AdguardTeam / FiltersRegistry

Known filters subscriptions transformed for better compatibility with AdGuard
GNU Lesser General Public License v3.0
235 stars 54 forks source link

Add «Dandelion Sprout's Anti-Malware List» #954

Open DandelionSprout opened 3 months ago

DandelionSprout commented 3 months ago

Prerequisites

Problem description

Hoping to make my anti-malware list recognised as a major security list once and for all, alongside the small handful of other lists in that field that doesn't really cover much (in particular Online Malicious URL Blacklist).

Proposed solution

Add https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareAdGuard.txt to https://github.com/AdguardTeam/FiltersRegistry/tree/master/filters/ThirdParty

Additional information

I attempted to figure out how to create a full pull request for this, but unfortunately the repo system for lists was incomprehensible to me. 😓

The list is also covered by Dandelion Sprout's Annoyances List, so a note similar to that used for "EasyList" towards "AdGuard Base" (that the former is already covered by the latter), should be added for Anti-Malware List as well as for Legitimate URL Shortener towards Dandelion Sprout's Annoyances List.

DandelionSprout commented 2 months ago

Additional notes added at a later time than the OP

The list is to the best of my current knowledge the only dedicated anti-malware list to use AdGuard-specific syntax, in particular $network. However, it dawned on me only just now that I'll need to do dual-coverage of the paid AdGuard versions and the Browser Extension versions (by using both 250.250.250.250$network and ||250.250.250.250^$all). I can handle that later this week.

The way the list is made has some similarities to uBlock Filters Badware Risks, in that both lists are based on live experiences from people who browse the internet normally (whereas alleged security firms out there just base them on very poorly performed filescans). The main difference (that I'm currently aware of) between my list and Badware Risks is that I usually cover all domains found on bad IPs (occasionally reaching 3- or 4-digit amounts of domains), while they cover the most common malware domains that users encounter.