So what happened with this? By the time I went to bed everyone

botnet

Is this some kind of 4chan x shit? I've never seen that domain on here before

>>61009719
It's a 1x1 image that tracks you.

>>61010014
Pretty sure some people without 4chan X were getting it as well
I think it only shows up on certain boards like /pol/

>>61010061
i have it right now on /g/ with 4chanx

>>61010160
just checked and i do as well

i use appchan x and i don't get it on /g/. can't be bothered to try other boards.

>>61010171
even with 4chanx disabled i still have it
i don't know what is it but i blocked it with ublock origin and umatrix

>>61009719
If this whole thing blows over, which I hope to god it does, I'll have learned to never express overly /pol/ or /r9k/ -tier views here again. Even if only ironically.

>>61010241
Yeah I'm fucked if it's what people are making it out to be

>>61010241
EVERYTHING I HAVE EVER POSTED ON THIS WEBSITE WAS IRONIC AND DOES NOT REFLECT MY REAL LIFE VIEWS OR BELIEFS. I WAS MERELY "TROLLING"

I wonder if this is one of those botnets that stick themselves into your browser's cache like what happened to imgur a few years back.

https://www.reddit.com/r/technology/comments/3lw2g6/imgur_is_being_used_to_create_a_botnet_and_ddos/

>>61010287
THIS DESU

>>61010287
this. i actually LOVE blacks and jews. they have such nice cultures

Why can't I block this in uBlock Origin?
No matter how much I block it, it still appears in the logger when I refresh the page.

>>61010389
doesn't the red thing on the left mean it's blocked

>>61010061
>I think it only shows up on certain boards like /pol/
It's blue boards, I think.

>>61010355
jej

>>61010389
works on my machine

File: ss (2017-06-21 at 19.29.17).png (4KB, 723x35px) Image search: [Google]

4KB, 723x35px

>>61010413
>>61010424
I think it's working now.
Odd.

>>61010269
What are people making it out to be?

>>61010418
/pol/ isn't a blue board and it shows on /pol/ for me

You guys have tried clearing ALL of your temporary internet files right? Clear the ones from IE and Flash and of course clear the ones from your primary browser.

>>61010436
logging your posts with your IP to tie them to your name

>>61010453
why would 4chan need separate domain to do that?

File: g - The g Wiki httpwiki.installgentoo.com - Technology - 4chan - Mozilla Firefox (Private Browsing) pol - Welcome to pol - Politically Incorrect - Politically Incorrect - 4chan - Mozilla Firefox (Private Browsing).png (442KB, 2116x729px) Image search: [Google]

442KB, 2116x729px

>>61009719
Nothing. You retards are infected with some botnet shit!

>>61010418
>>61010439
It's blue boards + /pol/ afaik.

>>61010464
it wouldn't be 4chan doing it, presumably
it's another company using an exploit

ITT: Tinfoil hats, its just another ad-thing, they cannot do shit with ad-info they gather from me because I don't buy shit I don't need or that its on fucking internet ads of all places.

File: ss (2017-06-21 at 19.33.14).png (18KB, 513x491px) Image search: [Google]

18KB, 513x491px

Well it DOES save a cookie to uniquely identify you.

>>61010477
Check for ekansovi in your cookies, that's were I found it.

>>61010477
Click on "+All"

File: pieces-of-the-real-me1.jpg (209KB, 567x358px) Image search: [Google]

209KB, 567x358px

pls no bully

>>61010488
Yeah, but how did it get here?

Clearly an admin has put it there - why

File: (((Ekans)))ovi.png (71KB, 250x250px) Image search: [Google]

71KB, 250x250px

ekans is backwards for snake
Coincidence?

File: Options - Mozilla Firefox (Private Browsing).png (95KB, 1146x738px) Image search: [Google]

95KB, 1146x738px

>>61010496

>>61010489
>Not using self destructing cookies

>>61010489
I think every cloudflare server does that

File: g - The g Wiki httpwiki.installgentoo.com - Technology - 4chan - Mozilla Firefox (Private Browsing).png (278KB, 1208x687px) Image search: [Google]

278KB, 1208x687px

>>61010497
Done. Nothing.

>>61010477
if i'm infected i should have it for every site i visit, but i have it only on 4chan

Still don't have this.

>>61010538
Weird
I have 4chan X and OneeChan installed btw.

>>61010477
What country are you located in? I'm on a fresh windows install(literally within the last 24 hrs) and have it. I'm in the US.
If it really is another ad service, has it been spotted on any other websites?

File: 8934hnt7g32dnuifcq.jpg (154KB, 2121x1414px) Image search: [Google]

154KB, 2121x1414px

What are we doing now? Is it still safe to post?
>>61010453
How can they tie your IP with your name?
What other risks are we dealing with?

File: Add-ons Manager - Mozilla Firefox (Private Browsing).png (122KB, 1208x730px) Image search: [Google]

122KB, 1208x730px

>>61010550
Maybe that's why? I only have these extensions

It's the NSA

EVERYTHING I HAVE EVER POSTED ON THIS WEBSITE WAS IRONIC AND DOES NOT REFLECT MY REAL LIFE VIEWS OR BELIEFS. I WAS MERELY JOKING

>>61010518
Ovi means EGG SNAKES LAY EGGS

Browser cookies are basically website eggs! Your computer will hatch into a snake and EAT your data and privacy and genitals!

>>61010538
check the ub log "behind the scene" for websockets

>>61010517
Money, duh

>>61010555
Ukraine

>>61010519
Same for me. Does that mean that I am safe?

>>61010517
Compromised ad network is a more likely explanation. Doesn't seem to be a part of 4chan x, I searched for the url in the code and it turned up nothing.

>>61010570
FUCK

File: uBlock — Logger - Mozilla Firefox (Private Browsing).png (122KB, 1208x1161px) Image search: [Google]

122KB, 1208x1161px

>>61010572
Nothing

>>61010560
just check where else your IP has logged in
it's not complicated bud

>>61010587
Like it can't be obfuscated in any way.
>>61010585
Odd, anyone outside of the US/ have this?

