What the fuck is up with sales

**Shoehorn!** · 05-08-2007, 05:00 PM

Originally posted by StarkReality

Good point, but there are too many strange coincidents at once I think...I've never seen a slowdown like this hit THAT many webmasters at once, and it's heavier than anything I've seen before.

Example: One program I advertise for years now is doing 1:500-1:1000, always, ever, since I started advertising them. No signup for the last 16000 hits...it makes me think.

It's still in the "could be bad luck" range, but too many people have bad luck lately, can't be technical issues only.

True, I am pretty confident that it has a lot to do with the problems between several major hubs though. Its not scrubbing and it for sure isn't shaving, and I find it very hard to believe that all of the sudden people have collectively just decided to not buy memberships for the last few days.

**Dennis69** · 05-08-2007, 05:03 PM

Yeah these last few weeks have been brutal on sales... both with my own paysites and others as well!

**jonesy** · 05-08-2007, 05:26 PM

Originally posted by Chio

you fruit!

takes one to know one!

neil p is god!

**Lee** · 05-08-2007, 05:29 PM

Today isnt great but the month is ok overall.

**KrisKross** · 05-08-2007, 05:46 PM

My total for yesterday is amongst my top ten. And my sales for the last 6-8 weeks have been better than ever.

**Quickdraw** · 05-08-2007, 05:57 PM

Here is what I get when trying to get to your sites via Google on a machine infected with a variant of the zlob video codec trojan.
From first click these redirects happen instantly. I was on your site for a minute, but never saw it in the browser, just the logs.
The clicks to your sites end up being redirected to various PPC landing pages, and if a 'bidded' search term, it will redirect to the top bidders URL for the PPC engine that is used for the current redirect.

If I backup and click your link again, the process continues, and eventually I might make it to your site, if persistent enough. Even then, after so many redirects and unknowns happening with an infected computer, I'd think twice before entering any credit card numbers.

Code:

GET http://www.google.com/search?hl=en&q=baileysroom&btnG=Google+Search
200 OK

GET http://85.255.119.189/frame.php
200 OK
###Click to Baileysroom starts here#######
GET http://toolbarqueries.google.com/search?client=navclient-auto&googleip=P;;16343&freshness_check=4sopIA_HzsvQtnBIm2IUV&iqrn=3hjD&orig=0w4En&ie=UTF-8&oe=UTF-8&querytime=oF&features=Rank:&q=info:http&#37;3a%2f%2fwww%2egoogle%2ecom%2fsearch%3fhl%3den%26q%3dbaileysroom%26btnG%3dGoogle%2bSearch&ch=771875666563
200 OK

GET http://www.google.com/url?sa=T&ct=res&cd=1&url=http%3A%2F%2Fwww.baileysroom.com%2F&ei=nR1BRrf0AovehAPjlaTADg
204 No Content

GET http://www.baileysroom.com/
200 OK

GET http://85.255.119.189/click.php?PHPSESSID=B043EDE50C4D4AACA85F6083F8EFF1CF&qq=24b610d24064303b0cb207bffed0ea9d&id=1&qnaes={B043EDE5-0C4D-4AAC-A85F-6083F8EFF1CF}
302 Found to http://64.111.208.122/click.php?c=1d9d414643820203af04&r=1&d=B043EDE50C4D4AACA85F6083F8EFF1CF

GET http://64.111.208.122/click.php?c=1d9d414643820203af04&r=1&d=B043EDE50C4D4AACA85F6083F8EFF1CF
302 Found to /dclick.php?c=52f4cae100610326e46b&r=1

