Revcontent Support Questions

Hey there, Support.

We’ve been seeing an increasing number of Forced Redirect Ads / Malicious Redirects on WeLoveTrump.com — some sort of script triggers a tab to open up with a scammy looking ad.

These are some example URLs for these bad ad redirects, which may give clues about where they’re coming from:

https://m.d-y.beauty/search-rewards/walmart.html?isp=Comcast%20Cable%20Communications%20inc.&brand=Apple&model=iPhone&region=Pennsylvania&city=Lancaster&siteid=eoirmn&domain=welovetrump.com&sd=Lancaster&td=Lancaster&exchange=Lancaster&hd=Lancaster&size=Lancaster&cep=35NRPrxrA8X3PfYj-ODtvSRwO18nj53xbAc9mdCY-57m9Z1wE3v85dtpIBqc886RHZrU4atmwJT-f164mmI0pQm-Gh3LkNdH7ITLye86cnvJmBW_w7MdXZdVlVxQ3CXozpQlm98gMsYt3VNiKIDQwxRT-2k4VILZ97IxTwdkm4SABBN0mCBcEiESUnxivmAyBO9ruQUqW26pM2aZ1BUOtRacCDp96CuRbgw3JpSpzR8o9yyr_v17X2iAnqQtyuGWGs6hjLh6iEL6fgCfy3O5tgxlYgtKu2-zjuzY0rzGFdooP2l303FCCv6XHjd2Ww_TyeEpmKFGy1gJhdsCL2CeJyCMAoaiDDP8Dy6er_lBVtsC2Xlz3dCHjKSQB1E9ezT1KNx65yy1B-boYiOa4faY7oTkngp0z7Dvc-ZHclTIyHgTvnYt53cv351Y3srlxmoFcDvj0CdALwKCe3UFDcPGUCOqSF3sdm7PkBeCVsfsP-EE7QcKIOlb9JiOIC-qZ0c3pdgAkmRd_Th-Lctpzus2NHV1piRRInSakw8bNxlkiy4sSYs_y-tEX_7TIXO7SwR8CXQnVXPIMq7mDs2uhgLltumhhe6k-gEzuVSDH4WF45Sqpwl12Xtei_cynyJCtmNEmdzHDiS2rZud92IACPD2xHehZJ4DdNaOth-1Qa8lTyG89MiO3KYu4dpCQgZkYxLxysf34x1SVvlYtS4h9VYqUgejt_RusmAncHHmplJOhjEmDFLtz0tqRMVu3TnvTjGANMu-MklEQ5UpCVfsEPsve7lxmyTctrZrPd-RohwMAXyyBo10ruQl01vN5fvJwfn6GLC3BN57XFWE_qG7twk5x4WcUhuwIYZX0yMz26w6K7XNna8G-T9Xr_k5shaFKHQjtyV9NyMHXE3Xv9L0vQ5v4l4L8-R4IHrKurnM7FzgGwLFdB-81WMYaH1plFfJol3tEfJ3zKymf-3gFa-n96c0jC-ot9zO-UZFe952bqGrTPUllFPZUUH5IWv-Mfu2CasWE4UYMPRpRKU5AKpIr7e5JY6wGidMvTt0XC9tjKKbbunyXqqR_aIViwQzd2VzZrI44_aVuro_CxnY1hHmDlGuk_9wqMiaUOvw9h-v1yleo3HLOoExYALNT91zSH5vT-J_joM962EcnyBaszGrVhEOY4WH_pu4qQ1eXkbjVBo-ale4HvIUz5Nc9GFuyOTItHG0qZ4xoH-DDXP4jGaR2uOZXHm9Y9N7nxobzbI8im97bp7h7QnwKDNhJa3gjgbvVZCyBdycFo1UdoLNkT5WjJzr6rDIlJWwzBe5fI5bM2kEYi5hdozTzVEa9bLhscOsVMEgJsoYhXlEu3AD4aySjh3JEz0-VS-l2rF-u8ikykJ6DFIoJzAO2o5FVW4q92ZxFLAu&lptoken=16ca693f033120b48446&ssp=metup-vf300hebf&hard=%5Bcpu%5DiPhone%5B-%5D4+Cores%5Bgpu%5DApple+Inc.%5B-%5DApple+GPU&device=iOS+15.6.1%7Csmartphone%7CApple%7CiPhone%7CMobile+Safari+15.6.1&network=2601%3A987%3A280%3A4a90%3A85e7%3A6530%3A73e6%3Aff33%7CUS%7Ctrue%7CAmerica%2FNew_York%7CUTC%2B-5%5Bnetwork%5Derror&tracking=sync.e-volution.ai%28-%29%28-%29s.funnel.e-volution.ai%28-%29et-nd26.itdsmr.com%28-%29adrta.com%28-%29us-east-edge-6.e-volution.ai&urls=https%3A%2F%2Fwelovetrump.com%2F2022%2F11%2F20%2Ffda-panics-and-backtracks-says-it-never-prohibited-ivermectin%2F%5BjsReferer%5D%5BoriginsInfo%5D%5B%22https%3A%2F%2Fwelovetrump.com%22%5D&screen=%5BcolorDepth%5D32%5Bration%5D3%5Bsize%5D375-667%5Bavail%5D375-667%5Btouch%5D5%2Ctrue%2Ctrue&info=inIframe%5BdeviceMemory%5DunSupport%5Bcookie%5Dtrue%5Bpdf%5DunSupport%5Bwebdriver%5DunSupport%5Bsession%5Dtrue%5BlocalStorage%5Dtrue%5BopenDB%5Dfalse%5BindexedDB%5Dtrue%5Bplugins%5D0%7CevalRedirect

https://m.w-t.homes/search-rewards/walmart.html?isp=Att%20Internet%20Services&brand=Samsung&model=Galaxy%20S20%20FE%205G®ion=Texas&city=Greenville&siteid=suhbse&domain=welovetrump.com&sd=Greenville&td=Greenville&exchange=Greenville&hd=Greenville&size=Greenville&cep=00wjAKlegtR-I64-abYzMGVTO1qB_CQTybjf_II94QE5OJDT2eDjLNkazkCmL5mDSgSfLRVJCFXwZ_jgriMr8X9duJcPOdzhG66UDmIWnMcv6T8Ka457dKR1lkyIAk2p66rn8ln4REvltxY95ugfRYZwr90KLALiZb68e0_0ek4oHbSBmvA-OU0TtU0ukIZI5yONHoBvyWt9W8XKURt8J7TKxDpIzj692k2lhbrtg-Yh68dccqpB_zcs7iukJvWhUw-koIdz9aDPB8WvO2aeKxmj1W7WDtocqkWTODKP28y5inzvAMh_G3L6QCE9w3PE-0Z4vCQDKjUOe7sZXqvdlnku7Q_yH_yb_FVX2jiUt1AirXFxN7BjYgfgP6LFHlPzqOdgfNN4x_YUpXwRkNmqzgXer_Y9DDfETAGPYb92SihFFQPzNWftJKJ0ac85qVnlrXhNK6EtaUUEochZxnKoJ1cb_3ms2FQsz4j26zzSokfKw6hng7D_e4-qe_N1op304X3C4Pf92b1hb8lYQ5FE0I486Yw2-ZTN-7e-reBEpkPvu-2ZscUobDxYTzcvu_W-tUKkhyjCRqpx56OUSfzYw-wCNzGiZqXZX7OxRz4WsZSx8iIZbS6S03O9ydyVzevKP1OjwjWbkQ8ehkbUeBHltcuhCHQhEKw6EKvrhAo1cb5ZFYhtZa7iSu6NkWRJopCVFpOfTOUA9jrKMm1p4BsPCUsxPIejmbkm1sMjVybYIYnuW5IV37GkL3hA-xqJX1yF5_N-ROIHaHkNqjaJQ5zC1uJx_eKvzxXqD8b7mK3z5y_MOcoDHysJS9LPDpPmWwWbYe2fzoEyh1RqjL9dMyyWkIJn586U1A0qyIZUGFd17uYhXMn3N3sJWr3NPdsc8uf11mE54Rq0b-c_rt8VkovPZ5Kj8Lp0X0kfRdSb1O7-aPi6LcdwT7qyK0EJFl3fWXR5_dYL0FhIxtcfNeVUnhUz_wgymru2EjJoZI-_OFq_bUUN7mo80N4sPKZg6-8ZYKc3PC9Vps2tfTiS-t0Ga0Agn-jAV_dzXtfcwajX18U_5sgVwu8OteLYM4j87CQtPSiR7zt4cgLZEpKeohcxnK68Ri0fekugS00Wbf5GLlk9GtyGHOPE1_bue3aSBwoiUJOmWVmaj9-gXnjwcjjuKny3OUnM4aF3YU0sr2vm6GIF-Hi8E7wuzH8F3NBhUNTi-uwXVDKMpYdIRMyW5YBgxYSbaD8Xk9zllgY–Inv3D_-gM_yNOppRmZk2FwBoDtL_eE9JwTyrEgxiMqgMdplXpuDFxDvuQYDOLd5SR3sGEaWHTQ9if8F4TYqWT5VmV7cRFbG-n2DsMH2WNfIZdu47yEaNlT-EKf0AhtzIJ17yo2qU3yDY6vi8GNojMq9ABK6Y0V0fNIXLEeAZQez0vxbim2OJojUGDD1f0aXn9m7XYslAdW4K12G2VvnMAiaYGyCx06i85_9QeXmngF9IpEdaACqpaX30B_6X0LBLPOE_uH6lL250y_yyVoG6bWQD5OTA4vSlUt4pfNNTYiIC2kAtmFwog&lptoken=165669be263c30fd9056&ssp=metup-39186-shoes300&hard=%5Bcpu%5DLinux+armv8l%5B-%5D8+Cores%5Bgpu%5DQualcomm%5B-%5DAdreno+%28TM%29+650&device=Android+12%7Csmartphone%7CSamsung%7CGalaxy+S20+FE+5G%7CChrome+Mobile+107.0.0.0&network=2600%3A1700%3A5a1%3A640%3Aa0ed%3Ae141%3A1c6f%3A4692%7CUS%7Ctrue%7CAmerica%2FChicago%7CUTC%2B-6%5Bnetwork%5Dwifi%5B-%5D10%5B-%5D50%5B-%5D4g&tracking=sync.e-volution.ai%28-%29%28-%29s.funnel.e-volution.ai%28-%29et-nd53.itdsmr.com%28-%29adrta.com%28-%29us-east-edge-2.e-volution.ai&urls=https%3A%2F%2Fwelovetrump.com%2F2022%2F11%2F23%2Fhuge-child-sex-scandal-unfolding-with-balenciaga%2F%5BjsReferer%5Dhttps%3A%2F%2Fwelovetrump.com%2F2022%2F11%2F23%2Fhuge-child-sex-scandal-unfolding-with-balenciaga%2F%5BoriginsInfo%5D%5B%22https%3A%2F%2Fwelovetrump.com%22%5D&screen=%5BcolorDepth%5D24%5Bration%5D3%5Bsize%5D360-800%5Bavail%5D360-800%5Btouch%5D5%2Ctrue%2Ctrue&info=inIframe%5BdeviceMemory%5D4%5Bcookie%5Dtrue%5Bpdf%5DunSupport%5Bwebdriver%5DunSupport%5Bsession%5Dtrue%5BlocalStorage%5Dtrue%5BopenDB%5Dtrue%5BindexedDB%5Dtrue%5Bplugins%5D0%7CtopRedirect

https://m.w-h.pics/search-rewards/walmart.html?isp=Att Internet Services&brand=Apple&model=iPhone®ion=Texas&city=Ft Worth&siteid=eoirmn&domain=welovetrump.com&sd=Ft Worth&td=Ft Worth&exchange=Ft Worth&hd=Ft Worth&size=Ft Worth&cep=r1x6PcZ3IKUCPFrtSjtJHR8ExZvfpQEfIHpu_MpWKMJgvGyo3jmT8JC6GTUG2L90ZYfwdBp07AMZqHt9wRGzcA7vYgKL7tBxEnfxD0-Azy_o3PkWfVQM4OWTCeeDPpQfk2Yd6HTblTK7_YwDXnrjDnDkyaePMPSmEzJE4VPHOSPAFsDrK0QTWDGGQRNSgABW2RVWiLTz6wG-GH-ik3FFIg0cX9Jz_ZeRJrEfZlIEpNCixPDAKrKGj6zmzmwinbAqQNZAwYLUXXrfUQwzMjerw8wNxdQHhOta4gEJbN9aiWP7SeLqVOWbffphxScVFfkweC_8ESr_MZDzj8YjyfRjzZbNXNjSw0GrtnrGHB44-7pgRae2Yc4YS85Pk8ug6IdqXnq4yC5kT_HUEap28TKDyPIZiziQ5dzJwq7wnsQ6GGoMuXsaWCAqtXV4ZLI3iT7Q0wwSccVD_GFZB3N8WgyWHlf3YsRZldJAJXPeHdb4zeoGfzbCAG27tIuiQ3fdr62ruK2V-fSN0_swTwGEmBOVkfhFlgEqMcdvPjgUrPsEykGr939BGKt7lHu782GEaAlPbHdf_3tfuhmcX4IN1yh-CirG2qMWZaG_fHP5fUICdMvM0J1H4fr100Sj3U7ecI3uQB4jhbPw6e00Ly35ti0Y7lH6lQ6W2VCzY5azP8cOpHzyFAUL7fdSLlUEMf7vqEBO1JM5Bs7kdTkjV9NSlThRbwWeqV_3lGf880EXkfQIEB_UhH0rWjyz9upeJll4TEYH_vrfs3jSuWux_3hZwwEn0Eg8Bcp74-dfkQMy4_1Yld8bSVF_lA-zByuGqiWkLlmueBZWHliLyTpXk6OWYjxyQ3Mrigr4UX1Ei2DQs6yxKV_bllWkxa9YhtOYQ0rWMuk847gK9p0MHRrMQpFJIujwvjFqljRnd-tpBXyh3-k5elbdE9gJBcU4Q75zd-phM8La8dJaHbc_x-1pJhs5J3Xml0hdUwj0tgXtFxZeY6214Je-7QfppO5GUTFI1bAj_6aNRlGnSkvxe0E2KUuDYPkbM36-_ifXoHggpX6x1BMeO3tGgFwYAXUYZ04CcXnCJcy1xtPRXOs5834ocTDF3naCYCKzTIdxbxi5US5lgOZfsINFN3ZPGQbfYVAPmzGxedW-cAeK1wD8b12FLULNSW-sM_Q-PB8Lo9xvxuyqlLBtj5nmdBbJNb5UiDCYJAD_YmbAQceK30Vto4AxSMzjqML34TRbBjxCiXN8jPDxkkswGVUj9KvP-0Apu7Itis6K0lnlKHftJ8XcyO_Zm5te3VH3DpdiseY5rJT80_T5ehjPemmak_FxCEdre-YLn16UsGgF2cd-WZkmBzLyLqreHl8o45y7aUasFDzDn0lnNNZ6yiWcGnCdwb9ZC0JCmiv7zD6V&lptoken=1633694513fb07d5813d&ssp=metup-vf300hebf&hard=[cpu]iPhone[-]4+Cores[gpu]Apple+Inc.[-]Apple+GPU&device=iOS+15.6.1|smartphone|Apple|iPhone|Mobile+Safari+15.6.1&network=2600%3A1700%3A4672%3Ab00%3A6cfd%3Add9f%3A4881%3Acbe5|US|true|America%2FChicago|UTC%2B-6[network]error&tracking=sync.e-volution.ai(-)(-)s.funnel.e-volution.ai(-)et-nd54.itdsmr.com(-)adrta.com(-)us-east-edge1.e-volution.ai&urls=https%3A%2F%2Fwelovetrump.com%2F2022%2F11%2F20%2Ffda-panics-and-backtracks-says-it-never-prohibited-ivermectin%2F[jsReferer][originsInfo][“https%3A%2F%2Fwelovetrump.com”]&screen=[colorDepth]32[ration]3[size]375-812[avail]375-812[touch]5%2Ctrue%2Ctrue&info=inIframe[deviceMemory]unSupport[cookie]true[pdf]unSupport[webdriver]unSupport[session]true[localStorage]true[openDB]false[indexedDB]true[plugins]0|evalRedirect

I’ve worked with our other ad vendors, as well as directly with e-Volution.ai, to identify the vendor through whom these malicious redirects are being served. At this point, the ads don’t appear to be coming through any of them.

Would you be able to investigate whether these malicious redirects are coming through Revcontent?

Also, would you be able to let us know who our Revcontent account manager is? Thanks so much!

Ted.