Nordic Filters report centre (Nordiske filtre rapportsentral)

[DandelionSprout]

Spun off from #779 for convenience and to hopefully make things tidier.

General guidelines:

• A report post can be for multiple sites, but it is strongly recommended that further sites be handled as separate posts instead of as "EDIT" sections.
• English is recommended, but I also allow Bokmål, Nynorsk, Danish, and Swedish, and I will do my very best to reply back in those languages in such cases (Finnish is strongly discouraged, as my Finnish vocabulary is less than 30 words, almost all of them food-related).
• If I struggle hard to reproduce something, or there's substantial concerns about the test environment, it may be requested to move a report to https://github.com/DandelionSprout/adfilt/issues

Additional rules added later on:
• 11th of July 2024: If a hidden, secret, private or offline source for entries is hinted to, talked about or linked to, you agree to that I/we will have dirt on you. Publicly available sources are not affected by this.

[THEtomaso]

Issue:

Empty ad container @ bt.no.

Example:

https://bt.no/i/jl5e09/
(scroll down and locate the grey container that goes horizontally, straight across the screen)

Possible fix:

bt.no##div[id^="blink-ad-"]:upward(1)

Note:

There's also a paywall that prevents you from loading the article more than a few times.
Don't know if anything can be done to counteract it.

[DandelionSprout]

Seems to be article-dependent, with some being instantly behind paywalls, and some apparently being unlimited. Looking through https://www.bt.no/nyheter/okonomi/i/WRPG6k/slik-holdt-erna-solbergs-naermeste-brev-dokumenter-og-mannens-navn-unna-offentligheten, I found the banner in question, and will hopefully get it fixed within 10min.

[DandelionSprout]

0f8a160 🌞

[THEtomaso]

There are more of the same sort now..

Example:
https://bt.no/i/l3Paae/

Possible fix:
bt.no##[class^="advertory-"]

[DandelionSprout]

571d510 🌞

[THEtomaso]

There are screenshots of a couple of scam links here:
https://elbil24.no/79400373/

Of course, at the point where such domains are commonly known, they're most likely abandoned already.
Nevertheless..
||easypark-id.com^$all
||easypark-no.org^$all

[DandelionSprout]

The domains seem to be hosted on 74.119.239.234 and 162.241.194.206 respectively, which would've lended it well to mass-blocking if not for how the 2 addresses have more than 15,000 domains combined. This will take a while to look into.

[iam-py-test]

easypark-no.org looks dead.

[THEtomaso]

Guess this sort of solution is a tad harsh?:
||easypark*.*^$document,domain=~easypark.com|~easypark.net|~easyparkgroup.com|~easyparkpartners.com|~easyparksystem.net

[DandelionSprout]

I've seen worse ideas over the years, but I'd probably go for ||easypark-$document or something. The dash seems to make all the difference in my eyes.

[DandelionSprout]

799d1a7 🌞

[THEtomaso]

There are large, empty placeholders @ vg.no now.
vg.no##[id^="finn-banner"] takes care of them!

--

EDIT:
@iam-py-test:
This issue should probably be prioritized (considering that vg.no is the most used site in Norway), and DS seems to be AWOL, at the moment.

[DandelionSprout]

571d510 🌞

[THEtomaso]

Issue:

The betting banner @ vglive.vg.no is back again!

Example:

https://vglive.vg.no/kamp/kristiansund-vålerenga/632530/rapport/

Screenshot:

Possible fix:

vg.no##.norsk-tipping-widget

..or perhaps even something like this?:

||dnbrci3nrwpcs.cloudfront.net^$domain=~norsk-tipping.no

[DandelionSprout]

I'll take a further look later this week. If I still can't find it by then, I'll add at least 1 of those 2 entries anyway.

[THEtomaso]

Yeah, you'll have to click on an ongoing match, of course.

##.norsk-tipping-widget contained an iframe from dnbrci3nrwpcs.cloudfront.net, which belongs to Norsk Tipping.
You can actually visit that domain, and you'll see that it's branded with their logo.