GET http://64.111.208.122/dclick.php?c=52f4cae100610326e46b&r=1
302 Found to http://66.250.74.152/click.php?go=aHR0cDovL3VzMDEueG1sc2VhcmNoLmZpbmR3aGF0LmNvbS9iaW4vZmluZHdoYXQuZGxsP2NsaWNrdGhyb3VnaCZ5PTUwMjAxJng9VDRkM2xvaVdWdGs3SnQ3a1BVbVE6VkZPNkxteFZyOVZ6UDtieFZkb1N3ZzVsTVBSNWtVTTc7c3lWMWt6NllrRDJvS2xKNFlVVkxkRztnc0tUUlY3VFU4Ujo7aUR0a0tFSlZ5QTQ7TDJsWUw6QmY3TTNHZHlsU1FCbGtkOUJ0b1NKdG9lO3ppaHlVa0ozemlYU2dvMDprUzVhO21QVlJrVTdqUzU1dDg2YUxGZTROZ0pKWVNjVlY5aHgxczJ5TWRSZGZQRDt0aUc6ejU6eGVpUWhQT087ViRWUQ==&b=MC4wNDE=&aff=1936&subaff=1615&time=1178672541&searcher_ip=24.119.49.119&cnt=21843&qq=baileysroom&mode=&seid=ezgbicYy13M1Tpbn/Xi0x7m32UsK9RDcmeE8SQ67&se=ZmluZHdoYXQ=&sid=17&pos=1

GET http://66.250.74.152/click.php?go=aHR0cDovL3VzMDEueG1sc2VhcmNoLmZpbmR3aGF0LmNvbS9iaW4vZmluZHdoYXQuZGxsP2NsaWNrdGhyb3VnaCZ5PTUwMjAxJng9VDRkM2xvaVdWdGs3SnQ3a1BVbVE6VkZPNkxteFZyOVZ6UDtieFZkb1N3ZzVsTVBSNWtVTTc7c3lWMWt6NllrRDJvS2xKNFlVVkxkRztnc0tUUlY3VFU4Ujo7aUR0a0tFSlZ5QTQ7TDJsWUw6QmY3TTNHZHlsU1FCbGtkOUJ0b1NKdG9lO3ppaHlVa0ozemlYU2dvMDprUzVhO21QVlJrVTdqUzU1dDg2YUxGZTROZ0pKWVNjVlY5aHgxczJ5TWRSZGZQRDt0aUc6ejU6eGVpUWhQT087ViRWUQ==&b=MC4wNDE=&aff=1936&subaff=1615&time=1178672541&searcher_ip=24.119.49.119&cnt=21843&qq=baileysroom&mode=&seid=ezgbicYy13M1Tpbn/Xi0x7m32UsK9RDcmeE8SQ67&se=ZmluZHdoYXQ=&sid=17&pos=1
302 Found to http://66.250.74.152/click_second_new3.php?go=aHR0cDovL3VzMDEueG1sc2VhcmNoLmZpbmR3aGF0LmNvbS9iaW4vZmluZHdoYXQuZGxsP2NsaWNrdGhyb3VnaCZ5PTUwMjAxJng9VDRkM2xvaVdWdGs3SnQ3a1BVbVE6VkZPNkxteFZyOVZ6UDtieFZkb1N3ZzVsTVBSNWtVTTc7c3lWMWt6NllrRDJvS2xKNFlVVkxkRztnc0tUUlY3VFU4Ujo7aUR0a0tFSlZ5QTQ7TDJsWUw6QmY3TTNHZHlsU1FCbGtkOUJ0b1NKdG9lO3ppaHlVa0ozemlYU2dvMDprUzVhO21QVlJrVTdqUzU1dDg2YUxGZTROZ0pKWVNjVlY5aHgxczJ5TWRSZGZQRDt0aUc6ejU6eGVpUWhQT087ViRWUQ==&b=MC4wNDE=&aff=1936&subaff=1615&time=1178672541&searcher_ip=24.119.49.119&cnt=21843&qq=baileysroom&mode=&seid=ezgbicYy13M1Tpbn/Xi0x7m32UsK9RDcmeE8SQ67&se=ZmluZHdoYXQ=&sid=17&pos=1&country=US

