Pop-up and surveys

[#1]

You hit the nail on the head

[#2]

Appreciate the frustration, but probably best to air it in the other thread open re: the high speed broadband link.

[#3]

Other ISPs also affected - http://www.revk.uk/2015/07/more-scum.html

[#4]

The plot thickens.  We had a warning mail sent around at work about Survey pop-ups that were purporting to come from a company called Zendesk, who provide our online ticket management system.  They look suspiciously familiar (i have blurred out the first part of the address, but that is our actually our zendesk link there.  I'd be very interested to know how they're doing this.

[#5]

It will either be malware or a browser extension installed locally on your machine that will have brought it down. The annoying sort of extensions that ask to be installed as part of a legitimate program halfway through so are easy to click accept on. I've not seen a variant yet that works in a different way.
They scrape the page for keywords and generally use the page title to populate where you are seeing about zendesk. A similar method is used for where it shows your ISP, I believe it checks whois records to get the company name. I can't say I've checked, but that's how I would do it.
It is unfortunate there is a legitimate survey campaign happening while these pop ups seem to be increasing in number again!
The issue with an ISP level block (which is in principle a good idea BTW) is that if the signatures are not good enough we could end up blocking legitimate traffic. There are also lots of variants using different URLs so blocking all of them becomes impractical.
Personally, I think the best thing we can do in these sort of scenarios is help to educate people.
Would a blog post on how to avoid and remove these sorts of things interest people?
If so, I can have a word with the guys about getting something written when something widespread like this is going on as long as it fits in with their plans for the blogs.

[#6]

Our Security Manager has just informed me that this was traced to a Chrome Plugin called "Auto Refresh Plus", which now seems to have been removed from the Chrome Web Store.

[#7]

Hi Scitt,
Good to see you on the forums again, really miss e contributions from your team.  I think that anything which helps educate users on this matter and others (how the internet is delivered, industry rules and constraints on service delivery... (to suggest a few others) is always worthwhile.
@lorisarvendu
That is really useful information.  With matters such as this is is always useful to know which bowser is involved.  Personally I think Chrome sucks
- I'm presentky battling with a FaceBook page address issue, which connects fine using IE but gets a 404 error when using Chrome or Safari - looks like the latter are screwing with the url capitalisation.
Kevin

[#8]

Quote from: Townman

Hi Scitt, Good to see you on the forums again, really miss e contributions from your team.  I think that anything which helps educate users on this matter and others (how the internet is delivered, industry rules and constraints on service delivery... (to suggest a few others) is always worthwhile.

+1 Having a word now to see if we can write one up.
@lorisarvendu - Thanks for getting back to us with this.

[#9]

I've been around lurking Kevin, just not posting! I stopped entirely because of the impending move from QA to security.
I'm sure there are more than a few blog posts that could be useful (or even just interesting!) to people.

[#10]

Hi Scott,
Another move?  Sounds like both bad and good news, bad for QA though there is a very safe pair of hands behind you (CP) and good for security.  You have a track record of getting things done (not forgotten your contribution to the referrals debacle even if the fix is incomplete).  Here is hoping that your move to security will put some drive behind sorting out SSL which is now some 7 months past its last forecast date.
Cheers,
Kevin

[#11]

Yippee  Now I am a winner???    - Will be doing a virus scan etc etc and no I didnt respond
Here is some info perhaps someone could send them a warning about copyright use of logo

