Web Nexus, Mediatraffic, Ccg360, and LinkShare Claiming Commissions on Netflix's Organic Traffic

Web Nexus, Mediatraffic, Ccg360, and LinkShare Claiming Commissions on Netflix's Organic Traffic
Spyware Still Cheating Merchants and Legitimate Affiliates - Ben Edelman

This page gives a screenshot and packet log showing how Web Nexus, Mediatraffic, Ccg360, and LinkShare claim commissions on Netflix's organic traffic. Testing occurred on May 12, 2007. Additional discussion.

Screenshot

On a PC with Web Nexus spyware installed, my automated testing system browsed the Netflix site. It received the popup shown in the foreground -- a duplicate copy of the Netflix site. The original Netflix window remains loaded, visible in the background.

Packet Log

The packet log below shows the series of redirects that caused this pop-up to appear. Traffic flowed from Web Nexus (yellow) to Integrated Search Technologies' Mediatraffic (green) to Ccg360 (blue) to LinkShare (red) and on to Netflix (purple).

GET /cp.php?loc=295&cid=9951709&u=...&en=google.com&pt=3&app_src=installer&app_run=unknown&crc=EDD26B3DE9E88A2B&cc=US&dp=...==&lp=0 HTTP/1.1
Accept: text/*, application/*, */*
QoolShown-Popups: 000
QoolShown-Popups-nt: 000
User-Agent: z_v5.2.7
Host: stech.web-nexus.net
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 12 May 2007 17:32:57 GMT
Server: Apache
Accept-Ranges: bytes
X-Powered-By: PHP/4.3.2
Pragma: no-cache
Cache-Control: private
Connection: close
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8

url=http://stech.web-nexus.net/mtraff.php/9951709/295/527/bmV0ZmxpeA==/.../7409/
type=0
show=0
size=0
style=0
height=608
width=808
title=
pid=7409
scroll=0
validity=24
traka_height=18
traka_url=http://stech.web-nexus.net/lm.html
pos=0

GET /mtraff.php/9951709/295/527/bmV0ZmxpeA==/.../7409/ HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: stech.web-nexus.net
Connection: Keep-Alive

HTTP/1.1 302 Found
Date: Sat, 12 May 2007 17:32:59 GMT
Server: Apache
Accept-Ranges: bytes
X-Powered-By: PHP/4.3.2
Location: http://cpvfeed.mediatraffic.com/feed.php?ac=1239&kw=netflix&ip=...&url=%2Fsearch%3Fsourceid%3Dnavclient%26ie%3DUTF-8%26rls%3DGGLJ%2CGGLJ%3A2006-07%2CGGLJ%3Aen%26q%3Dnetflix&def=http%3A%2F%2Fstech.web-nexus.net%2Fron.php%3Floc%3D309
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET /feed.php?ac=1239&kw=netflix&ip=...&url=%2Fsearch%3Fsourceid%3Dnavclient%26ie%3DUTF-8%26rls%3DGGLJ%2CGGLJ%3A2006-07%2CGGLJ%3Aen%26q%3Dnetflix&def=http%3A%2F%2Fstech.web-nexus.net%2Fron.php%3Floc%3D309 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: cpvfeed.mediatraffic.com
Connection: Keep-Alive

HTTP/1.1 302 Found
Date: Sat, 12 May 2007 17:33:04 GMT
Server: Apache/1.3.34 (Unix) PHP/5.0.5
X-Powered-By: PHP/5.0.5
Location: http://cpvfeed.mediatraffic.com/redir.php?ac=1239&sac=&dat=160e203be5ecc162fb7375fb361700b3&cpv=0.02390&url_pop=http%253A%252F%252Fnetflix.med.ccg360.com&ctl=Jq%2BXR3uuOkViBQ%3D%3D&def=http%3A%2F%2Fstech.web-nexus.net%2Fron.php%3Floc%3D309&kw=netflix&rqu1=%2F&rqu2=search%3Fsourceid%3Dnavclient%26ie%3DUTF-8%26rls%3DGGLJ%2CGGLJ%3A2006-07%2CGGLJ%3Aen%26q%3Dnetflix
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: netflix.med.ccg360.com
Connection: Keep-Alive

HTTP/1.1 302 Found
Date: Sat, 12 May 2007 17:33:05 GMT
Server: Apache/1.3.33 (Unix)
Location: http://click.linksynergy.com/fs-bin/click?id=kic1Ixnq*SQ&offerid=78684.10000177&type=3&subid=0
Keep-Alive: timeout=2, max=199
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://click.linksynergy.com/fs-bin/click?id=kic1Ixnq*SQ&offerid=78684.10000177&type=3&subid=0">here</A>.<P>
</BODY></HTML>

GET /fs-bin/click?id=kic1Ixnq*SQ&offerid=78684.10000177&type=3&subid=0 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: click.linksynergy.com
Connection: Keep-Alive

HTTP/1.1 302 Found
Server: WebSphere Application Server/5.1
Content-Type: text/html; charset=ISO-8859-1
Set-Cookie: ...
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR NID DEV ADM CUR OUR BUS LEG NAV"
Set-Cookie: ...
Date: Sat, 12 May 2007 17:33:05 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Pragma: no-cache
Location: http://www.netflix.com/Signup?mqso=60187019&ls_sourceid=kic1Ixnq.SQ-D0PvKYRm4eaTqxxbTZHJoA
Content-Language: en-US
Content-Length: 0