Fighting Malicious Ads on Download Pages

donho

@Coises
Thank you!
These 2 websites (8 links) have been blocked.

alexkoster

Thanks Don for providing a great piece of software, service to our community and for reminding us to open our hearts to those who are suffering (Hong Kong people, Taiwan independence, the Uyghur people and the Ukranian people to name a few)!

Here are the ads I am seeing when browsing using Mozilla Firefox from the USA. Both the top horizontal banner ad and the square ads on the right side appear malicious.

Screenshot 2025-06-07 at 22-16-55 Download Notepad v8.8.1 We are with Ukraine (stable auto-update triggered) Notepad.png

Top horizontal banner link:

https://ff.sitesearchweb.com/offer?cid=10970&pclid=60526930&ctag=784125095&pubd=https%3A%2F%2Fnotepad-plus-plus.org%2Fdownloads%2Fv8.8.1&utm_campaign=110315&crid=4466&cr_gid=298&yomen=106&bid_r=PdI6rEu7Vk4fz3A8Z3GXDQ

Side square links (each seem to link to the same URL):

https://ff.sitesearchweb.com/offer?cid=10970&pclid=60526930&ctag=784125095&pubd=https%3A%2F%2Fnotepad-plus-plus.org%2Fdownloads%2Fv8.8.1&utm_campaign=110315&crid=4466&cr_gid=298&yomen=106&bid_r=PdI6rEu7Vk4fz3A8Z3GXDQ

PeterJones

@donho,

I don’t know how much you can customize your stylesheets, or add <style> tags to individual pages. But if I use my browser’s “Inspect” tool, and add the following <style> to either the <head> or near the top of the <body>:

<style>
    ins { 
        background: linear-gradient(to bottom right, white, white 48%, red 48%, red 52%, white 52%, white); 
        border: 3px solid red;
    }
</style>

Then I can make the page render like this:

<style>
    ins { 

          /* Set a transparent border to allow the background gradient to show through */
  border: 4px solid transparent; 
  /* Apply your gradient as the background */
  background: linear-gradient(white, #f77) padding-box, 
              linear-gradient(to right, #f00, #3020ff) border-box; /* The gradient for the border */
  /* Ensure the background covers the border area */
  background-origin: border-box; 
  /* Clip the background to the padding box and border box to create the effect */
  background-clip: content-box, border-box; 
  /* Apply border-radius for rounded corners */
  border-radius: 30px; 
    }
    </style>

with an ins::before, you could even add an “AD:” prefix to any advertising content:

<style>
    ins::before {
        content: "AD:";
        /* You can add other styling properties here */
        font-weight: bold;
    }
    ins { 

          /* Set a transparent border to allow the background gradient to show through */
  border: 4px solid transparent; 
  /* Apply your gradient as the background */
  background: linear-gradient(white, #f77) padding-box, 
              linear-gradient(to right, #f00, #3020ff) border-box; /* The gradient for the border */
  /* Ensure the background covers the border area */
  background-origin: border-box; 
  /* Clip the background to the padding box and border box to create the effect */
  background-clip: content-box, border-box; 
  /* Apply border-radius for rounded corners */
  border-radius: 30px; 
    }
    </style>

I don’t know if doing any of these would violate the terms of service for your hosting… But if not, and if you can insert your own style to change borders and background of the ins tag using something similar to one of the examples I’ve done (even if not exactly what I’ve done), then you could at least make it more obvious to users that those are ad links rather than real download links.

donho

@alexkoster said in Fighting Malicious Ads on Download Pages:

https://ff.sitesearchweb.com

shithttps://ff.sitesearchweb.com was already blocked. So I think you won’t see it anymore. If you still see them, it could be a redirection.
In this case, could you provide me the link via right click context menu: “Copy link” command?

