diff --git a/Source/domainset/cdn.conf b/Source/domainset/cdn.conf
index da6ff5b4..a934abbb 100644
--- a/Source/domainset/cdn.conf
+++ b/Source/domainset/cdn.conf
@@ -5648,3 +5648,4 @@ magic.scalar.com # PostHog
 imgix.datadoghq.com
 .dd-static.net
 data.peer.as
+cdn.seedance2.ai # Cloudflare R2
diff --git a/Source/domainset/reject.conf b/Source/domainset/reject.conf
index e52dad5f..a1111120 100644
--- a/Source/domainset/reject.conf
+++ b/Source/domainset/reject.conf
@@ -99,11 +99,25 @@ bad.third-party.site
 # https://blog.huli.tw/2024/06/25/stop-using-polyfill-io/
 # https://sansec.io/research/polyfill-supply-chain-attack
 # https://www.bleepingcomputer.com/news/security/polyfillio-javascript-supply-chain-attack-impacts-over-100k-sites/
+# https://cside.com/blog/funnull-sanctioned-polyfill-infrastructure-laundering
+# https://blog.xlab.qianxin.com/funnull-resurfaces-exposing-ringh23-arsenal-and-maccms-supply-chain-attacks/
 .polyfill.io
 .polyfill-js.cn
 .polyfill.top
 .polyfill.com
 .polyfillcache.com
+.unionadjs.com
+.cdn1.ai
+.jquecy.com
+.jsdclivr.com
+.clondclare.com
+.bytedauce.com
+.maccms.la
+.bdustatic.com
+.jsdelivr.vip
+.macoms.la
+.ailyunoss.com
+.110.nz
 # Scam "Software Alternatives"
 # capterra recommend fake, unrelated, and worse, malware
 .capterra.com