Aff. Conversions

**WATP** · 11 June 2014, 6:35 am

Cheers Dan, like the code. Yeah your site has never brought up the pop up so that's all good!

Gooner; I've loaded your site 3 or 4 times today with a new IP each time and for the first time - no pop up, all loads were fine : )

To compare afterwards, I then tried a few other member's sites who have the JS code and the popup is still there for them.

**Rostick** · 11 June 2014, 10:04 am

Originally Posted by WATP

Cheers Dan, like the code. Yeah your site has never brought up the pop up so that's all good!

Gooner; I've loaded your site 3 or 4 times today with a new IP each time and for the first time - no pop up, all loads were fine : )

To compare afterwards, I then tried a few other member's sites who have the JS code and the popup is still there for them.

fantastic help WATP, you deserve our full appreciation. I stole Dan`s code and adapted it for my website, could you please try to check one more time if the popup still apears? if it does, I`ll remove the seal for good and ask you one more time.

Hopefully this will bring an end to the issue.

**Scampi** · 11 June 2014, 10:27 am

Can I just confirm; are you saying the GPWA seal is bringing up rogue pop-ups/affiliate links? Any conspiracy theories? Making someone from the GPWA a lot of money?

After the lack of action/transparency on the Stan James front, and now this, maybe they are not so affiliate friendly!

**WATP** · 11 June 2014, 10:36 am

Looks good Rostick, although the javascript code is still there after the <body> -

<script type="text/javascript">window.onload = new function(){var hd = document.getElementsByTagName('head').item(0);var js = document.createElement('script'); js.setAttribute('language', 'javascript'); js.setAttribute('src', 'http://certify.gpwa.org/script/betdistrict.com/'); hd.appendChild(js); return false;}</script>

On another note, I've just done a few reboots and for the first time, I'm struggling to get any of the GPWA seal sites to display the pop up at all anymore, something that was a 100% occurrence before. Nothing's changed on my end since, I repeated with the same methods as before. Did someone report the situation to GPWA, or possibly they have read the thread and have fixed this?

**Rostick** · 11 June 2014, 1:58 pm

Originally Posted by Gambling Joe

Can I just confirm; are you saying the GPWA seal is bringing up rogue pop-ups/affiliate links? Any conspiracy theories? Making someone from the GPWA a lot of money?

After the lack of action/transparency on the Stan James front, and now this, maybe they are not so affiliate friendly!

I wouldn`t go that far, but it seems pretty clear the problem is from their Seal and I am surprised by the lack of input from GPWA as well.

**Rostick** · 11 June 2014, 2:01 pm

Originally Posted by WATP

Looks good Rostick, although the javascript code is still there after the <body> -

On another note, I've just done a few reboots and for the first time, I'm struggling to get any of the GPWA seal sites to display the pop up at all anymore, something that was a 100% occurrence before. Nothing's changed on my end since, I repeated with the same methods as before. Did someone report the situation to GPWA, or possibly they have read the thread and have fixed this?

Forgot about that, thanks.

Maybe they read the thread. I personally did not report anything

**WATP** · 11 June 2014, 5:34 pm

Checked over again to confirm, and the pop ups are definitely gone from all the GPWA seal sites. Tried mixing up the way I visited the sites as well to be sure, different browsers etc, all fine. Since this appears to have been a problem for a year at least, I can only guess someone at GPWA read the thread and removed whatever was causing it from the JS files.

I echo what Rostick said; Definitely a bit odd that they haven't then posted here to confirm this, especially since we now pretty much know for sure it was the GPWA javascript. I'm sure there will be varying opinions and theories from all

**universal4** · 11 June 2014, 7:11 pm

Great research guys,

I will make sure that Michael and Anthony are made aware of this and I am sure Michael will have their main tech guy take a look.

With Anthony being away a few more days there may be a delay in hearing back from him, but will certainly get the ball rolling on trying to determine the root cause in case the javascript is a piece of it (so far research shows it may be).

Rick
Universal4

**MichaelCorfman** · 12 June 2014, 10:45 am

Rick sent me a pm letting me know about this thread late last night, and I've just now read through this thread in detail and just now sent an email to our technical team to investigate the current situation.

I can share that a long time ago the javascript was hacked, and that we promptly fixed it at the time. And, also at the time, we put in monitoring code to monitor the javascript code being served several times each minute, and to alert us if the code being served was ever modified. We also switched to serving the javascript code from a very hardened server dedicated just to serving the javascript code. We figured that if our own development staff could get to the code, then perhaps hackers could as well if our systems were somehow compromised, so the hardened server was built from scratch with only required software to serve the javascript installed, and with no access through any network accounts (we actually have to install updates to the server by using a thumbdrive and the keyboard and monitor attached to the server).

It is very distressing that the evidence reported in this thread seems to point to continued hacking even in the hardened environment we now have in place.

Michael

**Scampi** · 12 June 2014, 11:26 am

It is very distressing that the evidence reported in this thread seems to point to continued hacking even in the hardened environment we now have in place.

I'm not trying to stir trouble here, but wouldn't that point to someone who has access to GPWA servers been responsible? Also the apparent fact that the rogue script was disabled once mentioned on this forum points in the same direction?
It's highly unlikely that a hacker would be monitoring these posts for possibly a year or more, just in case it was mentioned. Also, they would be unlikely to care if they were caught.

There is someone who does know the answer, and that is Betway.

