Https-everywhere: Spam notifications started (for domain Mozgvya.com), after a recent ruleset was added for it

[Lissy93]

The Issue

For the last couple of days, I am now getting a lot of spamy browser notifications for various VPN providers, always as redirects of mozgvya.com. I had a quick look at recent commits for all the extensions I have, and saw this one, https://github.com/EFForg/https-everywhere/pull/18437 on your repo, which adds a new ruleset for the mozgvya.com domain, in this file: Mozgvya.com.xml.

To me, the code looks totally fine, but I'm not too familiar with the structure of rulesets.

More Details

This has been happening a couple times an hour, for the last 4 or 5 days, I got 2 of these pop-ups while writing this issue, it's starting to drive me crazy 😝

I've seen others having a similar issue on this Reddit thread: https://www.reddit.com/r/BATProject/comments/d5m5ln/getting_a_redirect_which_i_thought_was_not/

But other than that, I couldn't find any more details about what mozgvya .com is, which has lead me to conclude that it is probably a spam site, which is bombarding people with affiliate links. It was registered and hosted on AWS, but there's nothing else to find.

The type of URLs in the pop-up

This evening I got a NordVPN add pop-up, that sent me to this URL:
https://mozgvya.com/path/lp.php?trvid=10017&trvx=1d35ebd8&var1=29_science

20 minutes later I got an ExpressVPN advert notification, with this link:
https://mozgvya.com/path/lp.php?trvid=10008&trvx=518abffe&var1=21_business

My System

I am using Brave browser on Windows 10, connected via ProtonVPN. But also am getting the same behavior with Brave on Arch Linux, with both my own OpenVPN host or ProtonVPN. I tried disabling notifications within the domain settings, but no luck. I've done several malware scans on my PC, so I don't think it's anything wrong on my end, but it could be a possibility.

---

Thank you for the amazing job you guys do with this extension, I think it's awesome! Any suggestions on how I can fix this issue would be appreciated, but sorry in advance if I am posting this in totally the wrong place.

[pipboy96]

@Lissy93 Your computer is most likely fine. I am experiencing the same behavior and was also experiencing it before this ruleset was added. It's just NordVPN and ExpressVPN pay a lot for BAT ads, and thus their ads are the ones most often displayed. Try going to brave://rewards/ and disabling ads.

[pipboy96]

We do not officially support installing HTTPS Everywhere extension on Brave, it includes its own version of HTTPS rewriter written in C++, and doesn't require installation of HTTPS Everywhere extension.

[Lissy93]

Cool, that makes sense. Thanks for getting back to me, and sorry for the irrelevant issue 🚀

[pipboy96]

@Lissy93 No problem. 😃