Repository navigation
feat: add ACR blocklist and rebuild smart-tv coverage - #6
Merged
Merged
Conversation
Prompted by the September 2026 Gamers Nexus investigation into LG TVs and the wider ACR reporting around it. New DNS/acr/ (765 domains) is the narrow list: the fingerprint ingest endpoints and the ACR vendors themselves, leaving the app store, firmware updates, sign-in and streaming apps alone. Covers Samsung ACR, LG Ad Solutions and Alphonso, Vizio Inscape, Samba TV, Roku, the Nielsen and INFOnline measurement panels, and the CTV ad infrastructure fed by ACR segments. DNS/smart-tv/ goes from 48 to 1955 domains and is now the aggressive superset, adding home-screen profiling, recommendation engines, diagnostics and usage telemetry for LG, Samsung, Sony, Panasonic, Philips, Hisense/VIDAA, TCL, Toshiba, Vizio, Roku, Fire TV and Xiaomi, plus HbbTV red-button tracking. Most LG entries came from enumerating LG's per-country endpoints rather than from an existing list. 1582 hostnames answered, among them the lgrecommends home-screen profiling set that does not appear in the public lists. A nonsense label returns NXDOMAIN on every pattern, so these are individually provisioned records, not a wildcard. New IP/smart-tv/ (315 addresses) is the firewall backstop, because Samsung and LG sets carry resolver addresses in firmware and some fall back to DoH. Eight AWS addresses alone front 316 of LG's per-country ad hostnames. Also refreshed: tiktok +315, tracking +48 (session replay, CTV adtech), microsoft +30, google +25 (Android TV, beacons), chinese-shops +20, meta +13. IP/datto-kaseya re-resolved, 73 to 69 as several had rotated. Left deliberately: the allowlist keeps lgtvsdp.com and lgappstv.com, which under NextDNS suffix matching shadow 535 of the new LG blocks. Removing them risks the LG Content Store, so the allowlist header documents the trade-off instead of making that call silently. Pi-hole matches exactly and is unaffected. Not done: the politie.nl malafide handelspartijen register from issue #4. Both politie.nl and archive.org are refused by this environment's egress proxy, and the register mixes fraudulent shops with hijacked domains of real businesses, so guessing entries from news coverage would block legitimate companies. Noted as a pending import in the scam list header. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTFHBX5eKxuSiyM9pJyNSM
Both were apex entries. Under NextDNS suffix matching they switched 535 of the LG entries in DNS/smart-tv/ back on, including the rdx2 data exchange and the lgrecommends home-screen profiling endpoints. samsungcloudsolution.com and samsung.com stay. They still shadow 30 entries between them, but Samsung account sign-in and the app store run on those, so the headers say so rather than removing them too. Allowlist goes from 139 to 137. Headers in DNS/allowlist/ and DNS/smart-tv/ and the README updated to match. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTFHBX5eKxuSiyM9pJyNSM
There was a problem hiding this comment.
🟡 Changes recommended
Remove the OTA block and shared anycast firewall entries, and correct the documented IP coverage figures.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds ACR and expanded smart-TV DNS/IP blocklists, refreshes related lists, and updates documentation and allowlist behavior.
Changes:
- Adds ACR and smart-TV coverage.
- Expands tracking, vendor, and marketplace lists.
- Refreshes Datto/Kaseya data and documentation.
- Requires correction of OTA and shared-anycast firewall entries.
File summaries
| File | Summary |
|---|---|
README.md |
Documents lists and usage |
IP/smart-tv/ips.txt |
Adds smart-TV firewall addresses |
IP/README.md |
Documents IP-list usage |
IP/datto-kaseya/ips.txt |
Refreshes Datto/Kaseya addresses |
DNS/tracking/hosts.txt |
Expands tracking coverage |
DNS/tracking/domains.txt |
Expands tracking coverage |
DNS/smart-tv/domains.txt |
Expands smart-TV coverage |
DNS/scam/hosts.txt |
Documents deferred register import |
DNS/microsoft/hosts.txt |
Expands Microsoft coverage |
DNS/microsoft/domains.txt |
Expands Microsoft coverage |
DNS/meta/hosts.txt |
Expands Meta coverage |
DNS/meta/domains.txt |
Expands Meta coverage |
DNS/google/hosts.txt |
Expands Google coverage |
DNS/google/domains.txt |
Expands Google coverage |
DNS/datto-kaseya/hosts.txt |
Refreshes Datto/Kaseya lists |
DNS/datto-kaseya/domains.txt |
Refreshes Datto/Kaseya lists |
DNS/chinese-shops/hosts.txt |
Expands marketplace coverage |
DNS/chinese-shops/domains.txt |
Expands marketplace coverage |
DNS/allowlist/hosts.txt |
Removes conflicting LG exceptions |
DNS/allowlist/domains.txt |
Removes conflicting LG exceptions |
DNS/acr/hosts.txt |
Adds ACR hosts |
DNS/acr/domains.txt |
Adds ACR domains |
Review details
- Files reviewed: 23/25 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Four findings from the Copilot review, all confirmed against the data. samsungotn.net, www. and rwww. removed from DNS/smart-tv/. OTN is Samsung's over-the-network firmware update channel, so blocking it stops the TV picking up security fixes while the list header promised updates would keep working. The header now says why it is absent and how to add it back if freezing firmware is the goal. 1955 to 1952 domains. Five addresses removed from IP/smart-tv/: the two Cloudflare addresses behind inscape.tv, the two behind ads.roku.com, and the Akamai address behind aic-ngfts.lge.com. These are anycast, shared by unrelated services, so a firewall drop takes down arbitrary traffic rather than the TV. All three hostnames stay blocked by name in DNS/acr/, which is the right layer for them. 315 to 310. The header note about eight LG addresses each serving 316 hostnames read as if it described the whole LG section, which lists 26 addresses covering 597. Reworded so both figures are stated and neither contradicts the other. Counts in README.md and IP/README.md updated to match. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTFHBX5eKxuSiyM9pJyNSM
Handover scripts from the session that built the ACR list and validated every commit; keeping them in the repo instead of a throwaway container so the enumeration can be rerun later.
Closes #4. Adds the 368 website entries from the Dutch police's known fraudulent-trader register to DNS/scam (14 -> 382), cross-checked the extracted list against a second raw fetch of the page to rule out transcription errors. Bank accounts, phone numbers and email addresses from the register are out of scope for a DNS blocklist and are not imported. The register mixes fraudulent shops with domains of real businesses that may have been hijacked; the list header now documents how to correct a false positive.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Samenvatting
Aanleiding is het Gamers Nexus-onderzoek naar LG-TV's van september 2026 en de ACR-berichtgeving daaromheen.
Type wijziging
feat— nieuwe pagina, sectie of functionaliteitChecklist
type: korte omschrijving)