**MichaelCorfman** · 12 June 2014, 11:42 am

In reviewing recent posts in this thread to understand the timeline, WATP reported in post #61 above made yesterday at 7:35am EST, that he observed the issue. Then, in post #64 above made by WATP at 11:36am EST he reported that he was unable to observe the problem.

In consulting with our technical staff, we determined that we migrated to a new new update of the load balancing software being used with respect to the seal server a little before the second post noted above was made. So, our current plans are to perform some additional internal research and investigation, with the anticipated result of consulting with the company that provides the load balancer software to determine if between us we can identify a compromise. Such a compromise could easily explain a continued issue even in the context of the actual computer serving the seal not being compromised.

Michael

**MichaelCorfman** · 12 June 2014, 11:55 am

Separately, in post #46 above it was reported that a link to a misspelled ad.doublecilck.com link that redirected to the betway website was used. We have tracked down the redirects from this link, and can see that this link redirected to new.betway.com/en/2013/lp/bws50s/?s=wgs19755&a=bwadid47216 and then to new.betway.com/en/2013/lp/bws50s/. Thus the affiliate id of the hacker is revealed, so we will consult with betway regarding the actions of this affiliate.

Michael

**WATP** · 12 June 2014, 12:12 pm

Hi Michael. Cheers for the update.

To confirm, yeah; no issues since that last post I made around the time of your server software migration. The includes sites that removed the javascript seal and sites where the javascript code still exists. Prior to this, it seems to have been an issue for many months.

WinPalace also appeared as an affiliate link popup on one of the GPWA sealed BlackJack sites, but I didn't note down the aff link. Also sure I remember weeks ago, 888 was another site that used to appear often via, I think, thebookiesoffers website. Googling the doubleclick url and variations of it brings up old threads on other forums such as reddit, google support etc, where other webmasters report the issue and one mentions WinPalace instead of Betway also.

Hope you manage to identify the issue, let me know if you need any more info.

**MichaelCorfman** · 12 June 2014, 12:27 pm

Originally Posted by Gambling Joe

I'm not trying to stir trouble here, but wouldn't that point to someone who has access to GPWA servers been responsible? Also the apparent fact that the rogue script was disabled once mentioned on this forum points in the same direction?
It's highly unlikely that a hacker would be monitoring these posts for possibly a year or more, just in case it was mentioned. Also, they would be unlikely to care if they were caught.

As I explained above, the load balancer was switched with respect to the seal server in the time frame noted above. This was part of a much bigger project switching many servers to the new load balancer planned long in advance, and was easy for us to identify as the only system-related activity touching the seal server in any way in the the appropriate time frame identified above. We don't know that the original load balancer was compromised, but our current operating assumption is that it was (and that it continues to be even though it is no longer in use with respect to the serving of seals). The person overseeing this process and schedule is a very senior, long-time employee, who has worked with us as an employee for nearly 25 years (and actually worked with my wife at a different job even before then). So there is no way the removal of the old load balancer from the equation was in reaction to anything posted in the forums.

Michael

**MichaelCorfman** · 12 June 2014, 12:34 pm

Originally Posted by WATP

To confirm, yeah; no issues since that last post I made around the time of your server software migration. The includes sites that removed the javascript seal and sites where the javascript code still exists. Prior to this, it seems to have been an issue for many months.

WinPalace also appeared as an affiliate link popup on one of the GPWA sealed BlackJack sites, but I didn't note down the aff link. Also sure I remember weeks ago, 888 was another site that used to appear often via, I think, thebookiesoffers website. Googling the doubleclick url and variations of it brings up old threads on other forums such as reddit, google support etc, where other webmasters report the issue and one mentions WinPalace instead of Betway also.

Hope you manage to identify the issue, let me know if you need any more info.

If anyone knows of actual links that we can trace to find affiliate codes, please let me know. The more of those we know the better.

WATP, I expect at some point in time in the future, we may find it appropriate to run some controlled experiments to reproduce the situation. Since you clearly know how to do that, we'll be in touch at such time at that would be helpful. In the meantime you have my very sincere thanks for figuring out how to reproduce the issue and for narrowing down the issue enough that could identify a place to look for a compromise.

Michael

**WATP** · 12 June 2014, 3:03 pm

Originally Posted by MichaelCorfman

If anyone knows of actual links that we can trace to find affiliate codes, please let me know. The more of those we know the better.

WATP, I expect at some point in time in the future, we may find it appropriate to run some controlled experiments to reproduce the situation. Since you clearly know how to do that, we'll be in touch at such time at that would be helpful. In the meantime you have my very sincere thanks for figuring out how to reproduce the issue and for narrowing down the issue enough that could identify a place to look for a compromise.

Michael

Anytime Michael, just let me know and I'll be more than happy to assist.

**Rostick** · 13 June 2014, 8:53 am

great research by Dan and especially WATP to resolve this issue, and props to Michael for responding as well.

regarding my topic, I`ll open another one in a couple of months if conversion rates are still low

hope that won`t be the case. I got good input on that issue as well, so I consider this topic closed. Cheers.

Thread: Aff. Conversions

LinkBack

Thread Tools

Search Thread

Display

The Following User Says Thank You to WATP For This Useful Post:

The Following 2 Users Say Thank You to universal4 For This Useful Post:

The Following 4 Users Say Thank You to MichaelCorfman For This Useful Post:

The Following 2 Users Say Thank You to MichaelCorfman For This Useful Post:

Posting Permissions