.
! **********************************************************
! Block rules to increase security *
! **********************************************************
! Block risky and depreciated EVAL javascript command
#%#//scriptlet('noeval')
! Block everything except a few common Top Level Domains and (EU) Schengen and 5 Eyes countries
||*$all,denyallow=|com|edu|io|net|org|EU|AT|BE|CZ|DK|EE|FI|FR|DE|GR|HU|IS|IT|LV|LT|LU|MT|NL|NO|PL|PT|SK|SI|ES|SE|CH|HR|LI|US|UK|CA|AU|NZ
! Block file share services also used to host malware
||anonfiles.com$all
||discord.com/attachments$all
||file.io$all
||gofile.io$all
||hastebin.com$all
||ix.io$all
||pastebin.com$all
||pixeldrain.com$all
||tmpfiles.org$all
||ufile.io$all
||uploadfiles.io$all
||volafile.org$all
||zippyshare.com$all
! Block Linux executable and script formats on code sharing domains
||bitbucket.org/*.awk$all
||bitbucket.org/*.bash$all
||bitbucket.org/*.js$all
||bitbucket.org/*.ksh$all
||bitbucket.org/*.php$all
||bitbucket.org/*.pl$all
||bitbucket.org/*.rb$all
||bitbucket.org/*.sed$all
||bitbucket.org/*.sh$all
||bitbucket.org/*.tcl$all
||bitbucket.org/*.zsh$all
||bitbucket.org/*.elf$all
||bitbucket.org/*.aout$all
||bitbucket.org/*.coff$all
||bitbucket.org/*.bin$all
||bitbucket.org/*.deb$all
||bitbucket.org/*.rpm$all
||bitbucket.org/*.tar.gz$all
||bitbucket.org/*.tar.xz$all
||bitbucket.org/*.flatpak$all
||bitbucket.org/*.appimage$all
||bitbucket.org/*.snap$all
||github.com/*.awk$all
||github.com/*.bash$all
||github.com/*.js$all
||github.com/*.ksh$all
||github.com/*.php$all
||github.com/*.pl$all
||github.com/*.rb$all
||github.com/*.sed$all
||github.com/*.sh$all
||github.com/*.tcl$all
||github.com/*.zsh$all
||github.com/*.elf$all
||github.com/*.aout$all
||github.com/*.coff$all
||github.com/*.bin$all
||github.com/*.deb$all
||github.com/*.rpm$all
||github.com/*.tar.gz$all
||github.com/*.tar.xz$all
||github.com/*.flatpak$all
||github.com/*.appimage$all
||github.com/*.snap$all
||githubusercontent.com/*.awk$all
||githubusercontent.com/*.bash$all
||githubusercontent.com/*.js$all
||githubusercontent.com/*.ksh$all
||githubusercontent.com/*.php$all
||githubusercontent.com/*.pl$all
||githubusercontent.com/*.rb$all
||githubusercontent.com/*.sed$all
||githubusercontent.com/*.sh$all
||githubusercontent.com/*.tcl$all
||githubusercontent.com/*.zsh$all
||githubusercontent.com/*.elf$all
||githubusercontent.com/*.aout$all
||githubusercontent.com/*.coff$all
||githubusercontent.com/*.bin$all
||githubusercontent.com/*.deb$all
||githubusercontent.com/*.rpm$all
||githubusercontent.com/*.tar.gz$all
||githubusercontent.com/*.tar.xz$all
||githubusercontent.com/*.flatpak$all
||githubusercontent.com/*.appimage$all
||githubusercontent.com/*.snap$all
||gitlab.com/*.awk$all
||gitlab.com/*.bash$all
||gitlab.com/*.js$all
||gitlab.com/*.ksh$all
||gitlab.com/*.php$all
||gitlab.com/*.pl$all
||gitlab.com/*.rb$all
||gitlab.com/*.sed$all
||gitlab.com/*.sh$all
||gitlab.com/*.tcl$all
||gitlab.com/*.zsh$all
||gitlab.com/*.elf$all
||gitlab.com/*.aout$all
||gitlab.com/*.coff$all
||gitlab.com/*.bin$all
||gitlab.com/*.deb$all
||gitlab.com/*.rpm$all
||gitlab.com/*.tar.gz$all
||gitlab.com/*.tar.xz$all
||gitlab.com/*.flatpak$all
||gitlab.com/*.appimage$all
||gitlab.com/*.snap$all
||gitlab.io/*.awk$all
||gitlab.io/*.bash$all
||gitlab.io/*.js$all
||gitlab.io/*.ksh$all
||gitlab.io/*.php$all
||gitlab.io/*.pl$all
||gitlab.io/*.rb$all
||gitlab.io/*.sed$all
||gitlab.io/*.sh$all
||gitlab.io/*.tcl$all
||gitlab.io/*.zsh$all
||gitlab.io/*.elf$all
||gitlab.io/*.aout$all
||gitlab.io/*.coff$all
||gitlab.io/*.bin$all
||gitlab.io/*.deb$all
||gitlab.io/*.rpm$all
||gitlab.io/*.tar.gz$all
||gitlab.io/*.tar.xz$all
||gitlab.io/*.flatpak$all
||gitlab.io/*.appimage$all
||gitlab.io/*.snap$all
||sourceforge.net/*.awk$all
||sourceforge.net/*.bash$all
||sourceforge.net/*.js$all
||sourceforge.net/*.ksh$all
||sourceforge.net/*.php$all
||sourceforge.net/*.pl$all
||sourceforge.net/*.rb$all
||sourceforge.net/*.sed$all
||sourceforge.net/*.sh$all
||sourceforge.net/*.tcl$all
||sourceforge.net/*.zsh$all
||sourceforge.net/*.elf$all
||sourceforge.net/*.aout$all
||sourceforge.net/*.coff$all
||sourceforge.net/*.bin$all
||sourceforge.net/*.deb$all
||sourceforge.net/*.rpm$all
||sourceforge.net/*.tar.gz$all
||sourceforge.net/*.tar.xz$all
||sourceforge.net/*.flatpak$all
||sourceforge.net/*.appimage$all
||sourceforge.net/*.snap$allOkay finally decided (at least I think and hope so
Code:! ********************************************************** ! Block rules to increase security and privacy * ! ********************************************************** ! Block tracking pings and beacons ||*$ping #%#//scriptlet('abort-on-property-read', 'sendBeacon') ! Block risky and depreciated EVAL javascript command #%#//scriptlet('noeval') ! Block everything except from common Top Level Domains ||*$all,denyallow=nl|be|de|uk|eu|com|edu|io|net|org|abuse.ch ! Block file share services also used to host malware ||anonfiles.com$all ||discord.com/attachments$all ||file.io$all ||gofile.io$all ||hastebin.com$all ||ix.io$all ||pastebin.com$all ||pixeldrain.com$all ||tmpfiles.org$all ||transfer.sh$all ||ufile.io$all ||uploadfiles.io$all ||volafile.org$all ||zippyshare.com$all ! Block Linux executable and script formats on code sharing domains ||bitbucket.org/*.awk$all ||bitbucket.org/*.bash$all ||bitbucket.org/*.js$all ||bitbucket.org/*.ksh$all ||bitbucket.org/*.php$all ||bitbucket.org/*.pl$all ||bitbucket.org/*.rb$all ||bitbucket.org/*.sed$all ||bitbucket.org/*.sh$all ||bitbucket.org/*.tcl$all ||bitbucket.org/*.zsh$all ||bitbucket.org/*.elf$all ||bitbucket.org/*.aout$all ||bitbucket.org/*.coff$all ||bitbucket.org/*.bin$all ||bitbucket.org/*.deb$all ||bitbucket.org/*.rpm$all ||bitbucket.org/*.tar.gz$all ||bitbucket.org/*.tar.xz$all ||bitbucket.org/*.flatpak$all ||bitbucket.org/*.appimage$all ||bitbucket.org/*.snap$all ||github.com/*.awk$all ||github.com/*.bash$all ||github.com/*.js$all ||github.com/*.ksh$all ||github.com/*.php$all ||github.com/*.pl$all ||github.com/*.rb$all ||github.com/*.sed$all ||github.com/*.sh$all ||github.com/*.tcl$all ||github.com/*.zsh$all ||github.com/*.elf$all ||github.com/*.aout$all ||github.com/*.coff$all ||github.com/*.bin$all ||github.com/*.deb$all ||github.com/*.rpm$all ||github.com/*.tar.gz$all ||github.com/*.tar.xz$all ||github.com/*.flatpak$all ||github.com/*.appimage$all ||github.com/*.snap$all ||githubusercontent.com/*.awk$all ||githubusercontent.com/*.bash$all ||githubusercontent.com/*.js$all ||githubusercontent.com/*.ksh$all ||githubusercontent.com/*.php$all ||githubusercontent.com/*.pl$all ||githubusercontent.com/*.rb$all ||githubusercontent.com/*.sed$all ||githubusercontent.com/*.sh$all ||githubusercontent.com/*.tcl$all ||githubusercontent.com/*.zsh$all ||githubusercontent.com/*.elf$all ||githubusercontent.com/*.aout$all ||githubusercontent.com/*.coff$all ||githubusercontent.com/*.bin$all ||githubusercontent.com/*.deb$all ||githubusercontent.com/*.rpm$all ||githubusercontent.com/*.tar.gz$all ||githubusercontent.com/*.tar.xz$all ||githubusercontent.com/*.flatpak$all ||githubusercontent.com/*.appimage$all ||githubusercontent.com/*.snap$all ||gitlab.com/*.awk$all ||gitlab.com/*.bash$all ||gitlab.com/*.js$all ||gitlab.com/*.ksh$all ||gitlab.com/*.php$all ||gitlab.com/*.pl$all ||gitlab.com/*.rb$all ||gitlab.com/*.sed$all ||gitlab.com/*.sh$all ||gitlab.com/*.tcl$all ||gitlab.com/*.zsh$all ||gitlab.com/*.elf$all ||gitlab.com/*.aout$all ||gitlab.com/*.coff$all ||gitlab.com/*.bin$all ||gitlab.com/*.deb$all ||gitlab.com/*.rpm$all ||gitlab.com/*.tar.gz$all ||gitlab.com/*.tar.xz$all ||gitlab.com/*.flatpak$all ||gitlab.com/*.appimage$all ||gitlab.com/*.snap$all ||gitlab.io/*.awk$all ||gitlab.io/*.bash$all ||gitlab.io/*.js$all ||gitlab.io/*.ksh$all ||gitlab.io/*.php$all ||gitlab.io/*.pl$all ||gitlab.io/*.rb$all ||gitlab.io/*.sed$all ||gitlab.io/*.sh$all ||gitlab.io/*.tcl$all ||gitlab.io/*.zsh$all ||gitlab.io/*.elf$all ||gitlab.io/*.aout$all ||gitlab.io/*.coff$all ||gitlab.io/*.bin$all ||gitlab.io/*.deb$all ||gitlab.io/*.rpm$all ||gitlab.io/*.tar.gz$all ||gitlab.io/*.tar.xz$all ||gitlab.io/*.flatpak$all ||gitlab.io/*.appimage$all ||gitlab.io/*.snap$all ||sourceforge.net/*.awk$all ||sourceforge.net/*.bash$all ||sourceforge.net/*.js$all ||sourceforge.net/*.ksh$all ||sourceforge.net/*.php$all ||sourceforge.net/*.pl$all ||sourceforge.net/*.rb$all ||sourceforge.net/*.sed$all ||sourceforge.net/*.sh$all ||sourceforge.net/*.tcl$all ||sourceforge.net/*.zsh$all ||sourceforge.net/*.elf$all ||sourceforge.net/*.aout$all ||sourceforge.net/*.coff$all ||sourceforge.net/*.bin$all ||sourceforge.net/*.deb$all ||sourceforge.net/*.rpm$all ||sourceforge.net/*.tar.gz$all ||sourceforge.net/*.tar.xz$all ||sourceforge.net/*.flatpak$all ||sourceforge.net/*.appimage$all ||sourceforge.net/*.snap$all
I don't block Windows exe on my Linux laptop
I checked the AG rules work, either it is silently blocked (third-party) or throw a AG block page (first-party), I tested with abuse.ch entries
This first sample URL is already blocked by the uBlock Origin filter "Online Malicious URL Blocklist" If you proceed with uBO, it is immediately blocked by McAfee WebAdvisor and Kaspersky, as you can see in the second screenshot below.
This second sample URL was even more incredible. The block was performed again by the uBlock "Online Malicious URL Blocklist" filter list, and then by uBlock, followed by a block by McAfee WebAdvisor. Although McAfee WebAdvisor blocked it, it failed and did not prevent me from downloading the malware sample. Even so, when I clicked to save it, Norton Safe rose from the ashes and sprang into action, preventing me from downloading the sample, as you can see in the third screenshot below this post.
This was the first time I saw Norton Safe spring into action, and I was surprised that it prevented me from downloading the zip file.
From version 1.86 Brave browser allows you to disable the default blocklists (when you enable brave://flags/#brave-adblock-show-hidden-components) .
Finalized tweaking extensions and filter usage for best compatibility and performance (work profile with 19.1 score on Speedometer 3.1) and best blocking and security (surfing profile with 18.5 score on Speedometer 3.1). I disabled Brave's tracking filter (replaced it with Peter Low's) and first-party filter (replaced it with Custom rules).
Finally achieved same speedometer 3.1 benchmarks in Linux with Brave in Flatpak sandbox as my wife (on same HP laptop) on Windows 11 running standard user with Chrome and only Avira Safe Browsing extension (with its conservative anti-tracking) enabled.
The same policy; Hagezi TIF at DNS level and Easylist at browser level.
Yes, you are right (tried to cheat against the "don't fix what ain't broken" rule by editing the posts, which you as elite investigator noticed immediately
Switched back to AdGuard again, because it is easier to trouble shoot (using log) and has a blockpage (triggered by $document for first-party)
View attachment 294751
I also split the $all rule for hosting services known to host malware phishing (like GoDaddy, Weebly, Hostinger and NameCheap). Bij splitting the $all rule in document and third-party, any website blocked has a fair chance of functioning after choosing 'Proceed anyway' button.
I still use $all for blocking file sharing services often hosting malware (e.g. anonfiles, discord.com/attachments, file.io. gofile.io, hastebin, ix.io, pastebin.com, pixeldrain. tmpfiles.org, ufile.io, uploadfiles.io, volafile.org, zippyshare) and Linux executable and script formats hosted on popular coding platforms (like bitbucket, github, githubusercontent, gitlab and sourceforge).
Latest 10 https links on phishtank: AG blocked 7, Cloudflare ZT 2, Google safe browsing 1
View attachment 294753
