What are Malware, Malicious, Phishing and other types of violations?

Malware, or “malicious software,” is an umbrella term that describes any malicious program or harmful code that may invade, damage, or disable any device often by taking partial control over its host.

Malware is all about making money off users. It may steal, encrypt, or delete your data, alter or hijack core computer functions, and spy on your activity without your permission. However, it cannot damage the physical hardware or network equipment (with one exception − see the Google Android section below)

Detected violations can:

• Change user’s browser settings (e.g., set a new home page or default search engine).
• Use system resources, thereby reducing connection speed and performance.
• Install various apps, pop-up windows, and banners that work without an internet connection.
• Use system resources for DDoS attacks or cryptocurrency mining.
• Capture user’s personal data: logins, passwords, bank card numbers, and more.
• Download and install malicious software, new browser toolbars, extensions, or plugins.

Malware infiltrates users’ computers when they:

• Surf through infected webpages.
• Follow infected redirects.
• Download infected files.
• Enter personal data or bank card data on suspicious web pages.
• Install toolbars from undefined sources.
• Set up software from unknown developers.
• Open malicious email attachments.

Malicious software may be hidden in seemingly legitimate web resources or applications, therefore, our system provides thorough security checks to verify the potential threat and protect users against it.

The use of GeoEdge verification service is primarily intended to prevent propagation of malicious ads via AdsKeeper’s network, as well as protect web publishers who are the potential targets of malware. surf through infected webpage, follow infected redirects, download infected files, enter personal data or bank card data on suspicious web pages, install toolbars from undefined sources, set up software from unknown developers, open malicious email attachments.

If the violation is detected on your landing page:

1. Find the scanning result by clicking the incident link.

Please pay extra attention to the main violation indicators:

Trigger − type of detected violation:

• Malicious URL
• Post-Click Malicious In Page
• Phishing URL and etc.

Impact on User − the impact the violation may have on a user:

• Potential risk
• Bad User Experience and etc.

2. For detailed information on what is considered to be malicious, click on “Threat Details” at the top of the page

3. In the pop-up window you will see which domain / link / file / script is marked as malicious. This element must be removed from the landing page!

4. Please note that inside the “Threat Details” window there is a “More Info…” button
– click on it to get detailed information on flagged domain.

What should you do if you receive a violation notice

Owned Domain

If you are the domain owner and you own the code behind this domain, you need to contact your developer in order to eliminate the violation:

• provide them with the violation details and ask to remove the malicious element once violation issue is resolved,
• submit ads for re-check

Not Owned Domain

If you do not own this domain, contact the affiliate network in order to eliminate the violation:

• request the affiliate network to remove the malicious element
• send a request for re-check in our system

If you are sure that your landing page/domain is “clean” (free of malware)

• you need to request a form for rechecking the domain/landing page
• fill in additional information that is required by our security team

Why we do not accept scan results from the client made by public services as proof

//transparencyreport.google.com/safe-browsing/overview
//www.virustotal.com/gui/home/upload

These services do not include important settings like: geo-targeting/device-targeting, which in many cases may mean that the validation result is not valid.

Scanning from our side always considers the geo and device targeting set in the client campaign targeting.

This means that our algorithm selects the location and the device corresponding to the users who will see the ad. In some cases, you can see that out of 3 scans, the same link has an alert for only one specific device, or one specific geo. This means that it targets malicious elements on specific geos and devices.

In the first case, you see a legal advertising campaign works with native advertising.

In the second case, the malicious code is activated, and the advertisement starts working on the infection. But in this case, not all visitors are infected, but only those that meet the specified targeting conditions.