blocklistproject
[Add request] - porn ads
URL you wish to be added:
cnzz.yifenghuyu.com
wy6r8d.qejzyy.cn
flro0c.tianhongbanjia.cn
rq8otf.sinochemfuheng.cn
q784l0.momentchina.cn
Edit: Found on the same site
itmo8x.zmdwx.com.cn
p7vdqa.mayuetong.cn
c.tkkdoc.com
xxl.hushenqiquan.com
Edit2:
lwrao.qycg.wang
xuwqs.sxtc.wang
Edit3:
tqqvm.haedo.biz
cdnbaidu.cjfexmf.cn
doc.hbears.com
Why you believe this should be added:
They serve porn ads.
Add to list:
Ads, maybe also on porn
Other info you think we should know:
Samples
https://flro0c.tianhongbanjia.cn/MTcxOQ1719171910171634473793gif
https://wy6r8d.qejzyy.cn/MTcxOQ17191719/1214/1639494706.gif
https://cnzz.yifenghuyu.com/gdsgshehdf/1379.gif
https://q784l0.momentchina.cn/MTcyOQ17291729/1017/1634473670.gif
https://rq8otf.sinochemfuheng.cn/MTcyOQ17291729/0402/1585822405.gif
Edit:
https://itmo8x.zmdwx.com.cn/MTgwMQ18011801/1214/1639494671.gif
Edit3:
https://cdnbaidu.cjfexmf.cn/material/0003/1/0003_1_1631262793.gif
https://tqqvm.haedo.biz/adsbix_32847_2_balixjs?74328941646130510342
https://doc.hbears.com/ts_as.html?as=10073-20156-20
Found on https://m.wanben.org/16578/11366518.html (urlscan) which serves novels in Chinese. It uses javascript to load the ads. It may open a new tab/redirect you to a porn site. If you use a PC to access then you won't see anything. The script https://www.kanshuzhushou.com/cdn/js/zepto.min.js seems to determine if you are on android service and set control flag isAndroid, which determine load or not load the ads. You have to use remote debugging to inspect them.
Edit: I found the JS that seems to load the ads. I am not sure because they are obfuscated, but none of the ads load after blocking the following domains hosting the JS. I suspect the JS decode the obfuscated text, make a request to the domains and load them. Blocking the script seems to help.
https://c.tkkdoc.com:10360/static/lbsite/3494553b1a0c/ca46b5a2.js?v=1645870337208
https://xxl.hushenqiquan.com/z-2700-5-4017241?123
Edit2: These two domains host JS that handle clicking on the ad. They use a div with an image background to avoid being detected by adblockers. So they added yet another JS to handle clicks on the div. Even if the ad is blocked and you clicked on where the ad is supposed to be, it still redirects you to the porn page. Blocking these can prevent the placeholder from loading.
https://xuwqs.sxtc.wang/hmzn_32847_2_min.js?74328941645878528720
https://lwrao.qycg.wang/hmzn_2095_1_min.js?893291645878528738
Edit3: these hosts the javascript again
tqqvm.haedo.biz
doc.hbears.com
and this hosts the actual image
cdnbaidu.cjfexmf.cn
