Page 1 of 2 12 LastLast
Results 1 to 25 of 32
  1. #1
    Affiliate Manager PetsWarehouse.com's Avatar
    Join Date
    January 17th, 2005
    Location
    Long Island, New York
    Posts
    1,616
    One of our affiliats just brought this to my attention his link is redirecting to a casino??

    Test many other affiliate links they are fine.

    What's going on here?

    Try this link

    this link is posted with the affiliates permission.

    Help

    Henry
    Affiliate Manager
    <font face=verdana size=1 >Migizzi Inc d/b/a</font> Pets-Warehouse.com <font face=verdana size=1 color=43639C>10%/90 days/Datafeed/Parasite free
    </font>
    Henry@Pets-Warehouse.com<font face=verdana size=1 color=43639C> >< )))º> 631.789.5400 | Pets-Warehouse.com</font>

  2. #2
    ABW Veteran Student Heyder's Avatar
    Join Date
    January 18th, 2005
    Posts
    5,482
    http://www.pets-warehouse.com/vpasp/shopaff.asp?

    The shopaff.asp part is where the problem occurs when I clicked the link. The affid=xxx made no difference so all of your affiliates should be having the same problem. The only reason this affiliate might have the problem and not the others might be wether or not their affid is valid. If you change the numbers you end up at the casino.

    If you are on a shared server it could be just an alias mistake.

  3. #3
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    1,663
    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>
    If you are on a shared server it could be just an alias mistake. <HR></BLOCKQUOTE>
    Or the host knowingly redirects bad calls to the casino instead of a 404 file. The resulting URL has an affilliate number in it.

    Good catch Heyder.

    Wayne

  4. #4
    Affiliate Manager PetsWarehouse.com's Avatar
    Join Date
    January 17th, 2005
    Location
    Long Island, New York
    Posts
    1,616
    We have a dedicated server. Our other affiliates are coming thru and orders are comeig in??

    Our 404 is custom and intact.

    When that link is clicked
    it shows http://www.zodiaccasino.com/splash_2...23336&pop_up=1

    I think one of the casino's affiliates is a parasite? The parasite looks like their affilite 23336

    They are located in AU I called them they sounded concerned not a fly by night outfit they filled out a tech support ticket and said they would reply on Monday??????

    Henry
    Affiliate Manager
    <font face=verdana size=1 >Migizzi Inc d/b/a</font> Pets-Warehouse.com <font face=verdana size=1 color=43639C>10%/90 days/Datafeed/Parasite free
    </font>
    Henry@Pets-Warehouse.com[/URL]<font face=verdana size=1 color=43639C> >< )))º> 631.789.5400 | [URL=http://www.pets-warehouse.com]Pets-Warehouse.com</font>

    [This message was edited by Pet Dealer on January 09, 2004 at 05:40 PM.]

  5. #5
    2005 Linkshare Golden Link Award Winner  ecomcity's Avatar
    Join Date
    January 18th, 2005
    Location
    St Clair Shores MI.
    Posts
    17,328
    Serious problem if all your home page links get hijacked to this casino affiliate via a redirect from your dedicated server. Sure it isn't an employee making some side money as Heyder pointed out ALL links redirect is they are coded like that?

    Mike & Charlie ...

    If they won't adopt and feed a bird ..flip them one! BBQ some Gator and remember to flush WhenU..

  6. #6
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    2,082
    Well I clicked that link at 5:16 Pm and I get page cannot be displayed.
    Cazzie

    Fight Back! Parasite Free In 2004!

  7. #7
    Affiliate Manager PetsWarehouse.com's Avatar
    Join Date
    January 17th, 2005
    Location
    Long Island, New York
    Posts
    1,616
    There is only one person that touches the server and has been here several years and completely trusted.

    Cazzie, I just tried it and it comes up?

    It looks to me like an affiliate of the casino overwriting links so far all other affiliates are working.

    Henry
    Affiliate Manager
    <font face=verdana size=1 >Migizzi Inc d/b/a</font> Pets-Warehouse.com <font face=verdana size=1 color=43639C>10%/90 days/Datafeed/Parasite free
    </font>
    Henry@Pets-Warehouse.com<font face=verdana size=1 color=43639C> >< )))º> 631.789.5400 | Pets-Warehouse.com</font>

  8. #8
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    1,663
    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>We have a dedicated server.<HR></BLOCKQUOTE>
    It is puzzling since ...affid=201 redirects, yet if I change it to affid=202, I get "page cannot be displayed." If no parameter is passed, it also redirects.

    Doesn't seem like your typical parasite. Sure sounds like the problem lives on your server. Have you looked in the directories where your shopaff.asp file lives to see if anything new or unknown is lurking there? Or looked at the asp file itself? Check the revision date. Open the file and do search for "zodiaccasino." Of course, there could be an intermediate URL that redirects so check the code for anything else strange.

    My link works, though.

    Wayne

    Added: If this was a typical case of overwriting, the trigger would have to be on all our computers, wouldn't it? Still have the feeling the answer lies in your server.

  9. #9
    Resident Genius and Staunch Capitalist Leader's Avatar
    Join Date
    January 18th, 2005
    Location
    Florida
    Posts
    12,817
    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR> There is only one person that touches the server and has been here several years and completely trusted.
    <HR></BLOCKQUOTE>

    If your server is housed in a data center that you don't own, there could be someone else touching it that you and your authorized tech person don't know about...

    It's the most wonderful time of the year!~Old Christmas Song

  10. #10
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    2,082
    Very strange the links work for me now
    Cazzie

    Fight Back! Parasite Free In 2004!

  11. #11
    Affiliate Manager PetsWarehouse.com's Avatar
    Join Date
    January 17th, 2005
    Location
    Long Island, New York
    Posts
    1,616
    Our server is in our own building I can see it from where I'm sitting.
    That can't be it?

    I really don't think it's the server

    Henry
    Affiliate Manager
    <font face=verdana size=1 >Migizzi Inc d/b/a</font> Pets-Warehouse.com <font face=verdana size=1 color=43639C>10%/90 days/Datafeed/Parasite free
    </font>
    Henry@Pets-Warehouse.com<font face=verdana size=1 color=43639C> >< )))º> 631.789.5400 | Pets-Warehouse.com</font>

  12. #12
    Affiliate Manager PetsWarehouse.com's Avatar
    Join Date
    January 17th, 2005
    Location
    Long Island, New York
    Posts
    1,616
    Aff id 202 doesn't exist.

    I don't want to list the affiliates numbers here without their permission.

    But If someone can test these from the outside of our firewall I appreciate

    369, 1, 19, 174, 213

    Henry
    Affiliate Manager
    <font face=verdana size=1 >Migizzi Inc d/b/a</font> Pets-Warehouse.com <font face=verdana size=1 color=43639C>10%/90 days/Datafeed/Parasite free
    </font>
    Henry@Pets-Warehouse.com<font face=verdana size=1 color=43639C> >< )))º> 631.789.5400 | Pets-Warehouse.com</font>

  13. #13
    Full Member ellen-s4y's Avatar
    Join Date
    January 18th, 2005
    Posts
    489
    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>Originally posted by Pet Dealer:
    Aff id 202 doesn't exist.

    I don't want to list the affiliates numbers here without their permission.

    But If someone can test these from the outside of our firewall I appreciate

    369, 1, 19, 174, 213
    <HR></BLOCKQUOTE>

    Not seeing anything wrong with those numbers, or mine. This is very odd.

  14. #14
    Pimp Duck popdawg's Avatar
    Join Date
    January 18th, 2005
    Location
    Take off eh?
    Posts
    3,249
    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR> I really don't think it's the server <HR></BLOCKQUOTE>

    The redirect occurs on your domain on your dedicated server.
    unless any of the scripts are hosted elsewhere(shouldn't be with vp-asp), that narrows down the location of the problem to your server.

    Have you installed all the vp-asp security fixes? I don't think I saw anything that covers this explicitly although there was something about adding their own SQL in the Nov 29 update.

    This is odd.

    Must Build More in 2004
    Game on!!!! - The DawgFather

  15. #15
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    1,663
    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR> 369, 1, 19, 174, 213 <HR></BLOCKQUOTE>
    All those lead properly to your home page.

    When I said I tried affid 202, I tried some random numbers earlier and couldn't get any to go to the casino link except the one you posted first. Every other bad one gave a page error. The only other redirect I saw was as Heyder pointed out, when the affid perameter is omitted completely.

    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>I really don't think it's the server <HR></BLOCKQUOTE>
    Still wouln't hurt to look at the directory and the asp file, if only to remove it as a suspect.

    Wayne

  16. #16
    ABW Adviser Panel Dynamoo's Avatar
    Join Date
    January 18th, 2005
    Location
    Opposite the Slough of Despond
    Posts
    5,465
    I get http://www.zodiaccasino.com/splash_2...23336&pop_up=1

    Using SamSpade to look at the page, I see:

    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>HTTP/1.1 302 Object moved
    Server: Microsoft-IIS/5.0
    Date: Fri, 09 Jan 2004 23:33:32 GMT
    Connection: close
    Location: http://www.zodiaccasino.com/referral...ff_id=aff23336
    Content-Length: 121
    Content-Type: text/html
    Set-Cookie: affid=201; expires=Thu, 08-Apr-2004 04:00:00 GMT; path=/vpasp
    Set-Cookie: ASPSESSIONIDCCCCSAAA=FKHCNEBCIMAIHFLCNGIDBFDF; path=/
    Cache-control: private

    &lt;head&gt;&lt;title&gt;Object moved&lt;/title&gt;&lt;/head&gt;
    &lt;body&gt;&lt;h1&gt;Object Moved&lt;/h1&gt;This object may be found &lt;a HREF=""&gt;here&lt;/a&gt;.&lt;/body&gt;
    <HR></BLOCKQUOTE>

    Compare that with ID 202:

    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>HTTP/1.1 302 Object moved
    Server: Microsoft-IIS/5.0
    Date: Fri, 09 Jan 2004 23:35:28 GMT
    Connection: close
    Location: http://www.pets-warehouse/default.htm
    Content-Length: 121
    Content-Type: text/html
    Set-Cookie: affid=202; expires=Thu, 08-Apr-2004 04:00:00 GMT; path=/vpasp
    Set-Cookie: ASPSESSIONIDCCCCSAAA=KKHCNEBCHANADILLCOEMCHKB; path=/
    Cache-control: private

    &lt;head&gt;&lt;title&gt;Object moved&lt;/title&gt;&lt;/head&gt;
    &lt;body&gt;&lt;h1&gt;Object Moved&lt;/h1&gt;This object may be found &lt;a HREF=""&gt;here&lt;/a&gt;.&lt;/body&gt;
    <HR></BLOCKQUOTE>

    Beats the heck outta me. I'd check the administrator's PC with Spybot Search & Destroy and also check the other affiliate links (note that Samspade is quicker out of peak hours, but I guess this is something you can check with IIS).

    ________
    "All your commission are belong to us." - Slimeware Corporation

  17. #17
    I like traffic lights
    Join Date
    January 18th, 2005
    Location
    Southern hemisphere - away from Fukushima
    Posts
    2,936
    Here's what's happening for ID 201:

    ****

    from:/home/drewg# wget -S 'http://www.pets-warehouse.com/vpasp/shopaff.asp?affid=201'
    --19:19:12-- http://www.pets-warehouse.com/vpasp/....asp?affid=201
    => `shopaff.asp?affid=201'
    Resolving www.pets-warehouse.com... done.
    Connecting to www.pets-warehouse.com[64.80.161.147]:80... connected.
    HTTP request sent, awaiting response...
    1 HTTP/1.1 302 Object moved
    2 Server: Microsoft-IIS/5.0
    3 Date: Sat, 10 Jan 2004 00:11:40 GMT
    4 Connection: keep-alive
    5 Location: http://www.zodiaccasino.com/referral...ff_id=aff23336
    6 Connection: Keep-Alive
    7 Content-Length: 121
    8 Content-Type: text/html
    9 Set-Cookie: affid=201; expires=Thu, 08-Apr-2004 04:00:00 GMT; path=/vpasp
    10 Set-Cookie: ASPSESSIONIDCCCCSAAA=GNHCNEBCNLNHCABNEMFPGPIE; path=/
    11 Cache-control: private
    Location: http://www.zodiaccasino.com/referral...ff_id=aff23336 [following]
    --19:19:13-- http://www.zodiaccasino.com/referral...id=aff23336%20
    => `referral.asp?aff_id=aff23336%20'
    Resolving www.zodiaccasino.com... done.
    Connecting to www.zodiaccasino.com[207.219.94.77]:80... connected.
    HTTP request sent, awaiting response...
    1 HTTP/1.1 302 Object moved
    2 Server: Microsoft-IIS/5.0
    3 Date: Sat, 10 Jan 2004 00:19:21 GMT
    4 Connection: keep-alive
    5 Location: splash_2/splash_2.asp?aff_id=aff23336 &pop_up=1
    6 Connection: Keep-Alive
    7 Content-Length: 121
    8 Content-Type: text/html
    9 Set-Cookie: onclose=0; expires=Wed, 01-Dec-2004 00:00:00 GMT; path=/
    10 Set-Cookie: from%5Fid=0; expires=Wed, 01-Dec-2004 00:00:00 GMT; path=/
    11 Set-Cookie: affiliate=aff23336+; expires=Thu, 02-Dec-2004 00:00:00 GMT; path=/
    12 Set-Cookie: ASPSESSIONIDCSRBTRQS=PLAJBLPAOCDDCDKGJABIGOLO; path=/
    13 Cache-control: private
    Location: splash_2/splash_2.asp?aff_id=aff23336 &pop_up=1 [following]
    --19:19:14-- http://www.zodiaccasino.com/splash_2...36%20&pop_up=1
    => `splash_2.asp?aff_id=aff23336%20&pop_up=1'
    Connecting to www.zodiaccasino.com[207.219.94.77]:80... connected.
    HTTP request sent, awaiting response...
    1 HTTP/1.1 200 OK
    2 Server: Microsoft-IIS/5.0
    3 Date: Sat, 10 Jan 2004 00:19:27 GMT
    4 Connection: keep-alive
    5 Connection: Keep-Alive
    6 Content-Length: 9504
    7 Content-Type: text/html
    8 Set-Cookie: ASPSESSIONIDCCBQBQQC=JJJJODCCFCMBKNADJBAOJCPL; path=/
    9 Cache-control: private

    ****

    Here's what's happening for ID = 202:

    ****

    from:/home/drewg# wget -S 'http://www.pets-warehouse.com/vpasp/shopaff.asp?affid=202'
    --19:21:15-- http://www.pets-warehouse.com/vpasp/....asp?affid=202
    => `shopaff.asp?affid=202'
    Resolving www.pets-warehouse.com... done.
    Connecting to www.pets-warehouse.com[64.80.161.147]:80... connected.
    HTTP request sent, awaiting response...
    1 HTTP/1.1 302 Object moved
    2 Server: Microsoft-IIS/5.0
    3 Date: Sat, 10 Jan 2004 00:13:41 GMT
    4 Connection: keep-alive
    5 Location: http://www.pets-warehouse/default.htm
    6 Connection: Keep-Alive
    7 Content-Length: 121
    8 Content-Type: text/html
    9 Set-Cookie: affid=202; expires=Thu, 08-Apr-2004 04:00:00 GMT; path=/vpasp
    10 Set-Cookie: ASPSESSIONIDCCCCSAAA=KNHCNEBCJMADEAACOCFFNJBH; path=/
    11 Cache-control: private

    (snipped)
    ****

    For starters, look at the redirect that the ID=200 query gets.

    Note there is no ".com" on the end of the "www.pets-warehouse"

    As for ID=201, it certainly looks like the redirect to the casino site is coming FROM YOUR MACHINE.

    You need to get someone who know's the in's and out's of MS IIS (don't look at me, sunshine) and get them to do a forensic examination of the system to see who's been playing, and exactly how they got in.

    And you need to find out who aff # 23336 for zodiaccasino.com is!

    ****************************
    Jimmy James Inc. fan club membership # 3312

    "But Jimmy had fancy plans, and pants to match"

  18. #18
    ABW Ambassador cditty's Avatar
    Join Date
    January 18th, 2005
    Location
    Memphis TN
    Posts
    1,434
    One thing you might try doing is getting a really good program that can search INSIDE files and search all your asp pages for the casino site. UltraEdit is a really good program that does that.

    Unfortunately, either all of us are infected with something, unlikely as as drewbert used wget and I am using firebird. Check out your box. You might have been compromised. NT/IIS hasn't been the most secure servers in the world.

    Chris

    ----------------------------
    <FONT SIZE=1>ezDatafeed.com - Merchants - Give your affiliates your datafeed outside the networks, without cost to the affiliate. Check out ezDatafeed.com for more information.
    Scriptsforyoursite.com - Featuring datafeed import scripts for Backcountry Store, Coldwater Creek, Mondera.com and many more.....</font>

  19. #19
    Affiliate Manager PetsWarehouse.com's Avatar
    Join Date
    January 17th, 2005
    Location
    Long Island, New York
    Posts
    1,616
    thank all of you for the input.

    I tried to block outbound traffic thru the firewall to 207.219.94.77, but it sill redirects?

    Assuming that the redirect was on the server and I block outbound traffic??????

    Any more Idea's

    Henry
    Affiliate Manager
    <font face=verdana size=1 >Migizzi Inc d/b/a</font> Pets-Warehouse.com <font face=verdana size=1 color=43639C>10%/90 days/Datafeed/Parasite free
    </font>
    Henry@Pets-Warehouse.com<font face=verdana size=1 color=43639C> >< )))º> 631.789.5400 | Pets-Warehouse.com</font>

  20. #20
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    594
    what is in that redirect script?

    http://www.pets-warehouse.com/vpasp/shopaff.asp?

    IamJaloppy

  21. #21
    I like traffic lights
    Join Date
    January 18th, 2005
    Location
    Southern hemisphere - away from Fukushima
    Posts
    2,936
    <I tried to block outbound traffic thru the firewall to 207.219.94.77, but it sill redirects?

    >Assuming that the redirect was on the server and I block outbound traffic??????

    Not use whatsoever.

    You don't send any traffic through your server to the Casino. That's not how it works.

    Someone contacts your server, and you server tells them to go to the casino DIRECTLY. You can't block it with YOUR firewall.

    You have to look at your server and see what's doing the redirect.

    As I said before, you need an IIS guru.

    ****************************
    Jimmy James Inc. fan club membership # 3312

    "But Jimmy had fancy plans, and pants to match"

  22. #22
    Affiliate Manager PetsWarehouse.com's Avatar
    Join Date
    January 17th, 2005
    Location
    Long Island, New York
    Posts
    1,616
    We just recieved a reply from the casino tech support group.

    Yep, that is weird. FYI this affiliate is not making any money out of it; I will contact him and get some explanations.

    Thanks for that!

    Cheers

    ---------

    They appear to be responsible, I will await their reply.

    Henry
    Affiliate Manager
    <font face=verdana size=1 >Migizzi Inc d/b/a</font> Pets-Warehouse.com <font face=verdana size=1 color=43639C>10%/90 days/Datafeed/Parasite free
    </font>
    Henry@Pets-Warehouse.com<font face=verdana size=1 color=43639C> >< )))º> 631.789.5400 | Pets-Warehouse.com</font>

  23. #23
    Full Member ellen-s4y's Avatar
    Join Date
    January 18th, 2005
    Posts
    489
    Henry,

    http://www.pets-warehouse.com/vpasp/shopaff.asp With no affid, redirects to the casino as well.

  24. #24
    ABW Ambassador cditty's Avatar
    Join Date
    January 18th, 2005
    Location
    Memphis TN
    Posts
    1,434
    Henry, this is coming from your page. If you need someone to look at the page, feel free to email me the shopaff.asp page and I will take a look. I do some asp programming at work and should be able to help you troubleshoot it.

    Again, the problem is inhouse(that scipr most likely). There is no way that all of us are infected with some sort of parasite that is only tageting your program.

    Feel free to sand me a copy of it and I will be happy to look at it for you.

    Chris

    ----------------------------
    <FONT SIZE=1>ezDatafeed.com - Merchants - Give your affiliates your datafeed outside the networks, without cost to the affiliate. Check out ezDatafeed.com for more information.
    Scriptsforyoursite.com - Featuring datafeed import scripts for Backcountry Store, Coldwater Creek, Mondera.com and many more.....</font>

  25. #25
    ABW Veteran Student Heyder's Avatar
    Join Date
    January 18th, 2005
    Posts
    5,482
    Could it be that his zone file was either hacked or the wrong ip entered?

+ Reply to Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Google can't hack it?
    By buy_online in forum Search Engine Optimization
    Replies: 16
    Last Post: January 9th, 2006, 08:41 AM
  2. Hack Attempt @ 5:15 PM
    By Haiko de Poel, Jr. in forum Midnight Cafe'
    Replies: 7
    Last Post: January 10th, 2002, 03:56 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •