Nordic Filters report centre (Nordiske filtre rapportsentral)

[DandelionSprout]

Spun off from #779 for convenience and to hopefully make things tidier.

General guidelines:

• A report post can be for multiple sites, but it is strongly recommended that further sites be handled as separate posts instead of as "EDIT" sections.
• English is recommended, but I also allow Bokmål, Nynorsk, Danish, and Swedish, and I will do my very best to reply back in those languages in such cases (Finnish is strongly discouraged, as my Finnish vocabulary is less than 30 words, almost all of them food-related).
• If I struggle hard to reproduce something, or there's substantial concerns about the test environment, it may be requested to move a report to https://github.com/DandelionSprout/adfilt/issues

Additional rules added later on:
• 11th of July 2024: If a hidden, secret, private or offline source for entries is hinted to, talked about or linked to, you agree to that I/we will have dirt on you. Publicly available sources are not affected by this.

[THEtomaso]

Issue:

Empty ad container @ bt.no.

Example:

https://bt.no/i/jl5e09/
(scroll down and locate the grey container that goes horizontally, straight across the screen)

Possible fix:

bt.no##div[id^="blink-ad-"]:upward(1)

Note:

There's also a paywall that prevents you from loading the article more than a few times.
Don't know if anything can be done to counteract it.

[DandelionSprout]

Seems to be article-dependent, with some being instantly behind paywalls, and some apparently being unlimited. Looking through https://www.bt.no/nyheter/okonomi/i/WRPG6k/slik-holdt-erna-solbergs-naermeste-brev-dokumenter-og-mannens-navn-unna-offentligheten, I found the banner in question, and will hopefully get it fixed within 10min.

[DandelionSprout]

0f8a160 🌞

[THEtomaso]

There are more of the same sort now..

Example:
https://bt.no/i/l3Paae/

Possible fix:
bt.no##[class^="advertory-"]

[DandelionSprout]

571d510 🌞

[THEtomaso]

There are screenshots of a couple of scam links here:
https://elbil24.no/79400373/

Of course, at the point where such domains are commonly known, they're most likely abandoned already.
Nevertheless..
||easypark-id.com^$all
||easypark-no.org^$all

[DandelionSprout]

The domains seem to be hosted on 74.119.239.234 and 162.241.194.206 respectively, which would've lended it well to mass-blocking if not for how the 2 addresses have more than 15,000 domains combined. This will take a while to look into.

[iam-py-test]

easypark-no.org looks dead.

[THEtomaso]

Guess this sort of solution is a tad harsh?:
||easypark*.*^$document,domain=~easypark.com|~easypark.net|~easyparkgroup.com|~easyparkpartners.com|~easyparksystem.net

[DandelionSprout]

I've seen worse ideas over the years, but I'd probably go for ||easypark-$document or something. The dash seems to make all the difference in my eyes.

[DandelionSprout]

799d1a7 🌞

[THEtomaso]

There are large, empty placeholders @ vg.no now.
vg.no##[id^="finn-banner"] takes care of them!

--

EDIT:
@iam-py-test:
This issue should probably be prioritized (considering that vg.no is the most used site in Norway), and DS seems to be AWOL, at the moment.

[DandelionSprout]

571d510 🌞

[THEtomaso]

Issue:

The betting banner @ vglive.vg.no is back again!

Example:

https://vglive.vg.no/kamp/kristiansund-vålerenga/632530/rapport/

Screenshot:

Possible fix:

vg.no##.norsk-tipping-widget

..or perhaps even something like this?:

||dnbrci3nrwpcs.cloudfront.net^$domain=~norsk-tipping.no

[DandelionSprout]

I'll take a further look later this week. If I still can't find it by then, I'll add at least 1 of those 2 entries anyway.

[THEtomaso]

Yeah, you'll have to click on an ongoing match, of course.

##.norsk-tipping-widget contained an iframe from dnbrci3nrwpcs.cloudfront.net, which belongs to Norsk Tipping.
You can actually visit that domain, and you'll see that it's branded with their logo.

