HTTP SPAM Blocking - How To

Do you hate wasting bandwidth and time downloading pop-ups, pop-unders, video ads, and irritating mouseovers? I do and have a pretty reliable way for Tomato to drop all HTTP requests to the spam ads.

The Benefits:
* the following setup kills about 99% of the unwanted spam on my network
* web surfing is now a LOT faster because it blocks all outgoing requests for spam as opposed to blocking incomming data that has already been transfered to your computer
* no need for you to sell your surfing habits to 3rd party proxies
* no need to install Squid/Proxy software on your Tomato
* blocks Torrents! If you want to allow torrents then delete the first two lines in List #1 containing "announce" and "tracker"

It's a work in progress. If there is interest I can periodically post my updates. Please forward any suggestions and inclusions.

Enjoy!

HOW TO
-----------------------------------
* Under http://[Your Tomato IP]/restrict.asp
* Create a new rule - I use names "Keyword Blocking X"
* Use the settings in the attached thumbnail
* Using the "All Accept" rule will allow you to bypass the filter by MAC address
* The lists have a maximum length - right now I have two lists/rules

Rule List #1
-----------
.com.com
2o7
2o7.net
a.answers.com
adbrite.com
adcentriconline.com
adclick.php
addynamix
ad-flow
adhost.com
adhostingsolutions.com
adknowledge.com
adlog.com
adonspot
adrants.com
adrevolver.com
ads.adsonar.com
adstream_mjx.ads
adtech.de
adventnet.com
advertising.com
announce
anton.lr2.com
anytimeproducts.com
aspalliance.com
atdmt
auctionads.com
axilsearch
badges.del.icio.us
banner.com
betamarker.com
bigboobpass.com
bigmouthmedia.com
boubleclick
casalemedia
click_lx.ads
clickability
clicksor
cliksor
clobo
cm2.zonelabs.com
csmonitor.com
dada.it
digitalmedianet.com
domainsponsor.com
doubleclick.com
doubleclick.net
downloads.walmart.com
dw.com
elsitio.com
entertainsite
euroclick.net
fastclick
filewire
firstadsolution
fuc* <----the "F" word
gamespot
gamespy
google-analytics.com
googlesyndication
guarduptodate
hbmediapro
hitbox.com
hotpocketsdojo.com
hs2.zonelabs.com
hypertor
i.i.com
iframeurl
image.com
intellitxt.com
jsmaster
kontera.com
layer-ads.de
llnw.net
mcafee.com
mdcanada.ca
media.com
mediaplex.com
media-servers
meegos
musicgiants.gbis.com
mygamercard
napster.com
netregistry.net
netwealthpartner.com
offermatica.com
onlinesecurityhelp
opticaljungle.com
oversee.net
paypopup
phl-te.tacoda.net
pointroll.com
popunder
precisionclick
promo.tigeronline.com
questionmarket
realcastmedia
realmedia
revenue.net
revsci.net
screensavers.com
servedby
serving-sys.com
specificclick
sportsinteraction
spyfalcon
spylog
statcounter
tagworld
tdnetworks
tennpac.com
toolbar
tracker
traff4ppc
trafficmonkey.com
trafficmp
tribalfusion
unicast.com
usenext.de
userbars
valueclick
video.msn.com
x2Fnoactivex.html
xiti.com
yieldmanager
yournetaccess
youronlinesecurity
ypn-js.overture.com

List 2 - last updated 2008-08-11
--------
lakequincy.com
orcsweb.com
cpaclicks.com
information.com
qarchive.org
webtrendslive.com
hosting.de
blogads.com
arcweb.com
allmusic.com
zdmcirc.com
op-0ut.get2.us
show_ads.js
inMail24.com
rlink.org
wholeprofits.com
itrack.it
passion.com
ads.monster.com
advertserve.com
bluestreak.com
ecnext.com
.search.com
pochta.ru
digits.com
nm.ru
webtrenslive.com
alternateurl.com
madskills.com
srad.js
afy11.net
text-link-ads.com
snap.com
gmpg.org
adclick.php
cpxinteractive.com
member.dnsstuff.com/js
adbureau.net
graphics.dnsstuff.com/images
member.dnsstuff.com/amember
x-ratedclips.com
porn.com
player.php
mpegs.com
nudity.com
adengage.com
eprize.net
101com.com
domainroundtable.com
auctions.domaintools.com
ustream.tv
earthwebhardware.com
click_lx.ads
hail.com
adultfriendfinder.com
livejasmin.com
myspaceJS037.js
myspacetv.com
experts-exchange.com
hitslink.com
arrivenet.com
2o7.net
tfges.cn
webtrendslive.com
adsenseOpt.js
subscription.js
64.46.39.165
google_ads
valencemedia.com
collegehumor.com
clickhype.com
zango.com
zangocash.com
licenseacquisition.org
clearspring.com
adultfriendfinder.com
streamray.com
alt.com
bondage.com
utarget.co.uk
atwola.com
hosting-24.cn
.cn
porn
secureserver.net
208.109.167.144
popunder.htm


A good list of black listed websites can be retrieved from mvps.org -> serach under host file blocking. Here is a link (700kb text file)

mvps.org/winhelp2002/hosts.txt

An easier solution is to use an opendns server

Thanks
I think it would be a cool feature to add..
like AdBlock in Firefox

You have a few repeats in that list especially doubleclick and a few others. I think follow the examples giving in the F/W and then use the list provided in AdBlock is a better solution.

I gave this a shot tonight, and couldn't get it to work. I tried blocking just doubleclick as a keyword, but it still loaded it. Hmmm...

One thing I liked with the actiontec router that came with my Fios install was that you could set up include lists, not just exclude. When it came to locking down my kids PC, it was much easier to say which sites I wanted to let them have access to vs. not have access to.

Hypernova said:

You have a few repeats in that list especially doubleclick and a few others.

Click to expand...

You have obviously never tried to block double click. It is impossible to have too many variations and entries to block them. They always seem to find a way around the filters. Now that google owns them you need to triple the double click entries in every single malware filter that you can.

GeeTek said:

You have obviously never tried to block double click. It is impossible to have too many variations and entries to block them. They always seem to find a way around the filters. Now that google owns them you need to triple the double click entries in every single malware filter that you can.

Click to expand...

doubleclick. <-All I used to block them and it works.

Hypernova said:

doubleclick. <-All I used to block them and it works.

Click to expand...

Thanks so much for the clarification. I'll drop all of my duplictes immediately.

Duplicates are easier to find especially when they are printed on a full screen editor!

About the doubleclick ads comming through, I've found that a lot of ads come from javascripts through includes. You really need to check out the web page source code to find the bugger loading the stuff up.

Watch out that some spam sites use keywords used in normal web programming.
i.e. if you block the word "banner"
http://xys/bannerfourums/newreply.php?do=click4
would get the web page blocked even though no banner.com web content was being loaded.

Amazon and Walmart are big offenders for spam ads but if you like to look for price comparisons online then a LOT of web pages suddenly disappear! ;-)

Post the offending web page links and I'll have a look. My list is by no means all encompassing, just blocks the websites I hit.

I cleaned up and sorted my list in the original post and saved the changes. Now fits on one list! Keep in mind there's a maximum number of characters allowed in the list.

Good job, thanks!
However, why are you blocking aspalliance.com?

Thanks again,
Int15

Int15 said:

Good job, thanks!
However, why are you blocking aspalliance.com?

Click to expand...

I use the COB rule ;-)

Basically block sites/content if they have "popped up" somehow/someway that is irrelevant to my "internet experience".

I find aspalliance serves/posts too much ad&spam content on other scripting/programming websites.

Change it to "ads.aspalliance.com" and it will block some of the spam content but still show you the basic web site.

Great, thanks again!

-Int15

you could also just get a list for your hosts file if you use windows, or a program like hoster can download/edit it for you. blocks all my spam/banner ads.
here is all the info:
http://www.mvps.org/winhelp2002/hosts.htm

They renamed hoster to HostsXpert found here:
http://www.funkytoad.com/content/view/13/31/

All good links but I think I prefer the "small is beautiful" philosophy of Tomato. Personally I don't want to install and maintain spam buster software on every computer on the network...just call me lazy

mikester said:

All good links but I think I prefer the "small is beautiful" philosophy of Tomato. Personally I don't want to install and maintain spam buster software on every computer on the network...just call me lazy

Click to expand...

Adblock Plus for Firefox maintains itself.

Your hosts file is already in windows... there is nothing to install lol

Also here is how to use your hosts file that is already in linux:
http://www.accs-net.com/hosts/hostsforlinux.html

The list seems to work great.... thanks very much....

How much load

Has anyone studied how much load using lists like this puts on the router?

Wondering if it is better to do it on a 'per machine' basis.

Here's some stats for you:

WRT54GL running Tomato v.1.05.0977
CPU Load (1 / 5 / 15 mins) 3.91 / 4.49 / 4.29 (154 connections, mostly web surfing)
Total / Free Memory 14.20 MB / 1,432.00 KB (9.85%)
Uptime 16 days, 22:38:50

Just for fun I chose a website I like to view but HATE the spam content.

I ran a test using IE6. Before each test I went to "Tools" - "Internet Options", "deleted cookies", "delete files + all offline content", "clear history". I didn't bother timing the differences as I think the results are self explainatory.

URL: www.entrepeneur.com

Data Transfer Stats:
Tomato Spam Filter OFF
UL: 84014 bytes
DL: 777609 bytes

Tomato Spam Filter ON
UL: 49281 bytes
DL: 442139 bytes

Thats roughly a 44% reduction in data transfered. It's like getting an extra 44% of bandwidth!

Hey Yaqui, how about you show some comparison stats along with some time comparisons?

Flame away!