affiliate fraud

Lightning McQueen · May 3, 2013

and i suspect they've been putting it in sigs as well, those posts will obveously not show up in a site search. so there could be a few of those to find as well.

to be sure check this profile for hidden sig spam http://www.trade2win.com/boards/members/377814-jessica_21.html

if you see imagicon.info in that sig then likely you will not find all the post spam without a lot of effort.

to help out here's more to check

http://www.trade2win.com/boards/members/392790-flogger1.html

http://www.trade2win.com/boards/members/382362-stinklyonion.html

http://www.trade2win.com/boards/members/397042-paragon123.html

Lightning McQueen · May 4, 2013

Trader333 said:
As a matter of interest I checked my own browser for these links as I use firefox and there is nothing of affiliate nature at all in my cookies so this would imply that the cookies are not autogenerated unless I am missing something ?

i have just checked also using firefox, there are definitely cookies being dropped when viewing a page with these images.

one is named imagicon.info, so they are definatly serving something other than the image. another cookie that appears is betfair.com, a lot of these clowns are posting in betfair threads, is this a smoking gun? or a normal ad related t2w cookie?

so patricia i believe is packing a betfair affiliation in her sig.

flogger1 is packing a etoro affiliation in his sig. unless this little nugget belongs to t2w "AffiliateID=27755&ClickBannerID=0&SubAffiliateID=&Custom=&ClickDateTime=5/3/2013 10:55:51 PM"

stinklyonion is packing betfair in his sig.

why is nothing being done!

Lightning McQueen · May 4, 2013

that was the known sig linkers outed

now for the in post spammers

the latest clown - the nearly but not quite all deleted yet peleus - betfair

this page is crawling with affiliation in addition to flogger1 but he's etoro only remember, i believe it's another jessica - fancy that :whistling that packs the most here http://www.trade2win.com/boards/gen...ing-demo-accounts-practice-7.html#post1545254

that 1 page alone is heaving with affiliation to

etoro
dukascopy
plus500
easyforex
betfair

my work here is done!

Lightning McQueen · May 4, 2013

Lightning McQueen said:
why is nothing being done!

..and still nothing done yet

it's very disappointing. what more proof and independent documentary evidence do you need to show these spammers are up to no good. you cannot say this time round as happened before that there is not proof and the issue cannot be seen. it can be seen in firefox, so that one can't be used as before. a board clean up of these clowns is now well overdue.

Lightning McQueen · May 4, 2013

the site imagicon.info is only 2+ years old and has a privacy protected registration.

although privacy protected, a reverse whois suggests an indonesian origin for imagicon.info.

t2w has the dubious honour of being ranked 5 for allowing links associated with imagicon.info.

9138-lightning-mcqueen-albums-pics-picture3066-imagicon-linking-tables.jpg

Lightning McQueen · May 4, 2013

haha one of the jessica's posts over at traderji. yes they are all posting everywhere on forum land with the same nics.

the post in the pic looks harmless enough in a firefox browser doesn't it. can't see anything untoward about it on face value, no links to be seen, no dodgy looking smilies.

if same page viewed with a ie browser you can see a clue something isn't right with red x's within the post.

now look at the cookies that one innocent looking post has dumped on my pc!!!

9138-lightning-mcqueen-albums-pics-picture3068-jessica-spammer.jpg

you have 72 threads containing these posts. get a grip and bin these spammers please!

Trader333 · May 4, 2013

I am not available most of Saturday to address anything such as this but now you have listed them they will be addressed before the end of Sunday.

malaguti · May 5, 2013

Lightning McQueen said:
haha one of the jessica's posts over at traderji. yes they are all posting everywhere on forum land with the same nics.

the post in the pic looks harmless enough in a firefox browser doesn't it. can't see anything untoward about it on face value, no links to be seen, no dodgy looking smilies.

if same page viewed with a ie browser you can see a clue something isn't right with red x's within the post.

now look at the cookies that one innocent looking post has dumped on my pc!!!

you have 72 threads containing these posts. get a grip and bin these spammers please!

seems to me that this site should be avoided altogether if I could inadvertantly be hosting malicious content

Lightning McQueen · May 5, 2013

malaguti said:
seems to me that this site should be avoided altogether if I could inadvertantly be hosting malicious content

how do you mean?

if you mean traderji then be prepared to be shocked, in that the very same posts from jessica 30 have been sat on t2w for a couple of years. i have mentioned it but not posted the pic, i haven't posted that proof yet as i'm waiting for them to delete so we have conclusive proof of the fraudulent activity, and cookie dropping capabilities from just viewing a post containing images from a so called free emoticon site.

the delay in dealing with this is worrying. t333 will i'm sure be good to his word today

Trader333 · May 5, 2013

LM,

I have cleaned up the ones listed but as you say there are a lot more in many threads. What I could do with is a "find and replace (or delete)" option that would just clean all threads it is in. I will discuss this with Steve and Paul as to the best way to do a clean sweep. If you have any more suggestions then let me know. There are a few other possibilities in preventing or reducing this sort of activity and thanks for highlighting it.

Liquid validity · May 5, 2013

Trader333 said:
LM,

I have cleaned up the ones listed but as you say there are a lot more in many threads. What I could do with is a "find and replace (or delete)" option that would just clean all threads it is in. I will discuss this with Steve and Paul as to the best way to do a clean sweep. If you have any more suggestions then let me know. There are a few other possibilities in preventing or reducing this sort of activity and thanks for highlighting it.

Try using google advanced search on the T2W url:
http://www.trade2win.com/boards/
Search term could be the external image link, or image name if hosted on T2W.
Unless you have specific admin tools, better than nothing?

Trader333 · May 5, 2013

Finding the links is not the issue so much as doing a block replace / delete command to get rid of them.

Liquid validity · May 5, 2013

Trader333 said:
Finding the links is not the issue so much as doing a block replace / delete command to get rid of them.

I have no idea how things work with this board software,
so I may be talking bo11ox...

Can you download and upload the forum database links / hosted content
as xml into excel?
Find relevant links / images, replace with nothing,
then upload edited xml sheet?
Sort by conditional formatting might be easier?

That would work, but only if you can DL in xml to excel...
Obviously, content may remain on T2W server, but it won't be linked to anymore.

Lightning McQueen · May 5, 2013

Trader333 said:
LM,

I have cleaned up the ones listed but as you say there are a lot more in many threads. What I could do with is a "find and replace (or delete)" option that would just clean all threads it is in. I will discuss this with Steve and Paul as to the best way to do a clean sweep. If you have any more suggestions then let me know. There are a few other possibilities in preventing or reducing this sort of activity and thanks for highlighting it.

:clap: ok yes lots removed i see.

and yes it's getting there, but not there quite yet.

you were looking at 112 posts including all quotes across 72 threads, which should have been about 8 clicks of the mouse to rid the lot, how long does it take to click the mouse 8 times? 5 mins tops including waiting between clicks for the deletions to be done and the page to refresh. less than that if each page doesn't have to be selected individually, so i estimate 2 mins tops if that's the case that all posts can be selected and not 1 page at a time. possibly less than that with an admin pruning tool. notwithstanding the 2 year wait, why was there a delay with overwhelming proof this was spam and malicious devious spam at that, there's been mods on all weekend. something went wrong here.

no matter, it's under way

Lightning McQueen · May 5, 2013

a late note of caution to everyone that's tempted or plain nosey. (other than the mods obveously :cheesy: )

please don't be tempted to click the above links else you'll be the recipient of a ib and/or affiliate cookie from these clowns, ok

if you already have done so please clean out your cookies asap.

Lightning McQueen · May 5, 2013

http://www.trade2win.com/boards/members/393166-chillracer.html

this could be a special idiot, i believe this could be one of the earliest new style https spammers, possibly only dropped in to t2w to test out their new system. both sig image and post image are labelled as "test" and are clean of any dodgy drops other than an imagicon cookie labelled "test".

maybe a good idea to look deeper and record everything about this one... etc etc.

Trader333 · May 5, 2013

LM,

OK thanks for the other links and names, I am limited for time now until probably Monday evening but will get on with the list when I can.

Trader333 · May 5, 2013

Most of these are coming from the Phillipines and we could ban the entire IP range for the whole country but that may be a bit harsh. We may also be able to ban the word imagicon from anywhere including sig links so again I will look into it.

Trader333 · May 5, 2013

I have actioned the lot but more to do.

Lightning McQueen · May 5, 2013

Liquid validity said:
Try using google advanced search on the T2W url:
http://www.trade2win.com/boards/
Search term could be the external image link, or image name if hosted on T2W.
Unless you have specific admin tools, better than nothing?

for everything in most situations i would wholeheartedly agree with you on the google searching. most of the time you can find far more through google than through the t2w search function.

but i have to say the unexpected thing i noticed on this issue is that search success turned right around. for reasons unknown google was almost completely blind on this one, whereas the t2w function excelled itself seeing the texts behind image icons, hidden texts and the quotes. so pervasive are these links that the search function still wants to report back threads where posts are clearly now deleted and reside in the bin.

that's not to say there are no lurker posts, there are likely more yet undiscovered and finding them is only as good as the search tools and search terms used. though i believe high confidence on current search terms that this batch of nasties have bit the dust.

now what to do about all t2w members who have nasty cookies sat resplendent on their pc's :whistling

over to admin i think for that hot potato...

affiliate fraud

malaguti

Liquid validity

Liquid validity

Similar threads