GET http://66.250.74.152/click_second_new3.php?go=aHR0cDovL3VzMDEueG1sc2VhcmNoLmZpbmR3aGF0LmNvbS9iaW4vZmluZHdoYXQuZGxsP2NsaWNrdGhyb3VnaCZ5PTUwMjAxJng9VDRkM2xvaVdWdGs3SnQ3a1BVbVE6VkZPNkxteFZyOVZ6UDtieFZkb1N3ZzVsTVBSNWtVTTc7c3lWMWt6NllrRDJvS2xKNFlVVkxkRztnc0tUUlY3VFU4Ujo7aUR0a0tFSlZ5QTQ7TDJsWUw6QmY3TTNHZHlsU1FCbGtkOUJ0b1NKdG9lO3ppaHlVa0ozemlYU2dvMDprUzVhO21QVlJrVTdqUzU1dDg2YUxGZTROZ0pKWVNjVlY5aHgxczJ5TWRSZGZQRDt0aUc6ejU6eGVpUWhQT087ViRWUQ==&b=MC4wNDE=&aff=1936&subaff=1615&time=1178672541&searcher_ip=24.119.49.119&cnt=21843&qq=baileysroom&mode=&seid=ezgbicYy13M1Tpbn/Xi0x7m32UsK9RDcmeE8SQ67&se=ZmluZHdoYXQ=&sid=17&pos=1&country=US
302 Found to http://us01.xmlsearch.findwhat.com/bin/findwhat.dll?clickthrough&y=50201&x=T4d3loiWVtk7Jt7kPUmQ:VFO6LmxVr9VzP;bxVdoSwg5lMPR5kUM7;syV1kz6YkD2oKlJ4YUVLdG;gsKTRV7TU8R:;iDtkKEJVyA4;L2lYL:Bf7M3GdylSQBlkd9BtoSJtoe;zihyUkJ3ziXSgo0:kS5a;mPVRkU7jS55t86aLFe4NgJJYScVV9hx1s2yMdRdfPD;tiG:z5:xeiQhPOO;V$VQ

GET http://us01.xmlsearch.findwhat.com/bin/findwhat.dll?clickthrough&y=50201&x=T4d3loiWVtk7Jt7kPUmQ:VFO6LmxVr9VzP;bxVdoSwg5lMPR5kUM7;syV1kz6YkD2oKlJ4YUVLdG;gsKTRV7TU8R:;iDtkKEJVyA4;L2lYL:Bf7M3GdylSQBlkd9BtoSJtoe;zihyUkJ3ziXSgo0:kS5a;mPVRkU7jS55t86aLFe4NgJJYScVV9hx1s2yMdRdfPD;tiG:z5:xeiQhPOO;V$VQ
302 Found to http://us01.xmlsearch.findwhat.com/bin/findwhat.dll?clickthrough&y=50201&x=;WkCN2779Z:Uw6;R1G0xomUpzc0F9:fbBAZiyAkWhdJ:N3asug66ZsYH9b:3zC:4K21nXaxLZckd;gY0WYWU;sHsos745F1rwAT9rsdfNcdQ12;6iykHNwVeigkh6ZbJXZbGWZ7OVG:ci67BVFbAoFK:ws0lZL:LZJK:7ZHMXcUGrKJcXcKoZAfOzbYfV3ks72a4;Z7do6RQ4V7xsAeproZfh6Hl0&c=B69F4D94%2D7247%2D4D89%2DBB68%2DFFF6A4F15634

GET http://us01.xmlsearch.findwhat.com/bin/findwhat.dll?clickthrough&y=50201&x=;WkCN2779Z:Uw6;R1G0xomUpzc0F9:fbBAZiyAkWhdJ:N3asug66ZsYH9b:3zC:4K21nXaxLZckd;gY0WYWU;sHsos745F1rwAT9rsdfNcdQ12;6iykHNwVeigkh6ZbJXZbGWZ7OVG:ci67BVFbAoFK:ws0lZL:LZJK:7ZHMXcUGrKJcXcKoZAfOzbYfV3ks72a4;Z7do6RQ4V7xsAeproZfh6Hl0&c=B69F4D94%2D7247%2D4D89%2DBB68%2DFFF6A4F15634
302 Found to http://upspiral.us/index.php?tpid=10359&tspid=0&ttid=100&st=baileysroom

GET http://upspiral.us/index.php?tpid=10359&tspid=0&ttid=100&st=baileysroom
200 OK

GET http://www.upspiral.us/index.php?tpid=11115&tspid=0&ttid=100&st=baileysroom&bmst=&rdf=1&sid=10070508205834122959
200 OK

**madawgz** · 05-08-2007, 06:17 PM

bump because sales are still horrible

**RawAlex** · 05-08-2007, 06:20 PM

Bad conversions, or bad traffic levels? Are you down on hits, down on join page visits, or just down on conversions?

