PPC advertisers (e.g. Finish Line)
money viewers
   Google   
money viewers
InfoSpace
money viewers
Cheapstuff
money viewers
Adfirmative
money viewers
dSide Marketing
money viewers
Netaxle
money viewers
eWoss
money viewers
AdOn Network
money viewers
Trafficsolar

Packet Log - Trafficsolar Spyware, Long Chain of Intermediaries, InfoSpace Running Google Conversion-Inflation Click Fraud
Google Click Fraud Inflates Conversion Rates and Tricks Advertisers into Overpaying - Ben Edelman

This page gives a packet log detailing traffic as traffic flowed from Trafficsolar spyware through intermediaries and on to Google and finally back to the site my Automatic Spyware Advertising Tester had initially requsted, Finishline.com. All testing occurred on December 31, 2009.

See also discussion in main article, as well as screenshots and video.

The full chain of redirects is lengthy, as detailed in the diagram at right. Traffic flows from Trafficsolar spyware to AdOn Network to eWoss to Netaxle to dSide Marketing to Adfirmative to Cheapstuff to InfoSpace to Google, and finally back to Finish Line. All testing occurred on December 31, 2009.

In each step of transmissions, yellow highlighting marks redirect instructions, green highlighting marks the next redirect step, and pink highlighting marks the names of the parties involved.

 

Trafficsolar spyware (pink) observes browsing of the Finish Line site (blue), and redirects to AdOn's urtbk (green)

GET /url/in.cgi?11&camp=mg_ron&url=http%3A%2F%2Furl.urtbk.com%2Fcpv.jsp%3Fp%3D111211%26ip%3D...%26aid%3D403 1%26url%3Dhttp%253A%252F%252Fwww.finishline.com%252Fstore%252Fcheckout%252Fcart.jsp%26excludeCodes%3D%26default%3Dhtt p%253A%252F%252Ftrafficsolar.com%252Furl%252Fin.cgi%253F2%2526cid%253D0100020163FC2860E88343D0BA6E8AAC108F84BB47CCB0A 5%2526aid%253D4031%2526version%253D1.4.3%2526camp%253Dmg_ron%26selectedKeyword%3Dfinishline.com%26selectedListingId%3 D7553372&bid=0.0042&cid=0100020163FC2860E88343D0BA6E8AAC108F84BB47CCB0A5&aid=4031&version=1.4.3 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: trafficsolar.com
Connection: Keep-Alive

HTTP/1.1 302 Found
Date: Thu, 31 Dec 2009 20:52:28 GMT
Server: Apache/2.2.9 (Fedora)
Set-Cookie: SL_11_0000=_1_; domain=trafficsolar.com; path=/; expires=Fri, 01-Jan-2009 20:52:28 GMT
Location: http://url.urtbk.com/cpv.jsp?p=111211&ip=...&aid=4031&url=http%3A%2F%2Fwww.finishline.com%2Fstore %2Fcheckout%2Fcart.jsp&excludeCodes=&default=http%3A%2F%2Ftrafficsolar.com%2Furl%2Fin.cgi%3F2%26cid%3D0100020163FC286 0E88343D0BA6E8AAC108F84BB47CCB0A5%26aid%3D4031%26version%3D1.4.3%26camp%3Dmg_ron&selectedKeyword=finishline.com&selec tedListingId=7553372
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

<html>
<head>
<meta http-equiv="REFRESH" content="1; URL='http://url.urtbk.com/cpv.jsp?p=111211&ip=...&aid=4031&url=http%3A%2F%2Fwww.finishline.com%2Fstore%2Fcheckout%2Fcart.jsp&excludeCodes=&default=http%3A%2F%2Ftrafficsolar.com%2Furl%2Fin.cgi%3F2%26cid%3D0100020163FC2860E88343D0BA6E8AAC108F84BB47CCB0A5%26aid%3D4031%26version%3D1.4.3%26camp%3Dmg_ron&selectedKeyword=finishline.com&selectedListingId=7553372'">
</head>
<body>
document moved <a href="http://url.urtbk.com/cpv.jsp?p=111211&ip=...&aid=4031&url=http%3A%2F%2Fwww.finishline.com%2Fstore%2Fcheckout%2Fcart.jsp&excludeCodes=&default=http%3A%2F%2Ftrafficsolar.com%2Furl%2Fin.cgi%3F2%26cid%3D0100020163FC2860E88343D0BA6E8AAC108F84BB47CCB0A5%26aid%3D4031%26version%3D1.4.3%26camp%3Dmg_ron&selectedKeyword=finishline.com&selectedListingId=7553372">here</a>
</body>
</html>

 

AdOn (pink) redirects to eWoss (green)

GET /cpv.jsp?p=111211&ip=...&aid=4031&url=http%3A%2F%2Fwww.finishline.com%2Fstore%2Fcheckout%2Fcart.jsp&ex cludeCodes=&default=http%3A%2F%2Ftrafficsolar.com%2Furl%2Fin.cgi%3F2%26cid%3D0100020163FC2860E88343D0BA6E8AAC108F84B B47CCB0A5%26aid%3D4031%26version%3D1.4.3%26camp%3Dmg_ron&selectedKeyword=finishline.com&selectedListingId=7553372 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: url.urtbk.com
Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: CP="IDC DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV INT STA"
Set-Cookie: mgFreq=F|4|1262294139989|224046-0-1262329200000|; Domain=.urtbk.com; Expires=Sat, 30-Jan-2010 21:15:39 GMT
Set-Cookie: myGeekConv=2|565568|39455348|finishline.com|7553372|224046|cpv|10|111211|4031|-1|720x300|...|us|ma|506|0|1262294139990; Domain=.urtbk.com; Expires=Sat, 30-Jan-2010 21:15:39 GMT
Set-Cookie: mgUser=1|5a622e5618704a0abbaa07b3d716ceff|...|1262294139990|1; Domain=.urtbk.com; Expires=Sat, 30-Jan-2010 21:15:39 GMT
Location: http://jump.ewoss.net/cpv.ashx?keyword=finishline.com&n=105&site=1&c=6
Content-Type: text/html
Content-Length: 0
Date: Thu, 31 Dec 2009 21:15:39 GMT

 

eWoss (pink) redirects to Netaxle (green)

GET /cpv.ashx?keyword=finishline.com&n=105&site=1&c=6 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: jump.ewoss.net
Connection: Keep-Alive

HTTP/1.1 302 Found
Connection: close
Date: Thu, 31 Dec 2009 21:15:42 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Location: http://www.netaxle.com/search5.aspx?k=discount+basketball+shoes&u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9
Set-Cookie: jumpCookie=5722192; expires=Mon, 31-Dec-2108 06:00:00 GMT; path=/
Cache-Control: private
Content-Type: text/html

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="http://www.netaxle.com/search5.aspx?k=discount+basketball+shoes&amp;u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9">here</a>.</h2>
</body></html>

 

Netaxle (pink) redirects to dSide Marketing (green)

GET /search5.aspx?k=discount+basketball+shoes&u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: www.netaxle.com
Connection: Keep-Alive

HTTP/1.1 200 OK
Cache-Control: private
Date: Thu, 31 Dec 2009 21:15:42 GMT
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=c5m3vgnds0ip1uvzaoyqaayk; path=/; HttpOnly
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked

<html><body>Thank you for using NetAxle.<br>Your result will load shortly<br><img src="Loading.gif"><br><br><a id="aResult" href="http://www.netaxle.com/jump2.ashx?u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9">Click here if page doesn't load.</a><form method='post' action='http://www.netaxle.com/jump2.ashx?u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9' name='rr'></form><script type='text/javascript'>setTimeout('document.forms["rr"].submit()',10);</script></body></html>

 

POST /jump2.ashx?u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://www.netaxle.com/search5.aspx?k=discount+basketball+shoes&u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: www.netaxle.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=c5m3vgnds0ip1uvzaoyqaayk

HTTP/1.1 302 Found
Date: Thu, 31 Dec 2009 21:15:43 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Location: http://network.dsidemarketing.com/screen?aid=1647&cid=1375&subid=greinke&xargs=ZmlkPTExMTYma2V5PWRpc 2NvdW50IGJhc2tldGJhbGwgc2hvZXMmcmE9MjQuOTEuMTU0LjExNCZ1YT1Nb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA2LjA7IFdpbmR vd3MgTlQgNS4xOyBaYW5nbyAxMC4wLjMxNC4wKSZtZDV1YT1hNzhmYWFjNDE5NzIwZThkMDcwMGU1NWRjNjRmZDFlOCZhZHY9ZmluaXNobGluZ S5jb20mcG9zPTkmYmlkPTAuMDc4NDAmcmVmPXd3dy5maW5kYWNvdy5jb20mdXQ9MTI2MjI5NDE0MTo5NjMyODc&url=aHR0cDovLzI0OC0xMzc 1X2dyZWlua2UucHViLmFkZmlybWF0aXZlLmNvbS8yLnBocD9zaWQ9MjQ4JmtleXdvcmQ9ZGlzY291bnQrYmFza2V0YmFsbCtzaG9lcyZnb3RvP WEyNDY3YTI5NGZkYjAyZjU5MDZjZGZkZjZkYzZmMTgwLXdzVXNzM2t3U0YlMDlzay4zdy53U2sud3drJTA5MnZ2UiUzQSUyRiUyRm5ubi5MSXZ qYmlJLkV0USUyRk5JamFFMlMuak5SYiUzRkglM0RvcU5FdFdMditBak5ISXZBamlpK04ydElOJTI2VyUzRDdVczY0NHVrLWhwNXAta2g3dy0zc zZ3LTdraDdwazV1U3doMyUwOVJfYU5mdyUwOXNrdSUwOW9xTkV0V0x2JTJCQWpOSEl2QWppaSUyQk4ydElOJTA5WXRhdmppam9ZSWFSaUliJTA 5MnZ2UiUzQSUyRiUyRkVpcUVILkUySWpSTnZXT08uRXRRJTJGYXcuUjJSJTNGMiUzREZFdUE0Zklrc0Y0b1Vmc3NGU29vSXMzT3drb2ZPZnV1J TI2TiUzRG5Td0YlMjZSYiUzRHclMjZuTyUzRHclMjZqcSUzRFVTc2YlMjZPUSUzRHdGdVUlMjZOdiUzRG9xTkV0V0x2JTJCQWpOSEl2QWppaSU yQk4ydElOJTA5K2Yud3dzJTA5ZiUwOXclMDl3RjRTX3phSXFMSEklMDklMDlzJTA5R0xxdklvK3J2anZJTiUwOUdyJTA5MnZ2UiUzQSUyRiUyR m5ubi42cUxxTjJWcUxJLkV0USUyRiZvYmpUaW1TdHI9MC4zNDMyMDIwMCsxMjYyMjk0MTU0&s=1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 1412

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="http://network.dsidemarketing.com/screen?aid=1647&amp;cid=1375&amp;subid=greinke& amp;xargs=ZmlkPTExMTYma2V5PWRpc2NvdW50IGJhc2tldGJhbGwgc2hvZXMmcmE9MjQuOTEuMTU0LjExNCZ1YT1Nb3ppbGxhLzQuMCAoY29t cGF0aWJsZTsgTVNJRSA2LjA7IFdpbmRvd3MgTlQgNS4xOyBaYW5nbyAxMC4wLjMxNC4wKSZtZDV1YT1hNzhmYWFjNDE5NzIwZThkMDcwMGU1NW RjNjRmZDFlOCZhZHY9ZmluaXNobGluZS5jb20mcG9zPTkmYmlkPTAuMDc4NDAmcmVmPXd3dy5maW5kYWNvdy5jb20mdXQ9MTI2MjI5NDE0MTo5 NjMyODc&amp;url=aHR0cDovLzI0OC0xMzc1X2dyZWlua2UucHViLmFkZmlybWF0aXZlLmNvbS8yLnBocD9zaWQ9MjQ4JmtleXdvcmQ9ZGlzY2 91bnQrYmFza2V0YmFsbCtzaG9lcyZnb3RvPWEyNDY3YTI5NGZkYjAyZjU5MDZjZGZkZjZkYzZmMTgwLXdzVXNzM2t3U0YlMDlzay4zdy53U2su d3drJTA5MnZ2UiUzQSUyRiUyRm5ubi5MSXZqYmlJLkV0USUyRk5JamFFMlMuak5SYiUzRkglM0RvcU5FdFdMditBak5ISXZBamlpK04ydElOJT I2VyUzRDdVczY0NHVrLWhwNXAta2g3dy0zczZ3LTdraDdwazV1U3doMyUwOVJfYU5mdyUwOXNrdSUwOW9xTkV0V0x2JTJCQWpOSEl2QWppaSUy Qk4ydElOJTA5WXRhdmppam9ZSWFSaUliJTA5MnZ2UiUzQSUyRiUyRkVpcUVILkUySWpSTnZXT08uRXRRJTJGYXcuUjJSJTNGMiUzREZFdUE0Zk lrc0Y0b1Vmc3NGU29vSXMzT3drb2ZPZnV1JTI2TiUzRG5Td0YlMjZSYiUzRHclMjZuTyUzRHclMjZqcSUzRFVTc2YlMjZPUSUzRHdGdVUlMjZO diUzRG9xTkV0V0x2JTJCQWpOSEl2QWppaSUyQk4ydElOJTA5K2Yud3dzJTA5ZiUwOXclMDl3RjRTX3phSXFMSEklMDklMDlzJTA5R0xxdklvK3 J2anZJTiUwOUdyJTA5MnZ2UiUzQSUyRiUyRm5ubi42cUxxTjJWcUxJLkV0USUyRiZvYmpUaW1TdHI9MC4zNDMyMDIwMCsxMjYyMjk0MTU0&amp ;s=1">here</a>.</h2>
</body></html>

