Hosts: Instart Logic pissed me off

[kyrios21]

Hi Daniel,

It's me again. Hope you still remembering me.
I dunno whether this is an issue or not. You may even close it and consider this as a longue or a light talk.
Recently, I just learned something about Instart Logic.
Some websites use Instart Logic making the hosts file render in useless.
Becoz they move their js files into their own sub-domain.

I noticed when browser is Firefox, they do not use Instart Logic.
But when browser is Maxthon, they use Instart Logic and render the hosts file useless.
Is it related with browser? Caused by User Agent which is used the browser?
msn.com, goal.com, and dailymail.co.uk just to name a few of websites use Instart Logic.
When visiting those websites, I got lot of ads shown becoz of Instart Logic.

BTW, why noone make the hosts file included with sub-domain produced by Instart Logic?
Please enlighten me.

[kyrios21]

The reason I just wanna ask becoz of this.
I just visited dailymail.co.uk and was shocked knowing there's big iframe ads in left and right column.
And the suspect was www.sdad.guru
You won't notice this URL suspect if you use firefox (no Instart Logic). But if you use Maxthon, you will see.

But I read in steven list, it's marked as
# 0.0.0.0 www.sdad.guru #[affects msn.com]
OK, I'll find out why blocking www.sdad.guru will affect msn.com, I talk to myself.
With firefox, it won't affect (no Instart logic). With Maxthon and Chrome (Instart Logic), www.sdad.guru blocking will make no images visible in msn.com.
So steven is correct, www.sdad.guru indeed affect msn.com

[kyrios21]

Just read this. This is getting interesting
https://source.ind.ie/better/content/issues/867

[lightswitch05]

Hey @kyrios21 - you would probably like to read this ticket that talks more about Instart Crap https://github.com/StevenBlack/hosts/issues/801

The subdomains are basically random, so it would be impossible to generate a hosts file with all of them blocked. Even uBlock origin cannot block them. I suggest using Firefox as your primary browser. Perhaps uBlock origin will eventually be able to block requests based on headers - which is how Instart Crap is sending information

[kyrios21]

Hi Daniel,

maxthon is based on Chrome core. So you mean all Gecko browser will not be affected by InstartCrap and Webkit will?

[lightswitch05]

They are all affected, but they definitely do more targeting Chrome and modify behavior based on the dev tools being open or not. I just like Firefox, which also has built-in ad and tracking protection - but it still can't block InstartCrap. We really need a extension that can block based on headers

[dnmTX]

And yet i thought it was already dealt with. I guess not 🤔
@kyrios21 try to change your user agent and see if it will make any difference.Just a thought.

[kyrios21]

@dnmTX no, it can't
I just saw seomething. Firefox is almost immune to IL.
But there's Chrome extension which built for that purpose.
https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO-Extra-is-useful
I check with msn.com , and UBO Extra with Chrome really works.
I just wish someone fork UBO and UBO Extra for Maxthon.
The only adblocker extension for Maxthon is only ABP, and the version is really old.

Meanwhile, I've tried removing hosts file and use Maxthon for a test.
IL thought I'm a good boy coz the IL never kick in. Means the JS files fed from original location/ URL,
not from sub-domain.
The hard part is to find out which JS file(s) responsible for IL decision.
I tried with goal.com

[kyrios21]

OK,

Here's how I tested
Maxthon : ABP 1.0.0 (very old; the one and only available Adblock extension in Maxthon)
Firefox : Nano Adblocker 1.0.0.97 (latest)
Chrome : UBO Origin 1.18.10 (latest)

My initial finding how IL work is IL code must be inserted in the PHP/ASP file of each page.
Usually, $generichide is suffice to beat IL code. For example msn.com
All of the browsers I tested able to defeat msn.com

But in goal.com, $generichide does not work with Maxthon.
Could be the ABP in Maxthon is old or the $generichide is not implemented properly and
need to be updated (either the $generichide code or the ABP itself) .
Firefox and Chrome with $generichide are able to defeat goal.com

So I further played goal.com with Maxthon since $generichide does not work.
The way IL work is if they detect adblock, they try to refresh the page via web scoket.
1st they calling JS file from wfpscripts.webspectator.com
After that, they refresh the page using web socket from either of these URLs
msgws-useast1-s0001.webspectator.com
msgws-useast1-s0002.webspectator.com
msgws-useast1-s0003.webspectator.com
msgws-useast1-s0004.webspectator.com

Blocking the JS host (wfpscripts.webspectator.com) and those web socket URL does not work
with Maxthon. So the only way to beat it, is with blocking the sub-domain of goal.com
which is generated by IL code. Ugly but work.
The down side is the page is kinda slow to appear compared with opened with Chrome and Firefox.

That's my initial finding.

[kyrios21]

Edit : Maxthon with $generichide only works at front page of msn.com
Does not work at any article/link on that website.
Using sub-domain blocking does not work as well becoz the JS files responsible for ads also deployed
in the same sub-domain with JS files responsible for working website.

It's definitely UBO & UBO Extra need to be forked to Maxthon as Maxthon use Chrome core.

[lightswitch05]

Looks like webspectator.com is in a lot of lists already - but its missing many of the subdomains. Time to see what my expanded list can find

[lightswitch05]

It was able to find all those msgws-useast1 subdomains and more! :)

[dnmTX]

@kyrios21 what do you mean by

@dnmTX no, it can't

If that browser is based on chrome/chromium just make shortcut then right click -> properties and on the "Target" field add at the end: space --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0" and go to: https://www.whatismybrowser.com/detect/what-is-my-user-agent and see if it's working.

[kyrios21]

@dnmTX Oh... I made you confuse buddy. Sorry,
Yes, it can change user agent. What I mean by can't is by behaving /disguise Maxthon as Chrome will not make Maxthon immune to IL as Chrome itself weak again IL. I tried Chrome with msn.com

But Chrome with UBO Extra indeed make Chrome more resistant to IL.

[dnmTX]

@kyrios21

What I mean by can't is by behaving /disguise Maxthon as Chrome will not make Maxthon immune to IL as Chrome itself weak again IL

You actually disguising it as Firefox.....