc
://e.*.top/video/?c=$doc
/?srv_id=*#$doc
||love88.club^$all
.html?cep=*&cost=0.$doc
||familysexsimulators.io^$all
||23.109.87.170^
.live/1*.html?cep=$doc
||edfringe.com/*.php$all
||grakorte.com^$all
/click.php?key=*&zone_id=$doc
/domredirect?visitid=$doc
||smart-redirecting.com^
?adTagId=*&extclickid=$doc
/antibot*/ab.php$xhr,1p
||elooksjustli.one^
||keepsclean.com^$all
||magictrack1.com^
||my-cleaner.info^$all
||news-zolehe.com^$all
||ready-for-download.com^
||rcuacroossonec.com.ua^
||thbstvd.com^
/SRC/SRC.php?c=$doc
&tb=redirect&allb=redirect&ob=redirect&href=$doc
||datingmeetnet.com^$all
||bndl-trp.com^$all
||clean-2-clean.club^$all
||top-official-app.com^$all
||pornonenight.com^$all
||youfindadate.top^$all
?z=*&ymid=$doc
?z=*&cnv_id=*&sourceid=*&t1=$doc
||xypthe.com^
||besluor.com^
/jr.php?gz=$doc
/g?visitorid=*&extra_data2=|$doc
.com/play-2?h=*=eyJ&si1=$doc
/\.com\/proc\.php\?[0-9a-f]{40}$/$doc
||postyourlife.com^$all
||rplnd60.com^$all
||iwinprize.xyz^$all
||shosril.com^
||meetamate.site^
||dm09.biz^$all
/click.php?key=*&dj_placement=$doc
&srv_id=terra#$doc
||ultimate-clean.club^$all
||pcconelove.xyz^$all
||video.redwap.cam^$all
||cractica.xyz^$doc
||beyourxfriend.com^$all
||bybygnom.com^$all
||paderrer.com^$all
||best-site-online.com^
/jump/next.php?r=$doc
||softronline.click^
/?clickid=*&t2=$doc
||skipalos.xyz^$all
||makenoads.com^$all
||dateclique.life^
||family-simulators.io^$doc
||familyfornicate.com^$doc
||speedtestnow.site^$all
||lovedatee.net^$all
/dating_lp?keyword=$doc
/bonus/*.php?c=$doc,to=space|top
||club-gagnant.online^$all
/common-player-arrow/index.html?var=*&zoneid=$doc
/common-player/index.html?var=*&zoneid=$doc
/not-a-robot/index.html?$doc
||amazonaws.com/www.yournewlocalflingfinder7.com/$all
||dirtyfree.games^$all
||familycheaters.net^$all
||register.blissfulltimes.com^$doc
.com/pl?o=$doc
||geheimerseitensprung.com^$all
||matches4you.info^$all
||reifenachbarn.com^$all
/zclkredirect?visitid=$doc
||naughtymets.com^$all
||linkprotecttrck.com^$all
||www3secure.com^$all
||midnighthookup.today^$all
||padsthai.com^$all
||dirtyflirt9.com^$all
||bestvideo.cloud^$all
||bmtracks.com^$all
||bustymeets.com^$all
||aht42trk.com^$all
||jasnathvibes.com^$all
||lewdmilfh22y.com^$all
/mc-test/*/index.php?cid=$doc
||attractivecutiewcx.com^$all
||click-allow.top^
||spiendidates.com^$all
||alone-here.online^$all
||newonlinedates.com^$all
/?l=*&ymid=$doc
.com/r2.php?e=$doc
/video_app/adult/*/index.html?*p1=$doc
||apphasten.com^$all
||shinqueen.com^$all
/downloadapp/*/index.html?*p1=$doc
.com/afu.php?zoneid=$doc
||altairaquilae.com^$doc
||himasearch.shop^$doc
||reddriko.site^$all
||trripwire.com^$all
/dating/adult/*/index.html?*p1=$doc
/video-app-default/adult/*/index.html?*p1=$doc
||meet-flirts.com^$all
||mltrck.com^$all
||meetshorny.link^$all
||trckoja.com^$all
||trckams.com^$all
||pecuniatrck.com^$all
||smart-tds.com^$all
||nicking-unding.com^$all
||164.132.74.156^$all
||icetraff.com^$all
||girlsml.com^$all
||pussycat1.online^$all
||guardlnkcaptcha.com^$all
/gambling/main/default/*/index.html?*p1=$doc
/?p=*5gi3bp*$doc,to=biz|com
||landings.namapper.com^
||bd4jn7dk9u.com^$all
||throb.fun^$all
||throww.fun^$all
||dattter.shop^$all
||imp2.com^$all
/click.php?key=*&price=$doc
?click_id=*&tds_cid=$doc
.com/lp*.html?zoneid=$doc
/vpn/adult/*/index.html?*p1=$doc
||dunabear.com^$all
||mialifestyle.com^$all
||miafann.online^$all
||dating365.link^$all
||trckhoul.com^$all
/utility/adult/*/index.html?*p1=$doc
/1/index.html?c=$doc
/2/index.html?c=$doc
||1win-17545.com^
||onlysexygirl.com^$all
||binomasia.com^$all
/protectme_new1/index.html?$doc
||nyeeiye2.click^$all
||privatedates.link^$all
||trckotang.com^$all
||ct01.biz^$all
||ehnax.sbs^$all
||mobilerefreshpro.xyz^$all
||rekosx.co.in^$all
||remor.xyz^$all
||github.io/health-records-x-ray$doc
||adultminglenight.click^$all
||derriks.site^$all
||datenaughtysingles.click^$all
||flirtyconnection.click^$all
/other/btn/*/index.html?*p1=$doc
||suitablepartner.life^$all
||ohmysweetromancespot.life^$all
||painfont.cyou^$all
||builder.hufs.ac.kr/goLink.jsp?url=xn-$doc
||lamilagq.com^$all
/1/index.html?p1=$doc
/fb_video_googleplay/*/index.html?*p1=$doc
.sbs/c/*?s1=$doc
||lurk-online.com^$all
||datesmart.link^$all
||foxymilfspo.com^$all
||kissablepopsyv.click^$all
/click.php?key=*&type=push&$doc
.com/dating/*/index.html?lang=$doc
.info/?key=*&pixel=$doc
/?z=*&syncedCookie=true&rhd=false$doc,popup
||matcher.one^$all
||onlyhotdgirl.com^$all
||playfulmilfs.com^$all
||wooqi.win^$all
||chemiclk.com^$all
||techluki.com^$all
||lovestrive.org^$all
||vcnbbtrack.com^$all
||zodertracker.com^$all
||latenightlovers.com^$all
||clickrotate.net^$all
||date2night.b-cdn.net^
||sweet-hot-lady.top^$all
||ntfck.com^$all
||malenirt.site^$all
||repostponing.cfd^$all
/post/FileRotator_ID*/download.php?subid=$xhr
/bonus/com-*.php?c=$doc
||arousalx.com^$all
||easyfinderke.com^$all
||eroticher.com^$all
||lovenestx.com^$all
||dekarise.site^$all
://click-v4.*.com/click?$doc
://xml-v4.*.online/click?$doc
.monster/?t=$doc
?a=0&u=*&tracker=$doc
||elovify.com^$doc
.de/d8323ll?t=$doc
.top/t99b45h?t=$doc
||derriar.site^$all
||sektfeb.top^$all
||b2base252.top^$all
||smartgethub.com^$all
/?utm_source=*&j1=1^$doc

! https://github.com/uBlockOrigin/uAssets/issues/24602
! https://www.virustotal.com/gui/url/ce2b833adda2f862d77398203bbe33ea331097ba2a803d1a763492d2ac0d5a60
! https://safeweb.norton.com/report/show?url=discordvip.createsocialcard.top
! https://safeweb.norton.com/report/show?url=discordvip.pages.dev
||mikkim.top^$all
||discordvip.createsocialcard.top^$all
! https://www.virustotal.com/gui/url/a75fa82a901bdbb46bb9f214d99374495332a876a6d953bbe5c5d1c4217a90f8
||whatsapp-32w.pages.dev^$all
! https://www.virustotal.com/gui/url/e652bc90d72bcda74485e90218143fc41a630b979f72e1659df916e2eb08c28e
^s1=*&click_id=$doc
! https://www.virustotal.com/gui/url/16f860e9177badfbe960f2a9272d652ec0f57898763920b0e039b6292ac3053c
! https://www.virustotal.com/gui/url/16f860e9177badfbe960f2a9272d652ec0f57898763920b0e039b6292ac3053c
! https://github.com/uBlockOrigin/uAssets/issues/24731
##html[lang] > body.ishome > div.adult + main.main
^mh=*&mmid=$doc,script
||onenightchicko.com^$all
||nudepopsy71c.com^$all
! https://www.virustotal.com/gui/url/8cf51404736d06441fdd527108bfb65cf97bd4801698e4a3ff91cfc605baded9
||c0nt4ct-me.pages.dev^$all

! https://github.com/AdguardTeam/AdguardFilters/issues/68588
! https://github.com/uBlockOrigin/uAssets/issues/8869
! https://github.com/AdguardTeam/AdguardFilters/issues/129112
/^https:\/\/[0-9a-z]{3,}\.[-a-z]{10,}\.(?:li[fv]e|top|xyz)\/[a-z]{8}\/(?:article\d{4}\.doc)?\?utm_campaign=\w{40,}/$doc,match-case,to=life|live|top|xyz
/^https:\/\/[a-z]{2,3}\d\.biz\/go\/[0-9a-z]{15,18}$/$doc,to=biz
! fake dating/prize/video sites
! https://github.com/AdguardTeam/AdguardFilters/issues/183117
/^https?:\/\/[0-9a-z]*\.?[-0-9a-z]{3,}\.[a-z]{2,11}\.?[a-z]{0,7}\/(?:[0-9a-z]{6,10}\/)?\/?(?:article\d{4}\.doc)?\?(?:cid=[0-9a-z]+&)?u=[0-9a-z]{7}(?:&t=\d+)?&o=[0-9a-z]{7}/$doc,frame,match-case
! https://github.com/uBlockOrigin/uAssets/commit/df17084b4815e87d420e8adf19bf4959e828e6e5#commitcomment-66510549
/^https?:\/\/[0-9a-z]*\.?[-0-9a-z]{3,}\.[a-z]{2,11}\.?[a-z]{0,7}\/(?:[0-9a-z]{6,10}\/)?\/?(?:article\d{4}\.doc)?\?(?:cid=[0-9a-z]+&)?o=[0-9a-z]{7}(?:&t=\d+)?&u=[0-9a-z]{7}/$doc,frame,match-case
.live/web/?sid=t*~$doc
! https://urlscan.io/result/fb21aa1b-9c79-4ac4-8e82-386403964206/
/?u1=*&o1=*&sid=t*~$doc
! push notification scam
/^https:\/\/(?:www\d\.)?[-a-z]{6,}\.(?:club|com|info|net|org)\/(?=[-_a-zA-Z]{0,42}\d)(?=[-_0-9a-z]{0,42}[A-Z])[-_0-9a-zA-Z]{43}\/\?cid=[-_0-9a-zA-Z]{10,36}(?:&qs\d=\S+)?&(?:s|pub)id=[-_0-9a-z{}]{1,32}(?:&s=0\.\d+)?(?:#\S+)?$/$doc,match-case,to=club|com|info|net|org
/^https:\/\/(?:www\d\.)?[-a-z]{6,}\.(?:club|com|info|net|org)\/(?=[-_a-zA-Z]{0,42}\d)(?=[-_0-9a-z]{0,42}[A-Z])[-_0-9a-zA-Z]{43}\/\?(?:pub|s)id=[-_0-9a-z{}]{1,32}(?:&qs\d=\S+)?&cid=[-_0-9a-zA-Z]{10,36}(?:&s=0\.\d+)?(?:#\S+)?$/$doc,match-case,to=club|com|info|net|org
/^https:\/\/(?:www\d\.)?[-a-z]{6,}\.(?:club|com|info|net|org)\/(?=[-_a-zA-Z]{0,42}\d)(?=[-_0-9a-z]{0,42}[A-Z])[-_0-9a-zA-Z]{43}\/\?clickID=[0-9a-f]{32}&sourceID=\d+$/$doc,match-case,to=club|com|info|net|org

! https://github.com/uBlockOrigin/uAssets/issues/8378
||ogtrk.net^

! https://github.com/uBlockOrigin/uAssets/issues/8466
||91.241.60.117^$all

! https://github.com/uBlockOrigin/uAssets/issues/8630
||mfilecloud.com^$all
||xsharenode.com^$all
||basesfiles.com^$all
||sharpfiledownload.com^$all
||one-click.cc^$all
||descarga.pw^$doc
||clc-link.me^$all
||app.mediafire.com/v3txu5tkw7ln5$doc
||app.mediafire.com/tmiueij4j8d6g$doc
||app.mediafire.com/29ph7u17caayi$doc
||mediafire.com/folder/ofa1qju50ffaz/$doc
||mediafire.com/folder/hm0b7x2593fh1/$doc
||mediafire.com/folder/86rkvkl7eswi2/$doc
||mediafire.com/folder/4fsmxnec5zkpl/$doc
||www.youtube.com/@pengwincheat/$doc
||www.youtube.com/@melonitysoft/$doc
||www.youtube.com/channel/UCS9ql1ylQmDx7o_6v15X7mw/$doc
||www.youtube.com/channel/UCEMJ0wTeQgvyyvQTil7tteQ/$doc
||www.youtube.com/channel/UCNLgP9j7dK6tvEiZC2wZp5Q/$doc
||www.youtube.com/channel/UCwmnsubfOCTN_xMhg4czo5A/$doc
||sites.google.com/view/hubgames|$doc
||sites.google.com/view/flechh|$doc
||sites.google.com/view/kostsoft|$doc
||sites.google.com/view/projectxx1|$doc
||sites.google.com/view/ex1aucnh3r1/$doc
||sites.google.com/view/exlauncher69/$doc
||sites.google.com/view/drcheats6|$doc
||sites.google.com/view/extnllmm|$doc
||gamefree.vip^$doc
||gocrazy.gg^$doc
||murhack.com^$doc
||mi-hack.com^$doc
||wow-site.site^$doc
||cheatworld.site^$doc
||upload.advgroup.ru/mvWwiE4h$all
||fusionhacks.pro^$doc
||games-blacksoft.com^$doc
||freefiles-upload.com^$doc
||arcanecheat.com^$doc
||projectglbl.lol^$doc
||evilmods.com^$doc
||zencloud.life^$doc
||projecthygieia.com^$all
||pctopkey.com^$all
||zxcprogs.shop^$all
||loaderaura.com^$all
||auraloads.com^$all
||shadowofff.neocities.org^$doc
||fusionhacks.cc^$doc
||ethelium.club^$doc
||phantomcorestudios.net^$doc
! https://cloud-folder.org/KRvjWueEcl/
! https://cloud-pack.org/yE2Kn04/
||cloud-folder.org^$doc
||cloud-pack.org^$doc
||cloud-deployments.org^$doc
||tech-cloud.org^$doc
||cloud-access.org^$doc

! https://github.com/AdguardTeam/AdguardFilters/issues/69036
.systems/signup?ad_domain=$doc,popup

! fake software updaters /redirections
||atnpx.com^
||best-winplace.life^$all
||checkup08.biz^
||mfroute.com^
||webpushcloud.top^
||workerz1.com^
/index.php?uid=*&code=ad^$doc
||koitushinterneinnehmen.s3.eu-central-1.amazonaws.com^$all

! https://github.com/AdguardTeam/AdguardFilters/issues/84638
||sinder8.com^$all
! https://github.com/AdguardTeam/AdguardFilters/issues/84640
||bigosext69.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/9344
||captcharesolving-universe.com^$all

! scam
||trfcbooost.com^$all
||turboadblocker.com^$all
||youtuba.com^$all

! Typosquatting: redirects to scam sites
! https://www.reddit.com/r/uBlockOrigin/comments/12ok014/
! https://www.reddit.com/r/uBlockOrigin/comments/12nrio5/
! https://www.reddit.com/r/uBlockOrigin/comments/1392c8f/
||bestbut.com^$all
||girhub.com^$all
||gmkail.com^$all
||goglle.com^$all
||linkefdin.com^
||twitterr.com^$all
||yautube.com^$all
||yourube.com^$all
||youtubee.com^$all
||youtunbe.com^$all
||youutube.com^$all
||youvetube.com^$all
! https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/WJXUELicBQAJ
! "looks like typo squatting"
||wanderlust.rocks^$all
||messagesafe.net^$all
||msgsafe.net^$all
||best4fuck.com^$all
||bamboairways.com.vn^$all,to=~bambooairways.com
! https://github.com/uBlockOrigin/uAssets/issues/26047
||purplexity.ai^$doc,to=~perplexity.ai

! https://www.huorong.cn/info/1531309921141.html
||kuaizip.com^$all

! https://www.huorong.cn/info/1618397948649.html
! ||zhuangjizhuli.com^$all
! ||zhuangjizhuli.net^$all

! https://github.com/uBlockOrigin/uAssets/pull/9656
||geekotg.com^$all
! https://www.huorong.cn/info/1526627586130.html
||xiaobaixitong.com^$all
! https://www.huorong.cn/info/1577158839403.html
||daque.cn^$all
! https://www.huorong.cn/info/1598957552515.html
||dabaicai.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/9785
||lubuntu.net^$doc

! https://github.com/AdguardTeam/AdguardFilters/issues/92466
/^https:\/\/serch\d{2}\.biz\/\?p=/$doc,to=biz

! https://github.com/uBlockOrigin/uAssets/issues/4014 and https://github.com/uBlockOrigin/uAssets/issues/9840
! ||driverfix.com^$doc

! https://github.com/uBlockOrigin/uAssets/issues/9848
! https://github.com/uBlockOrigin/uAssets/issues/24729
||gghacks.com^$all
||rewardsgiantusa.com^$doc
||promotionsonlineusa.com^$doc
||displayoptoffers.com^$doc
||qualityhealth.com^$doc
||consumerproductsusa.com^$doc
||get-cracked.com^$all
! https://www.urbeef.de/windows-10-pro-aktivieren-ohne-key/ hacked site
||onlinepromotionsusa.com^$doc
||qsshc.xyz^$all
||ecoedgeinnovations.xyz^$all
||medlafire.co^$all
##.buttonautocl

! https://github.com/uBlockOrigin/uAssets/issues/9933
||greenadblocker.com^$doc

! https://github.com/uBlockOrigin/uAssets/pull/10017
||flash.cn^$all

! https://github.com/uBlockOrigin/uAssets/commit/5832dfebb4021c639b90c2973946ff7638c2290f#commitcomment-57642161
||foxmods.xyz^$doc

! phishing /malicious
||gesas.it^$doc
||techinnsrl.com^$doc
||studiogiamberardino.it^$doc
||eniedu.com^$doc
||gamletaarnhuset.no^$doc
||possessedcrackinghart.com^$all
||reepratic.com^$all

! phishing /scam /malware
! https://www.virustotal.com/gui/collection/4b1e307754c94e87e17a0c14102b873f17c5d2001f4afa2e58c3a6b98f391710
||dogehype.com^$all
||rblx.land^$all

! https://github.com/uBlockOrigin/uAssets/issues/10181
||nbryb.com^$all
||realnetnews.com^$all
||rogueleader.org^$all
||suggestive.com/deals/?cid=$doc

! https://github.com/uBlockOrigin/uAssets/issues/10442
||discordap.$all
||discord*.gift^$all,domain=~discord.gift
||discord*.gifts^$all,domain=~discord.gifts
||discord-give.$all
||discord-nitro.$all
||discordgift.$all,domain=~discordgift.site
||dlscord*.$all
||dlscrod*.$all
||freediscordnitro.$all
||updatemobilee.com^$all
||supreme-ad-blocker.info^$all
||allprizesforme.com^$all

! https://github.com/DandelionSprout/adfilt/issues/267
||tekhacks.net^$all

! https://github.com/uBlockOrigin/uAssets/pull/10503
||freedownloadfiles.org^$all

! https://github.com/uBlockOrigin/uAssets/issues/10536
||tw-goldenwinner-57.com^$doc

! https://github.com/iam-py-test/investigations/blob/main/2021/11/25/1.md
! https://github.com/uBlockOrigin/uAssets/pull/10599
||fasterfiles.net^$all

! https://github.com/uBlockOrigin/uAssets/pull/10774
! https://bbs.kafan.cn/thread-2222478-1-1.html
||a1475.com^$all
! https://bbs.kafan.cn/thread-2220230-1-1.html
||ts-group.com^$all
! https://bbs.kafan.cn/thread-2221500-1-1.html
||88btbtt.com^$all

! https://github.com/uBlockOrigin/uAssets/pull/10997
! fake domain
||jinshanduba.org.cn^$all
! https://bbs.kafan.cn/thread-2170747-1-1.html – malicious script
||phpstat.cntcm.com.cn/phpstat/count/abceffgh/abceffgh.js^$script

! https://github.com/uBlockOrigin/uAssets/pull/11041
||cdn.discordapp.com/attachments/916391647955279943/*^$all

! https://github.com/uBlockOrigin/uAssets/issues/11157
||sideload.net^$doc
||stc.tools^$doc
||stcverify.com^$doc
||1980s.click^$doc

! https://github.com/uBlockOrigin/uAssets/issues/11310
! https://github.com/uBlockOrigin/uAssets/issues/14009
! https://github.com/uBlockOrigin/uAssets/issues/24842
goharpc.com,pccrackbox.com,cracklabel.com,pcwarezbox.com,10crack.com,crackproductkey.com,crackpcsoft.net,crackwinz.com,genuineactivator.com,topcracked.com,fullcrackedpc.com,idmfullcrack.info,idmpatched.com,productkeyfree.org,patchcracks.com,cracksole.com,allsoftwarekeys.com,softwar2crack.com,productkeyforfree.com,wazusoft.com,rootscrack.com,activators4windows.com,procrackhere.com,proproductkey.com,freelicensekey.org,pcsoftz.net,freecrackdownload.com,f4file.com,serialkey360.com,zuketcreation.net,filedownloads.store,datanodes.to##[onclick*="open"]
serialkey89.com,installcracks.com,crackserialkey.co,maliksofts.com,crackpropc.com,ayeshapc.com,crackhomes.com,crackspro.co,crackknow.com,4howcrack.com,trycracksoftware.com,getprocrack.co,activationkeys.co,organiccrack.com,softwarance.com,procrackkey.co,download4mac.com,freeactivationkeys.org,explorecrack.com,okproductkey.com,downloadpc.net,up4pc.com,hitproversion.com,cracktube.net,abbaspc.net,crackdownload.org,crackdownload.me,corecrack.com,windowsactivator.info,keygenstore.com,procrackpc.co,getmacos.org,latestproductkey.co,shanpc.com,crackpckey.com,torrentfilefree.com,patchcracks.com,idmfullversion.com,wareskey.com,crackbell.com,newproductkey.com,osproductkey.com,serialkeysfree.org,autocracking.com,crackzoom.com,greencracks.com,profullversion.com,crackswall.com,rootcracks.org,licensekeys.org,softserialkey.com,free4pc.org,productkeys.org,crackedfine.com,idmcrackeys.com,crackedhere.com,licensekeysfree.org,trycracksetup.com,crackedsoft.org,assadpc.com,thecrackbox.com,crackproductkey.com,cracklabel.com,keystool.com,crackedpcs.com,cracksmad.com,licensekeyup.com,chcracked.com,finalcracked.com,activatorpros.com,crackedmod.com,whitecracked.com,cracksoon.com,boxcracked.com,activationkey.org,serialkeypatch.org,crackedsoftpc.com,proapkcrack.com,softscracked.com,freeappstorepc.com,reallpccrack.com,crackfullkey.net,hmzapc.com,zcracked.com,usecracked.com,crackedversion.com,aryancrack.com,piratespc.net,reallcrack.com,fultech.org,crackpro.org,cracksray.com,pcwarezbox.com,cracksmat.com,crackxpoint.com,startcrack.co,crackbros.com,pcfullversion.com,sjcrack.com,repack-games.com,bypassapp.com,crackfury.com,9to5crack.com,zpaste.net##center > [class*="buttonPress-"]
lewdgames.to,repack-games.com,warezcrack.net,freeprosoftz.com,vcracks.com,crackthere.com,keygenfile.net,scracked.com,cyberspc.com,softzcrack.com,crackintopc.com,zslicensekey.com,procrackpc.com,crackshere.com,crackdj.com,cracktopc.com,serialsofts.com,prosoftlink.com,zscracked.com,crackvip.com,windowcrack.com,softsnew.com,licensecrack.net,vstpatch.net,newcrack.info,topkeygen.com,vsthomes.com,vstserial.com,procrackerz.com,pcfullcrack.org,keygenpc.com,bicfic.com,ikcrack.com,downloadcracker.com,karancrack.com,piratesfile.com,activatorwin.com,starcrack.net,crackproduct.com,dgkcrack.com,crackglobal.com,crackcan.com,keygendownloads.com,crackpatched.com,windowsactivators.org,serialsoft.org,crackit.org,productscrack.com,crackurl.info,crackroot.net,crackmak.com,seeratpc.com,crackmix.com,piratepc.me,activators4windows.com,letcracks.com,latestcracked.com,proproductkey.com,fullversionforever.com,vlsoft.net,topcracked.com,goharpc.com,crackeado.net,freecrackdownload.com,assadpc.com,fileoye.com,f4file.com,crackpcsoft.net,crackwinz.com,excrack.com,mahcrack.com,get4pcs.com,keygenwin.com,mycrackfree.com,crackfullpro.com,crackkey4u.com,fileserialkey.com,cracksdat.com,crackgrid.com,licensekeysfree.com,crackkeymac.com,freecrack4u.com,getintomac.net,crackreview.com,activatorskey.com,kuyhaa.cc,cracktel.com,up4crack.com,cracksmat.com,crackbros.com,pcfullversion.com,crackcut.com,game-repack.site,dodi-repacks.download,yasir-252.net,getpcsofts.net,keystool.com,rootcracks.org,procracks.net,newproductkey.com,greencracks.com,zeemalcrack.com,macfiles.org,softzspot.com,softgetpc.com##div[class^="code-block code-block-"]
crackkits.com,crackwatch.org,origincrack.com,procrackerz.com,crackhub.org,crackrules.com,zeemalcrack.com,haxmac.cc,cracka2zsoft.com,clevercracks.com,crackpropc.com,crackspro.co,crackknow.com,onhax.in,haxpc.net##.getox
win-crack.com,productkeyfree.org,productkeyforfree.com,wazusoft.com,piratesfile.com,kalicrack.com,sadeempc.com,letcracks.com,topkeygen.com,thepiratecity.co,torrentmac.net,ryuugames.com,rootscrack.com,pesktop.com,profullversion.com,crackswall.com,proappcrack.com,thecrackbox.com,autocracking.com,zgamespc.com,serialkeysfree.org,torrentfilefree.com,crack11.com,gvnvh.net##center > a[target="_blank"][rel="nofollow noreferrer noopener"]
cracksoftwaress.net##div[style="float: none; margin:10px 0 10px 0; text-align:center;"]
haxnode.net##[id^="haxno-"]
romsdl.net##a[rel="nofollow noreferrer noopener"][target="_blank"]
zuketcreation.net##.cente-1
xcloud.mom##.ads-btns
onhax.in##[class*="buttonPress-"]
cracka2zsoft.com##center > a
origincrack.com##center > button
||xforce-cracks.com^$doc
||fileisready.com^$doc
||coronasfapps.net^$doc
||sustac.com^$all
||hostt.link^$doc
! https://www.virustotal.com/gui/url/306f66e86e6036d8c7b3d0c6ab8af27385505c969af4f998f75ffe1eae2c19be
||scane.click^$all
.click/track/*?title=*&key=$doc,to=click
! https://github.com/uBlockOrigin/uAssets/issues/27275
||crackingpatching.com^$doc
||patchedfiles.com^$doc

! https://github.com/uBlockOrigin/uAssets/issues/15793
! https://github.com/blocklistproject/Lists/issues/933
||vgfrrtc.click^$all
||ovgtt9j87tgh.world^$all
||wisoper.click^$all
||swiftflare.click^$all
||rarz-uploader.com^$all
||uploader-rars.com^$doc
||filedomain.click^$all
||ewuipld.pro^$all
||lokasjc.cfd^$all
||theipfire.co^$all
||securecracked.info^$all
||sushilprajapati.com^$all
||aneurismuox.click^$all
||afiletoget.click^$all
||filexstorage.site^$all
||jourl.live^$all
||ykjnjicn.xyz^$all
||34y26s47.cfd^$all
||atof42ap.click^$all
||kz3wnibp.cfd^$all
||worshippers.store^$all
||decisionsem.live^$all
||deliberatelyot.space^$all
.click/?s=*&g=*&q=files.zip$doc
.click/*?s=*&g=*&q=$script,3p
.click/?h=*&user=$script,3p
.click/?user=*&h=$script,3p
.click/*/?partner=*&pg=$script,3p
.xyz/*?s=*&g=*&q=$script,3p
.xyz/?h=*&user=45$script,3p
.xyz/*/?partner=*&pg=$script,3p
.cfd/?h=*&user=$script,3p
.cfd/?aD*HlwZT1jJnRtcD01JmFkY29kZT0x$script,3p
.one/?h=*&user=$script,3p
.online/?h=*&user=$script,3p
.pro/?h=*&user=$script,3p
%3C?php%20echo%20substr(md5(microtime()),0,rand(10,30));?%3E&$doc
/?*&gkss=$doc,to=cfd|click|pro|world|xyz
^click_id=*&s1=$doc
! https://github.com/uBlockOrigin/uBlock-discussions/discussions/790#discussioncomment-10332718
||cfd/file?ajk=$doc,popup

! https://github.com/uBlockOrigin/uAssets/issues/11394
||theannoyingsite.com^$all

! https://github.com/AdguardTeam/AdguardFilters/issues/109902
/vpnupdate/*/index.html?*p1=$doc

! https://github.com/uBlockOrigin/uAssets/issues/5605#issuecomment-1060013521
||smartklick.biz^$all

! https://github.com/uBlockOrigin/uAssets/issues/12117
||zoosk.online^$all

! https://github.com/uBlockOrigin/uAssets/issues/12194
||fulptube.org^$all

/bouncy.php?*&inPopUp=$all

! https://github.com/AdguardTeam/AdguardFilters/issues/115960
! https://www.virustotal.com/gui/url/6a4daf9dfa58864522ae7972ab042cf4bab17a48321b96d1952bd384210adcd2
! https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Fonpharmvermen.com%2F
||onpharmvermen.com^$doc
||sale24-pills.com^$doc

! https://github.com/uBlockOrigin/uAssets/issues/12934
! https://malwaretips.com/blogs/remove-hdvideosnet-com/
||hdvideosnet.com^

! https://github.com/uBlockOrigin/uAssets/issues/13177
! https://github.com/uBlockOrigin/uAssets/issues/13734
||fullcrack.vn^$all

! https://twitter.com/rarara18181818/status/1530214731608313856
/rtbfeed.php?$image,3p

! https://twitter.com/NaomiSuzuki_/status/1536553207299985408 fake chrome
!#if !env_mobile
/^http:\/\/[a-z]{5}\.[a-z]{5}\.com\/[a-z]{10}\.apk$/$doc,match-case,to=com
!#endif

! https://github.com/uBlockOrigin/uAssets/issues/14034
||fetishpartner.com^$all

! https://github.com/AdguardTeam/AdguardFilters/issues/125147
||facevideosc.com^$all

! https://github.com/AdguardTeam/AdguardFilters/issues/126480
/?c=propeller&lpid=$all

! https://github.com/uBlockOrigin/uAssets/issues/14588
||geoflix.me^$all

! https://github.com/uBlockOrigin/uAssets/pull/14985
||skymods.net^$all

! torrdroidforpc. com 
||tinyurl.com/setup-full-version$doc

! https://youtu.be/RfE_MreLSIM?t=183
||haxsoft.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/15368
||zenlytrade.com^$all

! https://shahrsakhtafzar.com/fa/news/security/42227-google-play-rubika-app-spy-users-personal-information
! https://farnet.io/1401/08/324594/rubika-is-detected-as-malware/
||rubika.ir^$all,to=~web.rubika.ir|~m.rubika.ir

! https://twitter.com/chaberi/status/1591139355628044288
||luckypapa.top^$all
! https://twitter.com/harugasumi/status/1591652561182150656
||nbsfmradio.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/15777
||ngazi.co.tz^$all
||video-watch1.com^$all
||musicinmysoul.biz^$all
||choseoffhandsight.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/15937
! https://www.virustotal.com/gui/url/a70d88ffc974f8d9cc5c3561938e95435d20a12a555e8c10d638d2bee5292165
! https://github.com/uBlockOrigin/uAssets/issues/27036
||melodydownloader.com^$all
||flymylife.info^$all
||neptunclicks.com^
||arakusus.com^$all
||imgfil.com^$all
||urlcod.com^$all
||tiurll.com^$all
||urlca.com^$all
||lomogd.com^$all
||voutew.com^$all
||abukss.com^$all
||konmm.com^$all
||xiuty.com^$all
||oyndr.com^$all
||lpoms.com^$all
||psfmi.com^$all
||gghut.com^$all
||vlyyg.com^$all
||mciun.com^$all

! https://github.com/AdguardTeam/AdguardFilters/issues/136693
/axad/?lpkey=$doc

! https://github.com/uBlockOrigin/uAssets/issues/15990
||vlcdownloads.com^$all

! https://twitter.com/tougei_miryoku/status/1602878676508344320
&t=main9|$doc,to=live
&t=main9ljs|$doc,to=live
&t=main9expsess|$doc,to=live
&t=mono|$doc,to=info

! https://github.com/uBlockOrigin/uAssets/pull/16038
||hypixei.com^$all

! Fake Steam website
! https://github.com/uBlockOrigin/uAssets/pull/16143
||99box.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/16153
||ezadblocker.com^$all
||watchadsfree.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/16209
||barlear.ru^$all

! https://github.com/uBlockOrigin/uAssets/issues/16257
||kaminarisubs.net^$all

! https://github.com/uBlockOrigin/uAssets/pull/16283
||galeden.cn^$all

! Phishing gathered from Twitter
! https://twitter.com/AP_Zenmashi/status/1614845455271333890
||3utilities.com^$all
! https://twitter.com/defenceability/status/1621446555726385153
||bafybeidzp4sgidm4rvsc32fofkhbz5bdotbekov4mnwzejakvnzhhohysa.ipfs.dweb.link^$all
! https://twitter.com/gorimpthon/status/1622092572188631041
.top/index-install.html|$doc
! https://twitter.com/defenceability/status/1622513282644054016
||r39-g003-h8ig0w-u8f0we8-fgw0rgf-0we880e-rhgth.obs.ap-southeast-2.myhuaweicloud.com^$all
! https://twitter.com/defenceability/status/1622801056379064321
||bafybeiexjty7qmufu5jvbyln5ce5mue2lqw2htafc3api4wwsefxet5k54.ipfs.dweb.link^$all
! https://twitter.com/defenceability/status/1623182946806169600
||chargerlogistics-dot-exceldocsverification.uk.r.appspot.com^$all
! https://twitter.com/defenceability/status/1623546261126402058
||bizerba-dot-azure-projectfiles.uk.r.appspot.com^$all
! https://twitter.com/harugasumi/status/1627983624447627265
||aajdrp.com^$all
! https://twitter.com/KesaGataMe0/status/1628158467625349122
||italianlottery.com^$all
! https://twitter.com/harugasumi/status/1628577192212066304
||metamasek.cc^$all
! https://twitter.com/KesaGataMe0/status/1629253647212363777
||theexpressiveteacher.com^$all
! https://twitter.com/harugasumi/status/1633133887047217152
||007itshop.com^$all
! https://twitter.com/ozuma5119/status/1635414656646008833
||e-tax-nta.web.app^$all
! https://twitter.com/ozuma5119/status/1638194144781930496
||blisterlngdate.com^$all
||fapello.xyz^$all
! https://twitter.com/harugasumi/status/1640690554156507139
||hohshops.com^$all
! https://twitter.com/masaomi346/status/1649260359763775488
||bavaria-cup.ru^$all
! https://twitter.com/8614miyauchi/status/1654845878933557248
||luckypapa.xyz^$doc
! https://twitter.com/harugasumi/status/1655470724377907200
||manage-fpw-my-sakura-fpw-jp-fpw.impulsion.mu^$all
! https://twitter.com/pingineer_jp/status/1646373106557267968
||honda-law-office.jp/wp-includes/70038/Earthcorejp/|$doc
! https://twitter.com/satontonton/status/1659183900059652098
||itsaol.com^$all
! https://twitter.com/harugasumi/status/1666013629853097984
||qhigh.com^$all
! https://twitter.com/harugasumi/status/1666436001953136641
||yoinst.com^$doc
! https://twitter.com/AP_Zenmashi/status/1674082742013755393
||almostmy.com^$all
! https://twitter.com/masaomi346/status/1696821001785635127
||tokyobag.shop^$all
! https://twitter.com/masaomi346/status/1716272554464473099
||erdfkhxrnanm.top^$all
! https://twitter.com/NaomiSuzuki_/status/1737749366520291403
||app-bitbanlk-cc.weebly.com^$all
! https://twitter.com/NaomiSuzuki_/status/1740725999845920943
||cordialhoist.top^$all
! https://x.com/masa_katahage/status/1791325878129234223
||luckvote.top^$all
! https://x.com/harugasumi/status/1792344876081889322
||kuronekoyamato-jp.com^$all
! https://x.com/NaomiSuzuki_/status/1808400909782995443
||npajp.icu^$all
! https://x.com/_3xsun_/status/1809119839036006478
||web-telegvm.org^$all
! https://x.com/ryu_tan_0317/status/1809130556090953765
||m-k-r-5.com^$all
||if-eku3a-fp.com^$all
! https://x.com/JCyberSec_/status/1809231223220236596
! https://www.reddit.com/r/Scams/comments/1grcp9l/text_message_evri_scam/
||ev.ri-*gb.com^$doc,to=~evri.com
! https://x.com/itmedia_news/status/1810495098876215790
||sapjp.com^$doc
! https://x.com/masaomi346/status/1812854359463723034
||t-pia.me^$all
! https://x.com/harugasumi/status/1817602306189464046
||toythieves.com^$all
! https://x.com/masaomi346/status/1819876303333700006
||rigidconcrete.ca^$all
! https://x.com/harugasumi/status/1820496420136419512
||sportslevels.com^$all
! https://x.com/harugasumi/status/1826758890333372471
||sso.biglobe.jp.net^$all
! https://x.com/kazunii_ac/status/1826984198768656845
||lsdfex.shop^$all
! https://x.com/izutorishima/status/1828044783375532415
||jaborcall.app^$doc
! https://x.com/harugasumi/status/1830434631294054482
||cqjykj.com^$all
||btemgb.com^$all
! https://x.com/__kokumoto/status/1833705979818729773
||amaeex.one^$all
! https://x.com/harugasumi/status/1838519663145468074
||ec2-13-230-253-66.ap-northeast-1.compute.amazonaws.com^$all
! https://x.com/masaomi346/status/1867012579492757739
||my-bitbank.cc^$all
! https://x.com/masaomi346/status/1874257707567636729
||jplivestreamhd.live^$all
! https://x.com/harugasumi/status/1874798942346760297
||lcskincarecenter.com^$all
! https://x.com/masaomi346/status/1886438624067223795
||clasm.live^$all
! https://x.com/AP_Zenmashi/status/1900801671384678793
||fklngauc.com^$all

