Driving Revenue JavaScript

[S/V_Surya]

I have a trendmicro watch on my PC. Everytime I open a page on this web site I get an alert about a site called http.cndlayer.com trying to run a jave script called driving revenue. It has been there for a couple days. Please get rid of this or I will I will have to move on.

[mrm]

Hmm... I have most scripts blocked, but since I joined CF my email address started to be spammed mercilessly by some bizbooster folks, so some checking might be in order.

[Shrew]

I would suggest doing a little research on the subject. Just because Trendmicro is flagging an unknown java script doesn't mean that all java scripts are bad. I work for a company that is heavily based in computer security and I don't have any issues with any scripts on this site while I'm at work and have no issues with virus', malware and the like.

Spammers sending mail to a mailbox would be completely unrelated. A mailicious pirce of code could be deleivered via E-mail, but wouldn't necessarily promote spam beign sent to a mailbox on an unrelated mail server.

[S/V_Surya]

If you google the web site you will find other people that have been alerted to a trojan trying to get on your PC. All user of CF should scan the PCs' to make sure they are not infected.

[SaltyMonkey]

I see embedded at end of page this:

<!-- Start Driving Revenue tag -->
<script language="JavaScript" type="text/javascript"> var DR_id = "1302";</script>
<script language="JavaScript" type="text/javascript" src="http://http.cdnlayer.com/drivingrevenue/DR_v4.js"></script>
<!-- End Driving Revenue tag -->



i also see really lousy CSS inline specs. and I do get ERRORS in the console for some of the js modules. The site is also not bug free.

[Janet H]

Originally Posted by S/V_Surya

I have a trendmicro watch on my PC. Everytime I open a page on this web site I get an alert about a site called http.cndlayer.com trying to run a jave script called driving revenue. It has been there for a couple days. Please get rid of this or I will I will have to move on.

Hi - this is not malware. We use CDN to load the images that you see on the forum as well as some ads (which help keep the doors open). The images include avatars, images in posts and even some of the little icons you see. It allows us to keep the site running faster as well.

Originally Posted by mrm

Hmm... I have most scripts blocked, but since I joined CF my email address started to be spammed mercilessly by some bizbooster folks, so some checking might be in order.

We don't sell, share, loan or rent your e-mail or account information but if you post your e-mail address anywhere on the internet that is visible it's likely that you will be spammed. There are bots that search for e-mail addresses and you can be their new best friend...

[SaltyMonkey]

Downloading the code, they appear at least to be owned by

Affiliate Every Link on the Web with VigLink

The code is compressed, so I need to beautify it to understand what it does

[S/V_Surya]

Yes thats the script not cdnlayer not cndlayer as noted in my earlier post.

[SaltyMonkey]

This has nothing to do with using CDN for serving resources. This is a tracking link and performing additional processing work unrelated to offloading cache images and the like

[S/V_Surya]

Originally Posted by Janet H

Hi - this is not malware. We use CDN to load the images that you see on the forum as well as some ads (which help keep the doors open). The images include avatars, images in posts and even some of the little icons you see. It allows us to keep the site running faster as well.



We don't sell, share, loan or rent your e-mail or account information but if you post your e-mail address anywhere on the internet that is visible it's likely that you will be spammed. There are bots that search for e-mail addresses and you can be their new best friend...

Why am I seeing this within the last cople of days?

[Janet H]

Originally Posted by SaltyMonkey

This has nothing to do with using CDN for serving resources. This is a tracking link and performing additional processing work unrelated to offloading cache images and the like

Yes - it's related to site advertising. It is not malware.

[mrm]

Originally Posted by Janet H

We don't sell, share, loan or rent your e-mail or account information but if you post your e-mail address anywhere on the internet that is visible it's likely that you will be spammed. There are bots that search for e-mail addresses and you can be their new best friend...

Janet, I never suggested you did, nor was my intention to do so. I just mentioned a suspicious correlation I noticed.

[SaltyMonkey]

Looking at the code, it appears to WRAP resources in the page with behavior tracking functionality. What it exactly does, can't tell since its not pretty named. Could be tracking user interaction on the site and logging it. For example, hovering over an ad image may generate a log entry that it was hovered. If it was clicked, another entry. It modifies to DOM for events and such.

However, this has nothing to do with using a CDN or not. It has to do with tracking activity on resource usage and navigation.

[Andy R]

Originally Posted by S/V_Surya

I have a trendmicro watch on my PC. Everytime I open a page on this web site I get an alert about a site called http.cndlayer.com trying to run a jave script called driving revenue. It has been there for a couple days. Please get rid of this or I will I will have to move on.

This is NOT malware. Driving Revenue is a company that is used by thousands of websites as an affiliate marketing solution. If someone links to an eCommerce site that offers and affiliate program then they add an affiliate ID.

I will pass on your report of TrendMicro to the owners of DrivingRevenue as they take these alerts seriously. I'll let you know what I hear but in the mean time I can assure you it's not malware.

Originally Posted by mrm

Hmm... I have most scripts blocked, but since I joined CF my email address started to be spammed mercilessly by some bizbooster folks, so some checking might be in order.

I can assure you we do not sell, share or in any other way dispense any of our member's data including emails. Maybe it was a coincidence but I can assure you we have not shared your data with anyone.

[SaltyMonkey]

Hard to tell what they are pushing down that pipe outside their vendor id:
var DR_id = "1302"

I mean, can they track using my uid if i am signed in?

And they also have a number of trackers:
<!-- Social Knowledge Quantcast tag -->
<!-- Google Analytics tag -->

Start Martini Network 1x1 Pixel
Adify tag for "AudiencePixel" Ad Space

who know what else?