 

dSide Marketing (pink) redirects to Adfirmative (green)

GET /screen?aid=1647&cid=1375&subid=greinke&xargs=ZmlkPTExMTYma2V5PWRpc2NvdW50IGJhc2tldGJhbGwgc2hvZXMmcmE9MjQ uOTEuMTU0LjExNCZ1YT1Nb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA2LjA7IFdpbmRvd3MgTlQgNS4xOyBaYW5nbyAxMC4wLjMxNC4w KSZtZDV1YT1hNzhmYWFjNDE5NzIwZThkMDcwMGU1NWRjNjRmZDFlOCZhZHY9ZmluaXNobGluZS5jb20mcG9zPTkmYmlkPTAuMDc4NDAmcmVmP Xd3dy5maW5kYWNvdy5jb20mdXQ9MTI2MjI5NDE0MTo5NjMyODc&url=aHR0cDovLzI0OC0xMzc1X2dyZWlua2UucHViLmFkZmlybWF0aXZlLm NvbS8yLnBocD9zaWQ9MjQ4JmtleXdvcmQ9ZGlzY291bnQrYmFza2V0YmFsbCtzaG9lcyZnb3RvPWEyNDY3YTI5NGZkYjAyZjU5MDZjZGZkZjZ kYzZmMTgwLXdzVXNzM2t3U0YlMDlzay4zdy53U2sud3drJTA5MnZ2UiUzQSUyRiUyRm5ubi5MSXZqYmlJLkV0USUyRk5JamFFMlMuak5SYiUz RkglM0RvcU5FdFdMditBak5ISXZBamlpK04ydElOJTI2VyUzRDdVczY0NHVrLWhwNXAta2g3dy0zczZ3LTdraDdwazV1U3doMyUwOVJfYU5md yUwOXNrdSUwOW9xTkV0V0x2JTJCQWpOSEl2QWppaSUyQk4ydElOJTA5WXRhdmppam9ZSWFSaUliJTA5MnZ2UiUzQSUyRiUyRkVpcUVILkUySW pSTnZXT08uRXRRJTJGYXcuUjJSJTNGMiUzREZFdUE0Zklrc0Y0b1Vmc3NGU29vSXMzT3drb2ZPZnV1JTI2TiUzRG5Td0YlMjZSYiUzRHclMjZ uTyUzRHclMjZqcSUzRFVTc2YlMjZPUSUzRHdGdVUlMjZOdiUzRG9xTkV0V0x2JTJCQWpOSEl2QWppaSUyQk4ydElOJTA5K2Yud3dzJTA5ZiUw OXclMDl3RjRTX3phSXFMSEklMDklMDlzJTA5R0xxdklvK3J2anZJTiUwOUdyJTA5MnZ2UiUzQSUyRiUyRm5ubi42cUxxTjJWcUxJLkV0USUyR iZvYmpUaW1TdHI9MC4zNDMyMDIwMCsxMjYyMjk0MTU0&s=1 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://www.netaxle.com/search5.aspx?k=discount+basketball+shoes&u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Connection: Keep-Alive
Cache-Control: no-cache
Host: network.dsidemarketing.com

HTTP/1.1 302 Found
Date: Thu, 31 Dec 2009 21:15:43 GMT
Server: Apache
Set-Cookie: uuid=390026552; path=/; expires=Fri Dec 31 21:15:43 2010
Location: /redir?aid=1647&cid=1375&subid=greinke&xargs=ZmlkPTExMTYma2V5PWRpc2NvdW50IGJhc2tldGJhbGwgc2hvZXMmcmE9MjQuOTEuMTU0LjExNCZ1YT1Nb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA2LjA7IFdpbmRvd3MgTlQgNS4xOyBaYW5nbyAxMC4wLjMxNC4wKSZtZDV1YT1hNzhmYWFjNDE5NzIwZThkMDcwMGU1NWRjNjRmZDFlOCZhZHY9ZmluaXNobGluZS5jb20mcG9zPTkmYmlkPTAuMDc4NDAmcmVmPXd3dy5maW5kYWNvdy5jb20mdXQ9MTI2MjI5NDE0MTo5NjMyODc&url=aHR0cDovLzI0OC0xMzc1X2dyZWlua2UucHViLmFkZmlybWF0aXZlLmNvbS8yLnBocD9zaWQ9MjQ4JmtleXdvcmQ9ZGlzY291bnQrYmFza2V0YmFsbCtzaG9lcyZnb3RvPWEyNDY3YTI5NGZkYjAyZjU5MDZjZGZkZjZkYzZmMTgwLXdzVXNzM2t3U0YlMDlzay4zdy53U2sud3drJTA5MnZ2UiUzQSUyRiUyRm5ubi5MSXZqYmlJLkV0USUyRk5JamFFMlMuak5SYiUzRkglM0RvcU5FdFdMditBak5ISXZBamlpK04ydElOJTI2VyUzRDdVczY0NHVrLWhwNXAta2g3dy0zczZ3LTdraDdwazV1U3doMyUwOVJfYU5mdyUwOXNrdSUwOW9xTkV0V0x2JTJCQWpOSEl2QWppaSUyQk4ydElOJTA5WXRhdmppam9ZSWFSaUliJTA5MnZ2UiUzQSUyRiUyRkVpcUVILkUySWpSTnZXT08uRXRRJTJGYXcuUjJSJTNGMiUzREZFdUE0Zklrc0Y0b1Vmc3NGU29vSXMzT3drb2ZPZnV1JTI2TiUzRG5Td0YlMjZSYiUzRHclMjZuTyUzRHclMjZqcSUzRFVTc2YlMjZPUSUzRHdGdVUlMjZOdiUzRG9xTkV0V0x2JTJCQWpOSEl2QWppaSUyQk4ydElOJTA5K2Yud3dzJTA5ZiUwOXclMDl3RjRTX3phSXFMSEklMDklMDlzJTA5R0xxdklvK3J2anZJTiUwOUdyJTA5MnZ2UiUzQSUyRiUyRm5ubi42cUxxTjJWcUxJLkV0USUyRiZvYmpUaW1TdHI9MC4zNDMyMDIwMCsxMjYyMjk0MTU0&s=1
Connection: close
Transfer-Encoding: chunked
Content-Type: text/plain

 

