wvproxy.com and the meaning of it all

So I was trawling through the log files here at work today and I noticed some more wvproxy.com URLs coming through to one of our customers. So I picked up the phone and called them.

It turns out that they have a Yellow Pages listing and have an alternate phone number to call on their yellow pages site. But strangely the number on the yellow pages site is NOT the same as the one that wvproxy.com returns.

The number on the wvproxy.com site does go through to the client though.

More wvproxy.com weirdness

So I just had a call from David from http://www.bigearsmediagroup.net.au/ doing an investigation into wvproxy.com (see my wvproxy.com weirdness post) and he had some very interesting things to say.

Apparently they are now doing some Google Adwords advertising and they are still changing the phone number and inserting extra stuff. This code was taken from the wvproxy version of the website: http://www.sdwetc.com.au/

<meta name="robots" content="noindex"/><meta name="norton-safeweb-site-verification" content="qelyedemzbc51m0-q79i41scmiq6-djrmmdl7v24ck9pcdy5gitxct9g32szorrblpfontb5rgctj1yviqav-ssxxu2w6y8xnncnl3kjx1tlssbboobwjbbie4igg10l" /><script language="javascript" type="text/javascript" src="http://prod-tct.webvisible.com/tracker-rp.js"></script>
<script language="javascript" type="text/javascript">
function wvEventLogger_defineSession() {
wvEventLogger = new Tracker({source: 'RP',
sessionId: 'wva0b72797751f4bd8beb9d882a1670282',
campaignId: '96083',
trackingHost: 'http://prod-tct.webvisible.com/'
});
}
function wvEventLogger_addLoadEvent(func) {
var oldonload = window.onload;
if (typeof window.onload != 'function') {
window.onload = func;
}
else {
window.onload = function() {
try {
oldonload();
}
catch (err) {
// ignore
}
func();
}
}
}

var wvEventLogger = null;
</script>

So as we can see, they are adding a noindex tag, so their goal is not to be indexed. They insert a norton safe search tag, although I do not know if this is legit or not. The change in phone number to me seems like a way to track conversions from the Google Adwords campaign – except the company in question does not have a google adwords campaign.

Could it be one of their competitors trying to steal their business?

At any rate – this is all rather – weird.

For the nerdy out there – a little bit of header checking led to an IIS6 Server behind an F5 load balancer web accelerator serving up the wvproxy.com domain

wvproxy.com weirdness

So – what is wvproxy.com? it is proxy site of a company called web visible.

What do they change?

I did a wget of a website and then the website with .wvproxy.com appended and then a recursive diff against those two resulting folders. The changes I saw were URLs in <a> tags and img src tags. For some reason they also changed Phone Numbers and added in some Javascript to log clicks on email address links.

Why are they doing this?

I am guessing it is part of a campaign someone is running.