[DandelionSprout]

8b13aaf 🌞

(I'm not 100% comfortable blocking Cloudfront subdomains unless they're known for malware, but I won't rule it out in the future.)

[THEtomaso]

Issue:

Large, empty ad boxes @ dn.no.

Example:

https://dn.no/2-1-1567004/

Possible fix:

dn.no##.top-ad-placeholder

--

EDIT:

Also, a new deblurrer is needed for Plus articles.

Example:
https://dn.no/2-1-1566721/

Fix:
dn.no##.shadow::before

[DandelionSprout]

I can't seem to find the placeholders at the moment; dn.no##[id^=dn_toppbanner] in Nordic Filters is supposed to fix them already.

dn.no##.shadow::before sadly didn't work, but dn.no##div[style*=linear-gradient] seems to work.

[DandelionSprout]

b3ca366 🌞

[THEtomaso]

dn.no##.shadow::before sadly didn't work, but dn.no##div[style*=linear-gradient] seems to work.

Confimed.
They've already changed it!

[THEtomaso]

Issue:

Ads @ nettavisen.no.

Screenshots:

Possible fix:

nettavisen.no##.commercial

--

EDIT1:

Also, their front page contains an annoying job advertisement carousel (about half way down).

Don't know if you'd want to get rid of it, but here's a possible fix, anyway:
nettavisen.no#?#amedia-resizable-iframe:-abp-has([src*="/stillingskarusell/"])

--

EDIT2:

There's another one of those job carousels @ https://borsen.dagbladet.no/

It's easely removed with dagbladet.no##.borsen-job-carousel

@DandelionSprout:
Let me know your current policy regaring those things.

[DandelionSprout]

The Eurojackpot and Shoppingtips banners are definitely going down. I'll analyse the rest.

[DandelionSprout]

Job carousels are allowed to stay, however.
———————————
571d510 🌞

[THEtomaso]

OK

[THEtomaso]

571d510

That doesn't take care of them all.
If you're gonna do it the hard way, like that, you currently need to include a[href^="/sportspill/"] as well, and whatever else they might come up with next.

[DandelionSprout]

It has been the case for years now that newssites mix in at least some sort of football news in football betting pool adticles, so they're not only only to block. Exceptions are if the articles contain no relevant news or analysis whatsoever, which has happened twice in 4½ years.

I took care of ones in another report that simply redirected directly to Norsk Tipping, at least.

[THEtomaso]

Issue:

The Nordic filter's stylesheet rules for aID overlays seems to be failing @ ba.no.

Example:

https://www.ba.no/vis/trafikk/

Screenshot:

Possible fix:

Simply ###aid-overlay ??

[DandelionSprout]

I honestly didn't expect 5 reports in the span of 2 days, as I was mostly busy trying to cure a rash with various gels in that time. 😅 I'll see which ones I can look through tonight.

[THEtomaso]

Don't forget this one:
#932 (reply in thread)
:)

[DandelionSprout]

b3ca366 🌞

[THEtomaso]

Issue:

Ads masquerading as articles @ https://www.elbil24.no/

Screenshot:

Possible fix:

elbil24.no#?#article:-abp-has(.kicker:-abp-contains(Annonse:))

[DandelionSprout]

571d510 🌞

[THEtomaso]

Issue 1:

• Large, empty containers @ https://www.an.no/, https://www.ifinnmark.no/, https://www.nord24.no/, etc.
  (scroll down a little bit)

• Large betting banner (disguised as an article) @ https://www.h-avis.no/
  (scroll down a little bit)

Possible fix:

Something generic perhaps, like this?
no#?#optimus-element:-abp-has([itemtype*="adplogger.no"])

--

Issue 2:

There's a similar large, empty container @ https://www.firda.no/
(scroll down a little bit)

Possible fix:

I would assume that other Amedia sites features the same thing, so perhaps this also qualifies for a generic fix, like this?:
no#?#amedia-resizable-iframe:-abp-has([src*="ad.amediakreativ.no"])
EDIT: Scratch that..
Unlike the first issue, I weren't able to locate this container anywhere else, so a site-specific fix, like this one, should be sufficient (I hope):
firda.no#?#amedia-resizable-iframe:-abp-has([src*="ad.amediakreativ.no"])

[THEtomaso]

(...)#?#optimus-element:-abp-has([itemtype*="adplogger.no"]) doesn't seem viable for at least ifinnmark.no, where it'd block a web series and the "Siste nytt" feed.

Those "Siste nytt" widgets are nothing but useless annoyances in my book.
Everything that are mentioned in them are displayed directly below!

Don't know which "web series" you're refering to (perhaps you could point it out for me?), but I've had this network rule in my filter list since forever, and I can't say that I've missed anything because of it:
||adplogger.no^

--

I can't find any actual placeholders that such an entry would've fixed either.

In the case of ifinnmark.no, it's an empty container which supposedly seems to hold a realestate carousel (which you're already blocking at ba.no, and on a generic third party level from finn.no).

--

PS:
Don't forget about these ones:
#932 (reply in thread)
#932 (reply in thread)

[DandelionSprout]

I at least think this is a webseries?

[THEtomaso]

OK, I see that I'm also blocking it with ##.optimus-complex-front, so I might have to look into this.
But for me personally, my first thought is that the pros of having those rules far outweighs the cons!

[THEtomaso]

At least, changing these rules..

ifinnmark.no##.optimus-complex-front
ifinnmark.no#?#optimus-element:-abp-has([itemtype*="adplogger.no"])

..into these

ifinnmark.no##.optimus-complex-front:not(h2:has-text(BaDesKen TV))
ifinnmark.no#?#optimus-element:-abp-has([itemtype*="adplogger.no"]):not(h2:has-text(BaDesKen TV))

..fixes the issue at ifinnmark.no.

But of course, that thing is subject to change, so the rules are not suited for your Nordic list.

[DandelionSprout]

At that point of narrowing, I admit things get a bit complicated. 😅 At that point I presume it's more convenient for me to just go through one row at a time if further ads occur.

[THEtomaso]

Issue:

Large ads @ digi.no
(one at the top, and one a bit further down)

Possible fix:

digi.no#?#.flex:-abp-has([id^="brandBoard"])
plus
digi.no##.max-w-screen-lg:style(padding-top: 12px !important;) (to uncramp the area below the site header).

[DandelionSprout]

These seem to work better than expected:

digi.no##.items-center.mx-auto
digi.no#?#div[id^=row-]:has(.preamble-shadow)

It also worked far better than expected (as of 25min of testing) to use CRC 5-56 almost everywhere on my mouse to fix the left button. If the improvement sticks around, then I honestly cannot believe it worked that well.

[DandelionSprout]

8b13aaf 🌞

[THEtomaso]

These seem to work better than expected

Still needs an uncramping rule though.

It also worked far better than expected (as of 25min of testing) to use CRC 5-56 almost everywhere on my mouse to fix the left button.

That must be one of the few things that I've actually never used it for. 😄

[THEtomaso]

Issue:

There's a bunch of ads, empty containers and various annoyances @ viralomania.com.
I've added some rules for it to my own filter (which you know where to find), but you'd probably want to go through it yourself.
Personally, I think it almost qualifies for ||viralomania.com^$doc.

[iam-py-test]

Off topic, but found an interesting tracking parameter on that site: 99ce77a
Thanks

[THEtomaso]

found an interesting tracking parameter on that site

I don't see it, so it must be loaded through some other third party crap, which I'm already blocking, perhaps.

[DandelionSprout]

8b13aaf 🌞

(I pondered on blocking the bottom-most bar as part of the "Empty padding" category too, but skipped it for now.)

[iam-py-test]

I don't see it, so it must be loaded through some other third party crap, which I'm already blocking, perhaps.

It was on a subresource, so debatable if it was worth blocking. Just contained the current URL, which could already be obtained though simpler means.

[DandelionSprout]

If anyone wonders, I have become aware of https://www.tv2.no/nyheter/innenriks/advarer-om-svindel-sms-sender-aldri-slike-henvendelser/16284207/, but various problems means it may take 48hrs before I can take care of that or the above reports.

[DandelionSprout]

8b13aaf 🌞

[THEtomaso]

Issue:

Another empty placeholder @ nettavisen.no.

Screenshot:

Possible fix:

nettavisen.no#?#optimus-element:-abp-has([itemtype*="/AdvertiserContentArticle"])

[DandelionSprout]

Though I couldn't find placeholders as such, the fix matches 2 adticles that I'll process.

[DandelionSprout]

ef5e506

[THEtomaso]

Off topic, but found an interesting tracking parameter on that site

Speaking of tracking, it seems that m$ have been stepping up their game at GitHub..
I now have to verify my device every single time that I log in! :(

--

EDIT:
Looks like they've reverted that behaviour now.

[THEtomaso]

Rules for some false Norwegian news sites:

||betzykrisesenter.no^$doc
||citra2010oslo.no^$doc
||digiter.no^$doc
||easydisplay.no^$doc
||kjaerra.no^$doc
||kontrast1.no^$doc
||norskmatkultur.no^$doc
||norskoffroadteknikk.no^$doc
||nyematoghelse.no^$doc
||securmarksykkel.no^$doc
||thecoolgirl.no^$doc
||topshineauto.no^$doc
||vossblues.no^$doc
||yttersiden.no^$doc

Source:
https://nettavisen.no/5-95-1523299/

[iam-py-test]

Thank you for reporting this. I have fixed it in 43301bf and 1176a09.

[DandelionSprout]

While somehow being less awake today than usual, I did some slow and peaceful(?) research and found that most or all of those domains are on 162.214.80.109 and 162.214.80.140. (A few are on Namecheap and can be presumed to be dead.) I was also eventually able to prove that the top domains for either of them were dubious at best too, e.g. technofunk.com.

Both IPs are listed with "10,000+" domains each, so we'd be talking in the area of 7 hours if I were to add all of those domains to Anti-Malware List.

[DDA78]

our company domain naturescrest.com is blocked due to above rule in your list, can you please check and remove, below is the specific line in your list that's causing the issue, ours is legitimate website.

://162.214.80.
! #932 (comment)

[DandelionSprout]

I had an E-mail notification for it earlier yesterday. I was able to check that the IP range covered far too many domains (similar to Cloudflare's IP addresses) to warrant a block after all, so indeed the domain (naturescrestCOM) should no longer be affected by it as of today (Sunday).

[THEtomaso]

Issue:

gamer.no needs to be cleaned up again (front page and articles).

Suggestions:

gamer.no##[data-uname^="gamer_netboard"]
gamer.no##[data-uname="gamer_artikkelboard"]
gamer.no##[data-uname="gamer_toppbanner"]:upward(1)
gamer.no#?#.deal-container:-abp-has(a[href*="prisjakt.no"])
gamer.no#?#.entrance:-abp-has(a[href*="/annonser/"])
gamer.no#?#.entrance:-abp-has(a[href*="/stilling/"])

(Perhaps even more rules, if I've bothered to disable my own filter)

[DandelionSprout]

I'll handle that site sometime early this week, although not tonight (Sunday).

[DandelionSprout]

5 of the 6 entries work very well, I'll gladly admit ( (...)netboard(...) being the only one I couldn't seem to find matches for).

Some I slightly changed to more or less reduce chances for false positives, but your suggestions were pretty good. 679cc7e

[THEtomaso]

Issue:

There's an ad in all articles @ rett24.no.

Possible fix:

rett24.no##[class*="_job-ad-article"]

[DandelionSprout]

Checking https://rett24.no/articles/e18-naboene-i-baerum-tapte-kampen-om-millionerstatninger-for-utbyggingsbraket, it would unfortunately be unfair to block ads for job listings when they too are hosted on rett24.no. I myself know all about how difficult it is to get a job within Norway, or even to be called in for an interview at all.

Screenshot of the page:

[THEtomaso]

In case you missed it, there's a "Ledige stillinger" button in the page header, which takes you to all of the job listings.
Those in-article containers should be considered ad clutter, imo.
I think the fact that they're labed with "Annonse" / "Ad", shows that the webmasters themselves sees it that way too! :)

[THEtomaso]

Issue:

Labeled ad containers @ https://www.elbil24.no/video/, https://www.kk.no/video/ and https://www.seher.no/video/.

Possible fix:

- dagbladet.no,sol.no##.adunit:upward(1)

+ dagbladet.no,elbil24.no,kk.no,seher.no,sol.no##.adunit:upward(1)

[DandelionSprout]

I can confirm the entry works on individual videos' pages, and I also found a second entry for KK's video menu (kk.no##.carousel-container + div:not(.carousel-container):has(> div:last-child)).

[THEtomaso]

What does that rule actually do?
If there are ads in that carousel, I can't seem to locate them.

Anyway, its complete lack of a scrollbar makes it one of the worst video carousels that I've ever seen!
Simply removing it with kk.no##.carousel-container:has-text(Anbefalte videoer) seems like the best course of action.

[DandelionSprout]

It was for this one:

Screenshot:

[THEtomaso]

AFAICT, it's covered by the other rule, so I don't see the need for it.

[THEtomaso]

Just mentioning this one, since it definitely qualifies as an annoyance, in my book:
https://vg.no/i/zA89gw/:
vg.no##[class*="_vglab_box_"]

[THEtomaso]

@DandelionSprout:
An article about a rather dubious site:
https://nettavisen.no/5-95-2045247/

[DandelionSprout]

I was only able to take a full look at the site tonight, and since there's no signs of their "store" re-opening in the near future, I suppose the situation pretty much fixed itself.

[iam-py-test]

I found a Norwegian fake dating website: paradismatch.com.
I can't read Norwegian so can't investigate much, but most of the users' profile pictures are copied from porn sites.
Imre, I can share more information if needed.

[DandelionSprout]

From gradually looking through and thinking on various involved clues, there seems to be 30 sites involved in that fraud:

bigonyou.com
chattrummet.com
datingcashexperts.com
dejtingpalatset.com
dejtingrummet.com
dinnyevenn.com
ensamkontakt.com
finnenelsker.com
flingtalk.com
flirtseason.com
hemlighetsportalen.com
katesingler.com
lekendating.com
leklust.com
meetupz.app
myfuckfriends.com
mynextcrush.com
noenlikerdeg.com
norskchathub.com
noticetick.com
paradismatch.com
romancestarter.com
seksuelllyst.com
singelflirten.com
singelkontakt.com
singelogklar.com
singelplatsen.com
talknotice.com
treffraskt.com
vennlighallo.com

I've concluded 100% that the sites are run by a fairly complicated Cyprus-based tax evasion scheme, plausibly even involving money laundering. I have however not been able to conclude 100.0% that the sites are involved in theft of site-visitors' money or credentials, though the apparent non-existence of any theorethical users of any of those sites who'd have shared info on them seems super-fishy indeed.

[THEtomaso]

I think you can safely block all of those sites, based on their names alone.

[iam-py-test]

I'm curious how you discovered those other websites.
Thanks

[DandelionSprout]

From how I remember it, it went something like this:

1. Googled paradismatch.com.
2. One of the search results was for its Hurricane Electric BGP listing (https://bgp.he.net/dns/paradismatch.com)
3. Its IP address was listed as 37.46.122.6, so I clicked on it on that page to get to https://bgp.he.net/ip/37.46.122.6
4. Its "Announcement" section was listed as 37.46.122.0/24, so I click onwards to there.
5. Looking at https://bgp.he.net/net/37.46.122.0/24#_dnsrecords, a specific few of the IPs had clusters of date-fraud sites.

[THEtomaso]

##.lp_smartembed_smartembed-nettavisen_tilbudsjegeren @ the top of nettavisen.no.

[Comitorismer]

I can't post Prisjakt URLs any longer on https://swedroid.se/forum due to them getting blocked/removed.

Using both Adblock Plus and Origin on Chrome (Desktop, dark mode) with the Dandelion Sprout's Nordic Filters+EasyList enabled.

Here's the entry in NordicFiltersABP-Inclusion.txt that is removing any Prisjakt product URL's posted by members on the forum:

Line #4574: a[href*="prisjakt.nu/produkt"]

Example of a thread where Prisjakt URL:s posted by members are hidden when Adblock is enabled: https://swedroid.se/forum/threads/fyndtipstraden-inga-diskussioner.61865/page-280

[THEtomaso]

That's actually from 'Frellwit's Swedish Filter', so you should report it here:
https://github.com/lassekongo83/Frellwits-filter-lists/issues/
IMO, the rule works like intended though.

[DandelionSprout]

Being unable to post a link in a thread altogether, is much less fortunate, however. But it should be fixed upstream in Frellwit's list for uBlock Origin (and de facto AdGuard) indeed. Once it's fixed at his list, then it'll also be quickly fixed in the ABP list as well.

[THEtomaso]

People shouldn't be hotlinking to such nasty tracking sites.
If anyone wants to use those sort of "services", they know where to find them for themselves.
The problem, as described, can easely be circumvented though, simply by disabling hotlinking when posting!

[THEtomaso]

@DandelionSprout:
I just noticed that you have a filter called "Anti-'Non-news' List", and I've got an idea for it..
If you haven't noticed; all so-called news articles with the headline "Nettet koker" always contains completely useless, non-essential crap!
Using that headline as a marker, in various ways, would at least help to eliminate some of the junk!

[DandelionSprout]

You're onto something to a partial extent. I for one have been perplexed by whenever newssites have headers on the frontpages along the lines of "Her er trenden som «alle» snakker om", with pressure on the quotation marks because the sites are well aware readers would ridicule them if they actually claimed "alle" would talk about them. On phones especially would it seem tempting for me to block those articles from frontpages, since users wouldn't normally be able to hover over the headers to see the actual URLs and titles.

It's like when various food companies in 2023 kept claiming their products were "maybe the best in the world". I'll keep an eye throughout the next week or so as to which exact types of headers I'd want to remove.

[THEtomaso]

Issue:

Large ad banner (empty, labeled) above every article at dagens.no.

Possible fix:

dagens.no#?#.generic-widget:-abp-has(.annonce)

[THEtomaso]

Issue:

New ads @ kode24.no.

Possible fix:

kode24.no##.banner-container
kode24.no###top-bar-ad

[DandelionSprout]

There's very little (if anything) I could about it that I can see on my end, since all of the admittedly pretty large banners are for various projects that Kode24 themselves run. Kode24's speeches-day, Kode24's newsletter, Kode24's job listing portal, etc.

[THEtomaso]

Issue:

Ad bar @ https://dagbladet.no/82750511/

Possible fix:

dagbladet.no#?##svelte-app-articlestickytopbar:-abp-has([alt="kommersiell logo"])

[DandelionSprout]

I think I got that one fixed after a couple days.

[THEtomaso]

Issue:

All articles @ vg.no now has a bunch of links to various adticles beneath them.

Possible fix:

vg.no##astro-island > section:has-text(Kommersielt innhold)

[DandelionSprout]

Fixed now in 40eb4ff

[THEtomaso]

Issue:

Ads beneath articles @ itavisen.no.

Examples:

https://itavisen.no/2025/03/03/trump-glemte-a-nevne-bitcoin-men-na-har-han-gjort-dette/
https://itavisen.no/2025/03/05/slik-er-mercedes-glc-elektrisk-spesiallaget-for-vinter-i-norge/
https://itavisen.no/2025/03/06/anklages-for-a-fastvare-odelegge-skriveren/

Possible fix:

itavisen.no##a[href*="itavisen.no/go/"]
itavisen.no##p:has-text(/annonse/i)
itavisen.no#?#h3:-abp-has(a[href*="itavisen.no/kjope-kryptovaluta/"])
itavisen.no#?#p:-abp-has(a[href*="itavisen.no/go/"])

[DandelionSprout]

Fixed now in 40eb4ff

[DandelionSprout]

This whole quick-reports-in-a-discussions-thread-thingie is getting ever harder for me to keep in mind in my backlogs, esp. as no screenshots ever seem to be added alongside the quick-reports. I think it's time for to centralise my backlogs at https://github.com/DandelionSprout/adfilt/issues instead.