! scam sites
||webuzz.me^$doc
||coup-ling.net^$all
||coup-ling-dm.net^$all
||gokinjolove.jp^$all
||gokinjolove.net^$all
||hornygirlsinapp.com^$all
||id001.jp^$all
||10un.jp^$doc
||3tuhabe.info^$doc
||5dgja.com^$doc
||8senjya.jp^$doc
||a-divination.com^$doc
||ad7mylo.com^$doc
||after-pop-abc.com^$doc
||aiai-talk.com^$doc
||aiaitalk.com^$doc
||alicekdsod.com^$doc
||any2st777fhy.com^$doc
||aqmessage.jp^$doc
||best-chat.net^$doc
||bestxchat.net^$doc
||car-na.jp^$doc
||cbcdnkyyxubdsrmg.com^$doc
||cdypsqghdgrw.com^$doc
||ch3l.net^$doc
||chl3.net^$doc
||date-app.net^$doc
||days-neighborhood.com^$doc
||determinatioon.jp^$doc
||di-ana.jp^$doc
||dosukoudo.net^$doc
||drct-match.com^$doc
||drct-match.net^$doc
||dydynight.org^$doc
||en-kakuri.biz^$doc
||en-mu-su-bi.com^$doc
||fapp.work^$doc
||fl-0wer685hjdp300.com^$doc
||fle652.net^$doc
||formatch.co.jp^$doc
||fortune-fate.jp^$doc
||fortune-koun.jp^$doc
||fortune-luna.com^$doc
||friendxroom.com^$doc
||ft-sou.com^$doc
||fukumaneki2211.com^$doc
||g6-gonight.org^$doc
||gabfbnaqodnvfafnj.com^$doc
||gandestin0.jp^$doc
||girls.a-makeup.com^$doc
||gokusenn.jp^$doc
||goldenluck.jp^$doc
||happy468.net^$doc
||happymethod55.com^$doc
||hi-a-so-bi.net^$doc
||himatalk77.net^$doc
||home4ugoog10you.com^$doc
||hope-for-shiningday.com^$doc
||hori-hori.xyz^$doc
||hp-dy.net^$doc
||hphp-dy.net^$doc
||i.redi-ana.jp^$doc
||i2019.jp^$doc
||indi-ana.jp^$doc
||iri195.net^$doc
||irie3.net^$doc
||ivy2241u.jp^$doc
||jamjamjam.biz^$doc
||k-colorful.jp^$doc
||k-smilegallery.com^$doc
||k1wa.jp^$doc
||kaiun-com.com^$doc
||kaiun-park.jp^$doc
||keep.secret-ace.com^$doc
||koiroom.net^$doc
||koiroomnotice.net^$doc
||koun-yogen.com^$doc
||l-one-one.com^$doc
||l-thr-thr.com^$doc
||l-two-two.com^$doc
||l0vekatsu.com^$doc
||lightn5.com^$doc
||lin-link.net^$doc
||link-service.net^$doc
||linkage-linkage.com^$doc
||love-fit.jp^$doc
||love-letter-dm.com^$doc
||love-letter.info^$doc
||loveaholics.com^$doc
||lovemelo.jp^$doc
||luuce.jp^$doc
||lzogdlorkfssui.net^$doc
||machi-match.info^$doc
||madnna.jp^$doc
||madnna.net^$doc
||mangogo.jp^$doc
||mangogo.work^$doc
||match-mate.jp^$doc
||match-mate.net^$doc
||matimati.site^$doc
||maytail.jp^$doc
||meguri-eye.net^$doc
||meguri-y.net^$doc
||moody-night.net^$doc
||my7love.xyz^$doc
||naja59jg.com^$doc
||navi-match.net^$doc
||near-s.com^$doc
||on-glamour.xyz^$doc
||one-chan-love.love^$doc
||onega.jp^$doc
||onegaga.jp^$doc
||osubstancenasubstitute.com^$doc
||otona-nona.biz^$doc
||otonanona.jp^$doc
||otonatime.net^$doc
||oyasu-mi.tokyo^$doc
||pair-online.jp^$doc
||piasukai.xyz^$doc
||plati-num.com^$doc
||pr0m.site^$doc
||privatelife.jp^$doc
||r30address.com^$doc
||r30deai.com^$doc
||reddishpurple.com^$doc
||reverita-t.jp^$doc
||rhsrthrtjhe.com^$doc
||ripiai.com^$doc
||romancetime.jp^$doc
||romancetrain.jp^$doc
||royalclass-dm.com^$doc
||royalclass.info^$doc
||s4fk.destin0.jp^$doc
||salon1999.net^$doc
||salonoshirase.net^$doc
||shells.pairapple.net^$doc
||sns-pair.net^$doc
||soul-ft.com^$doc
||space-high.com^$doc
||spirilp3000.com^$doc
||spirituallounge-3000.com^$doc
||sugarboxxx.net^$doc
||sugulove.com^$doc
||sweetmemo.net^$doc
||sweetmemoryy.com^$doc
||t1a.jp^$doc
||tadaapo123.com^$doc
||tadaapomail.com^$doc
||tadamatch.com^$doc
||tenluuce.jp^$doc
||tsumalabo.jp^$doc
||tumalabo.net^$doc
||tyotto.jp^$doc
||tyotyo.biz^$doc
||u3ig.com^$doc
||ura-nai-best.com^$doc
||vanilla-japan.net^$doc
||verita-t.jp^$doc
||yu0287tk.com^$doc
||jivo-ce.jp^$doc
||whimsicalrain.com^$doc
||2226wurpatw.tokyo^$doc
||app.plum375ap.com^$doc
||asiansgetnaughty.com^$doc
||blackstunners.com^$doc
||budhump.com^$doc
||connect-wp.net^$doc
||eternal.mobius-loop.net^$doc
||fukuinnnokotoba.com^$doc
||humpbuds.com^$doc
||localsgowild.com^$doc
||naughtyfever.com^$doc
||oo.opaall.com^$doc
||tenseikaiun.com^$doc
||secure-57v.pages.dev^$all
||slb3cr9dx9.jp^$doc
||sukui05.com^$doc
||4miracle4.jp^$doc
||amari-ama.com^$doc
||bambam-bi.com^$doc
||chocochipu-o.com^$doc
||chumsline.jp^$doc
||cosmos-metatrade.com^$doc
||dandelion-horsetail.work^$doc
||deaimatch.jp^$doc
||facebooc.jp^$doc
||gtir5die6sutngr.jpn.com^$doc
||happiness-gate.com^$doc
||iikanjiyanakanjide.wixsite.com^$doc
||kisekichikara.com^$doc
||loto-chance.com^$doc
||makoto-in-room.wixsite.com^$doc
||moira-101.com^$doc
||nitr5eur6fjhtsw.jpn.com^$doc
||okai.work^$doc
||pa-ir.net^$doc
||pdss3a1r.jp^$doc
||pfunding-01.com^$doc
||pororin081.com^$doc
||rainbow-fortune.biz^$doc
||rainbow-fortune.com^$doc
||rainbow-fortune.jp^$doc
||sall.etchat.jp^$doc
||star-fortune.com^$doc
||toki-no-irodori.com^$doc
||tokyo-get-business.jp^$doc
||tomodachixoxo.wixsite.com^$doc
||triangle123.com^$doc
||ukokjxfbdqwffmuvsd.jp^$doc
||vf5rkgirsir8ska.jpn.com^$doc
||vitop7eg5sqwgbk.jpn.com^$doc
||vixii.co^$doc
||wishhoree1890.com^$doc
||xs5rur1she7eyry.jpn.com^$doc
||57zyazmk.jp^$doc
||a.tlineat.jp^$doc
||angelchance.com^$doc
||b2ujcm.com^$doc
||be-loaded.com^$doc
||coralnov.jp^$doc
||doorway-of-guidance.com^$doc
||ed-blissful.com^$doc
||eika-akie220202.com^$doc
||eternalfame461.com^$doc
||ev-upstart.com^$doc
||for-tg.com^$doc
||for20-coco.com^$doc
||fortune-mooon.com^$doc
||ft-flower.com^$doc
||fukugyou2022.net^$doc
||fukukomachi-220513.com^$doc
||fukunoha211013.com^$doc
||fukura210317.com^$doc
||future-marvellous.com^$doc
||gogonews.club^$doc
||happiness-sign.com^$doc
||heart-uranai.com^$doc
||iflirts.com^$doc
||im-excellent.com^$doc
||infomessagehappy.com^$doc
||iris-808.com^$doc
||kaaairoo549kai.com^$doc
||kahimeyuki.jp^$doc
||karinaroom.wixsite.com^$doc
||l-chat.jp^$doc
||login-chat.net^$doc
||lovekatsu2277.com^$doc
||mintiia.com^$doc
||mio-love2.wixsite.com^$doc
||moon-1light.com^$doc
||moon1234moom.com^$doc
||mttk2020.jp^$doc
||mystery-forest.com^$doc
||oficialinesp.wixsite.com^$doc
||one-sunnyday.com^$doc
||online-gluck.com^$doc
||p-chi.info^$doc
||pairpure.jp^$doc
||pairpure.jp.net^$doc
||photo-gallery-picture2398.com^$doc
||poke10ve.com^$doc
||pocketlove.jp^$doc
||ppo.re9t-hmd0.com^$doc
||relife0001.com^$doc
||relifemail555.com^$doc
||s-kiseki.jp^$doc
||sebumu28.com^$doc
||sevensmooon.com^$doc
||tada10ve.jp^$doc
||tada1ove.com^$doc
||take.the.n-chapter.jp^$doc
||ultratime.info^$doc
||uu-charisma.jp^$doc
||v-yummy.com^$doc
||vroom24.com^$doc
||vroom24365.com^$doc
||wmw.matchin.jp^$doc
||wn56y7ve57j12zuv7tyj.com^$doc
||woman-good-job.work^$doc
||world.ex-advantage.jp^$doc
||xxa.uji8979erd77.jp^$doc
||y-tradie.com^$doc
||best-web2020.com^$doc
||dosudosuo.com^$doc
||fanfande.net^$doc
||female-good.work^$doc
||forum0120.com^$doc
||foundate-core.net^$doc
||li-neeee.net^$doc
||make2022.com^$doc
||salon.beauty202201.com^$doc
||sbfw.work^$doc
||tim.time-time-zyunizi.com^$doc
||xxxmake.com^$doc
||1litteno.home-walil1.jp^$doc
||1st-mail.jp^$doc
||2507u35ia6mk1.com^$doc
||2qpk150djf0ri.jp^$doc
||56fv2z8bfv9.com^$doc
||5jd2tj2idrool.com^$doc
||777.funnyy.net^$doc
||ai-ne.net^$doc
||ai-tas.com^$doc
||ai3tu.com^$doc
||alch.treas.jp^$doc
||amaenbo.jp^$doc
||amourplace.jp^$doc
||ancient-guidance.jp^$doc
||atchm.net^$doc
||bontruth.com^$doc
||c.onnect.jp^$doc
||c930lhsivns1b.jp^$doc
||chat111room-09.com^$doc
||connect-jumbo.com^$doc
||cosdate.jp^$doc
||cxbvnmyeruw.com^$doc
||d-hiyori.com^$doc
||daisukimatch.jp^$doc
||defendeerrpro.jp^$doc
||diamond-line.net^$doc
||dinosaur-crown.com^$doc
||dreamatch.jp^$doc
||edge-campaign-japan.com^$doc
||en5wr67sag3.com^$doc
||equation-of-happiness.com^$doc
||eromatchi.jp^$doc
||fanta-stic.net^$doc
||flirt.com^$doc
||fx-protrade.net^$doc
||ggcake.tindersplus.net^$doc
||glitter-girls.net^$doc
||gokuhuku.jp^$doc
||gyakusimei.com^$doc
||h-spe.net^$doc
||hapim.net^$doc
||happy-egg.net^$doc
||happylife-partner.com^$doc
||heartmatch.jp^$doc
||home-22-time.com^$doc
||i5h56ozira7l6.jp^$doc
||japanhotties.jp^$doc
||jdoasjfojuhod.com^$doc
||kaiunmegami.jp^$doc
||koipara.jp^$doc
||lib-333-lib.com^$doc
||local-bang.com^$all
||lovewish.jp^$doc
||lvmeet.net^$doc
||machimatch.jp^$doc
||matchmix.jp^$doc
||mmdem.net^$doc
||mmkat.net^$doc
||mmlnc.net^$doc
||moelove.jp^$doc
||mustwork.work^$doc
||myocean.jp^$doc
||nakayama.chikarakosopower.com^$doc
||netsgram.com^$doc
||nextaex.com^$doc
||one.thx-birthday.com^$doc
||one-two-up.jp^$doc
||one1-day.com^$doc
||otakuplay.jp^$doc
||otakurabu.jp^$doc
||p18d6.hp.peraichi.com^$doc
||pairnavipairnavi.com^$doc
||pakok.net^$doc
||paradise-angel.com^$doc
||peaces-ign.com^$doc
||peachzone.site^$doc
||plaza-l1o0nni-p1aza.com^$doc
||ptron.net^$doc
||ranch-1and.com^$doc
||rexsvj8omabse.jp^$doc
||richheart.completelifetime.com^$doc
||s908b9n62w53u.jp^$doc
||sdhjak.com^$doc
||sfsrch.com^$doc
||sokuh.net^$doc
||sonic-nicehands.com^$doc
||specialapp-sns.com^$doc
||stowers-service.com^$doc
||sxtown.jp^$doc
||syakoba.com^$doc
||tennshinomitibiki01.com^$doc
||unafei-kokusai.com^$doc
||upforit.com^$doc
||vhills.net^$doc
||votteetten.com^$doc
||vqydliiyda.net^$doc
||xn--4dkua4c8143c.jp^$doc
||xn--edkc9m807k.jp^$doc
||xn--n8j0la8wb3547bghe.jp^$doc
||xn--n8jwkyc7fw52nfvd.jp^$doc
||xn--z9j635l1gs.jp^$doc
||xn--z9jzga6u1506a.jp^$doc
||xyg.application-sns.com^$doc
||you4love.jp^$doc
||zmaka.net^$doc
||0281.jp^$doc
||0909810.com^$doc
||093093.jp^$doc
||11093.jp^$doc
||19093.jp^$doc
||2349.jp^$doc
||2h1.jp^$doc
||39093.net^$doc
||39093.tv^$doc
||4151.biz^$doc
||4151.tv^$doc
||55093.com^$doc
||55bdsm.com^$doc
||aeru.tv^$doc
||affairdating.com^$doc
||aitai.biz^$doc
||amantssexy.com^$doc
||askme4date.com^$doc
||b-7.jp^$doc
||babaroa.net^$doc
||bbs-7.jp^$doc
||bbsdx.jp^$doc
||benbbs.net^$doc
||bnbn.jp^$doc
||c-y.jp^$doc
||celcol.jp^$doc
||celebri.jp^$doc
||choucreme.com^$doc
||chy.jp^$doc
||cjok.net^$doc
||crostol.com^$doc
||datenabi.com^$doc
||doem.jp^$doc
||ebifri.com^$doc
||eraberu.jp^$doc
||erocm.com^$doc
||flirtanu.com^$doc
||flirtmoms.com^$doc
||freedom-garden.com^$doc
||freesexmatch.com^$doc
||geh.jp^$doc
||getnaughty.com^$doc
||gofun.jp^$doc
||gspo.jp^$doc
||guj.jp^$doc
||guw.jp^$doc
||h093.net^$doc
||hipma.jp^$doc
||hmai.jp^$doc
||hmhm.jp^$doc
||hoct.cc^$doc
||hxh.jp^$doc
||igetnaughty.com^$doc
||irha.jp^$doc
||jnjn.jp^$doc
||jukcha.com^$doc
||jukuana.net^$doc
||jyk.jp^$doc
||kadak.jp^$doc
||kanbbs.net^$doc
||kokanjo.net^$doc
||koubi.jp^$doc
||koy.jp^$doc
||ksds.jp^$doc
||linblog.info^$doc
||linguette.net^$doc
||locals.dating^$doc
||loveju.net^$doc
||mamak.jp^$doc
||matchx2.com^$doc
||meetdatekiss.com^$doc
||meetpie.net^$doc
||mejp.net^$doc
||mgirl.jp^$doc
||mland.jp^$doc
||mmnav.jp^$doc
||moecoco.com^$doc
||mymymy.net^$doc
||natadecoco.net^$doc
||naughtydate.com^$doc
||newhoney.jp^$doc
||nuide.net^$doc
||oneisan.net^$doc
||oolontya.com^$doc
||pair-pair.com^$doc
||panacota.net^$doc
||piparelli.net^$doc
||pirikitos.com^$doc
||pmew.jp^$doc
||pnav.jp^$doc
||quickflirt.com^$doc
||ricopin.com^$doc
||scnv.jp^$doc
||serev.net^$doc
||sfg.jp^$doc
||sfge.jp^$doc
||singles50.jp^$doc
||smab.jp^$doc
||smism.jp^$doc
||smmax.jp^$doc
||soha.jp^$doc
||sok8.net^$doc
||stomatico.com^$doc
||suguaitaina.com^$doc
||suguao.net^$doc
||sumatuma.com^$doc
||sxe.jp^$doc
||syasei.com^$doc
||tapi2.jp^$doc
||tarto.net^$doc
||tendermeetonline.com^$doc
||tendermeets.com^$doc
||tinql.com^$doc
||together.com^$doc
||maturedating.com^$doc
||topg.jp^$doc
||tubakinohimitsu.amebaownd.com^$doc
||tugonoyoi.com^$doc
||twowife.com^$doc
||txtx.jp^$doc
||ulla.com^$doc
||uniformdating.com^$doc
||wantubad.com^$doc
||wildmeets.com^$doc
||xgal.jp^$doc
||xzo.jp^$doc
||yceleb.com^$doc
||yourskiss.com^$doc
||life-is-luminous.com^$doc
||00ebjdbagyqwt.club^$doc
||0didjsgheje.club^$doc
||5050.fm^$doc
||6xtpke4.com^$doc
||adoptmeantranslate.com^$doc
||after-7.net^$doc
||aikatuz.jp^$doc
||always-happy-fortune.com^$doc
||alwayslike.safestspot.jp^$doc
||apppleheaddd.jp^$doc
||bestcosme.jp^$doc
||browser9182.web.fc2.com^$doc
||burmesterone.jp^$doc
||catchmetalk.com^$doc
||charecttorr.jp^$doc
||charm-n.com^$doc
||chesscheckersvariation.com^$doc
||circle7-bd.com^$doc
||club-house.link^$doc
||cocoro-liberty.com^$doc
||d-sr.net^$doc
||d-will.net^$doc
||daylighteel.com^$doc
||divination-truth.com^$doc
||during-the-holiday.com^$doc
||every-au.com^$doc
||every-bisque.com^$doc
||every-blanched.com^$doc
||every-cute.com^$doc
||every-dark.com^$doc
||every-dodo.com^$doc
||every-enjoy.com^$doc
||every-isb.com^$doc
||every-line1.com^$doc
||every-line2.com^$doc
||every-nejp.com^$doc
||every-pcpc.com^$doc
||every-salmon.com^$doc
||every-super.com^$doc
||every-toroku1.com^$doc
||every-toroku2.com^$doc
||every-toroku3.com^$doc
||experiencedlawsuit.com^$doc
||febdd.info^$doc
||fortune-yakata.com^$doc
||gnan.jp^$doc
||gnchag.com^$doc
||gran-danker.jp^$doc
||gyakunan.net^$doc
||higher-mainnd.jp^$doc
||igazre.com^$doc
||jinsei-uranai2023.com^$doc
||kantei-oracle.com^$doc
||lover-c.com^$doc
||mamagathering.org^$doc
||mc-aoyama.com^$doc
||miracle-door.com^$doc
||mother-sku.jp^$doc
||okanekasegeru.com^$doc
||online-777.jp^$doc
||p-mel.net^$doc
||part-ner01.jp^$doc
||peachcafe.net^$doc
||poison-idea.com^$doc
||polaris-775.com^$doc
||pollutionsatisfyadopt.com^$doc
||prophecy-of-fate.com^$doc
||rosaca-nina.net^$doc
||s-space.jp^$doc
||spring-sealion.com^$doc
||spiritual-leading.com^$doc
||sugusagasu.com^$doc
||sukui01.com^$doc
||sukui02.com^$doc
||sukui03.com^$doc
||sukui04.com^$doc
||sukuinote.jp^$doc
||sumsmsp.info^$doc
||szddbxyumfcf.net^$doc
||telet.me^$doc
||tomikuji.com^$doc
||ugfdwmausxfy.net^$doc
||uranai-hit.com^$doc
||wastearguewasteill.com^$doc
||web.fe-vrier.com^$doc
||whpbrmdss.com^$doc
||will-kantei.com^$doc
||wkdk.jp^$doc
||6xy-zg.com^$doc
||cwa-2020.com^$doc
||dwoetbarcrooplsloiwh.com^$doc
||gargar.making-garden.com^$doc
||mor.chance-10dayful.com^$doc
||s.meru.jp^$doc
||ytjon-d2s1ah.com^$doc
||lets-tip315.com^$doc
||loveri.net^$doc
||lvli.jp^$doc
||m2sg.jp^$doc
||mamasg.net^$doc
||mcbien.net^$doc
||sgua.jp^$doc
||spilov.net^$doc
||splv.jp^$doc
||suguap.net^$doc
||vien.jp^$doc
||eternal-station.jp^$doc
||friends-connect.com^$doc
||kinun-2023.com^$doc
||madonnaoasis.com^$doc
||msg.metamessen.net^$doc
||o-cean-fortune.biz^$doc
||o-cean-fortune.com^$doc
||secondary-with.com^$doc
||fure-ai.com^$doc
||fure-ai.site^$doc
||rea-love.net^$doc
||natu.natural-natural-pure.com^$doc
||btc8228.com^$all
||btc9339.com^$all
||abacus-prefix.com^$doc
||celezma.net^$doc
||dismay-sacred.com^$doc
||loveru.jp^$doc
||morale-yellow.com^$doc
||t1amo.jp^$doc
||uggstore.online^$doc
||fair.alivio-platform.com^$doc
||pair-seat.net^$doc
||pairseat.net^$doc
||sez.jp^$doc
||matching-go.jp^$doc
||kira-kira.blue^$doc
||p-chi.tech^$doc
||vanilla-japan.love^$doc
||jtybleua.jp^$doc
||mai-tel.jp^$doc
||sfc.bz^$doc
||sfget.jp^$doc
||download-campaign.com^$doc
||fine-cloud.net^$doc
||float-next.com^$doc
||matomenever.com^$doc
||mid-round.com^$doc
||otonanojikan13579.net^$doc
||up-loop.net^$doc
||videochat-fan.com^$doc
||mamamour.net^$doc
||2chlovers.web.fc2.com^$doc
||lovez.jp^$doc
||moremorelove.net^$doc
||after-noon.jp^$doc
||bse.bb64bb8.com^$doc
||chatchu.jp^$doc
||cupid-chat.net^$doc
||fx640b4a8v2n.net^$doc
||moonlight-ebbandflow.com^$doc
||nanroom.net^$doc
||nowtuma.net^$doc
||pastelism02.jpn.com^$doc
||pineapplecake-yummy.com^$doc
||ssq.spofbd99.com^$doc
||tokuyama-kaiun.com^$doc
||vy8monlf1t.com^$doc
||wifekai.net^$doc
||zerocha.jp^$doc
||chat-search.com^$doc
||hhh.u3se3jg3gae.com^$doc
||ii.iriiss.com^$doc
||let.attract1v3.com^$doc
||lmoox5.net^$doc
||paradise.shine-site.com^$doc
||utg.ri64-pdmv.com^$doc
||getmatch.jp^$doc
||hn-mizuki.com^$doc
||urara02032023.com^$doc
||berate-expressive.com^$doc
||gloria-divination.$doc
||otomachi.jp^$doc
||suffix-consignment.com^$doc
||amazonlogistics.jp^$all
||fukusenkan.com^$doc
||koi-chat.net^$doc
||sachikru.com^$doc
||sachikru1.com^$doc
||sachikru3.com^$doc
||sachikru4.com^$doc
||sachikru5.com^$doc
||sachikru7.com^$doc
||sachikru8.com^$doc
||koundayori.com^$doc
||second-love-love.jp^$doc
||deaiai55.com^$doc
||kokocha.site^$doc
||hjytu75fro0.jp^$doc
||secssnetplan.jp^$doc
||emyqsvk7zw.com^$doc
||evqhubkfh8.com^$doc
||jinuja5zgm.com^$doc
||ljqq93npbr.com^$doc
||n9zxgxpdu6.com^$doc
||pnw0kbzjtt.com^$doc
||sdlbtwi3lr.com^$doc
||tvngrq6yat.com^$doc
||vjybuykaxz4.com^$doc
||y2sysagetf.com^$doc
||san-dast.net^$doc
||dedestin0.jp^$doc
||legamee.jp^$doc
||miraiah.jp^$doc
||sen8senjya.jp^$doc
||happy-matome.com^$doc
||fukuroou.jp^$doc
||for.life-thrones.com^$doc
||7wbb.com^$doc
||recruit-gold.com^$doc
||emoti-on.com^$doc
||jinsei-undesu.com^$doc
||spiritual-jp.com^$doc
||unki-josho.com^$doc
||xdpiwrx7ub.net^$doc
||feve-r.com^$doc
||mugicom.live^$doc
||romanc-e.com^$doc
||sns3615.com^$doc
||go-ld-li-ne.site^$doc
||gold-line.click^$doc
||gold-line.online^$doc
||cloudmax.jp^$doc
||mamakatu42.blogspot.com^$doc
||princess2022.com^$doc
||vivian.jp.net^$doc
||cha-nce.net^$doc
||mirusiru.online^$doc
||mirusiru.site^$doc
||mobileverify.net^$doc
||grabgiftcard.net^$doc
||awapp.store^$doc
||appxfree.com^$doc
||appxfree.top^$doc
||kounnomichishirube.net^$doc
||lucksignpost0804.org^$doc
||lightning02s.com^$doc
||lightning0707.com^$doc
||silversex.com^$doc
||flirttime.com^$doc
||scene7goal3.work^$doc
||ma-rry.net^$doc
||ma-rry.site^$doc
||altdorfer-niklaus.com^$doc
||lucky-star8.com^$doc
||tulip-tulip.net^$doc
||koinik.net^$doc
||yurizono.com^$doc
||9gcpz8hu.com^$doc
||cit-rine.com^$doc
||ctn-ctn.com^$doc
||holy-kantei.com^$doc
||sk3-renew.com^$doc
||unki-max.com^$doc
||eir.tdhg7ppa.com^$doc
||recklessdroughtburglar.com^$doc
||the-match.jp^$doc
||gekkei-jyu-gekkei-jyu.com^$doc
||gekkeijyu-gekkeijyu.com^$doc
||evkakuri2308.click^$doc
||gtex3.com^$doc
||nice.par-even.com^$doc
||pr-0m.link^$doc
||wa-nago-wagona.com^$doc
||chi-yo-1807chiyo.com^$doc
||cuddle.koi-ba-na.com^$doc
||globalreward77.com^$doc
||jukukoi.jp^$doc
||jukukoi.me^$doc
||buono2023-web.com^$doc
||michi-fortune.jp^$doc
||miemashita.jp^$doc
||lovely-lovely.com^$doc
||shareno1wish.net^$doc
||cue-find.com^$doc
||d-position.com^$doc
||d-position.shop^$doc
||kaiunnookite.com^$doc
||bs-03-6743-2266.net^$doc
||love2-mail.com^$doc
||gokinjoscreen.com^$doc
||koun-wa.com^$doc
||one----talk.com^$doc
||mariage-inc.com^$doc
||tenmei-michibiki.com^$doc
||10vekatu.jp^$doc
||a-ro-ma.com^$doc
||a1tai7.jp^$doc
||atchao.jp^$doc
||bestchat-chat.com^$doc
||brs.bi09aso-yo.xyz^$doc
||brs.vacat81-best.tokyo^$doc
||chu-chu.jp^$doc
||deai-labo.site^$doc
||enenkatukatumail.com^$doc
||enjoylife2001.net^$doc
||ffr548tyfhe.jp^$doc
||k0k0cha.link^$doc
||ir0d0r1.jp^$doc
||lovemelo.net^$doc
||ma-t-chy.link^$doc
||maiwa12.jp^$doc
||mat-chy.site^$doc
||me08mo.com^$doc
||media-matchinggo.com^$doc
||meltiest.jp^$doc
||meltylove.jp^$doc
||mem44.com^$doc
||merukore.jp^$doc
||moremoremail.net^$doc
||p-pure.jp^$doc
||p0cket1ove.jp^$doc
||p0rte.site^$doc
||pairife.jp^$doc
||platinumpla2023.com^$doc
||riarialuvluv2023.com^$doc
||romance-time.net^$doc
||sez-pr.com^$doc
||soklove.net^$doc
||sugulove777.com^$doc
||ta0dal0ve.com/^$doc
||ta1kcall.site^$doc
||tada-love.jp^$doc
||tokimekitaine.net^$doc
||tokimekimaildesu.net^$doc
||tokumeichat135.net^$doc
||tokumeichatmail.net^$doc
||tsumatsuma.xyz^$doc
||olive-ft.jp^$doc
||az-l.com^$doc
||luna-t.net^$doc
||sm-bt.net^$doc
||sm-heaven.com^$doc
||smdotcom.com^$doc
||seselagi.com^$doc
||nc2.site^$doc
||recipe000.tokyo^$doc
||y54wdrg.com^$doc
||peach2023.net^$doc
||gokinjo---hot.com^$doc
||www.academicsingles.jp^$doc
||ado.wish-best.com^$doc
||keiunkan.com^$doc
||falsettoy.click^$doc
||on-li-ne.net^$doc
||pc.mt3sys.com^$doc
||as25ap.com^$doc
||asap15.com^$doc
||sm8787.com^$doc
||foretheure.jp^$doc
||alt.com^$doc
||keenchimairaanthem.com^$doc
||ccappu-ccinno.com^$doc
||ccappuccinno.com^$doc
||daddyclub.net^$doc
||papamagic.net^$doc
||hoshi-no-michibiki.com^$doc
||hoshi-no-michibiki.jp^$doc
||miracle.magic-connect.net^$doc
||fun-uranai.com^$doc
||hrt-hrt.com^$doc
||uranai-su-ki.com^$doc
||million-vita128.com^$doc
||eb-nav.com^$doc
||global-riward77.com^$doc
||x9mw.com^$doc
||essence-one.net^$doc
||himegoto-time.com^$doc
||himegoto-time.jp^$doc
||happiness-app.net^$doc
||matching364.com^$doc
||dr5rmdxa.com^$doc
||pktbuu.morau.top^$doc
||qxb0v.com^$doc
||w0o.eu^$doc
||zj5c3.com^$doc
||ilovu.store^$doc
||iris-making.com^$doc
||lm-mousey-happy.com^$doc
||speeds5-mmiliked.com^$doc
||blackknocckk.jp^$doc
||finelucckyy.jp^$doc
||nokiseitjnemnew.jp^$doc
||vi.violleet.com^$doc
||gg.garrnnet.com^$doc
||super-grander.jp^$doc
||fl.floriittee.com^$doc
||ll.liberrttyy.com^$doc
||6kk2a4t.com^$doc
||eujsiyajep.niigata.jp^$doc
||kantanemusuu.jp^$doc
||sp-ciro-gov.com^$doc
||startwork-introduce.com^$doc
||success-dream.jp^$doc
||lovetwipaco.com^$doc
||sharesharemail.net^$doc
||high-incomes.com^$doc
||line-channel-info.com^$doc
||line-special-information.com^$doc
||safety-line-message.com^$doc
||secure-line-network.com^$doc
||tw-lucky.site^$doc
||side-joblp.com^$doc
||71l0b.com^$doc
||ajv06.com^$doc
||f8dt6.com^$doc
||mphb0.com^$doc
||e-chat1.com^$doc
||fc67x.com^$doc
||cd7z7b.com^$doc
||everydaykennsyou.com^$doc
||king-sweepstakes.com^$doc
||qaghoz.com^$doc
||npdptp.com^$doc
||resort-life7.com^$doc
||moraeru.top^$doc
||mmnn.jp^$doc
||pxmmm23.net^$doc
||mamatech.pepper.jp^$doc
||manpuku-ja.com^$doc
||manpuku-ja.jp^$doc
||ms-lounge.net^$doc
||sm-sl.net^$doc
||st-art.life^$doc
||xanadu-du.com^$doc
||z9iq6vt.com^$doc
||enchantedfruit.com^$doc
||meltsweetbite.com^$doc
||4kx3a.com^$doc
||ce0oil1ibu.com^$doc
||ezg-iy.com^$doc
||hjr-wq.com^$doc
||olt-nw.com^$doc
||abrhsuoamrnrx.com^$doc
||agqycbadbofog.com^$doc
||awagbbxlyqoys.com^$doc
||blfeiywbthjom.com^$doc
||brwasnlipggqq.com^$doc
||bvwozybuqztvg.com^$doc
||efljiccdztabg.com^$doc
||fbgajrlmjiotb.com^$doc
||hneeeixuyivwg.com^$doc
||hrzonvohdppab.com^$doc
||iinfssspoipo.com^$doc
||jjvkbzdungkop.com^$doc
||jqbwhhxvcytgh.com^$doc
||jvuihhlzixawx.com^$doc
||khrbuumwcntfx.com^$doc
||kmnvwjrbskybh.com^$doc
||kswrkbdsejqpm.com^$doc
||lwjrudzmzygol.com^$doc
||motsrgidyzoaz.com^$doc
||nlfhtxehjzeti.com^$doc
||rsgyndxlwfurm.com^$doc
||sfxmgzhaeeguq.com^$doc
||zekhauukqrqwx.com^$doc
||mugen-online.com^$doc
||unlock-the-bg2.com^$doc
||yl-0-wf.com^$doc
||auto.giz-store.com^$doc
||heat.tsu-bas.com^$doc
||layer-pj.com^$doc
||shop22.fishkillbaptistnurseryschool.org^$all
||a-labyrinth.com^$doc
||du0.jp^$doc
||hapinet.net^$doc
||kiseki.com^$doc
||b.eeaach.com^$doc
||fukutoku-miyako.com^$doc
||ka73-urara.club^$doc
||uraaka.net^$doc
||peraichi.com/landing_pages/view/s8j8k/$doc
||lovelove-on-line.site^$doc
||gmatch.jp^$doc
||mai1b0x.com^$doc
||majiainc.com^$doc
||meet-up.jp^$doc
||torquetrove.com^$doc
||getm.site^$doc
||kuronekoyamzyato.top^$all
||9npze.com^$doc
||gsi3t.com^$doc
||support-e-n.com^$doc
||n43vr.com^$doc
||qf6tm5ug.com^$doc
||azbzcz.com^$doc
||candycandypop.com^$doc
||fate-15.com^$doc
||loveste.cc^$doc
||marketingcareer.jp^$doc
||showa-klub.com^$doc
||lines.fxmwjjeusmulsjf.com^$doc
||new.deeper-start.com^$doc
||xczzfvxknafgoawjtv.com^$doc
||lover.new-n-e-x-u-s.com^$doc
||lines.hdaprocqxmthax.com^$doc
||lshyodrgehlnyswsjq.com^$doc
||lum-i0e0r0e.com^$doc
||himitumatch.com^$doc
||yy4rhgzd.com^$doc
||fallenscfwqy2pbin0.jp^$doc
||genetick4zwtf6c8mh5.jp^$doc
||harmfuleqwrj14xnvdc.jp^$doc
||marginz03nx1oe.jp^$doc
||nextb5vzysjcq8d0.jp^$doc
||outdoorvzk6la39o7r8.jp^$doc
||political7450163928.jp^$doc
||reasonable5786mi4n3srxq.jp^$doc
||supervision6912305847.jp^$doc
||tender9041257836.jp^$doc
||veryverythanks1123.jp^$doc
||brotherorgan.com^$doc
||familymusicman.com^$doc
||motherguitar.com^$doc
||swe.sweet-sweet-sweets.com^$doc
||colorfulromance.com^$doc
||gmatch.jp^$doc
||blue-uranai.com^$doc
||bluemoon-uranai.com^$doc
||bm-bluemoon.com^$doc
||kin-un2023.com^$doc
||kinun-777.com^$doc
||kousenkan.com^$doc
||aikotoba2020.com^$doc
||ainokotoba1515.com^$doc
||yunekon2taxiy.jp^$doc
||midnighteaparty.com^$doc
||nav1.jp^$doc
||gamojinsegesegeas.com^$doc
||jalaobrsdrgssdrgrs.com^$doc
||ml.ml.wawahrsdfrhfsdfh.com^$doc
||up.ch3m1stry.com^$doc
||wawahrsdfrhfsdfh.com^$doc
||hoshiyomi-yakata.com^$doc
||hoshiyomi-yakata.jp^$doc
||admin-matching-pair.jp^$doc
||matching-pair.jp^$doc
||media-matching-pair.jp^$doc
||mimiray-k.jp^$doc
||miray-k.jp^$doc
||luna-ria.jp^$doc
||msiv5.com^$doc
||free-ren.jp^$doc
||free-ren.com^$doc
||fortune-crystal.com^$doc
||ctl.ultima.fun^$doc
||fab-inst.com^$doc
||ai-mono.jp^$doc
||again-agreement.com^$doc
||birth-bravery.com^$doc
||cross-customer.com^$doc
||desk-dictionary.com^$doc
||event-experiment.com^$doc
||final-future.com^$doc
||t-uraaka.site^$doc
||jap.cookingsboss.com^$doc
||jap.cookinggenuine.com^$doc
||ai-referee.com^$doc
||gamecygenn.com^$doc
||cryp-prel.com^$doc
||lowsoop.com^$doc
||5qex5.com^$doc
||bxn45.com^$doc
||gnkpy.com^$doc
||cgcsarz0opg.jp^$doc
||sakudon293ssp.jp^$doc
||accord-adoration.com^$doc
||banquet-barbecue.com^$doc
||campus-cardigan.com^$doc
||desirable-desktop.com^$doc
||efficient-election.com^$doc
||fantasy-federation.com^$doc
||only.hearty-community.com^$doc
||mithu02s.com^$doc
||impoverishedordealscrutinize.com^$doc
||hfykmfd1.com^$doc
||urgentrecommendationclimate.com^$doc
||worlddating365.com^$doc
||lien-lienam.com^$doc
||rune-luna-moon.com^$doc
||blue-could.com^$doc
||ombrewa.space^$doc
||chosentalladvanced.com^$doc
||methodsbillboardssurface.com^$doc
||li-ke-lo-ve.com^$doc
||like-love.net^$doc
||m-eteor.com^$doc
||m-eteor.shop^$doc
||b-cdn.net/human-verify-system.html$doc
||b-cdn.net/verify-captcha-$doc
||r2.dev/human-verify-system.html$doc
||sun123o.space^$doc
||harmonic-serenity.space^$doc
||yy8j.com^$doc
||reductioncarnival.com^$doc
||t-campaign.fun^$doc
||t-service.pics^$doc
||ap-ple.biz^$doc
||ap-ple.net^$doc
||bride1be.com^$doc
||cheri-sh.jp^$doc
||cheri-sh.net^$doc
||e-c.tokyo^$doc
||for-precious.net^$doc
||iroha-oran24.com^$doc
||jp.rian-rian.com^$doc
||kaigan-kaiun-fortune.com^$doc
||ri11que-za.com^$doc
||rokuseikantei.com^$doc
||match-member.com^$doc
||tu-tu.jp^$doc
||uusshmhmba.com^$doc
||jg5y2nkdg.com^$doc
||vip-salon.net^$doc
||voicehp.com^$doc
||yuri0513kago.com^$doc
||yurika-go0415.com^$doc
||agoke0333.info^$doc
||dgoke0333.info^$doc
||golsoe033.info^$doc
||icpkw0333.info^$doc
||sgoke0333.info^$doc
||ic0828op.com^$doc
||sns-rank-sidework.site^$doc
||j9q8dmk6.com^$doc
||kas6mjgmxhn5.com^$doc
||zjjgbuiy.com^$doc
||jkoi.jp^$doc
||dream901o.fun^$doc
||gold456o.fun^$doc
||light678o.fun^$doc
||sky567o.fun^$doc
||t-campaign.website^$doc
||t-service.lol^$doc
||5ra-greaws.com^$doc
||bibian4k.com^$doc
||bacchuss.net^$doc
||sg1first-syspro.jp^$doc
||ssgalaxy-sysgold.jp^$doc
||foryouswk.jp^$doc
||bell-02.com^$doc
||bell-03.com^$doc
||mirai-jc.jp^$doc
||herebyintentionally.com^$doc
||m-ateria.com^$doc
||hhll.app^$doc
||lu-club-de-matching.com^$doc
||l-partner.jp^$doc
||lpartner.jp^$doc
||peace-77place.com^$doc
||peach-next.info^$doc
||profileclub.info^$doc
||freeshot.info^$doc
||e95nfjld.com^$doc
||orga29.com^$doc
||the-latest-version.com^$doc
||book234h.fun^$doc
||litlink.site^$doc
||dem94jfdmn3d.net^$doc
||nyancokuji.xyz^$doc
||star789h.fun^$doc
||g5chat.com^$doc
||matchtap.site^$doc
||buzz-gric.com^$doc
||crowd-nrgt.com^$doc
||drg-mcre.com^$doc
||filter-zgzy.com^$doc
||girl-ewun.com^$doc
||heed-mvor.com^$doc
||loudly-xipt.com^$doc
||realm-foym.com^$doc
||rice-iten.com^$doc
||sodium-icft.com^$doc
||abusive-isolate.com^$doc
||curious-deplete.com^$doc
||memorial-mem0ria1.com^$doc
||memory-storage.net^$doc
||call-chieftain.com^$doc
||deep-dealings.com^$doc
||easy-elation.com^$doc
||o-ka-pilina.com^$doc
||dr-sapuri.jp^$doc
||sweet-1ove.jp^$doc
||u-to--u.com^$doc
||u-to-u.com^$doc
||u--to-u.com^$doc
||aibeautia1.jp^$doc
||loto7-diamond-club.com^$doc
||lotochance.hp.peraichi.com^$doc
||lotochance-vip.com^$doc
||connect-s2-chat.com^$doc
||scrutinizeordealscrutinize.com^$doc
||story-story.life^$doc
||mcdonal.fujicandy-balibalione.net^$doc
||penst-hap9p-chat.com^$doc
||penst3-hap11o-chat.com^$doc
||soul-of-compass.com^$doc
||e-manager-kanri.com^$doc
||info-top-letter.com^$doc
||noi9va4ewa.com^$doc
||thanksgift-special.com^$doc
||mailtherapyask.com^$doc
||xs525890.xsrv.jp^$doc
||raspberrysliceq.jp^$doc
||amschat.top^$doc
||coupletalk2024.com^$doc
||rain890o.fun^$doc
||t-eroero.monster^$doc
||t-echi.fun^$doc
||adult-ntrchanel.com^$all
||echi-echi-time.org^$all
||track.chkr7.com^$all
||calm234o.fun^$doc
||tree345o.fun^$doc
||ten-lp2025.com^$doc
||bird567o.fun^$doc
||go-90i.com^$doc
||signingn.com^$doc
||lalien10.com^$doc
||f-fri.com^$doc
||f-fri.net^$doc
||aloha.walea-lino.com^$doc
||door-donation.jp^$doc
||active-achieve.com^$doc
||awesome-meeting.jp^$doc
||basic-bank.com^$doc
||chief-child.com^$doc
||deliver-departure.com^$doc
||kneelmodernism.com^$doc
||tour375.com^$doc
||trr59rrt.com^$doc
||akuto23.com^$doc
||ntc69oia.com^$doc
||rken104.com^$doc
||rkn71nkr.com^$doc
||o-rakuenn.com^$doc
||honeyline.co.jp^$doc
||honeyline.net^$doc
||l-senior.com^$doc
||lovevoice.net^$doc
||image-play.net^$doc
||bijinkadan.com^$doc
||9888.st^$doc
||6969-chat.tv^$doc
||1919-chat.tv^$doc
||acttas.com^$doc
||t4hsalk.com^$doc
||foxi.supay.us^$doc
||luvmee.com^$doc
||luvmlp.com^$doc
||luvmsite.com^$doc
||placid-jaded.com^$doc
||matchxxx.jp^$doc
||getma.tech^$doc
||matchzzz.jp^$doc
||gokujyouclub.com^$doc
||gokujyouno.com^$doc
||gokujyou.jp^$doc
||jobb2nd.com^$doc
||uly-sses8888.com^$doc
||another2020.net^$doc
||at.colony-on.id^$doc
||bg1tey0a6eoe.jp^$doc
||colorone.jp^$doc
||ju6yid2e0tuq.com^$doc
||ty5r6a0atu5r.com^$doc
||xir6y7ey3ate.com^$doc
||xwa8flt6o.jp^$doc
||elephant-904.com^$doc
||abda.addressonoo-ma.com^$doc
||mmsefdrkcdpsrkdr-meaha.com^$doc
||nwberjyhruvqxswo-qxwne.com^$doc
||pcnhdukovmhslmie-vgrbx.com^$doc
||pdupmdatdenrfojs-wmzds.com^$doc
||pyhrjedhlepcdkek-zyapg.com^$doc
||yoitoki.jp^$doc
||play.google.com/store/apps/details?id=com.ola.yoitoki^$doc
||tenkeifa.com^$doc
||tenkeiya.com^$doc
||tenkeiza.com^$doc
||alienmanufacturerchairman.com^$doc
||chairmanalienxanthopsia.com^$doc
||xanthopsiamanufacturer.com^$doc
||datelove.cc^$doc
||datelove.co^$doc
||datelove.shop^$doc
||datelove.top^$doc
||loto-4x.com^$doc
||epicpotec.com^$doc
||nxishctcjccry.com^$doc
||duskspire-horizon.com^$doc
||daily-description.com^$doc
||divine.alegria-verte.com^$doc
||deal-dealings.com^$doc
||jolly.treasure-pleasure.com^$doc
||reveur-voyance.jp^$doc
||aura-and-color.com^$doc
||destinyholy.net^$doc
||roomtelling.com^$doc
||try-fortune.com^$doc
||fortune-moon.net^$doc
||hoshinokouranai.com^$doc
||irene-fortuna.com^$doc
||t-tousen.online^$doc
||t-haifu.space^$doc
||t-haifu.monster^$doc