**Shoehorn!** · 05-08-2007, 06:21 PM

Originally posted by Quickdraw

Here is what I get when trying to get to your sites via Google on a machine infected with a variant of the zlob video codec trojan.
From first click these redirects happen instantly. I was on your site for a minute, but never saw it in the browser, just the logs.
The clicks to your sites end up being redirected to various PPC landing pages, and if a 'bidded' search term, it will redirect to the top bidders URL for the PPC engine that is used for the current redirect.

If I backup and click your link again, the process continues, and eventually I might make it to your site, if persistent enough. Even then, after so many redirects and unknowns happening with an infected computer, I'd think twice before entering any credit card numbers.

Code:

GET http://www.google.com/search?hl=en&q=baileysroom&btnG=Google+Search
200 OK

GET http://85.255.119.189/frame.php
200 OK
###Click to Baileysroom starts here#######
GET http://toolbarqueries.google.com/search?client=navclient-auto&googleip=P;;16343&freshness_check=4sopIA_HzsvQtnBIm2IUV&iqrn=3hjD&orig=0w4En&ie=UTF-8&oe=UTF-8&querytime=oF&features=Rank:&q=info:http%3a%2f%2fwww%2egoogle%2ecom%2fsearch%3fhl%3den%26q%3dbaileysroom%26btnG%3dGoogle%2bSearch&ch=771875666563
200 OK

GET http://www.google.com/url?sa=T&ct=res&cd=1&url=http%3A%2F%2Fwww.baileysroom.com%2F&ei=nR1BRrf0AovehAPjlaTADg
204 No Content

GET http://www.baileysroom.com/
200 OK

GET http://85.255.119.189/click.php?PHPSESSID=B043EDE50C4D4AACA85F6083F8EFF1CF&qq=24b610d24064303b0cb207bffed0ea9d&id=1&qnaes={B043EDE5-0C4D-4AAC-A85F-6083F8EFF1CF}
302 Found to http://64.111.208.122/click.php?c=1d9d414643820203af04&r=1&d=B043EDE50C4D4AACA85F6083F8EFF1CF

GET http://64.111.208.122/click.php?c=1d9d414643820203af04&r=1&d=B043EDE50C4D4AACA85F6083F8EFF1CF
302 Found to /dclick.php?c=52f4cae100610326e46b&r=1

GET http://64.111.208.122/dclick.php?c=52f4cae100610326e46b&r=1
302 Found to http://66.250.74.152/click.php?go=aHR0cDovL3VzMDEueG1sc2VhcmNoLmZpbmR3aGF0LmNvbS9iaW4vZmluZHdoYXQuZGxsP2NsaWNrdGhyb3VnaCZ5PTUwMjAxJng9VDRkM2xvaVdWdGs3SnQ3a1BVbVE6VkZPNkxteFZyOVZ6UDtieFZkb1N3ZzVsTVBSNWtVTTc7c3lWMWt6NllrRDJvS2xKNFlVVkxkRztnc0tUUlY3VFU4Ujo7aUR0a0tFSlZ5QTQ7TDJsWUw6QmY3TTNHZHlsU1FCbGtkOUJ0b1NKdG9lO3ppaHlVa0ozemlYU2dvMDprUzVhO21QVlJrVTdqUzU1dDg2YUxGZTROZ0pKWVNjVlY5aHgxczJ5TWRSZGZQRDt0aUc6ejU6eGVpUWhQT087ViRWUQ==&b=MC4wNDE=&aff=1936&subaff=1615&time=1178672541&searcher_ip=24.119.49.119&cnt=21843&qq=baileysroom&mode=&seid=ezgbicYy13M1Tpbn/Xi0x7m32UsK9RDcmeE8SQ67&se=ZmluZHdoYXQ=&sid=17&pos=1

