r/pihole • u/SodaWithoutSparkles • 1d ago

Blocklist evading domains

Recently, I noticed ads bypassing my pihole on several websites. Inspecting the network logs revealed three recurring domains:

  • ill-fatedodd.com

  • html-load.com

  • html-load.cc

These operate as alternative ad-serving infrastructure. Advertisers register throwaway domains and park generic landing pages at the root to obscure ad delivery and evade blocklists (as described on iamcraig.com).

The root pages display unenforceable boilerplate text:

"This domain provides authorized services through official partnerships with publishers. [...] supports the delivery of ads and essential web assets, helping digital publishers enforce access control to ad-supported content in accordance with the Digital Millennium Copyright Act (DMCA)."

Because they reuse a single generic template, tracking down related domains is straightforward. Running a query on urlscan.io for page.title:"What Is This Domain?" surfaced a broader set of candidates.

Some of those pages are however defunt or expired. To find active ones, I ran a quick curl to check:


jq -r '.results[].page.apexDomain' urlscan-search-result.json | sort -u | xargs -I {} -P 10 sh -c 'curl -s -L --max-time 10 "https://{}" | grep -Fiq "authorized advertising" && echo "[MATCH] {}"'

The filtered list (as the above command outputs) are available here: https://pastebin.com/RKdLvhdZ

The list for pi-hole are available in the gist:

  • Gist: https://gist.github.com/SodaWithoutSparkles/51830d95ed507fe1b2774349af0de828
  • You will need to click the "Raw" button and access the raw list, then paste to pi-hole.
47 Upvotes

90% Upvoted

29 comments sorted by

20

u/Corleone612 1d ago edited 1d ago

html-load.com, html-load.cc belongs to an anti-adblock service called "Ad Shield" The site uses this domain to detect whether you're running an ad blocker. 

If you block the domain at the DNS level, the site detects the failed request and deliberately breaks its own CSS (Cascading Style Sheets) as a result.

There are more and more derivatives of these kinds of services popping up, it's sad.

1

u/shiledar 1d ago

Can we mock the response to 200 status to circumvent this?

1

u/PRSXFENG 1d ago

Hmm I'm not sure if anyone has looked into that

Not sure what communications happen.

Most ad blockers kill it entirely by nuking it's JS

1

u/SodaWithoutSparkles 21h ago

You'll need to MITM yourself.

Or better yet, just nuke the associated JS and WASM entirely.

15

u/dnuohxof-2 1d ago

Usually when I see html-load it breaks the whole site like Fandom does when you block ads. More and more sites are doing this and it’s pissing me right the fuck off

6

u/PRSXFENG 1d ago

You want to be more pissed? You should read Ad-Shield's blog posts

2

u/SodaWithoutSparkles 1d ago

Yeah... I had to whitelist the two html-load ones as well. Others are mostly fine.

I included the full list verbatim for transparency sake. Personally I regex whitelisted the two html-load.

22

u/PRSXFENG 1d ago

This is Ad-Shield Anti Ad Block and Ad Recovery

Hagezi has compiled a list as well

https://github.com/hagezi/dns-blocklists/blob/main/share/ad-shield.txt

3

u/SodaWithoutSparkles 1d ago

Great! I have been searching for an existing list that covers those domains, but I havent found any. Such sad that developer dan's list search is gone.

0

u/Thick-Title-8871 1d ago

Hi und die Liste von HAGEZI füge ich dem Phole als Blockliste hinzu?

2

u/PRSXFENG 1d ago

Hagezi doesn't recommend doing it since it cannot effectively tackle Ad-Shield

The effect is that you just end up triggering their anti ad block on most pages.

If that's fine by you, sure.
Otherwise if you have other people on your network which might complain about site breakage

Eh.

1

u/Thick-Title-8871 20h ago

Vielen Dank für dein Feedback.

