From 420cb7a29de2477a25755fe71de1b38133e45f91 Mon Sep 17 00:00:00 2001
From: Imre Kristoffer Eilertsen <imreeil42@gmail.com>
Date: Fri, 29 Dec 2023 06:14:25 +0100
Subject: [PATCH] Testing out its feasibility in such a large list as this.

---
 Dandelion Sprout's Anti-Malware List.txt | 206 +++++++++++------------
 1 file changed, 103 insertions(+), 103 deletions(-)

diff --git a/Dandelion Sprout's Anti-Malware List.txt b/Dandelion Sprout's Anti-Malware List.txt
index 2c33c1e05..c0feb4399 100644
--- a/Dandelion Sprout's Anti-Malware List.txt	
+++ b/Dandelion Sprout's Anti-Malware List.txt	
@@ -1,6 +1,6 @@
 [Adblock Plus 3.13]
 ! Title: 💊 Dandelion Sprout's Anti-Malware List
-! Version: 25December2023v1
+! Version: 29December2023v1
 ! Expires: 2 days
 ! Description: This list goes the extra kilometer to prevent more malware than other mainstream anti-malware lists. It blocks heavily abused top-level domains (and even search engine results for them), blocks domains used in malware redirection trains and in domain parking schemes, blocks sponsored Windows PUP nags on PC guide articles, uses mass blocking of domains belonging to bad IPs, and has many other subcategories that give it a solid advantage over similar lists out there.
 ! For other security-specific lists I've made, check out https://github.com/DandelionSprout/adfilt/tree/master/Special%20security%20lists
@@ -495,7 +495,7 @@ play.google.com#?#div[class$=" "] > div[class*=" "][jscontroller] > *:has([href$
 ||proserpina-zeb.com^$all,~inline-font
 ||lordagty.com^$doc
 ||madagty.com^$doc
-||zeroredirect5.com^$doc
+||zeroredirect5.com^$doc,domain=~malware-redirection-trains.*
 ||54.209.22.226^$doc
 ||54.91.125.197^$doc
 ||52.202.53.245^$doc
@@ -3718,7 +3718,7 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||zfirst-news.com^$all,~inline-font
 ||zmp3-online.com^$all,~inline-font
 ||zmusic-online.com^$all,~inline-font
-||zredir.com^$all,~inline-font
+||zredir.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ||178.128.142.109^$doc
 ||findmedia.biz^$all,~inline-font
 ||backtonews.biz^$all,~inline-font
@@ -3797,8 +3797,8 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||gogle.net^$all,~inline-font
 ||quatrefeuillepolonaise.xyz^$all,~inline-font
 ||extragifis.site^$all,~inline-font
-||best-prizes-202*.com^$doc
-||all-best-prize-202*.com^$doc
+||best-prizes-202*.com^$doc,domain=~malware-site.*
+||all-best-prize-202*.com^$doc,domain=~malware-site.*
 ||captcharesolving-universe.com^$all,~inline-font
 ||captcharesolver.com^$all,~inline-font
 ||instantfwding.com^$all,~inline-font
@@ -3806,8 +3806,8 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||gamesex.fun^$all,~inline-font
 ||goldprize.xyz^$all,~inline-font
 ||kmip.net^$all,~inline-font
-||0redirc.com^$all,~inline-font
-||redirekted.com^$all,~inline-font
+||0redirc.com^$all,~inline-font,domain=~malware-redirection-trains.*
+||redirekted.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ||rebiraert.com^$all,~inline-font
 ||iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com^$all,~inline-font
 ||5.8.34.26^$doc
@@ -4172,7 +4172,7 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||tweakbit.com^$all,~inline-font
 ||pcspeedup.en.softonic.com^$all,~inline-font
 ! Copied from «uBlock Filters - Badware Risks» because it has proven to be a very good entry
-||1redirb.com^$all,~inline-font
+||1redirb.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ! https://github.com/DandelionSprout/adfilt/issues/188#issuecomment-931700117
 ||retailproductsusa.com^$all,~inline-font
 ||cloud-repos.store^$all,~inline-font
@@ -4221,9 +4221,9 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||data-px.services^$doc
 ||newsvot.com^$doc
 ||adalgard-wol.com^$all,~inline-font
-||trkk4.com^$doc
+||trkk4.com^$doc,domain=~malware-redirection-trains.*
 ||secure-access-*.gate23.xyz^$doc
-||hosting-redirect.com^$doc
+||hosting-redirect.com^$doc,domain=~malware-redirection-trains.*
 ||microsoftedge.microsoft.com/addons/detail/browse-safe/halaijeoccdjjoknnkcejljcimnfbmkf^$doc
 ! https://github.com/DandelionSprout/adfilt/pull/289
 ||gogles.com^$all,~inline-font
@@ -4377,7 +4377,7 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||security-scanner.xyz^$all,~inline-font
 ||news-back.org^$all,~inline-font
 ! https://github.com/iam-py-test/investigations/blob/main/2021/11/1/1.md
-&url_bnm_redirect=$all,~inline-font
+&url_bnm_redirect=$all,~inline-font,domain=~malware-redirection-trains.*
 /mcafeedirect.jsp$all,domain=~mcafee.com
 /beep.mp3^$domain=xyz|club|pro
 ||kokotrokot.com^$all,~inline-font
@@ -4777,7 +4777,7 @@ zombooru.com##a[href="http://www.hard55.com"]
 ://179.60.146.$doc
 !#endif
 ! https://github.com/AdguardTeam/AdguardFilters/issues/121544
-||trafredirtds.com^$all,~inline-font
+||trafredirtds.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ||com/landers/iphone*_spin$doc
 ! https://github.com/AdguardTeam/AdguardFilters/issues/121772
 ||pu020ev.com^$all,~inline-font
@@ -4807,9 +4807,9 @@ zombooru.com##a[href="http://www.hard55.com"]
 ! https://github.com/AdguardTeam/AdguardFilters/issues/122757
 ://adbrbk.$doc
 ! https://github.com/AdguardTeam/AdguardFilters/issues/123544
-||saferedirects.xyz^$all,~inline-font
+||saferedirects.xyz^$all,~inline-font,domain=~malware-redirection-trains.*
 ||online-guard.com^$all,~inline-font
-/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$doc,popup
+/mcafee-safe-browsing/?*=*&*=*&*=*&*=*&*=*&*=$doc,popup,domain=~fake-site-with-malware.*
 ! https://twitter.com/iam_py_test/status/1545164642346930176
 ||amazon-security-info.lnk.to^$all,~inline-font
 ! https://github.com/AdguardTeam/AdguardFilters/issues/123968
@@ -5382,7 +5382,7 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||146.19.169.98^$doc
 ||146.19.169.99^$doc
 ! https://github.com/AdguardTeam/AdguardFilters/issues/132079
-/pushredirect/?$doc
+/pushredirect/?$doc,domain=~malware-redirection-trains.*
 ! https://github.com/AdguardTeam/AdguardFilters/issues/134355
 ||1000girl.com^$all,~inline-font
 ||1000islandsinfo.com^$all,~inline-font
@@ -10657,9 +10657,9 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||thor-pom.com^$all,~inline-font
 ||thutm-bru.com^$all,~inline-font
 ||uthyr-que.com^$all,~inline-font
-||zeroredirect1.com^$all,~inline-font
+||zeroredirect1.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ||zp-dom.com^$all,~inline-font
-||redirect.newprogrammatic.click^$doc
+||redirect.newprogrammatic.click^$doc,domain=~likely-a-malware-redirection.*
 ||arcad-hoh.com^$all,~inline-font
 ||eadri-fnr.com^$all,~inline-font
 ||gerhi-psv.com^$all,~inline-font
@@ -10993,8 +10993,8 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||hornygirlsinapp.com^$all,~inline-font
 ||jump-path1.com^$all,~inline-font
 ||jump-path2.com^$all,~inline-font
-||redirect-path1.com^$all,~inline-font
-||redirect-path2.com^$all,~inline-font
+||redirect-path1.com^$all,~inline-font,domain=~malware-redirection-trains.*
+||redirect-path2.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ||your-online-casino.com^$all,~inline-font
 ||hot-girls-around.com^$all,~inline-font
 ||how2-become-rich.com^$all,~inline-font
@@ -11021,8 +11021,8 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||pw-show-ad.com^$all,~inline-font
 ||pw-show-main.com^$all,~inline-font
 ||pw-show-test.com^$all,~inline-font
-||pwredir-*.com^$all,~inline-font
-||redir-pw*.com^$all,~inline-font
+||pwredir-*.com^$all,~inline-font,domain=~malware-redirection-trains.*
+||redir-pw*.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ||rich-people-club.com^$all,~inline-font
 ||search-top-videos.com^$all,~inline-font
 ||secret-casino-site.com^$all,~inline-font
@@ -11357,18 +11357,18 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||defre.net^$all,~inline-font
 ||pocrd.cc^$all,~inline-font
 ||puredi.net^$all,~inline-font
-||redic.net^$all,~inline-font
-||redic2.net^$all,~inline-font
-||redic3.com^$all,~inline-font
-||redic4.com^$all,~inline-font
-||redir2.net^$all,~inline-font
-||redir3.net^$all,~inline-font
-||redir4.net^$all,~inline-font
-||redir5.net^$all,~inline-font
-||redir6.net^$all,~inline-font
-||redir7.net^$all,~inline-font
-||redir8.net^$all,~inline-font
-||redir9.net^$all,~inline-font
+||redic.net^$all,~inline-font,domain=~malware-redirection-trains.*
+||redic2.net^$all,~inline-font,domain=~malware-redirection-trains.*
+||redic3.com^$all,~inline-font,domain=~malware-redirection-trains.*
+||redic4.com^$all,~inline-font,domain=~malware-redirection-trains.*
+||redir2.net^$all,~inline-font,domain=~malware-redirection-trains.*
+||redir3.net^$all,~inline-font,domain=~malware-redirection-trains.*
+||redir4.net^$all,~inline-font,domain=~malware-redirection-trains.*
+||redir5.net^$all,~inline-font,domain=~malware-redirection-trains.*
+||redir6.net^$all,~inline-font,domain=~malware-redirection-trains.*
+||redir7.net^$all,~inline-font,domain=~malware-redirection-trains.*
+||redir8.net^$all,~inline-font,domain=~malware-redirection-trains.*
+||redir9.net^$all,~inline-font,domain=~malware-redirection-trains.*
 ||rejco.online^$all,~inline-font
 ||rejco2.store^$all,~inline-font
 ||spinwincas.online^$all,~inline-font
@@ -11660,7 +11660,7 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||glersooy.net^$all,~inline-font
 ||gliceebe.xyz^$all,~inline-font
 ||gloacmug.net^$all,~inline-font
-||go.redirected*/click?^$doc,popup
+||go.redirected*/click?^$doc,popup,domain=~malware-redirection-trains.*
 ||goldfishka-casino.xyz^$all,~inline-font
 ||gousauhu.xyz^$all,~inline-font
 ||gphyvg.com^$all,~inline-font
@@ -11961,7 +11961,7 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||rahfnq.com^$all,~inline-font
 ||raybhi.com^$all,~inline-font
 ||rcqmrz.com^$all,~inline-font
-||redirected1.com^$all,~inline-font
+||redirected1.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ||rfduik.com^$all,~inline-font
 ||rgitpv.com^$all,~inline-font
 ||riaeqd.com^$all,~inline-font
@@ -12532,7 +12532,7 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||searchassured.com^$all,~inline-font
 ||searchequivalents.com^$all,~inline-font
 ||searchexcellent.com^$all,~inline-font
-||searchingredirect.com^$all,~inline-font
+||searchingredirect.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ||searchinquire.com^$all,~inline-font
 ||searchsimilars.com^$all,~inline-font
 ||searchstarters.com^$all,~inline-font
@@ -17325,7 +17325,7 @@ zombooru.com##a[href="http://www.hard55.com"]
 ||paywide.cards^$all,~inline-font
 ||promo-carte-avantages.com^$all,~inline-font
 ||qc1.site^$all,~inline-font
-||redirect2url.com^$all,~inline-font
+||redirect2url.com^$all,~inline-font,domain=~malware-redirection-trains.*
 ||revoiut-cy.com^$all,~inline-font
 ||revoke.money^$all,~inline-font
 ||richiediilrimborso.com^$all,~inline-font
@@ -19516,7 +19516,7 @@ toorgle.net##.join
 ||nickswheels.com^$all,~inline-font
 ||spizzicopizza.net^$all,~inline-font
 ! Other
-||redirectme.net^$doc
+||redirectme.net^$doc,domain=~malware-redirection-trains.*