GET http://66.250.74.152/click.php?go=aHR0cDovL3VzMDEueG1sc2VhcmNoLmZpbmR3aGF0LmNvbS9iaW4vZmluZHdoYXQuZGxsP2NsaWNrdGhyb3VnaCZ5PTUwMjAxJng9VDRkM2xvaVdWdGs3SnQ3a1BVbVE6VkZPNkxteFZyOVZ6UDtieFZkb1N3ZzVsTVBSNWtVTTc7c3lWMWt6NllrRDJvS2xKNFlVVkxkRztnc0tUUlY3VFU4Ujo7aUR0a0tFSlZ5QTQ7TDJsWUw6QmY3TTNHZHlsU1FCbGtkOUJ0b1NKdG9lO3ppaHlVa0ozemlYU2dvMDprUzVhO21QVlJrVTdqUzU1dDg2YUxGZTROZ0pKWVNjVlY5aHgxczJ5TWRSZGZQRDt0aUc6ejU6eGVpUWhQT087ViRWUQ==&b=MC4wNDE=&aff=1936&subaff=1615&time=1178672541&searcher_ip=24.119.49.119&cnt=21843&qq=baileysroom&mode=&seid=ezgbicYy13M1Tpbn/Xi0x7m32UsK9RDcmeE8SQ67&se=ZmluZHdoYXQ=&sid=17&pos=1
302 Found to http://66.250.74.152/click_second_new3.php?go=aHR0cDovL3VzMDEueG1sc2VhcmNoLmZpbmR3aGF0LmNvbS9iaW4vZmluZHdoYXQuZGxsP2NsaWNrdGhyb3VnaCZ5PTUwMjAxJng9VDRkM2xvaVdWdGs3SnQ3a1BVbVE6VkZPNkxteFZyOVZ6UDtieFZkb1N3ZzVsTVBSNWtVTTc7c3lWMWt6NllrRDJvS2xKNFlVVkxkRztnc0tUUlY3VFU4Ujo7aUR0a0tFSlZ5QTQ7TDJsWUw6QmY3TTNHZHlsU1FCbGtkOUJ0b1NKdG9lO3ppaHlVa0ozemlYU2dvMDprUzVhO21QVlJrVTdqUzU1dDg2YUxGZTROZ0pKWVNjVlY5aHgxczJ5TWRSZGZQRDt0aUc6ejU6eGVpUWhQT087ViRWUQ==&b=MC4wNDE=&aff=1936&subaff=1615&time=1178672541&searcher_ip=24.119.49.119&cnt=21843&qq=baileysroom&mode=&seid=ezgbicYy13M1Tpbn/Xi0x7m32UsK9RDcmeE8SQ67&se=ZmluZHdoYXQ=&sid=17&pos=1&country=US

GET http://66.250.74.152/click_second_new3.php?go=aHR0cDovL3VzMDEueG1sc2VhcmNoLmZpbmR3aGF0LmNvbS9iaW4vZmluZHdoYXQuZGxsP2NsaWNrdGhyb3VnaCZ5PTUwMjAxJng9VDRkM2xvaVdWdGs3SnQ3a1BVbVE6VkZPNkxteFZyOVZ6UDtieFZkb1N3ZzVsTVBSNWtVTTc7c3lWMWt6NllrRDJvS2xKNFlVVkxkRztnc0tUUlY3VFU4Ujo7aUR0a0tFSlZ5QTQ7TDJsWUw6QmY3TTNHZHlsU1FCbGtkOUJ0b1NKdG9lO3ppaHlVa0ozemlYU2dvMDprUzVhO21QVlJrVTdqUzU1dDg2YUxGZTROZ0pKWVNjVlY5aHgxczJ5TWRSZGZQRDt0aUc6ejU6eGVpUWhQT087ViRWUQ==&b=MC4wNDE=&aff=1936&subaff=1615&time=1178672541&searcher_ip=24.119.49.119&cnt=21843&qq=baileysroom&mode=&seid=ezgbicYy13M1Tpbn/Xi0x7m32UsK9RDcmeE8SQ67&se=ZmluZHdoYXQ=&sid=17&pos=1&country=US
302 Found to http://us01.xmlsearch.findwhat.com/bin/findwhat.dll?clickthrough&y=50201&x=T4d3loiWVtk7Jt7kPUmQ:VFO6LmxVr9VzP;bxVdoSwg5lMPR5kUM7;syV1kz6YkD2oKlJ4YUVLdG;gsKTRV7TU8R:;iDtkKEJVyA4;L2lYL:Bf7M3GdylSQBlkd9BtoSJtoe;zihyUkJ3ziXSgo0:kS5a;mPVRkU7jS55t86aLFe4NgJJYScVV9hx1s2yMdRdfPD;tiG:z5:xeiQhPOO;V$VQ

GET http://us01.xmlsearch.findwhat.com/bin/findwhat.dll?clickthrough&y=50201&x=T4d3loiWVtk7Jt7kPUmQ:VFO6LmxVr9VzP;bxVdoSwg5lMPR5kUM7;syV1kz6YkD2oKlJ4YUVLdG;gsKTRV7TU8R:;iDtkKEJVyA4;L2lYL:Bf7M3GdylSQBlkd9BtoSJtoe;zihyUkJ3ziXSgo0:kS5a;mPVRkU7jS55t86aLFe4NgJJYScVV9hx1s2yMdRdfPD;tiG:z5:xeiQhPOO;V$VQ
302 Found to http://us01.xmlsearch.findwhat.com/bin/findwhat.dll?clickthrough&y=50201&x=;WkCN2779Z:Uw6;R1G0xomUpzc0F9:fbBAZiyAkWhdJ:N3asug66ZsYH9b:3zC:4K21nXaxLZckd;gY0WYWU;sHsos745F1rwAT9rsdfNcdQ12;6iykHNwVeigkh6ZbJXZbGWZ7OVG:ci67BVFbAoFK:ws0lZL:LZJK:7ZHMXcUGrKJcXcKoZAfOzbYfV3ks72a4;Z7do6RQ4V7xsAeproZfh6Hl0&c=B69F4D94%2D7247%2D4D89%2DBB68%2DFFF6A4F15634

GET http://us01.xmlsearch.findwhat.com/bin/findwhat.dll?clickthrough&y=50201&x=;WkCN2779Z:Uw6;R1G0xomUpzc0F9:fbBAZiyAkWhdJ:N3asug66ZsYH9b:3zC:4K21nXaxLZckd;gY0WYWU;sHsos745F1rwAT9rsdfNcdQ12;6iykHNwVeigkh6ZbJXZbGWZ7OVG:ci67BVFbAoFK:ws0lZL:LZJK:7ZHMXcUGrKJcXcKoZAfOzbYfV3ks72a4;Z7do6RQ4V7xsAeproZfh6Hl0&c=B69F4D94%2D7247%2D4D89%2DBB68%2DFFF6A4F15634
302 Found to http://upspiral.us/index.php?tpid=10359&tspid=0&ttid=100&st=baileysroom

GET http://upspiral.us/index.php?tpid=10359&tspid=0&ttid=100&st=baileysroom
200 OK

GET http://www.upspiral.us/index.php?tpid=11115&tspid=0&ttid=100&st=baileysroom&bmst=&rdf=1&sid=10070508205834122959
200 OK

Whoa, what the fuck. So thats a surfer with an infected computer?

Can you contact me on ICQ please - 72458277.

**Shoehorn!** · 05-08-2007, 06:22 PM

Originally posted by RawAlex

Bad conversions, or bad traffic levels? Are you down on hits, down on join page visits, or just down on conversions?

Traffic is pretty much the same for me as a program owner and affiliate, just sales are down.

**Chio** · 05-08-2007, 06:23 PM

Originally posted by Quickdraw

Here is what I get when trying to get to your sites via Google on a machine infected with a variant of the zlob video codec trojan.
From first click these redirects happen instantly. I was on your site for a minute, but never saw it in the browser, just the logs.
The clicks to your sites end up being redirected to various PPC landing pages, and if a 'bidded' search term, it will redirect to the top bidders URL for the PPC engine that is used for the current redirect.

If I backup and click your link again, the process continues, and eventually I might make it to your site, if persistent enough. Even then, after so many redirects and unknowns happening with an infected computer, I'd think twice before entering any credit card numbers.

[CODE]....

Whoa. That's not good at all.

**RawAlex** · 05-08-2007, 06:23 PM

Originally posted by Quickdraw

Here is what I get when trying to get to your sites via Google on a machine infected with a variant of the zlob video codec trojan.
From first click these redirects happen instantly. I was on your site for a minute, but never saw it in the browser, just the logs.
The clicks to your sites end up being redirected to various PPC landing pages, and if a 'bidded' search term, it will redirect to the top bidders URL for the PPC engine that is used for the current redirect.

