Uassets: How to beat analytic.press?

[MioVisman]

URL(s) where the issue occurs

http://rh.adsh.org.ua/search.php?action=show_recent
And many other Russian-language sites

Describe the issue

The analytic.press statistics are connected on the sites by replacing the original js scripts through a 307 redirect. See screenshots.
If analytic.press is blocked, the original script will not be loaded :(

Screenshot(s)

Versions

• Browser/version: Firefox 72.0.2
• uBlock Origin version: 1.24.2

Settings

• default

Notes

Request URL: http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Request method: GET
Status code: 307

HTTP/1.1 307 Temporary Redirect
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: text/plain
Location: http://r.analytic.press/?id=85c27bce8183639953238dd557c6854a102f&reg=24&orig=http%3A%2F%2Fajax.googleapis.com%2Fajax%2Flibs%2Fjquery%2F1.10.2%2Fjquery.min.js
Content-Length: 1

[llacb47]

Wow, never seen that before.

[mapx-]

maybe needing an account or russian ip, I get no analytic.press

[MioVisman]

I do not know. Now I used a proxy server in Germany, I got the answer:

[mapx-]

and analytic.press seems to be a parked domain

[MioVisman]

Ip address analytic.press sends me to the USA https://ipinfo.io/162.255.119.38
But his subdomains (from which the scripts are loaded) send me to Moscow https://ipinfo.io/195.19.216.34

[llacb47]

@mapx- See this http://r.analytic.press/?id=85c27bce8183639953238dd557c6854a102f&reg=24&orig=http%3A%2F%2Fajax.googleapis.com%2Fajax%2Flibs%2Fjquery%2F1.10.2%2Fjquery.min.js from original post headers. But if no one can reproduce, maybe it is malware on your machine

[mapx-]

yes, I see the script but still cannot reproducing ..
@MioVisman could you try:
rh.adsh.org.ua##+js(set, encodeURIComponent, trueFunc)

[MioVisman]

Now in Google, when searching for data about the ip address, I came across the topic: Rostelecom replaces js-files? https://searchengines.guru/showthread.php?t=1001505
A similar situation is described there.
In 2018, 307 redirects to r.rtkrtb.com and other subdomains.
In 2019, 307 redirects to p.analytic.host and r.analytic.host.
And at the end of 2019, redirects went to p.analytic.press and r.analytic.press.

So this is apparently a local problem for 1 provider. Rostelecom - the largest Russian provider of digital services and services :(

[llacb47]

Oh so it is the ISP doing it...

[uBlock-user]

Accessing on http://, your ISP is intercepting the domain and causing redirects.

[MioVisman]

Domains blocked in "AdGuard Tracking Protection" list
https://github.com/AdguardTeam/AdguardFilters/commit/b380773ebbd8864a9e5b775facedeb5b063a5d2c

[gwarser]

If it's region specific then should be blocked by Russian lists.

[pavelkim]

I almost peed myself when found these requests on my browser log today. Rostelecom does manipulations with plain http traffic indeed. This is crazy.

[chestozo]

wow ... just got the same for the old URL
http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js

getting the same redirect to

http://r.analytic.press/?orig=http%3A%2F%2...