GoFuckYourself.com - Adult Webmaster Forum - Spyware is Killing our industry. Proof inside! Long Thread and VIDEO

- Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)

- - Spyware is Killing our industry. Proof inside! Long Thread and VIDEO (https://gfy.com/showthread.php?t=720781)

Quote:

Originally Posted by Quickdraw (Post 12394914)

This is only the tip of things but it is a good example of how traffic is being diverted from many places.

The following comes from 1 click on an infected machine. Everything in the quote all took place in about a second.
Notice that after clicking an ad on the Google results, it takes the user through the Google ad to the intended advertiser. It is then redirected so fast that most people won't even realize they even went to the intended site.

So, the advertisers on Google(and the other engines) are getting hit by a PPC charge, for traffic that really doesn't even make it to their site, but for a millisecond.

The traffic that is redirected is sent to various smaller PPC engines, through multiple redirects. The user finally lands at a, non-affiliated, top paying advertiser for these various PPC engines and the terms used. In this case the term was 'tomato seeds'.

this is happening for all keywords and all niches, mainstream and adult.

Sickening.

Quote:

Originally Posted by Quickdraw (Post 12394914)

Code:

GET http://www.google.com/search?hl=en&q=tomato+seeds&btnG=Google+Search

200 OK



GET http://85.255.119.189/frame.php

200 OK

##### Ad click started here #####

GET http://www.google.com/pagead/iclk?sa=l&ai=BjKu1_sNARsnNGpOYgQOgg8SqDPrVqB6Ws_XxA_bK6IAB4M0vCAAQARgBKAM4AFDEz9zh-_____8BYMme94fso-QXmAHAqQegAZ2ok_8DqgEEMk5SU8gBAYACAdkDI1XjKDBjSCg&adurl=http://store.tomatofest.com/&#37;3FClick%3D2

302 Found to http://www.googleadservices.com/pagead/adclick?sa=L&ai=BjKu1_sNARsnNGpOYgQOgg8SqDPrVqB6Ws_XxA_bK6IAB4M0vCAAQARgBKAM4AFDEz9zh-_____8BYMme94fso-QXmAHAqQegAZ2ok_8DqgEEMk5SU8gBAYACAdkDI1XjKDBjSCg&adurl=http://store.tomatofest.com/%3FClick%3D2&val=ChAzMTIzMTJmNGNmODUyMzQ3EMn07LEEGggd1oiS36BCxCAB



GET http://www.googleadservices.com/pagead/adclick?sa=L&ai=BjKu1_sNARsnNGpOYgQOgg8SqDPrVqB6Ws_XxA_bK6IAB4M0vCAAQARgBKAM4AFDEz9zh-_____8BYMme94fso-QXmAHAqQegAZ2ok_8DqgEEMk5SU8gBAYACAdkDI1XjKDBjSCg&adurl=http://store.tomatofest.com/%3FClick%3D2&val=ChAzMTIzMTJmNGNmODUyMzQ3EMn07LEEGggd1oiS36BCxCAB

302 Found to http://store.tomatofest.com/?Click=2&gclid=CPu04_mb_4sCFQqgYgodaRs_zA



GET http://store.tomatofest.com/?Click=2&gclid=CPu04_mb_4sCFQqgYgodaRs_zA

200 OK



GET http://85.255.119.189/click.php?PHPSESSID=B043EDE50C4D4AACA85F6083F8EFF1CF&qq=b01bb5eae6568bd2aa6bd8a775309ac1&id=1&qnaes={B043EDE5-0C4D-4AAC-A85F-6083F8EFF1CF}

302 Found to http://64.111.208.122/click.php?c=c3fe4046bef70c09d404&r=1&d=B043EDE50C4D4AACA85F6083F8EFF1CF



GET http://64.111.208.122/click.php?c=c3fe4046bef70c09d404&r=1&d=B043EDE50C4D4AACA85F6083F8EFF1CF

302 Found to /dclick.php?c=0855c9e17bd60d2c196b&r=1



GET http://64.111.208.122/dclick.php?c=0855c9e17bd60d2c196b&r=1

302 Found to http://66.250.74.152/click.php?go=aHR0cDovLzY3LjI5LjEzOS4yMjAvY2xpY2svP2FmZmlsaWF0ZT1TUzIyJnN1YmlkPTE5MzZfMTYxNSZUZXJtcz10b21hdG8lMjBzZWVkcyZzaWQ9WjAxODA0NTA1MEBFelgxRXpkM2QzWHlNek14Y2pNMUFET3dNak0yZ3pYNWdETjI4Vk81VVRPMFlETzNFVE0=&b=MC4xOTA=&aff=1936&subaff=1615&time=1178649599&searcher_ip=24.119.49.119&cnt=21843&qq=tomato+seeds&mode=&seid=czATgc4633g1Tpvi+H2xw7C/0UMC/RjUkek0QQaz&se=YWJjU2VhcmNoUA==&sid=39&pos=1