If I backup and click your link again, the process continues, and eventually I might make it to your site, if persistent enough. Even then, after so many redirects and unknowns happening with an infected computer, I'd think twice before entering any credit card numbers.

I know what that is. It is a very slick piece of code someone has backdoor'ed onto the server. It modifies a portion of apache in such a manner that all requests go there, and people get redirected through a "filter" that, depending on your country, browser, and how updated your system is will attempt to dump an assload of spyware onto the surfer's machine. Those that don't qualify get bounced back so fast that it is hard to see it even happening - most surfers wouldn't notice.

Have your server admins check your box(es) closely, you have been most massively hacked.

**Chio** · 05-08-2007, 06:25 PM

Originally posted by RawAlex

I know what that is. It is a very slick piece of code someone has backdoor'ed onto the server. It modifies a portion of apache in such a manner that all requests go there, and people get redirected through a "filter" that, depending on your country, browser, and how updated your system is will attempt to dump an assload of spyware onto the surfer's machine. Those that don't qualify get bounced back so fast that it is hard to see it even happening - most surfers wouldn't notice.

Have your server admins check your box(es) closely, you have been most massively hacked.

Any idea what to look for specifically?

**Shoehorn!** · 05-08-2007, 06:29 PM

Originally posted by RawAlex

Have your server admins check your box(es) closely, you have been most massively hacked.

Shit. I've sent them this thread, thanks for the heads up.

As Chio said, is there anything specifically they should be looking for?

**Quickdraw** · 05-08-2007, 06:31 PM

Originally posted by RawAlex

I know what that is. It is a very slick piece of code someone has backdoor'ed onto the server. It modifies a portion of apache in such a manner that all requests go there, and people get redirected through a "filter" that, depending on your country, browser, and how updated your system is will attempt to dump an assload of spyware onto the surfer's machine. Those that don't qualify get bounced back so fast that it is hard to see it even happening - most surfers wouldn't notice.

Have your server admins check your box(es) closely, you have been most massively hacked.

Hey RawAlex, actually that is happening on my computer that I have infected with one of the video codec virus that have been talked about lately.
All the clean computers around here do not display this behaviour.

**Chio** · 05-08-2007, 06:34 PM

Originally posted by jonesy

takes one to know one!

neil p is god!

**Shoehorn!** · 05-08-2007, 06:38 PM

Originally posted by Quickdraw

Hey RawAlex, actually that is happening on my computer that I have infected with one of the video codec virus that have been talked about lately.
All the clean computers around here do not display this behaviour.

Ah, so its something you put on a computer on purpose to see what the effect would be?

**dissipate** · 05-08-2007, 06:40 PM

i like boobies.

**HXMGP** · 05-08-2007, 06:41 PM

This is me today so far

6 SIGNUPS 61 CLICKS RATIO: 1:10 TOTAL: $108

**Chio** · 05-08-2007, 06:44 PM

Originally posted by dissipate

i like boobies.

**HXMGP** · 05-08-2007, 06:48 PM

Wait, just got another

7 SIGNUPS 61 CLICKS RATIO: 1:8 TOTAL: $126

**Quickdraw** · 05-08-2007, 06:49 PM

Originally posted by Shoehorn!

Ah, so its something you put on a computer on purpose to see what the effect would be?

Yessir..

**jonesy** · 05-08-2007, 06:52 PM

Originally posted by Chio

we were all fagollas at one time or another.

**Barefootsies** · 05-08-2007, 07:06 PM

Originally posted by MattO

Standard GFY answer:

I don't know what you're talking about, I'm making more cash money than ever before.

**Quickdraw** · 05-08-2007, 07:08 PM

I should add that what RawAlex posted is a very real problem too. They also use that same 85.255 address block for the redirects.

**RawAlex** · 05-08-2007, 07:17 PM

Quickdraw, it is the same group of people (I won't mention which country these people are from). They are effectively trying to install as much stuff as they can (and it makes you check in with them regularly).

**Corleone** · 05-08-2007, 07:33 PM

did somebody say spyware?

**jscott** · 05-08-2007, 10:37 PM

Originally posted by webgurl

atleast u have a sale with me today

thank god i have some income hehe!!!!

**B40** · 05-10-2007, 09:22 AM

"Summer slowdown"

What the fuck is up with sales

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment