search

tiuxo / hosts

Categorized hosts files for DNS based content blocking
Creative Commons Attribution 4.0 International
29 stars 11 forks source link

[BLOCK] #32

Open CyanoTex opened 2 years ago

CyanoTex commented 2 years ago
Domain List
jwobzj.findiovers.com porn
spirillen commented 2 years ago

image

image

drill findiovers.com @9.9.9.10
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 37934
;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 
;; QUESTION SECTION:
;; findiovers.com.      IN      A

;; ANSWER SECTION:

;; AUTHORITY SECTION:
findiovers.com. 900     IN      SOA     ns-1288.awsdns-33.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
drill www.findiovers.com @9.9.9.10
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 11475
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; www.findiovers.com.  IN      A

;; ANSWER SECTION:
www.findiovers.com.     3600    IN      CNAME   llbkq.abtrcker.com.
llbkq.abtrcker.com.     3600    IN      CNAME   j1.jump4geo.com.
j1.jump4geo.com.        60      IN      A       52.19.101.114

So where is the porn? this looks more like a tracking domain to me.

CyanoTex commented 2 years ago

image

image

drill findiovers.com @9.9.9.10
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 37934
;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 
;; QUESTION SECTION:
;; findiovers.com.      IN      A

;; ANSWER SECTION:

;; AUTHORITY SECTION:
findiovers.com. 900     IN      SOA     ns-1288.awsdns-33.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
drill www.findiovers.com @9.9.9.10
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 11475
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; www.findiovers.com.  IN      A

;; ANSWER SECTION:
www.findiovers.com.     3600    IN      CNAME   llbkq.abtrcker.com.
llbkq.abtrcker.com.     3600    IN      CNAME   j1.jump4geo.com.
j1.jump4geo.com.        60      IN      A       52.19.101.114

So where is the porn? this looks more like a tracking domain to me.

🤨 I'll edit my post then.

I could have sworn that when I visited it, it showed 18+ stuff. Oh well. 🤷

spirillen commented 2 years ago

if it was adult contents why the add it the ads filter? :confused:

image

CyanoTex commented 2 years ago

if it was adult contents why the add it the ads filter? :confused:

image

You said it looked more like a tracking domain than it was porn.

spirillen commented 2 years ago

Ok :smiley: I see it now, it was my fault is changed from ads to adult to tracking..

So where is the porn? this looks more like a tracking domain to me.

completely forgotten that line.

CyanoTex commented 2 years ago

Ok :smiley: I see it now, it was my fault is changed from ads to adult to tracking..

So where is the porn? this looks more like a tracking domain to me.

completely forgotten that line.

🤨 That's some weird website if it can change like that.

CyanoTex commented 2 years ago

Ok :smiley: I see it now, it was my fault is changed from ads to adult to tracking..

So where is the porn? this looks more like a tracking domain to me.

completely forgotten that line.

Okay, so, I found this TikTok profile: Screenshot_20211127-235129_TikTok.png

And if I recall correctly, I found the domain I posted for blocking, which came from: http://toktik.website/17n3n65c6ju7

And uBlock Origin stopped me because of this filter: Screenshot_20211127-235302_Firefox.png

spirillen commented 2 years ago

Step one and two... Curl

Remember to add this domain to redirection(tracking)

curl -I 'http://toktik.website/17n3n65c6ju7'
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sun, 28 Nov 2021 02:59:56 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.2.34
X-Robots-Tag: noindex
Location: https://jwobzj.findiovers.com/c/da57dc555e50572d?s1=144766&s2=1342764&j1=1
server: nginx
date: Sun, 28 Nov 2021 03:01:57 GMT
content-type: text/html; charset=utf-8
set-cookie: unique_id=61a2f0fd00018da0; Path=/; Expires=Thu, 27 Jan 2022 03:01:57 GMT; Secure; SameSite=None
set-cookie: unique_id2=61a2f0fd0002f2bd; Path=/; Expires=Sat, 26 Feb 2022 03:01:57 GMT; Secure; SameSite=None
set-cookie: 61a2f0fd0002f2bd_c=1; Path=/; Expires=Sat, 26 Feb 2022 03:01:57 GMT; Secure; SameSite=None
set-cookie: ref_token=144766; Path=/; Expires=Tue, 28 Dec 2021 03:01:57 GMT; Secure; SameSite=None
set-cookie: impression=; Path=/; Expires=Sun, 28 Nov 2021 03:01:57 GMT; Secure; SameSite=None
set-cookie: 61a2f0fd0002f2bd_sl=[266226]; Path=/; Expires=Sun, 12 Dec 2021 03:01:57 GMT; Secure; SameSite=None

Step 3: fire up Whonix...

The thing is this is not an adult site....

OF curse at another visit the comes a pair of lovely drawn boo*s it is a tracking/redirecting (adware) domain. apparently only to collect data before redirecting you to hushlove.com: https://mypdns.org/my-privacy-dns/porn-records/-/issues/1775 by using the spyware from authbill.com

Ive added this one as adware as there are no adult on the domain.

The following domains have been blacklisted in the process of investigating this issue:

conclusion

The reported domain is NSFW

There are more to blacklist than this domain...

Thankls for the report @CyanoTex

CyanoTex commented 2 years ago

Step one and two... Curl

Remember to add this domain to redirection(tracking)

curl -I 'http://toktik.website/17n3n65c6ju7'
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sun, 28 Nov 2021 02:59:56 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.2.34
X-Robots-Tag: noindex
Location: https://jwobzj.findiovers.com/c/da57dc555e50572d?s1=144766&s2=1342764&j1=1
server: nginx
date: Sun, 28 Nov 2021 03:01:57 GMT
content-type: text/html; charset=utf-8
set-cookie: unique_id=61a2f0fd00018da0; Path=/; Expires=Thu, 27 Jan 2022 03:01:57 GMT; Secure; SameSite=None
set-cookie: unique_id2=61a2f0fd0002f2bd; Path=/; Expires=Sat, 26 Feb 2022 03:01:57 GMT; Secure; SameSite=None
set-cookie: 61a2f0fd0002f2bd_c=1; Path=/; Expires=Sat, 26 Feb 2022 03:01:57 GMT; Secure; SameSite=None
set-cookie: ref_token=144766; Path=/; Expires=Tue, 28 Dec 2021 03:01:57 GMT; Secure; SameSite=None
set-cookie: impression=; Path=/; Expires=Sun, 28 Nov 2021 03:01:57 GMT; Secure; SameSite=None
set-cookie: 61a2f0fd0002f2bd_sl=[266226]; Path=/; Expires=Sun, 12 Dec 2021 03:01:57 GMT; Secure; SameSite=None

Step 3: fire up Whonix...

The thing is this is not an adult site....

OF curse at another visit the comes a pair of lovely drawn boo*s it is a tracking/redirecting (adware) domain. apparently only to collect data before redirecting you to hushlove.com: https://mypdns.org/my-privacy-dns/porn-records/-/issues/1775 by using the spyware from authbill.com

Ive added this one as adware as there are no adult on the domain.

The following domains have been blacklisted in the process of investigating this issue:

conclusion

The reported domain is NSFW

There are more to blacklist than this domain...

Thankls for the report @CyanoTex

http://witok.xyz/16k51ef5h7w7

Goes to the same website, but I'm pretty sure it's the same as that toktik website.

spirillen commented 2 years ago

Thank, have added witok.xyz I have added it to my lists.

But I started to wonder if this list actually is maintained... @brianclemens ??

brianclemens commented 2 years ago

@spirillen recently I'm not finding much time to maintain this list due to my involvement in Rocky Linux. I pay attention to reports of erroneously blocked items, but not so much requests to add entries because they are often not relevant to the purpose of this list. The purpose of this list is to block ads / etc on Japanese sites that anglocentric lists don't cover.

spirillen commented 2 years ago

Hey @brianclemens sounds like a good balance for you :+1:

If you feel like it, then my project includes the hole world wide web :wink: Meaning, if you find my work acceptable+ why not refer to it for the non .jp records? and since I do not understand Japanese, well I'm open to add a ping to you if you like.

CyanoTex commented 2 years ago

Thank, have added witok.xyz I have added it to my lists.

But I started to wonder if this list actually is maintained... @brianclemens ??

http://toksell.xyz/100cyrrwcrh0

Seems to be the same concept as the one I told you about. Rather new, my NextDNS config blocked it for being a new domain.

There's also a little bit of a pattern with these profiles using "tik" or "tok".

spirillen commented 2 years ago

http://toksell.xyz/100cyrrwcrh0

Seems to be the same concept as the one I told you about. Rather new, my NextDNS config blocked it for being a new domain.

There's also a little bit of a pattern with these profiles using "tik" or "tok".

Thanks @CyanoTex

This gave the following reports:

spirillen commented 2 years ago

@brianclemens, My comments ain't spam. they are made i correspondence to your license

Creative Commons Attribution 4.0 International

https://github.com/tiuxo/hosts/blob/2f3f7893ba8fd5c17fa52975b56fb1c81d60a4cb/LICENSE#L210-L237

And to make a quote to why I have made most of my resent comments

@brianclemens wrote in https://github.com/tiuxo/hosts/issues/32#issuecomment-986014268: @spirillen recently I'm not finding much time to maintain this list due to my involvement in Rocky Linux. I pay attention to reports of erroneously blocked items, but not so much requests to add entries because they are often not relevant to the purpose of this list. The purpose of this list is to block ads / etc on Japanese sites that anglocentric lists don't cover.