The Redirect Chain That Bypasses Your Ad Blocker

说明与用途

重定向链分析器通过测量跳转次数、延迟和头信息变化来检测恶意广告点击，绕过静态黑名单。

问题

Static ad‑blocker blocklists miss malicious ads that use fast‑rotating multi‑hop redirect chains, allowing attackers to bypass filters before domains appear on blocklists.

结果

The analyzer detects malicious redirect chains by focusing on behavioral signals rather than domain names, enabling real‑time blocking of novel malicious ads.

工作流

• 1. Install Python and requests library.
• 2. Copy the provided analyze_redirect_chain function into a script.
• 3. Optionally create a YAML config to set max_hops, whitelist_domains, score_threshold, and ignore_known_platforms.
• 4. Run the script against target URLs to collect hop metadata.
• 5. Feed the hop data into a scoring algorithm that weights hop count, delay variance, and header anomalies.
• 6. Flag chains exceeding the score_threshold for manual review or automated blocking.
• 7. Update the whitelist and thresholds as needed to reduce false positives.

证据

Static blocklists fail because they only check the final destination. An attacker can create a new domain, run it briefly, and move on before your list refreshes.

来源

The function captures the status code, next location, elapsed time, and the referrer policy at each step.

来源

A score based solely on hop count will flag real campaigns. Adding a whitelist of known ad-platform domains reduces noise while maintaining sensitivity.

来源