<!DOCTYPE html>
<html>
<head>

<title>2015 Annual Visitor Survey</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<link rel="stylesheet" href="http://netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css" type="text/css">
<link href="http://netdna.bootstrapcdn.com/font-awesome/4.0.3/css/font-awesome.css" rel="stylesheet" type="text/css">
<link rel="stylesheet" href="templates/_common/_templates/annual_visitor_survey_V2_MASTER_ISP/css/main.css" type="text/css">
<script src="templates/_common/_templates/annual_visitor_survey_V2_MASTER_ISP/js/vendor/modernizr-2.6.2-respond-1.1.0.min.js" type="text/javascript"> </script>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script>
<script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js"></script>
<script src="templates/_common/_templates/annual_visitor_survey_V2_MASTER_ISP/js/script.js" type="text/javascript"> </script>
    <script type="text/javascript">
$(document).ready(function (){
initStock('');
});
</script>
    <script type="text/javascript">
window.onload=function(){
$('#myModal').modal('show');
};
    </script>
   
<script src='templates/_common/js/date/returnDate.en.js'></script>
<!-- STARTALERT -->
<!--<script type="text/javascript">
alert("************************************************\n\nCongratulations!\n\nYou are Todays Lucky Visitor.\n\nClick OK to continue\n\n************************************************");
</script>-->
<!-- ENDALERT -->
<style type="text/css">
.top-bar {background: url('templates/_common/_templates/annual_visitor_survey_V2_MASTER_ISP/img/header_d.jpg') repeat-x;}
</style>
<meta name="robots" content="noindex, nofollow" />
</head>
<body>

<!-- Modal -->
<div class="modal fade" id="myModal" tabindex="-1" role="dialog" aria-labelledby="myModalLabel" aria-hidden="true">
<div class="modal-dialog">
<div class="modal-content">
<div class="modal-body">
<br>
<table>
<tr>
<td class="indent">
<img src="templates/_common/isp_survey/logos/plusnet.png" class="img_sz1" />
</td>
<td>
<p><b>Dear PlusNet user,</b></p><br>
<p>You are today’s lucky visitor for: <strong><script type="text/javascript">{returnDate("full",1)}
</script></strong></p><br/>
<p>
Please complete this short survey and to say “Thank You” we’ll give you a chance to get a <strong>reward worth at least &pound;100!</strong>
</p>
</td>
</tr>
</table>
</div>
<div class="modal-footer">
<button type="button" class="btn btn-primary" data-dismiss="modal">OK</button>
</div>
</div>
</div>
</div>
<!-- End Modal -->

<div class="top-bar">
<center>
<table>
<tr>
<td style="padding-right: 15px;">
<img src="templates/_common/isp_survey/logos/plusnet.png" height="58" width="58" align="left" />
</td>
<td>
<div class="top-header1">2015 Annual Visitor Survey</div>
<div class="top-header2">PlusNet Opinion Survey</div>
</td>
</tr>
</table>
</center>
</div><!-- top-bar -->

<div class="container">
  <div class="survey-container">
  <span class="pull-right"><i><script type="text/javascript">{returnDate("full",1)}</script></i></span>
  <div class="clearfix"></div>
  <!-- Question 1 -->
    <div id="q1">
    <div class="intro_text">
    <h2 class="mrg_t">Congratulations!</h2>
<p>

You’ve been personally selected to take part in our 2015 Annual Visitor Survey! Tell us what you think of PlusNet and to say <strong>“Thank You”</strong> we’ll give you a chance to get a <strong>reward worth at least &pound;100</strong>!
</p>
  </div>
  <div class="question-count">Question 1 of 4:</div>
  <div class="question_question">How many years have you been with PlusNet?</div>
  <form action="#">
  <span id="q1aspan" class="option q1option">
  <input type="radio" id="q1a" checked> Less than 1
  </span>
  <br>
  <span id="q1aspan" class="option q1option">
  <input type="radio" id="q1b"> 1-2
  </span>
  <br>
  <span id="q1aspan" class="option q1option">
  <input type="radio" id="q1c"> 2-3
  </span>
  <br>
  <span id="q1aspan" class="option q1option">
  <input type="radio" id="q1d"> 3+
  </span>
  <br>
  <span id="q1aspan" class="option q1option">
  <input type="radio" id="q1e"> Prefer not to answer
  </span>
  <br>
  <br>
  <div class="btn btn-success q1option">Next...</div>
      </form>
    </div>
    <!-- Close Question -->
   
