g00 网站说明
最近在做dns tunnel检测，发现了一堆类似这样的域名：c-6rtwjumjzx7877x24uwjkjwjshjx78x2eywzx78yjx2ehtr.g00.medicinenet.com
都是以g00为子域名，前面一堆随机字符！专门查了下：
从 https://www.reddit.com/r/pihole/comments/6s2zjw/can_i_block_anything_that_comes_from_g00websitecom/ 可以看到：
the problem is this: those g00 pages are ad-tech from a company called Instart Logic. the general idea is that it sees that you have an adblocker and re-writes the page/ads to be served from the domain you are at.
My company uses it and i mesed with my adblocker to block all g00 sites, but it actually messes with the UX of the whole website.
you could accomplish the same thing by disabling javascript also
也就是说，他专门用类似域名来防止广告拦截。我专门查了下 instart logic这个公司：
Instart Logic随后将把这样的分析应用于上述产品，从而使网站或移动应用的访问速度更快，优化搜索引擎排名，帮助发行商规避广告拦截工具。
该公司表示，其电商客户通常会看到营收增长5%到8%，而由广告支撑的发行商会看到营收增长3%到15%。该公司的客户包括Neiman Marcus、Kate Spade、亚洲航空、大西洋传媒、Ziff Davis、Telstra（也是该公司投资方）和纳斯达克。
chrome里安装ublock，访问medicinenet.com，可以看到其block的记录：
https://c-5uwzmx78pmca09x24quiomax2eumlqkqvmvmbx2ekwu.g00.medicinenet.com/g00/3_c-5eee.umlqkqvmvmb.kwu_/c-5UWZMXPMCA09x24pbbx78ax3ax2fx2fquioma.umlqkqvmvmb.kwux2fquiomax2fatqlmapwex2fbpcuj-atqlmapwex2fbpcuj-x78awzqiaqa-umvc.rx78ox3fq98k.uizsx3dquiom_$/$/$/$/$ =》是一张图片
https://c-5uwzmx78pmca09x24ix78qax2eowwotmx2ekwu.g00.medicinenet.com/g00/3_c-5eee.umlqkqvmvmb.kwu_/c-5UWZMXPMCA09x24pbbx78ax3ax2fx2fix78qa.owwotm.kwux2frax2fx78tcawvm.rax3fq98k.uizsx3dakzqx78b_$/$/$ =》是js脚本
https://c-5uwzmx78pmca09x24quiomax2eumlqkqvmvmbx2ekwu.g00.medicinenet.com/g00/3_c-5eee.umlqkqvmvmb.kwu_/c-5UWZMXPMCA09x24pbbx78ax3ax2fx2fquioma.umlqkqvmvmb.kwux2fkaax2fumlqkqvmvmbx2fzmlmaqovx2fdmvlwzx2fidozcvl.kaax3fq98k.uizsx3dtqvs_$/$/$/$/$/$?i10c.ua=1 =》 css
从 https://community.webroot.com/t5/Webroot-SecureAnywhere-Internet/g00-adware-insertion/td-p/279885 也可以看到：
this nasty g00 adware insertion in popular newspaper sites..
https://github.com/uBlockOrigin/uAssets/issues/227
when i go to newspaper site,it just head to g00 adware referrer and consumes lot of bandwidth....
can webroot foil this attempt by prebenting g00 crap....potentially a malicious code is inserted by instart logic code....
you can see no of cookies set by this g00 crap
following is list of sites affected
'baltimoresun.com',
'boston.com',
'capitalgazette.com',
'carrollcountytimes.com',
'celebuzz.com',
'chicagotribune.com',
'courant.com',
'dailypress.com',
'deathandtaxesmag.com',
'gamerevolution.com',
'gofugyourself.com',
'hearthhead.com',
'infinitiev.com',
'mcall.com',
'nasdaq.com',
'orlandosentinel.com',
'ranker.com',
'sandiegouniontribune.com',
'saveur.com',
'sherdog.com',
'spin.com',
'sporcle.com',
'stereogum.com',
'sun-sentinel.com',
'thefrisky.com',
'thesuperficial.com',
'timeanddate.com',
'tmn.today',
'vancouversun.com',
'vibe.com',
'weather.com',
'wowhead.com',
'calgaryherald.com',
'edmontonjournal.com',
'edmunds.com',
'financialpost.com',
'leaderpost.com',
'montrealgazette.com',
'nationalpost.com',
'ottawacitizen.com',
'theprovince.com',
'thestarphoenix.com',
'windsorstar.com',
here is whats the truth bout instart logic code..
`Instart
Logic's technology used to disguise third-party network requests as
first-party network requests, including the writing/reading of
third-party cookies as first-party cookies. I consider this to be
extremely hostile to users, even those not using a content blocker, as
it allows third-party servers to read/write cookies even if a user chose
to block 3rd-party cookies through your browser setting.`
also
this instart logic is making dns tweaks to news content before it passes
to its end users,it might result in future malicious payload........
ublock origin uses static filter lists,if it has no filter lists against those ,it will no work...
privacy badger not working....see here.....https://github.com/EFForg/privacybadger/issues/1044
webroot should prevent(dns change) this g00 adware insertion at earlier time...
now this affects more no of popular news websites,,,
https://github.com/uBlockOrigin/uAssets/issues/227 也可以看到
g00 adware insertion on newspaper websites #227
URL(s) where the issue occursorlandosentinel.com Those are the ones I have seen so far, there may be more. Describe the issueForcibly inserts g00 adware content and abuses window.location API if blocked by a filter like Screenshot(s)https://i.gyazo.com/86ab54811f6aaa1785b3d308566d6af6.png Versions
|
最新文章
- HTML5本地存储
- asp.net环境搭建
- Ptex源码学习笔记-2
- js获取单选按钮的值
- JavaScript学习笔记-new Date() 与 Date() 的区别
- cisco交换技术list
- windows系统常见端口和木马默认使用端口
- 【转】python中List的sort方法（或者sorted内建函数）的用法
- 亲试，Windows平台上使用Qt5.2.1编写Android
- ASP.NET常被忽视的一些细节
- SSM-MyBatis-09：Mybatis中SqlSession的close为什么能造成事务的回滚
- C++ 最简单的日志类
- Chapter 5 Blood Type——4
- 并发、并行与多线程——C++
- 重新打开Eclipse出现“An internal error has occurred. java.lang.NullPointerException”
- hadoop报错：hdfs.DFSClient: Exception in createBlockOutputStream
- 证明2x2正交矩阵专置后还是正交矩阵
- vue.js - 2
- Resource View Window of Visual Studio
- 源代码解析Android中View的layout布局过程