Forum Thread

Malware in SD ads again

14,379 6,976 April 13, 2017 at 10:32 PM
Have had a few attempted redirects from some ad that's being served to SD. Here's what I was able to grab about it:

Destination:sync-eu.exe.bid
IP:136.243.131.38 (same every time)
Port:60155 (but tried 60170, 60171 on successive attacks)

Definitely have an ad or ads that are bad on this site.

12 Comments

1

Sign up for a Slickdeals account to remove this ad.

This comment has been rated as unhelpful by Slickdeals users
Joined May 2015
L3: Novice
117 Posts
42 Reputation
Staff
#2
Quote from gaijin4life
:
Have had a few attempted redirects from some ad that's being served to SD. Here's what I was able to grab about it:

Destination:sync-eu.exe.bid
IP:136.243.131.38 (same every time)
Port:60155 (but tried 60170, 60171 on successive attacks)

Definitely have an ad or ads that are bad on this site.
Hey Gaijin4life, thanks for reporting this.

If this happens in the future and you're able to catch a screenshot, click-through URL, or any other info, it would help us find the exact ad you saw.

In the meantime, we'll look through our ad scanner to see if we can find anything. We did see some alerts yesterday and are working through them so it may be related. It's been relatively quiet for a long time and we'd like to keep them off our site.
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Apr 2011
L3: Novice
191 Posts
62 Reputation
#3
Seems to be happening again.
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Dec 2005
n00b extraordinaire 8^)~
5,022 Posts
2,889 Reputation
Sr. QA
#4
Quote from dyn2nvu
:
Seems to be happening again.
If you can provide the devs with any information about which ad, the url it sent you to, screenshot etc that would help a lot for them to be able to track down the bad ad. See the post above yours from one of the folks that deal with the ad issues Smilie
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Apr 2011
L3: Novice
191 Posts
62 Reputation
#5
http://www.grimsurveys.com/?sid=i...&c6=Chrome

http://www .grimsurveys. com/?sid=isp.opt.3a6x&ow=us.ao96ho9gbr467d49.2col.nojs.more&isp=Time%20Warner%20Cable%20Internet%20Llc&browser=Chrome&os=Windows&region=California&city=City&ip=1**********.161&countryname=United%20States&device=DESKTOP&brand=Desktop&model=Desktop&country=US&tr ack=t.pinksurveys.com&tid=0ba6f51c-279d-4a68-82c0-dc5e8b9e9e67&caid=3fc624b7-4074-4b7f-aa2a-a68cbc6a0c97&head=ret.ss.asp.ncxw9c&did=5269&voluumdata=BASE64dmlkLi4wMDAwMDAwMS1iN2Q5LTQ5YTktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjQ0ZWFjODAwLTRiYzQtMTFlNy04NjhkLWFiMjJmMWQwNGQyMV9fY2FpZC4uM2ZjNjI0YjctNDA3NC00YjdmLWFhMmEtYTY4Y2JjNmEwYzk3X19ydC4uSEpfX2xpZC4uNj djOWQ4YTMtMWExOC00NTRkLWE0MjctMjg2YjMyZDM5MDZmX19vaWQxLi5mMjQyZmIwOC05OWY5LTRiOTUtYTY5Yi00ODA4ZmY4MTE2OTlfX29pZDIuLmNmOTIwMWRiLWYyZjEtNGExYS1hZDI4LWRlYmVlNWI2ZDYxMF9fb2lkMy4uMTliZThlOTMtYzZiYS00M2FhLTgzY2UtZDYxZjhhNzE3ZDBlX19vaWQ0Li5kMjg3Y2ZlZS1jZDkzLTRkND ctOTMyZS1iY2ViM2ZlYjJjNTVfX29pZDUuLjFiY2RlMTI0LTEwYWQtNGEwNC04YWE5LTUxNzk0N2YzYjNhZV9fb2lkNi4uMjVlYzUyMGItNjc2YS00Y2Q4LWE0ZGMtMjg3M2MwMzIyMjA5X19vaWQ3Li42NDIzMGVjYy1jMTRiLTQwMTItOTI3Mi0wNzYyNTgzZjVmZDBfX29pZDguLmU0NWIxNjMyLWM3MGUtNGVjYi04YzE0LWIwYmM1NjE4Mz hhMV9fb2lkOS4uNzA2NjY2MTItMTc1ZC00ZjVjLWFlZDQtOTFiMzFlOWI3YTg4X19vaWQxMC4uNGFiNTk5MjctMmU5OC00MDIwLTk0OGItZTI3NGZhN2E2ZGM3X19vaWQxMS4uMTUyZTBkYjktNTNkMy00NTkwLThlMmItMmM0N2JkNTY3NjJkX19vaWQxMi4uZjgyZmQwYTktYzQzZi00ZjY5LTgwMzQtMjNmZGNkMjJlZjE5X19vaWQxMy4uMz hkMWY0MzktMGE0NC00MzBlLWI0NGQtZTZmNWZiMjM5NDZlX192YXIxLi41MjY5X192YXIyLi4xMzAzMV9fdmFyMy4uNDU0MTRfX3ZhcjQuLlVTX192YXI1Li5PcmFuZ2VfX3ZhcjYuLkNocm9tZV9fcmQuLmVuZ2luZVwuXHNwb3RzY2VuZXJlZFwuXGluZm9fX2FpZC4uX19hYi4uX19zaWQuLl9fY3JpLi5fX3B1Yi4uX19kaWQuLl9fZGl0Li 5fX3BpZC4uX19pdC4uX192dC4uMTQ5Njg3Mjc0NDMwNw&c1=5269&c2=13031&c3=45414&c4=US&c5=City&c6=Chrome
Reply Helpful Comment? 0 0
Last edited by dyn2nvu June 7, 2017 at 03:08 PM. Reason: edit city and ip address out
This comment has been rated as unhelpful by Slickdeals users
Joined Dec 2004
Community Manager
68,120 Posts
4,682 Reputation
Staff
#6
^^ thanks, passing that on. Thumbup
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Oct 2011
L1: Learner
16 Posts
10 Reputation
#7
Still happening on 6/8.

http://engine.spotscenered.info/Redirect.eng?MediaSegmentId=30262&dcid=1_ctx_1ad683f9-a480-4f8b-b9b5-4bb24a627c7b&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=hXPZuKMawgsqqaXmgsiEEscqvxeFp0YWn8oV21lbHO8iCvpmH9sk2fSprt3x5A_b-2hEatyK0i4Deb-rUYJDFrdTFYwunJKu09ZEHLHzJxZVXbejoDo8iaYVhEeoJfxmLsYuWMM8FrdrJIirVKzXk16lEXzP9HOgt66Ss7EbTNNUQfeOWR6JrG_B3izNFz-AKkMCOzOBL6Ilq8A0IW196p2pfZ7jBc_WUXn9_JdB0MIl_FB81GAe_8xvJ5cvSur1UiwQLYxPccWL_2zEYtCglURVHIRfd2WWEX0Ifoa08BrsRfG0FveaRk_5ud8YwBHfwi8XGtSpa_XuLru4dORtcoOHJxAXkIO2eJAHOjUDYYQhmonS53pL1cS8F--zgEcMiXbkppk1I3aPIg0ABHmb-ZYGYw8dL0Qd3qfznzHtq3HqrH-xfCBh05AON-hLrTDuNrLLxek3lcm45PcN3uoCX3o9uB8u4q3_acncoBZXyPpdmS559GjkZ8vjME4Ifeho3NvA1WsRwx-CqOtbYqcLJLpXcw33LsUWwFlH2PJB3V_3GjXdcx6_KYz_rjWEktBnhOW2T38KGWyzydi7VGRNosHSWg7RQUCKEuzgWdoOhmBYRGjE29D99kV2Mm2s57tbNcMwetouCpZElJ2gpqSHgkAu0_PMmfKtW_6C4GygNlshG-zUI9PwobDH0nGp6FrtzTyn7gR37vYzvH4qX39ZGXBH9L6IFcKqEaHdLzP516P65likxGIUD31TIWJj311epvT9iW4RxjPnfxWwElizT6pFutAjrvY3Zs0aUmsX_vFuyImsE1CmGP8c3oS029y5caMlUkpf7s7Tz3_MYZ1GngKKaS9ZWbU-8SL701Wcit7q0kTOgIkPr9Ar0hjzkuvyg5jz86fcv20_CjQ42Whbz1p6dvdf-IZCcuKpCyRGPeO8e7XPX08nHPLkTwZOTmIDERRVU8KeODo9DjGaT-6irDlPmkpvvY0LMfHE3Q3E8ZDOV324wqrUSpVuU4zFehAe7IhonYo6fJ2IvusjC_oXu-n-sV_TlE4UKOJqZGLkwgS2x99xfxfFNwsmfmcTlovidnSmV9JzLUF4JwK1JWn3LkoF4HXSsURYbNae2tGDpqj9kveAcvDfFKW3zF4h_c97aefhSf9voHQUs6LJGpkUbiE_cKBV4Gbxp3ou-xTj46-V70qf_DkSiFhwwcGdbOzY28m_2biRCopj2SdaByygRY8e4wvquPZpgMHZ13bcr3a-FfaQDW4y_vMVy_aGwU8J0

which brings you to;

grimsurveys.com
Reply Helpful Comment? 0 0
Last edited by Matmatic June 8, 2017 at 06:47 AM.
This comment has been rated as unhelpful by Slickdeals users
Joined Dec 2004
Community Manager
68,120 Posts
4,682 Reputation
Staff
#8
Thanks.. passed that one on too.

Those do help.. then they know what to block so it speeds it up..it is a bit like whack-a-mole at times.
Reply Helpful Comment? 0 0

Sign up for a Slickdeals account to remove this ad.

This comment has been rated as unhelpful by Slickdeals users
Joined May 2015
L3: Novice
117 Posts
42 Reputation
Staff
#9
Quote from Matmatic
:
Still happening on 6/8.

http://engine.spotscenered.info/R...Vy_aGwU8J0

which brings you to;

grimsurveys.com
This is very useful info, thanks! We think we narrowed it down and actually paused an ad partner so thanks for reporting it. Hopefully these will not show up again.
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Jun 2006
148 Posts
32 Reputation
#10
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Oct 2011
L1: Learner
16 Posts
10 Reputation
#11
Still being redirected...

https://advertising.onlinepaidclick.com/1779456556.js?pubid=156078&domain=173321&t=BgNZWkVHcmR0cXMeFl1eWlhwZXdxdwMXRVJFWHt%2Fd2EWeQ%3D%3D

https://pub.maha-media.com/nlp/index.php?guid=a3645e25-e40a-45c1-92fe-d681cb8a2904&Hardlink=true&time=0&currenturl=%7Bsubid%7Dswix.com&url=http://engine.spotscenered.info/link.engine

http://engine.spotscenered.info/Redirect.eng?MediaSegmentId=30262&dcid=1_ctx_74ab4f04-440a-4685-a9f6-1bf9414ba8d1&vmId=00000000-0000-0000-0000-000000000000&abr=false&timeZoneOffset=&v=hXPZuKMawgsqqaXmgsiEEscqvxeFp0YWn8oV21lbHO8iCvpmH9sk2fSprt3x5A_b-2hEatyK0i4Deb-rUYJDFrdTFYwunJKu09ZEHLHzJxZVXbejoDo8iaYVhEeoJfxmLsYuWMM8FrdrJIirVKzXk16lEXzP9HOgt66Ss7EbTNNUQfeOWR6JrG_B3izNFz-Ag6dLiVykxXaU7YezKEHmbGDMjghjtrS0sqXlTwo277rTXbu0yEI-Ht6Kni2jHcFfCFSqLpAHFseMBz3__DQcyjqLLUVCGEfiCthZJZshZR5MRcrhgPPfvjCY7nX0j8P4wYCnHblhJaTDSqt54Hw1T_-mAAnX4cugIii5cr-XqEPK0lAKcumRWnHp45Uj3eieI0i3WPLVCL9f6FZt0pdf_h21zxfcquXXO1uwv4GETxrWNcM6Gr7SjPOyisIEOGnADvJietMo8BBL3I09jn7uvNQoySGyx_H16lmC9FQVhenXWVFhASQKzjm_pSW2xrOJ0s4DuquJCq1ML0V2lwlZpTw8UznofnfXEPDGtyhFoMEuAzecOzRmsnyx0N_XIUELxCdt3ZfTVglIipvFC3WirugOOFtacivZdTHpv_6 oxtjbDzEqpcErlahfWmXtVFRo_pS4gUYvj74kzGiXzZHPjq7LuIMnqYU6KsrS8ECyXQASKekGB5hFzFvb4BCK0900G96CSkR1My4-mY3M7sabwoMHF3M9UQyH0AWZr-uv5aIvqjwDiXX6j3PY9dJexgV9o-9nGA4VbTZk9OnynjN-AhZsOyY0mhDJCa8o63c5mKVfSlWvSIgUGR-R-_hXM2H0e6yw01ZabEq855sroD1WOE8-BOV_o4YXjDK5JR-X2ZesuQmdVDAwTyoWfOnydNg9kvGhbjxX-LsFBx3YNTX2kbs4e0HXjgrD-VMGji8h48z6N812plwDzpZUcohl7veJkNxWcnpDC2FfZTNo34NNzRGFR-hELZW9kfGbE6o7RvpwkosNq4vIntv3Wour1Y-HmaJOPfUShlDCj58uq0H7F5gAFrrE5DZcdfiQbKGZPDHKhO66Y1ojIo3L36fqZdq9qq19rGN_6olLlKftvRJWuY67JJNPC9_wxdDWND-UbluQN2Z9t6uFUu0qAGcw0UBS49JBE8uW7YRUf4bXPlttInfr80qNyW7o67r7B1G6x9iEK0cQQn8EKaiUsFZ8Fm7yaQshEOv9pwBVq6Jsjv9HQBzMxCestIvMEyIc7gQC36fe0dAW5DP7gcZj1-uhmNoL0

http://www.grimsurveys.com/
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined Nov 2004
L9: Master
5,311 Posts
1,519 Reputation
Pro
#12
Still being redirected to spotscenered.info.
Reply Helpful Comment? 0 0
This comment has been rated as unhelpful by Slickdeals users
Joined May 2015
L3: Novice
117 Posts
42 Reputation
Staff
#13
Quote from corenom
:
Still being redirected to spotscenered.info.
Hey corenom,

Thanks for letting us know. We'll dig in and get this blocked.
Reply Helpful Comment? 0 0
Page 1 of 1
1
Join the Conversation
Add a Comment
 
Copyright 1999 - 2018. Slickdeals, LLC. All Rights Reserved. Copyright / Infringement Policy  •  Privacy Policy  •  Terms of Service  •  Acceptable Use Policy (Rules)  •  Interest-Based Ads
Link Copied to Clipboard