hypernitro.ru: Badware

[dwnas]

Prerequisites

• [X] This is NOT a YouTube, Facebook, Twitch or a shortener/hosting site report. These sites MUST be reported by clicking their respective links.
• [X] I read and understand the policy about what is a valid filter issue.
• [X] I verified that this issue is not a duplicate. (Search here to find out.)
• [x] I did not remove any of the default filter lists, or I have verified that the issue was not caused by removing any of the default lists.
• [X] I did not enable additional filter lists, or I have verified that the issue still occurs without enabling additional filter lists.
• [X] I do not have custom filters/rules, or I have verified that the issue still occurs without custom filters/rules.
• [X] I am not using uBlock Origin along with other content blockers.
• [X] I have verified that the web browser's built-in content blocker/tracking protection, network wide/DNS blocking, or my VPN is not causing the issue.
• [X] I have verified that other extensions are not causing the issue.
• [X] If this is about a breakage or detection, I have verified that it is caused by uBlock Origin and isn't a site issue.
• [ ] I did not answer truthfully to ALL the above checkboxes.

URL(s) where the issue occurs.

https://hypernitro.ru/pctivation
https://nitrohunt.com/login

Description

generic discord login account stealer, not currently detected by ublock as a bad site note that it seems to block successive requests, using incognito appears to bypass this

Other extensions used

none

Screenshot(s)

Screenshot(s)

Configuration

Details

```yaml uBlock Origin: 1.57.2 Firefox: 127 filterset (summary): network: 137244 cosmetic: 47178 scriptlet: 19398 html: 1786 listset (total-discarded, last-updated): default: user-filters: 1-0, never ublock-filters: 38081-110, 20m Δ ublock-badware: 8654-0, 20m Δ ublock-privacy: 901-2, 20m Δ ublock-unbreak: 2331-2, 20m Δ ublock-quick-fixes: 195-9, 20m Δ easylist: 87713-159, 20m Δ easyprivacy: 50877-64, 20m Δ urlhaus-1: 14780-0, now plowe-0: 3729-1160, now filterset (user): [array of 1 redacted] trustedset: added: [array of 14 redacted] userSettings: [none] hiddenSettings: [none] supportStats: allReadyAfter: 1273 ms (selfie) maxAssetCacheWait: 57 ms cacheBackend: indexedDB popupPanel: blocked: 0 ```

[stephenhawk8054]

Can you give full original links of it? They both show 404 error for me

[dwnas]

these links are correct, they have to have some sort of referrer i believe, as the links are normally spread through the use of a url shortener i.e https://goo.su/link-nitro (original link) the first link seems to change paths regularly, i'd suggest blocking the domains as a whole 1. 2.

[stephenhawk8054]

I added the domains.

I didn't say it's not correct link or whether blocking whole domains or not. The problem is we NEED some evidences to back up the decisions. No screenshots, no original links, no steps to reproduce... How would we respond if the website owners come to complain?