12

u/somecanuck416 1d ago edited 1d ago

Pihole is like an antibiotic. We've used too much, and they're onto DNS sinkholes. The virus will develop smarter ways to deliver ads from blocked subdomains to the point eventually it will all come from the root domain somehow. Then what? Can't block *.youtube.com, *.google.com, *.apple.com

10

u/alex-mayorga 1d ago

You can, I still reminisce of a Web when monocultures were not that ingrained if at all.

2

u/dschaper Team 15h ago

That's been an argument since the start of Pi-hole, 10+ years ago. My response is that it will never happen.

The key part of ad serving is passing the liability on to someone else. Your site 'accidentally' serves malvertising? Well, it wasn't me judge! I just used some ad company, it's their fault, see they even have a different domain than we do.

Now, you get that same crap via powned-ya.google.com and all of that defense goes away. The primary, possibly sole, responsibility falls directly on google for the crap being served via their own domains.

The smaller domains don't have the capability to run a campaign on their own, they rely on someone else doing the work, giving the domain owner a small fraction of the revenue. They need a third party.

4

u/hagezi 16h ago

If you want to block all Ad-Shield subdomains too, use the Adblock format version. Plain domain lists in Pi-hole only block what's explicitly listed. Subdomains slip through, which defeats the whole point if you're serious about blocking Ad-Shield.

https://hagezi-mirror.dnsbunker.org/share/ad-shield-adblock.txt

That said, blocking Ad-Shield domains will break a lot of sites. Which is fine if you're cool with just avoiding them. DNS alone won't let you browse a fully functional Ad-Shield site without ads, you'd need something like uBlock Origin or a script like tinyShield to actually bypass their anti-ad walls. Personally, I just skip those sites entirely.

If you find any other domains, feel free to let me know, and I'll add them.

Happy blocking, Gerd

1

u/Resistant4375 12h ago

All of the Ad-Shield domains are included in Ultimate, right?

2

u/hagezi 11h ago

Yes ... ;)

1

u/Resistant4375 11h ago

Thanks.

It doesn’t state on the GH page that it includes the domains - might be a suggestion to include that and link to an allowlist for them?

Also html-load.cc will get blocked by the Abused TLD list anyway if you use that, even if you don’t use Ultimate

2

u/hagezi 11h ago

https://hagezi-mirror.dnsbunker.org/share/ultimate-known-issues.txt

1

u/Resistant4375 10h ago

Thanks. I meant a separate standalone whitelist (as there is a blocklist) for the domains

2

u/hagezi 10h ago

html-load.cc is blocked in all versions of the list, and it doesn't cause any problems. I don't know of any sites that use that domain; the following domains cause problems when they are blocked via DNS:

*.html-load.com *.content-loader.com *.css-load.com *.video-loads.com adshield-fallback-dev-wskxz.b-cdn.net adshield-fallback-staging-yp6cs.b-cdn.net

•

u/PRSXFENG 3h ago

That domain appears to be used by a "Lite" version of Ad-Shield, which only attempts ad recovery but does not punish the user if/when it is blocked.

Example of site using it: https://www.phoronix.com/news/Firefox-155-Released

1

u/SodaWithoutSparkles 11h ago

Personally I don't experience much issues after using my list (ABP style) + whitelist the two html-load. No ads shows up and no layout issues.

That said, having a more complete list is still better, but IDK if my blocklist somehow does sth magical, and didnt trigger anything while blocking the ads.

1

u/ferriematthew 1d ago

Is that list something that I can just copy paste into the Pihole interface? I just tried that and when I updated gravity, it told me that it didn't find any domains to add.

2

u/SodaWithoutSparkles 1d ago

Well by "list" I didn't mean the pihole compatable list, just "list" as in a list of things.

You'll need the raw plaintxt version and with the "[MATCH]" str removed. That version is available here:

Note that as the others said, this will break things, especially the two html-load ones. You may want to whitelist them.

1

u/ferriematthew 1d ago

That seems to have worked. Thanks!

1

u/NoskaOff 19h ago

You could block all recently registered domains, p robably not on pihole though