Coises

Presumably different specifics, but looks about the same:

https://adclick.g.doubleclick.net/aclk?sa=L&ai=ClU5nLpxHaOtRi9jq2Q__8OqACvqPheZtoIOoxa0NwI23ARABIABgyb7JhsSjyBeCARdjYS1wdWItMzA1MDYzNDU5MTkwNzgxOMgBCagDAcgDAqoE4wFP0KD9Q5-RLoW_bLnU1bCDm2EsbyvkBSEHcqXOpSPEJYEzX7-amKNRwqwdZvTTA0G0rb32Tq1WMNhZc4CYZBHaDnvZrOg6mgasv6mOWjK84m0ochg54JtG4Dv7fdwW7F0CyitsG7GqCrbbBqua7540EiGSJJXY6Xyhkayupfx_HnRR6tvUkt9ZwNl572u3lO7h4HttpWb63188ldnzfGwadckWq4pBHv0HGciQYZotMELN9iOjnfi7IZ0v8QWm6nL73yAjOtvtfLHyBZ2zWeBmX1LsUSSDgwTocgcLOVvuSYsMMIAGsbbwlvCAu4dboAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAqgHrb6xAqgHv9OxAtgHANIIJgiAYRABMgKKAjoNgECAwICAgICogAKgA0i9_cE6WISF9Pbq5Y0D-gsCCAGADAGqDQJVU-oNEwjmyvr26uWNAxULrDoFHX-4GqDQFQGAFwGyFw4YDCoKNzg4NzQ4NjE3Mw&num=1&sig=AOD64_31LqHImfQ5WUrJfBD_n77VcK1pdg&client=ca-pub-3050634591907818&adurl=https%3A%2F%2Frtb.sitesearchweb.com%2Fapp%2Frtbclick%3Fp%3DhwYWMEB5yLQeS-2L09qapObI6rhj6iX1kUYvcc0zaJmktJmalqtYddd_V5p89uYG-xqnes1hHop3P4ejlU37YINicfMDgcaYqYRGshkmofTQ-DoEx7-h84FjlnoVrk6pIECQbGMQUguYatVWFFqG2cTvWFg3YxtSXBc7CVocNFYVWFj6-yjYRRhyW78wDg6ktdXecUuHvJxoj95DG5eLJMuL10VWe71vS6OmP5x2LCFUOaWzmsLc2MDWNNERfWAryNeLuiwhntoXWUmtaDj43KGVdxhb8HRagWOWehWuTqnkNcE_QoiWQoZcXyBjGeuhxO9YWDdjG1JSAtM29UH6ToyTFaLXZMWbcn0nWSHM7wEHnaqLh8PYQhh83ysbbtsnxrHARYdIP22g88ZQhJLiVX5WYW5sdU2ElBiClCZ39Okuohpytl3IGJaiXIfpz_fb6vPUQ50VoIUnwXV1JRfE_qvA5UeAtuF13dgMtBjhws3XBVX8PkxRsLn7GUZ7QQ6lTzQvziWiq67jTVQvVL4ScJYwqEcqLlqNRa8Vv1y9IfWC3Q8nwKZuEQXuW-A6veoEfn8yuoVxbCNfIb3rLfDWc3_b_Gpk1DjqcwuIa5K5WqE87ncelwQN_f3bjGrIIFKK29XXvCS9-JJSv0UMpIeRg_3BAN2jD3ow78hAE1-8MzEgdscSRm7E532hb9iNjk-HwmrAtXTbkRGWTc4SSy2LuZ38cZPrM9-_PQbbwy_B9u6Kvm0aAYPyYIh5tRdxW3xB-_QE5DXfN81aoPE8hd8gsoWhYgybI1PShbFkgWFa5_OLeZTqxnJFur1wZYh3BiKrrTnmoIDghbKC_MOb4SsGzuc_PGQ9KWLPy1ILd14vPx7Umt05Kcho3rpLQRb1S7EHxLOMzi9wwR6cupMpufL7NZvVJd-QRi_Ingj1DV4wwZBYcJPZJxtpkh_SAmnFCFrTIAnUr1vdI3z3WtzW3WA3pZwTwhn299zQi3mU6sZyRbooQDKDPXPWzeWwOd93wnHxZQ0NlPczx10awIIGt4tNmQOvPLZN5tgfIFyz8V46Y83VoZiyCmQ6_e-98XvRv0OE6CFp1ERQFx80ZHE1sJ2zwRK7OvCHLOEj9Tcuz2SQzy5AxD5MTqRBNT9TuaUc529wNIR7-v9BkmRRG1Ht1xlZyg0DajfwlUXO-9Vllz4X16p_wUIr9XObVJXarNqABY1Jwb_-lV5QNSwlsqoZyyXiX0ln5vWg1SZe5mjsAbHZTL_icFxhspKGHGkTAMibSrLUnsXHhG6wEAT9jh-eE4fz2vfTRdfxmDwnsMSY7cnzjtElWd0eCfXbMuvkuq2m1qXK79P_OYW03cm3PFGTpaHdTA%26cap%3DaEecLgAAKOsFOqwLABq4fy8G8nwE6qycuLcviw
https://adclick.g.doubleclick.net/aclk?sa=L&ai=CRel0LpxHaOSGA4La6tkP-bXViA76j4XmbaCDqMWtDcCNtwEQASAAYMm-yYbEo8gXggEXY2EtcHViLTMwNTA2MzQ1OTE5MDc4MTjIAQmoAwHIAwKqBOQBT9B10Q2cRwSPLH3bQKFXl4Rvwir0b4gUTMwBkgEV4xtIuRw-Gpr48HSM0CxfPqqoPrGx7vLheG-uBVa3O3sE3_HcgBLDWrOBiZN0UAZh1hT-U86_jfmVtTlrcMllBw0Z4LP2g8cqTihwaQt2N67SM4Pt2zuRZriRgvcMYPmsGY4EhIcCDtABq_o8UuOyj7V9LKzblcd7ELFf8kuSwUQzsxtd2u7isTHvK3VfaOwZUkaP9zyrgeDUO-RQucgKcDv0yswVBnEoze8YQwdA5ysKYG_EZ07jXoVi2R3Rh0CargrMG3kmgAaulaHroMTwjeYBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAqgHrb6xAqgHv9OxAtgHANIIJgiAYRABMgKKAjoNgECAwICAgICogAKgA0i9_cE6WLm89vbq5Y0D-gsCCAGADAGqDQJVU-oNEwjdzv326uWNAxUCrToFHflaFeHQFQGAFwGyFw4YDCoKMjg5ODAxNTc3NA&num=1&sig=AOD64_324i7XXl64msSitoHwgzKj0uK4_A&client=ca-pub-3050634591907818&adurl=https%3A%2F%2Frtb.mysafe-search.net%2Fapp%2Frtbclick%3Fp%3DhwYWMEB5yLQeS-2L09qapObI6rhj6iX1kUYvcc0zaJmktJmalqtYdWI0N41op1w3ndwf1cOP_H7io7jhLPvYu4NicfMDgcaYp29hROsoyAr9M52sfQ0HRYFjlnoVrk6pIECQbGMQUguYatVWFFqG2cTvWFg3YxtSXBc7CVocNFYVWFj6-yjYRRhyW78wDg6ktdXecUuHvJxoj95DG5eLJMuL10VWe71vS6OmP5x2LCFUOaWzmsLc2MDWNNERfWAryNeLuiwhntoXWUmtaDj43KGVdxhb8HRagWOWehWuTqnkNcE_QoiWQoZcXyBjGeuhxO9YWDdjG1JSAtM29UH6ToyTFaLXZMWbcn0nWSHM7wEHnaqLh8PYQhh83ysbbtsnxrHARYdIP22g88ZQhJLiVX5WYW5sdU2ElBiClCZ39Okuohpytl3IGJaiXIfpz_fbmiv6Vvr5fFRnSs90jOkix2wHa_vNRNvaHSk0KLc-4R906HPYk2hw5aCeAD1IvhNaP8sUppB90IhXvMYORdOEXp_FHNfEhKooIbr4ScI-uON36n1-VC-CuDlzpN6jAWgB0X1Z1QwEn-PRBpLKWX7EUXOTps5XJEUr-V-wvxXnTkEH39XULhQqguuuVlujQY4cqcdxkgx1RbhbC7U30TJp2c_RCOaTboU3PQbbwy_B9u4voRc3PNxmyfRoF0ro2BEGEVNxk35fiGCFDvhKXjoVS70GK4UD154jLX08dsz0sA5_nuhfyhFz4zVFiRX8Peq3KbOul1pkNQDX-prCs8Qul_j_wnoSwFILzGOt4rmFz6hLBsYp64c2M1Fgnn7cH2R6AC6HsYdvIMeg8LI3HRUrm0TCbq8yh6dpqMS1vzK1UhiACN2dUeb8fRloO2Zsu5XYYeDKeI0kAat7IInRaK_SYHdQBkvSIznhESTwXU9T0F-amyEVUCY3BODPT_PeU9Hmwj2qLmKzylu5SfQlVE9wjMe1e97PFkyzz2cnjTnMHipHwfbT90w5UJ38cZPrM9-_PQbbwy_B9u6fLl5nzoq-p4xaqmcNHUMMOxND6ZFHsDvKS3oyal67y5KthPkPTytKoIAJGu2qQHEINNPljpmZIda1CsAYVdyUZiSPblR3sIBLBsYp64c2Mzvzcg0K0IUDUVILrLXNzCnbYlgNbptOW-0kaI1D1ogIhO5n6nKL1NtL0yv6gxbNXt3ugxqkyN8Z4-_mj5MG-7QwTi-7OzfL3NpP_P_2FyhcXzM8HzNJAU3H7YKDcEz8J10eSKE1FkaK2eTmpZIWx4iwOs_y4Mq4qkLgbQPVp3KxYOEvC5UKKYuzypjklxUogoI3e4tMWh8xOHPNgKAG1iM2ca0jJ47zhy-J8iOQGh9O%26cap%3DaEecLgAAw2QFOq0CABVa-WHG4Y9QAbMnmhCmrw
https://adclick.g.doubleclick.net/aclk?sa=L&ai=ChK93LpxHaLO9Be6eodAPsNOO8A76j4XmbaCDqMWtDcCNtwEQASAAYMm-yYbEo8gXggEXY2EtcHViLTMwNTA2MzQ1OTE5MDc4MTjIAQmoAwHIAwKqBOkBT9AS8BDoK0GL0qOrdfFxFHFq2o5sDkTiBqA0rBWFtAyrzqSXbJq9gvZuAXU-qQwlhkoP5uKJ3P3OZlKfEtsAwTgxkoKeufBXSfQg6-9Zq5Tsbhrwoq_InsGTf6sk9yIP09A4D3M3uURlQ71cX-OuOw5-H8hK72ss07V1wP20L9LLFWfTJY8NRFoTyHjr1yojdeU53YlnxzIErq0VxVx4jvV3qGOhr1bHvmWROrP-7ELl7JTPpEX_OtI4UHFyfJmRIVlZoK9QZ7XfddENwf0CbP38tyTgzTYl0vngq4FH3w4_o_DlyzwSQ0GABr2v0pqUsJmNdaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQKoB62-sQKoB7_TsQLYBwDSCCYIgGEQATICigI6DYBAgMCAgICAqIACoANIvf3BOliI9fj26uWNA_oLAggBgAwBqg0CVVPqDRMI-cT_9urljQMVbk8IBB2wqQPu0BUBgBcBshcOGAwqCjQzNzQ3NDg5Nzk&num=1&sig=AOD64_1nVcUgveyG_MffOVS4kUjmjw0f9Q&client=ca-pub-3050634591907818&adurl=https%3A%2F%2Frtb.mysafe-search.net%2Fapp%2Frtbclick%3Fp%3DhwYWMEB5yLQeS-2L09qapObI6rhj6iX1kUYvcc0zaJmktJmalqtYdWI0N41op1w3ndwf1cOP_H7io7jhLPvYu4NicfMDgcaYp29hROsoyAr9M52sfQ0HRYFjlnoVrk6pIECQbGMQUguYatVWFFqG2cTvWFg3YxtSXBc7CVocNFYVWFj6-yjYRRhyW78wDg6ktdXecUuHvJxoj95DG5eLJMuL10VWe71vS6OmP5x2LCFUOaWzmsLc2MDWNNERfWAryNeLuiwhntoXWUmtaDj43KGVdxhb8HRagWOWehWuTqnkNcE_QoiWQoZcXyBjGeuhxO9YWDdjG1JSAtM29UH6ToyTFaLXZMWbcn0nWSHM7wEHnaqLh8PYQhh83ysbbtsnxrHARYdIP22g88ZQhJLiVX5WYW5sdU2ElBiClCZ39Okuohpytl3IGJaiXIfpz_fbr-MkazxrTEQDUweEATlxPmwHa_vNRNvasbGN8ckx6wQkyc4MRIUrgKCeAD1IvhNaP8sUppB90IhXvMYORdOEXp_FHNfEhKooIbr4ScI-uON36n1-VC-CuDlzpN6jAWgB0X1Z1QwEn-PRBpLKWX7EUXOTps5XJEUr-V-wvxXnTkEH39XULhQqguuuVlujQY4cqcdxkgx1RbhbC7U30TJp2c_RCOaTboU3PQbbwy_B9u4voRc3PNxmyfRoF0ro2BEGEVNxk35fiGCFDvhKXjoVS70GK4UD154jLX08dsz0sA5_nuhfyhFz4zVFiRX8Peq3KbOul1pkNQDX-prCs8Qul6q3G3t1cb2IzGOt4rmFz6gQiTCU-P7KEJc3irnpjwFDAC6HsYdvIMeg8LI3HRUrm0TCbq8yh6dpqMS1vzK1UhiACN2dUeb8fdgmcYTinMBbedbSTng5qbt7IInRaK_SYHdQBkvSIznhESTwXU9T0F-amyEVUCY3BODPT_PeU9Hmwj2qLmKzylu5SfQlVE9wjMe1e97PFkyzGBwSX-PoM4xh45rem4Vnyp38cZPrM9-_PQbbwy_B9u6fLl5nzoq-p4xaqmcNHUMMOxND6ZFHsDvKS3oyal67y5KthPkPTytKoIAJGu2qQHEINNPljpmZIWpmEAgzyFrVZiSPblR3sIAQiTCU-P7KEPWSVrwd0A6ENb8sQS0HcWjlTvQONxA8QvsO3oFGQKo3zJGaZofFSf9L0yv6gxbNXnRfg3k4HTQ64-_mj5MG-7QwTi-7OzfL3FUijSlchrgSNhi4Yk0dePHH7YKDcEz8J10eSKE1FkaK2eTmpZIWx4iM5oYOVqms50LgbQPVp3KxYOEvC5UKKYuzypjklxUogoI3e4tMWh8xOHPNgKAG1iM2ca0jJ47zhy-J8iOQGh9O%26cap%3DaEecLgABXrMECE9uAAOpsD6B8UKU9freh-sf-Q
https://adclick.g.doubleclick.net/aclk?sa=L&ai=Cg1jbLpxHaKLfB-u0odAPm4T_sAn6j4XmbaCDqMWtDcCNtwEQASAAYMm-yYbEo8gXggEXY2EtcHViLTMwNTA2MzQ1OTE5MDc4MTjIAQmoAwHIAwKqBOkBT9BYyV2WdYSUDvUnPY_dQ7DH9-IpaajrZN83TCYX5i2sO3cHRaBu2aannQ0-KHwORDtUPXcUlMLIJ3_39vzN_2FTtbvi_DD5brPBBt623GmytkGal-ghh-uuP8KGTRc80dfhoPZDb5RY5PIAGe_BdtJff0aH1At83TlDERb3fWAmGRMRQ2oSvqrIcBfRfYcKxn9Iz3d1w2cnt85k7OPYwioSkoabw9mlYSnDF3ssO2LaExJFPonysmC7GCm_ldtdWe80kny1UZnHS8gIMTmVyzmde79etIvFHabF2_lMvpHlI_6pO6kQftmABrG28JbwgLuHW6AGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQKoB62-sQKoB7_TsQLYBwDSCCYIgGEQATICigI6DYBAgMCAgICAqIACoANIvf3BOlicmPv26uWNA_oLAggBgAwBqg0CVVPqDRMIhbCB9-rljQMVa1oIBB0bwh-W0BUBgBcBshcOGAwqCjMxMzczMTA0MDQ&num=1&sig=AOD64_2QX5DLjS6Pl9QpUfqQ1VY45h0qjw&client=ca-pub-3050634591907818&adurl=https%3A%2F%2Frtb.sitesearchweb.com%2Fapp%2Frtbclick%3Fp%3DhwYWMEB5yLQeS-2L09qapObI6rhj6iX1kUYvcc0zaJmktJmalqtYddd_V5p89uYG-xqnes1hHop3P4ejlU37YINicfMDgcaYqYRGshkmofTQ-DoEx7-h84FjlnoVrk6pIECQbGMQUguYatVWFFqG2cTvWFg3YxtSXBc7CVocNFYVWFj6-yjYRRhyW78wDg6ktdXecUuHvJxoj95DG5eLJMuL10VWe71vS6OmP5x2LCFUOaWzmsLc2MDWNNERfWAryNeLuiwhntoXWUmtaDj43KGVdxhb8HRagWOWehWuTqnkNcE_QoiWQoZcXyBjGeuhxO9YWDdjG1JSAtM29UH6ToyTFaLXZMWbcn0nWSHM7wEHnaqLh8PYQhh83ysbbtsnxrHARYdIP22