 ||anthargo.com^$doc
 ! Domains on IPs known to host Discord Nitro spambots
 ||cabura.loan^$all,~inline-font
@@ -20311,26 +20311,26 @@ tumblr.com#?#div[data-id][tabindex="-1"]:has(a[href^="https://href.li/?https://b
 ! Only links to another site's (APKPure) APKs, yet tries to promote its own browser extension on the alleged download pages, which comes across as suspicious
 apkfab.com##.tip-extension
 ! Google results for 'Katy and Bob: Cake Café powerpc' (04/11/2022)
-||xxlmag.com/redirect^$all,~inline-font
-||ultimateclassicrock.com/redirect^$all,~inline-font
+||xxlmag.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
+||ultimateclassicrock.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
 ||2y68554.cyou^$all,~inline-font
 ||1pwk1j.cyou^$all,~inline-font
 ||986.group^$all,~inline-font
 ||185.87.148.199^$doc
 ! Google results for 'horse tales: emerald valley ranch mobygames' (05/11/2022)
 ||imaot.co.il/ContentArea/BannerClick^$all,~inline-font
-||q1065.fm/redirect^$all,~inline-font
-||wobm.com/redirect^$all,~inline-font
-||us105fm.com/redirect^$all,~inline-font
-||wnbf.com/redirect^$all,~inline-font
+||q1065.fm/redirect^$all,~inline-font,domain=~malware-redirection-results.*
+||wobm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
+||us105fm.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
+||wnbf.com/redirect^$all,~inline-font,domain=~malware-redirection-results.*
 ||ynxqoc2.cyou^$all,~inline-font
 ||resurrectionlinks.online^$all,~inline-font
 ||canon70x70.site^$all,~inline-font
 ||gacorhub.com^$all,~inline-font
 ||zh1653.com^$all,~inline-font
 ||45.136.49.35^$doc
-||semex.com/popurl.cgi^$all,~inline-font
-||pharmanimal.com/catalog/redirect.php^$all,~inline-font
+||semex.com/popurl.cgi^$all,~inline-font,domain=~malware-redirection-results.*
+||pharmanimal.com/catalog/redirect.php^$all,~inline-font,domain=~malware-redirection-results.*
 ! Browsing around for Tajik newssites
 ||arhernot.live^$all,~inline-font
 ||lifelongkick.live^$all,~inline-font
@@ -20463,8 +20463,8 @@ cdburnerxp.se##[href*="/downloadsetup.exe"]
 ! Commonly set as a proxy on hacked devices (https://www.virustotal.com/gui/url/e610e7d09c614529cb8c64185717769946f5c86044ac5c31c6608e604995f577/detection)
 ||34.80.59.191^$all,~inline-font
 ! Various domains on https://securitytrails.com/list/ip/72.14.178.174
-|http://www6.$doc
-|http://www1.*&kw$doc
+|http://www6.$doc,domain=~often-used-in-malware-redirections.*
+|http://www1.*&kw$doc,domain=~often-used-in-malware-redirections.*
 ||megabooru.com^$all,~inline-font
 ||zombooru.com^$all,~inline-font
 ||kusubooru.com^$all,~inline-font
@@ -22897,21 +22897,21 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat
 ||[2606:4700:3030::6815:5284]^$doc,popup
 ||[2606:4700:3037::ac43:9e39]^$doc,popup
 ! Google results for «SodaStream site:no cranberry»
-/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc
-||adservice.google.*/ddm/clk/$doc
-/ad_click/q?&url=$doc
+/^https?://[a-z0-9.-]{1,}\.([a-z]{3,}|[a-z][a-tv-z]|[a-qs-z][a-z])/.*(go\.php|redirect|url=|\?re=).*\.(xn--p1ai|рф|%D1%80%D1%84)$/$doc,domain=~malware-redirection-results.*
+||adservice.google.*/ddm/clk/$doc,domain=~malware-redirection-results.*
+/ad_click/q?&url=$doc,domain=~malware-redirection-results.*
 ! Laughably blatant fraud site
 ||cosercosplay.com^$all,~inline-font
 
 ! ——— Horrendously bad copypasted Android rooting "guides" (often with fake titles) that bricked two of my phones ———
 ! Most of the guides haven't even accounted for how modern phones have replaced the recovery environment with an extra boot environment, leading to very critical Fastboot commands not working and/or bricking the phone.