! https://github.com/AdguardTeam/AdguardFilters/issues/142492
||apkmirror.co^$all
||webogram.org^$all
||webogram.ru^$all
||xn--80affa3aj0al.xn--80asehdb^$all
||telegr.am/user_mgt/login$all
||tgram.ru^$all
||telegramm.site^$all
||web-telegram.net^$all

! https://app.any.run/tasks/679e9afa-eb19-4414-a086-e280a779a448 and https://tria.ge/230217-xd8nksgc9x/behavioral2
||anapatformacion.org/modules/file/tor/tor-browser.zip^$all

! https://github.com/uBlockOrigin/uAssets/issues/16397
/^https:\/\/[a-z]+\.com\/away\.php\?url=[%0-9A-z]{100,}$/$doc

! https://github.com/AdguardTeam/AdguardFilters/issues/143447#issuecomment-1438352020
||a-new86.com^$all
||ane102.net^$all
||koi2ru.com^$all
||room2021.net^$all
||roomoshirase.net^$all
||smore91.net^$all
||som419.net^$all
||touchoshirase.net^$all
||touchtacchi.net^$all
||wswsnews.net^$all
||fotkyin.top^$all

! https://www.reddit.com/r/uBlockOrigin/comments/11s92xa/
! https://www.virustotal.com/gui/url/e1d9aadb5c1f979f0c83a54015cf84cda2da0fa9c4b452c6dabe62deeb70add5/detection
||s3.amazonaws.com/extpro/speed4.html$all

! https://www.reddit.com/r/uBlockOrigin/comments/11s92xa/badware_risks_page_request_malware/jceopse/?context
! https://pastebin.com/t3z1m0tN
! https://www.virustotal.com/gui/url/2fb57656f55db6d335696767de2d73693a31148429ef6b51b97c01e43563a8ee
! https://www.virustotal.com/gui/url/7f8f874b486a656948944aa205c75fc490cff1235f1114e067f161e69f0bcbb9
||imgfarm.com/images/dlp2/prod$3p
||myway.com^$all
/anemone-*.min.js$script,1p

! techsupport scam
/?{BV_SRCID}&$doc
/werrx01/^$doc
/merrx01/^$doc
||ondigitalocean.app/*^phone=+1-$doc
||plesk.page/*?phone=$doc
/W*ity0*00Er00*/index.$doc
||s3.ap-northeast-1.amazonaws.com/tedex.com/*/index.html$all
||smarttvnew.vercel.app^$all
/systemerror-mac/?$doc
/Win0SecurityEr0CH0700Err0rSt/index.html$doc
/werrx01/index.html$doc
||activexsportswear.com^$all
||besttreasurecoastroofing.com^$all
||eharmonysingle.online^$all
||errorordufhwe.s3.ap-south-1.amazonaws.com^$all
||s3.ap-northeast-2.amazonaws.com/%*!!%*/index.html$doc
||s3.amazonaws.com/securityfotrus.1.13/index.html$all
||s3.eu-west-2.amazonaws.com/675.88.u6.8878/index.html$all
||s3.us-west-1.amazonaws.com/security.uni.firewall.$all
/Win00Security07/index.html$doc
/Er0Wind0fsd0Security087/index.html$doc
||websafety.online^$all
||cnctddot.com^$all
||mct-niger.com^$all
||stb-media.xyz^$all
||compass-holding.com^$all
||theweddingmahotsav.com^$all
||detailsreceipts.com^$all
||hodllane.com^$all
||165-227-173-120.plesk.page^$all
||pushlandings.b-cdn.net^$all
||64-226-126-114.plesk.page^$all
||fastndio.s3.eu-central-1.amazonaws.com^$all
||pub-77106c9273be4f3fbec6b6d6c3c51b7f.r2.dev^$all
||s3.ap-northeast-1.amazonaws.com/ongoing.com/aanoitmessure/index.html^$all
||setkuttina.pages.dev^$all
||certificate-certificate.gettrials.com^$all
||boring-tesla.149-102-231-176.plesk.page^$all
||xbasugigqiuegiwqdbsx.s3.ap-northeast-1.amazonaws.com^$all
||uwqghwfdwqywetqwfghewqeqweig.s3.ap-southeast-2.amazonaws.com^$all
||fantastic-salamander-c721cb.netlify.app^$all
||ondigitalocean.app/*/index.php?cezp=$doc
||amazonaws.com/*.*.*.*.*.*.*.*/*/index*.html$doc
||jp-helplineweb-chrsmjinfgtizonedswebs-01.s3.ap-southeast-2.amazonaws.com^$all
||germanytechsupport.pages.dev^$all
||systemsupport.pages.dev^$all
||techsupport-ev2.pages.dev^$all
||pub-3b4d978c14114185847089b100168c84.r2.dev^$all
||tingtang.pages.dev^$all
||tomtom.pages.dev^$all
||adolphusisomlycyou.pages.dev^$all
||lianashepard.autos^$all
||nihongirl.online^$all
||blob.core.windows.net/$web/index.html$doc
||windows.net/*?bcda=$doc
/index.html?ph0n=1-$doc
||technosoft35.ru^$all
||cj7tv5fq8p.com^$all
||pages.dev/Wi0n0erAry0mpAlert048/$all
||netlify.app/errox01/?$all
||infinityserve.life^$all
||seishinyoga.com^$all
||microchromejapan.b-cdn.net^$all
/^https:\/\/[a-z]{16,}\.s3\.[-a-z]+1\.amazonaws\.com\/[a-z]{66,}(?:\/[a-z]{45})?\.html/$doc,match-case,to=amazonaws.com
/^https:\/\/[-a-z]{16,}\.z\d{2}\.web\.core\.windows\.net\/[a-z]{70,}(\/[a-z]{40,})?\.html/$doc,match-case,to=web.core.windows.net
||web.core.windows.net/?zpbid=$doc
||watchdjav.online^$all
||amplifyapp.com/Win*/index.html$doc
||windows.net/Win*/index.html$doc
||windows.net/Mac*/index.html$doc
||web.core.windows.net/chrmac/index.html$doc
||web.core.windows.net/macx/index.html$doc
/index.html?Aniph=1-$doc
/index.html?ph0nq=$doc
/?pnoorg=1^$doc

! https://github.com/uBlockOrigin/uBlock-discussions/discussions/302#discussioncomment-10338866
||pages.dev/*/Fm7-alert.wav
||pages.dev/*/ai2.mp3
||pages.dev/*_Fm7-alert.mp3
||pages.dev/0wa0rni0ng0.mp3
||pages.dev/a0ler0tm0s.mp3
||pages.dev/al1.mp3
||pages.dev/yaketsuku.mp3
||pages.dev/fulls.js
||pages.dev/fullscreen.js
||pages.dev/media/alert.mp3
||pages.dev/nvidia.js
||pages.dev/js/esc.js
||pages.dev/js/flscn.js
||pages.dev/js/nvidia.js
||r2.dev/_Fm7-alert.mp3
||r2.dev/media/_Fm7-alert.mp3
||windows.net/*/bxsafe.js
||windows.net*/esc.js
||windows.net/*/flscn.js
||windows.net/js/jsd1.js
||windows.net/js/jsd2.js
||windows.net/*/jupiter.js
||windows.net/*/noir.js
||windows.net/*/nvidia.js
||windows.net/media/beep.mp3
||windows.net/*/media/beep.mp3
||windows.net/*_Fm7-alert.mp3
||b-cdn.net/jupiter.js
||b-cdn.net/noir.js
||b-cdn.net/nvidia.js
||windows.net/js/customone.js
||windows.net/js/customtwo.js
||windows.net/media/apked.mp4
.online/js/esc.js|$script,1p
.online/js/flscn.js|$script,1p
||amplifyapp.com/*/js/esc.js
||amplifyapp.com/*/js/flscn.js
||web.core.windows.net/takashi.mp3
||web.core.windows.net/yaketsuku.mp3
||web.core.windows.net/haruto.js
||web.core.windows.net/itsuki.js
||web.core.windows.net*/js/leave.js
||web.core.windows.net*/js/mouse.js
||web.core.windows.net/media/chrm.mp3
||web.core.windows.net/js/full.js
||web.core.windows.net/media/webs.mp4
||web.core.windows.net/js/lvs.js
||web.core.windows.net/js/muse.js
||web.core.windows.net/js/script5.js
||web.core.windows.net/js/script6.js
||web.core.windows.net/js/script7.js
||ipwho.is^$xhr,domain=web.core.windows.net

! https://twitter.com/genegene1234561/status/1647164176438280192
||japanonlinebroadcast.live^$all

! https://www.reddit.com/r/uBlockOrigin/comments/12ng4o8/
! https://www.virustotal.com/gui/url/fe6b4bc7a258a92a97ad3216c85d159857ccd581df9b31a50a308ca49f967e34
! https://www.virustotal.com/gui/url/0d491da362effc08d2b026f32242046d174165e7995abbde6917ef7864a7556c
||crackedpc.org^$all
||cracksway.com^$all

! https://www.reddit.com/r/uBlockOrigin/comments/12r255v/gamingnewsanalystcom_badware/
! https://github.com/uBlockOrigin/uAssets/pull/17655
||gamingnewsanalyst.com^$all
||gamingdebates.com^$all

! https://www.reddit.com/r/uBlockOrigin/comments/12vi0jy/
! https://www.virustotal.com/gui/url/e705e6e86261849df50f80f32db2bb74abb1f69fd2681a370c5013be27c9daf0
! https://www.virustotal.com/gui/file/f1e859d99072e35f20e172d8458e3ea1baf8ba86c8c9e311a0debcd2acd5d0fc
||bonzi.link^$all

! https://www.reddit.com/r/uBlockOrigin/comments/1314r3d/
! https://www.virustotal.com/gui/url/23a6e05b5c2005b085b2cb41f35cddf2e689d72797448dd8c7399f7f929507e0
||bestgames-2022.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/17947
! https://www.virustotal.com/gui/domain/pccdirect.site
! https://safeweb.norton.com/report/show?url=pccdirect.site
||pccdirect.site^$all

! https://github.com/uBlockOrigin/uAssets/issues/17960
! https://malwaretips.com/blogs/remove-template-search-newtab/
! https://www.virustotal.com/gui/domain/templatesearch.org
||templatesearch.org^$all

! https://www.reddit.com/r/uBlockOrigin/comments/13a95k2/
! https://www.virustotal.com/gui/url/dfe9c3f9bf87d003c70fecae8012b9fe4858a3922e6218b05a672fd3fe7f140e
! https://safeweb.norton.com/report/show?url=f-i-n-d.onlyfuns.win
! https://sitecheck.sucuri.net/results/f-i-n-d.onlyfuns.win
||f-i-n-d.onlyfuns.win^$all
! https://safeweb.norton.com/report/show?url=search-journal.onlyfuns.win
! https://urlscan.io/result/826671e6-126b-4113-82e3-24d96469bd93/
! https://sitecheck.sucuri.net/results/https/search-journal.onlyfuns.win/ydt
! https://www.virustotal.com/gui/domain/search-journal.onlyfuns.win
! https://www.virustotal.com/gui/domain/ftx.onlyfuns.win
||search-journal.onlyfuns.win^$all
||ftx.onlyfuns.win^$all
! https://www.virustotal.com/gui/domain/adultpics.wiki
||adultpics.wiki^$all

! https://github.com/uBlockOrigin/uAssets/issues/18103
! https://www.virustotal.com/gui/file/1f4f7b787ee329059e4de4487ba5c17c7c6ca3be95b72c9873fc9380632fa1f9/
! https://www.virustotal.com/gui/domain/d2r3dgsh5nr4kg.cloudfront.net
! https://www.virustotal.com/gui/domain/gamefabrique.com
! https://otx.alienvault.com/indicator/domain/gamefabrique.com
! https://opentip.kaspersky.com/gamefabrique.com
! https://safeweb.norton.com/report/show?url=gamefabrique.com
! https://www.urlvoid.com/scan/gamefabrique.com/
||gamefabrique.com^$all
||d2r3dgsh5nr4kg.cloudfront.net/installer/$all

! https://github.com/uBlockOrigin/uAssets/issues/18208
||hard-configurator.com^$all

! https://www.virustotal.com/gui/domain/mopiez.com
||mopiez.com^$all
! https://www.virustotal.com/gui/domain/goglel.com
||goglel.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/18380
||bestextensionegde.com^$all

! https://github.com/DandelionSprout/adfilt/discussions/779#discussioncomment-6298369
.com/api/users*^pii=&in=false^$doc
.com/api/users*^in=false&pii=$doc
.com/api/users*^in=false&token=$doc

! https://github.com/AdguardTeam/AdguardFilters/issues/158317
.com/bot-captcha-1?h=$doc

! https://github.com/AdguardTeam/AdguardFilters/issues/159825
/^https:\/\/[a-z]{5,7}\.[0-9a-z]{12}\.top\/[0-9a-f]{32}\/[0-9-a-f]{32}\/$/$doc,match-case,to=top
/\/[0-9a-f]{32}\/maq\/$/$doc,match-case,to=com|top
/antivirus/main/cleaner-default/*$doc

! Copycat and fake sites
! FitGirl Repacks - Official site: fitgirl-repacks.site
! https://old.reddit.com/r/FitGirlRepack/
! https://old.reddit.com/r/PiratedGames/comments/drlx3r/does_anyone_know_the_official_website_for_fitgirl/
! https://old.reddit.com/r/CrackWatch/comments/wl7nfb/dream_cycle_v209_release_fitgirl_repack_158_gb/?context=3
! https://github.com/uBlockOrigin/uAssets/issues/15085
! https://github.com/uBlockOrigin/uAssets/pull/15850
||fitgirl-repacks.*^$all,domain=~fitgirl-repacks.site,to=~fitgirl-repacks.site
||fitgirl-repack.*^$all,domain=~fitgirl-repacks.site
||fitgirlrepacks.*^$all,domain=~fitgirl-repacks.site
||fitgirlrepack.*^$all,domain=~fitgirl-repacks.site
||fitgirls-repack.*^$all,domain=~fitgirl-repacks.site
||fitgirl-repacks-site.org^$doc,domain=~fitgirl-repacks.site
! https://github.com/uBlockOrigin/uAssets/issues/18205
||fitgirlrepacksite.com^$all,domain=~fitgirl-repacks.site
! https://github.com/uBlockOrigin/uAssets/issues/18206
||fitgirl.cc^$all,domain=~fitgirl-repacks.site
! https://github.com/uBlockOrigin/uAssets/issues/21658
||fitgirlrepackz.*^$all,domain=~fitgirl-repacks.site
! https://github.com/uBlockOrigin/uAssets/pull/22532
||fitgirltorrent.*^$all,domain=~fitgirl-repacks.site
! Magisk manager - Official site: https://github.com/topjohnwu/Magisk
! https://xda-developers.com/psa-magiskmanager-com-not-official-website-magisk/
! https://forum.xda-developers.com/t/downloaded-a-fake-magisk.4581461/
! https://old.reddit.com/r/Android/comments/7r346t/psa_magiskmanagercom_is_not_the_official_website/
! https://github.com/topjohnwu/Magisk/issues/3435
! https://github.com/hagezi/dns-blocklists/issues/1744
||magiskmanager.com^$all
||magisk.me^$all
||magiskapp.com^$all
||magiskroot.com^$all
||magiskroot.net^$all
||magisks.com^$all
||themagisk.com^$all
||magiskzip.*^$all
||magiskmodule.com^$all
! LibreTube - Official site: libretube.dev
! https://github.com/libre-tube/LibreTube/issues/4409
||libretube.*^$all,domain=~libretube.dev,to=~libretube.dev
||libretubeapk.com^$all,domain=~libretube.dev
! ReVanced - Official site: revanced.app
! https://old.reddit.com/r/revancedapp/comments/1327o38/list_of_fake_revanced_sites_download_sites/
! https://old.reddit.com/r/AfterVanced/comments/wf4ov1/the_raftervanced_faq_frequently_asked_questions/
! https://github.com/revanced/revanced-discussions/discussions/854#discussioncomment-4565731
! https://safeweb.norton.com/report/show?url=revanced.io
! https://sitecheck.sucuri.net/results/revanced.io
! https://github.com/uBlockOrigin/uAssets/pull/17469
! https://github.com/uBlockOrigin/uAssets/issues/18857
! https://github.com/uBlockOrigin/uAssets/pull/19580
! https://github.com/hagezi/dns-blocklists/issues/2288
||revanced.$all,from=~revanced.app,to=~revanced.app
||revancedapk.$all,domain=~revanced.app
||revancedapp.$all,domain=~revanced.app
||ytvancedpro.com^$all,domain=~revanced.app
||youtubevanced.$all,domain=~revanced.app
||youtuberevanced.*^$all,domain=~revanced.app
||revancedmusic.com^$all,domain=~revanced.app
||revancedyoutube.org^$all,domain=~revanced.app
||revancedextend.com^$all,domain=~revanced.app
||revancedextended.$all,domain=~revanced.app
||revanced-extended.com^$all,domain=~revanced.app
||extendedrevanced.com^$all,domain=~revanced.app
||ytrevanced.$all,domain=~revanced.app
||vanced-official.com^$all,domain=~revanced.app
||vanced.pro^$all,domain=~revanced.app
||vancedmanager.$all,domain=~revanced.app
||revancedapps.$all,domain=~revanced.app
! LuckyPatcher - Official site: luckypatchers.com
! https://old.reddit.com/r/luckypatcher/comments/rawq9f/what_is_the_official_website/
! https://old.reddit.com/r/luckypatcher/comments/aln5tj/official_download_for_lucky_patcher/
||luckypatcher.*^$all,domain=~luckypatchers.com
||luckypatchers.*^$all,domain=~luckypatchers.com,to=~luckypatchers.com
||luckypatcherwin.com^$all,domain=~luckypatchers.com
! Balena Etcher - Official site: etcher.balena.io
! https://forums.balena.io/t/counterfeit-etcher-websites/274606/5
||etcher.net^$all,domain=~etcher.balena.io
||etcher.download^$all,domain=~etcher.balena.io
||balenaetcher.$all,domain=~etcher.balena.io
! Vencord - Official site: vencord.dev
! https://github.com/uBlockOrigin/uAssets/pull/19359
||vencord.app^$all,domain=~vencord.dev
! NewPipe - Official site: newpipe.net
! https://github.com/uBlockOrigin/uAssets/pull/22134
||newpipe.app^$all,domain=~newpipe.net
! Z-Library - Official sites: singlelogin.se, singlelogin.re, z-library.se, zlibrary-global.se, go-to-zlibrary.se
! https://www.reddit.com/r/zlibrary/comments/16xtm67/if_you_cannot_download_any_books_then_youre_on/
! https://github.com/uBlockOrigin/uAssets/pull/22998
||z-lib.io^$all
||z-lib.id^$all
||zlibrary.to^$all
||z-lib.yt^$all
||z-lib.lol^$all
||zlibrary-global.com^$all
||zlib-official.com^$all
||zlibrary.lol^$all
||z-library.live^$all
||z-library.blog^$all
||z-library-proxy.com^$all
||go-to-zlibrary.com^$all
! ProtonGE - Official site: https://github.com/GloriousEggroll/proton-ge-custom
! https://github.com/GloriousEggroll/proton-ge-custom#myself-gloriouseggroll-and-this-project-proton-ge-are-not-affiliated-with-httpsprotongecom-that-is-a-spamfake-website-there-is-no-existing-website-for-proton-ge-other-than-this-github-repository-proton-ge-does-not-collect-any-user-data-what-so-ever-and-is-not-a-company-or-organization-of-any-type
||protonge.com^$all
! Bloxstrap - Official site: bloxstraplabs.com
! https://github.com/uBlockOrigin/uAssets/issues/24123
! https://github.com/uBlockOrigin/uAssets/pull/24408
! https://github.com/bloxstraplabs/bloxstrap/blob/main/README.md
||bloxstrap.*^$doc,domain=~bloxstraplabs.com,to=~bloxstrap.pizzaboxer.xyz
||bloxstrapmenu.com^$doc,domain=~bloxstraplabs.com
! Fishstrap - Official site: fishstrap.app
! https://github.com/uBlockOrigin/uAssets/issues/27022
! https://github.com/returnrqt/fishstrap/blob/main/README.md
||fishstrap.com^$doc,domain=~fishstrap.app

! phishing https://www.virustotal.com/gui/url/8521a1e5b4269111fb1e98f2142739dad1d6fb42ddf5198597c68abfea395f7f/detection
||reink2.top^$all

! https://github.com/DandelionSprout/adfilt/discussions/779#discussioncomment-7137675
||86pmafno21mst.com^$all
||akyr3h9x5mb.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/20036
! https://tria.ge/231010-1rdl5sfg68/behavioral1
||tiger.qnews.media^$3p
||s8bet.com^$doc
||imagebet.ph^$all
||googleeplay.com^$all
||mingvip.com^$all
||t89ll.com^$doc
||brkbk.202226.net/jump/index.html$doc
||kbkb.bet^$doc
||bxtongji.cc^$all
||04tips.com^$all
||cdn.jsdelivr.net/gh/cnmseo/LookMother$3p
||urjump.com^$doc
||m8u9f3.com^$doc
|http://playing.io/?inviteCode=1000631|$doc
|http://playing.io/?inviteCode=1000632|$doc
||ttt777.com^$doc
||cloudflarebros.com^$all
||brcknkblue.com^$all
www.cambe.pr.gov.br##+js(noeval-if, tigervip2)

! https://tria.ge/231024-3lc5jace3w/behavioral1 & https://tria.ge/231024-3s7ygsbg39/behavioral1
! https://github.com/uBlockOrigin/uAssets/pull/20272
||adblock1.com^$all
||newupdatesnow.com^$all
||thefinanceadvice.com^$all
||fralstamp-genglyric.icu^$all

! https://github.com/uBlockOrigin/uAssets/issues/20335
||ilil.in^$all

! https://github.com/uBlockOrigin/uAssets/issues/20400
||ets2.gr^$all

! https://github.com/uBlockOrigin/uAssets/pull/21315
! https://bbs.kafan.cn/thread-2258753-1-1.html
||chromegoogle.cn^$all

! https://github.com/uBlockOrigin/uAssets/pull/21316
! https://bbs.kafan.cn/thread-2262861-1-1.html
||mk90.shop^$all

! Cryptocurrency Scams
||musk-project.com^$all
||muskusa.com^$all
||earth-ling.org^$all
||muskevent.info^$all
||teslamaked.com^$all
||cryptomusk.io^$all
||youtube.com/@Tesla.debate_live2024^$doc
||youtube.com/@TheCryptoLarkCrypto^$doc
! https://github.com/uBlockOrigin/uAssets/issues/24296
! https://www.virustotal.com/gui/url/95c95990e40d0859a1766b2da6047f64d2faecee65d74669243d443c7c185ebf
! https://www.urlvoid.com/scan/teslafond.io/
||teslafond.io^$all
! https://github.com/uBlockOrigin/uAssets/issues/24590
||teslacore.io^$all
! https://github.com/uBlockOrigin/uAssets/issues/24734
||btc24.info^$all
||youtube.com/@tesla24official^$doc
! https://www.reddit.com/r/Scams/comments/1fjggp3/deepfake_of_elon_musk_promoting_a_scam_qr_code/
||usmusk.net^$all
! https://github.com/uBlockOrigin/uAssets/issues/25492
||foundations-x2024.*^$doc,to=foundations-x2024.*
||foundations-x2024.cloud^$all
||foundations-x2024.sbs^$all
! https://github.com/uBlockOrigin/uAssets/issues/25832
||trump-drop.org^$all
||youtube.com/@tesla.Iive.officiaI.24^$doc
! https://gizmodo.com/elon-musk-fans-are-losing-so-much-money-to-crypto-scams-2000515413
||elondonald.com^$all
||musktrump.io^$all
! https://github.com/uBlockOrigin/uAssets/issues/26056
||stage3-last.$doc,to=~edu|~gov
||stage2024.$doc,to=~edu|~gov
! https://github.com/uBlockOrigin/uAssets/issues/26174
||presale-friday.$doc,to=~edu|~gov
||sale-friday.$doc,to=~edu|~gov
||stage3sale.$doc,to=~edu|~gov
||stage3sale2024.$doc,to=~edu|~gov
||black-sales.$doc,to=~edu|~gov

! xai scams
/^https:\/\/xai\w+(?:\.\w+)?\.[a-z]{3,}\/presale\b/$doc,match-case,to=~edu|~gov
/^https:\/\/[-\w]+xai\.[a-z]{3,}\/presale\b/$doc,match-case,to=~edu|~gov
||xaitoken.live^$all
||investxai.pro^$all
||xaitoken.$all,to=xaitoken.app|xaitoken.page.link|xaitoken.net
! https://github.com/uBlockOrigin/uAssets/issues/25726#issuecomment-2483460915
! https://www.reddit.com/r/CryptoScams/comments/1gv401z/xai_scam/
||xaiofficial.com^$all
! https://www.reddit.com/r/CryptoScams/comments/1h0ygoo/another_scam/
||officialxai.com^$all
! https://www.reddit.com/r/CryptoScams/comments/1h4mvx9/xai_scams_dont_trust_jesse_eckel_youtube_and/
||youtube.com/@jesseeckel5^$doc
! https://www.reddit.com/r/CryptoScams/comments/1h9yrl7/xai62f_presale_scam/
||xaiofficial.ai^$all

||0x00000000000.substack.com^$all
||etharticles.substack.com^$all
||publicationgroup.substack.com^$all
||teamproject.substack.com^$all
||tradestrategy.substack.com^$all
||uniproject.substack.com^$all
||web3projects.substack.com^$all
||webpublic.substack.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/22129
||primeleech.com^$all

! https://github.com/uBlockOrigin/uAssets/discussions/23094
! https://blog.sucuri.net/2024/02/web3-crypto-malware-angel-drainer.html
! https://www.virustotal.com/gui/url/2bf2e7500e2b15877f866b0a782436df8621b2c20f81e3d66f51e394f6ff6f30
||hostpdf.co^$all
/cachingjs/settings.js
/cachingjs/turboturbo.js
/config?key=6922a2c8-d1e9-43be-b201-749543d28fe1
/config?key=d35e161b-abb4-4949-b523-003165d250bb

! https://blog.sucuri.net/2023/08/from-google-dns-to-tech-support-scam-sites-unmasking-the-malware-trail.html
||dns.google/resolve?name=*.host-stats.io&type=txt|$xhr,3p

! https://blog.sucuri.net/2024/03/new-malware-campaign-found-exploiting-stored-xss-in-popup-builder-4-2-3.html
! https://www.virustotal.com/gui/domain/ttincoming.traveltraffic.cc/detection
! https://www.virustotal.com/gui/domain/host.cloudsonicwave.com
||traveltraffic.cc^$all
||cloudsonicwave.com^$all

! https://www.malwarebytes.com/blog/threat-intelligence/2024/03/fakebat-delivered-via-several-active-malvertising-campaigns
! https://www.virustotal.com/gui/url/1429f749760b6d69d16234f394be11fc61f48df2e1956ecc37f556621abad7e7
||open-project.org^$all
||epicgames-store.org^$all
||trelconf.com^$all
||trelconf.net^$all
||noitons.net^$all

! https://www.malwarebytes.com/blog/uncategorized/2024/03/tax-scammer-goes-after-small-business-owners-and-self-employed-people
! https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Firs-ein-gov.us%2F
! https://safeweb.norton.com/report/show?url=https:%2F%2Firs-ein-gov.us%2F
! https://www.virustotal.com/gui/domain/irs-ein-gov.us
||irs-ein-gov.us^$all

! https://blog.sucuri.net/2024/03/sign1-malware-analysis-campaign-history-indicators-of-compromise.html
/^https:\/\/[a-z]+\.[-a-z0-9]+\.[a-z]{3,7}\/[a-z]{2,6}\.(?:[a-z]{1,8}\.)?17\d{8}\.js\?(?:revision|sr?c?|ve?r?)=6[a-f0-9]{7}$/$script,3p,match-case,to=~edu|~gov
/^https:\/\/[a-z]+\.[-a-z0-9]+\.[a-z]{3,7}\/17\d{8}\/em\.js\?(?:revision|sr?c?|ve?r?)=6[a-f0-9]{7}$/$script,3p,match-case,to=~edu|~gov
||fueltypebel.info^$all
! https://infosec.exchange/@InfobloxThreatIntel/111947476473623155
! https://malwaretips.com/blogs/re-captha-version-3-55-top/
||re-captha-version-$all
! https://github.com/uBlockOrigin/uAssets/issues/24944
||valid-check-tl-$all
! https://github.com/uBlockOrigin/uAssets/issues/25858
! https://www.virustotal.com/gui/url/346513820edf167da7ee220fef88802fcc6568b8c7d42802d6c47796a455abc2
! https://blog.sucuri.net/2024/05/mal-metrica-redirects-users-to-scam-sites.html
! http://teluguodu.com/om-bheem-bush-movie-review/ - example site
||psh-static.b-cdn.net^
||check-tl-$all
||tech4u.app^$all
.com/?news&s|$popup
||cloud.tnewstraffic.com^$all
||cache.cloudswiftcdn.com^$all
||cdn.metricastats.com^$all
||cloud.edgerapidcdn.com^$all
||content.gorapidcdn.com^$all
||content.streamfastcdn.com^$all
||fast.quickcontentnetwork.com^$all
||ga.cdzanalytics.com^$all
||gll.metricaga.com^$all
||host.cloudsonicwave.com^$all
||host.gsslcloud.com^$all
||metrics.gocloudmaps.com^$all
||secure.gdcstatic.com^$all
||secure.globalultracdn.com^$all
||static.rapidglobalorbit.com^$all
||synd.edgecdnc.com^$all
||syndication.gcdnanalytics.com^$all
! https://www.reddit.com/r/uBlockOrigin/comments/1cane2z/clients_website_is_getting_blocked/l0tvbkp/
||mygeomanager.org^$all
||livedashboardkit.info^$all
/^https:\/\/[a-z]{10,}\.[a-z]{3,4}\/(?:engine|track)-[a-f0-9]{8}\.js$/$script,3p,to=~edu|~gov,header=vary:/^referer\,accept-encoding/i

! https://securelist.com/trojanized-text-editor-apps/112167/
! https://www.virustotal.com/gui/url/dce13fec61cd1b81b55c8d126b99266efbb6166d1a0bba02d4b8482ed53401b1
||vnote-*.myqcloud.com^$all

! phishing
! https://infosec.exchange/@urldna/112143355675099806
! https://www.virustotal.com/gui/url/38ad38ba67efdd42656b489e4df678ee065cad109cd1c9dbacf4632d356250d9
/^https:\/\/vietg[a-z]v[0-9]*\.cc\//$doc,to=cc
||clickhereecraigslist.tripod.com^$all
||mymokki.ru^$all,to=~hozblokspb.ru
||lapmangsctv.com.vn^$doc,to=~sctv.com.vn
||socgeneralist.firebaseapp.com^$all,to=~societegenerale.com
||testra*-covid.weebly.com^$all,to=~telstra.com.au
||telus.signup.clik2pay.com^$all,to=~telus.com
||flow.page/foxhills.co.uk^$all,to=~foxhills.co.uk
||jemi.so/correo-24-ar^$all,to=~correoargentino.com.ar
! https://infosec.exchange/@urldna/112471179848866488
||codeanyapp.com/neta/*/pay-method.php$doc
! https://infosec.exchange/@urldna/112469056606126055
||otomoto-h229.net^$all,to=~otomoto.pl
! https://infosec.exchange/@urldna/112467877238803859
||mybluehost.me/*Recibir_paquete.php$doc,to=~correos.es
! https://infosec.exchange/@urldna/112511051868588218
||codeanyapp.com/klarna/$doc,to=~klarna.com
! https://infosec.exchange/@urldna/112551867657605910
||mybluehost.me/*/dir/ca/pay/$doc,to=~canadapost-postescanada.ca
! https://urldna.io/scan/66a7ef78c6cd731d9e58537d
! https://www.virustotal.com/gui/url/56f91ca466c57869495ae334a9cf3c9e783adaca073f3c9c3ea2c79e4eb34659
||pub-*.r2.dev/gsecondcheck.html^$doc
! https://www.virustotal.com/gui/url/03b24f614a52c8027b4e82187175cafec7914b2f1b36e1f8ecf1a34ef72f5b7d
||uwelldeutschland.com^$all,to=~myuwell.com
! https://urldna.io/scan/672f9abd700a5d3457075fca
! https://www.virustotal.com/gui/url/ecbf475713f97228a59e6e5e79b9ba9609a09c22a1f5dedcd5c16d25f96eb07b
||user.fm/files/*/AbsaOnlinePop.html^$doc,to=~absa.co.za
! https://urldna.io/scan/67324b5a3803a830facf48a3
! https://www.virustotal.com/gui/url/abffa191cb33c38b1f9d5122904b940a7363a665c8ccee108aba6bf28549f497
||user.fm/files/*/ProofOfPayment.HTML^$doc
! https://www.virustotal.com/gui/url/6f952ec0d0f90125a00e86bd4e4597558f5c4cbdbdac197d715476ddb423b15a
/^https?:\/\/server\.[a-z0-9]{4}\.com\/invite\/\d+\b/$doc,match-case,to=com
! https://www.virustotal.com/gui/url/9e831405bb6fa517e0f6a8108bebf9feb0bd1a7c48684615aa34f558fd6bacc3
! https://urldna.io/scan/677eac1ec065f0f7026d1acc
/^https:\/\/[a-z0-9]{3,}\.[a-z]{8,10}\.ru\/[a-zA-Z0-9]{6,8}\/#[A-Z][a-z]{5,}@[a-z]+\.com$/$doc,match-case,to=ru
/t2dolalrwe/*$doc
##html[lang] > body:not([class]):not([id]):not([style]) > div.background-container > div.container > div.captcha-box
! https://urldna.io/scan/6785470b9c7014f0037a59ef
! https://www.virustotal.com/gui/url/3e3980788d2f902a650614287373abff2e8a52d707e2eb18dd56b1398922b45f
||melbournedistillery.com^$all
! https://urldna.io/scan/6787ea54ff48f1c3edd44b8d
! https://www.virustotal.com/gui/url/9362994a4404b8b59c426bb8a4637c10a17b298283aa728233c02ca5f48b9ca6
||koenig.cx^$all,to=~dropbox.com
! https://urldna.io/scan/679555cbdaf027101ea6a79f
! https://www.virustotal.com/gui/url/ee23a4af12effb7c10d2708f5d91541de414f547ce10ac39ad91c147fc1a9976
||eden.com.mx/support/juno/$all,to=~juno.com
! https://urldna.io/scan/67ac1e22fe8ca5effcab48a2
! https://www.virustotal.com/gui/url/2cf961c2a0441b4015603b2657d2db13692dc21008f1a78463f15a4cd4d558be
||emta-ee-authst.firebaseapp.com^$all,to=~ria.ee
||firebaseapp.com/Autentimine^$doc,to=~ria.ee

! ionos.com
! https://www.virustotal.com/gui/url/ddc3f8902f79ff133d7c3b115a29d785b19a74d3dc2a4db451d1c31d297fbbb2
||id-ionos.premiumservicesrl.com^$all,to=~id.ionos.com
! https://www.virustotal.com/gui/url/d9e486fc298d617dcef3444322b3fd62e7c09f2f2fee4c97736c54f38c9d67c6
||login-*-ionos-co-uk.jcmemoryscan.com^$all,to=~ionos.com

! chase.com
||unclepigva.com^$all,to=~chase.com
! https://urldna.io/scan/678b29ad976ce49815c9d092
! https://www.virustotal.com/gui/url/555d499dc6a45517858cc393ef245217657ddae4d997f43a6c438746add59042
||aurelie-picard-parentalite.fr/*/Recurring_Payment_Authorizationtt.html^$all,to=~chase.com
! https://www.virustotal.com/gui/url/aa63af97991d0fdce1c1381bc8c652932c396d7ff90505f6c9b2a78d1a4c8f3d
||mywebsitetransfer.com/chase/auth^$doc,to=~chase.com

! ameli.fr
! https://urldna.io/scan/673d518d1baadd13b30c1a19
! https://www.virustotal.com/gui/url/0b8c995ec706e68efcf33f1b7c567423285c29d0d3bc5b59f606da0735097e57
||fgt.ive.mybluehost.me^$doc,to=~ameli.fr
||mybluehost.me/*/Ameli/$doc,to=~ameli.fr
! https://urldna.io/scan/6734c9b617aed83575751074
! https://www.virustotal.com/gui/url/ac22c2340836b8dd3d611948cb1f0f370d55f9903faac7bfc5eea1ff71901a80
||line.pm/*/SNF-GKFF.FR/$doc,to=~ameli.fr

! ram.co.za
||ramscourierservice.weebly.com^$all,to=~ram.co.za
! https://urldna.io/scan/6734b1f69ee995c0b18b4e17
! https://www.virustotal.com/gui/url/fec16443e3fdb3c4112230fd5271044f3eea542efa85be26b8c8c5f5ba7202c3
||rampostsouthafrican-*.codeanyapp.com^$all,to=~ram.co.za
||codeanyapp.com/southafrica/*/PAYU^$doc,to=~ram.co.za

! wetransfer
||vvetransfer-lo-web-online.glitch.me^$all
! https://www.virustotal.com/gui/url/2dc456580d55d86c4b131ecc5120af4d79439ac3f9be066ce2c2440e4af96581
||vercel.app/magi/olde/saac-wetr-magi.html^$doc,to=~wetransfer.com
||download-wetransfer-*.vercel.app^$doc,to=~wetransfer.com
! https://www.virustotal.com/gui/url/9b40e92a4a7347a20f1d85bfe0e7e42622d08878d521db092c66ef9554eac83b
||specific-sample-orderline.vercel.app^$all,to=~wetransfer.com
! https://www.virustotal.com/gui/url/1adb59400d7153cc8cc5cf42cf25d03fb21f00c04b1bcb888acc526a10640f84
||purring-wood-magnolia.glitch.me^$all,to=~wetransfer.com
! https://urldna.io/scan/6734cdbe32353732f75caf89
! https://www.virustotal.com/gui/url/f31f3ff52efb6f2ec05f8cdcfd2fbbbe2e5e4fafb370031549d345c586afa947
||bingkasprogram-*.xdbng.com^$all

! leboncoin.fr
||auth2323d23.weebly.com^$all,to=~leboncoin.fr
! https://urldna.io/scan/6790f2df1cf105cd289789cf
! https://www.virustotal.com/gui/url/94f712e987d95edde2259f4f279ff9b3eca8deace265ad25f60f3dbc4387d5f1
||multilocal-leboncoin.com^$all,to=~leboncoin.fr

! linkedin
||faran.ac.ir/wp-content/$all,to=~linkedin.com
! https://www.virustotal.com/gui/url/0de3c62f4908d543d129c280ede7df7ad39cb8bdc69a7781aceab7bd9916cacf
||lnkdeka.standard.*.oortech.com^$doc,to=~linkedin.com
||oortech.com/loginfromSignIn.pdf-shtml^$doc,to=~linkedin.com
! https://www.virustotal.com/gui/url/bfab94c8fdfaab7bd440a6fb9e6a402dca1e7c70bcc0e33c9a9f526f17f1422e
||decorartealuminios.com.br/*/AZ-ULTIMATE-LINKEDIN/$all,to=~linkedin.com

! yahoo
! https://www.virustotal.com/gui/url/9fe200d8d5cdd921d387cb91a575532aa256fa85371c62b75c0058938cbcf225
||pages.dev/account/js-reporting^$doc,to=~yahoo.com
||iwq.pages.dev^$all,to=~yahoo.com
||jss.pages.dev^$all,to=~yahoo.com

! webmail
||formspark.rongviet.com.vn^$all
||webmailrupdatekorea.firebaseapp.com^$all
||benpsignin-portal.webflow.io^$all
||mail-cytanet.pages.dev^$all,to=~mail.cytanet.com.cy
||serviceteasfreem.weebly.com^$all
||jhwbcvkjkshaw.weebly.com^$all,to=~webmail.shaw.ca
||webmailupdating.wixsite.com^$all,to=~email.telstra.com
! https://www.virustotal.com/gui/url/dd060d260d7781f9610f40bdff4991144ed5b52be3a14dfcda6783987efc4b79
||phoenixvilla.rw/wp-about/*.html^$doc
! https://www.virustotal.com/gui/url/5a758358bf0a16b7afeadc99026ce4fc7c1faf0298f2f7c6b5ace52e7f148eef
||moonworks.in/jpcpanel/$all
! https://www.virustotal.com/gui/url/fe60b5ca89346121b165aaaaf2b0305dee777a8aa90c87e3eb656c914ae04e59
||bequettehomes.com/ahost/$all
! https://www.virustotal.com/gui/url/61cc08602b6328ce07535da1068dfc0f3ddd667c0e77849eadcd8ae33edad516
/^https://[a-z]{40,}\.pages\.dev\//$doc,to=pages.dev
! https://www.virustotal.com/gui/url/060b5ecd27e1ea35fa0718a87e73c270ac3c7310ddc4a7aef81b70bb7b89908a
||resisted-amusing-driver.glitch.me^$all
||glitch.me/public/index_CNC.html^$doc
! https://urldna.io/scan/6744075cddfe5e2d403906d8
! https://www.virustotal.com/gui/url/52781cf069e36bf584b588626bdc26e045c1acaf97d0990976ce3ecafe891f93
||r2.dev/Zimbra*.html^$doc,to=~mail.zimbra.com
! https://www.virustotal.com/gui/url/db592df8b8bc2b093e6087e6e14f6bfbfe121d6192fdce5f112cff14b294275b
/\/accounts\/19[56]\d{3}\/messages\/\d{1,2}\/clicks\/\d{4,5}\/\d{1,2}\b/$doc,match-case

! webmail.bell.net
||bellsecuredloginfom-net.vercel.app^$all,to=~webmail.bell.net
||hootbio.com/bellmail$all,to=~webmail.bell.net

! webmail.shaw.ca
||shawupdatingservic.wixstudio.io^$all,to=~webmail.shaw.ca
||shawmailboxservice4.wixsite.com^$all,to=~webmail.shaw.ca

! ups.com
! https://www.virustotal.com/gui/url/ef9755fcb211a668986b9afc5187577c92fb8c8bf62057bf9d0b59333827a35a
||mybluehost.me/Versan/UPS/$doc,to=~ups.com
! https://www.virustotal.com/gui/url/491f01fc6219c7c86ab857fe64e7b1d1ae815a7f796cc03cdb2866784ea16022
||preprod.exclusifparis.com/modules/deleteordersfree/$all,to=~ups.com
! https://www.virustotal.com/gui/url/3e53440f58e4d07872d2a5a7a6dbf845ec58b4c65301ef27c85bd61e3869587c
||edu.academiait.ru/.css/$all,to=~ups.com

! ee.co.uk
/^https:\/\/ee(?:-[a-z]{5,}){1,2}\.web\.app\//$doc,to=web.app|~ee.co.uk
/^https:\/\/ee(?:-[a-z]{5,}){1,2}\.firebaseapp\.com\//$doc,to=firebaseapp.com|~ee.co.uk
||my-ee-*.web.app^$doc,to=~ee.co.uk
||ee-network.web.app^$all,to=~ee.co.uk
||ee-billing-recovery.web.app^$all,to=~ee.co.uk
||ee-payment-issue.web.app^$all,to=~ee.co.uk
||my-ee-web.web.app^$all,to=~ee.co.uk
||my-ee-details.web.app^$all,to=~ee.co.uk
||my-info-ee.web.app^$all,to=~ee.co.uk
||ee-payment-method-issue.firebaseapp.com^$all,to=~ee.co.uk
||ee-pending-payment.firebaseapp.com^$all,to=~ee.co.uk

! bpost.be
||pakket-bpost-be.web.app^$all,to=~bpost.be
! https://urldna.io/scan/66b4cf94823078d8ed5a58d3
! https://www.virustotal.com/gui/url/07643f94058c79d4db0d2a4a5a318e0eca61d62b877d82b790eda32557e1e34a
||crpostbelnk.glitch.me^$all,to=~bpost.be

! intesasanpaolo.com
! https://urldna.io/scan/66a0d0d33b59511de9602564
! https://www.virustotal.com/gui/url/e9af3245273512c1cff602c7f7155b0f02559d3ea71eb1ef71050987ab097a08
! https://www.virustotal.com/gui/url/4b7c8214397f9b60c29d150b5de5f51c00d9ce1a7aa0975d3ab23d8151fbc427
||mybluehost.me/*intesasanpaolo/$doc,to=~intesasanpaolo.com
! https://www.virustotal.com/gui/url/2c550d7edd2e09bda175859925c4a54491014bd3a6088eb20c6e8f6af8bc1d22
||mybluehost.me/*/itx/it/conto/$doc,to=~intesasanpaolo.com

! paypal
||paypal-complete.com^$all
! https://www.virustotal.com/gui/url/cef8e619ca51273786cf72dab8a9d2daea04ce6fee978f0a42522fe10709785d
||prizegift.top^$all
! https://www.virustotal.com/gui/url/621f0b0a930a2e4ca9eb366e160f277ed64ae3fb27fc49c10f8b13965406fc8d
! https://www.virustotal.com/gui/url/44547259fcb9d9370026d505ab3e008012d70d63cf9974e1525cca0da5d30d9f
||paypal*.blogspot.$doc

! jio
! https://www.virustotal.com/gui/url/04af5fcfd24d55b81b2c1b6559a04fb30e7d12a11d0a83a280641d51cfb28572
! https://www.virustotal.com/gui/url/20fefdda4be34a69e4d12b7335bec5c512f4413e0834b461ff7195486558d001
/\/recharge\d?\.(?:html|php)\?mobile=\d{10}\b/$doc,match-case,to=~jio.com|~edu|~gov
! https://www.virustotal.com/gui/url/b759b9b84ad608c657b38f5df4ef20d316bfd542abba02fd18d3d0503132ca2c
/offer.php?rechargenumber=$doc,to=~jio.com|~edu|~gov
! https://www.virustotal.com/gui/url/4e4606f961466924894ce9d9dc3d41a151ff9dbaee68143b77f3a1db6a7ca972
/offer.html?rechargenumber=$doc,to=~jio.com|~edu|~gov
! https://urldna.io/scan/66a0d0c94f0acec29ff98592
! https://www.virustotal.com/gui/url/5208705dcb34cb93ae64eb4b4f11d20610a50cf6bf60c0190a67eac6a3a17355
/\/offer\.(?:html|php)\?(?:mobile|rechargenumber)=\d{10}\b/$doc,match-case,to=~jio.com|~edu|~gov

! apple
||buscaapp.com^$all
||dbs.applerewardsstore.com^$all,to=~dbs.com
||pal-24x7-support.xyz^$all
||pulseapp-24x7-service.github.io^$all
||rbchidraulica.com.br/info/verify^$all
! https://www.virustotal.com/gui/url/52cb5de2af70a3d65f41e0b63911d971ee27634d69160988ed7c8235c55c79e8
! https://www.virustotal.com/gui/url/dd2190d5505e9f0b1a79583c85dee20f6214b8bf614bf2a65187b1c9b5bd01df
/isignesp.php^$doc,to=~edu|~gov|~apple.com
! https://www.virustotal.com/gui/url/c9f138a870349b6c5e050bb4122ddf029ce78f1d701399e483656c0d89d2da70
/icloud2022-esp.php^$doc,to=~edu|~gov|~apple.com
! https://urldna.io/scan/6744068e8007f7be43de908c
! https://www.virustotal.com/gui/url/c2f79189f12bde8e6f32e61a4b5d7bf1948f04c8eab5a8a11df8c546b7bda019
||apples-24x7-*.pages.dev^$doc
||apples-24x7-customer-help-line.pages.dev^$all
||apples-24x7-help.pages.dev^$all
! https://www.virustotal.com/gui/url/cbc003929fddfa95032804f8ec9a850e88081ba6ba196c8df9885456e919f9f9
! https://www.virustotal.com/gui/url/82b10b329dc4296787ff7d6a1630a4ffb775d2335033cf4dcd0fb413173b2268
||icloud.apple-*.cn^$doc
/^https?:\/\/icloud\.apple\.[a-z]{6,}\.[a-z]+/$doc,to=co|cn

! ourtime
||login-ourtime.members-datings.workers.dev^$all,to=~ourtime.com
||ourtime-assist.members-authenticated.workers.dev^$all,to=~ourtime.com
||chat.voice-datings.workers.dev^$all,to=~ourtime.com
! https://www.virustotal.com/gui/url/8caad65d38a5f6df0e322dad6e4576fe0f42d2a9c4a4672d5959f5c53cb59632
||profile-ourtime.*.workers.dev^$doc,to=~ourtime.com
! https://www.virustotal.com/gui/url/ef9755fcb211a668986b9afc5187577c92fb8c8bf62057bf9d0b59333827a35a
/^https:\/\/ourtime\.[a-z]+-[a-z]+\.workers\.dev\//$doc,to=workers.dev|~ourtime.com
! https://www.virustotal.com/gui/url/82d637d6f547003b3e964cb24cbec41b6e811fdf9207056ee83d2121d60613ca
||voice-ourtime.*.workers.dev^$doc,to=~ourtime.com
/^https:\/\/(?:[-a-z0-9]+\.){2}workers\.dev\/v3\/(?:forgotpassword|security|signup)\b/$doc,to=workers.dev

! https://www.virustotal.com/gui/url/8fd29e49e539b6bab6c0a55c1d15321b7df02367fe1a9049c94fbf0b3aea1af8
! https://www.virustotal.com/gui/url/bd11af06bb1ed081ae7b373bd79e5601c17e0664be6856d922a92f771b24aee0
! https://github.com/uBlockOrigin/uAssets/issues/24829
/\/wap\/api\/(?:activity\/)?[a-zA-Z]+![-_a-zA-Z]+\.action\?/$xhr,1p,strict1p,match-case
! https://www.reddit.com/r/Scams/comments/1gg7xif/tiktok_fake_link_i_am_so_anxious_please_help_me/
! https://www.virustotal.com/gui/url/61c96fcfa32698a98f42c8ab0807a22e37d6722087fd478dfb2de71d3ebdbfa9
||wetching.ru^$doc,frame

! made-in-china.com
! https://infosec.exchange/@urldna/112553754973872125
||griffithdds.com/*/madeinchina.com/$all,to=~made-in-china.com
! https://urldna.io/scan/6696ed798f10cc579169ad67
! https://www.virustotal.com/gui/url/28ebe44abd659de808f562259dd899943c574ff82716856bfb76d218f64531b7
||oortech.com/mic.shtml^$doc,to=~made-in-china.com
! https://urldna.io/scan/674551863f64e80bf440d336
! https://www.virustotal.com/gui/url/ff4ccfb2b96d99a3cc1d783c835e7a02c5c2f680e93f7c93db403459cd651e22
||r2.dev/made-in-china.com/$doc,to=~made-in-china.com

! fedex
! https://www.virustotal.com/gui/url/3236050c1e12c8c10e6b905c61d2ed45f5a8fa393f560a96f98383565e57e78f
||fedexridn.com^$all
! https://www.virustotal.com/gui/url/0e767ec2a47d546a330606bb8d3ecfa70c21622eb5f05d58b0cfa2c9e64355ad
||saham.hugaf.dev^$all,to=~fedex.com

! booking.com
! https://www.virustotal.com/gui/url/5fef6bafac49c64dc9e0ca06339967aa2ba2936745a57ca2c47aa3606def1707
/^https:\/\/(?:[a-z]+\.)?hotel-(?:id)?\d{3,8}\.eu\//$doc,to=eu|~booking.com
/^https:\/\/(?:[a-z]+\.)?hotel-(?:id)?\d{3,8}\.com\//$doc,to=com|~booking.com
! https://www.virustotal.com/gui/url/5e3b5d680bc6c90219ddbb2524f7d6d8a58716399b4da91a06c027774d908e81
/^https:\/\/hotels-\d{6}\.eu\//$doc,to=eu|~booking.com
! https://urldna.io/scan/6692504801266863891e9011
! https://www.virustotal.com/gui/url/128f76d5853dacd7b1fac73d64a4078adde3c900b65bc23dc15bad5f629b446b
/^https:\/\/booking\.[a-z]{3,}-(?:id)?\d{3,8}\.eu\//$doc,to=eu|~booking.com
! https://www.virustotal.com/gui/url/73768b7c9bb2d042d06217e7526cc70608bd27ee32faf9df8e6fb251923b0789
/^https:\/\/booking(-[a-z]{3,}){2}\.(?:baby|lat|lol|xyz)\//$doc,to=baby|lat|lol|xyz|~booking.com

! airbnb
||air-bnb.check-$doc
||air.bnb-id*.com^$all,to=~airbnb.com
||navi-airbnb.vercel.app^$all,to=~airbnb.com
||property-rental-seven.vercel.app^$all,to=~airbnb.com
||airbnb-pi-three.vercel.app^$all,to=~airbnb.com
! https://www.virustotal.com/gui/url/8cdc4c3ca9313a9cdd27dc03d855105f37aebe9abac62265ea45993121cf7b31
! https://www.virustotal.com/gui/url/235683db58069cf98a6e1aa5719dd5cb941d669225f828b875f21d54dd3ad1c6
! https://www.virustotal.com/gui/url/ca2d5df746dc848767d695b04a59af02042fd44ac1829daa4df2da6acdf9834e
/^https?:\/\/([a-z]{4,}\.)?support-\d{1,2}\.ru\//$doc,to=ru

! labanquepostale
||group-postban.firebaseapp.com^$all,to=~labanquepostale.fr
||oasisministries.com/fr/postale/$all,to=~labanquepostale.fr
! https://www.virustotal.com/gui/url/998365385e6077a4903db356ff23917dc302baf8850fe7a5aab7d48b9f14f65d
||lidarusa.com/*/Bpostale2022/$all,to=~labanquepostale.fr
! https://www.virustotal.com/gui/url/e6ac5831557ccbbfd3de207e19710292f62d33b19b6ffe8ad275844dc0cc54dc
||plesk.page/*--_--$doc,to=~labanquepostale.fr
! https://www.virustotal.com/gui/url/9c2f302d6b000107ca771ce68c35e4c1c7aa6afb6e00a17b28417c515aaab75a
||vantechdns.com/bpnew/$doc,to=~labanquepostale.fr
! https://urldna.io/scan/6746aa4330c5ac705f5b6e7d
! https://www.virustotal.com/gui/url/7c2be5f501582239a5f1b8015617fbcf2fde2a5f3d09b91798c59d69ae07f269
||monamedia.net/CerticodePlus/DSP2/$doc,to=~labanquepostale.fr

! adobe
||adobecloud5xpo.yolasite.com^$all,to=~adobe.com
! https://www.virustotal.com/gui/url/a952ec269dd32deeb54f19f9b0b1f70d4e1cd72a176c1adc02dbdeab37eb0024
||socalthesyndicate.com/*/adobefud/$all,to=~adobe.com
! https://www.virustotal.com/gui/url/770ffdec12527b6af696bf4a7dde6fcaa484544ef932c438964f013b4a7c673f
||pub-*.r2.dev/adobe2024.html^$doc,to=~adobe.com
! https://www.virustotal.com/gui/url/d894e00a04a1372908b00bd1e710a5297e9a1436f6ec198baca25e9a5789f08e
||adobepd*.glitch.me^$doc,to=~adobe.com
! https://www.virustotal.com/gui/url/6294a9f79f81d7d9ebdcaa85273789747ee60201d9731b89a608346631408b5b
||doc*-order*adobe.glitch.me^$doc,to=glitch.me
||glitch.me/adobe-auto*.html^$doc
! https://www.virustotal.com/gui/url/e6663516cf34ff162f6c4a5d049c365ee56ab737978fd325a29088850eaa8b0e
||facture-free.com/Adobeverapdf/$all
! https://urldna.io/scan/674558fa3f64e80bf440d485
! https://www.virustotal.com/gui/url/9da22832e59d2b108d0ad6787ced43fe6cb0568e8818eaa504bfb7f73cfc7e2c
||mytemp.website/safetyfileaccess.htm^$doc

! gazprom
! https://www.virustotal.com/gui/url/48c374656c0dd133e6f922e4d8d73c919758a7c7fc68edf74bd91e58f721cd5b
/^https:\/\/[a-z0-9]{5,15}\.shop\/l(?:\/ru\/prelands)?\/gaz\//$1p,strict1p,match-case,to=shop
/^https:\/\/[a-z0-9]{5,15}\.shop\/uniq$/$xhr,1p,strict1p,match-case,method=get,to=shop
/^https:\/\/[a-z0-9]{5,15}\.shop\/lead$/$doc,1p,strict1p,match-case,method=post,to=shop
||c2bm9.shop^$all,to=~gazprom.ru
||cz4sb.shop^$all,to=~gazprom.ru
||pe4hk.shop^$all,to=~gazprom.ru
||g1vm6.shop^$all,to=~gazprom.ru

! netflix
||vstergioul.sites.sch.gr^$all,to=~netflix.com
||netflix.avdhoothadke.com^$all,to=~netflix.com
||waterdamagehomeinsuranceclaims.com^$all,to=~netflix.com
! https://urldna.io/scan/6675f810a0a139921a350afd
! https://www.virustotal.com/gui/url/9377fb4aca4525f2725505be1fa956898fe427deb060f273f48ed5f7fe05684b
||mybluehost.me/*/netflix/net/login.php$doc
! https://www.virustotal.com/gui/url/f4d836eca8bb2ce50a96dac7d031502d47c0a6ce85af040b911bf9883fbe157a
||mybluehost.me/watch/a/flix/$doc
! https://www.virustotal.com/gui/url/2dbe6c816822038f39d8d15d47d8bda7ec6f1ae753e2437d3b184b258e17cb7b
||ija.xwi.mybluehost.me^$all
||mybluehost.me/ntcz/$doc
! https://urldna.io/scan/66789b18c766226ae8d6e3ee
! https://www.virustotal.com/gui/url/30bc6d0ab3c42c34c0317e50e0b24db16a8996394bb39f6c959464bc4557fbb3
||floridavacationrentalsbyowners.com/*/Info/page_settings/account.php^$all
! https://www.virustotal.com/gui/url/d45b4424eb572378e0f5546d86502ac626c12404c5b2169e60088d1be6433031
||loginnetflixleiojfioje.blogspot.$all
! https://www.virustotal.com/gui/url/84ac274bbdbd4a67fe10e9bcb47e0f0d64e576888be06536b10d38b049acc2df
||xsph.ru/*/netfi2k/$doc
! https://www.virustotal.com/gui/url/14e936aa825143107ba0c568bab09fa7bcd89e4051ed8530d72808376875fdac
||bulksms.services/*/NetFlxinc/$doc
||bulksms.services/NetFxs/$all
! https://www.virustotal.com/gui/url/d6e9c698c28752894d1dc11a3b4cc9b0ba64976dbec9580abadbf588df977de1
||cpanel12wh.bkk1.cloud.z.com^$all
! https://www.virustotal.com/gui/url/4813b68055aa2c9808ac33189800add6be4989a96fd2266d0226384cdcb1aa94
||codeanyapp.com/NTFLX/$doc

! allegro
||allegrostore.cc^$all
||allegrostu.com^$all
||allegrocolombia.com^$all
||allegrocns.com^$all
||allegro-reinigung.de^$all
||chn-allegroshopac.one^$all
! https://www.virustotal.com/gui/url/86713b42ead067bb3d7f886acc11fd60a254ce8f744258d2ff2e01c0702b620d
/^https:\/\/allegro[a-z]{2,}\.shop\//$doc,to=shop
||allegroshop.shop^$all
||allegrocn.shop^$all
! https://www.virustotal.com/gui/url/9ea5ef839fa90f4ef448d5c9e1c4bad2af1028b88aa740f8deb02c34f42af8df
/^https:\/\/allegro-\d{3,4}\.com\//$doc,to=com
! https://www.virustotal.com/gui/url/543264167d2f97257f37e2cb9ae47e5e66fd8016b22bd0382163b4e589103eea
||allegrolokalnie.pl-$doc
||allegrolokalnie.*.shop^$doc

! rackspace
||racks.pages.dev^$all,to=~rackspace.com
! https://infosec.exchange/@urldna/112506923054085191
||rackweb-----support*.weebly.com^$all,to=~rackspace.com

! dana
||danakagetrsm.vercel.app^$all,to=~dana.id
||layanan-app.com^$all,to=~dana.id
||dana-indone*.id^$doc,to=my.id|web.id|~dana.id
! biz.id
-dna-log-*.biz.id^$doc,to=biz.id|~dana.id
! my.id
||pemesanan*.glowz.my.id^$doc,to=~dana.id
! https://www.virustotal.com/gui/url/c48b20f8825ce00c8ab0ad828ccbc3a587013eccd08f2ce7c45ec4f66e73cc7d
||claiim-hadiahh-danax-$all,to=~dana.id

! orange.fr
||orange53.yolasite.com^$all,to=~orange.fr
||dev-7614646544.pantheonsite.io^$all,to=~orange.fr
||smsmmsernorepls.wixsite.com^$all,to=~orange.fr
||orange234.wixsite.com^$all,to=~orange.fr
||mail.smartnetcom.ro^$all,to=~orange.fr
||exbtengineers.com/o/$all,to=~orange.fr
! https://infosec.exchange/@urldna/112456905938157006
||servicemailorange25.wixsite.com^$all,to=~orange.fr
! https://infosec.exchange/@urldna/112467287033433289
||assistancesosh.wixsite.com^$all,to=~orange.fr
! https://www.virustotal.com/gui/url/a667c0159708b76fce759d1b9f8230d44c1db8bbff82ea62e170df08f5673d4b
/or/.espace-.client/(;authentication.htm^$doc,to=~orange.fr
! https://www.virustotal.com/gui/url/f7a5efd0b25ad492328edf9bff729a32fafc839554c6b5de2bb0e64307667534
||tw1.ru/Orange/$doc,to=~orange.fr
! https://www.virustotal.com/gui/url/be4cef199b445a60996045837cf7867666318e2b547fdb5f76d3b20aee91f2a0
||messagerie*.godaddysites.com^$doc
||messagerie*.wixsite.com^$doc
||messagerie*.yolasite.com^$doc
! https://www.virustotal.com/gui/url/798cb44c90d1ecc992f9ec37fafa451cddbdbd1a030284aff63c923a9394809e
||app.vision6.com/em/message/email/$all,to=~orange.fr
! https://urldna.io/scan/67380cf0de915d9ef3ea17d5
! https://www.virustotal.com/gui/url/c98c0abbc182c6dc7549c9c7d423a2654dba1cee27b9a4cadfbb785415abcd38
||svropeauthentificatid.run.place^$all,to=~orange.fr

! tiktok shop
||tiktikshopvn.com^$doc

! amazon
||amazon-*.shop^$doc
||amazon-shopping.shop^$all
||daroznel.com^$all
||amazon8898.com^$all
||dalabuso.com^$all
||gimkax.com^$all
||dalobatter.com^$all
||skae3299.top^$all
||signup-amazon.com^$all
||ecommrce-web-amazon.netlify.app^$all
||etisalat-amazonprime.com^$all,to=~etisalat.ae
! https://infosec.exchange/@urldna/112483094476417201
||mybluehost.me/wp-admin/amz/$doc
! https://www.virustotal.com/gui/url/b495f4257b9f677ea7ec4bfb43469c70a38323aafe741885e43c2b1ca584ba6f
||mytemp.website/amazon-prime-video-com-br/$doc
! https://www.virustotal.com/gui/url/86279ddc548eead6c227e6d493e9cfcf4af0b28ccceae50c2f6420542a8d6fe7
||adswip.com^$all
! https://www.virustotal.com/gui/url/82fb19edb0616c29416b6c92f11d365c490ca600b06af0304a56b76db12c083b
||amserva.com^$all
! https://www.virustotal.com/gui/url/53009a72bcf3a35d6ae8ba145928d964252e7f83e29ab4f80d1165bb9af1831b
||cs-portalintranet.com/pf/$doc
! https://www.virustotal.com/gui/url/58b59187b6cb3330865debc22a67fda72a3fac9ea1c577fc62c9d336eda07d4b
||amazonway.co^$all
! https://urldna.io/scan/6730b06c22a140cea757d590
! https://www.virustotal.com/gui/url/d8c96426d3a4323f10d8f051e3af8f1a7d60eecb91ab9b1982f45b611252f3b1
||sites.google.com/mwhite55.appquestss.com/$doc
! https://urldna.io/scan/67380f4d415af7ad29e182e7
! https://www.virustotal.com/gui/url/cb24d223760a74a13a95eb93802ac2dba5377f99a40fdb4110ecff3737473f5d
||orders-processed.com^$all

! ebay
||vilbuy.com^$all
||epayu.cc^$all
||ebayonstores.com^$all
||shop-line.vip^$all
||939l.xyz^$all
||ebnays.xyz^$all
/^https:\/\/(?:seller\.)?ebay-[a-z]{8,15}\.com\//$doc,to=com
! https://www.reddit.com/r/Scams/comments/1cux08b/whatsapp_telegram_instagram_work_from_home_posts/
||51eabay.com^$all
! https://infosec.exchange/@urldna/112476252310873324
||135buy.com^$all
! https://www.virustotal.com/gui/url/8b2c822dc9c9130367597b14aa848cfacdd6022ad474c0af8c244856e30ee6ae
||ebaydw.^$all,to=ebaydw.cc|ebaydw.com
! https://www.virustotal.com/gui/url/9f1eac2069c48d297e1f284ede655f9d7b8f4d4b5aec91d934147db7d9ec4e16
||pages.dev/errors/validateCaptcha^$doc

! alibaba
||hologramid.cn^$all,to=~alibaba.com
||jybelinda.com^$all,to=~alibaba.com
! https://www.virustotal.com/gui/url/1649712cd78f28d5660fbf0d0de7d475f8cd51105caac04b3b521ecd850234a1
||vetsinthecity.me/*/Alibaba/$doc,to=~alibaba.com
! https://urldna.io/scan/6734c98f32353732f75caebe
! https://www.virustotal.com/gui/url/8f2575c66072c227f8e1a60a422e5ff861903bb97f28fb5e3229fa3ec204ae7a
||sanpelmaquinas.com.br^$all,to=~alibaba.com
! https://urldna.io/scan/673d3e2485f8a9a88ee40359
! https://www.virustotal.com/gui/url/9e3d8dd56e7c3938332d2f8e74f8a9f31904fcfa1f452772ad4ce91b36d1b28f
||molekinha.com.br/*/alibaba.com/$doc,to=~alibaba.com
/alibaba.com/passport.alibaba.com/*$doc,to=~alibaba.com

! aliexpress
! https://www.virustotal.com/gui/url/8348d50aefd96888490c11d2a155b0bae9299a51163b55463b2fd2bf709ef2f2
||airpsite.club^$all,to=~aliexpress.com

! AT&T
||wixsite.com/att-support/$doc
||diwapa3051.wixsite.com^$all
||idhnochalter.wixsite.com^$all
||cajewar736.wixsite.com^$all
||loginaccount6.wixsite.com^$all
||ruthah9.wixsite.com^$all
||iirrrrrrii.wixsite.com^$all
||attstsv.weebly.com^$all
||newversionattmailapps.weebly.com^$all
||ewueuweudsjdjsdjjd.weeblysite.com^$all
||maiil-myatt.weeblysite.com^$all
||rtm-att.directly.com^$all
||attvip.mx^$all
||olive121407.studio.site^$all
||at-t-admin.daftpage.com^$all
||keepo.io/loginatt/$all
||dlhessell.wixsite.com/att-support/$all
||bio.site/atttt^$all
! https://www.virustotal.com/gui/url/b78d7c493e891ae1dbc5b9ea30d22c50792b6d5a55104e33f5ba37e78ab658a1
||dones9.wixsite.com^$all
! https://infosec.exchange/@urldna/112465871317727388
||alisongaudino992.wixsite.com^$all
! https://infosec.exchange/@urldna/112564843620859575
||deenveerww.wixsite.com^$all
! https://urldna.io/scan/6693a1b55395ffdd02f65177
! https://www.virustotal.com/gui/url/b8064a06e570bfccdd2a896b02734c2282e5e0d51ebd0b6324c694d87b57b7e8
||att5h6.wixsite.com^$all
! https://urldna.io/scan/673ea1444fe8fdf8db4e9294
! https://www.virustotal.com/gui/url/f94b29d8e5114772c3ac5717d625c57295232b759022b97170cb21d1c51cae92
||attonlineservice*.wixstudio.com^$all
! https://urldna.io/scan/669ae204eaef0a7aabce0e9b
! https://www.virustotal.com/gui/url/1011eb8688635267bf06cc2b5783d0a01cbeafb99dbf483c2101e4375061d56e
||wixstudio.io/mysiteattmail940940^$doc
! https://www.virustotal.com/gui/url/8b95f575d0f421cbd9710ad5047527b048ca3bc2cedc6ba85718832f2dcd5438
||f.digital-*.com/igit/$doc
! https://urldna.io/scan/66f3c4afbc383e66ff108ce9
! https://www.virustotal.com/gui/url/6f610568e5af6a3841ade330487906294e9895cd1a17dd0ff428c2a6258ae1bc
||currentlyatt*.weebly.com^$all
! https://www.virustotal.com/gui/url/2ec68ebdc97db155bd29a90d948a1223e9514bb911e91c9e512436ccffabd7e7
||currentlymail*.weebly.com^$all
! https://urldna.io/scan/678bdf428f2d6f01e81e41e3
! https://www.virustotal.com/gui/url/a4fb0e7b9d9d645300b649e9ad11d36bc2040e0e29fe6e124f8188f241e8bd71
||att-currently-*.weeblysite.com^$all
! https://urldna.io/scan/673e8ad4962aac12d27309a9
! https://www.virustotal.com/gui/url/79485aada1c4e81b7f9282623813436167f110cd09ab9d11b65b6f18133f6b89
||dropbox.com/*/AT-T-YAHOO-MAIL.paper^$doc
! https://www.virustotal.com/gui/url/41c77b844c6c74eae22d614b7f9c6f3ced3fe11f9603a41731d02fc3bb26fc77
||2025*maintenance.weebly.com^$doc
! https://urldna.io/scan/67a0f6a986906883adfc8aaa
! https://www.virustotal.com/gui/url/ff993f76a74c8f64c70e9aaa32583fc2bedca6ca11962bce1408e650f7e26490
||amazonaws.com/anydo-user-uploads/*_ATT_VoiceMail.html^$doc

! BT
||homelogginbbt.weebly.com^$all,to=~bt.com
||loogginhomebtcom.weebly.com^$all,to=~bt.com
||callonjehovandprayinthemorning.weebly.com^$all,to=~bt.com
||boardband.univer.se^$all,to=~bt.com
! https://www.virustotal.com/gui/url/81f393064c4fd485f654fa3cacabf8ee89291ac445ff6e69771d8be4b3119634
||telegra.ph/British-Telecommunication-08-22^$all,to=~bt.com
! https://urldna.io/scan/66e850137f6f86bb44b4f849
! https://www.virustotal.com/gui/url/09601a67a365df2ad5eb12c9e6d89aaf22f6727c7be2c5fd493b525de9f75bf0
||telegra.ph/BT-Business-Communications-$all,to=~bt.com
! https://urldna.io/scan/674538ddb8e5f82c396b8d03
! https://www.virustotal.com/gui/url/a59a486bfbd78ca7917ac33413858ec598cf1375477b77c71d85dbe73e041232
||dazzl.ink/btupdate/$all,to=~bt.com

! gov phishing site
! https://www.virustotal.com/gui/url/19c07d4e7c627a1f83900c509ce73b828247b3bb932713383e5569e7e2671882
! https://www.virustotal.com/gui/url/3184ee7bcf4b3d443307b36cf33e2c1e078747f6618534fc944442ae1b323e4c
||pttgov*.top^$doc,to=top|~ptt.gov.tr
! https://www.virustotal.com/gui/url/3a1d96a6b5701a96f96d438792ee0fa48aaec7bbe65edadecafcb7af7ec75aa8
||irstaxrefunds.$doc,to=~irs.gov
! gov.vn
||thanhtrapcrt.online^$all,to=~thanhtra.gov.vn
||jetkingncsc.online^$all,to=~ncsc.gov.vn
! gov.it
! https://urldna.io/scan/6730eb2b26717399e42ee637
! https://www.virustotal.com/gui/url/2c605dc7e821311c7148654b01c5d07dfc8e46eedd6b76c08e78204b7953258e
||agenziaentrateriscossione.com^$all,to=~agenziaentrateriscossione.gov.it
! gov.gr
! https://urldna.io/scan/6729f08c603012bf64fdc18b
||aitimaforou.web.app^$all,to=~gov.gr

! gov.au
||mygovaus-$doc,to=~my.gov.au
||seeproc.com.br^$all,to=~my.gov.au

! gov.uk
||liveflo.qxlva.io^$all,to=~gov.uk
||student-finance-auth.firebaseapp.com^$all,to=~gov.uk
||casadosvidrosmt.com.br/wp-admin/csii/$all,to=~gov.uk
! https://www.virustotal.com/gui/url/ebc39394f30c18e781a2c98f035fa14897aba199d104977f4978e0af200df544
||smartaromas.com/income-individual_service_tax-gg-check-hm/$all,to=~gov.uk
! https://www.virustotal.com/gui/url/df772a3d132acedfd317846a7d291c5040650a99f43db6a706b7cc5155b00d50
||insolvency-development.co.uk^$all,to=~gov.uk

! impots.gouv.fr
! https://infosec.exchange/@urldna/112442514480319184
! https://www.virustotal.com/gui/url/43dc3482b86f463550c0a163836c4c622e4ec801184ba76f49aca03cf7fb5128
||mybluehost.me/*/impo/$doc,to=~impots.gouv.fr
||isz.bqv.mybluehost.me^$doc,to=~impots.gouv.fr
! https://urldna.io/scan/6725d792a8bda5a0f5926ac5
! https://www.virustotal.com/gui/url/2ed7817356b844c59b8767582f7b7e484b74f17654e4f3e18ed158db60060262
||polufredsoa.2mydns.net^$all,to=~impots.gouv.fr
||2mydns.net/fr-impot-gouv^$doc,to=~impots.gouv.fr
! https://urldna.io/scan/6734c7a19ee995c0b18b4fdc
! https://www.virustotal.com/gui/url/6114364912105935ec4264d07368ae3142c6b44dd9ebd68ced4545de317ad44f
/\.temporary\.site\/service\/[a-f0-9]{32}\//$doc,to=temporary.site|~impots.gouv.fr
||kkg.yaf.temporary.site^$doc,to=~impots.gouv.fr

! amendes.gouv.fr
||antai-gouv-fr.troliga.sk^$all,to=~amendes.gouv.fr
! https://urldna.io/scan/66a17973cf69aaa3408529d8
! https://www.virustotal.com/gui/url/59f573968e59b6b2f4f09ca26a81608992b83aaef9e7200b29529e10d7641d24
||mybluehost.me/wp-content/12/*.php^$doc,to=~amendes.gouv.fr
! https://www.virustotal.com/gui/url/7418298915cf7e1e60f2fdb5aa9f57ee419434420a10e8e39c92e1bf84429e74
! https://www.virustotal.com/gui/url/dc16d829559d0f800d5c8310b40196e594a84f9d635a75c2bf02a41adf85ded5
||mybluehost.me/*/amendes.org/$doc,to=~amendes.gouv.fr
||amz.boy.mybluehost.me^$doc,to=~amendes.gouv.fr
||vmb.wvs.mybluehost.me^$doc,to=~amendes.gouv.fr
! https://www.virustotal.com/gui/url/50fedc84296b3183d3a4c9cfc17c00b37257e8d04d2f03925863d9ed42aa5a83
||mybluehost.me/*/amendes2024org/$doc,to=~amendes.gouv.fr
||kby.oqp.mybluehost.me^$doc,to=~amendes.gouv.fr
! https://urldna.io/scan/6734c56517aed83575750f39
! https://www.virustotal.com/gui/url/817cb23e0959412ed1989ad6ec9ba27b84e09002d8dd0b32477ce39b84ef7b72
||vdv.oqp.mybluehost.me^$doc,to=~amendes.gouv.fr
||mybluehost.me/*/3dsec.php^$doc,to=~amendes.gouv.fr
! https://www.virustotal.com/gui/url/64d74ef6d37b2f855960f77fd99ee0ca35c86ea86f6f0a29818c6f2c9a98df21
||wcomhost.com/amendes-gouv/$doc,to=~amendes.gouv.fr
! https://urldna.io/scan/66cddfb7de9bc8f607153bad
! https://www.virustotal.com/gui/url/8ca3d39fd9aeabe8f038092a8eb013fb5e12c8f0209b728cb7851fb1ce75ef26
||wcomhost.com/impots-gouv/$doc,to=~impots.gouv.fr
||impotsgouv.*.wcomhost.com^$doc,to=~impots.gouv.fr
! https://urldna.io/scan/6690fec498efb38aa8b5fff8
! https://www.virustotal.com/gui/url/cf94732269e10553a3e945c3a3a6d96e1975f5bffd600d475248ba54f099bdf0
! https://www.virustotal.com/gui/url/bb37ef477fce261197eddc9c970d8cab9c3e9f2e33578752d7c29e9eb227af9f
! https://urldna.io/scan/66a222314305e9e5c9e85eff
! https://www.virustotal.com/gui/url/65d14490d3b1373b618e79ad0f10356a30d7d5be39a211a0c6a107131b6a8967
! https://www.virustotal.com/gui/url/d719ca5cfa674a89ed897f82ba6c5623a51768534823493f6cca6b86885f118e
! https://www.virustotal.com/gui/url/caebb8395e5ee3e8c414f7a4e19182a5be47693ecf9b344db9df543967eb1ba9
! https://www.virustotal.com/gui/url/39bf66d7df4004585841046986e24c782f3554092b44f1792a7e701dc1823bf0
/am/*.php^$doc,to=arubabusiness.it|mybluehost.me|serv00.net|wcomhost.com|~amendes.gouv.fr
! https://www.virustotal.com/gui/url/3970b40a9d9fcb5813cd3229e940e2df14c3f0e2b27db104085845f6bc6ced4a
! https://www.virustotal.com/gui/url/5dd0e94a8ea4348bc9dddc26ae0bb40f2710bb2b885d6ac2876303549ed6a211
||fi/a/Amendes/*.php^$doc,to=fi|~amendes.gouv.fr
||fi/part/Amendes/*.php^$doc,to=fi|~amendes.gouv.fr
! https://urldna.io/scan/66a41c9241da912d9de2fd1b
! https://www.virustotal.com/gui/url/a635704554faa14de0fa04eb1300f1b5c952c5b365a879c425102282f9df5139
||odeal.fi/fr/AMA/*.php^$doc,to=~amendes.gouv.fr
! https://www.virustotal.com/gui/url/ef9755fcb211a668986b9afc5187577c92fb8c8bf62057bf9d0b59333827a35a
||odeal.fi/amndes/*.php^$doc,to=~amendes.gouv.fr
! https://urldna.io/scan/66a2cb049156f76f336510fb
! https://www.virustotal.com/gui/url/ac3f9866a6710a1a7689ef3a1ae99fa1a2841e53bb0ae4e40bb4356b2a049c73
||askozvar.sk/*/amendesgouv/$all,to=~amendes.gouv.fr
! https://www.virustotal.com/gui/url/8b7f0ac19de9cbc97e619c01b07fe153b43df2e1863d9f9e8c3fd52fba0d8b01
||codeanyapp.com/amendes/$doc,to=~amendes.gouv.fr
! https://www.virustotal.com/gui/url/e3431725fba0f286c2f30e75b80573dd5536c45f40be41764a2c3f6780e95f9d?nocache=1
/12/infospage.php^$doc,to=~amendes.gouv.fr
/12/paiement.php^$doc,to=~amendes.gouv.fr
/12/3dsece.php^$doc,to=~amendes.gouv.fr
/12/3dsec.php^$doc,to=~amendes.gouv.fr
! https://urldna.io/scan/670d775881ebbf691d0aadbf
! https://www.virustotal.com/gui/url/f98d0dfa8176f89c84445e926156cb9c7f2fe999a1d3906513efeda1db663f85
||iglawfirm.com/services/antai-fr/$doc,to=~amendes.gouv.fr
! https://www.virustotal.com/gui/url/3cd91b0073bdde2b905701c3c79bd0fbd6f9edb2702349c9cf05851ae33aca69
/\.codeanyapp\.com\/.+\/(?:3dsece?|infospage|paiement)\.php\b/$doc,match-case,to=codeanyapp.com|~amendes.gouv.fr
||codeanyapp.com/pr/rue/$doc,to=~amendes.gouv.fr
! https://www.virustotal.com/gui/url/1ac3468cad26ad886a17a86d8b11cc3f50b8983657d8deaac3a4e1020467c1fe
||amandes*.serv00.net^$doc,to=~amendes.gouv.fr

! id.me
||internal-checker.com^$all,to=~id.me
! https://www.virustotal.com/gui/url/f60f6428c1a06204a7d721da7a65d1ae350f341d996bc47d8a2aab7371d172a7
||banque-online.com^$all,to=~id.me

! bank
||chamsocthekhachhang-$doc,to=~edu|~gov|~edu.vn|~gov.vn
||uudaikhachhangthe-$doc,to=~edu|~gov|~edu.vn|~gov.vn
||vdbank.com.vn^$all,to=~vdb.gov.vn
||conveyancingportal.com^$all
||bmoreferral.com^$all,to=~bmo.com
||personas.devbam.com^$all,to=~bam.com.gt
||negociebra.com.br^$all,to=~banco.bradesco
||wizardpayroll.com.ar^$all,to=~hsbc.com
||spareb1.com^$all,to=~sparebank1.no
||amigosdelasfinanzas.com^$all,to=~bancocajasocial.com
||anz.brandkit.io^$all,to=~anz.co.nz
||baovietin.top^$all,to=~baoviet.com.vn
||pncexc.com^$all,to=~pnc.com
||moonlightproshop.com^$all,to=~volksbank.at
||nbtbank.architect-cert.fiservapps.com^$all,to=~nbtbank.com
||douroweb.eu^$all,to=~bankofamerica.com
||gaoyinjiao.com^$all,to=~jabank.jp
||nyfinance.ru^$all,to=~nykredit.com
||wester-union-u.vercel.app^$all,to=~westernunion.com
/^https:\/\/tpbank\.[-a-z0-9]{5,}\.[a-z]{3}(?:\.vn)?\//$doc,to=~edu|~gov|~gov.vn|~tpb.vn
! https://www.virustotal.com/gui/url/c7b5088a8bb8a08b8df81c311e88524e9c7c5e5db8e8482973950f2f337aa021
||ewp.live/*/pages/region.php^$doc
! https://urldna.io/scan/668d0a422e28bacaabda96ab
! https://www.virustotal.com/gui/url/2edf261ddd989aea3a11b6e92775153dcdb8b3e4380b834b416b2bf9ab3b45a1
||glitch.me/*/nationwide^$doc,to=~nationwide.co.uk
! https://www.virustotal.com/gui/url/90fc0532ce482014c579919d1b23d03b0d77fb7b31f3a313e7f17ed9886718f3
||mybluehost.me/ameli/$doc,to=~ameli.fr
! https://www.virustotal.com/gui/url/c69b4c8bd6c92857d6e1e40f48ef8830c19d1da98e2c1f16ed7867c58d4b2f63
/28kxhS^$doc,to=online|shop|top|~sberbank.ru
! https://www.virustotal.com/gui/url/f8aff688f04724ec969bccbc5c87fab27425e949590f94006b8ad5ffc8280353
||xyz/akbank/$doc,to=xyz|~akbank.com
! https://www.virustotal.com/gui/url/47030aa07787d8246511284f00cf6a2fba1bea6974f8227f0828794b7b8493f5
/views/choice/*/start.php^$doc
! https://urldna.io/scan/66a7f011c6cd731d9e585383
! https://www.virustotal.com/gui/url/3e510ffb6fcc82ccf26a1b1d5581e6b2247314d93cd14e6d21be48ed104ee42e
||skylarkspb.ru/raiffeisentwint/$all,to=~raiffeisen.ch
! https://www.virustotal.com/gui/url/2f8145946986b2382bd0c7f6e7664d86aff0cea1d59b49fdf0e99b361bd4ba14
||hclsoftware.cloud/*/tdbanknotes^$all,to=~td.com
! https://www.virustotal.com/gui/url/6196dc974de02e22d5cae34d2cabd827a4d6260aaefd1f9f8ce5dd82d0d9ad2e
/wp-content/ntww/natwest3/*.php^$doc,to=~natwest.com
! https://www.virustotal.com/gui/url/140f7ba02b72c57a8ee92b662b49d413ee5475aac61b9c766b0e099579aa5ef1
^novobanco.pt-canais-digital/$doc,to=~novobanco.pt
^novobanco.pt-canais-digital-$doc,to=~novobanco.pt
! https://www.virustotal.com/gui/url/008e652bdc8ca70060bec73e3781cb1c9c5e43e88bb672eacb57301c6423e810
||codeanyapp.com/Particuliers/$doc,to=~particuliers.sg.fr
||espace-documents-authsec-appmovil.codeanyapp.com^$doc,to=~particuliers.sg.fr
! https://urldna.io/scan/66e03269255cb97803a40a75
! https://www.virustotal.com/gui/url/185e061423dca668ef141b4634bc6860980896d620094b46835d8170b771f00b
||ingresocancelacion.wixsite.com^$all,to=~bb.com.mx
||wixsite.com/foliobanbajio$doc,to=~bb.com.mx
! https://www.virustotal.com/gui/url/edf4998723800812cbe1bd7d49bed085753340593415067ccb6d8b9d94e0508d
||shahidulislamaurko.com^$all,to=~vr.de
! https://www.virustotal.com/gui/url/e003a1dd10861a22dc9a3216294de24775abc73c8ee758cdb1a1ca0f0faaf3a4
||sunnysani.com/lb/$all,to=~landbank.com
! https://urldna.io/scan/674558e03f64e80bf440d47f
! https://www.virustotal.com/gui/url/0e5629f823bd890a8d6a9df1ea35509febb5343e719a4b02bfe98353de7aa76c
||caixa-login-banco-home-login-auth-h.codeanyapp.com^$all,to=~caixabank.es
||caixa-*.codeanyapp.com^$doc,to=~caixabank.es
||codeanyapp.com/Caixanow/$doc,to=~caixabank.es

! nickel.eu
! https://infosec.exchange/@urldna/112496070441371886
||mybluehost.me/service/*/nkl-log.php$doc,to=~nickel.eu
! https://urldna.io/scan/67590eb30fdec9bca3a30d99
! https://www.virustotal.com/gui/url/618858f254ee0840cdab44ad767602a6621189ac71473fb580d6bab953d00228
||sviluppo.host/dl/NickelTru/$doc,to=~nickel.eu
||biblio.sviluppo.host^$doc

! dkb.de
! https://urldna.io/scan/66fa726d7fe4a642f943054f
! https://www.virustotal.com/gui/url/962dc2242a94ea0e5cb302755601e2f9a934fd9f35899dbadd3a6bfd40e17132
||www-winbank-lfremhmida*.codeanyapp.com^$doc,to=~dkb.de
||codeanyapp.com/*/DKB_new/$doc,to=~dkb.de
! https://urldna.io/scan/67541a576d7c656c306bc7bf
! https://www.virustotal.com/gui/url/4f1a30efcd152f58325efa41a866de58560fb7a144c1445b722681b8d64dbea8
||laurenmjackson.serv00.net^$doc,to=~dkb.de
||serv00.net/*/dkb/$doc,to=~dkb.de

! sparkasse.de
||sparkasse-safety.de^$all,to=~sparkasse.de
! https://infosec.exchange/@urldna/112451361935970416
||sparkasse-oberhessen.info^$all,to=~sparkasse.de

! itau.com.br
||itaconsorciodigital.com.br^$all,to=~itau.com.br
! https://urldna.io/scan/673be7fb998a98c2667f36fb
! https://www.virustotal.com/gui/url/1df98706f4dafb0ed0aa3d809632461ced3ae87efb1978718f9656fd7e743206
||supporthives.com/public/ita/$all,to=~itau.com.br

! hype.it
! https://urldna.io/scan/66f56c794bd3fd633b19524a
||freewebhostmost.com/DARKSIDE/hype/$doc,to=~hype.it
! https://urldna.io/scan/67331affb9d01b2786679042
! https://www.virustotal.com/gui/url/4dbc8a3fd3e95c19ceef8338fcd5a683250f09b9c9ac781ff765b75ff280580d
||td-online-carta.codeanyapp.com^$all,to=~hype.it
||codeanyapp.com/hype/$doc,to=~hype.it

! bancolombia
||e-cmv.ph^$all,to=~grupobancolombia.com
||bancolombiaapp.glitch.me^$all,to=~grupobancolombia.com
! https://urldna.io/scan/678d137a9c8cb22ff2083a59
! https://www.virustotal.com/gui/url/12684af259fcf151a47c96aaace7682719914c590ee19849efd138a084e1ae73
||cancelaciondeseguros-*.azurewebsites.net^$doc,to=~grupobancolombia.com

! Lloyds Bank
||lloyd-group.com^$all,to=~lloydsbank.com
! https://www.virustotal.com/gui/url/2c42bd7b61c06bc03e1745f170382dd5aa057fc2beda209a5aefa712bd1e6630
||lbg-calcs.vercel.app^$all,to=~lloydsbank.com

! hypovereinsbank.de
||gohvb-d634f.web.app^$all,to=~hypovereinsbank.de
||gohvb-*.web.app^$doc,to=~hypovereinsbank.de

! mbbank
/^https:\/\/mbdk\d+\.com\//$doc,to=com|~mbbank.com.vn

! bbva
||bbvaar.zeabur.app^$all,to=~bbva.com
! https://www.virustotal.com/gui/url/746e7d7310e64b2ecc19a2d26bc053c2a9c54903a53363f05d090a9e490b0652
||programajourney.com^$all,to=~bbva.pt

! https://www.virustotal.com/gui/url/1125c38e9f48cabcb0214a0de3c102d760850bf01d4b557ee65c023fa9b40188
||mybluehost.me/meke/cc/clients/$doc,to=~targobank.de

! bancodevenezuela.com
||bdvenlinea*.pages.dev^$doc,to=~bancodevenezuela.com
||bdvenlineaconfirmate.pages.dev^$all,to=~bancodevenezuela.com
||bdvenlinea-banvenez-beram.pages.dev^$all,to=~bancodevenezuela.com

! shinhan
||tinchapshinhan.online^$all,to=~shinhan.com.vn
||sites.google.com/view/shinhan-fiinance/^$all,to=~shinhan.com.vn

! americanexpress
||americanexpressempresas.com^$all,to=~americanexpress.com
! https://www.virustotal.com/gui/url/f76b0bf281683cdb6bbc97603b3c69dc096ec72b5a41125b61dab3c8e22adfc0
||r2.dev/blobamexbsatt.html^$doc,to=~americanexpress.com
! https://www.virustotal.com/gui/url/7ea630410a2e6836c0f0396f0dc4c7295cb0bcb3e5c956605ef42565c4e9b167
||amxprd.com^$doc,to=~americanexpress.com
! https://www.virustotal.com/gui/url/48406e8b50ea65b8acf74f33d88d25cac7fb1f5b0577db3dcc91401de629987d
/wp-admin/user/americanexpresss-com-login-true-verify.$doc,to=~americanexpress.com

! santander
||recompensaszurichsantander.com.mx^$all
||santander.*.fino.digital^$all
||santander.cf.sandbox.motrada.ch^$all,to=~santanderbank.com|~santander.co.uk
! https://urldna.io/scan/67375864415af7ad29e177f6
! https://www.virustotal.com/gui/url/4b0287034559c9ad4cb28be0e557d2e14b745e8f7e59bee9b57a45f46230c9c6
||santanderpod.*.co.uk^$all

! DHL
||dhl.*.potabox.com^$doc,to=~dhl.com
||dhl-event.app^$all
||dhexpress.weebly.com^$all
||ltlweight.trgr.me^$all
||dhlproductosyservicios.com^$all
||dhl-rpa-portal.infanion.com^$all
||sites.google.com/view/expressdhl^$all
||xn--d1aqfkf.xn--p1ai/bitrix/.../GlobalSources/$all
||app.farmaciadelmonestironline.com/SER/dnkdl/$all
||cricketbettingpro.com/home.html/autoload.html^$all
||itmustbetime.com/content/uploads/products/china/china/index.php^$all
! https://www.virustotal.com/gui/url/991fe449cae5b7f070cba12bf8b7ab0f9058c8d1a0c5857cee1f5f1ec775d1a8
||leatherqueen.shop^$all
! https://urldna.io/scan/66983ef62ca5c5af9410c6d6
! https://www.virustotal.com/gui/url/e894b4e45cf6086f3c110bb89db761073b96134cfb330d375e0170ea248a8cb4
! uat.dhl-express-ppd.infanion.com
||dhl-express-ppd.infanion.com^$all
! https://www.virustotal.com/gui/url/c40564d42e6b3d2cb9f3d9b2485c32e3446fb516d05ffd441d3c14be61027e97
||elementor.cloud/*/ENGHUY645/$doc,to=~dhl.com
! https://www.virustotal.com/gui/url/e6fde9752f33f20c2f5ff157816c2edc1c4f6de7c89103edd3ed05cca44d0d46
||mybluehost.me/*/phpmailer/src/dh/$doc,to=~dhl.com
||mtm.rnz.mybluehost.me^$doc,to=~dhl.com
! https://www.virustotal.com/gui/url/ef9755fcb211a668986b9afc5187577c92fb8c8bf62057bf9d0b59333827a35a
||mpinsureit.com^$doc,to=~dhl.com
! https://www.virustotal.com/gui/url/ef9755fcb211a668986b9afc5187577c92fb8c8bf62057bf9d0b59333827a35a
||goldsystem.com.br/amds/css/secure/dhlFR^$doc,to=~dhl.com
! https://urldna.io/scan/66b8baab2f59b21da15613c5
! https://www.virustotal.com/gui/url/bc113a7de909bb111ce2d933762fd686c2a0ac924aec049b4e320cee6dca583e
||elementor.cloud/*/ESDHL/$doc,to=~dhl.com
! https://www.virustotal.com/gui/url/b83b967ad9e06240e5bb34fe0fe20604b511c41b7a86902a19dcb4b1f3951bb3
/tracking/fV5EjH/*.php^$doc,to=~dhl.com
! https://www.virustotal.com/gui/url/8370f37d2cbdfe3d1dffb7c5c9a95341a447b725c177e85f66850aeb8b5b3544
! https://delivery-globaldhlauth.github.io/samedaydelivery/`
||delivery-globaldhlauth.github.io^$all
||github.io/samedaydelivery/$doc,to=~dhl.com
! https://www.virustotal.com/gui/url/a37864755cbf39bfac03577856042cde08fd23c91157aa2b5016d135177eeff8
||myjobdhl.earcu.com^$all
! https://urldna.io/scan/673d3de4d80447503bfc9372
! https://www.virustotal.com/gui/url/83f4006efa9dddfb7b6df6dda5a39e9e591906623eab4e0818b145fde7748bee
||cere.network/*-dhlshipmailchecker.shtml^$doc,to=~dhl.com
! https://www.virustotal.com/gui/url/78a9667c1b6380afdc50c5a0f20f2bd228ee2f6e354c8ea6e8acb0325236f6c2
||myjobdhl.earcu.com^$all

! whatsapp
||firavave.club^$all
! https://urldna.io/scan/66a0280430f40d4a2e1cdbfd
! https://www.virustotal.com/gui/url/dd581161abc02c436e7f1d3096ebc651b98bf4ff3eeea81cff8ba76b6b9ca277
||play.funfourmob.com^$all
! https://www.virustotal.com/gui/url/a342eef995ebb76a397c7b757f86eefd84229c5b64cb845b428e494066d90575
||fevertime.com/wasop/$all
! https://www.virustotal.com/gui/url/02a47f7abf79b9432d611eb4601015f554c548efad6cf7e9ebd64dd3d5cf8e88
||wathzapp.com^$all
! https://www.virustotal.com/gui/url/a4c7013f5435188514d6f397a43489fa24f2fb6d1c2ed224b7974b847f8a8a00
||wa-groupbebe.pages.dev^$all
||tg.sv/panggahokeee^$all

! instagram
||instogromv.com^$all
||fr-instagram.com^$all
||igleak.info^$all
||instagram.irancell-10g-free.rf.gd^$all
||businesslnstagram.zya.me^$all
! https://www.virustotal.com/gui/url/acc2a19b715277722ad875b89732cae77f0f223e3160792e197a54a85c3ad679
||instagram0639.blogspot.$doc

! facebook
||slimhealth.us^$all
||mait.inhhome.top^$all
||mail.pages.exchange-midasbuy.com^$all
||easy-way-system.sbs^$all
! /^https:\/\/[vw]ww-[a-z]?facebook[a-z]?([.-]com)?\.vn\//$doc,to=vn
||notificationbyfacebook.$doc
||notificationbyfacebook.firebaseapp.com^$all
||notificationbyfacebook.web.app^$all
||business-facebook-*.pages.dev^$all
||ads-verification-for-pay.vercel.app^$all
||business-manange.com^$all
||report.case-referency.com^$all
||facebook-guidelines.com^$all
||certify-issues-details-case.netlify.app^$all
||facebock-page-center.com^$all
||www-mfacebook.$doc
||www-facebooks.$doc
||www-facebook-$doc
||www-facebook.$doc
||vww-facebook.$doc
! https://urldna.io/scan/6730aa8524ba3300cc9e662b
||123456789login.weebly.com^$all
! https://infosec.exchange/@urldna/112560479201333529
||www-facebook-com.vn^$all
! https://urldna.io/scan/666037369f1ea64bf06cebf2
! https://www.virustotal.com/gui/url/668171c7e2792344e6f1258ad7c1ab14e94b6192dfa1a1e98fb798c938244caa
||vww-facebook.com.vn^$all
! https://www.virustotal.com/gui/url/381b8a23c755c95909382d1b4dc80bfd4e4c89b0f1c0e48ef626c16723ff88c1
||www-facebooks.com.vn^$all
! https://www.virustotal.com/gui/url/6213087609a2bfd4a2c285d35ebef2ce5a1e5b74ae61a556b8ed3711909a504f
||faceb00k.com.vn^$all
! https://www.virustotal.com/gui/url/4136e69c1844f4da9b6c8aeaa81579b3ec932df00e03615ca0c369666e18b23e
||mobile-facebook.com.vn^$all
! https://www.virustotal.com/gui/url/cec2b3b2d51dd750d71030c58ece4f3ae6f69e0b234d094f3fe19c591e2ab31f
||m-facebookk.com.vn^$all
! https://www.virustotal.com/gui/url/d18c16bd0ee1692c2f031e3d116f7017f53b71e3934e8fd975f5b1cfbb19303a
||mfacebookk.com.vn^$all
! https://www.virustotal.com/gui/url/1014d77546918719015cacc54e024eb3cf328434de3b08571ecc21c6d582e166
||fakeserhelpsreivew-$doc
! https://www.virustotal.com/gui/url/e5632b7ebd4d9ef4899155af4a8cf218797bd59972c231a7897b603b32ccccb1
||govern-assessment-validation-*.vercel.app^$all
! https://www.virustotal.com/gui/url/54cb07a8f7961f2a9b2e5aac8c8a7a3f7a3f816f56f799382b672929fabc32b4
! https://www.virustotal.com/gui/url/75b18ea12b5b20f2e824df4443cc6d3458ca214b738ff390f319a6bf6290a4d0
||support-center-for-*.vercel.app^$all
! https://www.virustotal.com/gui/url/785093a351dc39ce40732e1fd5980d63943d38e7abc7ac8bb3972dee85e2c33a
||safety-profiles-fb-ads-*.vercel.app^$all
! https://www.virustotal.com/gui/url/6091a6693b5581524198c73b1f84c58e9272f1b100d7e68d7ed5fae7d05a06e2
||request-page-violation-*.surge.sh^$all
! https://www.virustotal.com/gui/url/a9ef0c410c76df46d4871a247df980ac912b93df02d7c7012477107171c78964
||violation-*.surge.sh^$doc
! https://www.virustotal.com/gui/url/6eeee02278ccbecd060a66c9948c69d98b79c249876e03f7ff410180fa4b4057
||copyrights-*.surge.sh^$doc
! https://www.virustotal.com/gui/url/19c07d4e7c627a1f83900c509ce73b828247b3bb932713383e5569e7e2671882
||fan-page-*.surge.sh^$doc
! https://www.virustotal.com/gui/url/d8475ddede9ae4d82634b3b67f477e08dac8e9ed1f71e217485c81e64b325440
||content-voilation-$doc
! https://www.virustotal.com/gui/url/740e678d35aa4d230791e3e9bc98d3be1d94c5269a72b35892676c606e64c326
||appeal-account-copyright-case-review.$doc
! https://www.virustotal.com/gui/url/d67ee76e5dee301886e8acf659a38d3489da3815c63592ae63659fae81242a41
||community-flagged-$doc
! https://www.virustotal.com/gui/url/19c07d4e7c627a1f83900c509ce73b828247b3bb932713383e5569e7e2671882
||help-for-work-*.pages.dev^$doc
! https://www.virustotal.com/gui/url/727aea44e0ab1a53aa0f6471b838d7391f6b4404c388b308ad3add44e5b5d65c
||metabussines.com^$all
! https://urldna.io/scan/66983eea0498ab650fb7f81a
! https://www.virustotal.com/gui/url/24b304e37ceace8f0b2d4ed4587af156618393eabecad1eb1aa1809b9876ceb0
||transparency-business.com^$all
! https://urldna.io/scan/6698e7c8b88a5a4f7f81c078
! https://www.virustotal.com/gui/url/0fb1eb85ae5a83bbbf012fc401f663011ee27042d4fc1fd43c3d6ec9bbed1dbe
||http://marketplace-item-details-*.zya.me^$all
! https://www.virustotal.com/gui/url/0e4de7ac483088234981cd80049c18f2102970271a741b004182aece70bff443
! https://www.virustotal.com/gui/url/087951f6e1cb4f192f3d756c6a8bdef38ff818e02fb2cb0387807eda74f0f518
||info-meta-noreply.com^$all
! https://www.virustotal.com/gui/url/b6f1e13d46854c206f4126ba98691ffc00f511d4567c65ec4ea95626c39a85c2
! https://www.virustotal.com/gui/url/9651e3fa25ad8bbcd3a771acd5f4658d8dc598dc2c53ea2640cfc3c8c6257044
! https://www.virustotal.com/gui/url/163d930050fe67dd41c9a2905fb9c4fa817b75fc96de6c9d71192bfbb3048e5b
! https://www.virustotal.com/gui/url/da2e3aec870053861882f7d6c41257e727e284ecfb573bb62ebe0c1e1c5c7f4f
/^https:\/\/business\.[a-z]+confii?rm\.com\/meta-community-standard\d{14,15}[^\d]?/$doc,match-case,to=com|~facebook.com
! https://www.virustotal.com/gui/url/f591d0bdb853fe252d0d2a6db865b8af34cb562e1a438158efd90f99a972bdfc
/^https:\/\/business-component\.[a-z]+(-[a-z]+){2}\.com\//$doc,to=com|~facebook.com
! https://www.virustotal.com/gui/url/a9999feede5fb57166172d17ee75655b19d1a006d440aa6180f1cba3197edf13
! https://www.virustotal.com/gui/url/3272577275331ff6f7774d392e4e6189b8dc914c16777d24eb691b4830c5ef17
! https://www.virustotal.com/gui/url/09cac60b458f88d9a2f0fa101b5fe1365f0e1786068149bbadfff21b42b165ae
/\.(?:click|pages\.dev|surge\.sh)\/help\/contact\/\d{14,19}\b/$doc,match-case,to=click|pages.dev|surge.sh|~facebook.com
||business-help-temp-$doc
! https://www.virustotal.com/gui/url/ab0017dd6ee56266bf8d8514bf3ed892719deb7f1f1dd40c85e2ee7b1764d116
/\.workers\.dev\/help\/\d{14,19}\b/$doc,to=workers.dev|~facebook.com
||royal-glade-286f.kdsj.workers.dev^$doc
! https://www.virustotal.com/gui/url/ebc994d35635bdfa408c42209bb66ca8de3180dfe60c1c90386ca5bb2bd0c5cd
! https://www.virustotal.com/gui/url/4ed3b862ff18fb1a61b8ecf76583c1f07aa3bb8625fe9bbc4df3dd44a4a14e45
! https://github.com/uBlockOrigin/uAssets/issues/26518
/\.(?:boats|cfd)\/contract\/\d{14,19}\b/$doc,match-case,to=boats|cfd|~facebook.com
! https://www.virustotal.com/gui/url/a7fd00beea3a206574a55ebcc91d1c0c73330e31c5a38d602d6f82e14d646bff
||helps-center-page-number-$doc
! https://www.virustotal.com/gui/url/b0de32c1d69e1c616a08c16fd9df3e6bc63116beaffab23e979588eec9269845
||support-16.ubpages.com^$all
! https://www.virustotal.com/gui/url/e7726560de588d46e7eff751632d42ab49f745af0fcb8d6e2ddd3418f84861de
! https://www.virustotal.com/gui/url/cd24701c93decf07a0fd0d2e37e819bd355882c488c48cdeb07a02ebecd0171c
/\.(?:pages\.dev|vercel\.app)\/appeal_case_id\b/$doc,to=pages.dev|vercel.app
! https://www.virustotal.com/gui/url/8470f93fe263a78716f67eb89e35fa32d01f418a9aab33d45350940e49004fd2
/^https:\/\/(?:appeal|contact|page)\.[a-z]{15,}\.com\/appeal_case_id\b/$doc,to=com|~facebook.com
! https://urldna.io/scan/6730aa8ee473e50c56ba3f7e
! https://www.virustotal.com/gui/url/5fa27669e116daaa9aa118ffd4f11e797309bf8172129780699603d1d95046d2
||suport-page-help.com^$all
/\/contract\/support-case-id=\d{14,19}\b/$doc,match-case,to=~facebook.com
! https://www.virustotal.com/gui/url/06a955d5c7ac3eeffb64aa49d1e5ae928ee97870b84862c0be6aeb66e9d26a9b
||akuanakmamah.de^$doc
! https://urldna.io/scan/66f3c57b304b035a2881c2bd
! https://www.virustotal.com/gui/url/e1e065ad6355da6ec5c427cb7d991ce90430e275a0b80b2d69a46337b62d55fd
||support-metahelpcenter-id*.netlify.app^$all
||support-metahelpcenter-$doc,to=~facebook.com
||netlify.app/help/support/client_id=$doc
! https://urldna.io/scan/6730aa2daee258c88824ac60
! https://www.virustotal.com/gui/url/58de23eb9a6a00255f5503ad391fd24bf84135a63c6df7d992b0ed1b4bc71511
||reminders-infraction-account.netlify.app^$all
! https://www.virustotal.com/gui/url/6e13578979cea6a4fe1a10c9e13608da630f3a55e72ed7df3669b15d5ac3546c
||abc-ckd.com/facebook/$all
! https://github.com/uBlockOrigin/uAssets/issues/24719
||xyzxyz55.xyz^$all
! https://github.com/uBlockOrigin/uAssets/issues/24777
! https://www.virustotal.com/gui/url/c2d401ec0f20e437009573fca481565d05036489406f6bb9bee37365cf4d28f0
||vercel.app/americaplata.com.html^$doc
! https://www.virustotal.com/gui/url/94c89d8875b2ca47a7e312a65c7c2522400759d697ed5678c753f74c5bac1645
||atplink.com/responseandresolutioncenter$all
! https://www.virustotal.com/gui/url/4356eb329ad8473f5db57778ae7b23f588d9de5c1851f7876193aba38ab7703a
/^https:\/\/h5\.[a-z0-9]{4}\.com\//$doc,to=com
! https://www.virustotal.com/gui/url/cb040151df409b4bb2bf62d47bd91b293cc58bda80da9f7a53c6bc4cafa95457
||vercel.app/mixcc.html/$doc
! https://www.virustotal.com/gui/url/26455a14cbf57c4719a05f4fb3f33a42f47cb5850ae67d9859022b719e57110b
||vercel.app/metasp.html^$doc
! https://www.virustotal.com/gui/url/ddf62926e9586f22c559d61eb85d09413166351a04d990f41f79dacac43a671c
||vercel.app/decision&copyright^$doc
! https://www.virustotal.com/gui/url/6c19e403b2f4fac5bb0e1703ed4883ea157525ced4af89a88b66f8c900d37530
/^https?:\/\/[-a-z]{12,}\.vercel\.app\/[^.]+?g_ep=?EgoyMDI/$doc,match-case,to=vercel.app|~facebook.com
! https://www.virustotal.com/gui/url/6d5fd29cbe87f8704cb167b808453b9a8e73edf444acfa7c104aea5a2be7b368
/^https?:\/\/[-a-z]{12,}\.vercel\.app\/[^.]+?=D400e/$doc,match-case,to=vercel.app|~facebook.com
! https://www.virustotal.com/gui/url/216501aaaf110d2ec9e2861d702d4025ba63df702ab46b25da9fb39b57358c46
/^https?:\/\/[-a-z0-9]{25,}\.vercel\.app\/id\/\d{15,17}\.html\b/$doc,match-case,to=vercel.app|~facebook.com
! https://urldna.io/scan/673aaa74607ec87001473ba4
! https://www.virustotal.com/gui/url/878182e6093b5987cf46060002e7d7dcda53024fa99885b5d573970f9d7ef535
||live-metasupport.com^$all
! https://urldna.io/scan/674559483f64e80bf440d493
! https://www.virustotal.com/gui/url/266b06bd1751137e29622025a51e263eda7efd84a2a32bdc1854956135a21e4e
||supportadm7tmedia.online^$all
! https://www.virustotal.com/gui/url/7c0d4be00554ee880ccd48ebca4a31a384a439c7fdd266214dd21bf87217fcad
||befuls.shop^$all
! https://www.virustotal.com/gui/url/5816000c2c9efd6e3103e355e4db79833c78d3b472db28822508c36598195c0a
! https://www.virustotal.com/gui/url/2ab2d00623a9c7a0a2be93714e2d870c4524a0c5721448f33ac60eac913b3c5e
||businessrequestcenter.com^$all
||businesscreatorportal.com^$all
! https://www.virustotal.com/gui/url/cc2450d1ea3d6a4d610b156eac3bbfc31eef82a9536e32875ae90f5374387f04
||fb-business.com^$all
! https://www.virustotal.com/gui/url/099177cb27bbed7b0484adf16d9481d2472720c64f8ef0dc274d4c12b99fbe94
||faecbook.vn^$all
! https://www.virustotal.com/gui/url/d6ccb1aaa8c9c09ee68643561506c91f9ae7e0e744e2fef45132c4b4b419a1b0
||contact-supportbusinessmanager.ubpages.com^$all
! https://www.virustotal.com/gui/url/1eb22b0b60fcb61de6eee104b561163ee316cb267625a786d3503da0bd63b359
||counselschambers.co.uk^$doc
! https://www.virustotal.com/gui/url/2422c2d5d78436b9f6510865c617237e98f04c2cc69db8f566c23e24d0922f3c
||identityconfirrmpage.com^$all
! https://www.virustotal.com/gui/url/7580331164d1c54a39003b3472cef1009537bcea87806aa7a1b67083aed0b133
||online-ops.mypasschange.com^$all

! shopping sites
/api/user/do_login|$xhr,1p,to=com|info,method=post,header=access-control-allow-headers:/authorization\,content-type\,if-match\,if-modified-since\,if-none-match\,if-unmodified-since\,x-requested-with/i
/api/user/do_login|$xhr,1p,to=com|info,method=post,header=Access-Control-Allow-Headers:/authorization\,content-type\,if-match\,if-modified-since\,if-none-match\,if-unmodified-since\,x-requested-with/i
/api/webapi/login|$xhr,3p,to=online|vip,method=post,header=access-control-allow-headers:Origin, X-Requested-With, Content-Type, Accept, Authorization
||lazada.bbc6666.com^$all
! shopee
/^https:\/\/sp\d{2,3}88(?:vn)?\.com\//$doc,to=com|~shopee.vn
! sendo
||vnsendo.*^$all,to=info|shop|vip|~sendo.vn
! dienmayxanh
||mayxanhsupport.com^$all
||trungtam-dienmayxanh.com^$all

! steam
||steamproxy.*^$all,to=steamproxy.cc|steamproxy.net|steamproxy.vip
||sp.zhabite.com^$all
||sp.aircsgo.com^$all
||st.aircsgo.com^$all
||steam.zssjsq.com^$all
||steamcommunitylog.chez.com^$all
||steam.workshop*.com^$doc
! https://github.com/uBlockOrigin/uBOL-home/issues/156
! https://github.com/uBlockOrigin/uAssets/issues/27941
/^https:\/\/s[cfntz]y?[ace][aemnu][a-z]{1,4}or?[mn][a-z]{4,8}[iy][a-z]?\.com\//$doc,to=com|~steamcommunity.com
/^https:\/\/s[cfntz]y?[ace][aemnu][a-z]{1,4}or?[mn][a-z]{4,8}[iy][a-z]?\.ru\//$doc,to=ru|~steamcommunity.com
/^https:\/\/steam\.(?:community)?workshop-?[a-z]+\.com\//$doc,to=com|~steamcommunity.com
! https://www.virustotal.com/gui/url/d16f07ca49e9334d080d427294630f22f10d8925de8ae73df2128e0bdbd434a9
||steam.communityart-work.com^$all
! https://www.virustotal.com/gui/url/193529305a403b318c68513d9ca0bbf9869ab475004de21dd79b9746a98fc1d2
||steamcomuniry.com^$all
! https://urldna.io/scan/66925047e932af39c4d83b2e
! https://www.virustotal.com/gui/url/372d127253dfec7b8877a319c8b206cbe78cd073fb6aa63827b8e8f374b11d96
||steamcommunlyt.com^$all
! https://www.virustotal.com/gui/url/885e8a2414fc94eee924e9314140c217481c85a60f5583a11054d8eb6d25b07e
||steemcommuntiy.com^$all
! https://www.virustotal.com/gui/url/363aba32957697b30a125eafd87d3a50f64fac6df9eda931078288112b84b725
||stemcommunty.com^$all
! https://www.virustotal.com/gui/url/bcbbfae046e7d8b62418da2234556524170cf156f2ac5c9d25f1b7fb4bfc64e1
||workshop-users.com^$all
! https://www.virustotal.com/gui/url/4aba296c6d702d985b991365bdbe66ee72256a29c46ab9db1dc0dd1f25e0fbbe
||cn-steam.com^$all
||com/p/jcod-ppsr/huasdirjdo^$doc,to=~steamcommunity.com
! https://www.virustotal.com/gui/url/903d84272949895a1b6b839e17d42228ffeb3b76f17603b21df897a0f6d13124
/redeemwalletcode/gift/*$doc,to=~steamcommunity.com|~steampowered.com
! https://www.virustotal.com/gui/url/72c0e8ee73469a559b1fd1947216d05571d49a8206abf7f33400e16c0c2b020e
! https://www.virustotal.com/gui/url/3cfd2e05f7e6129a6278d7f0ab0bce05d021cdf47407f51b5dbe6d975eb5ff56
||steamcommunity.^$doc,to=~steamcommunity.com
! https://github.com/uBlockOrigin/uAssets/issues/27971
||namcards.com^$all,to=~steamcommunity.com

! https://www.virustotal.com/gui/url/ce6473af34e959a3b54481b19156fd89c5f79f572504e946322a699fa3c90982
||gasenna.id.vn^$all,to=~garena.vn
! https://urldna.io/scan/668c617231870afb8051862d
! https://www.virustotal.com/gui/url/58cfcbac7307b433fa5f749b7ec520a80ad2d9f3e6cf2ca23d82f13642b10920
||gaerana.io.vn^$all,to=~garena.vn
! https://www.virustotal.com/gui/url/2292c6eb437f9930590616da35a79465053768e7d761000fd8a3665843fc5502
||gasenna.io.vn^$all,to=~garena.vn
! https://www.virustotal.com/gui/url/cb13aced65dd286d5c1c7395bd0a6124cdf36584d46d769a453d648a90743847
||gerarna.io.vn^$all,to=~garena.vn
! https://www.virustotal.com/gui/url/f723578b1d245750ca20505afffccbb5c7dd7f8a5fa3173622a34a0316d9c13e
||gareana.vn^$all,to=~garena.vn
! https://www.virustotal.com/gui/url/c998e9fdb9fa0dd19da052a536973c793ff587d9e92aa8ece634369014c338d1
||doivangfreefiregarena.io.vn^$all,to=~garena.vn
! https://urldna.io/scan/66b4cffb823078d8ed5a58e2
! https://www.virustotal.com/gui/url/9b41d646681f2d6de5a19ce7251c93607d16fb3d341396c953043c47123e3e8e
||garenaea.vn^$all,to=~garena.vn

! mobilelegends
||mobilelegendsmycode.com^$all
||exchange-mlbb.go-midfer.com^$all

! pubg
||pubg-arena.top^$all
||register-turnamen.free.nf^$all
||sukien-pubg.io.vn^$all
||napthepubg.mobi^$all
! https://www.virustotal.com/gui/url/8beafe6d3589893c780dc140b59a7bf70fa4a900381da96faafb8b5d0a508eff
/volt/*?nox=$doc,to=ai|com
! https://urldna.io/scan/66b8bb055b2622c91165b2b6
! https://www.virustotal.com/gui/url/6b3ea23e4c4efa2fcbe9259409281c002a04671b6e205c3c91abb990fad40efc
||kraftonevent.com^$all
! https://urldna.io/scan/66b8bb222f59b21da15613d1
! https://www.virustotal.com/gui/url/63830f5c8fcc5abe8544ed1a7ecfcd986274c6a9b1cd1d3df8b47c874ec33730
||pubgxbest.com^$all

