Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tkqlhce.com is not malware, should not be blocked by Dandelion Sprout's Anti-Malware List #904

Closed
Alex9001 opened this issue Aug 19, 2023 · 3 comments

Comments

@Alex9001
Copy link

Describe the problem below this line as meticulously and detailed as possible (incl. pagelinks if any)

tkqlhce.com is an affiliate referral redirector used by sites like slickdeals.net (example, links in this thread )

it is not a malware distribution domain, and thus should not be blocked within the context of an anti-malware list. there are certainly other lists which should block it, such as tracker blocking lists, but not an anti-malware list

it is currently being blocked by Dandelion Sprout's Anti-Malware List

Add screenshots below if needed

image

Add a screenshot of the extension's logger

No response

Which adblocker(s) did you use when testing this?

AdGuard Home

Adblocker version(s)

adguard home v0.107.36

Which filterlists did you use? Failing to tell this will temporarily close the report until it has been told.

Dandelion Sprout's Anti-Malware List

Which browser(s) did you use when testing this?

Firefox

Browser version(s)

all browsers

Which OS(s) did you use when testing this?

Linux

OS version(s)

not relevant

@iam-py-test
Copy link
Collaborator

Seems to have been added because it was used to redirect from a scam website to a McAfee affiliate page: #287
I'm guessing there was one bad affiliate link (https://www.tkqlhce.com/click-100401187-14437943?sid=df41d215fe9342a5a52fd569fa1b5a8c19660&pid=57311), though interestingly, that link is still online & redirects to a McAfee affiliate page despite the original issue being from October of 2021.

@DandelionSprout
Copy link
Owner

I will doublecheck this weekend how it's being used by SlickDeals, but otherwise I at the time of writing agree with iam-py-test.

@DandelionSprout
Copy link
Owner

DandelionSprout commented Aug 20, 2023

Strange observations I've made:

  1. Somehow, if a prompt shows up on SlickDeals to ask if you are an EU citizen and you answer yes, the site does not redirect its links through tkqlhce.
  2. Presuming iam-py-test's result/example URL is unchanged, I see a possible narrow-down pattern I can change the entry to, even if I am certainly not confident about the reliability or safety of doing so.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants