Suggest websites to add to browser Anubis bypass

Every fucking website now uses either cuckflare or anubis, and instead of having to allow cookies for whatever fuckoff website, I made keyword boomarks to quickly take me to archive.org to bypass this shit.

Except now they seem to really want your fucking cookies, because the URL now turns into a bunch of shit.

https://openwrt.org/.within.website/x/cmd/anubis/api/pass-challenge?response=009da6852f958b303d2a8479639676e575dd83dd5a65c8586b978826f49f4617&nonce=942&redir=https%3A%2F%2Fopenwrt.org%2F&elapsedTime=26

Instead of being able to do wq (url) and getting taken to the archive.org version of the page, instead I have to unencode the url which for this url is easy, but for longer urls will be a massive pain to have to keep doing.

So what I would want is something that detects Anubis and then automatically stops this bullshit and just takes the user to the latest archive.org archive of the page.

I'm not enabling cookies for your shitass site because you hate AI. FUCK YOU I HOPE THE AI REPLACES YOUR ASS

I'd like to note that it's possible to bypass Anubis by simply sending a User-Agent string not containing the string Mozilla anywhere within it. As absurd as this sounds, it worked on a few Anubis'd sites I tried it on.
Note that this could change some sites' behavior, due to a different UA string being used. It would also require re-requesting pages if an Anubis response is sent, and likely storing (caching?) said detection.
You can also just spoof your UA everywhere though this could cause issues on some sites maybe.

Current list and overrides as of r3dfox 151.0.2.

general.useragent.override.archive.softwareheritage.org
general.useragent.override.bugs.freebsd.org
general.useragent.override.dd-wrt.com
general.useragent.override.dolphin-emu.org
general.useragent.override.forum.videolan.org
general.useragent.override.gcc.gnu.org
general.useragent.override.git.ffmpeg.org
general.useragent.override.git.keyedlimepie.org
general.useragent.override.git.lumen.sh
general.useragent.override.gitlab.archlinux.org
general.useragent.override.imgur.artemislena.eu
general.useragent.override.kernel.org
general.useragent.override.mozillazine.org
general.useragent.override.openwrt.org
general.useragent.override.opnxng.com
general.useragent.override.reactos.org
general.useragent.override.repo.palemoon.org
general.useragent.override.salsa.debian.org
general.useragent.override.trac.ffmpeg.org
general.useragent.override.wiki.debian.org
general.useragent.override.wiki.freebsd.org
general.useragent.override.wiki.postmarketos.org
FuckAnubis/5.0 (%OS_SLICE%; rv:140.0) Gecko/20100101 Firefox/140.0 r3dfox/140.0

Hmm, I wonder if this is some sort of optional feature that is enabled by default.

privadency.com and slrpnk.net I still get hit with the Anubis page, and both run v1.25.0, while other sites on v1.25.0 the bypass works completely fine.

Ah it's by design

Anubis decides to present a challenge using this logic:
User-Agent contains "Mozilla"
Request path is not in /.well-known, /robots.txt, or /favicon.ico
Request path is not obviously an RSS feed (ends with .rss, .xml, or .atom)
This should ensure that git clients, RSS readers, and other low-harm clients can get through without issue, but high-risk clients such as browsers and AI scraper bots will get blocked.

Should I make the useragent FuckAnubis/5.0 (%OS_SLICE%; rv:140.0) Gecko/20100101 Firefox/140.0 r3dfox/140.0 for the funny

Edit: I got 1 yes and 0 no's on Discord, so this is the fake useragent now.

Does this capture the UA from the first visit, or from the second one, which is already in the “.within.website” directory? Maybe we could write a header editor that works when the path includes “.within.website”?

I made the UA overrides more specific, for specific subdomains that have Anubis rather than applying to the whole website.

Does this capture the UA from the first visit, or from the second one, which is already in the “.within.website” directory? Maybe we could write a header editor that works when the path includes “.within.website”?

Unsure, why I'm doing it is so I can browse a given website without allowing cookies or JS. I might allow JS if the page is fucked without it, but I don't want to allow cookies for something I'm not going to have a presence on.

I'm going to go back to using LibRedirect as I stopped using it when literally every alternative required cookies and JS, when the source website didn't require cookies or sometimes even JS. This will give me a good idea of what to add to the list in future releases.

privadency.com and slrpnk.net I still get hit with the Anubis page, and both run v1.25.0,

I've found codeberg.org, forum.mozilla-russia.org, forums.debian.net, and techpowerup.com do not work with the bypass

Most (if not ALL) of the sites that work with the Mozilla-less SSUAO have an Anubis challenge difficulty level of 2; slrpnk.net has 3, while the 4 cited in your last comment have a level of 4 😉 ; the Anubis verification cookies have varied lifespans, from 20min (forum.mozilla-russia.org) to 1 week (forums.debian.net) ; I haven't tested many sites though, TBH ...

privadency.com and slrpnk.net I still get hit with the Anubis page, and both run v1.25.0,

I've found codeberg.org, forum.mozilla-russia.org, forums.debian.net, and techpowerup.com do not work with the bypass

Most (if not ALL) of the sites that work with the Mozilla-less SSUAO have an Anubis challenge difficulty level of 2; slrpnk.net has 3, while the 4 cited in your last comment have a level of 4 😉 ; the Anubis verification cookies have varied lifespans, from 20min (forum.mozilla-russia.org) to 1 week (forums.debian.net) ; I haven't tested many sites though, TBH ...