! google
||play-quartz-sanctuary.xyz^$doc

! microsoft
||microsoft*.dfautomotive.de^$doc
||microsoft.dfautomotive.de^$all
||microsoft.account.dfautomotive.de^$all
||activarhotmail.weebly.com^$all
||hab-sharepoint.weebly.com^$all
||servicewebformoes.weebly.com^$all
||microsoft-verify.glitch.me^$all
||validacionesoutlookmailwebadmin.glitch.me^$all
||whfdny.org^$all
||infos4.yolasite.com^$all
||microsoftupdate67.wixsite.com^$all
||exchange.add-solution.de^$all
||exceklcmicrosftprotection.pages.dev^$all
||graettingerlaw.com^$all
||post.nationalrent.ru^$all
||gocolonial.local-user.com^$all
||officesoftcn.com^$all
||athenasbaklava.com^$all
||e-outlook-online.com^$all
||serverdata.ch^$all
||nilousplaypen.com^$all
||cashum.unam.mx/wp-content/backups-dup-pro/imports/index.htm$all
||od.atami.no/one_drive.html$all
||thermovitraffic.com.mx/SharepointFileProject/$all
||cognitoforms.com/FiRe21/EmployeeTeammateQuarterNominationPeriodForMidyear^$all
||santangelo.eng.br/owasetup/$all
||maweresibanda.co.zw/portal.support/$all
! https://www.virustotal.com/gui/url/19c07d4e7c627a1f83900c509ce73b828247b3bb932713383e5569e7e2671882
||pages.dev/smart89/$doc
! https://urldna.io/scan/66e84f51b5b5cf9b2869e00d
! https://www.virustotal.com/gui/url/765e4dd75664d385d04eacaa47e36ed1029f2e42882c843c242b52cfafaf3300
! https://www.virustotal.com/gui/url/d7ef78d959b7cbfc5592321f643f505bc022c221a607a9d41d9d2aa6e41b8df3
/^https:\/\/(?:[a-f0-9]+\.)?[a-f0-9]{58}\.pages\.dev\//$doc,to=pages.dev
! https://infosec.exchange/@urldna/112186648791862292
||acir.postofficeweb.com/grupoacir/$all
! https://infosec.exchange/@urldna/112377161728125627
||storageapi-new.fleek.co/*/yss/ind.html$all
! https://urldna.io/scan/667d384ad611a65623a4c272
! https://www.virustotal.com/gui/url/08c0a664528400e7f69613f0d67cd32eaa27c172e61b59729af5fd808fb52737
||wwwservicemsnlive-*.hubspotpagebuilder.com^$all
! https://www.virustotal.com/gui/url/b434ef1646001aeffd5a32021dc365e17f38b4ca73cbd06e237fa29749e5ae05
||conohawing.com/*/outlook-$doc
! https://www.virustotal.com/gui/url/6842be99947bd0db1671500f4ab7774846e34f7d951b190be9e58b9e84536f39
||hergunavantaj.com.tr^$all
! https://www.virustotal.com/gui/url/121614b7a02a5f9bfe0df6bea30184ef2c28a03df07b6ae41c489de241554344
||irrigationservices.co^$all
! https://www.virustotal.com/gui/url/4c3fa27636d4439e79b4f6a05f2c3859897425727bf985a5afe5047266e462ff
||copynet.com.mx/Message%20Centre/$all
! https://www.virustotal.com/gui/url/64fb53355d445fd7b50685886e43e364285a48a660701a553cfbfd925c1a371c
||msnoauth*.com/office-$all
! https://www.virustotal.com/gui/url/564a9ce8f29f1fe3e951fc11865e27ed1f3280a512afbd110e2733634106510b
||sites.google.com/l0gin-microsoftwebonlne.app/$all
! https://www.virustotal.com/gui/url/51ddf7de3e21e346563a713d62f1a3221afda66b9681ab2b5989da7d901a3935
||monogonzalez.com^$all
! https://urldna.io/scan/669b8ab77cf5beafb5dbcf99
! https://www.virustotal.com/gui/url/1092dfb23e71f252516b56e8d516e92df4233b5d7e7a5178393f7a1ae02b9ff3
||microsofthotmailsi1.wixsite.com^$all
! https://www.virustotal.com/gui/url/d0a30d63d6975b69762e024ddb89c252a8f2822bddb8b4d171bf3495261dc479
||supplieradvisor.ciamlogin.com^$all
! https://www.virustotal.com/gui/url/6586411fdd055f472911a7507ed78ed2eabab30a79d2caf3402525f119dd8e66
||e-messsage.com^$all
! https://www.virustotal.com/gui/url/8f1d11e2386cb995b30ec481a6b28acd4903283450f034a426927648956578a2
||supp0rt.co.za^$all
! https://www.virustotal.com/gui/url/80a4ef21bdad71086be4131d0781e1578b59f2d3565ac48cd5d30aa7e2b2e398
||ariabcon.com^$all
! https://www.virustotal.com/gui/url/b1351123c5563546b0841861e21e71593f0eca917057ac3c9f497303160053e4
||vkcs.cloud/owa.html^$doc
! https://www.virustotal.com/gui/url/38b0cc10ec3ff351fb8688c6386834152abda6e018c63e8be60272b2ffb6c3b1
! https://www.virustotal.com/gui/url/c3e6ff6cc703988270f227d9bdd8192f74d795ff8efac3a1f4043049d4db21f8
||ocalam.com:8443/impact^$doc
||indylatinawrds.com:8443/impact^$doc
:8443/impact?impact=$doc
! https://www.virustotal.com/gui/url/001206894d1c51fed2957043775dd6b567f35f7223b755b536d8828cfc43403c
||todordigital.co.uk^$all
! https://www.virustotal.com/gui/url/526d0f017cf0af2b63746d39c742afe6d6d827cc1142d49fff26467f57d64c22
||pub-*.r2.dev/owa.html^$doc
! https://urldna.io/scan/6739584cde915d9ef3ea248b
! https://www.virustotal.com/gui/url/86d704e6d02054e1fdedfabd848701ee49998448ea66645a89626d274787aeea
||pub-*.r2.dev/owasecure.htm^$doc
! https://urldna.io/scan/66a7f0b018ce9822b681e283
! https://www.virustotal.com/gui/url/ae5b373bf18db6316d0bbae309378ce3f66e6e780682ce8bfdee60a8536c1721
||pub-*.r2.dev/onecode55.html^$doc
! https://www.virustotal.com/gui/url/f231e206ef4cf16012f015b13ca1069cdb1c250e7e6b6ad7533b46866cc62d46
||pub-*.r2.dev/OneDrive.html^$doc
! https://urldna.io/scan/673fdd72901499bb7178108c
! https://www.virustotal.com/gui/url/953665bd31d47d6384f1389967a6321adfe571f078e4f38d4f06cf9670fdff93
||pub-*.r2.dev/auth_type.html^$doc
! https://urldna.io/scan/66a893d548fc8e7672fbf688
! https://www.virustotal.com/gui/url/caa8a01a2f1c8511f8a5e2ac367ec62beaf35db464b564e1ce9450a4a4923fb4
||enexdirecto.com^$all
! https://www.virustotal.com/gui/url/759542b8116836f96e6a4ec604fb9f58b62b348346c3e65e417d649ae50b21b0
||ccefactoring.com.br/ziujhyhtrer/$doc
! https://www.virustotal.com/gui/url/9105be477423bad95f6841a21151289e3dde515febdad09429b0fd030ed95b49
/Message%20Centre/mc.php^$doc
! https://www.virustotal.com/gui/url/823f191614433b0f353b678994fe7399aebddf541c26f7434e630a352da61054
! https://www.virustotal.com/gui/url/bbab15ebcb0f684e6448edf35d469b5c411c6e3c7877387d16666e8a26fc3e8e
/\.com(\.[a-z]{2})?\/wp-includes\/images\/smilies\/images?\/smili?es\/[a-z]{25,35}\.html/$doc
! https://www.virustotal.com/gui/url/aa20e18faa34e87cefdd3540d18ac6f030f17d501460f771e84a70b07e66e8aa
||mlcrosoftonline.com.eu-secured.com^$all
! https://www.virustotal.com/gui/url/2f6b0d76102f8fbfafcc7a42d4768474d58c38079f7ff8a82b836e9649c7f7a5
||carrierzone.com/sharepoint/$doc
! https://www.virustotal.com/gui/url/1ed7b40b8d5a921616df1e5b651f0a8d055766eaa36d3ce73b5823cf6acb01b7
||hr-systemmet.dk^$all
! https://www.virustotal.com/gui/url/649a3b295ad9351627f2539d0671071bb781f0d39c7d2730bb1c10041bd76c76
||bertchou.com/wp-content/languages-old/config^$all
! https://www.virustotal.com/gui/url/faecdd6bdca1b1760f51038578451d7315e2ae074f68175da527f722d873fcf9
/^https:\/\/[a-z]{14}\.azureedge\.net\/\d{4}j\b/$doc,to=azureedge.net
! https://www.virustotal.com/gui/url/2d6508637022abdbe07180d88c2590ccef5de0d255841fdd1aacb4982ffe842c
||microsoft-notifcation.com^$all
! https://www.virustotal.com/gui/url/3d1271ed539c049f4a635c733563e00b453b091a64b5bd2cbefa294cde56c684
||eunssiatel.tech^$all
! https://www.virustotal.com/gui/url/07e776f18e73ca2817565bbe2a9c892254b43792ad6ba152e58f0f3bee9c51d0
/neteasyes/neteasyest/900^$doc
! https://www.virustotal.com/gui/url/a9a522e1d2bcaa50c4b0183207998f4d9f6df975701014c953a6cd7669289b05
/^https:\/\/[-a-z]{4,}\.dogfriendlytahoe\.com\//$doc,to=dogfriendlytahoe.com
! https://www.virustotal.com/gui/url/c9edd9d3e4002957c668e0d19002e4175227d7bbbc84059592fc4ab8cbf1a2f0
||docusine.com^$all
! https://www.virustotal.com/gui/url/ba3d635595cc93873b411791c58db6a12e5285cdebf35544afb1ca7350ef4296
||backblazeb2.com/securescriptindustriusfinanceprivate99.HTML^$doc
! https://www.virustotal.com/gui/url/aa14ca779e0ee64809a6698a89e50bd6d60138ee7707116c169fc765bb9baf98
||contoso-travel.com/login^$all
! https://www.virustotal.com/gui/url/89d827b0980847445477131a27a9d58d8ca0e64fd3aa782a508c1c8e01c6291b
||sitio-interno.com^$all
! https://www.virustotal.com/gui/url/c2ec0126a3e06b636368e4ff4c2ade3dbedac9d054db5b470bbf615ea390eb89
||oortech.com/onedrive.-html^$doc
! https://www.virustotal.com/gui/url/29857465da6296cafcf9dd205d78f34ea074a8bdcca2f62adf1b7cf9072ca3ba
||shockaholic.net/jgr/$all
! https://www.virustotal.com/gui/url/3d14b8eb5242df9e63127ef2cd69d85cf69dd965b382da83cd31938cfeda567a
||earovit.dk^$all
! https://www.virustotal.com/gui/url/b975db4665f554ab571c8a02b8b748500c278347191334a9c6b80abe036f9be4
||user.fm/files/v2-*/Refundnotice.html^$doc
! https://urldna.io/scan/6733148ced64ebd828fccb5b
! https://www.virustotal.com/gui/url/cba35981fd21da4668fb4a935d091677c5abfdb1ce1f00690aa54614f1adf12e
||user.fm/files/*/Proof%20of%20Payment.htm*$doc
! https://www.virustotal.com/gui/url/18f2bace516b40699daddedeecc81c41183f522004ee606ee432323987ba6494
||alnobala.ae/owasetup/$all
! https://www.virustotal.com/gui/url/6e69610c952076b5cf68160d8acba75dae81ad780929e950eb099399f6e6ccea
||authsignonstaff*.softr.app^$all
! https://urldna.io/scan/67324ae225a29e5c04a0cac2
! https://www.virustotal.com/gui/url/32d23c85dd5e4c10a1a7813f935117e236dfe8f914ad882fb302e83eca32f47a
||facture-pdf-secure-*.vercel.app^$all
! https://urldna.io/scan/67380ef58a64bab0b45d0b6b
! https://www.virustotal.com/gui/url/13c5d820504770599d96aa85000d49ed4af09e2191dcff38e8b63e4ec5eaead5
||hkwordpress.com/public/export/SM-ORDER/excelz/$doc
! https://urldna.io/scan/6746ab36d355f8dd0d56dae1
! https://www.virustotal.com/gui/url/6fd52a8f1ed5e9525b44d5c98c19ad9e9e89741153570855475ab19ea88095da
||msoftupdate.*.linodeobjects.com^$all
! https://urldna.io/scan/67468dbb2ad516bb77c59bb5
! https://www.virustotal.com/gui/url/11206caec45f8f731373a3c40f36725113e3f93945145892bb2895edb2ec0e59
||slobeg.com^$all
! https://urldna.io/scan/67869939c6a9b4f17944c786
! https://www.virustotal.com/gui/url/2065cd67be3bf7ac6469c02d033f73c6debf710054d1a5156334dbfe87b527f8
||outloksupportbuzoningreso.glitch.me^$all
||outloksupport*.glitch.me^$doc

! telegram
||telegramhcn.com^$all
||brawllstars.ru^$all
||telegremapp.me^$all
||telegerasm.work^$all
||telegeram.work^$all
||webtelegram.eu.org^$all
||telaagam.maxisl.vip^$all
||zhongwen-telegram.com^$all
||telergaom.top^$all
||telergctm.vip^$all
||teiegram.work^$all
||telegrambotsolution.pages.dev^$all
/^https:\/\/www\.telegram[a-z]{2}\.com\//$doc,to=com|~telegram.org
! https://www.virustotal.com/gui/url/ef9755fcb211a668986b9afc5187577c92fb8c8bf62057bf9d0b59333827a35a
/^https:\/\/ht[a-z]\d{2}\.vip\//$doc,to=vip
! https://www.virustotal.com/gui/url/3891030a1d3e7fb7ebac20d4607242e3c30477016bcdad27da7e88c9cdf65d3f
||recouphh.top^$all
! https://www.virustotal.com/gui/url/fc047acc620a85307852e4580ab5c21468a8fc8a175b5657a05950cd876ee07c
||recovery-cr.top^$all
! https://www.virustotal.com/gui/url/a33e6ee7dd86f0c86a655a942a7d38fae709e522c38f25bdd51c38cdceee9e06
||recovery-gzo.top^$all
! https://www.virustotal.com/gui/url/9bfb25d3ef31de34855417314d030bdd6c668b7a7e4fd826531e0e0f239ad2e6
/^https:\/\/xy[a-z]\d{2}\.cc\//$doc,to=cc
! https://www.virustotal.com/gui/url/2048958dffb9920086d04fe2b0b93fbe3c0ce180c9456d36b846600c15b1b1f5
||telegram-*.com/login/index.html^$all
! https://www.virustotal.com/gui/url/1c006fc290430f49ae7b3f4915f744f261fdee4617973735b00ee00e8ee34ec2
||d*wsapp.icu^$doc
! https://www.virustotal.com/gui/url/8f7738fd0cfff7c522802752d6fbdf015b19f8c7e483d01c6fb020854f42ef42
||telezelm-*.icu^$doc
! https://www.virustotal.com/gui/url/e7eea1fe6282dee603a27cc5d34c0c5eee90fd402de80989cf7a939e3e7e1352
||whatsapp*.icu^$doc
! https://www.virustotal.com/gui/url/cb39c3fd6faa42c07328f8e73f8a4d2258523b557b9f4e5a134ef4ec3cf4698c
/^https:\/\/telegram-[a-z]{2}\.[a-z]{2,3}\//$doc,to=~gov|~edu|~com|~net|~org|~telegram.org
! https://www.virustotal.com/gui/url/d69ea33854b1c9f85ec27cee7cd98ecff0e2933c2644e43df657671ebacb003e
/^https:\/\/telegram-[a-z]{3,4}\.com\//$doc,to=com|~telegram.org

! usps
||uspsparcels.net^$all,to=~usps.com
||uspssmartpackagelockers.com^$all,to=~usps.com
||smartparcellockers.tech^$all,to=~usps.com
! https://infosec.exchange/@urldna/112224043535026915
! https://infosec.exchange/@urldna/112244333356436954
/^https:\/\/usps\.[-a-z]{6,}\.(?:com|top)\/(?:address\.html|information|verify)\b/$doc,to=com|top|~usps.com
.top/pg?do=$doc,to=top
||wrc-gh.org/redelivery$doc,to=~usps.com
! https://infosec.exchange/@urldna/112560597065106850
||mybluehost.me/2us/verification/$doc,to=~usps.com
! https://urldna.io/scan/6683cfb811bd32bf9fb75225
! https://www.virustotal.com/gui/url/25aea0e999fad6210accce6965b498b4794ae442233ece87290293486f17d432
||mybluehost.me/uspshome/$doc,to=~usps.com
! https://urldna.io/scan/668915c66ba77bfb3cacea3c
! https://www.virustotal.com/gui/url/2cffc82255b1724b4e9083c350c2c3d73ff9366ee6ab15d6c0bc37ab6c7b8066
||mybluehost.me/us/post/$doc,to=~usps.com
! https://www.virustotal.com/gui/url/d8f1aa4bd75eb85e45126053f1e67862e33be37dc3b9064af310cfda1629964b
||mybluehost.me/tracking-mail-delivery/$doc,to=~usps.com
! https://www.virustotal.com/gui/url/ab9313e89cd1f37e143b6bbfb8e7b43d4484328dda0b5fd287a44fbefce58479
! https://www.virustotal.com/gui/url/3a759ec6ab4192d774c4a40be278da6bdda88cb693995472cf84bf6fb9c3617a
! https://www.virustotal.com/gui/url/cb0992c96c240779edaf3a6b5c7b4c19eecbd983f5621a1b654ced34cb2ad739
||mybluehost.me/*unitess/$doc,to=~usps.com
||mybluehost.me/UNITEDSTATESPOSTAL/$doc,to=~usps.com
||yah.ppl.mybluehost.me^$doc,to=~usps.com
! https://www.virustotal.com/gui/url/876186ad51623f15303e6fc8565e4411545aa92a07d0c118c7cb6e3db91bba85
! https://www.virustotal.com/gui/url/114d0d1abadc10805bd8dbce5fec3d58f73494e989aadca11d0dc8b67f466142
/^https:\/\/transporta[a-z]{8,9}pro\.top\/i\b/$doc,to=top|~usps.com
! https://www.reddit.com/r/Scams/comments/1gxejx5/usps_scam_sent_me_this_httpsuinfotracklmstopus_in/
! https://urldna.io/scan/674295237e7857a321be968d
! https://www.virustotal.com/gui/url/924ffc9758a7ef73e36f5538969f3a27000b5743f7f18761e4aa4ffe484ac6bd
! https://www.virustotal.com/gui/url/a4729e0a66bb9fe48da61dda6db467c5cb5525017dcdbf9efb42c2e51168342a
/^https:\/\/[a-z]\.[a-z]{10,}\.top\/us(?:\/|$)/$doc,to=top|~usps.com
||infotracklms.top^$all,to=~usps.com
! https://urldna.io/scan/673d512e85f8a9a88ee409e2
! https://www.virustotal.com/gui/url/39e12c416f93afd6e666595aa1a1856578ea27720677fc8e7f954dd5e3a8f3f7
/^https:\/\/[a-z]\.[a-z]{10,}\.top\/l(?:\/|$)/$doc,to=top|~usps.com
! https://urldna.io/scan/66ac783f3e864409c90271ce
! https://www.virustotal.com/gui/url/839734b93740d77e02daa895fd4ebe200e54e66c6e2d99a844a3b727cad9d6e9
||usps.*.top^$doc,to=top|~usps.com
! https://www.virustotal.com/gui/url/15d93929f279c01081acbaf92154c4705e9ff235e3fe339d330aa4d9937c669f
||wpenginepowered.com/usps/$doc,to=~usps.com
! https://www.reddit.com/r/phishing/comments/1hc0qiy/is_this_a_scamfake_number/
! https://www.virustotal.com/gui/url/ce425295e72396f58f308fc806facb264bca671c58428ea9b1367fc6e62d2ec8
||usps.*.sbs^$doc,to=~usps.com
||uspac.sbs^$all,to=~usps.com
! https://www.virustotal.com/gui/url/1dfeccb4f1210b4a962751e4e0ffc64a224d653e7bd14bda3b1a2e7c252091ae
||informed.delivery*.top^$all,to=~usps.com
! https://www.virustotal.com/gui/url/91d4560abcb8a03cc50d943bc4534c58935968a2b7c80f0c63cca78a84ce0ddc
||info-tracking*.cc^$all,to=~usps.com

! weebly/square phishing
/^https:\/\/(?:[a-z0-9]{2,}-)+10\d{4}\.weeblysite\.com\//$doc,to=weeblysite.com
/^https:\/\/(?:[a-z0-9]{2,}-)+10\d{4}\.square\.site\//$doc,to=square.site

! spotify
||upgradeyourspotify.cc^$all
||keepo.io/opddater-spotifykonto-informas/$all
! https://community.spotify.com/t5/Accounts/Phishing-Email/td-p/5877600
/^https:\/\/[^.]+\.codeanyapp\.com\/wp-content\/.+\/spo[a-z]{2}i\//$doc,to=codeanyapp.com
||codeanyapp.com/*/spotii/$all
||codeanyapp.com/*/spoofi/$all
||mybluehost.me/*/MitID/$doc
||airpos.co.kr/.well-known/pki-validation/*/MitID/$doc
||autolocksmithpro.com/spt/$all
! https://urldna.io/scan/674294bdb5cc598397d25392
! https://www.virustotal.com/gui/url/2afd8fdb0de2cbf5c56ab9480426fd19cc0037d43d1453b19deb28ae60bd78e6
||spoti-safe-support*.codeanyapp.com^$all,to=~spotify.com
||spoti-*.codeanyapp.com^$doc,to=~spotify.com
! https://www.virustotal.com/gui/url/475155b96214f5e3a49c9f6d369879b0858477f84232cc11818d4cea64d5d3d2
||spolify-support-premium.codeanyapp.com^$all,to=~spotify.com
||codeanyapp.com/Issued/settings/$doc,to=~spotify.com
! https://www.virustotal.com/gui/url/5f5d2e941e3e44e01a4ec88d3732113195e2afdef511d3635fbd291495f82f4f
||mybluehost.me/spot/Account/$doc
! https://www.virustotal.com/gui/url/e12ae2bc0550053fb14c5626719115d304edc007040499a44cb4113cd9e41d0e
||mybluehost.me/dse/main/$doc
! https://www.virustotal.com/gui/url/0ceb34c5d826a3c5f8f0c736ffe7b7e65d14b21e331ffeb64a619e894c340f12
||mybluehost.me/MUSIC/SPOTIFY24K/$doc
! https://www.virustotal.com/gui/url/079563d015c00efbca61d80c59f00d19ef06ccbc9922565e1d6d388c99986ba4
||veratv-mtic.vera.com.uy/r/$doc
! https://urldna.io/scan/67507c616f88e161d7e39ff9
! https://www.virustotal.com/gui/url/45fb09e403d0d5908fdc97144ba574cb72b2c909993402d7dd525faae65252bc
||freewebhostmost.com/*/spotify/$doc

! swisspass
||divinedownload.com^$all,to=~swisspass.ch
||swiss-passapp.web.app^$all,to=~swisspass.ch
||mybluehost.me/CFF/$doc,to=~swisspass.ch
||mybluehost.me/--/SBBCFF$doc,to=~swisspass.ch
||mybluehost.me/SBB.CH/$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/92187fec54723b98e4a67ce247dfcc2a18d6fe2ad425c9ef8d926abd8fac9a10
||mybluehost.me/*/swisspass/$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/1b04ebdcbc185c83d58b89b7f5d0220f440aa8ef7652138a1ba30bf981e841f4
||mybluehost.me/Konto/SBB/$doc,to=~swisspass.ch
! https://urldna.io/scan/6677f243e02f8fe8990a0417
! https://www.virustotal.com/gui/url/0fec438409b71ba8f28fd33e31a13227836fc644467d625aa2b98986ba21ce3a
||mybluehost.me/sbb-ch/$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/d06025e9a812f7d17e3febbba184c6f7a74904fcec32cd0202fb429b5ceef0e4
||mybluehost.me/SBB/$doc,to=~swisspass.ch
||the.jxc.mybluehost.me^$doc,to=~swisspass.ch
! https://infosec.exchange/@urldna/112428358456633497
||mybluehost.me/pass/index/$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/5ca860461f268be334cb25520f39cb73eb4666019b8c095dbb2951124bb8766d
||mybluehost.me/seitech/$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/fdfaee41433e38d0aad765575c0ebd0edea90c19bc028a0d9f6438e563f36cf5
||mybluehost.me/*/swpassfr/$doc,to=~swisspass.ch
! https://infosec.exchange/@urldna/112316881794824268
||mybluehost.me/*/CHFINAL/$doc,to=~swisspass.ch
||acconsult.info/*/CHFINAL/$doc,to=~swisspass.ch
! https://infosec.exchange/@urldna/112441688955721080
||sviluppo.host/sbb-chf-id/$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/6f294b5e73e405ef5a20b9048c6ae8c86925cde499e303dcb7b107f78c9655d9
||sviluppo.host/CHFINAL/$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/e225d606addeced5162fc2f28cb5a6829d9e3dde8986d246c682ba79a5f6e0b0
||sviluppo.host/*/CHFINAL/$doc,to=~swisspass.ch
! https://infosec.exchange/@urldna/112439801316174846
||wcomhost.com/spass/$doc,to=~swisspass.ch
! https://infosec.exchange/@urldna/112658035861531160
||altitudesim.ca/*/CHFINAL/$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/536c73948a6fb646afe3bbd0a06889b9e4bb377eec397600321961e3d366805c
||codeanyapp.com/Swissp/$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/925d7839914de2aaffbf139dfb1dff9d8fee9c41b6360aaf01044dcfb491ce50
||suissscomee-correo*.codeanyapp.com^$doc,to=~swisspass.ch
||codeanyapp.com/Sus/*/sign.php^$doc,to=~swisspass.ch
! https://urldna.io/scan/66fbdab87023f3006d689f21
! https://www.virustotal.com/gui/url/783d501994049995741eaaa5f34f0be120fdd106eaa7c6bd47446694dff64928
||verwalten-sbb-informationen-managecff-kundenportal-online.codeanyapp.com^$all,to=~swisspass.ch
||codeanyapp.com/manage-SBB/$doc,to=~swisspass.ch
! https://urldna.io/scan/66f570a14bd3fd633b195269
! https://www.virustotal.com/gui/url/345b465213187507be93fc705ef0fa4a2cc6c0d458bcf0b29b220a5e1c8742e6
||codeanyapp.com/*/SWISSPASSC/$doc,to=~swisspass.ch
||cffsbbhost-aniamaria*.codeanyapp.com^$all
! https://www.virustotal.com/gui/url/09ca05326d77f387fef2bd7bd8339221643d939ebcc2c4946ec727536ea849da
||manage-administrere-swisspass-*.codeanyapp.com^$doc,to=~swisspass.ch
! https://www.virustotal.com/gui/url/88a463b79f93e14c7bfd831ab894e1cd94f75c8bc44b6917854cdf6d71abb2b1
||romacsystems.com/*/CHFINAL/$doc,to=~swisspass.ch
! https://urldna.io/scan/67043f59c89a9d177fe0c3ad
! https://www.virustotal.com/gui/url/fa720cbffdfb2b9e90eb9e7ff5e989f0b665ae022871a2973c776834c6692e97
||valuge.com.ar/sbb/$doc,to=~swisspass.ch

! swisscom
||secureserver.net/myswisscom$doc,to=~swisscom.ch
||codeanyapp.com/Swiss_com/$doc,to=~swisscom.ch
! https://infosec.exchange/@urldna/112546087270319031
||codeanyapp.com/info/cc.php^$doc,to=~swisscom.ch
! https://infosec.exchange/@urldna/112474128904326825
||mybluehost.me/neww/$doc,to=~swisscom.ch
! https://www.virustotal.com/gui/url/dc05982c117efe86a9230d707df6f72a81c98251949428004e8c154bd578d717
||mybluehost.me/*/csom/$doc,to=~swisscom.ch
! https://infosec.exchange/@urldna/112485099916668793
||secureserver.net/ruckstantung907921/$doc,to=~swisscom.ch
! https://www.virustotal.com/gui/url/10d8d5cb68cf0f03cb48b3c5000af376e656858a0722bbf8d95cb0935086ed33
||sviluppo.host/df/pass.php^$doc,to=~swisscom.ch
! https://www.virustotal.com/gui/url/b125bd6b92439b436f012c539b1601915c8146703187c0b86119a4fe0c8d8e82
||mybluehost.me/sssssssssssssss/$doc,to=~swisscom.ch
! https://www.virustotal.com/gui/url/30b8b4ed87742d205e71d3d8d045cc07108bd46aa060e4bd0cbd788719e06dec
||mybluehost.me/comssss/$doc,to=~swisscom.ch
! https://www.virustotal.com/gui/url/59261853c67824755221c072c0014f52c675e2f856c26b50dde5065fc7ec5eab
||mybluehost.me/swisscom-login/$doc,to=~swisscom.ch
||mst.ail.mybluehost.me^$doc,to=~swisscom.ch
! https://www.virustotal.com/gui/url/dc9f208e3448b0d1db82cfcaf5b4ea6fbf5c1e6da5d95cc7e3fe84fe34bd5909
||mybluehost.me/*/swisscom/$doc,to=~swisscom.ch
! https://www.virustotal.com/gui/url/aaaf519966c47df9632c128df1d10e6d85ba70f07a5dc2843b2c091dfbe25a73
||codeanyapp.com/swiss-login/$doc
! https://www.virustotal.com/gui/url/cb52891c4aa112bee959dff579cc7f62498eabdbd2070213211f06b1bbd153af
||nxcli.io/pub/swissii/$doc,to=~swisscom.ch
! https://urldna.io/scan/67a76df2f3c5101e4317697e
! https://www.virustotal.com/gui/url/e24f078d080ca557260399cb9452e3c3984c0a0830e167f2b86494f155f76f44
||cfolks.pl/*/swisscom/$doc,to=~swisscom.ch

! swisspost
||swisspost.web.app^$all,to=~post.ch
! upc
! https://urldna.io/scan/66789b05c766226ae8d6e379
! https://www.virustotal.com/gui/url/94fdcf815a75d8182fee65b9f90fcbdd03498c33f6200e0c951a1a5874b2ad1d
||wcomhost.com/ch/upc/$all,to=~upc.ch

||tokenp0ckht.click^$all,to=~tokenpocket.pro
||mememoguls.vip^$doc,to=~mememoguls.com
||spendabit-payment.xyz^$doc,to=~spendabit.co
||web-tonkeep.website^$doc,to=~tonkeeper.com
||sparkflaretrustline.xyz^$doc,to=~flare.network
||paidnetwork-migration.com^$doc,to=~paidnetwork.com
||app-maplerpc.online^$doc,to=~maple.finance
||base-dawgz.web.app^$doc,to=~basedawgz.com
||migration-z1labs.com^$doc,to=~z1labs.ai
||tomarket-rewards.vercel.app^$doc,to=~tomarket.ai
||claim-etherfi.me^$doc,to=~ether.fi
||novastakingwallet.com^$doc,to=~novawallet.io
||xei.claims^$doc,to=~xei.ai
||kucoin0101.com^$all,to=~kucoin.com
||airdrope.live^$doc,to=~ton.org
||routerprotocol-migrate.com^$doc,to=~routerprotocol.com
||gaos.bio^$doc,to=~gao.bio
||whitelist-memefi.com^$doc,to=~memefi.club
||bnbfour.net^$doc,to=~bnbfour.meme
||cyberblast.info^$doc,to=~cyberblast.io
||gz-gmy.com^$all,to=~paxos.com
||mantanetworkcn.com^$all,to=~manta.network
||interface-git-parallel-cypress-uniswap.vercel.app^$doc,to=~uniswap.org
||mode-claim.xyz^$doc,to=~mode.network
||claim-bool.com^$doc,to=~bool.network
||tronlink-walletextension.webflow.io^$all,to=~tronlink.org
||tpro-airdrop.pages.dev^$doc,to=~tpro.network
||claim-wienerdog.com^$doc,to=~wienerdog.ai
||claimable-bankless.com^$all,to=~bankless.com
||pepesunchained.net^$doc,to=~pepeunchained.com
||itrustcapitaalloginn.webflow.io^$all,to=~itrustcapital.com
||secure---sso---robinhood---com-cdn.webflow.io^$doc,to=~robinhood.com
||sso--en--cobo--trsuted-auth.webflow.io^$all,to=~cobo.com
||pepecoinsuper-airdrop.pages.dev^$doc,to=~pepe20.vip
||appmemekombatclaim.pages.dev^$doc,to=~memekombat.io
||testmyaa.pages.dev^$doc,to=~earndrop.io
||claimspaace.pages.dev^$doc,to=~lingocoin.io
||blastairdropclaims.pages.dev^$doc,to=~blast.io
||harambetok-eng.pages.dev^$doc,to=~harambetoken.ai
||rarepepewtf.pages.dev^$doc,to=~rarepepes.com
||miles-plume-network.pages.dev^$all,to=~plumenetwork.xyz
||agentlayer-xyz.pages.dev^$doc,to=~agentlayer.xyz
||pngvnreward.pages.dev^$doc,to=~pngvntoken.com
||trava-dapps.pages.dev^$doc,to=~trava.finance
||web3mainnetdapp.pages.dev^$all
||web3connectfix.pages.dev^$all
||syncwallet.pages.dev^$all,to=~walletconnect.com
! https://infosec.exchange/@urldna/112379049102904534
||azuki-*.vercel.app^$all,to=~azuki.com
! https://infosec.exchange/@urldna/112246221074509842
||base-swap-frontend-*.vercel.app^$doc
! https://urldna.io/scan/66af69831a242fe968f80145
! https://www.virustotal.com/gui/url/c245ab34fb1e8cf41cba99c1fb61dfbfef60d98044ebac3abc65c1b9a150aea4
||final-claim.pages.dev^$doc
! https://urldna.io/scan/66bb2923fc6db4b70d37ece8
! https://www.virustotal.com/gui/url/6bebec722c703a448f14d1650315b534ee785959080537cebada1d6120883763
! https://www.virustotal.com/gui/url/4e1f0d563a121e484113dcf1582323732ce110451f33e939985911c248f19c31
||alienxchain*.pages.dev^$doc,to=~alienxchain.io

! metamask.io
||clinitex.fr/META5KYC/$doc,to=~metamask.io
! https://www.virustotal.com/gui/url/7ef12f181e0c1d09475f2fd51b19b06ff393f4c686abfb89b312cd47447ac7bf
||metamask*.webflow.io^$doc,to=~metamask.io
! https://urldna.io/scan/67854752459acf9a4783a52c
! https://www.virustotal.com/gui/url/cee662e90d9fc49c35fbab24dab21abd84ccf517379594f35fd525f96ecd102e
||keychron.in/wp-includes/certificates/home^$all,to=~metamask.io

! bitvavo
! https://www.virustotal.com/gui/url/745c24c2aa94c7f7f499e025206ae5f6b4a924745cdfe5a236f1b2294d205988
! https://www.virustotal.com/gui/url/6d933508beb9ccdb687fbbda485debca1b600b8fa3144bf4c5aabd8192b6f94e
! https://www.virustotal.com/gui/url/ed82c68f48ab8a115fef0919482e5a7757fe01cd40efd82e409cc5c8acea696d
! https://www.virustotal.com/gui/url/ead9cba1887cf0f63e532da6b5cbb77d8efc1b88a713765bf06448d84d3b08e6
/\.(?:cc|com|top|vip)\/index\/index\/lang\/[a-z]{2}-[a-z]{2}\b/$doc,to=cc|com|top|vip
/index/index/*Trade/tradelist^$doc
||bitvavo*.cc^$doc,to=cc|~bitvavo.com
||bitvavo*.top^$doc,to=top|~bitvavo.com
||bitvavo*.vip^$doc,to=vip|~bitvavo.com
! https://www.virustotal.com/gui/url/2f9becce50774b02440cf2841612005d5f2fad9bc20a59e8b748896290912929
||bitvavo.com.nl.$doc,to=~bitvavo.com

! trustwallet.com
||auth--sso-trust.webflow.io^$all,to=~trustwallet.com

! sky.money
||reward-sky.money^$doc,to=~sky.money

! binance
||bnbc-onay-sayfasi-global.smtp-host.de^$all,to=~binance.com
||dendreonlawsuit.com^$all,to=~binance.com
||binace-epa.com^$all,to=~binance.com
||megadropclaim.com^$all,to=~binance.com

! https://www.virustotal.com/gui/url/baaec2820a40db4dace37d5955dcb9f9db10ea16337b06b8a4a814bb67c27b13
||pub-*.r2.dev/ledge.html^$doc,to=~ledger.com

! magamemecoin.com
||trump-coin1.pages.dev^$doc,to=~magamemecoin.com

! pinksale.finance
||pinksales-pools.pages.dev^$doc,to=~pinksale.finance
||pink-sales.pages.dev^$doc,to=~pinksale.finance
||pink-sale.pages.dev^$doc,to=~pinksale.finance

! coinbase
||baseguardauth.net^$all,to=~coinbase.com
||coinbase-yield.info^$all,to=~coinbase.com
||coinbaseexnsion.webflow.io^$all,to=~coinbase.com
! https://www.virustotal.com/gui/url/35ca5ae411511f7c68dd4297ac19551e0dc2d562572c35234539516970135d61
||koinssendspro.top^$all,to=~coinbase.com
||e-stata.ru/track/1/$all,to=~coinbase.com
! https://www.virustotal.com/gui/url/aad6cef484f8b6f4b186003ec4fe426cf01ea15cea8b668cff7315be7a8f937f
/^https:\/\/(?:[^.]+\.)?\d{6}-coinbase\.com\//$doc,to=com|~coinbase.com
||178368-coinbase.com^$all,to=~coinbase.com
! https://urldna.io/scan/673815d0415af7ad29e1843a
! https://www.virustotal.com/gui/url/e79f7ed84af220f6af9f63754c6802f2d5ba30b0c57199ad159b0626ec1734cb
||llq.rsq.mybluehost.me^$all,to=~coinbase.com
||mybluehost.me/wp-admin/maajoun/$doc,to=~coinbase.com
! https://www.virustotal.com/gui/url/7ded02cc0d6e76dddd81c80c1ee8acd63d01bfc59f82900632ff8e2fde616881
||mail.*-coinbase.com^$doc,to=~coinbase.com

! imtoken
||imtoken.org.cn^$all,to=~token.im
||scszdm.com^$all,to=~token.im
||imtoken-bl.click^$all,to=~token.im
app##center#yangchen > iframe#external-frame[src="https://im136.mom/"]:not([class])

! pancakeswap
||pancak-e-swap.com^$all,to=~pancakeswap.finance
/^https:\/\/pancake(?:dro|swa)pclick\d+\.vercel\.app\//$doc,to=vercel.app|~pancakeswap.finance
||pancakeswap-*.vercel.app^$doc,to=~pancakeswap.finance
||pancake-swap*.vercel.app^$doc,to=~pancakeswap.finance
||pancake-nft*.vercel.app^$doc,to=~pancakeswap.finance
! https://urldna.io/scan/66a4bc168460353814f6213e
! https://www.virustotal.com/gui/url/7528b31829b0fcc71f1ff78c7f2f57511b5a5bda28523f6bf82b80e92c111b21
||pancakeclaim-*.vercel.app^$doc,to=~pancakeswap.finance
! https://urldna.io/scan/674409c3ddfe5e2d40390738
! https://www.virustotal.com/gui/url/33c94f8d107bcdf6bb9c625b3d028193e9727ff537a64887ed092b942bc7b13b
! microsoft.microsoftedge.pancakeswap.finance.expolorer.im
||pancakeswap.finance.expolorer.im^$all,to=~pancakeswap.finance
! https://urldna.io/scan/66a4bc858460353814f62149
! https://www.virustotal.com/gui/url/3af2108517176d42953dbd322c5ba1ad071121986debd4dbe38041700b3037fc
||pancake.run^$all,to=~pancakeswap.finance
! https://www.virustotal.com/gui/url/ef9755fcb211a668986b9afc5187577c92fb8c8bf62057bf9d0b59333827a35a
||pay8-2v-*-gmailcom.vercel.app^$all,to=~pancakeswap.finance

! openphish
||mmitalianbeef.square.site^$all,to=~mmitalianbeef.com
||bigbauer.com^$all,to=~gmx.com
||lkmw88.com^$all,to=~mercadolibre.com
||vangphutai.com^$all,to=~vangphutai.vn
||autoscurt24.de^$all,to=~autoscout24.de
||hk668.cc^$all,to=~yahoo.com
||dc.tensgpt.com^$all,to=~discord.com
||carrefour-enbacktoschool4.pages.dev^$all,to=~carrefour.com
||sacolamobile.influenciadormagalu.com.br^$all,to=~sacola.magazineluiza.com.br
||globalgrainsadf.com^$all,to=~globalgrain.us
||vzla-qr.com^$all,to=~usaa.com
||inmotiongmbh.com^$all,to=~in-motion.de
||beluxrepm.followme.fr/FolloWMe$all,to=~realestate.bnpparibas.com
||mybluehost.me/Cope346/$all
||allbikesputte.be/sumconfirm.php/$all,to=~sumup.com
||glitch.me/pdf.html?email=$doc
! https://www.virustotal.com/gui/url/ac091676a63040d2e855eeaabe9e13cc18eadc5f644bd494763edde0270be742
||chattts-49f1.beszyrecala.workers.dev^$all,to=~christianmingle.com
! https://www.virustotal.com/gui/url/51313f8d841a87fbda4029330b190c9e5f4bd4c70646f2a73b10771d677a8ab2
||cursorltd.com^$doc
! https://www.virustotal.com/gui/url/5ff91c73c62cc4bd5af699518d73ecffe9bdd0830c4052e4da1405568495c4df
||cprapid.com^$doc
! https://www.virustotal.com/gui/url/0fded7ccb337703e58ddc34b8a7c89f87fdcb102a543136e434b4f1783d37935
||utahpolicetraining.*.mybluehost.me^$all
! https://www.virustotal.com/gui/url/7d2852015c759596a7be24edf4043c58dc246bfb027a625a4de4d24ed1a81fbc
||mybluehost.me/*/choronopost/$doc,to=~chronopost.fr
! https://www.virustotal.com/gui/url/dd422322662ef1547afcc735850a4a4ee1ae601cb1502701174730f24f4e9ac0
! https://www.virustotal.com/gui/url/5b84e52dfe110a03f08cf7165bd70e003bb45de1a0f0440a0b370b2e2de55421
/^https:\/\/([a-z]-){10,15}[a-z]\.(?:com|net|org)\.tr\//$doc,to=com.tr|net.tr|org.tr
! https://www.virustotal.com/gui/url/ef4d71bf92ccca6f4079f06f4c519e9d21bc45e240ea32a42561b5684a2305da
/views/go/start.php^$doc
! https://www.virustotal.com/gui/url/09b11b4c345be67d2e7659fa2f1d1c07a000bc3cebbbbed17e891865a355d07e
/^https:\/\/pub-[a-f0-9]{32}\.r2\.dev/be[a0-9]\d{2,3}\.html\b/$doc,match-case,to=r2.dev
! https://www.virustotal.com/gui/url/f6313df525470be85c52d6b7ec608c212bd3ec8eda8307f210371b221f24612c
||namecheapsupport-*.codeanyapp.com^$all,to=~namecheap.com
! https://www.virustotal.com/gui/url/533a27da14f888f81e8afad084a17a7e1b2dd574cd90b869b21c993283862927
! https://www.virustotal.com/gui/url/f3bf8c53016b9b45de66415c7d948cd79c8f2d83b270e7135b21056fc7479b5d
||mybluehost.me/vcd/$doc
||kvv.jxc.mybluehost.me^$doc
! https://www.virustotal.com/gui/url/484243c62c486e1c6b6544028fa5b1e30c1643fea446e5d89e6912d132e04b22
||web-interface.eu^$doc
! https://www.virustotal.com/gui/url/ec321ee03c2a6081a48bdfb72bd8e3995f8fd79e2a253a5cb8f79026d4c1d940
||mybluehost.me/servizi/assistenza/$doc
! https://www.virustotal.com/gui/url/95d15ded75c863d83ec7a52e0039975f826a95a41e4c9e5f5716e3526c61fb26
||mybluehost.me/wise/number-account-$doc
! https://www.virustotal.com/gui/url/034cc004f078ee24b7f4377283d50d128f547de4339a51c8e29a8f8e36272b13
||smrturl.co/o/*/53458494^$doc
! https://www.virustotal.com/gui/url/e67f0541ea51baa725f5d46407f919246af360cf78bc40e0c17cba5ffbc39764
||agripro-fr-*.com^$doc,to=~agriaffaires.com
! https://www.virustotal.com/gui/url/df55aa990ceb6b188ea2bc71d8c53d5543ef819ff6980441733c47aab107ba03
||notifyhubss.net^$doc
! https://www.virustotal.com/gui/url/1a661786267f134f0db0e0c38c8a943b761fdc3024dfd83292bd92f5b87790db
||aolmaiillogin.blogspot.$doc
! https://www.virustotal.com/gui/url/93d0fd19d0ee6dec3c47f9cb2eea7aae77866dcefe75c4fae0f3a9e6d46a8be7
||afflatus.consulting/deutschepost/$all
! https://www.virustotal.com/gui/url/abdf1f3f732db10decfd52dac12a827777744b05c6fdcfb5b9cf2beea87bb3b5
||drcolomo.com^$doc
! https://www.virustotal.com/gui/url/08707db7f603d7f6c28ec7f2c00bd999637a21d685b102842a355581cb317408
||konopslski.top/robot/$doc
! https://www.virustotal.com/gui/url/0342f75ca1638cd23da5969237102207799c8b9d0f27935db9bec3c1e73603fc
||info-espanol-id-configes*.codeanyapp.com^$all
||codeanyapp.com/dgte/$doc
! https://www.virustotal.com/gui/url/9c2f9548f9c46df8806b6fe7f75154fab6ad25508379e762c73c7d1f7d703555
||lcldetecthumainweb*.firebaseapp.com^$all
! https://www.virustotal.com/gui/url/a187aca9b762ddf1572d5049d20892e25b274b3809e0db93b001826d60b3d8dc
||freewebhostmost.com/consegna-pacchi/avviso/$doc
! https://www.virustotal.com/gui/url/d5d4656684e01ec70403cb9623c2045239f3ceccdfaa76d64370fd3ef442e9c5
||appinstallcheck.com^$all
! https://www.virustotal.com/gui/url/29c19a57930bd821bfb1b584240745cedfbced9d18b09f84ae7215d112bf6957
||copeescan.es^$all
! https://www.virustotal.com/gui/url/8edceca45507386df4d12d9d3812f3847db87333c10cabe35f82ae84635924f0
||gellyte.es^$all
! https://www.virustotal.com/gui/url/489f451f1e42d3bf60b3736cd04d836d6f798cd1adb3232f90fc752d04afd878
||allegro*/aukcja/$doc,to=buzz|icu|shop
! https://www.virustotal.com/gui/url/3ff7013630ec52ca97ead99e456af477f027dbb7fb75a529536c35714d91d8d7
||shop/au/uqmobile^$doc
! https://www.virustotal.com/gui/url/9c79f4b2c668cfb077990b88fd4c79d46cb23a989293d6de5e72fcd4d6e02b48
/^https?:\/\/[-a-z]{4,}\.(?:com|org)[-.][-a-z]{2,}\.(?:cc|top|vip|world|xin)\/pay\b/$doc,match-case,to=cc|top|vip|world|xin
/^https?:\/\/[-a-z]{4,}\.(?:com|org)[-.][-a-z]{2,}\.(?:cc|top|vip|world|xin)\/us\b/$doc,match-case,to=cc|top|vip|world|xin
! https://www.virustotal.com/gui/url/8dacd7644def349c4f653861107b1ae465689e42b2195756e5a7606d27a5f5ae
||secure.*.win/pay^$doc,to=win
! https://www.virustotal.com/gui/url/c9d0ddc98f30109abf93eccb33297b72b1bb87867961ad92ed7b80ebd831d20e
||shimura-china.com^$all

! docusign.com
||signature-rho.vercel.app^$all,to=~docusign.com
! https://urldna.io/scan/66acf1d95524ec1c98282e3f
! https://www.virustotal.com/gui/url/ac02b390f9ea3f865b7fb2148e42c48c7fe0c51b6c7f868ad7f762a44e463a39
||f1nancier.com^$doc
! https://www.virustotal.com/gui/url/6e9187f7fd43794da064ee58f10f92f1f2b43dd968fcc3f5b915b680f5f61d07
||pub-*.r2.dev/alt_type.html^$doc,to=~docusign.com
||pub-*.r2.dev/auth_gen.html^$doc,to=~docusign.com
||pub-*.r2.dev/auth_response.html^$doc,to=~docusign.com
||pub-*.r2.dev/auth_start.html^$doc,to=~docusign.com
||pub-*.r2.dev/DocuSign.html^$doc,to=~docusign.com
||pub-*.r2.dev/doc_start.html^$doc,to=~docusign.com
||pub-*.r2.dev/dse_sign.html^$doc,to=~docusign.com
||pub-*.r2.dev/response_start.html^$doc,to=~docusign.com
||pub-*.r2.dev/response_type.html^$doc,to=~docusign.com
||pub-*.r2.dev/secure_response.html^$doc,to=~docusign.com
||pub-*.r2.dev/traffic.html^$doc,to=~docusign.com
||pub-*.r2.dev/utility_base.html^$doc,to=~docusign.com
||pub-*.r2.dev/docuss_3456787654324567897865433456789.html^$doc,to=~docusign.com
! https://urldna.io/scan/674d19c2f8fa42d3049b4db3
! https://www.virustotal.com/gui/url/a9f87f6daa95d251cf5102e33caedc158d636bb4df8bf1f3009f524b4c2c930b
! https://www.virustotal.com/gui/url/4f19f27cd1a1d6184dae8450a7c39b5b6fbdb0721111bc6d7bd7ae175b2aee46
||pub-*.r2.dev/gatewaymyoffice.html^$doc,to=~docusign.com
||s3.amazonaws.com/*_singlesigninh.html^$doc

! https://khonggianmang.vn/uploads/2023_CBT_46_3d412a8a49.pdf
||vieclamlazada.vn^$all,to=~lazada.vn

! https://khonggianmang.vn/uploads/2023_CBT_47_01103e7ccb.pdf
||didongvietstore.com^$all,to=~didongviet.vn

! https://khonggianmang.vn/uploads/2023_CBT_48_4807790772.pdf
||tin-dung-$doc
||khcn-tindung-$doc
||viettelgroup.com^$all,to=~viettel.com.vn

! https://khonggianmang.vn/uploads/2023_CBT_50_f8da1fd477.pdf
||khach-hang-the-$doc

! https://khonggianmang.vn/uploads/2024_CBT_09_4c59decfba.pdf
||chamsockhachhang-$doc

! https://khonggianmang.vn/uploads/20240412_BCT_03_2024_V1_f9a4a7619c.PDF
! /^https:\/\/hdsaison-?[a-z]{2,}\.(?:cc|com|vip)\//$doc,to=cc|com|vip|~hdsaison.com.vn
/^https?:\/\/dienmayxanh[-a-z0-9]+\.com\//$doc,to=com|~dienmayxanh.com
/^https:\/\/dich-vu(?:-[a-z0-9]+){2,3}\.com\//$doc,to=com
/^https:\/\/zla\d{3}\.top\//$doc,to=top|~tiki.vn
||cskh-vib-$doc
||cskh-vib.$doc
||chamsockhachang-$doc
||chamsocthekhachang-$doc
||nang-cap-$doc
||hdsaison-$doc,to=cc|vip|~hdsaison.com.vn
||dichvucong.$doc,to=~gov.vn
||tikimall.$doc,to=tikimall.*|~tiki.vn
||taikhoanvps.com.vn^$all,to=~vps.com.vn
||motaikhoanchungkhoanvps.com^$all,to=~vps.com.vn
||zla963.top^$all,to=~tiki.vn

! https://khonggianmang.vn/uploads/20240502_BCT_04_2024_V2_1_a0c95c1f96.pdf
||clzl.pro^$all,to=~momo.vn

! https://khonggianmang.vn/uploads/2024_CBT_21_c7d8f95f66.pdf
||tpbankvn.workplace.com^$all,to=~tpb.vn

! https://khonggianmang.vn/uploads/2024_CBT_22_26eef5509b.pdf
/^https:\/\/da\d{4}\.com\//$doc,to=com|~lazada.vn
/^https:\/\/tdk[det]0[0-9]\.com\//$doc,to=com|~tiki.vn
||da6555.com^$all,to=~lazada.vn
||soppe68.$all,to=~shopee.vn

! https://khonggianmang.vn/uploads/2024_CBT_23_cdbc1a35e4.pdf
/^https:\/\/(www\.)?sp\d{4,5}p\.com\//$doc,to=com|~shopee.vn

! https://khonggianmang.vn/uploads/2024_CBT_25_32ceacddc3.pdf
||vib-*.com^$doc,to=com|~vib.com.vn
||vib-*.shop^$doc,to=shop|~vib.com.vn
||binhchoncuocthivetranhsinhvien2024.weebly.com^$all

! https://khonggianmang.vn/uploads/2024_CBT_26_3710292cc3.pdf
||vn156475p.com^$all

! https://khonggianmang.vn/uploads/2024_CBT_28_97c3eaa00a.pdf
||nze98582s.com^$all,to=~shopee.vn

! https://khonggianmang.vn/uploads/20240701_BCT_06_2024_V4_48f8dba76d.PDF
||uudai-tructuyen-$doc

! https://khonggianmang.vn/uploads/2024_CBT_27_5b8aa10967.pdf
||uudaikhachhang-$doc
||nang-hang-$doc
||mojgov.weebly.com^$all,to=~moj.gov.vn
||chinhphu.cc^$all,to=~chinhphu.vn
||lapdatinternet.net^$all,to=~sctv.com.vn

! https://khonggianmang.vn/uploads/2024_CBT_29_32b001d150.pdf
||hethongnhanvien.com^$all,to=~lazada.vn
||baovietcom.vip^$all,to=~baovietbank.vn
||hethongvaynhanh247.com^$all
||bethivetranh2024.weebly.com^$all
! https://www.virustotal.com/gui/url/7f02e45eca07e7e20dc88acf94a0403f02c5096f1ad128fd111c50e19bb63d76
||momoshopvip.com^$all,to=~momo.vn

! https://khonggianmang.vn/uploads/2024_CBT_31_7548fefc87.pdf
||baovietn.vip^$all,to=~baovietbank.vn
||govn.cc^$all,to=~gov.vn
||baoviet.vip^$all,to=~baovietbank.vn
||baoviet*.vip^$doc,to=vip|~baovietbank.vn

! https://khonggianmang.vn/uploads/20240701_BCT_07_2024_bcab9d2e82.pdf
||mmb-online.com^$all,to=~mbbank.com.vn
||soppe86.life^$all,to=~shopee.vn
||nhanvientiki.org^$all,to=~tiki.vn
||iazada.com^$all,to=~lazada.vn

! https://khonggianmang.vn/uploads/2024_CBT_32_7b55a3e3fc.pdf
||hotrokhachhang-$doc
||cham-soc-the-$doc
||baovietvay.top^$all,to=~baovietbank.vn
||taichinheximbak.com^$all,to=~eximbank.com.vn
||tikinew.club^$all,to=~tiki.vn
||pddgov.cc^$all,to=~gov.vn
||vssid.*.cc^$doc,to=~baohiemxahoi.gov.vn
||kbthuhoivontreo.com^$all,to=~vst.mof.gov.vn

! https://khonggianmang.vn/uploads/2024_CBT_33_e01257ffdd.pdf
||sendotv.shop^$all,to=~sendo.vn
||vnsendotv.vip^$all,to=~sendo.vn
||sdfsshop1.com^$all,to=~tiki.vn
||tikivn84.com^$all,to=~tiki.vn
||snggov.com^$all,to=~gov.vn
||vn-eid.com^$all,to=~dichvucong.gov.vn

! https://khonggianmang.vn/uploads/2024_CBT_34_cf5513cd5e.pdf
/^https:\/\/nz[a-z]\d{5}s\.com\//$doc,to=com|~shopee.vn
||558-558-559.com^$all,to=~shopee.vn
||nzx65821s.com^$all,to=~shopee.vn
||congtygiaohangtietkiemvn.com^$all,to=~giaohangtietkiem.vn

! https://khonggianmang.vn/uploads/2024_CBT_35_86bfef4e1e.pdf
||hethongnoibo.bio.link^$all,to=~lazada.vn
||sendovn.shop^$all,to=~sendo.vn
||vnpttechnology.weebly.com^$all,to=~vnpt.com.vn
||baovietvc.top^$all,to=~baovietbank.vn
||baoviet*.top^$doc,to=~baovietbank.vn
||nhanvienghtk.com^$all,to=~giaohangtietkiem.vn
||giaohangtietkiem247.*^$all,to=giaohangtietkiem247.*|~giaohangtietkiem.vn

! https://khonggianmang.vn/uploads/2024_CBT_36_d1b5aaea0a.pdf
||tienichshiinhan.com^$all,to=~shinhan.com.vn
||govqp.com^$all
||org.govqp.com^$all,to=~vr.org.vn

! https://khonggianmang.vn/uploads/2024_CBT_38_1dc220bba1.pdf
||ebayu.top^$all
||svgov.cc^$all,to=~gov.vn
||bcavnvnvngov.com^$all,to=~bocongan.gov.vn
||hangtietkiem.online^$all,to=~giaohangtietkiem.vn

! https://khonggianmang.vn/uploads/20241004_BCT_09_2024_DN_PDF_7dbc4574fe.pdf
||vamcvn.org^$all,to=~sbvamc.vn

! https://khonggianmang.vn/uploads/2024_CBT_41_2e21dc3d54.pdf
||uudauthekhachhanh-$doc
||chamsocthe-$doc
||amazoul.xyz^$all
||soyte.cc^$all
||dichvudienmay-xanh.online^$all,to=~dienmayxanh.com
||fasebook.com.vn^$all
||giaohangtietkiemvn.website^$all,to=~giaohangtietkiem.vn
||thuongmai-dientu.com^$all,to=~lazada.vn
||tiki886.vip^$all,to=~sendo.vn
||jetkingncsc.com^$all,to=~ncsc.gov.vn
||vieegovn.cc^$all,to=~gov.vn

! https://khonggianmang.vn/uploads/2024_CBT_42_d70d7fd1fb.pdf
||ccty-ghtk.com^$all,to=~giaohangtietkiem.vn
||thongtincancuoc.com^$all,to=~chinhphu.vn
||vietcp.com^$all,to=~dichvucong.gov.vn
||ccbcavn.cc^$all,to=~gov.vn

! https://khonggianmang.vn/uploads/2024_CBT_43_c3bec6c039.pdf
/^https:\/\/amazon[a-z]\d\.com\//$doc,to=com
||amazoul.site^$all
||amazoni2.com^$all
||dienlanhdienmayxanhvn.com^$all,to=~dienmayxanh.com
||sendo1.com^$all,to=~sendo.vn
||evnnpcs.com^$all,to=~evn.com.vn

! https://khonggianmang.vn/uploads/2024_CBT_44_c16e3ef30d.pdf
||cskhtructuyen-$doc
||shopamzselling.com^$all
||brvgov.com^$all
||clash-flow-loan.com^$all,to=~bocongan.gov.vn
||vnairlines.net^$all,to=~vietnamairlines.com
||giaohangtietkiem-cskh.com^$all,to=~giaohangtietkiem.vn
||lazada.ac^$all,to=~lazada.vn
||tb88789.com^$all,to=~shopee.vn
||tikione.vip^$all,to=~tiki.vn
||tikifreeship.$all,to=~tiki.vn

! https://khonggianmang.vn/uploads/2024_CBT_45_94e8b27e5a.pdf
||tiktok-svip*.com^$all,to=~tiktok.com
||evaluatetravels.com^$all,to=~traveloka.com
||ocbcccreonline.com^$all,to=~ocb.com.vn
||vimoney.credit^$all,to=~mbbank.com.vn
||evnsp.com^$all,to=~evn.com.vn
||evnsspc.com^$all,to=~evn.com.vn
||sellings-global.com^$all
||zvogo.com^$all
||wrgov.com^$all,to=~gov.vn
||vn-chinhphu.com^$all,to=~dichvucong.gov.vn

! https://khonggianmang.vn/uploads/2024_CBT_46_3a94e9ec2e.pdf
||khach-hang-$doc
||nhantienquocte*.vercel.app^$doc
||applecenter.info.vn^$all
||mmmbonline.com^$all,to=~mbbank.com.vn
||iplus-fianc24h.online^$all,to=~mbbank.com.vn

! https://khonggianmang.vn/uploads/2024_CBT_47_e86306b303.pdf
/^https:\/\/giaohangtietkiem\w+\.com\//$doc,to=com|~giaohangtietkiem.vn
||khuyenmaidacbiet-$doc
||uudaidacbiet-$doc
||evnspccskh.com^$all,to=~evn.com.vn
||shb-bank.com^$all,to=~shb.com.vn
||aeoonmallstore.com^$all,to=~aeon.com.vn
||nhanvienhanghoa.com^$all,to=~giaohangtietkiem.vn
||dichvutonghop.vip^$all,to=~giaohangtietkiem.vn
||giaohangtietkiem24.com^$all,to=~giaohangtietkiem.vn

! https://khonggianmang.vn/uploads/20250602_BCT_01_2025_v1_5fb3de74c1.pdf
/^https?:\/\/amazo[a-z]{2}\d\.com\//$doc,to=com|~amazon.com
||amazoni1.com^$all
||amazouo9.com^$all
||amzzcbe-cme.com^$all
||amz-dropshipping.com^$all
||vietchinhphux.com^$all,to=~dichvucong.gov.vn
||vnchinhphu.cc^$all,to=~dichvucong.gov.vn
||dichvucongvnbca.com^$all,to=~dichvucong.gov.vn
||congthongtinanninhmang.com^$all,to=~bocongan.gov.vn
||cucanninhmang24h.com^$all,to=~bocongan.gov.vn
||kiemtragplx.vn^$all,to=~mt.gov.vn
||ctygiaohangtietkiemm1.com^$all,to=~giaohangtietkiem.vn

! https://web.archive.org/web/20240917130138/https://social.immibis.com/notice/AjwiBkDIwtyORTzsAq
||bensonmarketing.msk.su^$all

! https://social.immibis.com/notice/Ajz20OCipGbiOZVVaK
||bleyeare.com^$all
||hberify.com^$all
||fo4nz.com^$all
||ciaberibu.com^$all
||holancha.com^$all

! https://social.immibis.com/notice/Ajz23VfnVrXgQdaxCS
||glysinew.com^$all
||conackmar.com^$all
||abducke.com^$all
||gstoran.com^$all
||insonoban.com^$all
||bughter.com^$all

! https://social.immibis.com/notice/Ak0oAfQ2fMsvdjfEBs
||dulge9.com^$all
||rcestershir.com^$all
||ouseptu.com^$all
||uresnaus.com^$all
||orundompes.com^$all
||iteparyleb.com^$all
||ermogel.com^$all
||ndinast.com^$all

! https://social.immibis.com/notice/Ak34ZeLTmXsX8HNsy8
||ontrical.com^$all
||etensiten.com^$all
||opgandi.com^$all
||matectord.com^$all
||congbac.com^$all
||oetsont.com^$all
||ofereome.com^$all

! https://social.immibis.com/notice/Ak75ZTvJPMLpOaT5M0
||talcopur.com^$all
||hanorid.com^$all
||orawakle.com^$all
||ellifluo.com^$all
||ebortbide.com^$all

! https://social.immibis.com/notice/AkDtb9o5KiCiEzq7tY
||ioncibria.com^$all
||sishedra.com^$all
||legropth.com^$all
||mandalveca.com^$all

! https://social.immibis.com/notice/AkFwNfc6y2el0qQ4eG
||gataterso.com^$all

! https://social.immibis.com/notice/AkI3VG5OqmGc9UbWl6
||newreuti.com^$all
||halowasus.com^$all
||iquitorr.com^$all
||moncelork.com^$all
||amboya6.com^$all
||anathemv.com^$all
||eangetar.com^$all

! https://social.immibis.com/notice/AkOGSQnt0jj4sM9cps
||adobedownloader.info^$all
||opiumundi.com^$all
||mirtiat.com^$all
||lernehat.com^$all

! https://social.immibis.com/notice/AkWaR4uBPlljkbZsGG
||endrowl.com^$all
||xceteu.com^$all
||ripliguay.com^$all

! https://social.immibis.com/notice/AkYdomVW9oFnorxFNw
||pelastorl.com^$all
||usecurter.com^$all
||vb09cl.com^$all
||iscidine.com^$all

! https://social.immibis.com/notice/AknDmYT7hMGsGNVl5M
||ny4yze.com^$all
||tickovent.com^$all
||aphenunci.com^$all

! https://social.immibis.com/notice/AkopNrn6iDJgMoTPH6
##html[lang] > body.startnew > div#sections > section#section_uname
||sichogyp.su^$all
||orownsdow.com^$all
||identente.com^$all

! https://social.immibis.com/notice/Akt1pxOHSkHXvMrTTk
||datumdellago.com^$all
||lokuracristiana.com^$all
||clinicaimplantologica3d.com^$all
||gruposabar.com^$all
||xalatlaco.org^$all
! https://www.virustotal.com/gui/url/7761b06fcec8382fade116ee7e4bcfa4f654c42e132629c82a3781ce0640c8cc
||r2.dev/INV-CHKCOPY-Remittance-Overpayment%20Refund$doc

! https://social.immibis.com/notice/AkvRQJ3fGcfeihZGk4
##html[lang] > body:not([style]) > div.captchaBody
||cam/secured/host/*.php|$xhr,3p,domain=r2.dev
||implarededeensino.com.br^$all
||vertiselevadores.com.br^$all
! https://www.virustotal.com/gui/url/0198904efc817234dda14b543a3644473d65939aef0bb7b87c912ca063869f9b
||r2.dev/Outlook%20Secured%20Document$doc

! https://social.immibis.com/notice/AkwoyOsqbfJIjlh7GC
! https://urldna.io/scan/679e4fbadfbd87ce7437f173
! https://www.virustotal.com/gui/url/26646f2c4dcf3184642d13ed89cbf9dfc28b4d09a089ef7b55904ae9c0da9785
! https://www.virustotal.com/gui/url/958a09b666417db11ddeed57e7fd829e19669623cb5ed35e3342e7e6490150bd
/^https:\/\/[a-z0-9]{2,}\.[a-z0-9]{4,11}\.com\/[a-zA-Z0-9]{30,}\?[a-zA-Z0-9]{25,}$/$doc,to=com|~google.com|~microsoft.com
/^https:\/\/[a-z0-9]{2,}\.[a-z0-9]{4,11}\.ru\/[a-zA-Z0-9]{30,}\?[a-zA-Z0-9]{25,}$/$doc,to=ru
/^https:\/\/[a-z0-9]{2,}\.[a-z0-9]{4,11}\.su\/[a-zA-Z0-9]{30,}\?[a-zA-Z0-9]{25,}$/$doc,to=su
! microsoft
||chervindi.com^$all
||grahurgum.com^$all
||liverun0.com^$all
||ephemeral9.com^$all
||hocklahro.ru^$all
||tinjudish.ru^$all
||intended9.com^$all
||aging3.co^$all
! google
||arciansi.su^$all

! https://www.reddit.com/r/phishing/comments/1fxvrn0/boys_girls_clubs_of_southeast_virginia_proposal/
/^https:\/\/[a-z0-9]{50,}\.[a-z0-9]{4,11}\.com\/[a-zA-Z0-9]{50,}$/$xhr,3p,method=get,to=com|~google.com|~microsoft.com,from=com|ru|su
/^https:\/\/[a-z0-9]{50,}\.[a-z0-9]{4,11}\.ru\/[a-zA-Z0-9]{50,}$/$xhr,3p,method=get,to=ru,from=com|ru|su
/^https:\/\/[a-z0-9]{50,}\.[a-z0-9]{4,11}\.su\/[a-zA-Z0-9]{50,}$/$xhr,3p,method=get,to=su,from=com|ru|su
|https://*.favoripirlanta.com^$doc
||amernamproa.com^$all
||tivorica.su^$all
||xylentura.su^$all

! https://www.malwarebytes.com/blog/threat-intelligence/2024/03/new-go-loader-pushes-rhadamanthys
! https://safeweb.norton.com/report/show?url=https:%2F%2Farnaudpairoto.com%2F
! https://otx.alienvault.com/indicator/domain/arnaudpairoto.com
! https://www.virustotal.com/gui/url/ec3d5edf4b9db60d4a4057757d820361c850dd355dd21e929c57bc55e54f7517?nocache=1
||puttyconnect.info^$all
||astrosphere.world^$all

! https://www.reddit.com/r/Scams/comments/1bv6nyh/is_this_a_real_facebook_link/
! https://www.virustotal.com/gui/url/dec6d9d61fd01d20623f190e52acccf2bef004ec1cd11324efa93e70d417a1b5
! https://www.urlvoid.com/scan/marketplace-item-352983165488.000.pe/
||marketplace-item-*.000.pe^$doc

! https://www.bitdefender.com/blog/labs/ai-meets-next-gen-info-stealers-in-social-media-malvertising-campaigns/
! https://www.reddit.com/r/uBlockOrigin/comments/1dcnc7u/my_website_is_flagged_as_badware_risks_by_ubo/
! https://github.com/uBlockOrigin/uAssets/issues/24134
! /^https:\/\/(?:ai|art|get)?-?midjourney(?:s|ai)[^\/]+\//$doc,to=~midjourney.com|~edu|~gov
! /^https:\/\/(?:ai|art|get)-?midjourney[^\/]+\//$doc,to=~midjourney.com|~edu|~gov
! /^https:\/\/(?:ai|art|get)-midjourney[^\/]+\//$doc,to=~midjourney.com|~edu|~gov
||ai-midjourney*.$doc,to=~midjourney.com|~edu|~gov
||art-midjourney.$doc,to=~midjourney.com|~edu|~gov
||get-midjourney.$doc,to=~midjourney.com|~edu|~gov
||mid-journey.$doc,to=~midjourney.com|~edu|~gov
||aimidjourney.$doc,to=~midjourney.com|~edu|~gov
||aimidjourneys.$doc,to=~midjourney.com|~edu|~gov
||getmidjourney.$doc,to=~midjourney.com|~edu|~gov
||midjourneys.$doc,to=~midjourney.com|~edu|~gov
||midjourney.co^$all,to=~midjourney.com
||midjourneysai.us^$all,to=~midjourney.com
||midjourneyais.us^$all,to=~midjourney.com

! https://blog.talosintelligence.com/coralraider-targets-socialmedia-accounts/
! https://www.virustotal.com/gui/url/4084d02e0b9a73221be4a32e853f87471ca45c5a80f8c7e461e640e025503512
! https://safeweb.norton.com/report/show?url=runningapplications-b7dae-default-rtdb.firebaseio.com
! https://otx.alienvault.com/indicator/domain/runningapplications-b7dae-default-rtdb.firebaseio.com
||runningapplications-b7dae-default-rtdb.firebaseio.com^$all

! https://www.malwarebytes.com/blog/threat-intelligence/2024/04/active-nitrogen-campaign-delivered-via-malicious-ads-for-putty-filezilla
||kunalicon.com^$all
||recovernj.com^$all

! https://baochinhphu.vn/canh-bao-mot-so-website-gia-mao-lua-dao-nguoi-dung-internet-can-tranh-102240219171043932.htm
||vuabem.com^$all

! https://www.virustotal.com/gui/url/5df7c4ecaa01f24d8ccfdac5be4c0eb09a0a49c705e6b1bcfebd50f261fa5174
! https://www.virustotal.com/gui/url/70b03a18e67dfc8ae8b93c16e69c0046223cf8e312aa8f4f655e6e1498797493
! https://safeweb.norton.com/report/show?url=magicslimnhatban.com
! https://safeweb.norton.com/report/show?url=giamcannhatban.com
! https://www.urlvoid.com/scan/magicslimnhatban.com/
||magicslimnhatban.com^$all
||giamcannhatban.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/23674
||examated.co.in^$doc

! https://www.virustotal.com/gui/file/cbc37be64bbe194d3e06da6048f0db712bf8f323f78222f4265604d609fee325
! https://www.virustotal.com/gui/file/d5a0a28b2a8e97c24f12595833a0663e904e750149eb64b8b9a17f9758a5c966
! https://www.virustotal.com/gui/file/ca6d7147f4d2489bb06c9b6590ee9939c3c65165c2d584f1881d00a587fc4ce4
||github.com/linarweloper/Blumfarmbot^$doc

! https://www.cyberdaily.au/security/10614-vigilante-hacks-scam-call-centre-proceeds-to-warn-victims
||waredot.com^$doc
||waredot.us^$doc

! https://www.reddit.com/r/uBlockOrigin/comments/1djhn6p/ubo_lite_missed_some_ads/
/l/DMP_captcha_for_vpn?$all

! https://github.com/uBlockOrigin/uAssets/issues/24189
||kmspico.*^$doc,to=kmspico.*
||kmspico-$doc
||kms-full.com^$doc
||kmspico.io^$doc
||kms-tool.com^$doc
||kmsauto.tech^$doc
||kmsautodown.space^$doc
||gpstracker.site^$all
||kmsauto.org^$doc
||furykms.com^$doc
||ativadorkmspico.com^$doc
||get-kmspico.com^$doc
||getkmspico.com^$doc
||kmspico10.com^$doc
||kmspicoactivator.net^$doc
||kmspicoofficial.com^$doc
||kmspicoportable.com^$doc
||officialkmspico.com^$doc
||oficial-kmspico.com^$doc

! https://github.com/uBlockOrigin/uAssets/pull/18388
! https://github.com/uBlockOrigin/uAssets/pull/23643
! https://www.forbes.com/sites/jacksonweimer/2021/04/10/that-twitter-family-tree-trend-is-secretly-following-random-accounts--without-your-consent
||roundyearfun.org^$all
||roundyearfun.com^$all
||twitter-circle.com^$all
||funxgames.me^$all
||infinitytweet.me^$all
||infinitytweet.com^$all
||infinityweet.me^$all
||infinityweet.com^$all

! https://github.com/uBlockOrigin/uAssets/pull/24255
! https://sansec.io/research/polyfill-supply-chain-attack
! https://www.bleepingcomputer.com/news/security/polyfillio-javascript-supply-chain-attack-impacts-over-100k-sites/
! https://www.bleepingcomputer.com/news/security/polyfillio-bootcdn-bootcss-staticfile-attack-traced-to-1-operator/
! https://www.v2ex.com/t/950163
! https://www.silentpush.com/blog/triad-nexus-funnull/
||googie-anaiytics.com^$all
||bootcdn.net^$all
||bootcss.com^$all
||staticfile.net^$all
||staticfile.org^$all
||xhsbpza.com^$all
||union.macoms.la^$all

! https://x.com/Polyfill_Global/status/1809122842145141114
! https://github.com/uBlockOrigin/uAssets/pull/24434
||polyfill.top^$all
! https://github.com/uBlockOrigin/uAssets/pull/25087
||polyfill-js.cn^$all

! https://github.com/uBlockOrigin/uAssets/issues/24248
||veilcurtin.world^$doc
||midnightsociety-x.com^$doc
||2d45b3cf2299d8ba038f45cb38aca4f2ecfbcb8d264ba28432ae5c51.com^$doc

! https://github.com/uBlockOrigin/uAssets/issues/24262
||get-express-vpn.online^$all,to=~expressvpn.com

! https://github.com/uBlockOrigin/uAssets/issues/24323
! https://www.virustotal.com/gui/url/f355d4d12f50be515284fc97096bad1f093194efe21fd7420c4446ae20def74a
! https://transparencyreport.google.com/safe-browsing/search?url=joannclearances.com
! https://safeweb.norton.com/report/show?url=joannclearances.com
! https://www.urlvoid.com/scan/joannclearances.com/
! https://www.scamadviser.com/check-website/joannclearances.com
! https://www.scam-detector.com/validator/joannclearances-com-review/
||joannclearances.com^$all,to=~joann.com
! https://github.com/uBlockOrigin/uAssets/issues/25075
||joannstoressales.shop^$all,to=~joann.com
! https://github.com/uBlockOrigin/uAssets/issues/25077
||joannmax.com^$doc,to=~joann.com
! https://github.com/uBlockOrigin/uAssets/issues/25083
||joannoutlet.com^$all,to=~joann.com

! https://github.com/uBlockOrigin/uAssets/issues/24390
! https://github.com/hagezi/dns-blocklists/issues/3163#issuecomment-2229056638
||pcapp.store^$doc
||convertwithwave.com^$doc
||withsecurify.com^
||securifyguard.com^
||getsecurify.com^

! https://github.com/uBlockOrigin/uAssets/issues/24421
||highwaycpmrevenue.social-previews.top^$all,to=~image.io
||clicksocialimage.top^$all,to=~image.io

! https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/facebook-malvertising-epidemic-unraveling-a-persistent-threat-sys01/
! https://www.virustotal.com/gui/file/02b336b42d4d80ed17bf255536ecdf3d28db51bc81cc17926dee458e61f092e5
! https://www.virustotal.com/gui/url/ff01e9e3d9b91835d34ba457e2714f407acca9bf14b486b55fd9e6d6c27286f0
! https://www.virustotal.com/gui/url/14cc314140e3441870cfc94908ca49175f70bd7eca6781cd8041b16889d21452
||blue-softs.com^$all
||softs-download.com^$all
||iemcan.com^$all
||hvacpartstechnician.com^$all
||pmequebeclic.com^$all
||sirokataldea.com^$all
||sites.google.com/view/blue-softs^$all
||sites.google.com/view/xtaskbar-themes^$all
||sites.google.com/view/newtaskbar-themes^$all
||sites.google.com/view/awesome-themes-desktop^$all
||sites.google.com/view/taskbar-themes^$all
||sites.google.com/view/ai-image-3d^$all
||sites.google.com/view/taskbar-themess^$all
||sites.google.com/view/softs-download^$all
||sites.google.com/view/sora-ai-v2^$all
/^https:\/\/[a-z]{6,19}\.(?:com|net)\/js\?t=[_a-z0-9]+&ns=[a-z]{2}$/$script,3p,strict3p,match-case,to=com|net
/^https:\/\/[a-z]{6,19}\.(?:com|net)\/(?:static_)?file\/\?t=[_a-z0-9]+&ns=[a-z]{2}$/$frame,popup,3p,strict3p,match-case,to=com|net
/^https:\/\/[a-z]{6,19}\.(?:com|net)\/(?:static_)?file\/\?t=[_a-z0-9]+&ns=[a-z]{2}$/$doc,match-case,to=com|net

! https://github.com/uBlockOrigin/uAssets/issues/24522
||shy-boat-90ce.jiko728928922.workers.dev^$doc,to=~uniswap.org
||uniwspapp.com^$all,to=~uniswap.org
||app.corn-staging.com^$all,to=~uniswap.org

! https://community.bolster.ai/t/crowdstrike-look-alike-domains-list/217
||crowdstrikebluescreen.com^$doc
||crowdstrike0day.com^$doc
||crowdstrikedoomsday.com^$doc
||crowdstriketoken.com^$doc
||bsodsm8r.xamzgjedu.com^$doc
||crowdstrike-cloudtrail-storage-bb-126d5e.s3.us-west-1.amazonaws.com^$doc
||crowdstrikeoutage.info^$doc
||microsoftcrowdstrike.com^$doc
||crowdpass.live^$doc
||crowdstrike.life^$doc
||crowdstrikeupdate.com^$doc
||mecrowdstrikesnowstandalone.azurewebsites.net^$doc
||crowdstrikereposify.net^$doc
||crowdstrike-falcon.online^$doc
||crowdstrike-solutions.nl^$doc
||crowdstrikeclaim.com^$doc
||crowdstrikeoutage.com^$doc
||crowdstrikefix.zip^$doc
||crowdstuck.com^$doc
! https://www.bleepingcomputer.com/news/security/fake-crowdstrike-fixes-target-companies-with-malware-data-wipers/
||dropbox.com/*/crowdstrike-hotfix.zip^$all

! https://www.fortinet.com/blog/threat-research/dark-web-shows-cybercriminals-ready-for-olympics
||tickets.website.com.se^$all,to=~tickets.paris2024.org
||ticketsparis24.com^$all,to=~tickets.paris2024.org
||tickets-paris24.com^$all,to=~tickets.paris2024.org
||ticket-paris24.com^$all,to=~tickets.paris2024.org

! https://www.gdatasoftware.com/blog/2024/06/37947-badspace-backdoor
! https://x.com/GroupIB_TI/status/1790230873285242992
||elamoto.com^$all
||kongtuke.com^$all
||egisela.com^$all
||uhsee.com^$all

! https://www.trellix.com/blogs/research/onedrive-pastejacking/
||kostumn1.ilabserver.com^

! https://github.com/uBlockOrigin/uAssets/issues/24698
! https://www.virustotal.com/gui/url/3567cf0ebb6ab1f0cd450a21f7ecbe6c21f13f75a4f5cc0a74644b893cb80f33
! https://safeweb.norton.com/report/show?url=freeadd.me
! https://sitecheck.sucuri.net/results/freeadd.me
! https://note.com/gifted_clover95/n/na707692645ce
! https://note.com/comiciz/n/n0cc2743f61b2
||freeadd.me^$doc
||askfollow.us^$doc
||more-followers.com^$doc
||twitob.com^$doc
||twitterfollowers.site^$doc
! https://github.com/brave/brave-core-crx-packager/pull/957
##html[lang] > body#body > * > div.cv-xwrapper > div.cvc > div.cv-inner
##html[lang] > body#body > * > div.cvh.BlockClicksActivityBusy

! https://github.com/AdguardTeam/AdguardFilters/issues/185242
||bilsevvakfi.org^$doc
||ogrencilerbirligi.com^$doc
||lcwpaketleme.com^$doc
||herkeseuygunisilanlari.com^$doc
||kariyerfirsatin.com.tr^$doc
||cartepak.online^$doc
||aryapaketleme.com^$doc

! https://github.com/uBlockOrigin/uAssets/issues/24779
||hkdk.events/8cjknac3yxdqk4^$all

! https://github.com/uBlockOrigin/uAssets/issues/24832
||xdxg.xyz^$all

! https://github.com/uBlockOrigin/uAssets/issues/24826
||zebg.top^$all

! https://github.com/uBlockOrigin/uAssets/issues/24916
! https://www.virustotal.com/gui/url/a69ac87c4cb253bc4fdee1874d0980807a24de54b1716022f6ecc8a2056e3d5e
/^https:\/\/help\.[a-z]{3,}-x-[a-z]{3,}\.com\//$doc,to=com|~x.com