g88ZQhJLiVX5WYW5sdU2ElBiClCZ39Okuohpytl3IGJaiXIfpz_fbVOa4TfyVhBeBhL_KgFHc8mwHa_vNRNvaYh2On9MNXKZ0DH834oxFHqCeAD1IvhNaP8sUppB90IhXvMYORdOEXp_FHNfEhKooIbr4ScI-uON36n1-VC-CuDlzpN6jAWgB0X1Z1QwEn-PRBpLKWX7EUXOTps5XJEUr-V-wvxXnTkEH39XULhQqguuuVlujQY4cqcdxkgx1RbhbC7U30TJp2c_RCOaTboU3PQbbwy_B9u4voRc3PNxmyfRoF0ro2BEGEVNxk35fiGCFDvhKXjoVS70GK4UD154jLX08dsz0sA5_nuhfyhFz4zVFiRX8Peq3KbOul1pkNQDX-prCs8Qul--6bVALW3NmzGOt4rmFz6gQiTCU-P7KENZwacGsXYRKlKp3pU96NOrjR5d2JcR7f0TCbq8yh6dpqMS1vzK1UhiIPIcuS3nP6j9LQx4jnII3QVxqhM6ihVN7IInRaK_SYHdQBkvSIznhESTwXU9T0F-amyEVUCY3BODPT_PeU9Hmwj2qLmKzylu5SfQlVE9wjMe1e97PFkyzGBwSX-PoM4y7id55KnGcsZ38cZPrM9-_PQbbwy_B9u6fLl5nzoq-p4xaqmcNHUMMOxND6ZFHsDvKS3oyal67y5KthPkPTytKoIAJGu2qQHEINNPljpmZIYo57d1ZSERHZiSPblR3sIAQiTCU-P7KEHvttU6nN97hHZ2cQoV2MN2vnGC-jpXBH6fi3wR4B3ibB6uOc1jseF1L0yv6gxbNXpSKgd637L684-_mj5MG-7QwTi-7OzfL3KySR8Wm3vHYXzM8HzNJAU3H7YKDcEz8J10eSKE1FkaK2eTmpZIWx4huvls-x-qjzULgbQPVp3KxYOEvC5UKKYuzypjklxUogoI3e4tMWh8xOHPNgKAG1iM2ca0jJ47zh3Xnt8YtdwtB%26cap%3DaEecLgAB76IECFprAB_CG9qinRrim8k_WhC1ew

donho

@Coises

Above 4 links are 2 websites (add sh*t before to not have the clickable links): “shithttps://ff.mysafe-search.net/” & “shithttps://ff.sitesearchweb.com/” - Both were already blocked - do you still see them?

Edit: OK, I see they’re the same websites - it means Adsense block website system not working. I will contact Google Adsense for this issue.

donho

@PeterJones

I didn’t try your method, because not only does it take the focus from the download image, but (I suppose) it will be also applied to the non-malicious ads.
However, it gave me an idea: Why don’t we label all the ads?

So here’s the result:

donho

@PeterJones
Finally I have tried your method - way much better: the “Advertising” label is much closer to ads.

It’s been applied to v8.8.1:
https://notepad-plus-plus.org/downloads/v8.8.1/

Let’s wait & see…

Mark Olson

@donho
v8.8.1 looks good to me!

donho

@Mark-Olson

v8.8.1 looks good to me!

But still, you can pass me the malicious ad’s link.