New Popunder - WatchSeries

[tracerman]

http://www.watchseries.li/

Popunders are showing when you click on a video.

http://www.watchseries.li/link/5616639

Happened twice on that link.

[gorhill]

I could not reproduce a popunder, or even popup. Please provide precise detailed step-by-step instruction on how to reproduce the popunder issue.

[tracerman]

[LimboSlam]

@tracerman: Is this the pop-up you get? It was blocked by my extension called JavaScript Popup Blocker. So @gorhill take a look please: http://healthydevil.com/got-5-minutes-you-can-brush-away-your-cellulite/?zt=55f32a1c6d47cd6364000193&zz=53b1d47c6d47cd82ae000011&site_id=&zr=177610&cb=VNtRbX68a988&f=pNb.

EDIT: Just got another one when with Pale Moon and also blocked (no add-ons/extensions), here it is: http://serve.popads.net/servePopunder.php?cid=2969&iuid=5669145506&ts=1450754417&pl=!qYKYxnzcSoM20gE91v%2BrGFSvxCYZKARlo4%2BjNy34%2BxSmhqBGM18xy3MMiHGCFAJ56R%2FWslfOJIlSCaEmliKg8x4ChbOs6z2xDMHZSvrq0ZNrXTrHcwWRJdNmUr%2BZRHQIWr5MOMjM%2ByIsy0onQ57cXBvdePiokID%2BNyrqIR0FixKeRK7ASt4sArqR776fSM5WNJo6tvc7p9WKcP8NiaeeXJW08zJ4h34oWXxRxIi2UBx4U%2BVUDp749PWEL5%2BCgu7VuUX6XYhvLhP42d54%2BSLHbYlPMBfCrFnQxKYmCMzGCw3rmEDeTGMZx3IonOXExt2PNSxm0BNOiGQCinMgeAhgNGwz%2FgUTp8DtwYdoMfOv4Ns%3D&m=433,140,68,417,25,223,3,6,0,4,-8,-8,850,450,1296,786&s=1280,800,1,1280,800&v=nt.v.

[tracerman]

Yes, one of them auto blocks it. But there are some times where it doesn't. I looked at my chrome history and these are the links it's been opened.

https://static.htmlhubing.xyz/tvmenew/

http://static.htmlhubing.xyz/tvmenew/?runauction=1?crr=fd6b68ccf4082072de7d,,AbtRHauATN0gHM1gTL3Y2dqZTM2Y3YyRnZtQWZi1WZGJTJl1mLvVGZpZXZoRnRyUiRyUSQzUCc0RHa4174ecc3558507e4e2c3&ctbust=0.6531584684176117

http://static.htmlhubing.xyz/tvmenew/?k=5678b3435d6157611533.19314746&h=26c1f2a02fc555615561106a84e4f43a9ec7300b&ban=7611533&iid=14507507871659014636209490918772333&r=982353&exp=prpd&ci=TNlHegRHUwwVPJ0SKxgAe4hGYYBFMcVTAt0WftEXIxgAXcxFXcBFMclWHpFQPt1XMUFFMwGDCMlHUwwVPJ0SKxgAe4hGYYBFMcVTAt0WftEXIxgAfQBDXp1RaB0Tb9FDVRBDtxgAT5BFMc1TCtkSMIgHeoBGWQBDX1EQLt1XLxFSMIwFXcxFXQBDXp1RaB0Tb9FDVRBD0xQV&pm=%3DwATU5VTxJ0TctEQLlUcDJED&pabt=%3D%3DADdAwH%2BRXcd4FD&pc=ZgBGYgBGA8xH&id=7611533

http://breignqued.com/

[LimboSlam]

Yes these are definitely pop-ups and if you disable Ublock Origin and other security extensions: it's clearly malware by Panda Free AV, as well as AVG Free.

Another one, here it is: http://techteam2016.com/vella/1velapa.html?voluumdata=vid..00000002-002e-4eaa-8000-000000000000__vpid..16eeb800-a858-11e5-8b77-be4ca2e6d70e__caid..0c60d9a7-6da0-4636-92a3-477dff9bbf92__rt..R__lid..8f1b7c8f-af24-48eb-ab56-4120c1934543__oid1..02cb514d-fbfa-4a5f-9692-84b909105be3__var1..%5BWEBSITEID%5D__var2..%5BKEYWORD%5D__var3..%5BCATEGORYID%5D__var4..%5BCOUNTRY%5D__var5..%5BBID%5D__rd..serve%5C.%5Cpopads%5C.%5Cnet__aid..__sid..&websiteid=[WEBSITEID]&keyword=[KEYWORD]&categoryid=[CATEGORYID]&country=[COUNTRY]&bid=[BID]

EDIT: Keep getting the same redirects/pop-ups in Pale Moon, here are three of the same I believe: http://serve.popads.net/servePopunder.php?cid=631802&iuid=6086206260&ts=1450754898&pl=%21sGyEPDQ20yemj31VyvziqUV3chOtLLwYhA35BFU%2Fz2aauL6czuTFmK8mnms0fDTJpZJFoPPis0w%2FH2wNN2HvkXJSQeIQQ9K0ElN83AR3pdy0ia6a1M2cFBbUohzc6xspDo3MSr8m8BaROxQ3SE7JO8W4LyhrgayGPfVTT14i5WaFrynw6Nmkijh3TcSRKBkBocCS5XZIZGE%2Fh3OydfEhcukSOjJdd3uHQ%2BH1VkMqJr8jYlA8oS73CJuopB47%2BCsZ9%2FGMEDbVqATAIw6INNkEOw%3D%3D&m=-1,-1,0,0,0,-1,-1,1,0,3,-1,-1,850,450,1280,770&s=1280,800,1,1280,800&v=nt.v

http://serve.popads.net/servePopunder.php?cid=631802&iuid=6179994371&ts=1450755289&pl=%21DPM2MbDpCbMPzbFgBxT9gw0%2BEaBP9isQdIvOHj8VYt9ZNaokd27MgeLsd%2BkXOzTUK%2FyVCA0CcCmFurHPc%2BhgBfbY0lZaZfY4bDHZiE9hKhEqEATwQjvU8bZ4yelpdtI9JjxuhNEOzxqohSd2B6HUOqTYNiPsVrFM%2BwDgtP2ub7bNu1sifTSt2u%2FDFMPt6K3QOlbptHYijTwmrlVoGmbLEfs77o9pySWc5RzerT4lVfKAzmsNKrabgbAA4x0KnN5DzOWhTaRwjgNEFnJmgXz9cw%3D%3D&m=-1,-1,0,0,0,-1,-1,1,0,3,-1,-1,850,450,1280,770&s=1280,800,1,1280,800&v=nt.v

http://serve.popads.net/servePopunder.php?cid=631802&iuid=8744360172&ts=1450755640&pl=%21aNKVkvsUjq%2FRR0JxxIOBi7V9YK5xFjKt64aj%2F2Gex4iGwMWSb6tVKBKqUpNDfUxpDp5%2BDT5WVsT7nkyc3eJWLG%2FdCVPifcbNdSoE%2BpcTFnI3r0wQOzeZAv2GH5IHnlb7knGhilTQ9G7SZD%2BUlUeiZX2DQXCAULsIui%2F3Kd4z%2FCpsXy6wfw1lH%2FobzZDjmBrYQ66TcqxdNqG38PWvlmyRTfEhQIIMlCaHcwsWgMAAD1l4YqcRY%2BxLvAKqu5pbIYuNXEqjVirqXT3qFuUgccjLpA%3D%3D&m=-1,-1,0,0,0,-1,-1,0,0,3,-1,-1,850,450,1280,770&s=1280,800,1,1280,800&v=nt.v

[LimboSlam]

Steps:

1.) Disable click-to-play (Run all plugin content)
2.) Allow cookies to be set
3.) Disable Ublock Origin and any other security extensions/add-ons
4.) Temporarily disable your AV or just turn off web protection
5.) Then load offending website: http://www.watchseries.li/link/5616639

Hope this helps @gorhill and @tracerman.

[gorhill]

I looked at my chrome history

Use the logger, it's the tool of choice to sort out what is occurring inside uBO.

[gorhill]

I still do not see popunders -- only popups. These can be handled by EasyList, report to maintainers of EasyList. For example:

||htmlhubing.xyz^$popup