GET /redir?aid=1647&cid=1375&subid=greinke&xargs=ZmlkPTExMTYma2V5PWRpc2NvdW50IGJhc2tldGJhbGwgc2hvZXMmcmE9MjQuO TEuMTU0LjExNCZ1YT1Nb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA2LjA7IFdpbmRvd3MgTlQgNS4xOyBaYW5nbyAxMC4wLjMxNC4wKSZ tZDV1YT1hNzhmYWFjNDE5NzIwZThkMDcwMGU1NWRjNjRmZDFlOCZhZHY9ZmluaXNobGluZS5jb20mcG9zPTkmYmlkPTAuMDc4NDAmcmVmPXd3d y5maW5kYWNvdy5jb20mdXQ9MTI2MjI5NDE0MTo5NjMyODc&url=aHR0cDovLzI0OC0xMzc1X2dyZWlua2UucHViLmFkZmlybWF0aXZlLmNvbS8 yLnBocD9zaWQ9MjQ4JmtleXdvcmQ9ZGlzY291bnQrYmFza2V0YmFsbCtzaG9lcyZnb3RvPWEyNDY3YTI5NGZkYjAyZjU5MDZjZGZkZjZkYzZmM TgwLXdzVXNzM2t3U0YlMDlzay4zdy53U2sud3drJTA5MnZ2UiUzQSUyRiUyRm5ubi5MSXZqYmlJLkV0USUyRk5JamFFMlMuak5SYiUzRkglM0R vcU5FdFdMditBak5ISXZBamlpK04ydElOJTI2VyUzRDdVczY0NHVrLWhwNXAta2g3dy0zczZ3LTdraDdwazV1U3doMyUwOVJfYU5mdyUwOXNrd SUwOW9xTkV0V0x2JTJCQWpOSEl2QWppaSUyQk4ydElOJTA5WXRhdmppam9ZSWFSaUliJTA5MnZ2UiUzQSUyRiUyRkVpcUVILkUySWpSTnZXT08 uRXRRJTJGYXcuUjJSJTNGMiUzREZFdUE0Zklrc0Y0b1Vmc3NGU29vSXMzT3drb2ZPZnV1JTI2TiUzRG5Td0YlMjZSYiUzRHclMjZuTyUzRHclM jZqcSUzRFVTc2YlMjZPUSUzRHdGdVUlMjZOdiUzRG9xTkV0V0x2JTJCQWpOSEl2QWppaSUyQk4ydElOJTA5K2Yud3dzJTA5ZiUwOXclMDl3RjR TX3phSXFMSEklMDklMDlzJTA5R0xxdklvK3J2anZJTiUwOUdyJTA5MnZ2UiUzQSUyRiUyRm5ubi42cUxxTjJWcUxJLkV0USUyRiZvYmpUaW1Td HI9MC4zNDMyMDIwMCsxMjYyMjk0MTU0&s=1 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://www.netaxle.com/search5.aspx?k=discount+basketball+shoes&u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9
Accept-Language: en-us
Cookie: uuid=390026552
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Connection: Keep-Alive
Cache-Control: no-cache
Host: network.dsidemarketing.com

HTTP/1.1 302 Found
Date: Thu, 31 Dec 2009 21:15:44 GMT
Server: Apache
Set-Cookie: uuid=390026552; path=/; expires=Fri Dec 31 21:15:44 2010
Location: http://248-1375_greinke.pub.adfirmative.com/2.php?sid=248&keyword=discount+basketball+shoes&goto=a246 7a294fdb02f5906cdfdf6dc6f180-wsUss3kwSF%09sk.3w.wSk.wwk%092vvR%3A%2F%2Fnnn.LIvjbiI.EtQ%2FNIjaE2S.jNRb%3FH%3DoqNEtWLv+AjNHIvAjii+N2tIN%26W%3D7Us644uk-hp5p-kh7w-3s6w-7kh7pk5uSwh3%09R_aNfw%09sku%09oqNEtWLv%2BAjNHIvAjii%2BN2tIN%09YtavjijoYIaRiIb%092vvR%3A%2F%2FEiqEH.E2IjRNvWOO.EtQ%2Faw.R2R%3F2%3DFEuA4fIksF4oUfssFSooIs3OwkofOfuu%26N%3DnSwF%26Rb%3Dw%26nO%3Dw%26jq%3DUSsf%26OQ%3DwFuU%26Nv%3DoqNEtWLv%2BAjNHIvAjii%2BN2tIN%09+f.wws%09f%09w%09wF4S_zaIqLHI%09%09s%09GLqvIo+rvjvIN%09Gr%092vvR%3A%2F%2Fnnn.6qLqN2VqLI.EtQ%2F&objTimStr=0.34320200+1262294154
Connection: close
Transfer-Encoding: chunked
Content-Type: text/plain

 

Adfirmative (pink) redirects to Cheapstuff (green)

GET /2.php?sid=248&keyword=discount+basketball+shoes&goto=a2467a294fdb02f5906cdfdf6dc6f180-wsUss3kwSF%09sk.3w.wSk.wwk%092vvR%3A%2F%2Fnnn.LIvjbiI.EtQ%2FNIjaE2S.jNRb%3FH%3DoqNEtWLv+AjNHIvAjii+N2tIN%26W%3D7Us644uk-hp5p-kh7w-3s6w-7kh7pk5uSwh3%09R_aNfw%09sku%09oqNEtWLv%2BAjNHIvAjii%2BN2tIN%09YtavjijoYIaRiIb%092vvR%3A%2F%2FEiqEH.E2IjRNvWOO.EtQ%2Faw.R2R%3F2%3DFEuA4fIksF4oUfssFSooIs3OwkofOfuu%26N%3DnSwF%26Rb%3Dw%26nO%3Dw%26jq%3DUSsf%26OQ%3DwFuU%26Nv%3DoqNEtWLv%2BAjNHIvAjii%2BN2tIN%09+f.wws%09f%09w%09wF4S_zaIqLHI%09%09s%09GLqvIo+rvjvIN%09Gr%092vvR%3A%2F%2Fnnn.6qLqN2VqLI.EtQ%2F&objTimStr=0.34320200+1262294154 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://www.netaxle.com/search5.aspx?k=discount+basketball+shoes&u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: 248-1375_greinke.pub.adfirmative.com
Connection: Keep-Alive
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Thu, 31 Dec 2009 21:15:44 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.1.6
P3P: policyref="http://www.adfirmative.com/w3c/p3p.xml", CP="DEVa OUR IND DSP NON COR"
Set-Cookie: coo_click1=4cf07191ed92255fafeb991dd9ef89d8
Set-Cookie: cf_coo_click15=7a9be3812db757b312f8cce44b170c63; expires=Thu, 24-Dec-2037 21:15:44 GMT
Location: /3.php?objTimStr=0.34320200+1262294154&said=1375_greinke&time=1262294144&sid=248&check=f7782786a9c9341 94c4629b570ca0f2e&referrer_check=94a2ef68b314fc1380b00921ab857a3b&goto=a2467a294fdb02f5906cdfdf6dc6f180-wsUss3kwSF%09sk.3w.wSk.wwk%092vvR%3A%2F%2Fnnn.LIvjbiI.EtQ%2FNIjaE2S.jNRb%3FH%3DoqNEtWLv+AjNHIvAjii+N2tIN%26W%3D7Us644uk-hp5p-kh7w-3s6w-7kh7pk5uSwh3%09R_aNfw%09sku%09oqNEtWLv%2BAjNHIvAjii%2BN2tIN%09YtavjijoYIaRiIb%092vvR%3A%2F%2FEiqEH.E2IjRNvWOO.EtQ%2Faw.R2R%3F2%3DFEuA4fIksF4oUfssFSooIs3OwkofOfuu%26N%3DnSwF%26Rb%3Dw%26nO%3Dw%26jq%3DUSsf%26OQ%3DwFuU%26Nv%3DoqNEtWLv%2BAjNHIvAjii%2BN2tIN%09+f.wws%09f%09w%09wF4S_zaIqLHI%09%09s%09GLqvIo+rvjvIN%09Gr%092vvR%3A%2F%2Fnnn.6qLqN2VqLI.EtQ%2F&referrer=http%3A%2F%2Fwww.netaxle.com%2Fsearch5.aspx%3Fk%3Ddiscount%2Bbasketball%2Bshoes%26u%3DC62F7784-AEBE-4AC1-92F1-C4ACE4B851A9
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