! https://github.com/uBlockOrigin/uAssets/issues/24952
||chromeweb-authenticators.com^$all
||chromeweb-authenticatr.com^$all

! https://github.com/hagezi/dns-blocklists/issues/3514
! https://github.com/uBlockOrigin/uAssets/issues/25036
||onevanilla.click^$all
||bilbocine.com^$doc
||unionplus-card.click^$doc
||dailysmscollection.org^$doc
||surgecardinfo.click^$doc
||panoramacharter.click^$doc
||mymercy.click^$doc
||marykayintouch.autos^$doc
||direct2hr.click^$doc
||creditcardchase.click^$doc
||alaskasworld.cfd^$doc

! Phishing
! https://github.com/uBlockOrigin/uAssets/pull/25052
||zcxoin.work^$all

! https://bbs.kafan.cn/thread-2272310-1-1.html
! https://github.com/uBlockOrigin/uAssets/pull/25058
||iqpoll.cn^$doc

! https://bbs.kafan.cn/thread-2272726-1-1.html
! https://github.com/uBlockOrigin/uAssets/pull/25062
||zhandouxian.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/25067
! https://www.reddit.com/r/uBlockOrigin/comments/1f2faj4/where_do_i_send_a_phishing_site_to_be_blocked_by/
! https://www.virustotal.com/gui/url/ce9a8cf37fd8617e96d23832915d7bf2f6b2d32b810cf96b0c82eb649c32c854
||tempisite.com^$all

! https://github.com/uBlockOrigin/uAssets/pull/25177
! https://github.com/uBlockOrigin/uAssets/issues/25221
! https://www.virustotal.com/gui/url/54511a44248d675994732236310dd43af00862874726d9d2ace0a53b1da9c275
! https://www.virustotal.com/gui/url/2a0352008de7b5a41de9c97a977bbee85150de3b22f02486a08027ef6636b1aa
/^https:\/\/(?:www\.)?roblox(?:\.com)?\.[a-z]{2}\//$doc,to=roblox.*|~roblox.com

! https://github.com/uBlockOrigin/uAssets/issues/25353
! https://www.urlvoid.com/scan/feather-wallet.org/
||sparrowwallet.net^$doc,to=~sparrowwallet.com
||electrum.is^$doc,to=~electrum.org

! https://unit42.paloaltonetworks.com/rare-phishing-page-delivery-header-refresh/
||tracker.club-os.com^
||onelink.me/*&af_web_dp=$doc
||guide-orientation.tn/go_page.php?$doc
! https://github.com/uBlockOrigin/uAssets/issues/26798
!#if env_mobile
@@||onelink.me/*://app/$doc
!#endif
! https://github.com/AdguardTeam/AdguardFilters/issues/199381
@@||toss.onelink.me/*service.toss.im$doc,1p

! https://krebsonsecurity.com/2024/09/scam-funeral-streaming-groups-thrive-on-facebook/
||livestreaming24.xyz^$doc
/^https:\/\/(?:www\.)?[-a-z0-9]+\.com\.[-a-z0-9]+\.com\//$doc,to=com,ipaddress=148.251.54.196
/^https:\/\/(?:www\.)?[-a-z0-9]+\.xyz\.[-a-z0-9]+\.com\//$doc,to=com,ipaddress=148.251.54.196

! https://securelist.com/sambaspy-rat-targets-italian-users/113851/
||belliniepecuniaimmobili.*^$doc,to=belliniepecuniaimmobili.*
||immobilibelliniepecunia.*^$doc,to=immobilibelliniepecunia.*
||bpecuniaimmobili.*^$doc,to=bpecuniaimmobili.*
||belliniepecuniaimmobilisrl.*^$doc,to=belliniepecuniaimmobilisrl.*
||immobiliarebelliniepecunia.*^$doc,to=immobiliarebelliniepecunia.*

! https://github.com/uBlockOrigin/uAssets/issues/25470
||the-north-face.gr^$all
||thenorthfacegreece.com^$all

! https://sansec.io/research/cosmicsting-fallout
! https://sansec.io/research/cosmicsting
! https://sansec.io/research/cosmicsting-cnext-persistent-backdoor
! https://blog.sucuri.net/2024/11/2024-credit-card-theft-season-arrives.html
||forimg.net^$all
||hobidoch.store^$all
||heqipop.space^$all
crimsonav.com,ngsingleissues.nationalgeographic.com##+js(acs, atob, new Function(atob()
||cdnstatics.net^$all
! Group Bobry
/^https:\/\/[a-z]{7,}\.[a-z]{3,}\/get\/\?s=[a-zA-Z0-9]+=*$/$script,3p,match-case,to=~edu|~gov
/^https:\/\/[a-z]{7,}\.[a-z]{3,}\/img\/$/$script,3p,match-case,to=~edu|~gov
||quantunnquest.com^$all
||analytisgroup.com^$all
||analytisweb.com^$all
||bytesbazar.com^$all
||chartismart.com^$all
||codecarawan.com^$all
||creativeslim.com^$all
||creatls.com^$all
||cssmagic.shop^$all
||datifyny.com^$all
||dealhunt.website^$all
||desiqnia.shop^$all
||desynlabtech.com^$all
||getstylify.com^$all
||graphiqsw.com^$all
||happyllfe.online^$all
||horlzonhub.com^$all
||javaninja.shop^$all
||marketiqhub.com^$all
||marketrom.shop^$all
||marketsoilmart.com^$all
||metricsy.shop^$all
||novastraem.com^$all
||radlantroots.com^$all
||sellifypro.com^$all
||sellwisehub.com^$all
||statify.online^$all
||statlstic.shop^$all
||statspots.com^$all
||techtnee.com^$all
||trendgurupro.com^$all
||trendor.website^$all
||trendori.shop^$all
||vizualis.online^$all
!#if cap_html_filtering
energiasolare100.it,lundracing.com,red17.co.uk,workplace-products.co.uk##^div[onmousemove*=".innerHTML"][onmousemove*="String.fromCharCode"]
!#else
energiasolare100.it,lundracing.com,red17.co.uk,workplace-products.co.uk##+js(trusted-replace-argument, String.prototype.includes, 0, undefined, condition, /^checkout$/)
!#endif
! Group Surki
/^wss:\/\/[^\/]+\.[a-z]{2,}\/(?:common|ws)\?source=http[^&]+$/$websocket,3p,match-case,to=~edu|~gov
||accept.bar^$all
||amocha.xyz^$all
||cdn-webstats.com^$all
||cpeciadogfoods.com^$all
||inspectdlet.net^$all
||clearnetfab.net^$all
||cloudflare-stat.net^$all
||fallodick87-78.sbs^$all
||iconstaff.top^$all
||jquerypackageus.com^$all
||jqueryuslibs.com^$all
||jstatic201.com^$all
||lererikal.org^$all
||nothingillegal.bond^$all
||paie-locli.com^$all
||sellerstat.site^$all
||shoponlinemelike.shop^$all
||statsseo.com^$all
||statstoday.org^$all
||vincaolet.xyz^$all
||webexcelsior.org^$all
adrissa.com.co,americansoda.co.uk,casteloforte.com.br,centerfabril.com.br,forqueen.cz,joinusonline.net,jollibee.com.vn,kitapsan.com.tr,mebelinovdom.com,ojworld.it,qualityrental.com,szaszmotorshop.hu,tvojstyl.sk,up-shop.org,yairalon.com.br##+js(acs, WebSocket, event.data)

! https://github.com/uBlockOrigin/uAssets/issues/25583
! https://www.virustotal.com/gui/url/da347b9b68b517c0a828f127ce9675ce47ed7277f16ace2673cdc835ded5a85c
||comodozeropoint.com^$all,to=~comodo.com
||avatrade-services.com^$all,to=~avatrade.com
||ailurophilestealer.shop^$all

! https://blog.sekoia.io/mamba-2fa-a-new-contender-in-the-aitm-phishing-ecosystem/
##html#html[sti][vic][lang] > body#allbody
/\/m\/js(?:drive|nom|sp|v)\.js\b/$script,1p,strict1p
/\/n\/js(?:drive|nom|sp|v)\.js\b/$script,1p,strict1p
/\/o\/js(?:drive|nom|sp|v)\.js\b/$script,1p,strict1p

! https://www.reddit.com/r/Dublin/comments/1g3ed75/
||payzoneparking.info^$all

! https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/
! https://www.virustotal.com/gui/url/cbccfc85c6a35d83fb54471a174148addeddc78879d48a44f12d8d8b9f7055ee
! https://www.virustotal.com/gui/url/d46f89de4ff2b3be786c8973fb700f48fdaaecab6e85f72397133e1bbba6b145
/^https?:\/\/[a-z]{7,}\.com\/go\/[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}\b/$doc,match-case,to=com
/^https?:\/\/[-a-z0-9]{8,}\.ru\/\?load=[a-zA-Z0-9]+(-[a-zA-Z0-9]+)+$/$doc,match-case,to=ru
||com/go/$doc,to=com,ipaddress=3.0.82.215
||com/go/$doc,to=com,ipaddress=3.0.178.139
||com/go/$doc,to=com,ipaddress=2406:da18:3af:9302:6ead:4c78:949:685a
||com/go/$doc,to=com,ipaddress=2406:da18:3af:9302:218a:d776:533b:6b69
||rungamepc.ru^$all
||game02-com.ru^$all
||gameportpc.ru^$all
||menkaralpheratz.com^$all
||ofsetvideofre.click^$all
||newvideozones.click^$all
||downloadstep.com^$all
||downloadsbeta.com^$all
||streamingsplays.com^$all
||streamingszone.com^$all
||runkit.com/wukong/black-myth-wukong-crack-pc^$all
||runkit.com/skylinespc/cities-skylines-ii-crack-pc-full-setup^$all
||runkit.com/masterposte/dying-light-2-crack-on-pc-denuvo-fix^$all
||runkit.com/dz4583276/monster-hunter-rise-crack-codex-pc/1.0.0/clone^$all
||groups.google.com/g/hogwarts-legacy-crack-empress^$all
||verify-captcha.com^$all
||r2.dev/CAptcha-Verifications-$doc
/please-verify-z.html^$doc

! https://x.com/Unit42_Intel/status/1829178013423992948
||dlvideosfre.click^$all
/human-verify-system.html^$doc
/human-captcha-v*.html^$doc
/captcha-verify-v*.html^$doc
/verify-captcha-v*.html^$doc

! https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6
##html > body > div.container.m-p > #checkbox-window.checkbox-window
||ajmaboxanherulv*.b-cdn.net^$doc
||anti-automation-v*.b-cdn.net^$doc
||bot-check-v*.b-cdn.net^$doc
||dedicloadpgeing*.b-cdn.net^$doc
||file-typ-botcheck*.b-cdn.net^$doc
||izmncdnboxuse*.b-cdn.net^$doc
||newverifyyourself-system*.b-cdn.net^$doc
||nikutjyjgchr*.b-cdn.net^$doc
||verification-module-v*.b-cdn.net^$doc
||verifyyourself-*system.b-cdn.net^$doc
||weoidnet*.b-cdn.net^$doc
||fiare-activity.com^$all
||chromeupdates.com^$all
||fingerboarding.com^$all
||foodrailway.cfd^$all
||b-cdn.net/get-this-puzzle-solved.html^$doc
||b-cdn.net/Recap-v*.html^$doc
||b-cdn.net/verf-v*.html^$doc
/cf-check.html^$doc
/final-step-to-continue.html^$doc
/dedicated-captcha-page.html^$doc
/hcaptcha-human-check.html^$doc
/IQWJDolx.html^$doc
/JSKADull.html^$doc
/modi-cloudflare-update-new.html^$doc
/prove-human-recaptcha.html^$doc
/RYFTGJcaptchv*.html^$doc
/recaptcha-v*-protocol-$doc
/recaptcha-verification.html^$doc
/recaptcha_verification*.html^$doc
/security-challenge-captcha.html^$doc
/SYNCfuzzv*.html^$doc
/verify-human-recaptcha.html^$doc
/verify-me-first-v*.html^$doc
! https://github.com/uBlockOrigin/uAssets/discussions/17361#discussioncomment-11692494
##html[lang] > body:not([class]):not([id]):not([style]) > div.container > div.recaptcha-box
/bot-verification-check-re*.html^$doc
! https://github.com/uBlockOrigin/uAssets/issues/27463
/need-to-pass-step.html^$doc

! https://www.reddit.com/r/windows/comments/1gkmlhp/what_does_this_windows_r_command/
! https://www.virustotal.com/gui/url/530e6d106c328dc6334383fd4de29593fc7f4591bab8df517431612c7f0cd4e6
! https://github.com/uBlockOrigin/uAssets/issues/26193
! https://github.com/uBlockOrigin/uAssets/issues/26205
||exo.io/cloudcask/$doc
/cloudflare-v1-getup-*.html^$doc
/modi-cloudflare-update.html^$doc

! https://github.com/hagezi/dns-blocklists/issues/4009
! https://github.com/rustdesk/rustdesk/discussions/9679
||rustdesk.co.nz^$doc
||rustdesk.io^$doc
||rustdesk.pl^$doc
||rustdesk.secure-box.de^$doc

! https://github.com/uBlockOrigin/uAssets/issues/25783
||bitdefender.top^$doc,to=~bitdefender.com

! https://github.com/uBlockOrigin/uAssets/issues/25800
||caressesetboulesdepoils.fr^$doc

! https://www.netskope.com/blog/attackers-target-crypto-wallets-using-codeless-webflow-phishing-pages
webflow.io##html.w-mod-js:not(.wf-active) > body:not([class]):not([id]) > a[class="w-inline-block"][href^="http"]

! https://github.com/uBlockOrigin/uAssets/issues/25869
||coinomiwallet.cc^$all,to=~coinomi.com

! https://github.com/uBlockOrigin/uAssets/issues/25870
||infinityvvallet.io^$all,to=~infinitywallet.io

! https://www.reddit.com/r/Scams/comments/1giz9gn/mslivepro_is_a_fake_website_also_so_is/
||mslive.pro^$all,to=~microstrategy.com

! https://github.com/uBlockOrigin/uAssets/issues/25913
/^https:\/\/gov\.[^.]*gr\.[a-z]{2,6}/$doc,to=~gov|~edu|~gov.gr
! https://github.com/uBlockOrigin/uAssets/issues/25986
||0.gp/greece2^$all,to=~gov.gr
||gr93.sbs^$all,to=~gov.gr

! https://github.com/uBlockOrigin/uAssets/issues/27155
! https://freesoftwarecreative.com/pages/?f4107d2
! https://d1myn4ixnn41tz.cloudfront.net/public/external/v2/htmlxf.4151823.2951e.0.js
! https://d390icj1ta4x0p.cloudfront.net/public/ct?cpguid=&pr=0&it=4151823&w=1920&h=1080&key=2951e&m=0&r=
/cloudfront\.net\/(?=[a-z]{0,6}\d)[a-f0-9]{7}\.js$/$script,3p,match-case
||freesoftwarecreative.com^$doc
||cloudtrks.com^$all
||macgsapptrck.com^$all
||debridleech.com^$doc
||trckkkk.com^$all
||fastorfar.com^$all
||hopgp.com^$all
||fast2cloud.com^$all
||safesendclub.com^$all

! https://www.malwarebytes.com/blog/scams/2024/11/crooks-bank-on-microsofts-search-engine-to-phish-customers
||ixxx-blognew.com^$all,to=~ibx.key.com
||info-blog-news.com^$all,to=~ibx.key.com
||new-bllog-i.com^$all,to=~ibx.key.com
||xv-bloging-info.com^$all,to=~ibx.key.com
||xxx-new-videos.com^$all,to=~ibx.key.com
||xxx-ii-news.$all,to=~ibx.key.com

! https://github.com/uBlockOrigin/uAssets/issues/25933
||udemy-creators.com^$all,to=~udemy.com

! https://github.com/uBlockOrigin/uAssets/issues/25927
! https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-phish-n-ships-fakes-online-shops-to-steal-money-and-credit-card-information
! stage 1
||ntischoolpune.org/*.php?$doc
.php?iid=*&cid=$doc,to=~gov|~edu
.php?cid=*&pnum=$doc,to=~gov|~edu
! stage 2
||jb*img.top^$all,to=top
/\.[a-z]{3,}\/a\.aspx\?cid=/$doc,match-case,to=~com|~net|~org|~gov|~edu
! stage 3
/\.[a-z]{3,}\/products\.aspx\?cname=.+&cid=/$doc,match-case,to=~com|~net|~org|~gov|~edu
/^https:\/\/online\.[a-z]{7,}\.top\//$doc,to=top
||justdakota.top^$all

! https://timesofindia.indiatimes.com/technology/tech-news/bsnl-warn-users-about-this-fake-tower-installation-website/articleshow/113094732.cms
||bsnltowersite.in^$doc,to=~bsnl.co.in

! https://github.com/AdguardTeam/AdguardFilters/issues/191813
||dareka4te.shop^$all
! Fake WordPress plugins loading ads/malware
! https://www.godaddy.com/resources/news/threat-actors-push-clickfix-fake-browser-updates-using-stolen-credentials
! https://github.com/AdguardTeam/AdguardFilters/issues/191813
/wp-content/plugins/admin-bar-customizer/abc-script.js
/wp-content/plugins/advanced-user-manager/aum-script.js
/wp-content/plugins/advanced-widget-manage/awm-script.js
/wp-content/plugins/content-blocker/cb-script.js
/wp-content/plugins/custom-css-injector/cci-script.js
/wp-content/plugins/custom-footer-generator/cfg-script.js
/wp-content/plugins/custom-login-styler/cls-script.js
/wp-content/plugins/dynamic-sidebar-manager/dsm-script.js
/wp-content/plugins/easy-themes-manager/script.js
/wp-content/plugins/form-builder-pro/fbp-script.js
/wp-content/plugins/quick-cache-cleaner/qcc-script.js
/wp-content/plugins/responsive-menu-builder/rmb-script.js
/wp-content/plugins/seo-optimizer-pro/sop-script.js
/wp-content/plugins/simple-post-enhancer/spe-script.js
/wp-content/plugins/social-media-integrator/smi-script.js

! https://blog.sucuri.net/2024/11/malware-steals-account-credentials.html
! https://x.com/MBThreatIntel/status/1376662429229142022
! https://x.com/rootprivilege/status/1549799944835371008
||jqueri.at^$all
||jsdelivr.at^$all
||gstatis.co^$all
||at^$script,xhr,3p,ipaddress=185.215.113.111

! https://github.com/uBlockOrigin/uAssets/issues/25994
! https://www.reddit.com/r/Scams/comments/1go6jwc/coinbase_scam_i_believe_this_is_a_scam/
||pekanbaru.one^$all,to=~coinbase.com

! https://github.com/uBlockOrigin/uAssets/issues/26010
||securevault.top^$all

! https://www.reddit.com/r/Scams/comments/1gppxs5/package_is_detained_scam/
! https://www.reddit.com/r/Scams/comments/1gpo2x6/is_this_a_scam_seems_kinda_sketchy/
! https://www.reddit.com/r/Scams/comments/1grey9a/is_this_actually_usps_or_a_scam/
! https://www.virustotal.com/gui/url/7d78e3dd3c6dbb1eeb8a916a3fa87f8235d374691d35d90afc330182a18fc766
/^https:\/\/usps\.com-(?:[-\w]+\.){1,2}[a-z]{2,4}\//$doc,to=~com|~net|~org|~edu|~gov
! https://www.reddit.com/r/Scams/comments/1hc2p3j/httpsamazoncomcustomstopapsigninopenid/
/^https:\/\/amazon\.com-(?:[-\w]+\.){1,2}[a-z]{2,4}\//$doc,to=~com|~net|~org|~edu|~gov

! https://github.com/uBlockOrigin/uAssets/issues/25519
||orcaslicer.net^$doc
! https://github.com/uBlockOrigin/uAssets/issues/26052
||orcaslicer.info^$doc
||orcaslicer.co^$doc
! https://github.com/uBlockOrigin/uAssets/issues/27270
||orca-slicer.com^$doc

! https://www.reddit.com/r/Scams/comments/1grbhas/marabasebi_website_scam/
||marabase-bi.com^$doc,to=~mara.com

! https://github.com/uBlockOrigin/uAssets/issues/26061
/^https:\/\/www\.air-?up-?[a-z]{2,}\.com\//$doc,to=com|~air-up.com
/^https:\/\/www\.xn--airup[a-z]{5,6}-[a-z0-9]{3}\.com\//$doc,to=com|~air-up.com
||airupgreece.net^$doc,to=~air-up.com
||airupitaly.it^$doc,to=~air-up.com
||airupfrance.fr^$doc,to=~air-up.com

! https://github.com/uBlockOrigin/uAssets/issues/26058
||ftuapps.io^$doc
||ftuapps.dev^$doc
||farlad.com^$doc

! https://github.com/uBlockOrigin/uAssets/issues/26072
||geekupdates.notion.site/Ultra-Security$doc

! https://forum.trezor.io/t/emails-from-trezor-appear-as-a-phishing-attack/13865
! https://forum.trezor.io/t/phishing-email-received-claiming-trezor-firmware-update-required/13929
||uobretailcreditmanagement.$doc
||blockfiupdates.$doc

! https://github.com/uBlockOrigin/uAssets/issues/26102
||uploadfox.net^$inline-script
uploadfox.net###ad-gs-05

! https://github.com/uBlockOrigin/uBlock-issues/discussions/3461
||allinoursite.com^$doc
||bteux.com^$doc
||childrenoftheclouds.com^$doc
||dating-express.com^$doc
||doorsstormsy.shop^$doc
||emailservicesnetau.com^$doc
||euromaillinnk.com^$doc
||findthorman.shop^$doc
||glaters.com^$doc
||homtail.shop^$doc
||keydoordasher.shop^$doc
||mybach.xyz^$doc
||threeneptuneboot.com^$doc
/unsub/unsub^$doc
/unsub_sent.php|$doc,method=post
/^https?:\/\/www\.[a-z]{9,20}\.com\/o-[a-z]{4}-[a-z]\d6-[a-f0-9]{32}\b/$doc,match-case,to=com
/^https?:\/\/[a-z]+\.[a-z]{4,}\/oop\/\d+_md(?:\/\d+){5}\b/$doc,match-case
##html > body.hold-transition.theme-primary.bg-img[style^="background-image"][style*="wallpaperaccess.com"][style*="background-repeat"][style*="background-size"]
##html > body > div.container > form#unsubscribe-form[onsubmit="submitUnsubscribeForm(event)"]
##html > body > div.content > dl > dd.dd1 > div.min_sider > form#form1[action="unsubscribe.php"]
##html > body.body > div.container > div.content > form > table.optoutForm

! Pretending to be a government service
||detranrapido.co^$all
||pagamentocnh.com^$all

! https://malwaretips.com/blogs/remove-flake-creditcable-info/
! https://www.virustotal.com/gui/url/9c04f6b29c12f7fe981be638719be31d9bcbd5bf504423c12b49d7ce445c9f6d
||creditcable.info^$all

! https://github.com/uBlockOrigin/uAssets/issues/26164
||klingxai.com^$all

! https://www.reddit.com/r/Scams/comments/1gxe9i7/httpswwwpopularresortadscom/
||popular-resort-ads.com^$doc,to=~ads.google.com

! https://www.reddit.com/r/DeFiVault/comments/1gzn8dn/coinbase_account_status/
://backcb.one^$all

! https://www.reddit.com/r/Scams/comments/1h13jv4/madgicx_job_offer_my_gf_clicked_on_through_an_add/
||madgicxde.com^$all,to=~madgicx.com

! https://www.cloudflare.com/es-la/threat-intelligence/research/report/sacked-or-hacked-unmasking-employment-termination-scams/
||gxsearch.club^$all

! https://blog.sucuri.net/2024/11/credit-card-skimmer-malware-targeting-magento-checkout-pages.html
||staticfonts.com^$all
||static-fonts.com^$all

! https://www.reddit.com/r/Scams/comments/1h2b6vz/semrushshopcom_scam/
! https://www.virustotal.com/gui/url/cf71745d1add3f6d61cf306282b04d7c2271c69c5d32de23cb0eec54a9b5611b
||semrushshop.com^$all,to=~semrush.com

! https://www.malwarebytes.com/blog/scams/2024/11/printer-problems-beware-the-bogus-help
||megadrive.solutions^$all
||geeksprosoftwareprints.org^$all
||printcaretech.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/26264
||editproai.$all,to=editproai.org|editproai.pro

! https://github.com/uBlockOrigin/uAssets/issues/26255
! https://web.archive.org/web/20241130205822/https://lesivs.com/
||lesivs.com^$doc

! https://blog.checkpoint.com/research/navigating-the-evolving-threat-landscape-ahead-of-black-friday/
||longchampblackfriday.com^$all,to=~longchamp
||jcrewblackfriday.com^$all,to=~jcrew.com
||hottest-bag.com^$all,to=~louisvuitton.com

! https://blog.eclecticiq.com/inside-intelligence-center-financially-motivated-chinese-threat-actor-silkspecter-targeting-black-friday-shoppers
||dopeblackfriday.shop^$all
||llbeanblackfridays.shop^$all,to=~llbean.com
||makitablackfriday.shop^$all,to=~makitatools.com
||eu-blochdance.shop^$all,to=~blochworld.com
||ikea-euonline.com^$all,to=~ikea.com
||gardena-eu.com^$all,to=~gardena.com

! https://news.trendmicro.com/2024/11/13/black-friday-scams/
||northfacedeals.shop^$all,to=~thenorthface.com

! https://github.com/uBlockOrigin/uAssets/issues/26280
||igetintopc.com^$all

! https://www.reddit.com/r/Scams/comments/1h4yn23/is_this_a_usps_scam/
! https://www.reddit.com/r/phishing/comments/1h5nqhn/is_this_a_scam/
||usps-packages-*.com^$doc,to=~usps.com

! https://www.reddit.com/r/Scams/comments/1h7aw12/another_usps_scam_text_message_with_my_delivery/
! https://www.virustotal.com/gui/url/dcf0a9e31564ffdac83f5fe888d41f46b9c9d2c6fd41ae9e516c6d0f0bb58a12
||info-trackingcas.cc^$all,to=~usps.com

! https://github.com/uBlockOrigin/uAssets/issues/26353
! https://www.bleepingcomputer.com/news/security/eset-partner-breached-to-send-data-wipers-to-israeli-orgs/
||backend.store.eset.co.il/pub/*/ESETUnleashed_*.zip^$all

! https://www.reddit.com/r/CryptoScams/comments/1h9klwr/mexc_global_exchange/
||gnxuohpr.icu^$all,to=~mexc.com
||mexcgbaip.vip^$all,to=~mexc.com
||www.*.icu^$doc,ipaddress=/^(13\.227\.254\.\d{2}|2600:9000:2(00a|1d1):[a-z0-9]{2}00:1[1c]:(7b7c|2741):(1ac|2d0)0:93a1)$/
||www.*.vip^$doc,ipaddress=/^(13\.227\.254\.\d{2}|2600:9000:2(00a|1d1):[a-z0-9]{2}00:1[1c]:(7b7c|2741):(1ac|2d0)0:93a1)$/

! fake cloudflare captcha
||pub-549d59daefd74f7583e1766800fe7b07.r2.dev^

! https://www.reddit.com/r/Scams/comments/1hdbyok/website_asking_for_camera_access/
||r-tiktok.com^$all,to=~tiktok.com

! https://www.reddit.com/r/Scams/comments/1hhzsjx/is_salomonoutletstoresusacom_is_legit/
||salomonoutletstoresusa.com^$all,to=~salomon.com

! fake dating
/^https:\/\/[0-9a-z]{7}\.([0-9a-z]{7})\.top\/[0-9a-z]{7}\?t=\1&cid=[0-9a-z]+/$doc,to=top,match-case

! https://www.reddit.com/r/Scams/comments/1hleeck/this_has_to_be_a_scam_right/
||dhldeliveryhome2.info^$all

! https://www.reddit.com/r/Scams/comments/1hmbf58/i_fell_for_a_toll_scam/
||thetollroads.com-*.cfd^$all,to=~thetollroads.com

! https://github.com/uBlockOrigin/uAssets/issues/26629
||dtioykqj1u8de.cloudfront.net^$all,to=~amazon.co.jp

! https://github.com/uBlockOrigin/uAssets/issues/26656
||jaowomous.xyz^$all

! https://github.com/uBlockOrigin/uAssets/issues/26660
?id=*&p1=*&p2=*&p3=*&p4=$doc
||partners-tds.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/26655
! https://www.virustotal.com/gui/url/be76de7311f2989fd8bc3795e76047c8f83cbb9dc990180e985af4824269a3db
||likeyoumakehappy.xyz^$all,to=~alza.sk

! https://github.com/uBlockOrigin/uAssets/issues/26672
||gtrewe.co.in^$all
! https://github.com/uBlockOrigin/uAssets/issues/26708
||fiheos.co.in^$all
! https://github.com/uBlockOrigin/uAssets/issues/26817
||butsmism.co.in^$all
!/^https?:\/\/[a-z0-9]{6,20}\.[a-z]{6,20}\.co\.in\//$all,to=co.in
! https://github.com/uBlockOrigin/uAssets/issues/26919
||glousism.co.in^$all
! https://www.reddit.com/r/antivirus/comments/1imiwam/should_i_be_worried/
||tryrichleads.top^$all

! https://github.com/uBlockOrigin/uAssets/issues/26722
||maxsecurityultimate.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/26760
||hotdebrid.com^$doc
||maxdebrid.com^$doc
||anydebrid.com^$doc

! https://www.reddit.com/r/Scams/comments/1hx4mxz/semrush_task_scam_httpswwwsemrushmallcom/
||semrushmall.com^$all,to=~semrush.com

! https://www.reddit.com/r/antivirus/comments/1hzae66/what_is_the_best_thing_to_do_after_clicking_a/
||grass-io.$all,to=cc|vip|~getgrass.io
||inmotionhosting.com/~myapp/grass_air/$doc,to=~getgrass.io

! https://github.com/uBlockOrigin/uAssets/issues/26814
||pubgrlxvote.top^$all

! https://github.com/uBlockOrigin/uAssets/issues/26853
||teleqpnm.cn^$all,to=~telegram.org

! https://www.malwarebytes.com/blog/news/2025/01/the-great-google-ads-heist-criminals-ransack-advertiser-accounts-via-fake-google-ads
! https://github.com/uBlockOrigin/uAssets/issues/26878
||sites.google.com/view/entteraccess^$all,to=~ads.google.com
||sites.google.com/view/helpp2k^$all,to=~ads.google.com
||ads-overview.com^$all,to=~ads.google.com
||adsg00gle-v3.vercel.app^$all,to=~ads.google.com
||ads1.google.*.com^$doc,frame,to=~ads.google.com

! https://www.reddit.com/r/Scams/comments/1i29m8t/for_the_first_time_i_almost_fell_for_one/
||ezdrivema.com-$doc,to=~mass.gov
! https://www.reddit.com/r/phishing/comments/1i2zh8p/nice_try_ive_gotten_3_this_week/
||ezdrive.com-$doc,to=~mass.gov

! https://www.reddit.com/r/phishing/comments/1i2gi5r/is_this_legit/
||thetollroads.texas-$all,to=~thetollroads.com
/^https:\/\/thetollroads\.[a-z]+-[a-z]{4}\.[a-z]{3}\//$doc,to=~thetollroads.com

! https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/
/^https:\/\/(?:[-a-z0-9]{2,}\.){1,2}(?:[a-z]{2,3}|click|online)\/(?:[-a-z0-9]+\/){1,4}[a-zA-Z0-9]{150}\/index\?a=/$doc,xhr,match-case,method=get,to=~edu|~gov
/^https:\/\/(?:[-a-z0-9]{2,}\.){1,2}(?:[a-z]{2,3}|click|online)\/(?:[-a-z0-9]+\/){1,4}[a-zA-Z0-9]{150}\/verify\b/$doc,match-case,method=get,to=~edu|~gov

! https://github.com/uBlockOrigin/uAssets/issues/26894
||unhesiss.shop^$all

! https://github.com/uBlockOrigin/uAssets/issues/26912
||edeetion.com^$all
||cleverjumper.com^$all

! https://github.com/uBlockOrigin/uAssets/issues/26941
||teams-live.com^$all

! https://www.reddit.com/r/phishing/comments/1i6j0m9/surely_this_cant_be_real_right/
||irs.gov-$doc,to=~irs.gov

! https://www.bleepingcomputer.com/news/security/hundreds-of-fake-reddit-sites-push-lumma-stealer-malware/
/^https?:\/\/reddit-\d{1,2}\.[a-z]{4}\.(?:net|org|pw)\//$doc,to=net|org|pw|~reddit.com
/^https?:\/\/wettransfer\d{2}\.[a-z]{4}\.(?:net|org|pw)\//$doc,to=net|org|pw|~wetransfer.com

! https://www.reddit.com/r/Scams/comments/1i9q6d9/interact_transfer_website_scam/
! https://www.virustotal.com/gui/url/945ff04832d56ce17157c30a33e1c7f2fc7eea8577a519d7d5837f1864dd6563
||e-interac-*.com^$all,to=~interac.ca

! https://github.com/AdguardTeam/AdguardFilters/issues/196657
||press-continue.*.top^$all
||com/$doc,ipaddress=/^(172\.240\.(108\.(68|76|84)|127\.234|253\.132)|185\.246\.188\.125|192\.243\.(59\.(1[23]|20)|61.22[57]))$/

! https://www.reddit.com/r/Scams/comments/1iht58s/i_bought_from_httpsxhvoqishop/
||xhvoqi.shop^$all,to=~costco.com

! https://x.com/Unit42_Intel/status/1883948928602644785
||duckdns.org/security-check/$doc
||duckdns.org/FAMOUS/Gens/$doc

! https://www.reddit.com/r/Scams/comments/1iif4o4/received_a_text_via_e_mail_from_irs/
||irs.gov.*.com^$doc,to=com|~irs.gov

! https://www.reddit.com/r/Scams/comments/1iju9t8/can_someone_help_clarify_that_this_is_fake/
||evri.*.xyz^$doc,to=xyz|~evri.com

! https://github.com/uBlockOrigin/uAssets/issues/27109
! https://github.com/uBlockOrigin/uAssets/issues/27172
! https://github.com/uBlockOrigin/uAssets/issues/27583
||sharedrop.io^$all
||snapdrop.net^$all

! https://cyble.com/blog/deepseeks-growing-influence-surge-frauds-phishing-attacks/
||deepseek-aiassistant.com^$all,to=~deepseek.com
||usadeepseek.com^$all,to=~deepseek.com
! https://x.com/AlvieriD/status/1883450009523282280
! https://www.virustotal.com/gui/url/5059b05b49a57abb1e55efe9e811edae20d620d4fcbdbdfe595c31c16be78aa0
||gg.deepseek.$doc,to=~deepseek.com
||deepseek.$all,to=deepseek.app|deepseek.top|~deepseek.com
! https://x.com/AlvieriD/status/1887092079114817962
||deepseeklogin.com^$all,to=~deepseek.com
||deepseeklogins.com^$all,to=~deepseek.com
||deepseekapk.download^$all,to=~deepseek.com
||deepseekapp.download^$all,to=~deepseek.com

! https://www.reddit.com/r/phishing/comments/1iln9ux/is_this_a_new_scam/
! https://www.virustotal.com/gui/url/dd2c16c95013aa1a20b35b50301b1116d582be01d346dc048a894b480fbbee59
||paytoll*.top/ezdrivema^$all,to=~mass.gov

! https://blog.sucuri.net/2025/02/google-tag-manager-skimmer-steals-credit-card-info-from-magento-site.html
! https://www.virustotal.com/gui/url/d75d7ece986f58c9b63c56e5a753158c2fa9dc927e9cc6a2ca5f2c1cfa2bde3a
||eurowebmonitortool.com^$all

! https://www.reddit.com/r/Scams/comments/1in9l8t/be_careful_posting_your_resume_on_job_boards/
||sunpass.com-$doc,to=~sunpass.com

! https://www.reddit.com/r/Scams/comments/1iuso58/need_help_identifying_a_text/
||hhcollect.co^$all,to=~harriscollect.com
||pay-hh.com^$all,to=~harriscollect.com
||harriscollect.net^$all,to=~harriscollect.com

! https://www.reddit.com/r/Scams/comments/1itgp4n/unpaid_toll_booth_scam/
! https://www.reddit.com/r/Scams/comments/1ivvd8u/httpsminnesotaezpasscom_and/
! https://www.reddit.com/r/Scams/comments/1ivruom/my_grandma_sent_a_copy_of_her_bank_check_to_a/
-ez-pass.com^$doc
||thetollroads-$doc,to=top|xin|world

! https://www.reddit.com/r/phishing/comments/1it5lbc/first_time_ive_seen_this_one/
/^https:\/\/help-\d{8}\.[a-z0-9]{6}-\d{2}\.click\//$doc,to=click|~facebook.com

! https://www.reddit.com/r/Scams/comments/1itaq6g/not_sure_if_this_text_from_the_irs_is_a_scam_or/
||irs.gov.*.com^$doc,to=com|~irs.gov

! https://www.reddit.com/r/Scams/comments/1it0wrf/parking_fine_scam_spoofing_as_the_uk_government/
||govuk.*.top^$doc,to=top|~gov.uk

! https://www.reddit.com/r/phishing/comments/1irz2ck/bro_really/
||e-navy*.weebly.com^$doc,to=~navyfederal.org

! https://github.com/uBlockOrigin/uAssets/issues/27298
||informationpolicy.cloud^$all

! https://www.reddit.com/r/uBlockOrigin/comments/1j1hdul/please_add_httpsonlyfansuk_to_the_filter_list/
||only-fans.uk^$all

! https://www.reddit.com/r/antivirus/comments/1iy3ndw/bruh_all_i_was_doing_was_looking_stuff_bc_im/
||apple-protect.com^$all

! https://github.com/AdguardTeam/CoreLibs/issues/1966 Can be removed if it's fixed
!#if ext_ubol
/^https:\/\/[a-z]{3,5}\.[a-z]{4,10}\.[a-z]{2,6}\/item-(?:[0-9a-z]{10}|\d{8})\.html$/$doc,match-case,to=art|baby|cfd|click|eu|fit|fun|hair|homes|ink|lat|lol|mom|my|sbs|skin|top|world|xyz
/^https:\/\/[a-z]{4,5}\.[a-z]{4,10}\.[a-z]{2,6}\/item-(?:[0-9a-z]{10}|\d{8})\.html$/$doc,match-case,to=biz|blog|cc|cloud|club|info|life|me|one|online|shop|site|space|store
!#endif

! https://www.reddit.com/r/Scams/comments/1iyqpsn/new_digital_fearscam_unlocked_zoom_phishing/
||zoom.us*web.us^$doc,to=~zoom.com

! https://www.reddit.com/r/phishing/comments/1j2yegj/finally_got_one/
||e-zpass.com-$doc

! https://urlscan.io/result/0195c345-b963-7000-8e56-212b7f83bae8/
/n/ax4mqlu25efi/b/*$doc

! https://urlscan.io/result/0195d804-d996-7001-8afc-be76c4caf798/related/
||fly.storage.tigris.dev/completing/default-page.html?X-Amz-Algorithm=$doc
||fly.storage.tigris.dev/pass-this-security-check.html?X-Amz-Algorithm=$doc

! https://hybrid-analysis.com/sample/a86e82991e518f25534e59f857ea156140b083365eadd1ee0d88517c2badf766
! https://urlscan.io/result/0195d81c-3058-7ff5-b149-2cebebf1b331/
/amvn_pops/?keyword=$doc

! https://www.youtube.com/watch?v=NR1hnYbrMwE
! https://www.reddit.com/r/losslessscaling/comments/1hzo40l/losslessscalingcom/
! https://www.virustotal.com/gui/url/1932ec9ade57ef85981e6d9c78cdea859e312c58b3577ba0730a23f7950ca202
||lossless-scaling.com^$all,to=~losslessscaling.com
||lossless-scaling.download-fast.com^$all,to=~losslessscaling.com

! https://github.com/uBlockOrigin/uAssets/issues/27798
||fiverr-receiving-page.world^$all

! https://github.com/uBlockOrigin/uAssets/issues/27800
! https://www.youtube.com/watch?v=SBTH9n6lz9o
||tlauncher.org^$doc

! https://www.reddit.com/r/Scams/comments/1j9omrq/ustn_never_thought_id_be_making_a_post_here/
||amezpay.com^$doc,to=~amerimedems.com

! https://x.com/masaomi346/status/1906988126918295737
! https://urlscan.io/search/#hash%3A09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
/^https:\/\/[a-z]{7,8}\.com\/\?s=[0-9a-z]{13}&q=/$doc,to=com,match-case
/?fingerprint=*&i=$doc
/?id=*&traceId=$doc
=1&id=*&traceId=$doc

! https://github.com/uBlockOrigin/uAssets/issues/27938
||turtleclient.xyz^$all