diff --git a/SpywareFilter/sections/specific.txt b/SpywareFilter/sections/specific.txt
index 2b1206b0fc8..5c9d2fa2a65 100644
--- a/SpywareFilter/sections/specific.txt
+++ b/SpywareFilter/sections/specific.txt
@@ -84,6 +84,7 @@ $cookie=_awl;maxAge=30,domain=nypost.com|al.com|9news.com
 !
 ! NOTE: Specific rules
 !
+||mail.yandex.*/web-api/journal/v1?_m=do-client-log
 ||s3.us-east-2.amazonaws.com/telemetry.bydata/
 ||seaart.ai/log/
 ||cartoonporno.xxx/static/js/lib/counters/
@@ -4686,13 +4687,22 @@ link.gmapp*.net$image
 ! it's problematic that due to how Gmail proxy work, these domains aren't even exposed on the network level
 ! fortunately, extensions can see them (Gmail puts the real URL in the location.hash part of the src)
 !
-! hh.ru
-i.hh.ru/mailing/$image
-i.hh.ru%2Fmailing%2F$image
+! Generic rules
+! Customer.io
+.com/e/o/$image
+.com%2Fe%2Fo%2F$image
+.io/e/o/$image
+.io%2Fe%2Fo%2F$image
+.net/e/o/$image
+.net%2Fe%2Fo%2F$image
 ! Amazon SES
 ! Used with a personal domains of sites. CI0/0 is an unique URL part
 /CI0/0$image
 %2FCI0%2F0$image
+!
+! hh.ru
+i.hh.ru/mailing/$image
+i.hh.ru%2Fmailing%2F$image
 ! Western Digital
 support-*.wd.com/rd/*.gif$image
 support-*.wd.com%2Frd%2F*.gif$image
@@ -4877,9 +4887,6 @@ emea.focusvision.com%2Ftracker%2F$image
 ! 1password.co
 lnk.1password.com/s/eo/$image
 lnk.1password.com%2Fs%2Feo%2F$image
-! Redsift
-link.redsift.com/e/o/$image
-link.redsift.com%2Fe%2Fo%2F$image
 ! Revolut
 click.revolut.com$image
 ! https://github.com/AdguardTeam/AdguardFilters/issues/182885