atomohd.cloud: detection - Githubissues

uBlockOrigin / uAssets

Resources for uBlock Origin, uMatrix: static filter lists, ready-to-use rulesets, etc.

GNU General Public License v3.0

4.21k stars 777 forks source link

atomohd.cloud: detection #17128

Closed helpman closed 1 year ago

helpman commented 1 year ago

Prerequisites

[X] This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
[X] I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
[X] I am running the latest version of uBlock Origin (uBO).

I tried to reproduce the issue when...

[X] uBO is the only extension.
[X] uBO uses default lists and settings.
[X] using a new, unmodified browser profile.

Description

after clicking links on atomohd.cloud, the link protection service acorta-enlace.com shows a screen with "adblock detected" and ask you to shut it down and reload. even turning off ublock origin, still show the same popup

URL(s) where the issue occurs.

atomohd.cloud => atomtt.com => acorta-enlace.com => various crap domains

Screenshot(s)

https://user-images.githubusercontent.com/6162124/224503721-d4cdcde9-5b8b-41b8-8347-fd98a78aba72.jpg

Notes

refreshed filters. also tried disabling ublock for acorta-enlace.com

Configuration

```yaml uBlock Origin: 1.47.4 Chromium: 111 filterset (summary): network: 88658 cosmetic: 44938 scriptlet: 17638 html: 0 listset (total-discarded, last-updated): default: user-filters: 1-0, never easylist: 63872-44, 1m easyprivacy: 31041-1174, 1m plowe-0: 3757-932, 1m spa-0: 3509-11, 1m spa-1: 5104-192, 1m ublock-abuse: 78-0, 1m ublock-badware: 4686-114, 1m ublock-filters: 32808-115, 1m ublock-privacy: 290-1, now ublock-quick-fixes: 368-24, now ublock-unbreak: 1920-42, now urlhaus-1: 6629-0, now filterset (user): [array of 2 redacted] trustedset: added: [array of 30 redacted] switchRuleset: added: [array of 1 redacted] removed: no-large-media: behind-the-scene false hostRuleset: removed: behind-the-scene * * noop behind-the-scene * image noop behind-the-scene * 3p noop behind-the-scene * inline-script noop behind-the-scene * 1p-script noop behind-the-scene * 3p-script noop behind-the-scene * 3p-frame noop modifiedUserSettings: [none] modifiedHiddenSettings: [none] supportStats: allReadyAfter: 50254 ms (selfie) maxAssetCacheWait: 579 ms ```

mapx- commented 1 year ago

it's another domain too

add

@@||pagead2.googlesyndication.com^$xhr,domain=finanzasdomesticas.com
@@||googleadapis.l.google.com^$xhr,domain=finanzasdomesticas.com

helpman commented 1 year ago

still there. updated filters, popup still shows :(

mapx- commented 1 year ago

finanzasdomesticas page ?

acorta-enlace.com page ?

clear cookies / localStorage/ cache for the tested page
reset uBO, don't modify any uBO setting, update all the filter lists, don't add any other list (other than your regional list)
disable any custom filter for that site
disable any other extension / addon in your browser, disable builtin blockers /shields/ tracking protection in brave/ opera/ vivaldi/ edge/ firefox etc
if Opera browser: open opera://extensions/ and check the "allow access to search page results" option
disable (if any) the web shields in your antivirus / antimalware software / other blocking software
are you using a DNS which features adblocking (like AdGuard DNS)?=> test using another DNS (google for example => IP addresses 8.8.8.8 & 8.8.4.4)
restart the system, reopen the browser, test again.

helpman commented 1 year ago

cookies cleared, cache cleared, ubo with default settings, filter list updated, chrome's blockers disabled, reset computer, using google's dns, still the same. atomohd.cloud open links on atomtt.com, the links there point to acorta-enlace.com which shows different domains to protect links. (finanzasdomesticas.com, pequenutricion.com and seguridadinformaticahoy.com) which shows a countdown to enable links or supposedly a couple ads to click, but those ads are never shown and you have to repeat until the countdown is shown. Tried in opera, opera's blocks disabled, same result

mapx- commented 1 year ago

for now I have only

atomohd.cloud => atomtt.com => acorta-enlace.com => finanzasdomesticas.com => google

I asked you: where / which page do you still have anti adblocking ?

helpman commented 1 year ago

the url shows acorta-enlace.com but something seems to be weird, as I uninstalled ublock on opera, and disabled adblock in opera... yet the same page is shown? https://user-images.githubusercontent.com/6162124/224538104-161b8e9d-6f5b-488c-94a8-4f1252cd0f22.jpg

mapx- commented 1 year ago

well, it's something in your system then .. however, it's insane using this "chain" of pages just to download some movie, did you try using torrents ?

helpman commented 1 year ago

actually that's what I need to get access to the torrent :( I can't find it in any tracker. Once the link protection is done, you don't need to do that for 24 hours. still jumps from one site to another and you need to close 4 tabs for each link, though :( (atomohd->atomtt->atomtt->acorta-enlace->download the torrent file, close 4 tabs, rinse and repeat) I have no idea what could be causing this detection thing then :(

mapx- commented 1 year ago

send me a private message on reddit about what you want do find ( this user https://www.reddit.com/user/ajaxmix )

detyso commented 4 months ago

Use this script to skip that shortener https://codeberg.org/Amm0ni4/bypass-all-shortlinks-debloated/