[viertaxa]

Hi! I had never heard of your service, so I googled it and accidentally misspelled "Pixel" as I often do as "Pixle". The first result was a reddit thread and the second seemed to be a full-length rip of Becoming Royal that had some really malicious ads which were clickjacking and covering the content. Just thought you might like to know. :)

[Fornax96]

Thanks for letting me know. I suspect my advertising partner is doing some shady business on my site. I have been trying to catch them but I never seem to get the malicious ads myself, even when using a VPN from more eastern or southern nations.

Could you maybe send me a screenshot / screen capture of the ads and send them to [e-mail]? I'd really appreciate that.

[viertaxa]

I sent you an email. Domain is the same as my un here.

[tyingq]

That page is the second organic result for "pixledrain" for me.

The url is https://pixeldrain.com/u/823R39Sc

And it is full of popups, redirects, etc. And maybe acting differently per-referer.

[Fornax96]

Do you happen to be using an iphone? The malicious ads seem to be targeting iphones specifically. I can't reproduce it myself but I have told my advertiser about it.

I have some leverage here since I'm one of their largest publishers.

[tyingq]

Nope, Android. I tried reloading a few times, and the page is normal most of time. So it must be only when a specific ad runs?

Edit: Played around with it a bit. I think (not sure), some of the stuff is coming from this in the page source, near the bottom.

  <script type="text/javascript" src="//optyruntchan.com/400/4189877" data-cfasync="false" async="async"></script>
  </script>

[tyingq]

Note that is actually in the page, is NOT the ad, and couldn't have been injected by the ad.

It looks troublesome to me, as I don't see it on other similar pages on your site that also have ads.

Edit: Confirmed. Added "optyruntchan.com" to my local hosts file as 127.0.0.1. The page still has the ad at the bottom, but all the popups, overlays, redirects, are gone.

[Fornax96]

It's not like pixeldrain has been hacked or anything. I have been serving ads for this company for almost a year. It's just that they decided to serve full screen ads all of a sudden without consulting me.

I have removed them completely for now. I'll just be operating at a loss until I find an alternative ;-(

[tyingq]

Ah, okay, sorry. I didn't see that piece of javascript on any other user-created pixeldrain pages, and it isn't involved in the ad at the bottom/center of the page. So, it did seem out of place to me. I can't even tell where it would place an ad.

[dormento]

I took a look at the script, it looks _hella_ shady. Some sort of packing I've never seen.