Help - Search - Members - Calendar
Full Version: Suspicious Code?
Get Paid Forum - Get Paid Discussion > Get Paid To Programs > Sites Allegedly with problems of hacking/virus/0-iframes, autosearches etc ... > Others
astrangemix
recently I've had a couple of ptp site ads which I've been immediately suspicious of because of the high cpm, the one today offers $2 ai.gif

looking through the code there's only 1 iframe and it has a height/width

I am seeing the code below though and while I don't understand it it doesn't really look good to me lol. so does anyone have any idea if this is something nasty

function killErrors() {
return true;
}
window.onerror = killErrors;
click_bid ='This is a URL for the site but it has " atss1.php" on the end of it not the "ads.php" the submitted url has, also contains my ip, name of the site I'm viewing from and a little more info I placed below
a13.location.href=click_bid;

scripts/admin/pload.php?p_load=advmgr&function=requests&type=ptc&jand=' + AdBrite_jsad + '&ads=' + Ads_data;
locotime
QUOTE (astrangemix @ Mar 3 2008, 04:15 PM) *
recently I've had a couple of ptp site ads which I've been immediately suspicious of because of the high cpm, the one today offers $2 ai.gif

looking through the code there's only 1 iframe and it has a height/width

I am seeing the code below though and while I don't understand it it doesn't really look good to me lol. so does anyone have any idea if this is something nasty

function killErrors() {
return true;
}
window.onerror = killErrors;
click_bid ='This is a URL for the site but it has " atss1.php" on the end of it not the "ads.php" the submitted url has, also contains my ip, name of the site I'm viewing from and a little more info I placed below
a13.location.href=click_bid;

scripts/admin/pload.php?p_load=advmgr&function=requests&type=ptc&jand=' + AdBrite_jsad + '&ads=' + Ads_data;


Hmmmm, locolady does those types of ptp sites. Is that the PaidCPM site? There are limited sites that will allow those types of ptp links. I just asked locolady if she has been paid by paidcpm and she did nod yes.
If you are a little good at taking those urls apart you can...
You my want to contact the PO and ask that question, that you posted.
locotime cd.gif
jlandis
QUOTE (locotime @ Mar 3 2008, 01:25 PM) *
Is that the PaidCPM site? There are limited sites that will allow those types of ptp links.


That's because PaidCPM (and others like it) are paying their members to aid them in committing fraud. Their links contain hidden iframes and scripts that defraud PPC advertisers with each click. Many program owners are aware of this kind of illegal activity and don't want it advertised through their sites, so they ban these programs.

PaidCPM links have been analyzed on this forum, if anyone's interested in searching. I posted about it at http://getpaidforum.com/forums/index.php?s...p;#entry4865466
astrangemix

it's not PaidCPM but I would suspect it's the same type of scammy site (if jlandis's post about what's been found with PaidCPM is correct). I myself haven't seen/read anything about them but who else besides sites doing scammy things can afford $2 cpm ar.gif

this is only the 2nd time I've seen this site so it's likely new/newer; We-ads

I also recently ran across this same code in ppk-ads (or something close to that. they used to spread their nasties the old fashioned way with everything but the kitchen sink loading in the background and you could see it lol) if this new code/script is supposed to be doing the same thing though it appears to be invisible, at least I couldn't see anything but my gut is telling me there's almost certainly something not right with this site, I just can't prove it and don't have the time to try which is why I posted here since I know there are some who try to improve our industry by constantly watching and learning about the newest ways of cheating ax.gif

I do not want to reject an ad for no reason but I also do not want to send an ad out that is likely, at best, cheating someone and may potentially even have the ability to mess up some members pc if said member does not have adequate protection.
locotime
QUOTE (astrangemix @ Mar 3 2008, 05:52 PM) *
it's not PaidCPM but I would suspect it's the same type of scammy site (if jlandis's post about what's been found with PaidCPM is correct). I myself haven't seen/read anything about them but who else besides sites doing scammy things can afford $2 cpm ar.gif

this is only the 2nd time I've seen this site so it's likely new/newer; We-ads

I also recently ran across this same code in ppk-ads (or something close to that. they used to spread their nasties the old fashioned way with everything but the kitchen sink loading in the background and you could see it lol) if this new code/script is supposed to be doing the same thing though it appears to be invisible, at least I couldn't see anything but my gut is telling me there's almost certainly something not right with this site, I just can't prove it and don't have the time to try which is why I posted here since I know there are some who try to improve our industry by constantly watching and learning about the newest ways of cheating ax.gif

I do not want to reject an ad for no reason but I also do not want to send an ad out that is likely, at best, cheating someone and may potentially even have the ability to mess up some members pc if said member does not have adequate protection.

I applaude your decision not to advertise such sites. ci.gif
I simply just do not click those sites. Who wants to wait for a page to load as long as some of them do. (Feels like hours to me) There are alot of other "legit" sites that do the same, but in a toned down version. Some sites do not even know that it is going on. SAS has a really good eye out for those kinds of goings on. Check the SAS link here in the forum for details. I think but am not very sure any more. Clickvoyager has the tools to check those links before they let it into rotation. If that link has nasty stuff they will let you know what it is.

Who wants a dose of drive cleaner? Nobody.
locotime cd.gif
wagdoll
Google says we-ads is a sister site to dxptp

QUOTE
We sister site we-ads.com Check advertising page for Specials! We-ads.CPM(SPECIALS!! PTP advertises) 10000 PTP Views price for advertiser: $0.80 ...


DXptp has been using 0 iframes on that site and it's sister sites for over a year. I've never seen any site on this script running without cheating 0 iframes on their PTP pages. But I've never seen a PTP page for we-ads so I don't know what it has on it.
astrangemix
I can pm you the code if you'd like, I'd say link but it's been my experience these sites will redirect any direct hits anyway from the ptp page ar.gif
davidwalker
Its got the same code line as dxptp and the jobstream loads a 0 iframe

<script type="text/javascript" src="ads.js"></script>

which loads

var AdBrite_jsad = Math.round(100000*Math.random());
var Ads_data = AdBrite_jsad + 777;
temp_frame1='<iframe' + ' name="a13"' + ' src="' + '' + '"' + ' width=0 height=0 marginwidth="0" marginheight="0" frameborder=0 scrolling="no"></iframe> ';
document.write(temp_frame1);

David
astrangemix

thank you David aa.gif
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2012 Invision Power Services, Inc.