Uassets: twoddl.co

Created on 19 Nov 2017 · 28Comments · Source: uBlockOrigin/uAssets

URL(s) where the issue occurs

twoddl.co, rarbg.to & some other sites which my popups are based on.

Describe the issue

Whenever I browse the mentioned sites above & press on their search bar or even anywhere on the page, I get a popup with malicious sites like izxdpodiowdgp.bid, 35.188.14.213, b.codeonclick.com or nextlnk1.com and then it keeps redirecting itself to advertising websites.
Your help means the world :)

Screenshot(s)

No need.

Versions

Browser/version: FF 57
uBlock Origin version: 1.14.18

Settings

https://i.imgur.com/FomOHcj.jpg

Notes

None.

Source

salam2009

All 28 comments

you had your answer here:
https://forums.lanik.us/viewtopic.php?p=128012#p128012

twoddl.co##script:inject(popads.net.js)

rarbg.to already in the ublock filters

mapx- on 19 Nov 2017

What about the other sites which use the same mentioned popups (Like myegy.tv), isn’t there some global filter for them? That’s why I had to post my issue here too, so I can be sure I’m not missing anything.

salam2009 on 19 Nov 2017

no general rules => just provide all those sites

mapx- on 19 Nov 2017

Okay, thank you for your confirmation.

salam2009 on 19 Nov 2017

I will add filters for the popup issues.

okiehsch on 19 Nov 2017

Are you gonna add them to one of uBO default filters so they can be updated automatically?
Or should I get them somewhere else?

salam2009 on 19 Nov 2017

I will add them to uBO-filters, after I commit you can update your filter list.

okiehsch on 19 Nov 2017

BTW, I do not get any popups at rarbg.to with a uBO-default setup, so the commit will not include any rarbg-filters.

okiehsch on 19 Nov 2017

I didn't check rarbg after installing uBO & @mapx- said that uBO already have filters for it, but the popups do appear on myegy.tv, twoddl.co & some others before adding their filters manually.

salam2009 on 19 Nov 2017

What are the "other" domains?

okiehsch on 19 Nov 2017

mkvcage.com, ganool.se, arabseed.tv are giving me http://35.188.14.213/ popups!

salam2009 on 19 Nov 2017

myegy.tv##script:inject(abort-current-inline-script.js, A, popunders) myegy.tv##script:inject(abort-on-property-write.js, H7WWWW) mkvcage.com,twoddl.co##script:inject(abort-on-property-write.js, _pop) arabseed.tv,ganool.se,mkvcage.com##script:inject(nowebrtc.js)
works on my end.

okiehsch on 19 Nov 2017

👍1

and on my end:

twoddl.co##script:inject(popads.net.js)
||myegy.tv/files/js/alaz.compiled.
myegy.tv##script:inject(abort-current-inline-script.js, popunders)
mkvcage.com##script:inject(popads.net.js)
mkvcage.com##script:inject(abort-current-inline-script.js, atob)
||adscpm.site^
ganool.se##script:inject(abort-current-inline-script.js, adcashMacros)
ganool.se##[id^=epom]
arabseed.tv##script:inject(abort-current-inline-script.js, atob)
||old.arabseed.com/pop/$image

mapx- on 19 Nov 2017

Wow, you guys are really awesome :)
Too bad I have to do this on every other similar sites.

salam2009 on 19 Nov 2017

@mapx-
Well, the atob filters could break legitimate content, so I would always prefer the nowebrtc.js.
myegy.tv##script:inject(abort-current-inline-script.js, popunders) what are you fixing with that filter?
||myegy.tv/files/js/alaz.compiled. already takes care of the popunder

okiehsch on 19 Nov 2017

I saw this script in the source

<script>
--
  | document.domain = "myegy.tv";
  | window.A = {
  | popunders: ["http:\/\/replainy.co\/out?zoneId=2427346-2427421"]         };
  | </script>

probably it's harmless blocking the external script

mapx- on 19 Nov 2017

I disabled that script with myegy.tv##script:inject(abort-current-inline-script.js, A, popunders)
Your filter will not work, see for yourself:
Add only
myegy.tv##script:inject(abort-current-inline-script.js, popunders)
then click on any film/series at myegy.tv, and you will get the replainy-popup/under

okiehsch on 19 Nov 2017

I see, needing the "window" => A, right ?

mapx- on 19 Nov 2017

Yes, and then you can narrow it down, with "popunders", to lessen the likelyhood of site breakage.
abort-current-inline-script.js, A, popunders, the second one can be anything in that inline-script.
For example abort-current-inline-script.js, A, replainy.co would also work.

okiehsch on 19 Nov 2017

👍1

However, would be great having the injecting filters in the logger ..
https://github.com/gorhill/uBlock/issues/2877

mapx- on 19 Nov 2017

That would make it easier, if somebody reports some broken site I always check uBO-filters if there are any script:inject filters for that site, unless the cause of the breakage is obvious of course.
But I don't think the average user is really missing that feature.

okiehsch on 19 Nov 2017

👍1

@okiehsch hi, I get a redirection on rarbg.to to rarbgmirror.xyz, and there are popups.
uBlock filters already has rarbg.to##script:inject(abort-on-property-read.js, _wm3)