Global Information > Sites running malicious code

[Resolved] Valeptr

(1/2) > >>

lynn55:
I know bresmoney is member of globalfriendsonline forum.

hxxp://valeptr.com/pages/ptp.php?refid=bresmoney



I readout jutakys iframe detector and complete code.
 This HTML code is dangerous and may harm your computer No zeroiframes detected!
Check took 8.94 seconds

(Level: 0) Url checked:
[url=http://valeptr.com/pages/ptp.php?refid=bresmoney]http://valeptr.com/pages/ptp.php?refid=bresmoney[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (iframe source)
[url=http://ad.z5x.net/st?ad_type=iframe&ad_size=468x60&section=310058]http://ad.z5x.net/st?ad_type=iframe&ad_size=468x60&section=310058[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (script source)
[url=http://ad.z5x.net/+rm_url]http://ad.z5x.net/+rm_url[/url]+
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (iframe source)
[url=http://ad.media-servers.net/st?ad_type=iframe&ad_size=468x60&section=241681]http://ad.media-servers.net/st?ad_type=iframe&ad_size=468x60&section=241681[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (script source)
[url=http://ad.media-servers.net/+rm_url]http://ad.media-servers.net/+rm_url[/url]+
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (iframe source)
[url=http://www.gimmelink.com/grabber.php?id=605]http://www.gimmelink.com/grabber.php?id=605[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (iframe source)
adgrabber.php?id=605&id2=http://valeptr.com/pages/ptp.php?refid=bresmoney
PTP URL within iframe! (most PTPs consider this cheating)
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (iframe source)
[url=http://ad.z5x.net/st?ad_type=iframe&ad_size=160x600,120x600&section=310058]http://ad.z5x.net/st?ad_type=iframe&ad_size=160x600,120x600&section=310058[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (script source)
[url=http://ad.z5x.net/+rm_url]http://ad.z5x.net/+rm_url[/url]+
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (iframe source)
[url=http://d3.zedo.com/jsc/d3/ff2.html?n=790;c=338/1;s=296;d=14;w=728;h=90]http://d3.zedo.com/jsc/d3/ff2.html?n=790;c=338/1;s=296;d=14;w=728;h=90[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (iframe source)
[url=http://yads.zedo.com/ads2/a?]http://yads.zedo.com/ads2/a?[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (script source)
[url=http://d7.zedo.com/jsc/igeo.js]http://d7.zedo.com/jsc/igeo.js[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (script source)
[url=http://d3.zedo.com/bar/v14-700/d3/jsc/iframe2.js]http://d3.zedo.com/bar/v14-700/d3/jsc/iframe2.js[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (iframe source)
[url=http://www.gypsyjackpot.com/pages/index.php?refid=inya]http://www.gypsyjackpot.com/pages/index.php?refid=inya[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (iframe source)
[url=http://ad.media-servers.net/st?ad_type=iframe&ad_size=160x600&section=241681]http://ad.media-servers.net/st?ad_type=iframe&ad_size=160x600&section=241681[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (script source)
[url=http://ad.media-servers.net/+rm_url]http://ad.media-servers.net/+rm_url[/url]+
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
[url=http://www.axill.com/cpm/axill.js]http://www.axill.com/cpm/axill.js[/url]
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
language=javascript http://d3.zedo.com/jsc/d3/ff2.js
Blank page / could not connect
No ad codes identified

Source code of submitted URL:

<html>
<head>
<title>valeptr.com - Paid To Promote!</title>
<style type="text/css">
<!--
body {
background-image: url(images/vale-hg.gif);
background-repeat: repeat;
font-family: "Times New Roman", Times, serif;
font-size: 16px;
font-style: normal;
color: #B43425;
}
a:link {
color: #B43425;
text-decoration: none;
}
a:visited {
color: #B43425;
text-decoration: none;
}
a:hover {
color: #743A29;
text-decoration: underline;
}
a:active {
color: #743A29;
text-decoration: underline;
}
-->
</style>
</head>
<body>
<table width="1004" border="2" bgcolor="#F8F8F8" align="center" bordercolor="#743A29" cellpadding="0" cellspacing="0">
  <tr>
    <td>
<table width="100%" border="0" cellpadding="0" cellspacing="0">
      <tr>
        <td>
<table width="100%" border="0" cellpadding="0" cellspacing="0">
          <tr>
<td>
<table bgcolor="#743A29" border="0" align="center" cellpadding="0" cellspacing="3">
  <tr>
    <td><!-- BEGIN STANDARD TAG - 468 x 60 - ROS: Run-of-site - DO NOT MODIFY -->
<IFRAME FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO WIDTH=468 HEIGHT=60 SRC="http://ad.z5x.net/st?ad_type=iframe&ad_size=468x60&section=310058"></IFRAME>
<!-- END TAG --></td>
  </tr>
  <tr>
    <td><!-- BEGIN STANDARD TAG - 468 x 60 - ROS: Run-of-site - DO NOT MODIFY -->
<IFRAME FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO WIDTH=468 HEIGHT=60 SRC="http://ad.media-servers.net/st?ad_type=iframe&ad_size=468x60&section=241681"></IFRAME>
<!-- END TAG --></td>
  </tr>
  <tr>
    <td><script type="text/javascript">
<!--
ad_width =468;
ad_height =60;
ad_affid=27918;
//-->
</script>
<script type="text/javascript" src="http://www.axill.com/cpm/axill.js"></script>
</td>
  </tr>
</table>
</td>
<td>
<table bgcolor="#743A29" border="0" align="center" cellpadding="0" cellspacing="3">
<tr>
<td><!-- gimmelink-->
            <iframe width="425" height="180" frameborder="1" src="http://www.gimmelink.com/grabber.php?id=605" marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true" scrolling="no"></iframe><!-- gimmelink-->
</td>
<tr>
</table>
          </tr>
        </table>
</td>
      </tr>
      <tr>
         <td>
            <table width="100%" border="0">
              <tr>
                <td colspan="3">
                  <div align="center"><strong><a href="http://valeptr.com/pages/advertise.php" target="_blank">Advertise
                    Here</a> • <a href="http://valeptr.com/pages/confirm.php?refid=bresmoney" target="_blank">Join
                    ValePTR</a> • <a href="http://www.gypsyjackpot.com/pages/index.php?refid=inya" target="_blank">Open
                    Rotator Ad in New Window</a> • <a href="http://valeptr.com/pages/ptpabuse.php?aid=226" target="_blank">Report
                    Abuse</a> • <a href="http://valeptr.com/pages/index.php?refid=bresmoney" target="_blank">Site
                    Home</a></strong></div>
                </td>
              </tr>
              <tr valign="top">
                <td rowspan="2" width="120" bgcolor="#F8F8F8">
                  <div align="center">
                    <!-- BEGIN STANDARD TAG - 160 x 600/120 x 600 - ROS: Run-of-site - DO NOT MODIFY -->
                    <iframe frameborder=0 marginwidth=0 marginheight=0 scrolling=NO width=160 height=600 src="http://ad.z5x.net/st?ad_type=iframe&ad_size=160x600,120x600&section=310058"></iframe>
                    <!-- END TAG -->
                  </div>
                </td>
                <td colspan="2" bgcolor="#743A29">
                  <table width="100%" border="0" align="center">
                    <tr>
                      <td align="center">
                        <!--  begin ZEDO for channel: EA-Site Target 3296, publisher: Valeptr.com, Ad Dimension: Super Banner - 728 x 90 -->
                        <script language="JavaScript">
var zflag_nid="790"; var zflag_cid="338/1"; var zflag_sid="296"; var zflag_width="728"; var zflag_height="90"; var zflag_sz="14";
</script>
                        <iframe src="http://d3.zedo.com/jsc/d3/ff2.html?n=790;c=338/1;s=296;d=14;w=728;h=90" frameborder=0 marginheight=0 marginwidth=0 scrolling="no" allowtransparency="true" width=728 height=90>
                        <script language="JavaScript"
src="http://d3.zedo.com/jsc/d3/ff2.js"></script>
                        <noscript> <a href="http://yads.zedo.com/ads2/r?n=790;c=338/1;s=296;x=3584;u=j;z=[timestamp]" target="_blank"><img border="0" width="728" height="90"
src="http://yads.zedo.com/ads2/x?n=790;c=338/1;s=296;x=3584;u=j;z=[timestamp]" alt="Click here"></a>
                        </noscript> </iframe>
                        <!-- end ZEDO for channel: EA-Site Target 3296, publisher: Valeptr.com, Ad Dimension: Super Banner - 728 x 90 -->
                      </td>
                    </tr>
                  </table>
                </td>
</tr>
              <tr valign="top">
<!-- rotator -->
                <td>
                  <div align="center"><iframe src="http://www.gypsyjackpot.com/pages/index.php?refid=inya"  width="684" height="704" name="a" marginwidth="1" marginheight="1" align="middle" scrolling="yes"></iframe></div>
                </td>
                <!-- rotator -->
                <td width="160" bgcolor="#F8F8F8">
                  <!-- Media servers 160 x 600-->
                  <IFRAME FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO WIDTH=160 HEIGHT=600 SRC="http://ad.media-servers.net/st?ad_type=iframe&ad_size=160x600&section=241681"></IFRAME>
                  <!-- END mediaservers TAG -->
                </td>
              </tr>
              <tr>
                <td colspan="3">
                  <div align="center"><strong>As a ValePTR member the user bresmoney has not been credited for your visit. Thanks!</strong></div>
                </td>
              </tr>
          </table>
</td>
      </tr>
     </table>
</td>
  </tr>
</table>

<!-- pop space -->

<!-- BEGIN GUNGGO pop-under-->
<script type="text/javascript">
var cache_buster=Math.random((new Date()).getMilliseconds())*100000000000000000;
document.write('<scr'+'ipt type="text/javascript" src="http://max.gunggo.com/show_ad.ashx?type=pop&sid=296&cid=338/1&cb='+cache_buster+'"></scr'+'ipt>');
</script>
<noscript>
<div style="width: 1px; height: 1px;overflow: hidden;"><a href="http://www.Gunggo.com">Online Advertising</a></div>
</noscript>
<!-- END GUNGGO pop-under-->
</body>
</html>
Edited to alter thread title to reflect the new report

Craig:
Hello Lynn,

Just to clarify, the referral ID on a PTP page is not responsible for placing the content on that page.  :)

I have not been able to replicate the problem on a couple of quick looks at the site myself there which makes me think it could be from a site/advert in one of their rotators, not placed directly on the PTP page.

If it is an ad one of their advertisers sites they need to know this by people reporting problems by the "Report Abuse" button so they can steps to identify and rectify the problem.

There are numerous reasons why such ads can be found on pages and the owner of the page is not always responsible, it can be very hard to spot problems if the problem ad's on their advertisers site, and is targeted for a different country than theirs, for example.

I'm sorry I couldn't be of more help and I will visit a few click exchanges to see if I can replicate the problem you had/saw so I don't end up giving anybody a lot of invalids.

 :)

lynn55:
Thank you for reply.   I found  ptp page has rotator got bluevertise.

I see mvent2 pops up same message box.
http://www.em-traffic.com/promo.php?ref=29423

Help me how to report this
I click abuse report button then next page. What is Comment means?
http://valeptr.com/pages/ptpabuse.php?aid=260

Craig:
The comment box is where you put the information on what you have found and where, so they can take action on the advert, try and tell them what you found - Creditburner etc, and which site you think/know was running the ad.

HTH  :)

Craig:
Found today;

Source code URL: hxxp://valeptr.com/pages/free.php?refid=xxx

Zedo found, this has been reported.

Mvents warnings;

 This HTML code is dangerous and may harm your computer  1 hidden Iframe was detected!
This was at: http://d3.zedo.com/jsc/d3/ff2.html?n=790;s=296;c=338/1;d=0;
Here are the destination URL's detected (showing 1 to 1):
http://d13.zedo.com/jsc//zpu.html?f=;z=2-107 (0x0)

All of these Iframes were expanded. Would you like to view the analysis of this site from Jutaky's detector? 
Extracted code;

At the top of the page directly under the 728px × 90px Banner, it's the right 468px × 60px banner

The properties of that banner;

 This HTML code is dangerous and may harm your computer Link properties;

Address: http://adserver.adtechus.com/?adlink/5206/828003/0/1/AdId=321559;BnId=4;itime=545299398;key=key1+key2+key3+key4;

Image Properties;

Location: http://aka-cdn-ns.adtechus.com/images/23/Ad321559St1Sz1Sq670139V0Id4.gif
   
Frame name;

 This HTML code is dangerous and may harm your computer http://d3.zedo.com/jsc/d3/ff2.html?n=790;s=296;c=338/1;d=0;   
The html for that frame (not visible via "View page source" option/method)

 This HTML code is dangerous and may harm your computer <iframe height="60" frameborder="0" width="468" scrolling="no" allowtransparency="true" marginwidth="0" marginheight="0" src="http://d3.zedo.com/jsc/d3/ff2.html?n=790;s=296;c=338/1;d=0;"/>   
Source code of that frame;