>>61010602
You have to select "behind the scene" and browse /g/ for a bit.

>>61009719
If I use private browsing mode and self destructing cookies as well as block it in noscript am I safe?

>>61010625
i'm in Italy

File: 4ec5548fa49022809a579a416122523f0e632246_hq.jpg (70KB, 628x842px) Image search: [Google]

70KB, 628x842px

>>61010600
It's not all bad, anon O3o

File: 2956258.jpg (264KB, 1360x1103px) Image search: [Google]

264KB, 1360x1103px

:)

Weird.
When I load the page 4chan x removes the script that makes the websocket thing work.
It tries to load then gets rekt.

I'm seeing it now in the "behind-the-scenes" view on ublock. ublock sees it but it seems to be incapable of blocking it for some reason.

>>61010706
I think you have to delete the behind-the-scene entry from the whitelist. Then it blocks it.

>>61010748
No it wont block it just like that.

>>61010748
Confirmed for me at least.

>>61010784
Deleting behind-the-scene from the whitelist and then adding

||ekansovi.com$domain=4chan.org
||a.ekansovi.com/wsm$websocket,domain=behind-the-scene

to the filters worked for me.

>>61010872
You can use
||$websocket

to block all future attempts at using websockets like this.

>>61010872
>Deleting behind-the-scene from the whitelist
Will make uBlock Origin unable to update the filterlists. Don't suggest this to anyone.

it's ad tracking

>>61011023
Are you sure? The update seems to work fine. How can we block it then?

File: 1497599546706.jpg (204KB, 1000x1000px) Image search: [Google]

204KB, 1000x1000px

>>61011122
We hack it.

>>61011023
>>61011122
Shouldn't you be able to do the "even if whitelisted" thing?

>>61011122
>Are you sure?
Yes. It's on gorhill's github described.

>How can we block it then?

0.0.0.0 ekansovi.com

in your hosts file.

>>61010602
>ad.doubleclick.net
why is that allowed on mine? i have nearly all the filters activated, even the hosts files

Has anybody actually bothered to find out what script actually tries to set up the websocket and what it tries to transfer?

>>61011159
>why is that allowed on mine?
Because of this. It's there I assume it breaks something, You can create a rule:

* doubleclick.net * block

to block it.

>>61011188
Firefox has a websockets inspector plugin that you could use. I'd try to figure it out but I don't have this

>>61011122
uMatrix does it automatically

File: Untitled.png (4KB, 481x93px) Image search: [Google]

4KB, 481x93px

>>61011213
>Because of this
Silly, I forgot to attatch image

has anyone actually looked at the site yet?

Even if this is some bullshit ad fuckery, it made me realise I let my guard down.

uMatrix 4lyfe - reminds me of NoScript for Firefox, only less shitty, and easier to use

>>61011239
also don't use chrome, use iridium

File: amisafe.png (19KB, 517x407px) Image search: [Google]

19KB, 517x407px

am i safe

>>61011343
Best way to check to be 100% sure:

Go to Settings>Advanced Settings>Privacy>Content Settings>All Cookies and Site Data

Search for "ekansovi"

>>61009719
chanpink doesn't have this problem

>>61011147
It's not working. I tried to block it dynamically but it failed too.

So, uh, there's a bunch of obfuscated javascript at the top of every page that's opening the websocket.

>not stealing your neighbors Wi-Fi for 4chan usage
lol
enjoy having your racist/sexist virginal shitposts exposed if you or your family ever become of interest

So is this just some ad tracking garbage that tinfoil hats are sperging over or something to actually he concerned about

>>61011417
wtf is chanpink?

>>61011471
both arent good desu senpai

>>61011471
i have this showing up on ublock, but no cookie? also running pi-hole

>>61011494
I'd prefer ad tracking over potential employers and family reading my shitposts

File: it's-a-me! Ekan!.png (10KB, 432x145px) Image search: [Google]

10KB, 432x145px

>>61010872
uMatrix blocks websockets, at least in Firefox (in Chrom{e,ium} there's a need to add an uBlock companion to fix websockets)
>>https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO-Extra-is-useful
and I never investigated what's the situation for uMatrix but I'd guess that it can't fix websockets there

Cookies/Dom Storage cleaned, no occurrences of this ekans stored anywhere (and I'm a GNU/Linux turboautist) still ekansovi strives to sneak in

Do we have any official word on this?

>>61010670
>
it never ends, does it ?

>>61011442
b.u and b.a look like they're the functions for decoding obfuscated strings

>>61009719
I got it with uMatrix. Only wants to runs 1 script and XHR.

>>61011574
OP here. I got it as well
I'm more worried about what it was, though

>>61011421
Try to flush the dns cache
amd as admin:

ipconfig /flushdns

That domain should not resolve at all anymore.

Any way to keep the behind-the-scenes whitelisted while blocking websockets? Right now it looks like the only solution is to use an extension to disable websockets which is less than ideal.

File: "Got Snakes?" - "GNO!".png (10KB, 424x126px) Image search: [Google]

10KB, 424x126px

>>61011528
>and I never investigated what's the situation for uMatrix but I'd guess that it can't fix websockets there
well, according to gorhill it only affects "Chromium version 57 and earlier" ; I've checked on Chromium 61 and it werks

File: unknown.png (10KB, 741x124px) Image search: [Google]

10KB, 741x124px

No but seriously guys there's obfuscated javascript at the top of every page and it looks like it's tracking you lol

>>61011666
Can it save posts, though, or just when you're on 4chan?

>>61011666

b.a("HyEeSzUEDzgZFhwEaxMnKg==")

in the javascript resolves to "xhr.ekansovi.com"

>>61011691
fucked if I know, I'm trying to make sense of it.

>>61011666
Oh shit, OK fuck you.
My name is Sam Hyde, come at me.

