ero-advertising malware

**Naughty** · 09-15-2014, 01:12 AM

Originally posted by wocnom

Hi there,

we have just noticed that few of our sites are marked by google as infected by malware and punished as hell. There are mentioned ero-advertising...

WE ARE PISSED OFF

https://safebrowsing.google.com/safe...vertising.com/

Anyone get pwned too? :/

Looks good from the link you posted:

Safe Browsing
Diagnostic page for ero-advertising.com

What is the current listing status for ero-advertising.com?

This site is not currently listed as suspicious.

What happened when Google visited this site?

Of the 29053 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2014-09-14, and the last time suspicious content was found on this site was on 2014-09-14.

Malicious software includes 5 exploit(s), 1 trojan(s).

This site was hosted on 3 network(s) including AS27589 (MOJOHOST), AS16265 (FIBERRING), AS15169 (GOOGLE).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, ero-advertising.com appeared to function as an intermediary for the infection of 1520 site(s) including pornsharing.com/, sextubeset.com/, videarn.com/.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

Next steps:

Return to the previous page.
If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.

==
Second thought: I don't know what the hell that info says.... No malicious anything, but then it says it was some way. Confusing stuff.

**Klen** · 09-15-2014, 01:13 AM

Originally posted by Naughty

Looks good from the link you posted:

Safe Browsing
Diagnostic page for ero-advertising.com

What is the current listing status for ero-advertising.com?

This site is not currently listed as suspicious.

What happened when Google visited this site?

Of the 29053 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2014-09-14, and the last time suspicious content was found on this site was on 2014-09-14.

Malicious software includes 5 exploit(s), 1 trojan(s).

This site was hosted on 3 network(s) including AS27589 (MOJOHOST), AS16265 (FIBERRING), AS15169 (GOOGLE).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, ero-advertising.com appeared to function as an intermediary for the infection of 1520 site(s) including pornsharing.com/, sextubeset.com/, videarn.com/.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

Next steps:

Return to the previous page.
If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.

Ero-advertising site itself is not infected,but advertisers are,it says nicely

Code:

 Over the past 90 days, ero-advertising.com appeared to function as an intermediary for the infection of 1520 site(s) including pornsharing.com/, sextubeset.com/, videarn.com/.

**wocnom** · 09-15-2014, 01:17 AM

So we had a chat session with ero-advertising support few minutes ago and it`s confirmed.

"some pretty uncool publisher" tweaked it out. fuck.

We have already removed ero ads from the sites and ask ggl for reconsideration our sites.

Do you have any experience with these situations? Can/does your site full recover after incident like this?

**Harmon** · 09-15-2014, 01:18 AM

Time to close up shop and start over

**Mediamix** · 09-15-2014, 01:22 AM

Still one of the best ad networks out there..

**Harmon** · 09-15-2014, 01:27 AM

Originally posted by Mediamix

Still one of the best ad networks out there..

Apparently not if they aren't monitoring their advertisers as closely as they should be. That's just pure negligence.

**Paully** · 09-15-2014, 01:50 AM

Can you just block the shitty publishers in your ad panel? If so, do that, and then have Google check it again.

I used others and I could go through the referring sites. There were plenty of shit sites I didn't want traffic from for other reasons. People sometimes sign up under one site then send traffic from another.

**MoreMagic** · 09-15-2014, 03:51 AM

Same problem here.

**wizzart** · 09-15-2014, 03:55 AM

Wow this is epidemic

**johnclark** · 09-15-2014, 04:00 AM

I have not been affected but I was updating some of my babelogs this morning and 4 of my trade partners have the google warning, sucks.

**wocnom** · 09-15-2014, 04:44 AM

minor info:
ggl just whitelisted two of our sites (we removed all ero-advertising ads and ask for reconsideration through webmasters tools ~5 hours ago).

**Ross** · 09-15-2014, 04:49 AM

Originally posted by wocnom

So we had a chat session with ero-advertising support few minutes ago and it`s confirmed.

"some pretty uncool publisher" tweaked it out. fuck.

We have already removed ero ads from the sites and ask ggl for reconsideration our sites.

Do you have any experience with these situations? Can/does your site full recover after incident like this?

Your site should recover almost fine if it is in isolated incident, google understands that this happens, it can take a couple of days to bounce back and then a week or so to recover. You always take a slight hit when this happens, you may lose 5-10% of your traffic but overall the majority will be ok.

Unfortunately there is a lot of malicious people out there looking to exploit ad networks, that is why we use advanced software as a force against malware. Our software finds it before Google does and automatically deletes it to avoid penalties.

**wocnom** · 09-15-2014, 04:55 AM

Originally posted by Ross

Your site should recover almost fine if it is in isolated incident, google understands that this happens, it can take a couple of days to bounce back and then a week or so to recover. You always take a slight hit when this happens, you may lose 5-10% of your traffic but overall the majority will be ok.

Unfortunately there is a lot of malicious people out there looking to exploit ad networks, that is why we use advanced software as a force against malware. Our software finds it before Google does and automatically deletes it to avoid penalties.

thx for info man.

Originally posted by Naughty

Over the past 90 days, ero-advertising.com appeared to function as an intermediary for the infection of 1520 site(s) including pornsharing.com/, sextubeset.com/, videarn.com/.

I see ggl is still counting...

Over the past 90 days, ero-advertising.com appeared to function as an intermediary for the infection of 2883 site(s) including pornsharing.com/, sextubeset.com/, tubekittysex.com/.

**adultmobile** · 09-15-2014, 04:57 AM

Originally posted by wizzart

Wow this is epidemic

Yes this is not only ero-advertising, browse with chrome a few adult sites and the red page about danger site it happens so often lately, that's just due to some adverts

http://gfy.com/showthread.php?t=1150056

**Best-In-BC** · 09-15-2014, 05:01 AM

They have never been good or made any logical sense to me

**MoreMagic** · 09-15-2014, 09:59 AM

Funny, how little response.

**Klen** · 09-15-2014, 10:05 AM

Originally posted by adultmobile

Yes this is not only ero-advertising, browse with chrome a few adult sites and the red page about danger site it happens so often lately, that's just due to some adverts

http://gfy.com/showthread.php?t=1150056

It is possible how they used other brokers which were selling unsold traffic to ero advertising so it caused a cascade reaction.

**dready** · 09-15-2014, 10:06 AM

Malvertisers have been making a massive push the past little while. Quite a number of ad networks have been affected.

**Mediamix** · 09-16-2014, 11:32 AM

Still the best ad network with the best support and crew in the world.

**wocnom** · 09-16-2014, 01:32 PM

Originally posted by Mediamix

Still the best ad network with the best support and crew in the world.

I don`t want to sound like a little cunt here and I REALLY appreciate that they don`t hide this incident.

But I would rather read...

... that this will never happen again. Ever. And what will they do to prevent situations like that in future.

instead of:

Hello, we had situation here. We almost fucked up your XXXX sites/biz and our reputation. We are sorry. Have a nice day.

But yeah, I am maybe living in my perfect dreamland.

**sandman!** · 09-16-2014, 01:51 PM

**PornDiscounts-V** · 09-16-2014, 03:07 PM

For to love Russians

**wocnom** · 10-18-2014, 02:27 AM

OMG it`s back again. Some kind of malware in their banner on one of our site and all is fucked up again.
We are removing them right now. Amateurs.

**wocnom** · 11-01-2014, 04:17 PM

AGAIN.. no comment

**anexsia** · 11-01-2014, 04:59 PM

Originally posted by wocnom

So we had a chat session with ero-advertising support few minutes ago and it`s confirmed.

"some pretty uncool publisher" tweaked it out. fuck.

We have already removed ero ads from the sites and ask ggl for reconsideration our sites.

Do you have any experience with these situations? Can/does your site full recover after incident like this?

-edit- whoops, noticed this was old

but hope your site recovers again!

Hey man I actually just dealt with this last weekend (not ero, but I got a notification from Google that one of my websites had a "malware" infection). I made sure the website was clean and then submitted a reconsideration request (you should have that option on Google Webmaster Tools on that same page where it lists your security thing) and just put that I had scanned and cleaned up the site. I received a notice from Google the very same day that my site tested cleaned and they removed the notice. Not only did I gain my traffic back but it literally DOUBLED lol and has stayed that way. I've dealt with this before and have always received more traffic then I was getting before the notice which is kinda cool.

Anyways, just submit a reconsideration and let them know that it was ero and that you completely removed ero from your website, your traffic will be back in no time

**wocnom** · 11-01-2014, 05:11 PM

anexsia: Thx for your reply.

Actually we know the scenario very well - removing ero-advertising ads, asking ggl for reconsideration, waiting 24h with low traffic/income and hoping that the site will be restored ok.

Google marked our sites with "malware" infection 3× for last two months and in every single case ero-advertising was mentioned and highlighted.
We wrote them (ero) mail one hour ago.

It`s just pissing us off, because we are loosing money, traffic and the fun.

**wocnom** · 11-03-2014, 07:25 AM

Well our site is still marked as infected by google. Fuck.
Anyway, quite interesting news today, check out these links:

exoclick:
https://safebrowsing.google.com/safe...e=exoclick.com

ero-advertising:
https://safebrowsing.google.com/safe...vertising.com/

juicyads:
https://safebrowsing.google.com/safe...e=juicyads.com

plugrush:
https://safebrowsing.google.com/safe...=plugrush.com/

Look at the dates. Does anybody have the same problem? What about employees of these companies here on the gfy, any info? :/

**PAR** · 11-03-2014, 07:53 AM

https://safebrowsing.google.com/safe...ite=google.com

As you can see even google has an issue with this.. every ad network in the world has malware issues.
The solution for them is not an easy one... You have advertisers that will do everything they can to get their malware ads into any system they can. It's also not an easy thing to find.

All an ad network can do is try to find and deal with it as fast as possible.
example.
Malware advertiser places an ad in a system..
They leave the ad clean for X amount of time.
Then they target the malware to say load on only 1% of the traffic 1 time that they target to only display in 1 GEO, 1 OS, 1 Browser, and only new IP's that have not seen the ads.
Making it very hard to find even when doing manual or automated quality checks of ads.

An ad network could view the ad from the exact target that the malware advertiser has opted to target the malware to and never see the malware due to their IP already being in the advertisers system and flagged to not show the malware to them.

It is not possible for any ad network to say they this will never happen again.
Even the best systems I have seen that can flag 0day malware etc. Still have the issue of being able to trigger the malware to detect it. By that time it is possible some users have already triggered it before they have a chance to see it.

**wocnom** · 11-03-2014, 08:09 AM

PAR: Thx man for your 2cents, good reading.

It`s not easy to prevent these situations, we get it. Maybe the best move is make some contacs and sell the banners directly, according to the frequency of these incidents.

**timmyc38** · 11-03-2014, 08:52 AM

it appears they were aware and handled it - check my sig too, while your at it

**PAR** · 11-03-2014, 10:41 AM

Originally posted by wocnom

PAR: Thx man for your 2cents, good reading.

It`s not easy to prevent these situations, we get it. Maybe the best move is make some contacs and sell the banners directly, according to the frequency of these incidents.

Sell direct or to not sell direct is a question all webmasters need to think about...
If you sell direct it's still not 100% you wont someday get malware TBH...
Yes the risk is reduced but never 100%...

If you sell it yourself will the eCPM be greater than if you sell it via an ad network?
If so will the increase in eCPM be great enough to offset you time, energy etc...

**FoxyFletch** · 11-12-2014, 08:43 AM

Ero-Advertising vs PlugRush

PlugRush wins over ero-advertising any day in my opinion.

**FoxyFletch** · 11-12-2014, 09:09 AM

By the way it's very easy to fix problem like that, go on Google Webmaster Tools and reply to the malware notification as corrected and explain to the that you removed the affected advertiser. I had it with Exoclick recently where the 300 x 250 banners where being infected. So I removed them, permanently.

**PAR** · 11-12-2014, 01:20 PM

Originally posted by FoxyFletch

Ero-Advertising vs PlugRush

PlugRush wins over ero-advertising any day in my opinion.

Ya because there is never any malware in plugrush ever.... LOL

virustotal.com/en-gb/domain/widget.plugrush.com/information/
scroll down to:
Latest detected files that communicate with this domain section...

any and all ad networks have their own issues with malware do to the complex nature of monitoring for it 24/7 in realtime across every geo, device type, browser type etc..

ero-advertising malware

ero-advertising malware

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment