twoddl.co

[salam2009]

URL(s) where the issue occurs

twoddl.co, rarbg.to & some other sites which my popups are based on.

Describe the issue

Whenever I browse the mentioned sites above & press on their search bar or even anywhere on the page, I get a popup with malicious sites like izxdpodiowdgp.bid, 35.188.14.213, b.codeonclick.com or nextlnk1.com and then it keeps redirecting itself to advertising websites.
Your help means the world :)

Screenshot(s)

No need.

Versions

• Browser/version: FF 57
• uBlock Origin version: 1.14.18

Settings

https://i.imgur.com/FomOHcj.jpg

Notes

None.

[mapx-]

you had your answer here:
https://forums.lanik.us/viewtopic.php?p=128012#p128012

twoddl.co##script:inject(popads.net.js)

rarbg.to already in the ublock filters

[salam2009]

What about the other sites which use the same mentioned popups (Like myegy.tv), isn’t there some global filter for them? That’s why I had to post my issue here too, so I can be sure I’m not missing anything.

[mapx-]

no general rules => just provide all those sites

[salam2009]

Okay, thank you for your confirmation.

[okiehsch]

I will add filters for the popup issues.

[salam2009]

Are you gonna add them to one of uBO default filters so they can be updated automatically?
Or should I get them somewhere else?

[okiehsch]

I will add them to uBO-filters, after I commit you can update your filter list.

[okiehsch]

BTW, I do not get any popups at rarbg.to with a uBO-default setup, so the commit will not include any rarbg-filters.

[salam2009]

I didn't check rarbg after installing uBO & @mapx- said that uBO already have filters for it, but the popups do appear on myegy.tv, twoddl.co & some others before adding their filters manually.

[okiehsch]

What are the "other" domains?

[salam2009]

mkvcage.com, ganool.se, arabseed.tv are giving me http://35.188.14.213/ popups!

[okiehsch]

myegy.tv##script:inject(abort-current-inline-script.js, A, popunders)
myegy.tv##script:inject(abort-on-property-write.js, H7WWWW)
mkvcage.com,twoddl.co##script:inject(abort-on-property-write.js, _pop)
arabseed.tv,ganool.se,mkvcage.com##script:inject(nowebrtc.js)

works on my end.

[mapx-]

and on my end:

twoddl.co##script:inject(popads.net.js)
||myegy.tv/files/js/alaz.compiled.
myegy.tv##script:inject(abort-current-inline-script.js, popunders)
mkvcage.com##script:inject(popads.net.js)
mkvcage.com##script:inject(abort-current-inline-script.js, atob)
||adscpm.site^
ganool.se##script:inject(abort-current-inline-script.js, adcashMacros)
ganool.se##[id^=epom]
arabseed.tv##script:inject(abort-current-inline-script.js, atob)
||old.arabseed.com/pop/$image

[salam2009]

Wow, you guys are really awesome :)
Too bad I have to do this on every other similar sites.

[okiehsch]

@mapx-
Well, the atob filters could break legitimate content, so I would always prefer the nowebrtc.js.
myegy.tv##script:inject(abort-current-inline-script.js, popunders) what are you fixing with that filter?
||myegy.tv/files/js/alaz.compiled. already takes care of the popunder

[mapx-]

I saw this script in the source

<script>
--
  | document.domain = "myegy.tv";
  | window.A = {
  | popunders: ["http:\/\/replainy.co\/out?zoneId=2427346-2427421"]			};
  | </script>

probably it's harmless blocking the external script

[okiehsch]

I disabled that script with myegy.tv##script:inject(abort-current-inline-script.js, A, popunders)
Your filter will not work, see for yourself:
Add only
myegy.tv##script:inject(abort-current-inline-script.js, popunders)
then click on any film/series at myegy.tv, and you will get the replainy-popup/under

[mapx-]

I see, needing the "window" => A, right ?

[okiehsch]

Yes, and then you can narrow it down, with "popunders", to lessen the likelyhood of site breakage.
abort-current-inline-script.js, A, popunders, the second one can be anything in that inline-script.
For example abort-current-inline-script.js, A, replainy.co would also work.

[mapx-]

However, would be great having the injecting filters in the logger ..
gorhill/uBlock#2877

[okiehsch]

That would make it easier, if somebody reports some broken site I always check uBO-filters if there are any script:inject filters for that site, unless the cause of the breakage is obvious of course.
But I don't think the average user is really missing that feature.

[zummuz]

@okiehsch hi, I get a redirection on rarbg.to to rarbgmirror.xyz, and there are popups.
uBlock filters already has rarbg.to##script:inject(abort-on-property-read.js, _wm3)

[okiehsch]

Added rarbgmirror.xyz to fix. 0d2a971

[ghajini]

adblock warning
https://myegy.cc/link/1302446

[salam2009]

adblock warning
https://myegy.cc/link/1302446

The download link is already there (highlighted in blue). You can simply ignore the adblock warning.

[mapx-]

still there even disabling uBo, if you want add:
myegy.cc##.disclaimer

[smed79]

Added to AWRL https://hg.adblockplus.org/antiadblockfilters/rev/b8d33e4f2207

[theinstantmatrix]

another mirror, same popups on click
https://rarbg2019.org/

[ghost]

rarbg closed its doors