Also fuck niggers, spics, kikes, gooks, nips, wops, frogs, libtards, people who use emojis and single speed bikes.

I genuinely stopped phoneposting because of this. I have the standard filter with ublock and umatrix now. Blocked ekan as much as i could with both.
>>61011725
this thing occasionally shows up in uMatrix, too Seems shifty, but is probably used to save post containers.

>>61011666
mirin' satanic trips
and it's true, fuck

adios amigos

>>61010550
>>61010565
Its not the extensions.

Note: The posts made by this IP address are strictly satirical; and resemblance to any personal opinions, real or ironic, are strictly coincidental. No animals were harmed in the making of these posts.

File: 9428058.png (98KB, 600x500px) Image search: [Google]

98KB, 600x500px

THREAD THEME:

https://www.youtube.com/watch?v=bUFWXpYJKaI

I'm retarded, if ublock blocks the requests then what's the issue?

>>61011884
The fact that it's there in the first place

>>61011860
I would welcome death if people I knew had access to every one of my 4chan shitposts. South Park was right all along, we should have known

>>61011904
If the tinfoil hats are right then of course it's an issue but far less of one, at least for me. My worst fear is >>61011919 coming true and having a database with this information publicly available

File: >set CSP >CSP blocks xhr but still allows unsafe-eval.png (8KB, 1134x48px) Image search: [Google]

8KB, 1134x48px

man

so if umatrix blocks this I'm good to go?
I want to make a little infograph explaining what is it using this thread and how to use umatrix to block it

>>61011884
>if ublock blocks
except it doesn't unless you instruct it so; many will just assume that standard uBlock w/o uMatrix is enough

and it's not

>>61011919
The reason you can see it is to make people give up and become paranoid, any serious Nazis wouldn't care.

File: 1494469666435.jpg (241KB, 1069x1196px) Image search: [Google]

241KB, 1069x1196px

>mfw i don't have this
By the outlook of things looks like this might be only targeted at US or EU where people can get arrested for having an opinion

>>61011970
It seems to be blocked on my browser

File: d4843.jpg (66KB, 400x400px) Image search: [Google]

66KB, 400x400px

>not showing up for me anywhere
Looks like I'm home free lads

b.a("Aj8NCQ==")

Resolves to "eval"

b.a("ECwODjkbPDMZFgYbIDwnJAw4NS88FhYgCgwnOz4hOA==")

Resolves to "webkitResolveLocalFileSystemURL"

File: 1497464162128.jpg (163KB, 1027x794px) Image search: [Google]

163KB, 1027x794px

Has anybody tried to contact gook about that shit?

>>61012001
did you really check the "behind the scene" page? It looks like >>61011528
do you use only uBlock Origin without settings like >>61010872 ?

>>61012009
Right click > View source code
Search for one of those code snippits
If it's there you're running the obfuscated Javascript whether you're running uMatrix or not.

>>61012049
Well, fuck

>>61012071
*whether you're blocking ekansovi or not

What if we wipe all broswer data, load up a VPN somewhere like JP and then try and see if it appears. This may be targeting specific countries.

>>61012023
>"Hey gook could you pls stop selling my data for once ok thanks bye"

>>61011778
firefox for android supports both ublock and umatrix

I see it in Iridium 58 and Opera using Blink 58 but not in Chromium 55 and Google Chrome 55. It might be being bypassed on older browsers so if you don't see its probably still loaded.

>>61012009
fug

if i have ekansovi blocked at the hosts file, is it safe?

>>61012071
>>61012092

Not quite. Everyone will still have the code in the HTML as thats the literal index file its pulling from the 4chan servers. uBlock / HOSTS etc block the connections that code tries to make.

Do you even know how blocking works?

>>61012145
I said it's running the obfuscated javascript whether you block ekansovi or not. It's not going to make the connections but it's still running 15KB worth of Javascript.

>>61010642
Italy here too, don't have it

People saying they "don't have it" - you're probably not looking properly.

>>61012186
Well.... yeah.

EVERYTHING I HAVE EVER POSTED ON THIS WEBSITE WAS IRONIC AND DOES NOT REFLECT MY REAL LIFE VIEWS OR BELIEFS. I WAS MERELY JOKING

I had it a second in ublock and now it's gone after reload

when i turn on yesscript, it's disabled, but 4chan is unusable. tf do i do? i have no idea how to make umatrix load pages correctly.

File: 502[3].jpg (19KB, 351x359px) Image search: [Google]

19KB, 351x359px

Used to get it on /pol/ and not on /g/ an hour ago, now it's exactly the opposite, /g/ tries to connect to ekansovi and /pol/ doesn't.
Also firebug console suggests the websocket it tries to open just 404s anyway without any blocking on my part.

>>61012235
Yes it does buddy.

File: Capture.png (43KB, 825x533px) Image search: [Google]

43KB, 825x533px

>>61012186
Where you seeing this?

I don't have any javascript running from ekansovi

All of this javascript is Google or 4chan

>>61012235
>merely pretending

SWAT's already on the way, punk.

>>61012318
It's not being included from some 3rd party site, it's embedded in this page

>>61012294
The stories and information posted here are artistic works of fiction and falsehood.
Only a fool would take anything posted here as fact.
You're not fools, are you, NSA?

File: hmm.png (40KB, 1280x302px) Image search: [Google]

40KB, 1280x302px

well, i have it too
location is poland

So did anyone bother to un-obfuscate the js to see what it's actually doing?

>>61012353
So, this is 100% Hiro's doing I assume?

>>61012414
Probably; assuming it's malicious it could be a hacker, but we're yet to find out if it is malicious.

File: ss (2017-06-21 at 21.29.25).png (3KB, 229x63px) Image search: [Google]

3KB, 229x63px

Can't find the green default .ico in 4chan X anymore after blocking ekans.
Is it gone for anyone else? Green boards display no favicon at all now.

>>61012424
If it's malicious it's definitely Hiro.

>>61012432
I still have it, you probably blocked it via another rule.

There's a lot of stuff in here about ice servers or stun servers, anyone know what that is?

>tfw I don't have it

Is this just a USA/UK thing or something?

>>61012508
did you check well enough?

File: ss (2017-06-21 at 21.35.23).webm (286KB, 624x224px) Image search: [Google]

286KB, 624x224px

>>61012461
Strange. I have no other 4chan rule other than blocking all ekans stuff.
It's definitely blocking my green favicon, webm related.
I'm not seeing a block in the logger.
I added these rules

||ekansovi.com

! 21.6.2017, 19:25:00 behind-the-scene
||a.ekansovi.com$important

! 21.6.2017, 19:25:20 behind-the-scene
||a.ekansovi.com/wsm$websocket,domain=behind-the-scene

>>61012508
read the thread, retard

>>61012513
It doesn't show in the requests blocked of UBlock. It doesn't show in the behind the scenes menu either after opening a bunch of threads.

File: Selection_098.png (19KB, 531x187px) Image search: [Google]

19KB, 531x187px

i blocked it in the ublock origin dashboard but i am still seeing it in the logger in behind-the-scenes

pls halp

>>61012450
Revenge for Hiroshima, and calling him Hiroshima.

File: ss (2017-06-21 at 21.40.33).png (29KB, 1488x465px) Image search: [Google]

29KB, 1488x465px

>>61012461
>>61012516
I removed all "My Filters" and it changed nothing.
Can someone post me their exported "My Rules", so that I can revert to default?
I don't know what else it could be.

>>61012516
Added those to my filters and still have the icon.

Might be Firefox related. When I was using Nightly the blue favicon would not load.

File: Selection_099.png (19KB, 626x94px) Image search: [Google]

19KB, 626x94px

if it's red, does that mean it's working?

>>61012587
i think it means it's blocked.

Decoded most of the strings, its still pretty obfuscated but whatever.

https://pastebin.com/C0Mj6vHL

>>61012424
>but we're yet to find out if it is malicious.
Oh come on. Why should he ever engineer such a complex piece of shit able to bypass fucking uBlock Origin with standard settings if it's not malicious. That, or a subpoena to make merrica great again or something.

>>61012587
blocked.

>>61012579
You should be able to reset it to default in uBlock settings but I doubt that will change anything.. Check the logger in uBlock to see what is blocking it.

>>61012629
wtf i hate 4chan now!

>>61012581
Well that's odd because it only gets removed when I enable uBlock.
>>61012658
The logger is not listing the favicon at all.
Just removed all cookies and chache and so on, gonna restart browser now, but doubt it gets fixed.

>>61010542
same guy - on my other os the cookie is there but i don't have the requests. ???

>>61010477
Your entire OS is a botnet ya dingus.

>>61012676
It might Firefox, I don't even have a favicon when I launch Firefox with extensions disabled.

File: ss (2017-06-21 at 21.47.02).png (42KB, 821x260px) Image search: [Google]

42KB, 821x260px

>>61012676
>>61012581
>>61012658
>>61012712
It just showed up in the logger when I loaded sys.4chan.org/auth, and... what the fuck??
Am I being trolled by Fanboy's list here? Why is 4chan detected as REDDIT?

>>61012692
oh shit. now it's showing in the ublock logger too

>>61012725
Oh yeah, now I remember, that indeed happen.
Here is the rule I added. I completely forgot about it.
@@||s.4cdn.org/image/favicon.ico$image,domain=4chan.org

>>61010287
This, of course. We are always joking here. 100%

File: NHFUKkw.png (73KB, 290x200px) Image search: [Google]

73KB, 290x200px

>>61012629
>It unironically uses XOR for string encryption

File: rsz_1rsz_wtf.png (23KB, 261x202px) Image search: [Google]

23KB, 261x202px

I have it according to ublock, but it has a (-) beside it

does that mean it's blocked

also, my browser, pale moon, is set to never save history..am I safe?

File: ekansovi.png (38KB, 773x484px) Image search: [Google]

38KB, 773x484px

how to block using uMatrix:

go to logger in uMatrix.

refresh the 4chan page and look at the logger again

follow these steps

File: ss (2017-06-21 at 21.54.48).png (32KB, 1168x327px) Image search: [Google]

32KB, 1168x327px

>>61012754
I added it, but now it's not showing up in the logger anymore at all. And it's still not back.
But instead Fanboy's list is now whitelisting doubleclick's favicon? And blocking all favicons not by reddit?
Did they get hacked or something?

File: IMG_0543.png (138KB, 345x337px) Image search: [Google]

138KB, 345x337px

I helped ccd0 add obfuscated botnet code to recent versions of 4chan X and advised him to pull it from github.org lest he gets discovered and reported. The botnet is appended to the code at compile-time; it's built into our fork of the Coffeescript compiler. It's very basic right now but eventually we're gonna make it into a powerful, decentralized p2p network that DDoSes sites specified by our future clients. The C&C is a hidden Github repo; orders are routed via the updates mechanism (just setting a few variables). Since the last few revisions we've gotten a couple prospective clients (we advertise on IRC and on blackhat SEO forums) and we're going to start actually making money for the next few days. ccd0 will deny this to the best of his ability, for obvious reasons - or maybe try to make it look like he's trolling all of you - but I seriously encourage you to stop updating 4chan X if you ever notice your connection getting slow/have bandwidth restrictions. See, the botnet is opt-out that way.

>>61012725
always knew we are reddit

I do not get this on Firefox.
I do get this on Vivaldi.

>>61012847
It's not 4chanX though, I'm not using it and it's still there.

>>61012847
that looked like it took so much effort to make only to be obvious as fuck bait

>>61012725
It has a "~reddit.com" meaning it can happen in any domain except reddit so it blocks the 4chan one. Its not detecting as reddit.

>>61012820
Have you tried Shift + reload?

>Did they get hacked or something?
False positive or something. That whitelist might have a purpose, you should be able to block it anyways.

>>61012847
No 4chan X here. fuck off.

>>61012847
that old copy pasta

>>61012876
>It has a "~reddit.com" meaning it can happen in any domain except reddit
Yeah I kinda thought so, but why would you block all favicons except reddit's...

I tried Ctrl+reload multiple times already, yeah. This used to refresh favicons immediately when I worked on some websites.
However, it's still broken now, even after disabling all of the lists the blocking rule appears in and adding the exception

File: fkwfk.jpg (106KB, 923x353px) Image search: [Google]

106KB, 923x353px

>>61012414
It's code for ads

File: hnnnng.png (488KB, 425x534px) Image search: [Google]

488KB, 425x534px

>>61009719
>Tfw advertising bots are fake
>Mfw chickmoot makes money with it

>>61012863
>I do not get this on Firefox.
read the thread.

>>61012908
My guess its trying to block third party fav icons. Check the logger one more time. I am going to try updating my filters to see if I can get that.

I don't know what it is for sure but I'm just blocking it in my host file.

I should be fine unless more domains get added.

If anyone knows exactly what it is please do tell.

>>61013034
remove and block

File: 250px-CaptainHindsight_400x400.jpg (31KB, 400x400px) Image search: [Google]

31KB, 400x400px

maybe you shouldn't have used 4chan in the first place. it's too late now

>>61013067
Just coming 12 years too late, cunt.

>>61012992
The favicons came back after I disabled the fanboy filters and then restarted my browser. (not without restart)
then I enabled the fanboy lists again and favicons immediately dissappeared.
Gonna restart again now.

>>61013130
Try force updating the fanboy filters or disable just the ultimate list.

File: ekans.jpg (82KB, 984x374px) Image search: [Google]

82KB, 984x374px

Update your filters lads. Based gorhil took care of us.

File: ss (2017-06-21 at 22.16.55).png (16KB, 444x273px) Image search: [Google]

16KB, 444x273px

>>61013145
pic related. This part here appears in both the fanboy lists. It's one of the only things in the lists with a comment, apparently saying it blocks "popads tracking".
I guess I will just have to leave them both disabled.

File: Screenshot_20170621-161905.png (125KB, 1440x2560px) Image search: [Google]

125KB, 1440x2560px

This is with a fresh install ublock on android firefox

>>61013206
Did you add the white list rule properly? Remove the one I gave you and try white listing from uBlock's logger.

File: thumbs up cat.png (200KB, 450x384px) Image search: [Google]

200KB, 450x384px

>>61013185
i still feel kind of dirty now

>>61009719
https://who.is/whois/ekansovi.com

site isn't even live

>>61010453
But, but I thought we were Anonymous? CAN'T YOU GUYS DO SOMETHING?

File: 1497316092075.jpg (18KB, 680x514px) Image search: [Google]

18KB, 680x514px

Guys, it's the Russians.

>>61013214
Its behind the scene on Firefox.

>>61013261
Actually it's the jews:
>>61010670

>>61013185
Where you seeing this

>>61013185
Link it.

Request URL:wss://a.ekansovi.com/wsm
Request Method:GET
Status Code:101 Switching Protocols
Response Headers
view source
Connection:Upgrade
Sec-WebSocket-Accept:smNl5qDJmpTE/V80vY0bQ2HB2HY=
Upgrade:websocket
Request Headers
view source
Accept-Encoding:gzip, deflate, sdch, br
Accept-Language:en-US,en;q=0.8
Cache-Control:no-cache
Connection:Upgrade
DNT:1
Host:a.ekansovi.com
Origin:https://boards.4chan.org
Pragma:no-cache
Sec-WebSocket-Extensions:permessage-deflate; client_max_window_bits
Sec-WebSocket-Key:ZVJv99nFzKohZUcCf7dvUA==
Sec-WebSocket-Version:13
Upgrade:websocket
User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/58.0 Iridium/58.0 Safari/537.36 Chrome/58.0.3029.81

it's a web socket it opens
can't see any other data
anyone actually see it transmit data?

>>61013328
see >>61012629

>>61013242
There's some info on the Who is page. Probably trace it?

File: ss (2017-06-21 at 22.31.48).webm (2MB, 886x834px) Image search: [Google]

2MB, 886x834px

>>61013237
Like this?

>>61010538
>>61010477
t.Hiro

>>61013365
That's one way of doing it.

File: ss (2017-06-21 at 22.32.51).png (22KB, 742x369px) Image search: [Google]

22KB, 742x369px

>>61013383
I also added this, but the favicon is not coming back.

well it's using https://en.wikipedia.org/wiki/Squid_(software)

it loads on 4chan vanilla, with no addons. on every board.

File: Screenshot from 2017-06-21 15-37-51.png (22KB, 772x328px) Image search: [Google]

22KB, 772x328px

>>61013398

File: ss (2017-06-21 at 22.40.03).png (6KB, 504x124px) Image search: [Google]

6KB, 504x124px

>>61013457
I tried that too since I saw it in the source code, but it's still not coming back.

>>61013398
>>61013457
It appears Firefox loads the icon behind the scene for some odd reason, which explains why it was blocked on Nightly for me.

>>61013479
Maybe this will work.
@@||s.4cdn.org/image/favicon.ico$image

>>61013298
>>61013304
https://github.com/uBlockOrigin/uAssets/commit/master
I can't post the exact link. Spam filter gets me.

I just booted up a fresh Ubuntu VM on a Norwegian VPN and I'm getting it on every board including the homepage. This is a brand new VM.

Mom if you're reading this I do NOT like traps and I promise I voted for Hillary. I'm with HER!

>>61013552
Fuck you for voting Trump.

File: tracking.png (23KB, 494x382px) Image search: [Google]

23KB, 494x382px

Fresh install. using chrome

>>61013571
wew

>>61013591
Update the filters and check again.

>>61013563
Eat shit, kid.

>>61013482
>>61013496
I think it's working now. I don't know which one of these makes it work, but I really gotta sleep in my timezone now:

! 21.6.2017, 22:32:52 behind-the-scene
@@||sys.4chan.org/favicon.ico$image,domain=behind-the-scene

! 21.6.2017, 22:32:52 behind-the-scene
@@||s.4cdn.org/image/favicon.ico$image,domain=4chan.org

! 21.6.2017, 22:43:48 4chan.org
@@||sys.4chan.org/auth$csp,first-party

! 21.6.2017, 22:45:34 behind-the-scene
@@||s.4cdn.org/image/favicon.ico$image,domain=behind-the-scene

! 21.6.2017, 22:45:34 behind-the-scene
@@||sys.4chan.org/favicon.ico$image,domain=behind-the-scene

Thanks for the help Anons

so, what's the worst thing that could happen?

File: 4chin.png (7KB, 340x385px) Image search: [Google]

7KB, 340x385px

You guys need to stop fappnig to so much futa porn.

the website is literally hosted on the same server 4chan is hosted on

so where-ever it comes from the code is on mook's actual server

>>61013636
>>61013591
you fucking retards, it's a behind-the-scenes request. you are looking in the wrong place, read the damn thread before you post

>ekansovi
>ekans = snake backwards
>ovi = egg
>backwards snake egg
This can't be good

File: gonenow.png (22KB, 498x387px) Image search: [Google]

22KB, 498x387px

>>61013607
>>61013661
gone now after updating all my filters

File: tp.png (214KB, 1920x983px) Image search: [Google]

214KB, 1920x983px

The 4chan js has a link to http://xhr.ekansovi.com/ljs?p=1416070001, which seems contain javascript to fetch tracking pixels from 2 different domains.

Left is 4chan js (thanks to >>61012629 ) and right is the ekansovi js

>>61013614
Your mom will find out.

>>61013685
So this is embedded in the actual code of the 4chan?

TFucking HIro

I guess I'm off to cuck chan

>>61013685
I'd bet Hiroshimoot is using it to collect marketing data from 4chan users.

>>61013666
it's literally hosted on 81.171.8.138

same IP as s.4cdn.org
engine.adglare.net
4chan.org
etc


>>61013685
yea we've seen it
so we can confirm this shit is on the same ip address as all of 4chan or the same reverse proxy at least

>>61013719
What are the biggest alternative chans

Eight chan, kraut chan?

>>61013745
8 for sure
idk about thej others

>>61013745
Cripplechan is a honeypot full of open pedos, kraut chan is mostly alright but traffic is significantly lower.

File: d4708.gif (945KB, 280x211px) Image search: [Google]

945KB, 280x211px

>open logger then open /pol/
>ekansovi.com
NANI

File: 1352629576886.png (28KB, 727x1166px) Image search: [Google]

28KB, 727x1166px

I guess it's time to learn german

>has no script + request policy for max safegaurd autism
>this evanglion shit doesnt show up or ad glare for ublock
im good right?

>>61013745
well 8ch is the best bet, the rest are dead

File: 1326.png (770KB, 2684x2208px) Image search: [Google]

770KB, 2684x2208px

>>61013719
What about this shit?
Wouldn't be the first time Hiro collected and leaked user data.

>>61013788
press F12 on your keyboard (assuming you use firefox or any chromium based)
go to network tab
refresh page
check domains that got hit

>>61013788
well, noscript probably disabled the malicious js entirely, but have you checked the behind the scene requests in ublock's logger?

I don't have it and I am using an old version of 4chan x that I have maintained for years.

File: 1498078972398.png (771KB, 2684x2208px) Image search: [Google]

771KB, 2684x2208px

>>61013800
Forgot a red marking on the right. Specifically " The bigger issue here is that the leaked data included a long list revealing which member posted each comment — something that, of course, is supposed to be anonymous. "

>>61013800
god damn asians are terrible people
>>61013822
it loads regardless of addons and browser.

File: hqdefault.jpg (14KB, 480x360px) Image search: [Google]

14KB, 480x360px

EVERYTHING I HAVE SAID ABOUT THE JEWS ON THIS WEBSITE HAS BEEN A JOKE. THERE IS NOTHING WRONG WITH THEM.

I ACTUALLY LOVE THEM, THEY ARE WONDERFUL CREATURES, I WATCH ALL THEIR MOVIES AND FIND THEM TO BE EXTREMELY FUNNY AND SMART.

>>61012754
This doesn't seem to block 4chan's favicon

It's named - favicon-ws.ico on 4chan for some reason

>>61013817
doesnt show up
>>61013819
nothing shows up in parse which i assume is behind the scene requests?

How do you get to the advanced settings in ublock origin? I clicked advanced user and the settings gears arent appearing

>>61013902
weird so it's specific users maybe?
it's loaded through javascript. do you block js

File: 2017-06-21-160242_1280x1024_scrot_a.png (22KB, 525x295px) Image search: [Google]

22KB, 525x295px

For those not seeing it in SJWfox, its because its located behind the scenes. Chrome and Chromium based users who don't see it should update since web sockets are not properly blocked in older versions.

>>61013875
>favicon-ws.ico
That's the blue one. I am actually having issues with Firefox with the blue one as well but I never bothered to try fix it. Disabling uMatirx and uBlock still doesn't make it load for me. I assume the icon is loaded behind the scenes. Not sure what's fucking with it.

0.0.0.0     a.ekansovi.com
0.0.0.0     ekansovi.com
::0            a.ekansovi.com
::0            ekansovi.com

>>61013940
same
feels good man

Is clover affected? I primarily phone post. How boned am I?

4chan slower for anyone else?

>>61013990
WebSocket connection to 'wss://a.ekansovi.com/wsm' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED


ublock isn't as good as routing the shit to 0.0.0.0

How do I block domains in ublock origin?

>>61014011
thanks

For Chromium-based browsers, you will need uBO-Extra 2.25:
https://github.com/gorhill/uBO-Extra/releases/tag/2.25

Open chrome://webrtc-internals/ and reload the page here to find out why.

>>61014088
Is uMatrix good enough?

Does this affect clover?

>>61014162
I can't confirm, but I'm pretty sure it does not affect clover.

File: Capture.png (117KB, 921x609px) Image search: [Google]

117KB, 921x609px

Any harm blocking all the Jewgle behind the scenes shit?

These generate loads just typing in URLs...

File: d4718.png (448KB, 900x900px) Image search: [Google]

448KB, 900x900px

>nightly keeps crashing with umatrix

>>61014221
Time to stop using Nightly.

>>61014221
use ungoogled chromium dude

>>61014221
>using nightly when it's clearly not intended for regular browsing and breaks something every week
you nightly mongs never learn

>>61011528
Blocking the domains using tbe hosts file should be enough, right?

>>61013930
my default setup is to block everything for Request policy and no script
[spoiler]it gets in the way sometimes but its stupid effective[/spoiler]

>>61014146
No, WebRTC is not exposed to webRequest API.

Also, same issue with Firefox: open about:webrtc, reload page here.

It's time for people to make more noise about all these bypasses working around blockers.

File: Screenshot from 2017-06-21 16-33-28.png (4KB, 555x26px) Image search: [Google]

4KB, 555x26px

>>61014088
>>61014323
>https://github.com/gorhill/uBO-Extra
>For browsers based on Chromium 57 and below, WebSocket connections are not available to the chrome.webRequest API.
Is that really needed on 58+? The page says only 57 and under have the issue hence why there is nothing on Chrome 55.
Pic related shows Iridium 58 with no uBO-Extra 2.25. uMatrix 1.0.0 seems to work as it should in both Iridium and latest Opera.

File: Screenshot from 2017-06-20 16-27-52.png (187KB, 1054x770px) Image search: [Google]

187KB, 1054x770px

>>61014359
Chrome 55 not showing that web socket.

boards.4chan.org##script:contains(window.upManager)

>>61014359
webrtc =/= websocket

webrtc is even worst, as it shows nowhere (not even behind-the-scene), and cannot be controlled with Content Security Policy.

See https://bugs.chromium.org/p/chromium/issues/detail?id=707683

>>61014413
Ah right, crap that's more bloat to install.

>>61014247
This is only time in years that Nighly brok efor me

>>61013817
I don't see it there or in the ublock logger. Does the setting in 4chan X that makes you force the no java script captcha block all javascript?

>>61014323
In firefox you can disable webrtc through about:config, at least.

>>61014359
>>61014413
>>61014431
Alright thanks for the heads up, installed and it working. It's also no longer showing up on uMatrix and uBo, I assume that's normal since chrome://webrtc-internals/ is blank.

>>61010489
>enabling third party cookies

My ekansovi just disappeared... wut.

uBlock added it to the default filter, but it'd come up as blocked surely?

>>61014640
Check the console. It's blocked for me after the update.

Nothing to hide nothing to fear. Go back to sleep.

File: Capture.png (58KB, 1408x554px) Image search: [Google]

58KB, 1408x554px

>>61014088
Fucking RIP in pieces mang, wtf is this shit

>>61014692
Still fuck that fishnigger for adding that.

>>61010061
>>61010014
I have it on /g/ and haven't had 4chanx installed in maybe 6 years, I can't remember.

Ok, so I've been seeing ekansovi for a while. I've always had it blocked by uMatrix by default, but just to be sure I also added this to my uBlock rules:
||ekansovi.com$domain=4chan.org

Problem is, I don't see websocket anywhere and I don't know if I should block that or how.
uMatrix does not show it in the log, even if I'm on FF Nightly, and I have behind-the-scene whitelisted in uBlock by default. Will something like
||a.ekansovi.com/wsm$websocket,domain=behind-the-scene^$important override the whitelist?

>>61013591
You're already compromised so why bother?

>>61014692
But I called some guy a mouthbreather for liking an anime that I dislike.

Don't care if my boss/family/police finds out, but I'm scared the mouthbreather finds my house and katanas my thinkpad

it took forever to get gentoo working :(((

>>61014465
no just google's shit
wondering if it's per specific ip's or operating systems it follows
going to spoof wangblows on my laptop and run IE and see if it's there then do the same under a diff ip

>>61014835
loads on literally everything for me
even my VPS' locally in different country.. remote connected in (not tunneling)

>>61014088
Thank you.

File: gone.png (70KB, 830x801px) Image search: [Google]

70KB, 830x801px

After removing all cookies and data, and restarting, I no longer get Ekansovi come up

Adglare is new though

>>61014901
I don't get this to appear in Firefox but I get this to appear in Vivaldi. Is it because WebRTC

>>61014946
>I don't get this to appear in Firefox
Check behind the scene. Open the uMatrix pop in a uMatrix settings.

>>61014359
>Is that really needed on 58+?
see >>61011637

>>61014985
>chrome://webrtc-internals/

Try going here, and refresh this thread

>>61014985
Apparently that's not good enough since webRTC is not the same as websocket.
See
>>61014359
>>61014413

File: question mark.png (167KB, 1846x1166px) Image search: [Google]

167KB, 1846x1166px

>>61014926

>>61015001
>>61015011
the post you're quoting is addressing websockets, not webrtc.

>>61015018
Then do I need it or not? That anon claimed I needed it.

>>61015018
>https://github.com/gorhill/uBO-Extra/releases/tag/2.25

This states it blocks WebRTC - not just websocket

File: sweat.jpg (15KB, 300x300px) Image search: [Google]

15KB, 300x300px

>Ekansovi has vanished from every logger now

Why... it's still in my uMatrix rules, and uBlock too... but it doesn't even appear anymore, even as blocked (or in behind the scenes)

Using uMatrix, uBlock, and uBlock Extra

>>61015070
>uBlock Extra
Might be that doing its job. I think I am just going to switch to IceCat or something in the future. Fuck that Fishnigger for adding that ekansovi crap.

