Skip to main content
gamedev.net
🔒 Locked

Ads impersonating GDNet

Started by Hodgman 70 replies 17.4k views
Original Post
Hodgman
Hodgman

Not sure how much you can do about this, but there's an advertiser putting banner ads on the site that impersonate the style to fool people into thinking they're actual GDNet links:

ulEcEU4.png

Worse still, if you click on one of those links, they've pirated the GDNet header on the site that the links take you to:

xNM57BR.png

Michael Tanczos
Michael Tanczos

I saw that too. I know we've had to put some new ad networks in place so I'm trying to figure out which one it belongs to. I don't like that they are taking our header to make it look like a gamedev.net page.

TheChubu
TheChubu

Its like those ads that simulate being the "Download" link :D

"I AM ZE EMPRAH OPENGL 3.3 THE CORE, I DEMAND FROM THEE ZE SHADERZ AND MATRIXEZ"   My journals: dustArtemis ECS framework and 
frob
frob

I saw it early this evening, and in an effort to capture more details, discovered it is somewhat defensive to identification.

When I opened Chrome's developer tools chrome stuttered and the add unloaded itself, then the page reloaded.

Hoping to capture it again in progress, I kept the Chrome debugging window open and browsed the site this evening as normal. I noticed one time the page loaded the ad for an instant then immediately reloaded without the ad, and it also reset Chrome's debug console! I have flash turned off and several script limiters so it is probably html5 driven.

Whoever is running the ad knows full well that they are up to no good, are evading anti-script tools, and are trying to evade capture in debugging tools.

Servant of the Lord
Servant of the Lord

When I opened Chrome's developer tools chrome stuttered and the add unloaded itself, then the page reloaded.

Wow, that's pretty impressive crazy.

frob
frob

I saw that too. I know we've had to put some new ad networks in place so I'm trying to figure out which one it belongs to. I don't like that they are taking our header to make it look like a gamedev.net page.

It shows up with a media net link when picking the ad options button, if that helps.
frob
frob
The URL of the followed link is this, tons of tracking detail inside it.

Their site has a title 'Gamedev.net' and has stolen a screenshot of the banner, which they host here where it could be removed with a DMCA claim pretty easily.
Servant of the Lord
Servant of the Lord

The same ad is back - I'm seeing it in multiple threads.

One of the button redirect links:

[Malicious linky]


Depending on the link, the url paths are different, but they all seem to be 637501985.keywordblocks.com, with the number being constant for every ad I'm currently seeing. (Presumably it changes whenever the ads are blocked, or maybe the number is just a timestamp) Actually, it's the same number prefix used in frob's link three days ago.

Amusingly the button links are context-sensitive to what's on the page. In this thread, we're talking about, among other things, lockpicking minigames in RPGs. So three of the buttons read: [Lockpicking] [Keyless locks] [Emergency locksmith]

Whereas, in this thread we're talking about ads, so it displays:

[Banner advertising] [Banner design] [Pay-per-click] [Website promotion] [Online advertising] [Free targeted]

Postie
Postie

That would explain why the actual content displayed on the buttons is often cut off. Eg on the APIs and Tools forum page the first item should read "Game Development Courses", but the Courses part is omitted.

[size="2"]Currently working on an open world survival RPG - For info check out my Development blog:[size="2"] ByteWrangler
Orymus3
Orymus3




Amusingly the button links are context-sensitive to what's on the page

Indeed, can't believe I've actually missed that.

Wow, they went to great lengths!

Madhed
Madhed

Currently this is the only ad I see on GDNet. Every page I open, I see this Imposter. wtf!?

Orymus3
Orymus3

Currently this is the only ad I see on GDNet. Every page I open, I see this Imposter. wtf!?


Also accurate for me though they NEVER show up on mobile :S
TheChubu
TheChubu




Currently this is the only ad I see on GDNet. Every page I open, I see this Imposter. wtf!?
Yup. For me too its pretty much the only ad I see.
"I AM ZE EMPRAH OPENGL 3.3 THE CORE, I DEMAND FROM THEE ZE SHADERZ AND MATRIXEZ"   My journals: dustArtemis ECS framework and 
Madhed
Madhed

Have you considered other ad networks, like Google Adsense for example?

This is not the first time that there were problems with the banner, after all.

Michael Tanczos
Michael Tanczos

Have you considered other ad networks, like Google Adsense for example?

This is not the first time that there were problems with the banner, after all.

Adsense booted us.. and there doesn't seem to be a close second. Even with media.net and their ads we'll only make about $5 per day which is nowhere near enough.

jefferytitan
jefferytitan

Which ad provider are you using? Isn't there any way to report a malicious ad? Or change which categories of ads they serve?

Sik_the_hedgehog
Sik_the_hedgehog

Oh wow, just tried and I bugged it up pretty hard. I tried loading the console just to see, and indeed the ad refreshed... back into the same ad. Meaning it completely failed to dodge it. Good job. (also if you can't get that situation to happen, the ad is its own frame, you can still examine its source code and it won't be able to tell you did)

For the record, detecting if the console is open turns out to be rather simple: just check the height difference between the window size and the document size (outer height vs inner height). If the difference is large enough it probably means the console is opened.

Don't pay much attention to "the hedgehog" in my nick, it's just because "Sik" was already taken =/ By the way, Sik is pronounced like seek, not like sick.
Stormynature
Stormynature




Even with media.net and their ads we'll only make about $5 per day which is nowhere near enough.

Is the site in trouble?

samoth
samoth



Adsense booted us...
Out of curiosity, why would they do that? Surely, GD.net is enough of a "serious, high profile site" with enough visibility/exposure so they'd want you as customers, no?



637501985.keywordblocks.com, with the number being constant for every ad I'm currently seeing
Probably the 637501985 is a virtual host name (one for every site) that translates to "Gamedev.net" in this case, which lets them track which site the clicks came from. Or maybe they log it on their load balancer, to the same effect. One of the GET values would likely translate to what ad you clicked on (like "locksmiths", "cheap locks" or whatever).

Might be fun writing a bash script that forks off a few sub-shells running wget to do continuous GETs with some random 9-digit hostname on the keywordblocks.com domain and with some random GET vars (or maybe choosing random values out of a selection of 3-4 legitimate values) over night, and having the user-agent set to something like "Thank you for not stealing your copyrighted logo and impersonating our site. Are you getting the message or do we have to get more concrete?" followed by 4 kilobytes of random, incompressible data. You might add another 4kB of random data as GET variable if you feel funky, too. By default, pretty much every web server accepts anywhere from 4 to 16kB of data for GET-vars and user-agent (the hell, why would you want that! but they do!), and most of them log at least the URL and user-agent right away, and verbatim. Spawning an extra few thousand web server instances and filling the logs with incompressible data is a pretty safe way of getting a site administrator's attention.

I've actually done that thing once around 2004 or so (might have been 2005) with a particularly obnoxious "Canadian Viagra Pharmacy" (or similar) site that was really pissing me off. They had actually filled up three coworker's mail quota with spam, which was "only" 5GB at that time -- effectively disabling them from using email.

Much to my surprise (to be honest, pissed off as I was, I had never really expected that to work), they actually stopped sending us mail within 3 days of me starting the script on half a dozen machines here, and half a dozen machines in my old lab at my alma mater. Sadly, I don't think I still have the script around any more... in retrospective, that was actually quite fun. biggrin.png

frob
frob

Out of curiosity, why would they do that?

Answered last month: "Google AdSense banned our ad account.. AdSense is a primary means of supporting the site so we are in emergency mode to fix the problem. Long story short, they don't like the way we display ads responsively (ie. how the site looks when you shrink the browser down). They also didn't like the dropdown menu directly covering the ad either.."

Might be fun writing a bash script that...

That would be bad.

The advertiser would likely drop the site. And if the site is no longer on AdSense, would mean basically no revenue except from gd+ subscriptions.

I have read about temporary AdSense blocks before, they can be very painful.

There is no serious competition, so no good way to earn money from website ads except through Google. Google acquired the other major ad sources. They bought Applied Semantics eleven years ago to build AdSense. They paid over $3B to buy DoubleClick, nearly a billion for AdMob, a half billion for Admeld, and so on. There used to be lots of choices for website ads, but Google made themselves the monopoly through a bunch of buyouts.

If the site is hurting on a temporary basis it might be time to bring back the donation form and the "donated money to the site" recognition, and/or have a membership drive again. If the AdSense ban were to be permanent, well, that's really bad news.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.