Peeplink popups and how to block them

Discussion in 'Lounge' started by 4ger4ger, Nov 1, 2017.

  1. 4ger4ger

    4ger4ger Member

    Joined:
    Dec 5, 2016
    Messages:
    31
    Likes Received:
    15
    So I got fed up with peeplink once a fake windows virus popup came up and was persistent. I first started by blocking that domain. Then more popups started happening, so I decided to take a look at the web page's source. I found obfuscated javascript in there, so I went ahead and deobfuscated it to find the culprit domains of all the popups and potential malware. Here is a list of domains and/or IPs you can block to stop the madness. Use hosts file or adblock filters.

    Fake Windows virus popup:
    45.55.40.206

    Popup Ads:
    c1.popads.net
    c2.popads.net
    www.rfbrceyxthpj.bid
    www.lyovvtevsu.bid


    These can change at any time, to check you can open a Peeplink link in a private browsing or incognito mode window and right click -> view source. You'll find code like this:

    /*<![CDATA[/* */
    /* Privet darkv. Each domain is 2h fox dead */
    (function(){ var g=window;g["\u005f\x70\u006fp"]=[["\u0073\x69t\u0065\u0049\x64",1363633],["\u006d\u0069\x6e\u0042i\u0064",0],["\u0070\x6f\u0070\x75\u006e\u0064\u0065\u0072s\u0050erI\x50",0],["d\x65\x6c\u0061\x79B\x65\x74\x77\u0065\u0065n",600],["\u0064\x65f\u0061\x75lt",false],["\u0064\x65\u0066\x61u\x6c\u0074Pe\x72\u0044\u0061y",0],["top\u006d\u006fs\x74L\u0061\u0079e\x72",!1]];var m=["/\x2f\x631.\u0070\u006fp\x61\x64\x73.\x6e\u0065\u0074\u002f\x70\x6f\u0070\u002ejs","\x2f\x2f\x63\x32\u002e\x70\x6f\x70a\u0064s\x2e\x6e\x65t\u002fpo\x70\x2e\x6a\u0073","/\x2f\x77\x77\x77\x2er\u0066\x62\u0072\x63\x65yx\u0074h\x70\u006a.b\x69\x64/\u007az\u002e\x6a\x73","/\u002fw\u0077\u0077\u002e\x6cy\u006f\u0076\x76t\x65\x76\x73\u0075.\x62i\u0064\u002f\x72\u006dk\u0064\u002ejs",""],f=0,v,r=function(){if(""==m[f])return;v=g["d\u006f\x63um\x65nt"]["\x63\x72\u0065a\u0074\u0065\x45\x6c\u0065m\x65\x6et"]("\x73\u0063\x72\u0069p\x74");v["ty\x70\u0065"]="\u0074ex\u0074\u002f\x6aa\x76\x61\u0073cr\x69\u0070\x74";v["\x61s\x79\x6e\u0063"]=!0;var l=g["d\u006f\u0063\x75\u006de\u006e\u0074"]["\x67et\u0045l\x65men\u0074\u0073\x42y\u0054\u0061g\u004e\u0061m\u0065"]("\x73\u0063r\x69\x70\x74")[0];v["s\x72c"]=m[f];if(f<2){v["cro\x73\x73\u004f\x72\x69\x67i\u006e"]="an\x6f\u006e\x79\x6d\u006f\x75s";};v["\x6f\u006e\x65r\u0072o\u0072"]=function(){f++;r()};l["\u0070a\x72e\u006et\u004e\x6fd\u0065"]["\x69\x6e\x73\u0065\u0072\x74B\x65f\x6f\u0072\u0065"](v,l)};r()})();
    /*]]>/* */


    Now copy all of that and use http://jsnice.org/ to deobfuscate it.

    (function() {
    /** @type {Window} */
    var win = window;
    /** @type {Array} */
    win["_pop"] = [["siteId", 1363633], ["minBid", 0], ["popundersPerIP", 0], ["delayBetween", 600], ["default", false], ["defaultPerDay", 0], ["topmostLayer", false]];
    /** @type {Array} */
    var path = ["//c1.popads.net/pop.js", "//c2.popads.net/pop.js", "//www.rfbrceyxthpj.bid/zz.js", "//www.lyovvtevsu.bid/rmkd.js", ""];
    /** @type {number} */
    var i = 0;
    var script;
    /**
    * @return {undefined}
    */
    var loadScript = function() {
    if ("" == path) {
    return;
    }
    script = win["document"]["createElement"]("script");
    /** @type {string} */
    script["type"] = "text/javascript";
    /** @type {boolean} */
    script["async"] = true;
    var t = win["document"]["getElementsByTagName"]("script")[0];
    script["src"] = path;
    if (i < 2) {
    /** @type {string} */
    script["crossOrigin"] = "anonymous";
    }
    /**
    * @return {undefined}
    */
    script["onerror"] = function() {
    i++;
    loadScript();
    };
    t["parentNode"]["insertBefore"](script, t);
    };
    loadScript();
    })();


    You can find the domains to block by looking for any domains or .js files. I've bolded them above to make them easier to find.

    EDIT: It turns out they have a lot of spam domains, I'd just use noscript at this point. Or disable javascript on peeplink. It will give you a notification that the site won't work without javascript, but you can block that alert with uBlock Origin.
     
    Last edited: Nov 2, 2017
    • Like Like x 3
    • Winner Winner x 1
    • Useful Useful x 1
    • List
  2.  
  3. Army of Ninjas

    Army of Ninjas Rock Star

    Joined:
    Sep 24, 2013
    Messages:
    787
    Likes Received:
    446
    Location:
    A series of tubes
    The popups have been out of control lately.
     
  4. ontschoeit

    ontschoeit Kapellmeister

    Joined:
    Oct 10, 2017
    Messages:
    80
    Likes Received:
    44
    I don't care, I have a separate Windows just for the nasty stuff. Worst case for me were message boxes in a FF instance which are full up front and FF could not be stopped the normal way. Taskmanager. If it returned after start FF, I deleted %appdata%\..FF.. happened once...
    More annoying are the fake Google winning ads on Android.
     
  5. twoheart

    twoheart Audiosexual

    Joined:
    Nov 21, 2015
    Messages:
    2,008
    Likes Received:
    1,223
    Location:
    Share many
    Just login to peeplink with fake data and popups are gone.
     
    • Agree Agree x 2
    • Like Like x 1
    • Useful Useful x 1
    • List
  6. westfinch

    westfinch Platinum Record

    Joined:
    Jun 25, 2013
    Messages:
    297
    Likes Received:
    175
    Exactly what Saint told me to do. No problem since.
     
  7. Yuri

    Yuri Rock Star

    Joined:
    Apr 14, 2014
    Messages:
    482
    Likes Received:
    376
    Yup, no need for all that faff, just login.
     
  8. PM

    PM Member

    Joined:
    Apr 7, 2017
    Messages:
    19
    Likes Received:
    9
    Peeplink login doesn't work anymore.... It says error password incorrect...
    I am certain that I use the correct password...

    I made new account, was logged in but after logout same problem... Already registered or wrong password message...

    Others same problem?
     
  9. CrankHank

    CrankHank Member

    Joined:
    Jun 4, 2020
    Messages:
    20
    Likes Received:
    7
    I got rid of that crap with ADGUARD (you’ll find it at SANET for instance). Solves same issues on other sites too.
     
  10. Arabian_jesus

    Arabian_jesus Audiosexual

    Joined:
    Jul 2, 2019
    Messages:
    942
    Likes Received:
    735
    I use uBlock Origin, NoScript, Privacy Settings and Miner Block in Chrome and I never have any problem!
     
  11. WizzDome71

    WizzDome71 Producer

    Joined:
    Apr 23, 2020
    Messages:
    217
    Likes Received:
    139
    I confirm AdGuard extension for Chrome or Firefox works really good. No need to get into more complicated stuff. Install in 5s and that's it ^^
     
  12. Epidemico

    Epidemico Producer

    Joined:
    Apr 10, 2017
    Messages:
    125
    Likes Received:
    80
    Location:
    Alano di Piave (BL), Italy
    Personally i find uBlock origin the best and most effective one, it's so effective that i have to disable it on some sites to be able to see some media content here and there.
     
    • Agree Agree x 2
    • Winner Winner x 1
    • Useful Useful x 1
    • List
  13. twoheart

    twoheart Audiosexual

    Joined:
    Nov 21, 2015
    Messages:
    2,008
    Likes Received:
    1,223
    Location:
    Share many
    I would suspect that the given browser can't save cookies anymore. May it be due to settings in the browser or other software on the machine that suppresses saving cookies. Try to set the acceptance of cookies not so strict.
     
  14. Gyro Gearloose

    Gyro Gearloose Audiosexual

    Joined:
    Jul 8, 2019
    Messages:
    4,237
    Likes Received:
    1,846
    Location:
    Germany
    ublock origin and someone who cares hosts

    the ultimate duo

    no adds pop ups never , anywhere

    clean www

    [​IMG]
    no script is nerving..i dont need it anyway
     
    Last edited: Jun 11, 2020
  15. Gyro Gearloose

    Gyro Gearloose Audiosexual

    Joined:
    Jul 8, 2019
    Messages:
    4,237
    Likes Received:
    1,846
    Location:
    Germany
    oh..i forgot ghostery anti tracker..ultimate trinity
    --
    e.g ...so funny to read comment like i got no adds anymore i did buy youtube premium eh eh
    peeplinks are completly clean at my site...only some stream hosters have sort of hardcoded pop ups lately but its not so bad pop ups cause they go away after clicking to full screen
     
    Last edited: Jun 11, 2020
  16. Gyro Gearloose

    Gyro Gearloose Audiosexual

    Joined:
    Jul 8, 2019
    Messages:
    4,237
    Likes Received:
    1,846
    Location:
    Germany
  17. Jaloegisch

    Jaloegisch Newbie

    Joined:
    Feb 16, 2021
    Messages:
    7
    Likes Received:
    2
    simpler solution: click on the lock in chrome left to the url of peeplinks, then go to site settings and there you block javascript. This worked for me perfectly fine!
     
Loading...
Similar Threads - Peeplink popups block Forum Date
When I click a link in Peeplink on the sister site... popups? Is this new? Anyone else? Forum News and Updates Nov 2, 2023
What Does This Mean?? - AudioZ / Peeplink Dotted Arrow Forum News and Updates Jun 2, 2023
Peeplink problems Internet for Musician Jan 13, 2023
Peeplink/Jdownloader Asking for Captcha Internet for Musician Nov 17, 2021
Peeplink URLs are oddly repeated with certain older posts Forum News and Updates Nov 5, 2021
Loading...