Please help with filtering encrypted variables URL.

[nmr50]

Hello everyone!
This time I met new ads scheme where ads engine is trying to mask real ads urls, the example list is here:
domain.org##.js-content.row.yhvhlqeumd.yhvhlqeumd--rjzajr
domain.org##.js-content.ltzbolcvuiu.ltzbolcvuiu--umjfnfsw.row
domain.org##.js-content.livzqfcm.livzqfcm--zrmcglzxbhl.row
domain.org##.js-content.row.unqsj.unqsj--gxuzyo

domain.org##.b-yellow-box.js-yellow-box.zczgyurj.zczgyurj--ahlji
domain.org##.b-yellow-box.js-yellow-box.xselbmuoq.xselbmuoq--wrdstnl

domain.org##.b-longgrid-column.prlxl.prlxl--lxrm
domain.org##.b-longgrid-column.bbig.bbig--owfkbi
domain.org##.b-longgrid-column.cinhwqofmu.cinhwqofmu--awwht
domain.org##.b-longgrid-column.jyoqg.jyoqg--ljgtqwdvlt

domain.org##.b-tabloid__topic_news.fylk.fylk--merjnaweegm.item.news
domain.org##.b-tabloid__topic_news.item.kfmlggi.kfmlggi--xyooso.news

-- As you can see - some of words are static, but others are changing (randomly?).. I still have difficulties with wildcards usage, so - please,
tell me how to filter out those 4 urls with wildcars-alike scheme:
domain.org##.js-content.*--*
domain.org##.b-yellow-box.js-yellow-box.*--*
domain.org##.b-longgrid-column.*--*
domain.org##.b-tabloid__topic_news.*--*

Thanks in advance!

[mapx]

Read about filters
en/filters#elemhide_attributes

Provide real examples and explain what on page you want to hide.

[nmr50]

mapx, hello again !:)

Read about filters
en/filters#elemhide_attributes
Provide real examples and explain what on page you want to hide.

Here is the 1st site - https://lenta.ru/
There are ads located by common name "Яндекc.Дирeкт", you'll notice them.
Also pogoda.yandex.ru has the same ads engine, tv.yandex.ru and so on.

Real ads urls are:
lenta.ru##.js-content.row.yhvhlqeumd.yhvhlqeumd--rjzajr
lenta.ru##.js-content.ltzbolcvuiu.ltzbolcvuiu--umjfnfsw.row
lenta.ru##.js-content.livzqfcm.livzqfcm--zrmcglzxbhl.row
lenta.ru##.js-content.row.unqsj.unqsj--gxuzyo
lenta.ru##.b-yellow-box.js-yellow-box.zczgyurj.zczgyurj--ahlji
lenta.ru##.b-yellow-box.js-yellow-box.xselbmuoq.xselbmuoq--wrdstnl
lenta.ru##.b-longgrid-column.prlxl.prlxl--lxrm
lenta.ru##.b-longgrid-column.bbig.bbig--owfkbi
lenta.ru##.b-longgrid-column.cinhwqofmu.cinhwqofmu--awwht
lenta.ru##.b-longgrid-column.jyoqg.jyoqg--ljgtqwdvlt
lenta.ru##.b-tabloid__topic_news.fylk.fylk--merjnaweegm.item.news
lenta.ru##.b-tabloid__topic_news.item.kfmlggi.kfmlggi--xyooso.news

[mapx]

Read this thread (on ruadlist subforum)
https://forums.lanik.us/viewtopic.php?f=102&t=29964

read also (for other important fixes)
https://forums.lanik.us/viewtopic.php?f=102&t=22512

[nmr50]

Hello mapx, thanks for suggestions, but I did not found no useful info for me. That "styler" or how it spelled out, does not work even if installed, even if I visit lenta.ru site, and see, trying to set custom filters especially made for lenta.ru. Heck it, I found another thingie those spammers are using for showing their shit:

Code: Select all

https://palacesquare.rambler.ru/qnnsefkok/ZGVub2Eud3Foa2tAeyJkYXRhIjp7IkFjdGlvbiI6IlJlZGlyZWN0IiwiUmVmZmVyZXIiOiJodHRwczovL2xlbnRhLnJ1LyIsIlByb3RvY29sIjoiaHR0cHM6IiwiSG9zdCI6ImxlbnRhLnJ1In0sImxpbmsiOiJodHRwczovL3BhbGFjZXNxdWFyZS5yYW1ibGVyLnJ1L2Fsd2ZpZC9ZVGMzTkcwdWFHZG9jbTVrYkdSa2NUZzFiV2wvQWV5SmtZWFJoSWpwN0lrRmpkR2x2YmlJNklsL0psWkdseVpXTjAvP2h3dnNuaHJyd294ZT1JbjBzSW14cGJtc2kmbGFsbXlhZnRhaWc9T2lKb2RIUndjem92JnFvcmtnbD1MMlJwY21WamRDNTUmdGR6dT1ZVzVrWlhndWNuVXYmdW14YXl0cGt2Z2R3dT1QM0JoY25SdVpYSWkmemtjY3d6ZGw9ZlElM0QlM0QifQ%3D%3D

-- so the question: is it possible to set-up some filter that will count letters in ONE STRING url, and if count exceeds 20 letters - without punctuation, slashes - just plain A-Z and a-z text - then block it ?

Example, how I see this on shown URL above:
Adblock sees this url, and counts letters - ah oh - we got 20 un-punctuated/non-slashed letters ? BLOCK THIS URL:

Code: Select all

https://palacesquare.rambler.ru/qnnsefkok/ZGVub2Eud3Foa2tAeyJk*

Spammers moved their technology on higher level by encrypting their urls, as you see, now it is time to give out some answer..

Another solution I thought of is to use vocabulary blocking method like - compare first (definable) 20 chars (after 2nd slash) - ZGVub2Eud3Foa2tAeyJk - with current words list, if this string is NOT in list then BLOCK THIS URL.

Waiting for your answer,
Thanks in advance!

[lewisje]

is it possible to set-up some filter that will count letters in ONE STRING url, and if count exceeds 20 letters - without punctuation, slashes - just plain A-Z and a-z text - then block it ?

That's known as a regular expression filter, which should generally be avoided but in this case cannot be.

Here's a first pass at it:

Code: Select all

/\/\w{21}/$domain=lenta.ru

This blocks URLs that include a forward slash followed by 21 characters that are underscores or ASCII numerals or uppercase or lowercase letters, and is restricted to work only on lenta.ru and subdomains, to keep the filter from affecting performance on other sites.