issue-ads bypassing Shields on popsci.com

[lukemulks]

Report via Community contributor: https://community.brave.com/t/popsci-com-terrible-on-brave/2154

Needs investigation Need to reproduce

Popsci.com's ads are getting through on Brave. So are unwanted videos. Scrolling is jerky. I have to block both fingerprinting and scripts to get rid of them, and this leaves me unable to navigate through the website. I am using IOS 10.11.6, and Braves's latest update.

Correction: user experienced on OSX El Capitan, not iOS.

[lukemulks]

DESKTOP TEST OS: Windows10, 64bit

Results:

• Unable to reproduce.
• Ads are blocked as expected.
• Tracking blocked as expected.
• No visual on ads.

Screenshot below:

• Original feedback was that iOS was not blocking as expected.
• Confident that desktop shields appear to be working properly
• However, given Android results, we need to dig deeper on desktop.

Ads & Trackers blocked on Desktop: Windows

http://s.ntv.io/serve/load.js

http://js-sec.indexww.com/ht/p/184400-126828929453385.js

http://cdn.yldbt.com/js/yieldbot.intent.js

http://bonniercorp-d.openx.net/w/1.0/jstag?nc=6747-Bonnier-RON

http://i.po.st/static/v4/post-widget.js#publisherKey=am3ljo5ms1qhfnpfgkj5

http://widgets.outbrain.com/outbrain.js?_=1491791028507

http://bonniercorp.122.2o7.net/b/ss/timepopsci/1/H.24.4/s84371524907813?AQB=1&ndh=1&t=9%2F3%2F2017%2019%3A25%3A10%200%20420&ce=UTF-8&ns=bonniercorp&pageName=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&g=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%3Fdom%3Dpsc%26loc%3Dfeatrow%26lnk%3Dgetting-your-genetic-disease-risks-from-23andme-is-probably-a-terrible-idea&r=http%3A%2F%2Fwww.popsci.com&cc=USD&ch=health&events=event2&v1=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&c2=sara%20chodosh&v2=sara%20chodosh&c3=23andme%2C%20genetic%20testing%2C%20genes%2C%20health&v3=23andme%2C%20genetic%20testing%2C%20genes%2C%20health&c4=basic%20content&v4=basic%20content&c6=article&c7=article&v8=health&c17=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%23page-4&v17=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%23page-4&c19=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&v19=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&c21=10%3A00PM&v21=10%3A00PM&c22=Sunday&v22=Sunday&c23=Weekend&v23=Weekend&c32=New&v32=New&c37=232733&v37=psc&v38=getting-your-genetic-disease-risks-from-23andme-is-probably-a-terrible-idea&v40=featrow&c45=false&c46=false&c61=sara%20chodosh&c66=04-07-17&s=3072x1728&c=24&j=1.6&v=N&k=Y&bw=2044&bh=1022&AQE=1

http://c.amazon-adsystem.com/aax2/amzn_ads.js

http://bonniercorp.122.2o7.net/b/ss/timepopsci/1/H.24.4/s88851095739391?AQB=1&ndh=1&t=9%2F3%2F2017%2019%3A23%3A48%200%20420&ce=UTF-8&ns=bonniercorp&pageName=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&g=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%3Fdom%3Dpsc%26loc%3Dfeatrow%26lnk%3Dgetting-your-genetic-disease-risks-from-23andme-is-probably-a-terrible-idea&r=http%3A%2F%2Fwww.popsci.com&cc=USD&ch=health&events=event2&v1=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&c2=sara%20chodosh&v2=sara%20chodosh&c3=23andme%2C%20genetic%20testing%2C%20genes%2C%20health&v3=23andme%2C%20genetic%20testing%2C%20genes%2C%20health&c4=basic%20content&v4=basic%20content&c6=article&c7=article&v8=health&c17=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%3Fdom%3Dpsc%26loc%3Dfeatrow%26lnk%3Dgetting-your-genetic-disease-risks-from-23andme-is-probably-a-terrible-idea&v17=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%3Fdom%3Dpsc%26loc%3Dfeatrow%26lnk%3Dgetting-your-genetic-disease-risks-from-23andme-is-probably-a-terrible-idea&c19=health&v19=health&c21=10%3A00PM&v21=10%3A00PM&c22=Sunday&v22=Sunday&c23=Weekend&v23=Weekend&c28=100&c32=New&v32=New&c37=232733&v37=psc&v38=getting-your-genetic-disease-risks-from-23andme-is-probably-a-terrible-idea&v40=featrow&c45=false&c46=false&c61=sara%20chodosh&c66=04-07-17&s=3072x1728&c=24&j=1.6&v=N&k=Y&bw=2044&bh=1022&pid=health&pidt=1&oid=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%3Fdom%3Dpsc%26loc%3Dfeatrow%26lnk%3Dgetting-your-genetic&ot=A&AQE=1

