Hosts: Could you check https://knowyourmeme.com?

[ghost]

Every time i enter https://knowyourmeme.com my CPU load gets high. Is it just me? I'm thinking about mining or special scripts. Just a suggestion.

[ScriptTiger]

Are you experiencing a one-time burst of CPU activity when you initially load the page or is it a sustained load for the duration of your visit on the website?

[ghost]

It's a sustained load. Eventually, I'm forced to close the tab. It happened many times.

[dnmTX]

@pr10n there are 2-3 domains that are not in the lists,not sure how "harmful" they are but you can add them and see if it's better.I personally can't reproduce the issue on my end.
toolbar.complex.com
xhr.acrabakasaka.com try this one first(the rest are more like annoyances)
assets.pinterest.com
api.b2c.com
www.civicscience.com try this one too

[ghost]

I decided to block the knowyourmeme domain itself. I just thought it'd be good to let you know that I have a CPU load issue with that domain just in case it's a reproducible and fixable issue.

[ScriptTiger]

Good catch, @dnmTX.
mvps.org hits on stats.complex.com and @lightswitch05 hits on b2c.com, adserver.b2c.com, cdn.adserver.b2c.com, and api-54-190-136-221.b2c.com.

After checking the source, I can only confirm media.complex.com and api.b2c.com as being known domains that should be blocked but aren't, so I'll add those to my current PR. The rest might take some more research.

[StevenBlack]

This is fixed in #793. Thanks everybody!

Closing.

[dnmTX]

xhr.acrabakasaka.com hosts script that brings ads and tracking once it's loaded.This is taken from the script:

Ping @lightswitch05

[lightswitch05]

@dnmTX thanks, I already have acrabakasaka.com and a.acrabakasaka.com in the list, happy to add xhr.acrabakasaka.com as well

[dnmTX]

@lightswitch05 happy to help.Also,can you check https://civicscience.com/. Their website is all about surveys,tracking and ads.There is also script from them on that page:

<script src='https://www.civicscience.com/widget/jspoll/?elt=b1f8e488-f090-efc4-a171-a882913dc7e1&amp;tgtid=c8664869-1ef2-4db4-f522-99c24c1abf3f' type='text/javascript'></script>

P.S. If you add this make sure to include www. in the front.

[mrjackyliang]

Anyone looking for information on "b2c.com", it belongs to FouAnalytics. Proof here. Took me a couple of weeks!

Original: https://api.fouanalytics.com/api/init-825pey2s3vo35t7mv0d.js
Hidden: https://api.b2c.com/api/init-825pey2s3vo35t7mv0d.js

Connection between b2c.com and fouanalytics.com found here: https://clutchpoints.com.atlaq.com. And use this to unpack their hidden eval code.

Bonus: http://pi-hole.b2c.com/admin/ 😂

[dnmTX]

I can confirm @mrjackyliang's findings and we already know that anything related to b2c.com is as bad as it can get.
But i also found this:
https://www.linkedin.com/pulse/fouanalytics-alternative-google-analytics-fraud
so at this point i'm kind of on the crossroad so i'll leave it to Steve @StevenBlack to make the call here.
In case it's approved those are the domains that will need to be blocked:
0.0.0.0 api.fouanalytics.com
0.0.0.0 adsbydomain.fouanalytics.com

[mrjackyliang]

Dr. Fou is often on Twitter also. One of the really interesting things I found in their hidden eval code is that it is a fingerprinting mechanism, a very specific one.

[StevenBlack]

Thanks Jacky @mrjackyliang and Dan @dnmTX, I've added those two fouanalytics.com domains in commit 58b36a7e.

[llacb47]

Another website using the api.fouanalytics.com script: https://thoughtcatalog.com/

[dnmTX]

@ScriptTiger, @llacb47 was just informing us where he found api.fouanalytics.com and not suggesting the entire website to be blocked because of it. He is pretty knowledgeable how things work and very helpful around here 😉

[ScriptTiger]

Oh, sorry! I read it wrong lol. Yeah, I see you guys are making a list of "evidence" for the case. Okay, okay, sorry :P