 This HTML code is dangerous and may harm your computer <!--  Copyright (c) 2000-2009 ZEDO Inc. All Rights Reserved. -->
<html>
<head>
<script language="JavaScript">
var d1=new Image();var zzblist=new Array();var zzllist=new Array();var zzl;
document.write('<script type="text/javascript" src="http://d3.zedo.com/jsc/bmap.js"></scr'+'ipt>');
document.write('<script type="text/javascript" src="http://d3.zedo.com/jsc/lmap.js"></scr'+'ipt>');
if(document.cookie.indexOf('ZEDOIDX')==-1){
var w0=new Date();
w0.setTime(w0.getTime()+18000000);
document.cookie='ZEDOIDX=1000;expires='+w0.toGMTString()+';domain=.zedo.com;path=/;';
}
if((document.cookie.indexOf('ZEDOIDX')!=-1)&&(document.cookie.indexOf('gs')==-1)){
document.cookie='gs=1;domain=.zedo.com;path=/;';
d1.src='http://h.zedo.com/init/'+Math.random()+'/g.gif';
}
</script>
</head>
<body marginwidth=0 marginheight=0 leftmargin=0 topmargin=0 style="background-color:transparent">
<script language="javascript">
var zzGeo=254;var zzCountry=255;var zzState=0;var zzMetro=0;
if((document.cookie.indexOf('FFgeo')==-1)||(document.cookie.match(/FFgeo=([^;]*)/)[1]==254)){
document.write('<script src="http://d7.zedo.com/jsc/igeo.js"><\/script>');
}
var zzuid="unknown";
if(document.cookie.match(/ZEDOIDA=([^;]*)/))
zzuid=RegExp.$1;
if(document.cookie.indexOf('ZEDOIDX')==-1)
zzuid='blocked';
document.write('<script src="http://d7.zedo.com/jsc/lang.js"><\/script>');
</script>
<script language="JavaScript" src="http://d3.zedo.com/bar/v15-101/d3/jsc/iframe2.js"></script>
<noscript>
<iframe src="http://yads.zedo.com/ads2/a?" width=999 height=999 frameborder=0 border=0 marginwidth=0 marginheight=0 scrolling="no" align="top" allowTransparency="true"></iframe>
</noscript>
</body>
</html> 
The iFrame it leads to;

 This HTML code is dangerous and may harm your computer <iframe height="0" frameborder="0" width="0" style="border: 0px none ; position: absolute; display: inline; width: 320px; height: 280px;" src="http://d13.zedo.com/jsc//zpu.html?f=;z=2-107"/>
Complete source code;

 This HTML code is dangerous and may harm your computer <html>
<head>
<title>ValePTR.com - Paid To Promote for Free Members</title>
<link href="http://valeptr.com/pages/ptp.css" rel="stylesheet" type="text/css">
</head>
<body>
<table width="99%" border="4" bgcolor="#F8F8F8" align="center" bordercolor="#743A29" cellpadding="0" cellspacing="0">
  <tr>
    <td>
            <table width="100%" border="0" cellpadding="0" cellspacing="0">
          <tr>
            <td>
            <table width="100%" border="0" cellpadding="0" cellspacing="0">

              <tr>
                <td colspan="2">
                  <table width="100%" border="0" cellspacing="0" cellpadding="5">
                    <tr>
                      <td>
                                             
                        <table width="100%" border="0" cellspacing="0" cellpadding="3">
                          <tr>
                            <td colspan="2">
                              <table width="100%" border="0" cellspacing="0" cellpadding="5">
                                <tr>
                                  <td rowspan="2" width="10%"><a href="http://valeptr.com/pages/index.php?refid=gfosupport" target="_blank"><img src="http://valeptr.inya.info/ele/vale_freeptpw.gif" alt="ValePTR - PTP for Free Members" border="0"></a></td>
                                  <td width="90%">
                                    <div align="center"><strong><font size="-1">As
                                      a ValePTR member the
                                      user gfosupport has not been credited for your visit.                                      </font></strong></div>

                                  </td>
                                </tr>
                                <tr>
                                  <td width="90%">
                                    <div align="center">
                                      <script type="text/javascript"><!--
document.write('<s'+'cript type="text/javascript" src="http://cpm-traffic.com/show.php?z=35&pl=2836&j=1&code='+new Date().getTime()+'"></s'+'cript>');
// --></script>
<noscript>
<iframe src="http://cpm-traffic.com/show.php?z=35&pl=2836" width="728" height="90" marginwidth="0" marginheight="0" hspace="0" vspace="0" frameborder="0" scrolling="no"></iframe>
</noscript>
                                      <!-- END TAG -->
                                    </div>
                                  </td>

                                </tr>
                              </table>
                            </td>
                          </tr>
                          <tr>
                            <td valign="top">
                              <div align="center">
                                <!-- Start of CbproAds.com Banner Ads -->
<script type="text/javascript"><!--
cb_ad_member = "28230"
cb_ad_format = "468x60_as"
cb_ad_category = "8%2D20%2C+8%2D4891%2C+8%2D170%2C+8%2D8474%2C+8%2D1566%2C+8%2D3728"
cb_ad_channel = "interntop"
cb_ad_selection = ""
cb_ad_keyword = ""
cb_ad_productivity = ""
cb_ad_border = ""
cb_ad_bg = ""
cb_ad_link = ""
cb_ad_text = ""
//--></script>
<script type="text/javascript" src="http://www.cbproads.com/adsense_banner.js"></script><br><a href="http://www.cbproads.com/refer.asp?id=28230" target="_blank"><font size="1">Ads By CbproAds</font></a>

<!-- End -->
                              </div>
                            </td>
                            <td valign="top">
                              <div align="center">
                               <script type="text/javascript"><!--
ps_username = "Adminya";
ps_website_id = 52;
ps_ad_type = 1;
ps_ad_width = 468;
ps_ad_height = 60;
ps_color_border = "000000";
ps_color_bg = "FFFFFF";
ps_color_title = "FFFFFF";
ps_color_link = "B43425";
ps_color_hover = "743A29";
ps_color_url = "B43425";
ps_color_text = "000000";
ps_page_url = document.location;
-->
</script>
<script type="text/javascript" src="http://www.xoze.com/frame.js"></script>
                              </div>
                            </td>
                          </tr>

                        </table>
                                            </td>
                    </tr>
                  </table>
                </td>
              </tr>
            </table>
          </td>
      </tr>

      <tr>
         <td>
            <table width="100%" border="0">
              <tr>
                <td colspan="3">
                  <div align="center"><strong><a href="http://valeptr.com/pages/advertise2.php" target="_blank">Advertise
                    Here</a> &#8226; <a href="http://valeptr.com/pages/confirm.php?refid=gfosupport" target="_blank">Join
                    ValePTR</a> &#8226; <a href="http://adpaid.com/pages/index.php?refid=inya" target="_blank">Open
                    Rotator Ad in New Window</a> &#8226; <a href="http://valeptr.com/pages/ptpabuse.php?aid=889" target="_blank">Report
                    Abuse</a> &#8226; <a href="http://valeptr.com/pages/index.php?refid=gfosupport" target="_blank">Site
                    Home</a></strong></div>

                </td>
              </tr>
              <tr valign="top">
                <td width="120" bgcolor="#F8F8F8">
                  <script type="text/javascript"><!--
ps_username = "Adminya";
ps_website_id = 52;
ps_ad_type = 2;
ps_ad_width = 120;
ps_ad_height = 600;
ps_color_border = "000000";
ps_color_bg = "FFFFFF";
ps_color_title = "FFFFFF";
ps_color_link = "B43425";
ps_color_hover = "743A29";
ps_color_url = "B43425";
ps_color_text = "000000";
ps_page_url = document.location;
-->
</script>
<script type="text/javascript" src="http://www.xoze.com/frame.js"></script>
                </td>
                <!-- rotator -->
                <td width="100%">
                  <div align="center"><iframe src="http://adpaid.com/pages/index.php?refid=inya"  width="100%" height="704" name="a" marginwidth="1" marginheight="1" align="middle" scrolling="yes"></iframe></div>

                </td>
                <!-- rotator -->
                <td width="160" bgcolor="#F8F8F8">
                  <!-- AdJungle Zone: sky_160 -->
<script src="http://aj.adjungle.com/aj/zone.jsp?z=JZ0000013252" type="text/javascript"></script>
                </td>
              </tr>
                 </table>
                    </td>

              </tr>
            </table>
        </td>
  </tr>
</table>
<!-- pop space -->

</body>
</html>   

Navigation

[0] Message Index

[#] Next page