Fathom tracking partially unblocked

[JobcenterTycoon]

Hello, while most of the Fathom tracking is already blocked in https://github.com/AdguardTeam/cname-trackers/blob/master/trackers/fathom.txt a few scripts pass through because they use a other CNAME domain.

Examples:

prefinery.com -> electric-eighten.b-cdn.net
steadybit.com -> type-thirtyseven.b-cdn.net
meinsmartplan.de -> gorgeous-easy.b-cdn.net

Example for the script: prefinery.com -> https://glowing-van.prefinery.com/script.js But the list only contains ant.prefinery.com

I don’t know if it can be fixed because b-cdn.net get widely used

[ameshkov]

Yeah, b-cdn.net shouldn't be blocked. They might be using it as a proxy.

[GeQi]

Yes, Fathom explicitly states that they use Bunny as proxy. This looks rather hopeless. It seems the only way is to manually add the sub-domains to tracking lists instead.

[GeQi]

Reported to the filter list repo: AdguardTeam/AdguardFilters#116645

[ameshkov]

Actually, I think we can solve this rather easily by adding one more step to the detection algorithm.

We'll need to scan all bunny CDN cnames and check if the domain hosts Fathom's javascript file.

@slavaleleka when you have some free time, please take a look.

[TPS]

We'll need to scan all bunny CDN cnames and check if the domain hosts Fathom's javascript file.

Is it possible to check the contents of the file while doing this? If they're already randomizing domain names, then filenames (& even contents, similar to how other malware does) are likely next.