[privoxy-devel] [ ijbswa-Actionsfile feedback-1622518 ] Domain squatting on-close pop-unders

[SourceForge.net <no...@so...>]

Actionsfile feedback item #1622518, was opened at 2006-12-26 17:38
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=460288&aid=1622518&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: filter: ad-not-blocked
Group: current actionsfile
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Adam Piggott (proactivesvcs)
Assigned to: Nobody/Anonymous (nobody)
Summary: Domain squatting on-close pop-unders

Initial Comment:
URL: http://www.powerdvd.com/
One of the URLs called from this page is http://www.powerdvd.com/top.php?d=powerdvd.com
...which contains on-close pop-under code. It also contains home page-setting code that only seems to work with IE.

Other URLs with this:
http://www.kanzaisoga.com/
http://www.ercipd.com/
http://www.cistern.org/

I've also found instances where the pop-under is not present, such as http://www.tiretrack.com/

For others, see http://www.google.co.uk/search?q=%22/top.php%3Fd%3D%22&hl=en&meta=


{+block}
/top\.php\?d=.*\.[a-z]{2,5}$

...prevents this behaviour. The .*\. assumes that other uses of this method will always have a domain name after the ?d=, as well as the [a-z]{2,5}$ which I believe helps constrain the rule, matching a top-level domain string pattern.

I'd say that simply blocking /top\.php\?d= may cause false positives.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=460288&aid=1622518&group_id=11118