[DandelionSprout]

8b13aaf 🌞

(I'm not 100% comfortable blocking Cloudfront subdomains unless they're known for malware, but I won't rule it out in the future.)

[THEtomaso]

Issue:

Large, empty ad boxes @ dn.no.

Example:

https://dn.no/2-1-1567004/

Possible fix:

dn.no##.top-ad-placeholder

--

EDIT:

Also, a new deblurrer is needed for Plus articles.

Example:
https://dn.no/2-1-1566721/

Fix:
dn.no##.shadow::before

[DandelionSprout]

I can't seem to find the placeholders at the moment; dn.no##[id^=dn_toppbanner] in Nordic Filters is supposed to fix them already.

dn.no##.shadow::before sadly didn't work, but dn.no##div[style*=linear-gradient] seems to work.

[DandelionSprout]

b3ca366 🌞

[THEtomaso]

dn.no##.shadow::before sadly didn't work, but dn.no##div[style*=linear-gradient] seems to work.

Confimed.
They've already changed it!

[THEtomaso]

Issue:

Ads @ nettavisen.no.

Screenshots:

Possible fix:

nettavisen.no##.commercial

--

EDIT1:

Also, their front page contains an annoying job advertisement carousel (about half way down).

Don't know if you'd want to get rid of it, but here's a possible fix, anyway:
nettavisen.no#?#amedia-resizable-iframe:-abp-has([src*="/stillingskarusell/"])

--

EDIT2:

There's another one of those job carousels @ https://borsen.dagbladet.no/

It's easely removed with dagbladet.no##.borsen-job-carousel

@DandelionSprout:
Let me know your current policy regaring those things.

[DandelionSprout]

The Eurojackpot and Shoppingtips banners are definitely going down. I'll analyse the rest.

[DandelionSprout]

Job carousels are allowed to stay, however.
———————————
571d510 🌞

[THEtomaso]

OK

[THEtomaso]

571d510

That doesn't take care of them all.
If you're gonna do it the hard way, like that, you currently need to include a[href^="/sportspill/"] as well, and whatever else they might come up with next.

[DandelionSprout]

It has been the case for years now that newssites mix in at least some sort of football news in football betting pool adticles, so they're not only only to block. Exceptions are if the articles contain no relevant news or analysis whatsoever, which has happened twice in 4½ years.

I took care of ones in another report that simply redirected directly to Norsk Tipping, at least.

[THEtomaso]

Issue:

The Nordic filter's stylesheet rules for aID overlays seems to be failing @ ba.no.

Example:

https://www.ba.no/vis/trafikk/

Screenshot:

Possible fix:

Simply ###aid-overlay ??

[DandelionSprout]

I honestly didn't expect 5 reports in the span of 2 days, as I was mostly busy trying to cure a rash with various gels in that time. 😅 I'll see which ones I can look through tonight.

[THEtomaso]

Don't forget this one:
#932 (reply in thread)
:)

[DandelionSprout]

b3ca366 🌞

[THEtomaso]

Issue:

Ads masquerading as articles @ https://www.elbil24.no/

Screenshot:

Possible fix:

elbil24.no#?#article:-abp-has(.kicker:-abp-contains(Annonse:))

[DandelionSprout]

571d510 🌞

[THEtomaso]

Issue 1:

• Large, empty containers @ https://www.an.no/, https://www.ifinnmark.no/, https://www.nord24.no/, etc.
  (scroll down a little bit)

• Large betting banner (disguised as an article) @ https://www.h-avis.no/
  (scroll down a little bit)

Possible fix:

Something generic perhaps, like this?
no#?#optimus-element:-abp-has([itemtype*="adplogger.no"])

--

Issue 2:

There's a similar large, empty container @ https://www.firda.no/
(scroll down a little bit)

Possible fix:

I would assume that other Amedia sites features the same thing, so perhaps this also qualifies for a generic fix, like this?:
no#?#amedia-resizable-iframe:-abp-has([src*="ad.amediakreativ.no"])
EDIT: Scratch that..
Unlike the first issue, I weren't able to locate this container anywhere else, so a site-specific fix, like this one, should be sufficient (I hope):
firda.no#?#amedia-resizable-iframe:-abp-has([src*="ad.amediakreativ.no"])

[THEtomaso]

(...)#?#optimus-element:-abp-has([itemtype*="adplogger.no"]) doesn't seem viable for at least ifinnmark.no, where it'd block a web series and the "Siste nytt" feed.

Those "Siste nytt" widgets are nothing but useless annoyances in my book.
Everything that are mentioned in them are displayed directly below!

Don't know which "web series" you're refering to (perhaps you could point it out for me?), but I've had this network rule in my filter list since forever, and I can't say that I've missed anything because of it:
||adplogger.no^

--

I can't find any actual placeholders that such an entry would've fixed either.

In the case of ifinnmark.no, it's an empty container which supposedly seems to hold a realestate carousel (which you're already blocking at ba.no, and on a generic third party level from finn.no).

--

PS:
Don't forget about these ones:
#932 (reply in thread)
#932 (reply in thread)

[DandelionSprout]

I at least think this is a webseries?

[THEtomaso]

OK, I see that I'm also blocking it with ##.optimus-complex-front, so I might have to look into this.
But for me personally, my first thought is that the pros of having those rules far outweighs the cons!

[THEtomaso]

At least, changing these rules..

ifinnmark.no##.optimus-complex-front
ifinnmark.no#?#optimus-element:-abp-has([itemtype*="adplogger.no"])

..into these

ifinnmark.no##.optimus-complex-front:not(h2:has-text(BaDesKen TV))
ifinnmark.no#?#optimus-element:-abp-has([itemtype*="adplogger.no"]):not(h2:has-text(BaDesKen TV))

..fixes the issue at ifinnmark.no.

But of course, that thing is subject to change, so the rules are not suited for your Nordic list.

[DandelionSprout]

At that point of narrowing, I admit things get a bit complicated. 😅 At that point I presume it's more convenient for me to just go through one row at a time if further ads occur.

[THEtomaso]

Issue:

Large ads @ digi.no
(one at the top, and one a bit further down)

Possible fix:

digi.no#?#.flex:-abp-has([id^="brandBoard"])
plus
digi.no##.max-w-screen-lg:style(padding-top: 12px !important;) (to uncramp the area below the site header).

[DandelionSprout]

These seem to work better than expected:

digi.no##.items-center.mx-auto
digi.no#?#div[id^=row-]:has(.preamble-shadow)

It also worked far better than expected (as of 25min of testing) to use CRC 5-56 almost everywhere on my mouse to fix the left button. If the improvement sticks around, then I honestly cannot believe it worked that well.

[DandelionSprout]

8b13aaf 🌞

[THEtomaso]

These seem to work better than expected

Still needs an uncramping rule though.

It also worked far better than expected (as of 25min of testing) to use CRC 5-56 almost everywhere on my mouse to fix the left button.

That must be one of the few things that I've actually never used it for. 😄

[THEtomaso]

Issue:

There's a bunch of ads, empty containers and various annoyances @ viralomania.com.
I've added some rules for it to my own filter (which you know where to find), but you'd probably want to go through it yourself.
Personally, I think it almost qualifies for ||viralomania.com^$doc.

[iam-py-test]

Off topic, but found an interesting tracking parameter on that site: 99ce77a
Thanks

[THEtomaso]

found an interesting tracking parameter on that site

I don't see it, so it must be loaded through some other third party crap, which I'm already blocking, perhaps.

[DandelionSprout]

8b13aaf 🌞

(I pondered on blocking the bottom-most bar as part of the "Empty padding" category too, but skipped it for now.)

[iam-py-test]

I don't see it, so it must be loaded through some other third party crap, which I'm already blocking, perhaps.

It was on a subresource, so debatable if it was worth blocking. Just contained the current URL, which could already be obtained though simpler means.

[DandelionSprout]

If anyone wonders, I have become aware of https://www.tv2.no/nyheter/innenriks/advarer-om-svindel-sms-sender-aldri-slike-henvendelser/16284207/, but various problems means it may take 48hrs before I can take care of that or the above reports.

[DandelionSprout]

8b13aaf 🌞

[THEtomaso]

Issue:

Another empty placeholder @ nettavisen.no.

Screenshot:

Possible fix:

nettavisen.no#?#optimus-element:-abp-has([itemtype*="/AdvertiserContentArticle"])

[DandelionSprout]

Though I couldn't find placeholders as such, the fix matches 2 adticles that I'll process.

[DandelionSprout]

ef5e506

[THEtomaso]

Off topic, but found an interesting tracking parameter on that site

Speaking of tracking, it seems that m$ have been stepping up their game at GitHub..
I now have to verify my device every single time that I log in! :(

--

EDIT:
Looks like they've reverted that behaviour now.

[THEtomaso]

Rules for some false Norwegian news sites:

||betzykrisesenter.no^$doc
||citra2010oslo.no^$doc
||digiter.no^$doc
||easydisplay.no^$doc
||kjaerra.no^$doc
||kontrast1.no^$doc
||norskmatkultur.no^$doc
||norskoffroadteknikk.no^$doc
||nyematoghelse.no^$doc
||securmarksykkel.no^$doc
||thecoolgirl.no^$doc
||topshineauto.no^$doc
||vossblues.no^$doc
||yttersiden.no^$doc

Source:
https://nettavisen.no/5-95-1523299/

[iam-py-test]

Thank you for reporting this. I have fixed it in 43301bf and 1176a09.

[DandelionSprout]

While somehow being less awake today than usual, I did some slow and peaceful(?) research and found that most or all of those domains are on 162.214.80.109 and 162.214.80.140. (A few are on Namecheap and can be presumed to be dead.) I was also eventually able to prove that the top domains for either of them were dubious at best too, e.g. technofunk.com.

Both IPs are listed with "10,000+" domains each, so we'd be talking in the area of 7 hours if I were to add all of those domains to Anti-Malware List.

[DDA78]

our company domain naturescrest.com is blocked due to above rule in your list, can you please check and remove, below is the specific line in your list that's causing the issue, ours is legitimate website.

://162.214.80.
! #932 (comment)

[DandelionSprout]

I had an E-mail notification for it earlier yesterday. I was able to check that the IP range covered far too many domains (similar to Cloudflare's IP addresses) to warrant a block after all, so indeed the domain (naturescrestCOM) should no longer be affected by it as of today (Sunday).

[THEtomaso]

Issue:

Empty ad box in all tutorial pages @ http://www.datamaskin.biz/

Example:

http://www.datamaskin.biz/Feilsoking/convert-files/181851.html

Possible fix:

datamaskin.biz##.ad2

[DandelionSprout]

Though the site seems dubious at best, there's no sign of malware or casino hijackers on the site, so I'll handle that site (including your entry 🌞) as soon as a Titralac have got me into shape for the evening.

[THEtomaso]

Though the site seems dubious at best, there's no sign of malware or casino hijackers on the site

Yeah, I came to the same conclusion.

as soon as a Titralac have got me into shape for the evening.

Maximum dose: 20 per day! :)

[THEtomaso]

@DandelionSprout:

https://vglive.vg.no/ has been given a new design.
..and of course, as always; it's much worse than the old one!

At least, vglive.vg.no##.fantasy-promotional-banner is easely justified.
Especially since the target page seems to be so full of tracking that it won't display correctly in any of my browsers, even with uBO disabled!