    <!-- Question 2 -->
    <div id="q2" class="question"> <br>   
      <div class="question-count">Question 2 of 4:</div>
      <div class="question_question">Have you ever had to call PlusNet support?</div>
      <form action="#">
  <span id="q2aspan" class="option q2option">
  <input type="radio" id="q2a" checked> Yes, recently
      </span>
      <br>
      <span id="q2aspan" class="option q2option">
      <input type="radio" id="q2b"> Not recently
      </span>
      <br>
      <span id="q2aspan" class="option q2option">
      <input type="radio" id="q2c"> I used online help
      </span>
      <br>
      <span id="q2aspan" class="option q2option">
      <input type="radio" id="q2d"> Prefer not to answer
      </span>
      <br>
      <br>
      <div class="btn btn-success q2option">Next...</div>
      </form>
    </div>
    <!-- Close Question -->
   
    <!-- Question 3 -->
    <div id="q3" class="question"> <br>
    <div class="question-count">Question 3 of 4:</div>
<div class="question_question">What is your primary use for PlusNet internet?</div>
<form action="#">
        <span id="q3aspan" class="option q3option">
<input type="radio" id="q3a" checked> Work
</span>
<br>
        <span id="q3aspan" class="option q3option">
        <input type="radio" id="q3b"> Leisure
        </span>
        <br>
        <span id="q3aspan" class="option q3option">
        <input type="radio" id="q3c"> Mobile connectivity
        </span>
        <br>
        <span id="q3aspan" class="option q3option">
        <input type="radio" id="q3d"> Prefer not to answer
        </span>        
       
        <br>
        <br>
        <div class="btn btn-success q3option">Next...</div>
      </form>
    </div>
    <!-- Close Question -->
   
    <!-- Question 4 -->
    <div id="q4" class="question"> <br>
      <div class="question-count">Question 4 of 4:</div>
  <div class="question_question">Would you recommend PlusNet Internet to friends?</div>
  <form action="#">
        <span id="q4aspan" class="option q4option">
<input type="radio" id="q4a" checked> Yes
</span>
<br>
<span id="q4aspan" class="option q4option">
<input type="radio" id="q4b"> No
</span>
<br>
<br>
<div class="btn btn-success q4option" id="q4option_submit">Submit...</div>
</form>
    </div>
    <!-- Close Question -->
   
    <!-- Process 1 -->
    <div id="process1" class="dsp_nn">
    <br>
      <p><strong>That's it, all done! Thank you for your participation.</strong></p>
  <br/>
  <p>As we submit the answers to your questions, we are checking our inventory to see what we can offer you as a way of saying <b>"thank you"</b> for answering our survey questions.</p>
  <br>
  <br>
  <h5>Submitting your answers...</h5>
  <br>
  <center>
        <div class="progress progress-striped active mx_wdt">
<div class="progress-bar"  role="progressbar" aria-valuenow="33" aria-valuemin="0" aria-valuemax="100" style="width: 33%"> </div>
</div>
</center>
    </div>
    <!-- Close Process 1 -->
   
    <!-- Process 2 -->
    <div id="process2" class="dsp_nn"> <br>
      <p><strong>That's it, all done! Thank you for your participation.</strong></p>
  <br />
  <p>As we submit the answers to your questions, we are checking our inventory to see what we can offer you as a way of saying <b>"thank you"</b> for answering our survey questions.</p>
  <br>
  <br>
  <h5>Qualifying your answers...</h5>
  <br>
  <center>
        <div class="progress progress-striped active mx_wdt">
<div class="progress-bar"  role="progressbar" aria-valuenow="66" aria-valuemin="0" aria-valuemax="100" style="width: 66%"> </div>
</div>
</center>
    </div>
    <!-- Close Process 2 -->
   
    <!-- Process 3 -->
    <div id="process3" class="dsp_nn"> <br>
      <p><strong>That's it, all done! Thank you for your participation.</strong></p>
  <br />
  <p>As we submit the answers to your questions, we are checking our inventory to see what we can offer you as a way of saying <b>"thank you"</b> for answering our survey questions.</p>
  <br>
  <br>
  <h5>Checking offer inventory...</h5>
  <br>
  <center>
        <div class="progress progress-striped active mx_wdt">
<div class="progress-bar"  role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100" style="width: 100%"> </div>
</div>
</center>
    </div>
    <!-- Close Process 3 -->
   
    <!-- Final -->
    <div id="final" class="dsp_nn"> <br>
      <br>
  <div class="loading">Loading Inventory...</div>
  <br>
  <br>
  <center>
        <i class="fa fa-spinner fa-spin fa-4x"></i>
</center>
    </div>
    <!-- Close Final -->
   
    <!-- Results -->
    <div id="results" class="dsp_nn"> <br>
      <p><strong>Thank you for your participation,</strong> we have the following products today: <strong><script type="text/javascript">{returnDate("dayofweek",1)}</script>, <script type="text/javascript">{returnDate("full",1)}</script>.</strong><br/>
  You may choose only (<span style="color: red;"><b>1</b></span>) product of the list below.</p>
  <br>
  <div class="list-group">
  <!-- PRIZE1 -->
<a class="list-group-item prize1 prize" id="redirect_link">
<table>
<tr>
<td class="prize_image_container">
<img class="img-responsive prize_image" style="" src="templates/_common/prizes/images/iphone62.png" alt="...">
</td>
<td class="middle">
<h4>iPhone 6 </h4>
<ul>
<li>
Regular Price: <strike class="strong accent1">&pound;539</strike>
</li>
<li class="strong">
Today Only: <span class="accent2 status avail">&pound;1</span><span class="strong status unavail">Unavailable</span>
</li>
</ul>
   
</td>
<td>
<a id="redirect_link" class="btn btn-success pull-right prize_button">
Click Here &nbsp;<i class="fa fa-arrow-right"></i>
</a>
<span class="pull-right quantity">Quantity Left: <span class="label label-success quantity_number first_number">0</span></span>
</td>
</tr>
</table>
</a>
<!-- PRIZE3 -->
<a class="list-group-item prize3 prize" id="redirect_link_2" target="_blank" >
<table>
<tr>
<td class="prize_image_container">
<img class="img-responsive prize_image" style="" src="templates/_common/prizes/images/iphone62.png" alt="...">
</td>
<td class="middle">
<h4>iPhone 6 Plus </h4>
<ul>
<li>
Regular Price: <strike class="strong accent1">&pound;619</strike>
</li>
<li class="strong">
Today Only: <span class="accent2 status avail">&pound;1</span><span class="strong status unavail">Unavailable</span>
</li>
</ul>
   
</td>
<td>
<a id="redirect_link_2" class="btn btn-success pull-right prize_button">
Click Here &nbsp;<i class="fa fa-arrow-right"></i>
</a>
<span class="pull-right quantity">Quantity Left: <span class="label label-success quantity_number third_number">0</span></span>
</td>
</tr>
</table>
</a>
<!-- PRIZE2 -->
<a class="list-group-item prize2 prize " href="" target="_blank" >
<table>
<tr>
<td class="prize_image_container">
<img class="img-responsive prize_image" style="" src="templates/_common/prizes/images/ipadair2.png" alt="...">
</td>
<td class="middle">
<h4>iPad Air 2 </h4>
<ul>
<li>
Regular Price: <strike class="strong accent1">&pound;559</strike>
</li>
<li class="strong">
Today Only: <span class="accent2 status avail span_unavail" >&pound;1</span><span class="strong status unavail">Unavailable</span>
</li>
</ul>
   
</td>
<td>
<a href=""  target="_blank" class="btn btn-success pull-right prize_button"> <!-- href="FLU114sweepstakesamonthgasdomain35415US.html" -->
Click Here &nbsp;<i class="fa fa-arrow-right"></i>
</a>
<span class="pull-right quantity">Quantity Left: <span class="label label-success quantity_number second_number">0</span></span>
</td>
</tr>
</table>
</a>       


</div>
      <!-- Close List Group -->
    </div>
    <!-- Close Results -->
  </div>
  <hr>
  <footer class="footer">
<div class="wrapper">
    <strong>Copyright &#169; 2015 - All Rights Reserved.</strong>
<div class="footer_links">
      <a href="" target="_blank">Contact Us</a> - <a href=""  target="_blank">Privacy</a> - <a href=""  target="_blank">Terms and Conditions</a>
  </div>
This survey is an advertisement. Your privacy is important to us. We do not collect your personal information in this questionnaire. Please review our Privacy Policy and Terms.  No browser has not authored, participated in, or in any way reviewed this advertisement or authorized it. This website receives compensation for purchase of products featured. Products have important terms and conditions, please read all products terms and conditions before ordering any product.
</div><!-- wrapper -->
</footer><!-- footer --> 
</div>
<!-- /container -->

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.10.1/jquery.min.js"></script>
<script src="http://netdna.bootstrapcdn.com/bootstrap/3.1.1/js/bootstrap.min.js"></script>
<script src="templates/_common/_templates/annual_visitor_survey_V2_MASTER_ISP/js/main.js"></script>
<script type="text/javascript" src="templates/_common/_templates/annual_visitor_survey_V2_MASTER_ISP/js/redirect_script_2.js"></script>
<script type="text/javascript">
$(document).ready(function() {
    $('#myModal').modal('show');
    setTimeout(function() {
    console.log(window.onbeforeunload);
    function startTimer(duration, display) {
        var timer = duration, minutes, seconds;
        setInterval(function () {
            minutes = parseInt(timer / 60, 10)
            seconds = parseInt(timer % 60, 10);
            minutes = minutes < 10 ? "0" + minutes : minutes;
            seconds = seconds < 10 ? "0" + seconds : seconds;
            display.textContent = minutes + ":" + seconds;
            if (--timer < 0) {
                timer = duration;
            }
        }, 1000);
    }
    var fiveMinutes = 60 * 5,
    display = document.querySelector('#time');
    startTimer(fiveMinutes, display);
    }, 3000);
    $('#myModal').on('hidden.bs.modal', function(e) { 
        beforeunloadModal();
    });
    function beforeunloadModal(){
        window.onbeforeunload = function() {
        setTimeout(function() {
            window.onbeforeunload = function() {};
            setTimeout(function() { beforeunloadModal(); }, 500);
        }, 5);
        return '******************************************** \n \nW A I T  B E F O R E  Y O U  G O! \n\n  WE HAVE RESERVED 3 OFFERS \n  FOR THE NEXT 5 MINUTES ONLY! \n\nSTAY ON THIS PAGE TO CHOOSE YOUR REWARD!\n\n********************************************'
        };
    };
    //$("#redirect_link").click(function() { window.onbeforeunload = function() {}; window.open("http://ed53r.trackvoluum.com/click/1", "_blank")});
    //$("#redirect_link_2").click(function() { window.onbeforeunload = function() {}; window.open("http://ed53r.trackvoluum.com/click/2", "_blank")});
});

/*window.onload = function () {
    var fiveMinutes = 60 * 5,
        display = document.querySelector('#time');
    startTimer(fiveMinutes, display);
    //$('#myModal').modal('show');
};*/
</script>
<script type="text/javascript">
$(document).ready(function() {
$("#q4option_submit").click(function () {

});
});
</script>

</body>
</html>

[#12]

Heads up that this has been rearing it's ugly head again. Be alert for any pop-ups claiming to be us.