This page gives a screenshot and packet log reporting a Look2me/Ad-w-a-r-e ad display on May 7, 2006. Additional discussion.
Screenshots
On a massively infected test PC, I attempted to view the Google.com. I received a series of pop-ups, ultimately including the image shown below.
This screenshot has been modified to cover sexually-explicit areas and to reconstruct screen portions damaged by video compression.
Packet Log
Packet log analysis indicates that the popup shown above was served in the way set out in the diagram at top-right. First, Look2me sought an ad from its controlling server, Ad-w-a-r-e.com (yellow). Look2me selected this ad based on minimal targeting, noting only that I was then browsing (or requesting to browse) Google (light yellow). The Ad-w-a-r-e controlling server specified an ad at intern-etadvertising.com (light green), a standard Look2me ad farm which shows untargeted (run-of-network) ads. Intern-etadvertising specified that the ad was to come from Firstadsolution.com (dark green), which in turn sent me to YieldManager (blue), which specified that the ad was actually at Falkag.net (pink) (part of DoubleClick). Falk AG in turn sent me on to Instantnavigation.com (eXact Advertising) (grey). Instantnavigation sent me to the 207.97.227.29 server (also eXact Advertising) (grey), which then sent me to MyGeek (orange), which finally passed me to Naughtyplay (red), the sexually-explicit web site shown to me.
POST /cgi-bin/UMonitorV2 HTTP/1.0
Host: www.ad-w-a-r-e.com
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Referer:
Connection: close
Content-Length: 68
Content-Type: application/x-www-form-urlencoded
<HTML>
<BODY style="margin-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px;" onUnload="window.open('http://64.194.221.33/cgi-bin/7upV2?query=ron');">
<!-- Tag for size prepopped for site NT - MB-U Direct: Run-of-site - DO NOT MODIFY -->
<SCRIPT TYPE="text/javascript" SRC="http://ad.firstadsolution.com/rmtag2.js"></SCRIPT>
<SCRIPT language="JavaScript">
var rm_host = "http://ad.firstadsolution.com";
var rm_section_id = 3926;
var rm_banned_pop_types = 23;
var rm_pop_frequency = 0;
rmShowPop();
</SCRIPT>
</BODY>
</HTML>
<!-- END TAG -->
GET /imp?z=0&s=3926&u=http%3A%2F%2Fwww.intern-etadvertising.com%2Fmuon.html&r=1&y=23 HTTP/1.1
Accept: */*
Referer: http://www.intern-etadvertising.com/muon.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; {B67536BD-C7AB-E94F-9C19-...})
Host: ad.firstadsolution.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Connection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: http://ad.yieldmanager.com/imp?z=0&s=3926&u=http%3A%2F%2Fwww.intern-etadvertising.com%2Fmuon.html&r=1&y=23
Cache-Control: no-store
Content-Length: 0
GET /imp?z=0&s=3926&u=http%3A%2F%2Fwww.buyer-shabit.com%2Fmuon.html&r=1&y=23 HTTP/1.1
Accept: */*
Referer: http://www.buyer-shabit.com/muon.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; {B67536BD-C7AB-E94F-9C19-...})
Cookie: ...
Connection: Keep-Alive
Host: ad.yieldmanager.com
HTTP/1.1 200 Ok
Connection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: application/x-javascript
Cache-Control: no-store
Content-Length: 680
HTTP/1.1 302 Found
Connection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: http://ad.yieldmanager.com/iframe3?AAAAAFYPAAAJTQEAi4EAAAA AAAAAAP8AAP8BGAEIAAPcvwAAkU0AAP.EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKRwPQr Xo.E.pHA9Ctej8T8zMzMzMzP5PzMzMzMzM.k.AAAAAAAAAkAAAAAAAAACQAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAt4XqdsGbpwCfXdF8tMJ0Rt4NqCAJcYXNBk6 qtgAAAAA=,
Cache-Control: no-store
Content-Length: 0
HTTP/1.1 200 Ok
Connection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type: text/html
Set-Cookie: ...
Cache-Control: no-store
Content-Length: 928
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://xmlsearch.mygeek.com/presults.jsp?partnerid=110126&vendorId= 500830&type=2&code=9040720&rate=604362362&cr=604906906&domain=www.naughtyplay.com&a mp;query=1147057995873%3A%3A...%3A%3Aheather+hunter&rnk=1&url=http%3A%2F%2Fwww.naughtyplay.com% 2Fpornstars%2Fheatherhunter%2Findex.html">here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.27 Server at www.instantnavigation.com Port 80</ADDRESS>
</BODY></HTML>
HTTP/1.1 302 Found
Date: Mon, 08 May 2006 03:13:21 GMT
Server: Apache/1.3.12 (Unix)
P3P: CP="IDC DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV INT STA"
Set-Cookie: ...
Location: http://www.naughtyplay.com/pornstars/heatherhunter/index.html
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://www.naughtyplay.com/pornstars/heatherhunter/index.html">here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.12 Server at xmlsearch.mygeek.com Port 80</ADDRESS>
</BODY></HTML>
viewers