Also, when opening a match, there are huge Twitter widgets that clutters the event list!
This can be properly removed with the following rules:
vglive.vg.no#?#div.report-item-wrapper:-abp-has(.report-item__media-tweet)
||twitter.com^$domain=vglive.vg.no

[DandelionSprout]

I know I tend to be somewhat slow to react to live football matches, but on 2 occasions this week have I failed to see the Fantasy banner, or really any banner that I can see.

[THEtomaso]

Deblurrer for Pluss articles @ https://www.minerva.no/:
minerva.no##.teaserContent::before

[THEtomaso]

@DandelionSprout:
Considering all those filter lists of yours..
How about one that removes those silly AI summaries, which seems to infest more and more news articles these days?
I've blocked the ones that I've encountered myself, so if you need any pointers, you know where to look.

[DandelionSprout]

I had a chaotic weekend where I had to restitute every bit of energy I could get, so I was only able to reply to this now.

I've come across one, tv2.no##.ai-factbox-summary, and as odd as it may sound, I actually find the summaries to be convenient, in part because it makes me able to skip the legally mandated but very awkward counter-statements from various companies mentioned in the articles.

I have some faint plans to create one or two new lists for other topics, but it's going slowly.

[THEtomaso]

Issue:

Deblurrers are needed for most of DN Media Group's sites.

Examples:

https://dn.no/7-1-r8b79j5s6_/
https://europower.no/2-1-1676264/
https://fiskeribladet.no/2-1-1674743/
https://hydrogeninsight.com/2-1-1676337/
https://intrafish.com/2-1-1674438/
https://intrafish.no/2-1-1675058/
https://rechargenews.com/2-1-1675893/
https://tradewindsnews.com/2-1-1677018/
https://upstreamonline.com/2-1-1676504/

Possible fix:

This will take care of the most of them:

europower.no,fiskeribladet.no,hydrogeninsight.com,intrafish.*,rechargenews.com,upstreamonline.com##.shadow::before

This (although not very elegant) takes care of the one at tradewindsnews.com:

tradewindsnews.com##.article-center-column > div > div > div:style(background-image: none !important;)

And this (even less elegant) seems to take care of the one at dn.no (at least for now):

dn.no##vev[id].__frame > div[id].frame.frame.__wc.__c:style(background-image: none !important;)

Note:

I also noticed the abtest parameter @ intrafish.com.
..so ||intrafish.*^$removeparam=abtest for ALUST?

[DandelionSprout]

I admit that I've felt I had to make deblurrers a lower priority recently, so that I could focus on all sorts of other things in my life in general. 😓 I cannot readily commit to a guarantee time for when it would be handled again, unfortunately enough.

[THEtomaso]

Well, if you ever get around to it..
vestnesavisa.no##.faded-content::before @ https://www.vestnesavisa.no/2024/nyheiter/hald-pa-hatten-i-dag-kan-det-blese-godt/

[THEtomaso]

Issue:

A blocked tracking pixel (blocked by 'EasyPrivacy') prevents people from creating new accounts at smn.no / sparebank1.no.
There's probably not much point in reporting at the EasyList repo, since it only appears at the end of the registration process, and I don't have a screenshot of it, or anything.

Possible fix:

Fix for 'Dandelion Sprout's Nordic filters for tidier websites' (@DandelionSprout), or pherhaps for 'uBlock filters - Unbreak' (@Yuki2718):
@@/pm-blikunde/1x1.png$domain=smn.no|sparebank1.no

Note: the pixel doesn't seem to be needed for anything else than the registration process, so make sure that you include the /pm-blikunde/ part!

[DandelionSprout]

Thanks for the tip. I'll look into it tomorrow (Thursday).

[DandelionSprout]

A small heads-up in advance if there's wondering about it, smn.no seems to merely be a redirect to sparebank1.no, including what little I can tell about the login process (I admit I use an Eika bank instead of Sparebank1). If screenshots can tell otherwise, I'd be all ears.

sparebank1.no I'll handle very soon now.