http://static.chartbeat.com/js/chartbeat.js

http://bonniercorp.122.2o7.net/b/ss/timepopsci/1/H.24.4/s82060892444251?AQB=1&ndh=1&t=9%2F3%2F2017%2019%3A24%3A42%200%20420&ce=UTF-8&ns=bonniercorp&pageName=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&g=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%3Fdom%3Dpsc%26loc%3Dfeatrow%26lnk%3Dgetting-your-genetic-disease-risks-from-23andme-is-probably-a-terrible-idea&r=http%3A%2F%2Fwww.popsci.com&cc=USD&ch=health&events=event2&v1=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&c2=sara%20chodosh&v2=sara%20chodosh&c3=23andme%2C%20genetic%20testing%2C%20genes%2C%20health&v3=23andme%2C%20genetic%20testing%2C%20genes%2C%20health&c4=basic%20content&v4=basic%20content&c6=article&c7=article&v8=health&c17=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%23page-3&v17=http%3A%2F%2Fwww.popsci.com%2F23andme-is-probably-terrible-idea%23page-3&c19=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&v19=health%3Agetting%20your%20genetic%20disease%20risks%20from%2023andme%20is%20probably%20a%20terrible%20idea&c21=10%3A00PM&v21=10%3A00PM&c22=Sunday&v22=Sunday&c23=Weekend&v23=Weekend&c32=New&v32=New&c37=232733&v37=psc&v38=getting-your-genetic-disease-risks-from-23andme-is-probably-a-terrible-idea&v40=featrow&c45=false&c46=false&c61=sara%20chodosh&c66=04-07-17&s=3072x1728&c=24&j=1.6&v=N&k=Y&bw=2044&bh=1022&AQE=1

http://cdn.taboola.com/libtrc/bonnier-network/loader.js

http://cdn.viglink.com/api/vglnk.js

http://b.scorecardresearch.com/beacon.js

http://cdn.krxd.net/controltag?confid=J0JP_bas

http://edge.quantserve.com/quant.js?_=1491791028046

http://cdn-gl.imrworldwide.com/novms/js/2/nlsDcrLite510.min.js#nol_sfcode=dcr-cert&nol_ci=us-
903454&nol_apid=T55D59F5E-1D4E-4054-B5E6-9F7220B8AB04&nol_assetname=health&nol_apn=&nol_syndication=N&nol_vc=c29

• [ ] Check Android tablet, confirm status.
• [x] Check Android phone, confirm status.
• [ ] Check iPad Pro, confirm status.
• [ ] Check iPhone, confirm status.
• [ ] Check macOSX, confirm status.

Issue will be routed to the appropriate repository once confirmations above are completed.

[lukemulks]

Android Phone (Nexus 5) Page appears to load fine at first, but if the user lets the page sit, an interstitial is invoked for the following

redirect URL:

http://tu9srvbirvvtosricy5zzxj2aw5nlxn5cy5jb200.g00.popsci.com/g00/2_d3d3LnBvcHNjaS5jb20%3D_/TU9SRVBIRVVTOSRodHRwczovL2JzLnNlcnZpbmctc3lzLmNvbS9TZXJ2aW5nL2FkU2VydmVyLmJzP2NuPWJyZCZQYWdlPSZQbHVJRD0wJlBvcz0yMzMzMDY4MTk2MTU1OTcxOCZFeWVibGFzdGVySUQ9MTA3NDMxOTg4OCZjbGs9MSZzY3Q9MSZkZz0xMDczODM5MTE1JmRnbz0xMDczODM5MTE1JmRpPTAmcGM9JnNlc3Npb25pZD03NDc2ODMzNjMyMDE3MjA3MTgxJnVzZXJjb29raWU9dTI9MmFhMGQ1ZmYtMGM2OC00NWE3LTk0NjItYzkyNDZlN2ZjMTdiJk9wdE91dD0wJm5jdT1odHRwJTNBJTJGJTJGaW5zaWdodC5hZHNydnIub3JnJTJGdHJhY2slMkZjbGslM0ZpbXAlM0RiYzlkMWRiMS00ZjliLTQzMjEtOWZiZi05Nzk4ZDNmODYyNzYlMjZhZyUzRG5vamh2cDAlMjZzZmUlM0RiMjI3NmVhJTI2c2lnJTNEVjVDX2hXd0JxcG95SnFZOEZFT3EtOTBFQmNac1ZfS3JaWEdyWDA1ZjZKOC4lMjZjcmlkJTNEcTkxc3hta3QlMjZjZiUzRDI4NDQ0JTI2ZnElM0QwJTI2dGRfcyUzRHd3dy5wb3BzY2kuY29tJTI2cmNhdHMlM0R5MjklMjZtY2F0JTNEJTI2bXN0ZSUzRCUyNm1mbGQlM0QyJTI2bXNzaSUzRCUyNm1mc2klM0RhdXc3ajh0b2tyJTI2c3YlM0RjYXNhbGUlMjZ1aG93JTNEMjAlMjZhZ3NhJTNEJTI2cmdjbyUzRFVuaXRlZCUyNTIwU3RhdGVzJTI2cmdyZSUzRENhbGlmb3JuaWElMjZyZ21lJTNEODA3JTI2cmdjaSUzRFNhbiUyNTIwSm9zZSUyNnJneiUzRDk1MTQxJTI2ZHQlM0RNb2JpbGUlMjZvc2YlM0RBbmRyb2lkJTI2b3MlM0RPdGhlciUyNmJyJTNEQ2hyb21lJTI2c3ZwaWQlM0QxODM3NTMlMjZybGFuZ3MlM0QwMSUyNm1sYW5nJTNEJTI2ZGlkJTNEMzE3MjAxNzUlMjZyY3h0JTNET3RoZXIlMjZ0bXBjJTNEMTMuMiUyNnZydGQlM0QlMjZvc2klM0QlMjZvc3YlM0QlMjZkYWlkJTNEJTI2ZG5yJTNEMCUyNnZwYiUzRCUyNnN2c2MlM0QlMjZkdXIlM0QlMjZjcnJlbHIlM0QlMjZucHQlM0QlMjZzdnNjaWQlM0QxNzI5OTglMjZyJTNEaHR0cCUzQSUyRiUyRnd3dy5sZy5jb20lMkYmZWJSZWZlcnJlcj1odHRwJTNBJTJGJTJGd3d3LnBvcHNjaS5jb20lMkYmaTEwYy5tYXJrLmlmcmFtZS50eXBl_$/$/$

This reeks of ILaAB...

• 2nd redirect hop was made to a sizmek burstingpipe URL (couldn't capture the full URL in time)

• Final hop from burstingpipe (sizmek) was the destination url: LG.com, which failed to render (blank white container).

• Appears to be a bug with ILaAB in Brave (android).

• Also appears to be a change-up or different implementation with popsci, compared to other domains in past cases.

• On page refresh, URL doesn't change and ad blocking is catching counts, but something is not working correctly because ads are rendering in Android (not desktop though).

Android block counter:

Ads:

Going to pull some tricks on the tablet, and recheck source on desktop. Will check iOS as well.

[lukemulks]

cc: @Jacalz for visibility. :-)

[Jacalz]

Can not see any ads, lets open if problems arise