Travelocity
money viewers
   Traffic Marketplace    
money viewers
Web Nexus

Web Nexus, Traffic Marketplace Promoting Travelocity in a Full-Screen Pop-Up
Advertising Through Spyware -- After Promising to Stop - Ben Edelman

This page gives a screenshot and packet log reporting Web Nexus promoting Travelocity on February 22, 2007. Additional discussion.

Screenshot

On a PC with Web Nexus installed, I browsed the web. I received the Travelocity ad shown below. This popup filled my entire screen.

Notice the lack of branding on this popup. A user who manages to move the popup upwards will find a "Web Nexus" footer at the ad's bottom edge, but initially this label is substantially off-screen and hence unreadable. In contrast, Travelocity's Assurance of Discontinuances (Travelocity agreement page 4, provision 11.a; PDF page 11) requires that each adware-delivered advertisement be branded with a "prominent" name ori icon. This substantially-off-screen label cannot meet that requirement.

The ad's off-screen labeling is the necessary and foreseeable result of Web Nexus's design parameters. As flagged in purple highlighting in the packet log below, Web Nexus specificaly instructed that the ad window have height of 625 pixels. On any PC running 800x600 resolution, the bottom 25 pixels would appear off-screen. This choice of ad height causes the ad's bottom-edge branding to disappear, and further causes the ad to cover the Start button and taskbar, preventing the user from readily switching to another program or window.

Packet Log

Packet log analysis of the Travelocity popup reveals how it appeared on screen. First, Web Nexus spyware (yellow) sent traffic to Traffic Marketplace (blue). Then Traffic Marketplace selected a Travelocity ad (red). Purple highlighting marks Web Nexus server instructions as to the size of the popup.

GET /cp.php?loc=295&cid=9951709&u=ZWJheS5jb20v&en=&pt=3&app_src=installer&app_run=unknown&crc=EDD26B3DE9E88A2B&cc=US&dp=YnA9Mjc7c3A9ODtjcGM9NTMxOTtjcHI9Mjg7bmJyPTc7Zmg9MTY=&lp=0 HTTP/1.1
Accept: text/*, application/*, */*
QoolShown-Popups: 000
QoolShown-Popups-nt: 000
User-Agent: z_v5.2.7
Host: stech.web-nexus.net
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 22 Feb 2007 06:55:45 GMT
Server: Apache
Accept-Ranges: bytes
X-Powered-By: PHP/4.3.2
Pragma: no-cache
Cache-Control: private
Connection: close
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8

url=http://stech.web-nexus.net/sp.php/9157/715/295/9951709/527/
type=0
show=0
size=0
style=0
height=625
width=808
title=Ampira Media
pid=9157
scroll=0
validity=24
traka_height=18
traka_url=http://stech.web-nexus.net/lm.html
pos=0

GET /sp.php/9157/715/295/9951709/527/ HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ZangoToolbar 4.8.3)
Host: stech.web-nexus.net
Connection: Keep-Alive

HTTP/1.1 302 Found
Date: Thu, 22 Feb 2007 06:55:47 GMT
Server: Apache
Accept-Ranges: bytes
X-Powered-By: PHP/4.3.2
Pragma: no-cache
Cache-Control: private
Location: http://t.trafficmp.com/b.t/e48U/1172127347
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET /b.t/e48U/1172127348 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ZangoToolbar 4.8.3)
Host: t.trafficmp.com
Connection: Keep-Alive

HTTP/1.1 302 Object moved
Server: TrafficMarketPlace-JForce/3.4.3.2
Expires: Tues, 1 Jan 2002 01:00:00 GMT
Pragma: no-cache
Connection: close
P3P: CP="NID PSD OUR STP STA NOI"
Cache-Control: private, no-cache="Set-Cookie"
Content-Type: text/html
Location: http://cache.trafficmp.com/tmpad/content/clickhere/travelocity/0107/contextual720_v2.html
Content-Length: 208
Set-Cookie: u=A037D4900357D015; expires=Fri, 22-Feb-2008 07:17:46 GMT; path=/; domain=.trafficmp .com
Set-Cookie: ctime=3756977; expires=Fri, 22-Feb-2008 07:17:46 GMT; path=/; domain=.trafficmp .com
Set-Cookie: loc=chksum=-956248402; expires=Wed, 28-Feb-2007 07:17:46 GMT; path=/; domain=.trafficmp .com
Set-Cookie: TMPFreqCap=AS4876=3756977; expires=Sun, 25-Mar-2007 07:17:46 GMT; path=/; domain=.trafficmp .com
Set-Cookie: TMPCrByAS=AS4876=32669; expires=Sun, 25-Mar-2007 07:17:46 GMT; path=/; domain=.trafficmp .com
Set-Cookie: TMPPOByAS=AS4876=5799; expires=Sun, 25-Mar-2007 07:17:46 GMT; path=/; domain=.trafficmp .com
Set-Cookie: POVisit=&2609=,5799,; expires=Sun, 25-Mar-2007 07:17:46 GMT; path=/; domain=.trafficmp .com

<head><title>Object moved</title></head><body><h1>Object Moved</h1>This object may be found <a HREF="http://cache.trafficmp.com/tmpad/content/clickhere/travelocity/0107/contextual720_v2.html">here</a>.</body>