Resolved: Long time pi-hole user, all of a sudden google ads getting through


#1

I have been using pi-hole for a long time. In the last two days I noticed ads have started to appear on sites like The Verge and ESPN. Here’s an example of the image source from the page that was served to me:

<img src="https://tpc.googlesyndication.com/simgad/7382299282673983833" border="0" width="970" alt="" class="img_ad">

The domain - tpc.googlesyndication.com - is in the blacklist:

Match found in list.0.raw.githubusercontent.com.domains:
 tpc.googlesyndication.com
Match found in list.2.sysctl.org.domains:
 tpc.googlesyndication.com
Match found in list.6.hosts-file.net.domains:
 tpc.googlesyndication.com
tpc.googlesyndication.com.proxy.c9w.net

Any ideas?


#2

Has your network changed (added IPv6 where it wasn’t available previously?). If the Pi-hole wasn’t set to block IPv6 and your network has recently become v6 enabled then you’ll most likely get adverts via that. And do you have any secondary DNS servers on your configuration?


#3

Here’s a screenshot of another one on Techcrunch:


#4

Am running pfSense with IPv6 disabled and have made no changes there. The DNS on the firewall points to one place - the pi-hole. I will double check everything.


#5

Check just to make sure, http://ipv6-test.com should report that the client is not capable. And the usual checks for the clients (/etc/resolv.conf if it’s linux, or ipconfig /all for Windows.)


#6

(Dan, thanks for the attention!)

Looks like IPv6 is indeed blocked. Something sneaky is going on. Did google find an end-around?


#7

If they had I’m sure we’d have a lot more in the way of reports. What is the IP address that is returned when you dig/drill for those domains on the Pi-hole and on the client? (nslookup if it’s Windows.)


#8

This is why they pay you the big bucks… I found some resolution going to 8.8.8.8. Somehow I had that DNS resolver in my Network settings (MacOS) for the WiFi I am on. I removed it and the ads have vanished. Sorry for the alarm. Now to figure out how that entry got there.


#9

Good we found it! Let us know if you run in to anything else.


#10

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.