-||unofficialtwrp.com^$doc
-||androidweblog.com^$doc
-||androidgreek.com^$doc
-||ytechb.com^$doc
-||gadgetstwist.com^$doc
-||gadgetsfarms.com^$doc
-||techorfy.com^$doc
+||unofficialtwrp.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
+||androidweblog.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
+||androidgreek.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
+||ytechb.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
+||gadgetstwist.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
+||gadgetsfarms.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
+||techorfy.com^$doc,domain=~had-not-updated-their-root-guides-to-reflect-a-b-partition-phones-as-of-2021.*
 
 !#if false
 ! ——— If you run a webserver of any sort, and you get incoming requests to resolve these domains, that's rarely a good sign for that requestor's intentions ———
@@ -22942,47 +22942,47 @@ tumblr.com#?#:is(.post,div[data-cell-id][style],div[tabindex]:is([style^=m],[dat
 ://ww7.$doc,domain=~ww7.be|~ww7.readsnk.com
 ://ww8.$doc,domain=~ww8.co|~ww8.ikea.com|~ww8.tiki.ne.jp|~ww8.erovoice.us|~ww8.anyanime.com|~ww8.bakushpal.az|~ww8.tokyoghoulre.com|~ww8.readonepiece.com
 ://ww9.$doc,domain=~ww9.ikea.com|~ww9.tiki.ne.jp|~ww9.sakura.ne.jp|~ww9.generali.pt|~ww9.itau.com.br
-://ww10.$doc
-://ww11.$doc
-://ww12.$doc
-://ww13.$doc
-://ww14.$doc
-://ww15.$doc,domain=~ww15.nl
-://ww16.$doc
-://ww17.$doc
-://ww18.$doc
-://ww19.$doc
-://ww20.$doc
-://ww21.$doc
-://ww22.$doc
-://ww23.$doc
-://ww24.$doc
-://ww25.$doc
-://ww26.$doc
-://ww27.$doc
-://ww28.$doc
-://ww29.$doc
-://ww30.$doc
-://ww31.$doc
-://ww32.$doc
-://ww33.$doc
-://ww34.$doc
-://ww35.$doc
-://ww36.$doc
-://ww37.$doc
-://ww38.$doc
-://ww39.$doc
-://ww40.$doc
-://ww41.$doc
-://ww42.$doc
-://ww43.$doc
-://ww44.$doc
-://ww45.$doc
-://ww46.$doc
-://ww47.$doc
-://ww48.$doc
-://ww49.$doc
-://ww50.$doc
+://ww10.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww11.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww12.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww13.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww14.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww15.$doc,domain=~ww15.nl|~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww16.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww17.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww18.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww19.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww20.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww21.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww22.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww23.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww24.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww25.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww26.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww27.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww28.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww29.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww30.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww31.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww32.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww33.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww34.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww35.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww36.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww37.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww38.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww39.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww40.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww41.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww42.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww43.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww44.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww45.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww46.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww47.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww48.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww49.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
+://ww50.$doc,domain=~practically-always-leads-to-a-domain-parking-service-known-for-malware.*
 
 ! ——— Temp hotfix for https://github.com/AdguardTeam/AdGuardHome/issues/1835 ———
 !!!/\\/$doc
@@ -23023,11 +23023,11 @@ get.adobe.com###offersInformationPane
 ||mb.download.gigabyte.com/FileList/Swhttp/DriverUpd/ANTIVIRUS^
 
 ! ——— Potential typo-squats and directly related stuff ———
-||snapchat.cm^$doc
-||facebook.cm^$doc
-||wix.cm^$doc
+||snapchat.cm^$doc,domain=~malware-typo-squatter-of-snapchat.com
+||facebook.cm^$doc,domain=~malware-typo-squatter-of-facebook.com
+||wix.cm^$doc,domain=~malware-typo-squatter-of-wix.com
 ||199.59.243.222^$doc
-|http://ww01.$doc
+|http://ww01.$doc,domain=~very-very-extremely-frequently-used-in-malware-redirections.*
 ||14d.us^$all,~inline-font
 ||173.208.96.42^$all,~inline-font
 ||173.208.96.43^$all,~inline-font