CJ publisher abusive acts report

**in2sky** · 24-08-10

Dear CJ team,

I was pointed to post my concerns regarding to abusive act here. Please direct me to the correct channel if this is the wrong place.

I'm an adsense publisher from Thailand and recently facing an attempt to replacing my adsense with CJ ads. To be exact, replacing all adsense ads with CJ ads. This problem is happening to every web page that has adsense installed and happening to many users in Thailand as you can see some example discussions in links below (in Thai).

http://www.thaiseoboard.com/index.php/topic,133579
http://www.thaiseoboard.com/index.php/topic,134329
http://www.thaiseoboard.com/index.php/topic,134666

I don't have a clue how this happening but my best guess is that this caused by some kind of adware. This so call adware trying replace every single adsense on any site that user gain access => stealing adsense publisher money!

Here's some proof (the sites listed here aren't mine):

This is how the site look before get replaced by CJ ads (see the URL on bottom left)
http://img248.imageshack.us/i/jayadsense.jpg/

This is how the site look after get replaced by CJ ads (see the URL on bottom left)
http://img137.imageshack.us/i/jaycj.jpg/

Before
http://img836.imageshack.us/i/kapookadsense.jpg/

After
http://img163.imageshack.us/i/kapookcj.jpg/

Before
http://img243.imageshack.us/i/dlmunadsense.jpg/

After
http://img52.imageshack.us/i/dlmuncj.jpg/

Please kindly investigate and advise by return. Please feel free to contact me anytime.

Regards,
Pichol

**Daniel Powel** · 24-08-10

Hi Pichol,

Thank you for posting.

I think we understand what the issue is here. This is appears to be a case where a CJ publisher is advertisering that creative through Google Adwords. Many CJ publishers do act as advertiser on Google, so they could appear on your site if you have Adwords.

However, if you do not think this is the case, then we will need you to send us the source code of the page both when a Google ad shows and a CJ ad shows. We would need to code to confirm anything.

Also, you might be able to ask Google if CJ ads are being inserting in your Adsense, which might clear things up.

My email is dpowel@cj.com. Please get us this code and we'll investigate further.

Thank you,
Daniel Powel
Commission Junction

**in2sky** · 25-08-10

Hi Daniel,

Thank you for you reply.

I'm pretty sure this CJ ads is some kind of adware. Points of notice are:

1. The url of any google adword/adsense should be pointing to google url. But the CJ ads is using something like "javascript:submitCJ10639325X389('CJ10639325X389', null);"
2. The infected sites as in my last post only has adsense installed
3. The behavior of this adware:
- When I open my browser, all adsense is replaced by CJ ads for every website I opened
- After I clicked on refresh on my browser, the CJ ads is gone and never come back again. Adsense is shown normally
- When I closed my browser and open it again. CJ ads is back and will be gone after click on refresh
- This apply t every browser

In case you need to investigate the site in my last post. The URL are:
1. Jay is Games - Flash and Casual Game reviews, walkthroughs, room escape games, point and click games, puzzle games and more!
2. http://radio.kapook.com/102_5_get.php
3. Sweet Home 3D 2.5
Please note that the source code of the page before and after insertion are the same. But only the ads displayed is different. Here is some explaination why.

From a tecnical view posted here:
PANTIP.COM : O9594010

To summarize, this adware is infected in DNS. It's trying to capture every call to "http://pagead2.googlesyndication.com/pagead/show_ads.js" (which is a script calling adsense) and replace them with CJ ads.

In case the hypothesis above is true (which i totally agreed) then the root cause of this problem may out of your hand as we have to contact our internet provider to solve this. But what I need from CJ is that this publisher is publishing CJ ads using an unacceptable method and caused many trouble to innocence user/webmaster. I would be pleased to see some actions on this publisher either legally or morally.

Thank you very much for your time. Please feel free to contact me in case any question you may have.

Regards,
Pichol

**Daniel Powel** · 27-08-10

Hi Pichol,

Thank you for emailing me. I'll respond here with some thoughts then perhaps we can work through the detail via email.

Have you tried to get this result on another computer? This would be the first thing to check. Also, in order to help any further, we would need you to get the source code from your site when the activity is occuring and when it isn't. This is absolutely essential. Without that, we would not be able to assist.

I will drop you an email now.

Thanks,
Dan

**in2sky** · 27-08-10

Hi Daniel,

I tested this problem on 2 of my PC and as well as on my mobile. All of them has the same problem. There is many people facing the same problem and we have some disscussion here True internet (which is in thai, you can google translate it). I also contacted google and asked them if this is part of their ads network or not but until now there is no response from them.

For the request file/sourcecode, I sent you an email included the files as well as the details. Please note one thing, when I view the site from my firefox then > right click > view source. The sourcecode is exactly the same weather it is showing adsense/cj ads. But when I saved them into html, the sourcecode can capture the different on both adsense/cj.

BTW, I forget to send an original source that I viewed from right click > view source, will sending you in another mail.

Best regards,
Picol

**Jane_blankm** · 29-08-10

Hi,

I have tried the sites on my home computer, I see google ad's for all of them. No matter how hard I try, I can not replicate the screen shots your have shown.

Picol, I suggest you check your computer for recent software installations. It could simply be software the changing ad's to make money. I would also suggest doing a virus scan.

BTW, I do not work for Value Click Media.

Jane

**in2sky** · 31-08-10

Hi Jane,

As I mentioned in my previous post, this is some kind of DNS attack. This adware (virus) infected itself to DNS server and trying to change every adsense call to CJ ads. You will unable to see the CJ ads unless you're using the same DNS server as me.

I tried AVG/ad-aware/Bitdefender/Kaspersky scanner on my PC but couldn't find anything in my computer. One of my friend tested this by formating his PC and then open the site but the ads is still there. So I think this should proof that this is not PC level infection.

Pichol