topic Re: weird url to bypass filtering in Peer-Peer Topics

weird url to bypass filtering

ParatrooperJoe — Mon, 25 Sep 2023 15:31:17 GMT

We have been seeing an uptick of student users fnding ways to access otherwise blocked gaming websites while at school (no way, right!).

Most recently, I have noticed url look like this example:

https://9pbkvq3vc4bauslnloca9t4bllk816a4-a-sites-opensocial.googleusercontent.com/gadgets/ifr?url=https://cdn.jsdelivr.net/gh/r3tq6l1/to9d2if10dv@80e256cb3ca3b5793665f5ffb7d62285f2805e86/g7kh63s/bitlife.xml&container=enterprise&view=default&lang=en&country=ALL&sanitize=0&v=a6e633e32d2db5dc&libs=core&mid=206&parent=https://sites.google.com/site/unblockedgame76/bitlife#st=e%3DAIHE3cD32AIyFeUgbeQuB4lmFhKset5MmzRr3ebS5VlkoPLIQ2mBrfERpYTTqLE354h3vXCcWGrV0MKelnyBjWiBna8Izp43QH0eiBMjcptyJwSLIs4I6berl4DXoWWzMeRulvtrcqDi%26c%3Denterprise&rpctoken=5273128876388627158

of course, the website this link is showing is at the very end of this link and is a google sites, which we have blocked, but if they access it from the above link it is bypassnig our filter and allowing the website to load.

I have not tested blocking that full url, but my guess is it will only block this one website and not other websites they might use the same method for. Any ideas on how they are finding such "urls". is this some sort of bit.ly type redirect service? Any ideas on how to block that so that not just the one gaming site gets blocked, but any other website they try and use this method to bypass the filters?

Why is it a problem and why do I care? Basically the students are playing games in class instead of doing work, and yes the teacher assignes whatever discipline is in the student hadn book, but it is becoming an annoying a daily occurrence that the Principals would love if we could find a way to just block this so the students will not be bypassing the web filters.

Thanks in advance for any insight/recommendations you can give!

Re: weird url to bypass filtering

Kim_Nilsson — Mon, 25 Sep 2023 18:46:02 GMT

I'm pretty sure that Securly would block it by adding *unblocked* to the block list.

Re: weird url to bypass filtering

ParatrooperJoe — Wed, 27 Sep 2023 00:00:43 GMT

Thanks @Kim_Nilsson however, we already have that in our blocked list.

I could totally be wrong, but it seems like the filter is seeing and analyzing only "https://9pbkvq3vc4bauslnloca9t4bllk816a4-a-sites-opensocial.googleusercontent.com" before it sees the rest of the link "/gadgets/ifr?url=https://cdn.jsdelivr.net/gh/r3tq6l1/to9d2if10dv@80e256cb3ca3b5793665f5ffb7d62285f2805e86/g7kh63s/bitlife.xml&container=enterprise&view=default&lang=en&country=ALL&sanitize=0&v=a6e633e32d2db5dc&libs=core&mid=206&parent=https://sites.google.com/site/unblockedgame76/bitlife#st=e%3DAIHE3cD32AIyFeUgbeQuB4lmFhKset5MmzRr3ebS5VlkoPLIQ2mBrfERpYTTqLE354h3vXCcWGrV0MKelnyBjWiBna8Izp43QH0eiBMjcptyJwSLIs4I6berl4DXoWWzMeRulvtrcqDi%26c%3Denterprise&rpctoken=5273128876388627158"

And i am worried if I block "*.googleusercontent.com" I will block other things that we probably do not want to block..... and if I include the first part, it probably will block the one website, but I thinking that first part is specific to the one website?

Re: weird url to bypass filtering

Kim_Nilsson — Wed, 27 Sep 2023 05:34:18 GMT

Yes, you are right on both counts.

Google's built-in URL Blocking isn't very flexible.

Re: weird url to bypass filtering

ParatrooperJoe — Wed, 27 Sep 2023 14:10:21 GMT

@Kim_Nilsson Do you, or anyone else know of how these links are being generated? Is there some service or website you know of that creates these types of links? I am guessing it has something to do with: http://cdn.jsdelivr.net ? also wondering what *opensocial.googleusercontent.com even is? Is that a core service provided by google or one of its products?

Re: weird url to bypass filtering

Kim_Nilsson — Wed, 27 Sep 2023 14:20:33 GMT

Nope, no clue where they come from.

Re: weird url to bypass filtering

MaryGrant — Mon, 13 Nov 2023 19:03:58 GMT

Dealing with something similar with webcache.googleusercontent.com and then q=whatever game.... I feel I have exhausted all block logic in GoGuardian so I just added this URL to Google's built-in URL blocking and it doesn't seem to impact anything?? I am watching various kiddos accessing games through that URL in real time right now in GoGuardian. My last resort is to call in a few kids to manually clear their browser history so they lose the cache redirect....not sure that will address it and not sure if that's similar to opensocial or not but this is frustrating for sure!