jbjhbg jhgbjh June 30, 2013 18:16

Please add these to your blocking lists: clkmon.com, onclickads.net (maybe .com too) - They're active when visiting thepiratebay.sx

Thanks for the great software.

In the meantime, hosts file here is getting 2 additions lol.
1 person likes
this idea +1
Reply
  • CHAMP
    Eric P. Scott July 01, 2013 01:55
    These are unrelated.

    1. clkmon.com is most likely indicative of malware present on your system. Ghostery only deals with trackers on web pages, so unless you can furnish some independently verifiable examples (URLs), we've got nothing.

    2. onclickads.net is definitely something to chew on. Very few sites reference it directly (e.g. www.watchmovies.ch). Many others bring it in via propellerpops.com. This is a good place to remind people that Ghostery is not an ad blocker. Simply adding onclickads.net might be good for enough for you, but you'd still be vulnerable to tracking. So, Ghostery needs keep tabs on both.

    Propeller Ads

    Website: www.propellerads.com

    Examples: (Type 1) — currently detected as OpenX
    www.clipstravel.com
    www.dl4all.com
    www.herdailyvideos.com
    www.spectrfile.com
    www.wgofo.com
    www.yify-torrents.com
    share-links.biz
    www.share-online.biz

    Examples: (Type 2)
    www.mp3banana.com
    mp3juices.com
    www.pakheaven.com
    www.rapidmusicsearch.com
    www.skillsongs.com
    www.torrentbee.com
    www.videosnpictures.com
    youtump3.com

    Pattern: /(ad\\.propellerads\\.com|propellerpops\\.com|onclickads\\.net)\\//

    Comment
    good point! good point! (undo)
  • (some HTML allowed)
    How does this make you feel?     Add Image
    I'm

    e.g. sad, anxious, confused, frustrated indifferent, undecided, unconcerned happy, confident, thankful, excited kidding, amused, unsure, silly

    Cancel
  • jbjhbg jhgbjh July 01, 2013 07:10
    Extremely doubtful there is malware present, as I have latest ZoneAlarm + Antivirus (uses Kaspersky integrated) on all systems on my network and also scan a few times a week on all machines using Malwarebytes. Always clean. In addition, all machines use NoScript, RefControl, Ghostery, Trueblock Plus (an Adblock + fork...you know about all that "non-intrusive" stuff Wladimir speaks of lol), BetterPrivacy and HTTPSEverywhere plugins. Nobody ever has physical access to any machines other than family members and my router is secured with WPA2-AES and a long password. The tor network is also used for almost all browsing and other things as well. Nobody here downloads any software besides me and I test everything on jotti.org before even considering installing. Ccleaner is used multiple times a day, with CCEnhancer plugin, like my machines were made to run only that lmao....not really, but ya know. :)

    Thank you for the suggestion though as I do find it rather odd myself. TPB hasn't behaved like this until recently.

    Here's an example of a popup I got just now when visiting there:

    Seems to dealing with adjuggler.

    Please note, yesterday I did add those two addresses in the topic to my hosts file to direct to 127.0.0.1

    Just trying to give as much info as possible in case it helps on your end with either blocking or determining nothing further needs to be done.

    Thanks again for everything! If you need any more info, please feel free to ask.

    Cheers!
    Comment
    good point! good point! (undo)
  • (some HTML allowed)
    How does this make you feel?     Add Image
    I'm

    e.g. sad, anxious, confused, frustrated indifferent, undecided, unconcerned happy, confident, thankful, excited kidding, amused, unsure, silly

    Cancel
  • jbjhbg jhgbjh July 01, 2013 15:45
    Just wanted to add that the popup shown above happened when not using the tor network proxy, which is why I made reference to the hosts file change. Obviously, hosts file is nullified in this scenario.

    It also happens all the same with all cookies cleared and using tor.

    Very glad Ghostery is blocking it already as shown, but Adjuggler is still putting a cookie from that i.p. address even though I have FF set to only have cookies from 1st party sites. Seems that redirect is qualified as one of them.
    Comment
    good point! good point! (undo)
  • (some HTML allowed)
    How does this make you feel?     Add Image
    I'm

    e.g. sad, anxious, confused, frustrated indifferent, undecided, unconcerned happy, confident, thankful, excited kidding, amused, unsure, silly

    Cancel
  • jbjhbg jhgbjh July 01, 2013 17:49
    Thanks again and of course there's no immediacy necessary. AdJuggler ip range added to my router's firewall for good measure. :)
    Comment
    good point! good point! (undo)
  • (some HTML allowed)
    How does this make you feel?     Add Image
    I'm

    e.g. sad, anxious, confused, frustrated indifferent, undecided, unconcerned happy, confident, thankful, excited kidding, amused, unsure, silly

    Cancel
  • CHAMP
    Felix Shnir July 17, 2013 17:38
    Sorry for delay, they are now added.
    Comment
    good point! good point! (undo)
  • (some HTML allowed)
    How does this make you feel?     Add Image
    I'm

    e.g. sad, anxious, confused, frustrated indifferent, undecided, unconcerned happy, confident, thankful, excited kidding, amused, unsure, silly

    Cancel