Caring for a Three Legged Dog or Cat

cometdog said:

I thought it was just a conflict in advertising script and norton is thinking it's ugly.   

These "attacks" have nothing to do with scripts from this site. Upon further investigation, our server's IP address is found nowhere in any of the reports. Not knowing Norton, we are unsure how anyone can confirm this domain as the cause. We would sure like to know.

All the IP addresses reported so far are suspicious and have been blocked. We doubt we have many users in Maldova. But the source of "browser fingerprinting" is not necessarily a website being viewed, it usually indicates active malware but can be be facilitated by any open connection to the Internet.

..now I am getting advertising banners from places I have visited on the net.

This is the very nature of Google, it is not specific to any scripts on this site. Over the past couple years the Google Monster has become very good at tracking where everybody has been to present them with "better targeted ads". We wrote about this in another blog back in late 2009. It is the nature of the Beast.

No worries from our end!   

Thank you, we are doing our best to keep it that way and have escalated the issue for further investigation.

The problem with blocking IP ranges is that legitimate users with dynamic addresses can be denied access, and hackers will often just rotate their IP batches or use a proxy anyway. 

We've gone ahead and blocked the range reported. If we start receiving complaints from users and visitors being blocked we'll send them your way. Please advise of any further attacks from Moldova, or suspicious activity from other IP address ranges.

As far as advertising goes, it shall remain out of pure necessity until such a time that this site generates enough income to support our efforts.

This just in from our server manager...

It seems like it's a flash and/or java program that's being delivered via google ads that pops up a misleading window that looks like it's coming from Windows that installs a virus on your computer.  Many other forums (and other sites) appear to be affected by this too.  If you google "Vista antivirus 2012" you can find some good info on it; apparently this is what the virus installer calls itself.  It seems like a painful virus to remove.

Blocking those IPs on the server won't have any effect.  Traffic from those IPs doesn't actually go through tripawds.com, it goes directly to the person's computer; the ads are offsite links.  Apparently Chrome isn't vulnerable to the attack, and it might also be helpful to have people upgrade Java and Flash to the latest versions.

Unfortunately, we cannot afford to remove Google ads from this website. The best practice is to not click any ads that seem suspicious, and to never click any software warnings unless you are certain it is legitimate.

We have reactivated the footer ads site-wide and will submit the links of any malicious ads to Google for investigation. If you get an attack warning please look to see what ad might be displaying and send us the link via PM. (Do not click the link, right-click on it and copy the link location.) A screenshot will not help. We need to submit the link URL to Google or they can't do anything about it.

Thank you for your patience, cooperation and continued support.