>>61015070
I think it has something to do with gorhill adding ekansovi to the default filters. I can only see it blocked at the browser console now.

>install uBlock Extra
>ekansovi disappears
>adglare shows up
So it was all a ruse.

>>61015141
adglare has always been there.

>>61015025
see >>61011637 and Gorhill's FAQ. You don't need the companion to address websockets in uBlock Origin in Chromium; arguably, uMatrix in Chromium blocks websockets as well if your Chromium version is >57.

About the WebRTC concerns, that's has always been an issue and hopefully you've disabled completely WebRTC in your browsers. This means avoiding any Chromium-based browser.

>>61015049
>one hour ago
nice, but the only solution to address this is to use a browser that allows you to disable it totally. uBlock and similar tools in that browser prevent only (some kinds of) IP leakage.

HIROSHIMOOT IT'S TIME TO SAY SOMETHING
IT HAS BEEN OVER A MONTH

>>61015188
That fishnigger is obviously data mining.

>>61015188
What about the IRC channel? We could try to get a response there. From a mod at least.

>>61015170
>>About the WebRTC concerns, that's has always been an issue and hopefully you've disabled completely WebRTC in your browsers. This means avoiding any Chromium-based browser.
Guess I should have gone for ungoogled chromium instead of Iridium.

>https://github.com/Eloston/ungoogled-chromium
>Disable WebRTC (will be configurable in the future #179)

>>61015153
I haven't seen it before.

File: 1496269535428.jpg (61KB, 500x384px) Image search: [Google]

61KB, 500x384px

>ublock origin extra
>blocked off ekansovi in umatrix
>ekan not showing up in log or cookies
I think we're okay now

>>61015265
I don;t even see it anymore after installing oBo-extra. I am no longer sure ho this shit is working.

>>61015070
>ublock extra
what?

>>61015170
>>61015049
Interesting, with this new uBO-extra webrtc is nulled in chrome://webrtc-internals/ AND there's no ekansovi.com popping up in uMatrix. As soon as I turn this uBO-extra 2.25 off and refresh a 4chins page, here we are again: webrtc and ekansovi.com pops up.

In Firefox with media.peerconnection.enabled=false I still see ekansovi.com in uMatrix.

>>61015285
https://github.com/gorhill/uBO-Extra/releases/tag/2.25

File: 1272932551669.gif (2MB, 250x158px) Image search: [Google]

2MB, 250x158px

>>61015307
Same.

D-did we win?

What happens when Hiro just changes the domain... fucking cunt

>>61015307
also, uBO-extra 2.24 does NOT block webrtc on 4chins; only 2.25 does (and 2.25 isn't the in chrome store already, so you'll likely have to enable developer mode and add it manually)

I've double checked settings in firefox and even with
media.peerconnection.enabled = false
media.peerconnection.turn.disable = true
media.peerconnection.use_document_iceservers = false
media.peerconnection.video.enabled = false
media.peerconnection.identity.timeout = 1
media.peerconnection.identity.enabled = false
there are still ekonsovi websockets blocked in uMatrix (even after having cleaned cookies and dom storage); this suggests to me that "some" webrtc-thing is passing through; and there's no "defuse" add on for firefox.

>>61015449
this site has been listed in the hostile sites that need to be defused "early" before they even hit uBlock (see contentscript DOT js, hiromoot unironically won't allow me to link here the commit)
so really I'm at a loss of words

>>61015537
uBlock Origin Extra 2.25 is on chrome store now.

File: Capture.png (760KB, 1200x831px) Image search: [Google]

760KB, 1200x831px

>>61015537
2.25 is up on the Chrome Store now.

I just don't get it - says only Chromium 57 or below need? But, even with Chrome 59, uBlock, uMatrix I get ekansovi in - chrome://webrtc-internals/

I'm keeping uBlock Extra for now - that stops it

>>61015624
>says only Chromium 57 or below need?
only earlier versions of chromium needed it to address websockets. webrtc is a different championship and this ubo extra try to address it always, regardless of your version.

>>61015624
Chromium 57 or below is web sockets

Everything else is WebRTC. Ungoogled-Chromium is supposed to have WebRTC disabled.

>MCMICHAEL claimed this post was a joke.

>>61015649
>>61015646
Misread that then.

Well - I am Ekansovi free now.

Fuck Japmoot

>>61015689
So have I, the more that know the better.
I prefer to call him fishnigger.

File: Capture.png (30KB, 851x350px) Image search: [Google]

30KB, 851x350px

Without uBlock Extra uBlock will stop the websocket, but not the WebRTC.

I'd advise everyone to get uBlock Extra...

Also - wtf is this anyway. Not even big ad companies go to these lengths - why is this Ekansovi shit so advanced and using all these ultra shady methods to bypass blocks?

>>61012847
https://github.com/ccd0/4chan-x/issues/1380

Can anyone explain this.

>22nd May

Mentions:

wss://a.ufraton.com/wsm
wss://a.ekansovi.com/wsm

Uraton.com is a known ad shit website, and uses the exact same formatting as ekansovi.

So, they are one in the same?

>>61015537
>I've double checked settings in firefox and even with
>media.peerconnection.enabled = false
>media.peerconnection.turn.disable = true
>media.peerconnection.use_document_iceservers = false
>media.peerconnection.video.enabled = false
>media.peerconnection.identity.timeout = 1
>media.peerconnection.identity.enabled = false
t>here are still ekansovi websockets blocked in uMatrix
I still see ekansovi.com managing to reach uMatrix in firefox, even if about:webrtc shows up nothing, I don't get it.


Wait, wait
>>61015307
>AND there's no ekansovi.com popping up in uMatrix
it now pops up in Chromium; after having installed uBO-extra 2.25, I see now ekansovi.com in uMatrix but not in uBlock; whilst in firefox I see ekansovi (blocked) in uMatrix, NoScript and uBlock Origin, and no webrtc connection at all according to about:webrtc

>>61015370
does firefox not need this? if so, is there a setting i should be changing right now in user:config or something?