So does this mean that one way to prevent headache with Anubis-protected sites is to save its cookie(s) for relevant sites?

I ask because I could just preemptively set up 'Cookie AutoDelete' rules right now to keep the Anubis cookie {well, all cookies for the sites, as CAD lost years ago the ability to do separate cookies} for those sites I visit often.

Came across a *.mint.lgbt link with Anubis, tried adding to bypass list, but wasn't able to get past.

As for Codeberg, its filter is seemingly more complex. Different variations of the same User-Agent value produce different pages:

Note that the first one I tried was my browser's (LibreWolf) actual string, Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0, which led to the gibberish page with curl, but leads to the JS challenge on my browser (based on headers?).
curl's default UA string, curl/8.20.0 for me, actually works fine with both curl and LibreWolf, though I'm not sure if this will change. git's might be worth a try too.

Also, maybe Codeberg uses iocane? Too lazy to look into that software but the forge hosting it has the ?trans-rights=human-rights query string in common.

Also I find it a shame how the whole scraper situation has led to much of the web requiring JS/Cookies, even sites that would otherwise function perfectly fine without those things.
As a site administrator, I can indeed say the crawlers exist and can cause some types of sites (like git forges) to slow down (and sometimes the whole server in the process, even), but it's possible to filter them out in much less destructive ways (i.e. based on headers).
I suppose this isn't the beginning of this though... cuckflare has been part of the problem for likely over a decade by now. I might as well add sites requiring HTTPS might as well go on this list too; granted, this can prevent accidentally leaking requests to ISPs, but it's also a huge blow for backwards compatibility, and most modern browsers can prevent accidental unencrypted connections in current year anyway.

I'll also confess I've been part of the problem before.
Once I put my forge behind Anubis after a site slowdown incident, but then I wasn't satisfied with the result at all and soon reverted that change.
Much later, I blocked access to some endpoints (like /src/commit), and later implemented a cookie check. I didn't realize how big of a deal this was (seeing how many cookies random sites save sort of opened my eyes). Eventually I reverted this.
Anyway now I have a much better filter. It has some flaws but I'll work on those when I'm less busy.
(sorry this is getting so long but I felt like saying that)

Oh and I forgot to say. Once I noticed that Codeberg always presented the gibberish page to me when I tried to view some pages on my phone (SM-J327T1 running a lightly modded stock 7.0 rom), via the last version of Bromite (ideally I'd run a custom rom but I'm too lazy to port any right now).
The issue has gone away, but I still think this tells a lot about the filter used on that site.

Maybe a stupid question, but why is Cloudflare / Anubis even an issue for r3dfox?
I'm using r3dfox v142.0.1 without any issue for sites using Turnstile/Anubis.

If this is going to be an issue going forward, many non-technical users of r3dfox won't have an idea of the problem, so it may be worth adding code to detect the bot challenge and advising r3dfox user of issue and how to resolve? Or at the least, mentioning it as a known issue in the readme and release notes?
Also consider making the overrides list easily editable in prefs.

it's only an issue if you have cookies and/or javascript disabled, and in that case it's equally a problem on r3dfox as any other browser. The bypass exists to let you use anubis'd sites without having to enable cookies and javascript

How about solving it with an extension?

https://addons.mozilla.org/firefox/addon/anubis-bypass/
https://gitlab.com/zipdox/anubis-bypass

Had I knew that existed, maybe I'd just have used it idk. Since I have this though and it's probably better than relying on third party extension, I'll keep going with this.

Or maybe it is possible to cut elements (or text) from HTML code before parsing?

! uBlock Orgin
*##^script:has-text(x-robot-challange)
! AdGuard MV2
$$script:has-text(x-robot-challange)

https://github.com/gorhill/ublock/wiki/Static-filter-syntax#html-filters

However, I don't know if it fits every page.

These aren't scripts, I get Cuckflare and Shitubis telling me to enable scripts when I try to load a page of theirs without scripts.

So you’re saying that the domain servers are compromised (as if someone had uploaded malware to them, whether intentionally or not)?

Server side Cloudflare/Anubis injection?

I'm not completely sure how it works, but basically it by default will give you the challenge page, and only when you pass it and set the cookie will it allow you in. If cookies are blocked, you either get infinite loop or blocked. If JS is blocked, you get blocked.

Well this doesn't need to be an open issue. It can be closed and I can keep taking feedback of sites to add.

Navigation Menu

Repository navigation

Suggest websites to add to browser Anubis bypass #30

2 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Suggest websites to add to browser Anubis bypass #30

Description

Activity

chipmunkmc commented on May 23, 2026

K4sum1 commented on May 23, 2026

K4sum1 commented on May 23, 2026

K4sum1 commented on May 23, 2026

K4sum1 commented on May 25, 2026

krystian3w commented on May 25, 2026

K4sum1 commented on May 26, 2026

K4sum1 commented on May 26, 2026

2 remaining items

Vangelis66 commented on May 26, 2026

realAzazello commented on May 26, 2026

K4sum1 commented on May 29, 2026

chipmunkmc commented on May 30, 2026

chipmunkmc commented on May 30, 2026

ncc470 commented on Jun 7, 2026

teknixstuff commented on Jun 7, 2026

quroe commented on Jul 9, 2026

K4sum1 commented on Jul 9, 2026

krystian3w commented on Jul 10, 2026

K4sum1 commented on Jul 12, 2026

krystian3w commented on Jul 12, 2026

K4sum1 commented on Jul 12, 2026

K4sum1 commented on Sep 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions