From da25a961189b0e733843a07a08a78987f7a0db44 Mon Sep 17 00:00:00 2001
From: Hugo <hugo@notainutilis.fr>
Date: Mon, 2 Oct 2023 11:38:36 +0200
Subject: [PATCH] sources and script cleaning for match pattern

---
 scripts/update.sh                                |  2 +-
 .../Malvertisement external forwarding.txt       |  5 ++++-
 sources/Malware/Malvertisement redirection.txt   | 16 ++++++++++++++++
 ... software.txt => Software name squatting.txt} |  0
 4 files changed, 21 insertions(+), 2 deletions(-)
 rename sources/Malware/{Name squatting software.txt => Software name squatting.txt} (100%)

diff --git a/scripts/update.sh b/scripts/update.sh
index f537f130..d380fc0e 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -6,7 +6,7 @@
 
 # Cleanup sources:
 ## Normalizes URLs into domains: lowercases, remove leading spaces, protocol (`x://`) `www.` subdomains, everything after `/`, only one space before `#`. Keeps comments intact.
-find ./sources -type f -name "*.txt" -exec sed -ri 'h; s/[^#]*//1; x; s/#.*//; s/.*/\L&/; s/^[[:space:]]*//i; s/^.*:\/\///i; s/^www\.//i; s/\/[^[:space:]]*//i; s/[[:space:]].*$/ /i; G; s/(.*)\n/\1/' {} \;
+find ./sources -type f -name "*.txt" -exec sed -ri 'h; s/[^#]*//1; x; s/#.*//; s/.*/\L&/; s/^[[:space:]]*//i; s/^.*:\/\///i; s/^[.*]*//i; s/^www\.//i; s/\/[^[:space:]]*//i; s/[[:space:]].*$/ /i; G; s/(.*)\n/\1/' {} \;
 ## Remove duplicate domains from each source file (keeps repeated comments and empty lines for organization).
 find ./sources -type f -name "*.txt" -exec bash -c '
     awk "(\$0 ~ /^[[:space:]]*#/ || NF == 0 || !seen[\$0]++)" "$0" > "$0_temp.txt";
diff --git a/sources/Malware/Malvertisement external forwarding.txt b/sources/Malware/Malvertisement external forwarding.txt
index fcf1ff1f..ee94d85c 100644
--- a/sources/Malware/Malvertisement external forwarding.txt	
+++ b/sources/Malware/Malvertisement external forwarding.txt	
@@ -1,3 +1,6 @@
-# Uses the external forwarding service to redirect to a string of websites which trigger advertisement, badware and malware adblock filter lists.
+# These URLs are called by the external forwarding service of a legitimate website
+# The site is not fully compromised but used to redirect to a string of websites which trigger advertisement, badware and malware adblock filter lists.
 
 sudrtestt.ru
+rxpromsoftware.ru
+vestibularfce.com.br
\ No newline at end of file
diff --git a/sources/Malware/Malvertisement redirection.txt b/sources/Malware/Malvertisement redirection.txt
index b1d019e3..f131e4cf 100644
--- a/sources/Malware/Malvertisement redirection.txt	
+++ b/sources/Malware/Malvertisement redirection.txt	
@@ -42,3 +42,19 @@ immobiliensky24.de
 adriamoevents.pl
 forum-wissenschaft-und-kunst.de
 agentur-hagemeier.de
+https://lrdyi.gartenbau-u.de/
+*://*.trockenbau-trebsen.de/*
+*://*.indexdummy3.de/*
+*://*.elternverein-cvd-gs.de/*
+*://*.webock.de/*
+*://*.kintagencia.es/*
+*://*.medcarelabjo.com/*
+*://*.h4s-baustelle.de/*
+*://*.makler-schiermeyer.de/*
+*://*.ekw-sport-sozialmarketing.de/*
+*://*.mkkinsektenschutz.de/*
+*://*.meblegrzywacz.pl/*
+*://*.bremen-kammerjaeger.de/*
+*://*.contact-protect.de/*
+*://*.phillee-sports.de/*
+*://*.mennica-woda.pl/*
\ No newline at end of file
diff --git a/sources/Malware/Name squatting software.txt b/sources/Malware/Software name squatting.txt
similarity index 100%
rename from sources/Malware/Name squatting software.txt
rename to sources/Malware/Software name squatting.txt