 

GET /3.php?objTimStr=0.34320200+1262294154&said=1375_greinke&time=1262294144&sid=248&check=f7782786a9c934194c4629b570ca0f2e&referrer_check=94a2ef68b314fc1380b00921ab857a3b&goto=a2467a294fdb02f5906cdfdf6dc6f180-wsUss3kwSF%09sk.3w.wSk.wwk%092vvR%3A%2F%2Fnnn.LIvjbiI.EtQ%2FNIjaE2S.jNRb%3FH%3DoqNEtWLv+AjNHIvAjii+N2tIN%26W%3D7Us644uk-hp5p-kh7w-3s6w-7kh7pk5uSwh3%09R_aNfw%09sku%09oqNEtWLv%2BAjNHIvAjii%2BN2tIN%09YtavjijoYIaRiIb%092vvR%3A%2F%2FEiqEH.E2IjRNvWOO.EtQ%2Faw.R2R%3F2%3DFEuA4fIksF4oUfssFSooIs3OwkofOfuu%26N%3DnSwF%26Rb%3Dw%26nO%3Dw%26jq%3DUSsf%26OQ%3DwFuU%26Nv%3DoqNEtWLv%2BAjNHIvAjii%2BN2tIN%09+f.wws%09f%09w%09wF4S_zaIqLHI%09%09s%09GLqvIo+rvjvIN%09Gr%092vvR%3A%2F%2Fnnn.6qLqN2VqLI.EtQ%2F&referrer=http%3A%2F%2Fwww.netaxle.com%2Fsearch5.aspx%3Fk%3Ddiscount%2Bbasketball%2Bshoes%26u%3DC62F7784-AEBE-4AC1-92F1-C4ACE4B851A9 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://www.netaxle.com/search5.aspx?k=discount+basketball+shoes&u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: 248-1375_greinke.pub.adfirmative.com
Cookie: coo_click1=4cf07191ed92255fafeb991dd9ef89d8; cf_coo_click15=7a9be3812db757b312f8cce44b170c63
Connection: Keep-Alive
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Thu, 31 Dec 2009 21:15:44 GMT
Server: Apache/2.2.6 (Fedora)
X-Powered-By: PHP/5.1.6
Location: http://click.cheapstuff.com/r1.php?h=3c8b70e4237d602235dde29f14d0f088&s=w513&px=1&wf=1&ai=6520&fm=1386&st=discount+basketball+shoes
Content-Length: 1
Connection: close
Content-Type: text/html; charset=UTF-8

 

Cheapstuff (pink) redirects to InfoSpace (green)

GET /r1.php?h=3c8b70e4237d602235dde29f14d0f088&s=w513&px=1&wf=1&ai=6520&fm=1386&st=discount+basketball+shoes HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://www.netaxle.com/search5.aspx?k=discount+basketball+shoes&u=C62F7784-AEBE-4AC1-92F1-C4ACE4B851A9
Accept-Language: en-us
Host: click.cheapstuff.com
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Connection: Keep-Alive
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 31 Dec 2009 21:15:45 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Content-Length: 4099
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<script type="text/javascript">
if (window.innerWidth < 150 && 1) {
var furl;
furl = 'http://localhost/fraud.php?aff='+6520+'&fid='+1386;
var xmlhttp;
if (window.XMLHttpRequest) { // code for IE7+, Firefox, Chrome, Opera, Safari
xmlhttp=new XMLHttpRequest();
} else if (window.ActiveXObject) { // code for IE6, IE5
xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
}
xmlhttp.onreadystatechange=function() {
if(xmlhttp.readyState==4) {
document.myForm.time.value=xmlhttp.responseText;
}
}
xmlhttp.open("GET","fraud.php?aff=6520&fid=1386",true);
xmlhttp.send(null);
location.href="http://click.cheapstuff.com/r2.php?h=3c8b70e4237d602235dde29f14d0f088&e=&s=w513&ai=6520&dip=&r=hjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%2BM2CXkpS%2FkUhm1DQepDC3ssYPgXcX1P&oref=&c=&wf=fraud";
}
</script>
<head>
<script type="text/javascript">
window.history.forward(1);
function clicklink() {
if (document.all) {
document.all("url").click();
} else {
location.href="http://click.cheapstuff.com/r2.php?h=3c8b70e4237d602235dde29f14d0f088&e=&s=w513&ai=6520&dip=&r=hjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%2BM2CXkpS%2FkUhm1DQepDC3ssYPgXcX1P&oref=&c=";
}
}
function clickredirect () {
document.redirect.submit();
}
</script>
</head>
<body onLoad="clickredirect();">
<a href="http://click.cheapstuff.com/r2.php?h=3c8b70e4237d602235dde29f14d0f088&e=&s=w513&ai=6520&dip=&r=hjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%2BM2CXkpS%2FkUhm1DQepDC3ssYPgXcX1P&oref=&c=&pixel=fraud" target='_top'><img src="./includes/spacer.gif" width="1" height="1" /></a>

<form name="redirect" method="POST" action="http://click.cheapstuff.com/r2.php?h=3c8b70e4237d602235dde29f14d0f088&e=&s=w513&ai=6520&dip=&r=hjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%2BM2CXkpS%2FkUhm1DQepDC3ssYPgXcX1P&oref=&c=">
<input type="hidden" name="h" value="3c8b70e4237d602235dde29f14d0f088">
<input type="hidden" name="e" value="">
<input type="hidden" name="s" value="w513">
<input type="hidden" name="ai" value="6520">
<input type="hidden" name="dip" value="">
<input type="hidden" name="r" value="hjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%2BM2CXkpS%2FkUhm1DQepDC3ssYPgXcX1P">
<input type="hidden" name="oref" value="">
<noscript><a href="http://click.cheapstuff.com/r2.php?h=3c8b70e4237d602235dde29f14d0f088&e=&s=w513&ai=6520&dip=&r=hjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%2BM2CXkpS%2FkUhm1DQepDC3ssYPgXcX1P&oref=&c=" target='_top'>Click here to redirect to this website.</a></noscript>
</form>
<a href="http://click.cheapstuff.com/r2.php?h=3c8b70e4237d602235dde29f14d0f088&e=&s=w513&ai=6520&dip=&r=hjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%2BM2CXkpS%2FkUhm1DQepDC3ssYPgXcX1P&oref=&c=" id='url' target='_top'></a>

</body>
</html>
<script>
document.location.href = "http://click.cheapstuff.com/r2.php?h=3c8b70e4237d602235dde29f14d0f088&e=&s=w513&ai=6520&dip=&r=hjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%2BM2CXkpS%2FkUhm1DQepDC3ssYPgXcX1P&oref=&c=";
</script>
<meta http-equiv="refresh" content="7;url=http://click.cheapstuff.com/k.php?ai=6520&url=http%3A%2F%2Fclick.cheapstuff.com%2Fr2.php%3Fh%3D3c8b70e4237d602235dde29f14d0f088%26e%3D%26s%3Dw513%26ai%3D6520%26dip%3D%26r%3DhjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%252BM2CXkpS%252FkUhm1DQepDC3ssYPgXcX1P%26oref%3D%26c%3D" />

 

GET /r2.php?h=3c8b70e4237d602235dde29f14d0f088&e=&s=w513&ai=6520&dip=&r=hjRWsHZFLS15P2RmgzRDuKh7LBlxNWVrgyFUo6RLLBd1OK43if1Gqa95bStwPGFafzNNpbB4XyJu86lgjSVVZrFTQew0Dm0vVvQPgYFYQ%2BM2CXkpS%2FkUhm1DQepDC3ssYPgXcX1P&oref=&c= HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: click.cheapstuff.com
Connection: Keep-Alive

HTTP/1.1 200 OK
Date: Thu, 31 Dec 2009 21:15:45 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Set-Cookie: PHPSESSID=pi9lgee5namnr7uhfamhv9p1h0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SessionCookie=pi9lgee5namnr7uhfamhv9p1h0; expires=Fri, 31-Dec-2010 21:15:45 GMT; path=/; domain=.cheapstuff.com
Content-Length: 4339
Keep-Alive: timeout=2, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

<html>
<head>
<script type="text/javascript">
window.history.forward(1);
function clicklink() {
if (document.all) {
document.all("url").click();
} else {
location.href="http://cheapstuff.com/ed.php?search=discount basketball shoes&url=http%3A%2F%2Fwsclick.infospace.com%2Fclickserver%2F_iceUrlFlag%3D1%3FrawURL%3Dhttp%253A%252F%252Fwww.google.com%252Faclk%253Fsa%253Dl%2526ai%253DCHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14%2526num%253D3%2526sig%253DAGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw%2526q%253Dhttp%253A%252F%252Fclickserve.us2.dartsearch.net%252Flink%252Fclick%25253Flid%25253D43000000038525362%252526ds_s_kwgid%25253D58000000000418174%252526ds_e_adid%25253D3384004416%252526ds_e_matchtype%25253Dsearch%252526ds_url_v%25253D2%260%3D%261%3D0%264%3D67.63.58.255%265%3D...%269%3Dbd6560213c264edd84c32740ef89ca01%2610%3D1%2611%3Dcheapstuff.7search%2613%3Dsearch%2614%3D245874%2615%3Dmain-title%2617%3D3%2618%3D3%2619%3D1%2620%3D3%2621%3D0%2622%3D1ibuxl0ueIU%253D%2640%3DNQoOLwld0pGr0oUJfw%252FHww%253D%253D%26_IceUrl%3Dtrue%0A++++";
}
}
</script>
</head>
<body onLoad="clicklink();">
<a href="http://cheapstuff.com/ed.php?search=discount basketball shoes&url=http%3A%2F%2Fwsclick.infospace.com%2Fclickserver%2F_iceUrlFlag%3D1%3FrawURL%3Dhttp%253A%252F%252Fwww.google.com%252Faclk%253Fsa%253Dl%2526ai%253DCHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14%2526num%253D3%2526sig%253DAGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw%2526q%253Dhttp%253A%252F%252Fclickserve.us2.dartsearch.net%252Flink%252Fclick%25253Flid%25253D43000000038525362%252526ds_s_kwgid%25253D58000000000418174%252526ds_e_adid%25253D3384004416%252526ds_e_matchtype%25253Dsearch%252526ds_url_v%25253D2%260%3D%261%3D0%264%3D67.63.58.255%265%3D...%269%3Dbd6560213c264edd84c32740ef89ca01%2610%3D1%2611%3Dcheapstuff.7search%2613%3Dsearch%2614%3D245874%2615%3Dmain-title%2617%3D3%2618%3D3%2619%3D1%2620%3D3%2621%3D0%2622%3D1ibuxl0ueIU%253D%2640%3DNQoOLwld0pGr0oUJfw%252FHww%253D%253D%26_IceUrl%3Dtrue%0A++++" id='url' target='_top'></a>
<noscript><a href="http://cheapstuff.com/ed.php?search=discount basketball shoes&url=http%3A%2F%2Fwsclick.infospace.com%2Fclickserver%2F_iceUrlFlag%3D1%3FrawURL%3Dhttp%253A%252F%252Fwww.google.com%252Faclk%253Fsa%253Dl%2526ai%253DCHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14%2526num%253D3%2526sig%253DAGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw%2526q%253Dhttp%253A%252F%252Fclickserve.us2.dartsearch.net%252Flink%252Fclick%25253Flid%25253D43000000038525362%252526ds_s_kwgid%25253D58000000000418174%252526ds_e_adid%25253D3384004416%252526ds_e_matchtype%25253Dsearch%252526ds_url_v%25253D2%260%3D%261%3D0%264%3D67.63.58.255%265%3D...%269%3Dbd6560213c264edd84c32740ef89ca01%2610%3D1%2611%3Dcheapstuff.7search%2613%3Dsearch%2614%3D245874%2615%3Dmain-title%2617%3D3%2618%3D3%2619%3D1%2620%3D3%2621%3D0%2622%3D1ibuxl0ueIU%253D%2640%3DNQoOLwld0pGr0oUJfw%252FHww%253D%253D%26_IceUrl%3Dtrue%0A++++" target='_top'>Click here to redirect to this website.</a></noscript>
</body>
</html>
<script>
document.location.href = "http://cheapstuff.com/ed.php?search=discount basketball shoes&url=http%3A%2F%2Fwsclick.infospace.com%2Fclickserver%2F_iceUrlFlag%3D1%3FrawURL%3Dhttp%253A%252F%252Fwww.google.com%252Faclk%253Fsa%253Dl%2526ai%253DCHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14%2526num%253D3%2526sig%253DAGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw%2526q%253Dhttp%253A%252F%252Fclickserve.us2.dartsearch.net%252Flink%252Fclick%25253Flid%25253D43000000038525362%252526ds_s_kwgid%25253D58000000000418174%252526ds_e_adid%25253D3384004416%252526ds_e_matchtype%25253Dsearch%252526ds_url_v%25253D2%260%3D%261%3D0%264%3D67.63.58.255%265%3D...%269%3Dbd6560213c264edd84c32740ef89ca01%2610%3D1%2611%3Dcheapstuff.7search%2613%3Dsearch%2614%3D245874%2615%3Dmain-title%2617%3D3%2618%3D3%2619%3D1%2620%3D3%2621%3D0%2622%3D1ibuxl0ueIU%253D%2640%3DNQoOLwld0pGr0oUJfw%252FHww%253D%253D%26_IceUrl%3Dtrue%0A++++";
</script>

 

GET /ed.php?search=discount%20basketball%20shoes&url=http%3A%2F%2Fwsclick.infospace.com%2Fclickserver%2F_iceUrlFlag%3D1%3FrawURL%3Dhttp%253A%252F%252Fwww.google.com%252Faclk%253Fsa%253Dl%2526ai%253DCHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14%2526num%253D3%2526sig%253DAGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw%2526q%253Dhttp%253A%252F%252Fclickserve.us2.dartsearch.net%252Flink%252Fclick%25253Flid%25253D43000000038525362%252526ds_s_kwgid%25253D58000000000418174%252526ds_e_adid%25253D3384004416%252526ds_e_matchtype%25253Dsearch%252526ds_url_v%25253D2%260%3D%261%3D0%264%3D67.63.58.255%265%3D...%269%3Dbd6560213c264edd84c32740ef89ca01%2610%3D1%2611%3Dcheapstuff.7search%2613%3Dsearch%2614%3D245874%2615%3Dmain-title%2617%3D3%2618%3D3%2619%3D1%2620%3D3%2621%3D0%2622%3D1ibuxl0ueIU%253D%2640%3DNQoOLwld0pGr0oUJfw%252FHww%253D%253D%26_IceUrl%3Dtrue%0A++++ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: cheapstuff.com
Connection: Keep-Alive
Cookie: SessionCookie=pi9lgee5namnr7uhfamhv9p1h0

HTTP/1.1 200 OK
Date: Thu, 31 Dec 2009 21:15:46 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Content-Length: 2123
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Cheapstuff.com - Searching Directories</title>
<style type="text/css">
[CSS omitted --BGE]
</style>
<script type="text/javascript">
<!--
window.history.forward(1);
function clicklink() {
if (document.all) {
document.all("url").click();
} else {
location.href="";
}
}
function clickredirect () {
document.redirect.submit();
}
//-->
</script>
</head>
<body onLoad="clickredirect();">
<form name="redirect" method="POST" action="http://cheapstuff.com/result-discount_basketball_shoes.html">
<input type="hidden" name="search" value="discount basketball shoes">
<input type="hidden" name="url" value="http://wsclick.infospace.com/clickserver/_iceUrlFlag=1?rawURL=http%3A%2F%2Fwww.google.com%2Faclk%3Fsa%3Dl%26ai%3DCHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14%26num%3D3%26sig%3DAGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw%26q%3Dhttp%3A%2F%2Fclickserve.us2.dartsearch.net%2Flink%2Fclick%253Flid%253D43000000038525362%2526ds_s_kwgid%253D58000000000418174%2526ds_e_adid%253D3384004416%2526ds_e_matchtype%253Dsearch%2526ds_url_v%253D2&0=&1=0&4=67.63.58.255&5=...&9=bd6560213c264edd84c32740ef89ca01&10=1&11=cheapstuff.7search&13=search&14=245874&15=main-title&17=3&18=3&19=1&20=3&21=0&22=1ibuxl0ueIU%3D&40=NQoOLwld0pGr0oUJfw%2FHww%3D%3D&_IceUrl=true">
<input type="hidden" name="cmd" value="redirect">
</form>
</body>
</html>

 

InfoSpace (pink) redirects to Google (green)

GET /clickserver/_iceUrlFlag=1?rawURL=http%3A%2F%2Fwww.google.com%2Faclk%3Fsa%3Dl%26ai%3DCHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14%26num%3D3%26sig%3DAGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw%26q%3Dhttp%3A%2F%2Fclickserve.us2.dartsearch.net%2Flink%2Fclick%253Flid%253D43000000038525362%2526ds_s_kwgid%253D58000000000418174%2526ds_e_adid%253D3384004416%2526ds_e_matchtype%253Dsearch%2526ds_url_v%253D2&0=&1=0&4=67.63.58.255&5=...&9=bd6560213c264edd84c32740ef89ca01&10=1&11=cheapstuff.7search&13=search&14=245874&15=main-title&17=3&18=3&19=1&20=3&21=0&22=1ibuxl0ueIU%3D&40=NQoOLwld0pGr0oUJfw%2FHww%3D%3D&_IceUrl=true HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://cheapstuff.com/result-discount_basketball_shoes.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Host: wsclick.infospace.com
Connection: Keep-Alive

HTTP/1.1 302 Found
Date: Thu, 31 Dec 2009 21:13:10 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Location: http://www.google.com/aclk?sa=l&ai=CHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14&num=3&sig=AGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw&q=http://clickserve.us2.dartsearch.net/link/click%3Flid%3D43000000038525362%26ds_s_kwgid%3D58000000000418174%26ds_e_adid%3D3384004416%26ds_e_matchtype%3Dsearch%26ds_url_v%3D2
Set-Cookie: .ASPXANONYMOUS=B3cxpalhi2Qtl9RDAd1UM8GSSuKtvsHQL-DBOaO9ORD089RcpxOYmgglrlpg8TEsmocYRs3P2lCBHWz81nmPi_S288J3KPc5yBNgwfwjh9Q1; expires=Sat, 26-Nov-2011 07:53:10 GMT; path=/
Set-Cookie: ASP.NET_SessionId=iorinwjs13och4fmeqatq045; path=/
Set-Cookie: DomainSession=TransactionId=d12641e1af7a45ba862c2740ef89ca01&SessionId=d1d80a2f108d487195b32740ef89ca01&ActionId=825add06f49c40a3984b2740ef89ca01&CookieDomain=.infospace.com&PrevActionId=; domain=.infospace.com; expires=Thu, 31-Dec-2009 21:33:10 GMT; path=/
Set-Cookie: DomainUserProfile=AnonymousId=8a0b21bab42b4eb08a542740ef89ca01&LastSeenDateTime=12/31/2009 9:13:10 PM&IssueDateTime=12/31/2009 9:13:10 PM&CookieDomain=.infospace.com; domain=.infospace.com; expires=Sat, 07-Dec-2109 21:13:10 GMT; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 693