[THEtomaso]

smn.no and sparebank1.no were two separate sites before, and your regional location determined which one to use.
But I can confirm that all of their regions seems to use, and redirect to, sparebank1.no now.

[THEtomaso]

Article about another ongoing scam (with screenshot of an URL):
https://tv2.no/16835010/

[DandelionSprout]

Unfortunately(?), the screenshot was apparently from January of an unspecified year, and its URL yields no results with https://redirectdetective.com/

Admittedly that means 1 fewer scam attempt to handle, but still.

[THEtomaso]

I saw no reason to specifically block it myself either, since I'm already blocking that whole TLD by default anyway. :)

[THEtomaso]

Article with a picture that shows a couple of new scam links:
https://sol.no/81812194/

[DandelionSprout]

Thanks for the tip. It appears the two domains in that picture are from the same IP, namely 193.143.1.45. I'll therefore handle that IP address tomorrow (Saturday), which also seems to have more than 100 other scam domains registered on that same IP address.

[THEtomaso]

I went through some Norwegian news sites, for the first time in a few weeks, and was met with a barrage of subscription popups, empty ad boxes, real estate carousels and shopping tips!

Here are some of the rules that I've come up with, so far (should be pretty much self-explanatory):

||acdn.no^*/subscription-product-marketing/ (manifests itself @ nettavisen.no, and a bunch of the sites below)

adressa.no,altaposten.no,avisa-st.no,bladet.no,dolen.no,driva.no,fjordabladet.no,fjordingen.no,fjt.no,fjuken.no,folkebladet.no,fosna-folket.no,framtidinord.no,hitra-froya.no,ht.no,inderoyningen.no,innherred.no,itromso.no,morenytt.no,namdalsavisa.no,nyss.no,opp.no,rbnett.no,smp.no,snasningen.no,steinkjer-avisa.no,t-a.no,tronderbladet.no,vestlandsnytt.no,vigga.no,vikebladet.no,vol.no##.AdWithTeaser

ao.no#?#optimus-element[id^="art-"]:-abp-has(.lp_smartembed_smartembed-shopping)

auraavis.no,inderoyningen.no,namdalsavisa.no,norddalen.no,op.no,snasningen.no,t-a.no,tronderdebatt.no##.realestatecarousel

inderoyningen.no,namdalsavisa.no,snasningen.no,t-a.no#?#.optimus-complex-front:-abp-has([param-url*="deals.innocode.no"])

lofotposten.no#?#optimus-element[id^="art-"]:-abp-has([param-url*="ad.amediakreativ.no"])
lofotposten.no#?#optimus-element[id^="art-"]:-abp-has([param-url*="deals.innocode.no"])

[THEtomaso]

Issue:

gamer.no needs to be cleaned up again (front page and articles).

Suggestions:

gamer.no##[data-uname^="gamer_netboard"]
gamer.no##[data-uname="gamer_artikkelboard"]
gamer.no##[data-uname="gamer_toppbanner"]:upward(1)
gamer.no#?#.deal-container:-abp-has(a[href*="prisjakt.no"])
gamer.no#?#.entrance:-abp-has(a[href*="/annonser/"])
gamer.no#?#.entrance:-abp-has(a[href*="/stilling/"])

(Perhaps even more rules, if I've bothered to disable my own filter)

[DandelionSprout]

I'll handle that site sometime early this week, although not tonight (Sunday).

[DandelionSprout]

5 of the 6 entries work very well, I'll gladly admit ( (...)netboard(...) being the only one I couldn't seem to find matches for).

Some I slightly changed to more or less reduce chances for false positives, but your suggestions were pretty good. 679cc7e

[THEtomaso]

Issue:

There's an ad in all articles @ rett24.no.

Possible fix:

rett24.no##[class*="_job-ad-article"]

[DandelionSprout]

Checking https://rett24.no/articles/e18-naboene-i-baerum-tapte-kampen-om-millionerstatninger-for-utbyggingsbraket, it would unfortunately be unfair to block ads for job listings when they too are hosted on rett24.no. I myself know all about how difficult it is to get a job within Norway, or even to be called in for an interview at all.

Screenshot of the page:

[THEtomaso]

In case you missed it, there's a "Ledige stillinger" button in the page header, which takes you to all of the job listings.
Those in-article containers should be considered ad clutter, imo.
I think the fact that they're labed with "Annonse" / "Ad", shows that the webmasters themselves sees it that way too! :)

[THEtomaso]

Issue:

Labeled ad containers @ https://www.elbil24.no/video/, https://www.kk.no/video/ and https://www.seher.no/video/.

Possible fix:

- dagbladet.no,sol.no##.adunit:upward(1)

+ dagbladet.no,elbil24.no,kk.no,seher.no,sol.no##.adunit:upward(1)

[DandelionSprout]

I can confirm the entry works on individual videos' pages, and I also found a second entry for KK's video menu (kk.no##.carousel-container + div:not(.carousel-container):has(> div:last-child)).

[THEtomaso]

What does that rule actually do?
If there are ads in that carousel, I can't seem to locate them.

Anyway, its complete lack of a scrollbar makes it one of the worst video carousels that I've ever seen!
Simply removing it with kk.no##.carousel-container:has-text(Anbefalte videoer) seems like the best course of action.

[DandelionSprout]

It was for this one:

Screenshot:

[THEtomaso]

AFAICT, it's covered by the other rule, so I don't see the need for it.

[THEtomaso]

Just mentioning this one, since it definitely qualifies as an annoyance, in my book:
https://vg.no/i/zA89gw/:
vg.no##[class*="_vglab_box_"]

[THEtomaso]

@DandelionSprout:
An article about a rather dubious site:
https://nettavisen.no/5-95-2045247/

[DandelionSprout]

I was only able to take a full look at the site tonight, and since there's no signs of their "store" re-opening in the near future, I suppose the situation pretty much fixed itself.

[iam-py-test]

I found a Norwegian fake dating website: paradismatch.com.
I can't read Norwegian so can't investigate much, but most of the users' profile pictures are copied from porn sites.
Imre, I can share more information if needed.

[DandelionSprout]

From gradually looking through and thinking on various involved clues, there seems to be 30 sites involved in that fraud:

bigonyou.com
chattrummet.com
datingcashexperts.com
dejtingpalatset.com
dejtingrummet.com
dinnyevenn.com
ensamkontakt.com
finnenelsker.com
flingtalk.com
flirtseason.com
hemlighetsportalen.com
katesingler.com
lekendating.com
leklust.com
meetupz.app
myfuckfriends.com
mynextcrush.com
noenlikerdeg.com
norskchathub.com
noticetick.com
paradismatch.com
romancestarter.com
seksuelllyst.com
singelflirten.com
singelkontakt.com
singelogklar.com
singelplatsen.com
talknotice.com
treffraskt.com
vennlighallo.com

I've concluded 100% that the sites are run by a fairly complicated Cyprus-based tax evasion scheme, plausibly even involving money laundering. I have however not been able to conclude 100.0% that the sites are involved in theft of site-visitors' money or credentials, though the apparent non-existence of any theorethical users of any of those sites who'd have shared info on them seems super-fishy indeed.

[THEtomaso]

I think you can safely block all of those sites, based on their names alone.

[iam-py-test]

I'm curious how you discovered those other websites.
Thanks

[DandelionSprout]

From how I remember it, it went something like this:

1. Googled paradismatch.com.
2. One of the search results was for its Hurricane Electric BGP listing (https://bgp.he.net/dns/paradismatch.com)
3. Its IP address was listed as 37.46.122.6, so I clicked on it on that page to get to https://bgp.he.net/ip/37.46.122.6
4. Its "Announcement" section was listed as 37.46.122.0/24, so I click onwards to there.
5. Looking at https://bgp.he.net/net/37.46.122.0/24#_dnsrecords, a specific few of the IPs had clusters of date-fraud sites.