viewers viewers viewers viewersHula's Global-store.net Sending Traffic to Vonage
Banner Farms in the Crosshairs - Ben Edelman
This page gives a packet log of example traffic passing from Hula's Global-Store to YieldManager to Traffic Marketplace to aQuantive's Atlas DMT to Vonage, as shown in the diagram at right. All testing occurred on June 10, 2006. See also a screenshot of the resulting on-screen window.
In each step of transmissions, yellow highlighting marks redirect instructions, green highlighting marks the next redirect step, and pink highlighting marks the names of the parties involved.
In each step of transmissions, traffic includes HTTP Referer headers (blue highlighting), reporting that this traffic originated at Inqwire (another Hula site). While traffic actually originated at Global-Store, a different Hula site, the presence of Inqwire headers could have alerted the intermediary ad networks that this traffic merited additional investigation.
Note also reload code (grey highlighting), set to reload the ad after 25 seconds (25,000 milliseconds) -- causing a new ad to be shown, and a new advertiser to be charged for an ad display.
Hula's Global-Store Embeds YieldManager Ad Frame
GET /Ad720x300.asp?flc=5&fld=26&st=6755&sc=956 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://global-store.net/index_tiny.asp?st=6755&sc=956&lc=60&ld=20&sf=1&flc=5&fld=26&sp=0&fd=5
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; {B67536BD-C7AB-E94F-9C19-E97F6E985912})
Host: www.inqwire.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Connection: close
Date: Sat, 10 Jun 2006 20:27:25 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html
Cache-control: private
Transfer-Encoding: chunked
<html>
<head>
<meta http-equiv="Page-Enter" content="blendTrans(Duration=1)">
<META HTTP-EQUIV="refresh" content="27;URL=http://www.inqwire.com/Ad720x300.asp?flc=4&fld=26&st=6755&sc=956&cb=">
<SCRIPT language="JavaScript">
function ReloadFunction(){
document.location.href = 'http://www.inqwire.com/Ad720x300.asp?flc=4&fld=26&st=6755&sc=956&cb=17008.6085796356';
}
</SCRIPT>
</head>
<body
onload="window.setTimeout('ReloadFunction()',
25000);">
<SCRIPT TYPE="text/javascript" SRC="http://ad.yieldmanager.com/imp?z=0&i=6755&S=956&r=1&y=23&w=720&h=300"></SCRIPT>
</body>
</html>
YieldManager Passes Traffic to Traffic Marketplace
GET /imp?z=0&i=6755&S=956&r=1&y=23&w=720&h=300 HTTP/1.1
Accept: */*
Referer: http://www.inqwire.com/Ad720x300.asp?flc=5&fld=26&st=6755&sc=956
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; {B67536BD-C7AB-E94F-9C19-E97F6E985912})
Host: ad.yieldmanager.com
Connection: Keep-Alive
Cookie: ...
HTTP/1.1 200 Ok
Connection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: application/x-javascript
Set-Cookie: ...
Cache-Control: no-store
Content-Length: 273
document.write('<iframe scrolling="no" marginwidth="0" marginheight="0" frameborder="0" height="300" width="720" src="http://t.trafficmp.com/b.t/eMMt/11"></iframe>');
var rm_data = new Object();
rm_data.creative_id = 8471;
rm_data.offer_type = 3;
rm_data.entity_id = 5955;
Traffic Marketplace Passes Traffic to aQuantive's Atlas DMT
GET /b.t/eMMt/11 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://www.inqwire.com/Ad720x300.asp?flc=5&fld=26&st=6755&sc=956
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; {B67536BD-C7AB-E94F-9C19-E97F6E985912})
Host: t.trafficmp.com
Connection: Keep-Alive
HTTP/1.1 302 Object moved
Server: TrafficMarketPlace-JForce/3.4.3.0
Expires: Tues, 1 Jan 2002 01:00:00 GMT
Pragma: no-cache
Connection: close
P3P: CP="NID PSD OUR STP STA NOI"
Cache-Control: private, no-cache="Set-Cookie"
Content-Type: text/html
Location: http://clk.atdmt.com/VON/go/trffevon0740000126von/direct/01/
Content-Length: 179
Set-Cookie: ...
<head><title>Object moved</title></head><body><h1>Object Moved</h1>This object may be found <a HREF="http://clk.atdmt.com/VON/go/trffevon0740000126von/direct/01/">here</a>.</body>
aQuantive's atlas DMT Passes Traffic to Vonage
GET /VON/go/trffevon0740000126von/direct/01/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://www.inqwire.com/Ad720x300.asp?flc=5&fld=26&st=6755&sc=956
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; {B67536BD-C7AB-E94F-9C19-E97F6E985912})
Connection: Keep-Alive
Host: clk.atdmt.com
HTTP/1.1 302 Object moved
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 0
Expires: 0
Location: http://www.vonage.com/startsavingnow
Server: Microsoft-IIS/6.0
P3P: CP="DSP COR NOI PSAo PSDo CUR ADMa DEVa OUR BUS UNI NAV INT COM STA PUR DEM PRE HEA FIN OTC POL"
Set-Cookie: AA002=001149971257-53360150/1151180857; expires=Thursday, 09-Jun-2011 00:00:00 GMT; path=/; domain=.atdmt.com
Connection: close
Date: Sat, 10 Jun 2006 20:27:37 GMT