on site "pop ups"

[thebookiesoffers]

one of my sites I just went on and a "pop up" appeared - 'so and so sites says enjoy casino games, click here'

I know I haven't installed anything to do that, Im not even using a CMS, just code. So I clicked and it went through to WinPalace, which is a affactive site. I dont advertise them at all and not even a member of affactive so WTF? Anyone know what the code is, how it got there and by whom/what?

[wonderpunter]

Most likely a plugin on your browser, that or spy ware.. I get them using the hola extension sometimes when I need to check GEO is working correctly

[pinkytoe]

Check to see if your websites were hacked. This could be by code injection.

Running screaming frog through your site or a similar tool will show up an leach pages too.

Also, as said above it could be your own malware that is producing it - in that case run Malwarebytes.

Feel free to PM me URL if you want me to take a look, although I'm far from an expert.

[TheGooner]

Did the page have a GPWA membership logo/banner on it?

The server / banner system was hacked 6-12 months ago, with something injected into the GPWA system to make the pop-up appear in certain situations. I was affected and removed the banner to remove the ad. I never added it back.

(Of course it may not be GPWA logo this time - but it is likely to be something similar from a 3rd party.)

[thebookiesoffers]

it was like one of the pop ups some sites have when you try and back click, 'do you really want to leave this page' sort of thing

[TheGooner]

Sounds like the same symptoms (but of course might be any 3rd party hack).
How exactly did you visit your site - via a google click, via a GPWA click or direct type-in?

I can't find the thread on here detailing it (tried "GPWA seal hack") just a couple of threads referencing it.

[WATP]

Hey BookiesOffers.

I PM'd you about this during that thread that Gooner is talking about. He's bang on, it was the GPWA javascript seal, and a few weeks ago, I started spotting it appearing now and then on sites that held this seal again. The first time it happened, around a year ago, your site was one of the ones that had the issue for sure, as well as Gooner's. As soon as he removed the seal from his site, the problem was fixed. Same thing, a popup that said "click here to play casino" thing or whatever and it went to winpalace when you clicked "ok".

A guy from GPWA got in touch with me back then, but to be honest, the efforts to remove it seemed a waste of time. As far as I recall, it shows only ONCE per IP per day, and it seemed to depend totally on how you actually loaded the site. Can't remember if it was through a referral from another domain, google or directly typing it, but the popup didn't always appear.

Edit: Old Thread >> https://www.gpwa.org/forum/aff-conve...217922/p4.html

[thebookiesoffers]

cheers dudes, found the code in the script which i forgot was there as I dont actually have the seal on the site so will delete and see what happens