Skip to content
This repository has been archived by the owner on Oct 24, 2020. It is now read-only.

Expand list of sites on which instart logic is found #110

Open
dharb opened this issue Dec 12, 2018 · 5 comments
Open

Expand list of sites on which instart logic is found #110

dharb opened this issue Dec 12, 2018 · 5 comments

Comments

@dharb
Copy link

dharb commented Dec 12, 2018

Hey there,

I recently came across a much larger list of domains that use instart logic. It turns out that instart logic owns an SSL cert that contains a long list of the domains where it can be found in the 'Subject Alternative Names' field, which you can see here: https://crt.sh/?id=361958495&opt=ocsp. I think there might be more to this evil tracker company having an SSL cert for these domains (is this a new form of server-side tracking that is unbeatable by client software?), but at the very least I would like to do whatever I can to limit their reach.

Would you like me to make a PR to update the readme and the array of domains where the instart logic buster should be activated?

@gorhill
Copy link
Owner

gorhill commented Dec 12, 2018

Every single hostname added to the content script need to undergo testing:

  • is IL actively obfuscating 3rd parties on the site?
  • can IL be foiled with just using uBO filtering syntax?
  • does adding the site to the content script breaks anything on that site

I can't blindly add sites in there.

@gorhill
Copy link
Owner

gorhill commented Dec 12, 2018

A first step would be to list the sites which are in there but not in uBO-Extra. The volunteers can start to check these sites one by one to validate that they need to be foiled by uBO-Extra.

@dharb
Copy link
Author

dharb commented Dec 12, 2018

Makes sense, I appreciate your level of thoroughness. I'll go ahead and diff the lists and post the results here as soon as I get a few minutes to spare.

As a side note, I just wanted to say thank you for all that you do, and for not selling out. It's inspiring.

@smed79
Copy link

smed79 commented Dec 12, 2018

Click to see the sites which are not in uBO-Extra

abchome.com
about.com
achicanow.com
alaskaair.com
alaskaair.net
apwcontent.com
arrow.com
askmen.com
autonation.com
autotrader.ca
bareweb.com
bax-shop.co.uk
bax-shop.es
bedroomworld.co.uk
bedstore.co.uk
bestreviews.com
bestwestern.com
beta.hearthhead.com
bluetriangletech.com
bostonglobe.com
bostonseaport.xyz
bouclair.com
btttag.com
btttagqa.com
cafemomstatic.com
cagesworld.co.uk
canada.com
canoe.com
cargurus.com
cbkgprod.com
cdscosa.com
celebslam.com
chess-4.com
chesskid-4.com
chesskidfiles-4.com
cirquedusoleil.com
citilink.co.id
computerworld.com
cromwell.co.uk
crystalski.co.uk
cwmods.com
demandware.net
destinydb.com
doorsworld.co
dotti.co.nz
dotti.com.au
dupontregistry.com
eberjey.com
eddieborgo.com
edmunds-media.com
ehealthinsurance.com
eneighborhoods.com
eq2interface.com
eqinterface.com
equipmenttrader.com
esicdn.cloud
esitest.cloud
esoui.com
faceoff.com
falconholidays.ie
falconholidaysprjuat.ie
fashionwashington.com
firstchoice.co.uk
fivefourclub.com
flexjet.com
forrent.com
frmonline.com
gardenfurnitureworld.com
goo.lolking.net
goodyear.com
haycdn.com
henhouse.com
hockeyinsideout.com
holidaycheck.de
homes.com
hourglassangel.com
i4u.com
idigitaltimes.com
inscname.net
instartdemo.com
jacquie.com.au
journeys.ca
journeys.com
justjeans.com.au
k.to
katespade.com
katespade.tech
kiddicare.com
kingston.com
latimes.com
leadingbusinessloans.com
levainbakery.com
lfpress.com
logicbuy.com
lolking.net
lotrointerface.com
machinelearningworkshop.com
magnettrade.co.uk
mamaslatinas-static.com
mamaslatinas.com
marahoffman.com
marcfisherfootwear.com
marjoon.com
mattressesworld.co.uk
meaningfulbeauty.com
mma.tv
mmoui.com
modern.co.uk
moorings.com
moovdemos.com
moovweb.net
mtstandard.com
nanovisor.io
naturalgrocers.com
naveensbiscuits.us
newegg.com
nflexperience.com
nydailynews.com
odistatic.net
officesupermarket.co.uk
opshead.com
pacificsunwear.com
pacsun.com
pagesjaunes.ca
peeks.com
photobucket.com
pilotonline.com
plated.com
pltd-staging.com
portmans.com.au
principalsecret.com
qaautonation.com
qfactor.io
quickenloans.com
reachoffers.com
rfdcontent.com
riftui.com
rockler.com
rocklerpro.com
ruecdn.com
ruelala.com
rugstudio.com
runt-of-the-web.com
rushordertees.com
rvtrader.com
saatva.com
scentbird.com
scorebig.com
secretui.com
shedsworld.co.uk
sheknows.com
shocho.co
sigersonmorrison.com
skim.gs
sofasworld.co.uk
solarforhomes.com
sparkpeople.com
static-homes.com
stgautonation.com
stltoday.com
swtorui.com
synapse-games.com
thegiftguide.ca
thomson.co.uk
timeanddate
tmn.today
toolbox.com
touchofmodern.com
tryitnow.com
vagazette.com
verywell.com
vistaprint.io
wag-static.com
walgreens.com
wapo.com
weather.com
whattoexpect.com
worldstores.co
worldstores.co.uk
wowinterface.com
wrap.co
wysadacdn.com
zacks.com
zamimg.com
zamnetwork
zenhaven.com
zoro.de
zorotools.de

@okiehsch
Copy link
Collaborator

okiehsch commented Dec 12, 2018

Well, I tried all domains beginning with "a" and could not reproduce any redirections.
I can see instart code in some sources for example autonation.com but it does not trigger a redirection on my end.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants