generic cdn domains

[collinbarrett]

Lists that include generic cdn domains, like d12ulf131zb0yj.cloudfront.net, should receive a deduction in FilScore.

Per @Atavic here.

Weight: Low

[Atavic]

The problem is that scripted subdomains as:

*daq0d0aotgq0f*.cloudfront.net
...

*pl109299*.puhtml.com
*pl5411*.bntags.com

...are created for the very purpose of avoiding being blacklisted. The owners of cloudfront, puhtml & bntags have a script ready to put new subdomains online once the available old onews get too much blacklisting.

A solution is to list all the available domains, like this filterlist does with admob:

admob.com
admob.de
admob.biz
admob.co.uk
...

BTW there are worst cases like:

a0675c1160de6c6.com
476vi285.stream
d50285bff60edbb406.com

...where the whole domain is the result of a scripted registration.

[Atavic]

Just another note, as seen on hosts2ch, there's a lazy scripted version, where

rc.i2i.jp
rc2.i2i.jp
...
rc9.i2i.jp

has a clear imprinting, where no random values are used.

[elypter]

is there a way to filter those not by url but by the reference in the source html file?

[Atavic]

If you mean to inspect the code and modify the parts containing these urls, yes. Proxies do this e.g. Fiddler or Privoxy.

[Atavic]

Just another lazy scripted version:

fra1.ib.adnxs.com
fra1.mobile.adnxs.com
fra10.ib.adnxs.com
fra100.ib.adnxs.com
fra11.ib.adnxs.com
fra110.ib.adnxs.com

...that appears in this hosts file.

[elypter]

cool. is it possible with an adblocker extension too? i dont know if they can intercept pageload early enough

[Atavic]

Yes, some modify redirections or User Agent, like https://github.com/FirefoxBar/HeaderEditor
But Webextensions - compared to old Addons - have reduced possibilities.

[collinbarrett]

closing into master issue #371