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="http://www.google.com/aclk?sa=l&amp;ai=CHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14&amp;num=3&amp;sig=AGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw&amp;q=http://clickserve.us2.dartsearch.net/link/click%3Flid%3D43000000038525362%26ds_s_kwgid%3D58000000000418174%26ds_e_adid%3D3384004416%26ds_e_matchtype%3Dsearch%26ds_url_v%3D2">here</a>.</h2>
</body></html>


</form>

</body>
</span>
</html>

Page issues event: Render, succeeded: True<br>

 

Google (pink) redirects to Doubleclick's Dartsearch (green) and back to Finish Line (blue)

GET /aclk?sa=l&ai=CHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQ GqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14&num=3&sig=AGiWqtyKvrE5w1uBDoXgXdwztVKzy2YjYw&q=http://clickserve.us2.darts earch.net/link/click%3Flid%3D43000000038525362%26ds_s_kwgid%3D58000000000418174%26ds_e_adid%3D3384004416%26ds_e_m atchtype%3Dsearch%26ds_url_v%3D2 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://cheapstuff.com/result-discount_basketball_shoes.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Cookie: PREF=ID=688fceadd1a664b2:TM=1176179610:LM=1240086191:S=U6jyM2WXkvklaOzU
Connection: Keep-Alive
Host: www.google.com

HTTP/1.1 302 Found
Cache-Control: private
Location: http://www.googleadservices.com/pagead/aclk?sa=L&ai=CHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJHj_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14&num=3&val=ChA2ODhmY2VhZGQxYTY2NGIyEJqn7LAEGgiHY1CpqVFfhiABKAA&sig=AGiWqtxa MzLDuguLohnfK0hFX65LwbxmOA&adurl=http://clickserve.us2.dartsearch.net/link/click%3Flid%3D43000000038525362%26ds_s _kwgid%3D58000000000418174%26ds_e_adid%3D3384004416%26ds_e_matchtype%3Dsearch%26ds_url_v%3D2
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=688fceadd1a664b2:TM=1176179610:LM=1262294147:S=xrS1v-cGpKsxKoVE; expires=Sat, 31-Dec-2011 21:15:47 GMT; path=/; domain=.google.com
Date: Thu, 31 Dec 2009 21:15:47 GMT
Server: AdClickServer
Content-Length: 0
X-XSS-Protection: 0

 

GET /pagead/aclk?sa=L&ai=CHKkPfRQ9S4r6CqT-owTi9_TRAoLVkWyo3734DPWJhwcQAyDorvcBKApQtvK8mfn_____AWDJlu6IhKTsD6ABjJH j_gPIAQGqBCFP0FVm-IcgrLtKfGE_HqFLW5c9ZqRaiJnhLowgadtav14&num=3&val=ChA2ODhmY2VhZGQxYTY2NGIyEJqn7LAEGgiHY1CpqVFfhiABKAA&sig=AGiWqtxa MzLDuguLohnfK0hFX65LwbxmOA&adurl=http://clickserve.us2.dartsearch.net/link/click%3Flid%3D43000000038525362%26ds_s_ kwgid%3D58000000000418174%26ds_e_adid%3D3384004416%26ds_e_matchtype%3Dsearch%26ds_url_v%3D2 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://cheapstuff.com/result-discount_basketball_shoes.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Connection: Keep-Alive
Host: www.googleadservices.com

HTTP/1.1 302 Found
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Set-Cookie: Conversion=CpABQ0hLa1BmUlE5UzRyNkNxVC1vd1RpOV9UUkFvTFZrV3lvMzczNERQV0pod2NRQXlEb3J2Y0JLQXBRdHZLOG1mbl9 fX19fQVdESmx1NkloS1RzRDZBQmpKSGpfZ1BJQVFHcUJDRlAwRlZtLUljZ3JMdEtmR0VfSHFGTFc1YzlacVJhaUpuaExvd2dhZHRhdjE0EhMIwZ6kk syBnwIVqDrlCh33FkWvGAEgpJurrKK44bUbSAE; expires=Sat, 30-Jan-2010 21:15:47 GMT; path=/pagead/conversion/1071171724/
Cache-Control: private
Location: http://clickserve.us2.dartsearch.net/link/click?lid=43000000038525362&ds_s_kwgid=58000000000418174&ds_e_ adid=3384004416&ds_e_matchtype=search&ds_url_v=2&gclid=CMGepJLMgZ8CFag65Qod9xZFrw
Content-Type: text/html; charset=UTF-8
Date: Thu, 31 Dec 2009 21:15:47 GMT
Server: AdClickServer
Content-Length: 0
X-XSS-Protection: 0

 

GET /link/click?lid=43000000038525362&ds_s_kwgid=58000000000418174&ds_e_adid=3384004416&ds_e_matchtype=search&ds_u rl_v=2&gclid=CMGepJLMgZ8CFag65Qod9xZFrw HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://cheapstuff.com/result-discount_basketball_shoes.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.314.0)
Connection: Keep-Alive
Host: clickserve.us2.dartsearch.net

HTTP/1.1 302 Moved Temporarily
Location: http://ad.doubleclick.net/clk;211879141;33352969;n;u=ds&sv1=38525362&sv2=2009123171&sv3=1550240;%3fhttp: //www.finishline.com/store/results/index.jsp?Ntt=basketball+shoe&N=0&Ntk=all&Ntx=mode%2Bmatchallpartial&isSearch=t rue&Ns=P_SalePrice%7C1&sourceid=paidsearch&cid=k70&lid=p38525362&gclid=CMGepJLMgZ8CFag65Qod9xZFrw
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Date: Thu, 31 Dec 2009 21:15:48 GMT
Expires: Thu, 31 Dec 2009 21:15:48 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Content-Length: 398
Server: GFE/2.0

<HTML>
<HEAD>
<TITLE>Moved Temporarily</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>Moved Temporarily</H1>
The document has moved <A HREF="http://ad.doubleclick.net/clk;211879141;33352969;n;u=ds&amp;sv1=38525362&amp;sv2= 2009123171&amp;sv3=1550240;%3fhttp://www.finishline.com/store/results/index.jsp?Ntt=basketball+shoe&amp;N=0&amp;N tk=all&amp;Ntx=mode%2Bmatchallpartial&amp;isSearch=true&amp;Ns=P_SalePrice%7C1&amp;sourceid=paidsearch&amp;cid=k7 0&amp;lid=p38525362&amp;gclid=CMGepJLMgZ8CFag65Qod9xZFrw">here</A>.
</BODY>
</HTML>