GET http://66.250.74.152/click.php?go=aHR0cDovLzY3LjI5LjEzOS4yMjAvY2xpY2svP2FmZmlsaWF0ZT1TUzIyJnN1YmlkPTE5MzZfMTYxNSZUZXJtcz10b21hdG8lMjBzZWVkcyZzaWQ9WjAxODA0NTA1MEBFelgxRXpkM2QzWHlNek14Y2pNMUFET3dNak0yZ3pYNWdETjI4Vk81VVRPMFlETzNFVE0=&b=MC4xOTA=&aff=1936&subaff=1615&time=1178649599&searcher_ip=24.119.49.119&cnt=21843&qq=tomato+seeds&mode=&seid=czATgc4633g1Tpvi+H2xw7C/0UMC/RjUkek0QQaz&se=YWJjU2VhcmNoUA==&sid=39&pos=1

302 Found to http://66.250.74.152/click_second_new3.php?go=aHR0cDovLzY3LjI5LjEzOS4yMjAvY2xpY2svP2FmZmlsaWF0ZT1TUzIyJnN1YmlkPTE5MzZfMTYxNSZUZXJtcz10b21hdG8lMjBzZWVkcyZzaWQ9WjAxODA0NTA1MEBFelgxRXpkM2QzWHlNek14Y2pNMUFET3dNak0yZ3pYNWdETjI4Vk81VVRPMFlETzNFVE0=&b=MC4xOTA=&aff=1936&subaff=1615&time=1178649599&searcher_ip=24.119.49.119&cnt=21843&qq=tomato+seeds&mode=&seid=czATgc4633g1Tpvi+H2xw7C/0UMC/RjUkek0QQaz&se=YWJjU2VhcmNoUA==&sid=39&pos=1&country=US



GET http://66.250.74.152/click_second_new3.php?go=aHR0cDovLzY3LjI5LjEzOS4yMjAvY2xpY2svP2FmZmlsaWF0ZT1TUzIyJnN1YmlkPTE5MzZfMTYxNSZUZXJtcz10b21hdG8lMjBzZWVkcyZzaWQ9WjAxODA0NTA1MEBFelgxRXpkM2QzWHlNek14Y2pNMUFET3dNak0yZ3pYNWdETjI4Vk81VVRPMFlETzNFVE0=&b=MC4xOTA=&aff=1936&subaff=1615&time=1178649599&searcher_ip=24.119.49.119&cnt=21843&qq=tomato+seeds&mode=&seid=czATgc4633g1Tpvi+H2xw7C/0UMC/RjUkek0QQaz&se=YWJjU2VhcmNoUA==&sid=39&pos=1&country=US

302 Found to http://67.29.139.220/click/?affiliate=SS22&subid=1936_1615&Terms=tomato%20seeds&sid=Z018045050@EzX1Ezd3d3XyMzMxcjM1ADOwMjM2gzX5gDN28VO5UTO0YDO3ETM



GET http://67.29.139.220/click/?affiliate=SS22&subid=1936_1615&Terms=tomato%20seeds&sid=Z018045050@EzX1Ezd3d3XyMzMxcjM1ADOwMjM2gzX5gDN28VO5UTO0YDO3ETM

200 OK



POST http://67.29.139.220/jump/?affiliate=ss22&subid=1936_1615&Terms=tomato%20seeds&e=

200 OK

#### This is the top position on abcsearch.com ####

GET http://samson-exotic-gardens.com/14.html

200 OK

In this redirect it appears they are using abcsearch.com.
They use spoofed referrers such as indaxis.info/search.php?q=term-used and many other similarly styled refs.

Looks like many chinese sweatshop clickers will have to look for a new job...

Imagine the sums we are talking about with hundreds of thousands of infections daily...this isn't a few script kiddies making some money, it's organized crime at a high level.

Quote:

Originally Posted by joy (Post 12394335)

What's your email? I will hit you up asap

hit me up: 3lettercom AT gmail DOT com

thanks!

this thread needs a bump

Does anyone really care?

Is anyone doing anything to stop this?

What can I do?

Quote:

Originally Posted by Huggles (Post 12395773)

Does anyone really care?

Is anyone doing anything to stop this?

What can I do?

The problem is that all affiliates can do it trying to educate surfers, make them aware that this spyware can be used for identity theft, theft of personal data, etc...although a guy with his cock in his hand is rather hard to educate.

The only really effective way of getting rid of these parasites is shutting down their affiliate accounts on sight. It's up to the program owners to watch for new affiliates suddenly generating huge sales volumes, especially if these affiliates aren't from the US, canada or western europe.

Theres got to be a way to prevent ref code swapping and it has to be done on the sponsor end. I don't have have a clue how all that shit works but i find it hard to believe that there is no way to encode ids to stop this.

NTSS: There are some ways that this could be addressed, but most programs aren't into it because (a) it would require time, effort, and programming, and (b) they are still making sales, just different affiliates are getting creditted.

Until the programs themselves start to feel true pain, there will be nothing done.

This is news? This has been going on for awhile, and it's not just the online adult industry that's affected.

I think a possible way to stop affiliate code replacements would be for all affiliates to be allowed to make domain aliases for the sites they're promoting...

Example :

You are an affiliate promoting cumfiesta.com .. when you link to the site like this cumfiesta.com?affid=mrcool then these thieves script see that the infected computer is loading the cumfiesta.com domain and then maked the replacement of the affid...

The affiliate could then reg his own domain for this site.. like cumfiestatour.com (nastydollar then need to add this as an alias to cumfiesta.com) then the trojan script can't recognize the domain and can't make any affid replacement..

Quote:

Originally Posted by intehend (Post 12398199)

This is news? This has been going on for awhile, and it's not just the online adult industry that's affected.

it's not news. But like any annoyance, nobody really talks about it until it becomes a real major issue. At this point, affiliates on many programs are seeing major sales swings, and now it would appear that CCBill may have been targetted, at least for some sites using them for sales and stats. It is finally news because the affiliates are feeling the pain.

My own experience shows conversions getting worse and worse, yet most program owners not saying a peep or discussing problems, so I have to assume they aren't seeing the same issues their affiliates are seeing.

So yeah, it's news, only because the minor cut has turned into a ruptured artery, and the lifeblood of the industry is slowly dripping out.

Quote:

Originally Posted by biskoppen (Post 12398563)

Might work on some, but most will just grab the sale as it hits the processor. If you move signups to the same domain you are gonna need SSL certificates for each alias. Besides, they'll catch on after a while and start adding the domains to the redirect database.

The thing is that the program owners can't be so aggressive in this issue or they risk getting their traffic redirected insted of just sent to an malware affiliate, my bet is many of them are aware of the malware affiliates and some probably shave them pretty hard. It's pretty easy to track what affiliates get malware sales.

When this become as big a problem for mainstream as it is for adult, then we will see improvements, not until then. I'm afraid that the only solution in the end is that microsoft fixes the rootkit problem and puts a really good anti-malware program in windows update.

I will just say that I have reported all threads and issues such as this and they are taken seriously. I will continue to do so.

Quote:

Originally Posted by Quickdraw (Post 12394914)

Code:

GET http://www.google.com/search?hl=en&q=tomato+seeds&btnG=Google+Search

200 OK



GET http://85.255.119.189/frame.php

200 OK

##### Ad click started here #####

GET http://www.google.com/pagead/iclk?sa=l&ai=BjKu1_sNARsnNGpOYgQOgg8SqDPrVqB6Ws_XxA_bK6IAB4M0vCAAQARgBKAM4AFDEz9zh-_____8BYMme94fso-QXmAHAqQegAZ2ok_8DqgEEMk5SU8gBAYACAdkDI1XjKDBjSCg&adurl=http://store.tomatofest.com/%3FClick%3D2

302 Found to http://www.googleadservices.com/pagead/adclick?sa=L&ai=BjKu1_sNARsnNGpOYgQOgg8SqDPrVqB6Ws_XxA_bK6IAB4M0vCAAQARgBKAM4AFDEz9zh-_____8BYMme94fso-QXmAHAqQegAZ2ok_8DqgEEMk5SU8gBAYACAdkDI1XjKDBjSCg&adurl=http://store.tomatofest.com/%3FClick%3D2&val=ChAzMTIzMTJmNGNmODUyMzQ3EMn07LEEGggd1oiS36BCxCAB



GET http://www.googleadservices.com/pagead/adclick?sa=L&ai=BjKu1_sNARsnNGpOYgQOgg8SqDPrVqB6Ws_XxA_bK6IAB4M0vCAAQARgBKAM4AFDEz9zh-_____8BYMme94fso-QXmAHAqQegAZ2ok_8DqgEEMk5SU8gBAYACAdkDI1XjKDBjSCg&adurl=http://store.tomatofest.com/%3FClick%3D2&val=ChAzMTIzMTJmNGNmODUyMzQ3EMn07LEEGggd1oiS36BCxCAB

302 Found to http://store.tomatofest.com/?Click=2&gclid=CPu04_mb_4sCFQqgYgodaRs_zA



GET http://store.tomatofest.com/?Click=2&gclid=CPu04_mb_4sCFQqgYgodaRs_zA

200 OK



GET http://85.255.119.189/click.php?PHPSESSID=B043EDE50C4D4AACA85F6083F8EFF1CF&qq=b01bb5eae6568bd2aa6bd8a775309ac1&id=1&qnaes={B043EDE5-0C4D-4AAC-A85F-6083F8EFF1CF}

302 Found to http://64.111.208.122/click.php?c=c3fe4046bef70c09d404&r=1&d=B043EDE50C4D4AACA85F6083F8EFF1CF



GET http://64.111.208.122/click.php?c=c3fe4046bef70c09d404&r=1&d=B043EDE50C4D4AACA85F6083F8EFF1CF

302 Found to /dclick.php?c=0855c9e17bd60d2c196b&r=1



GET http://64.111.208.122/dclick.php?c=0855c9e17bd60d2c196b&r=1

302 Found to http://66.250.74.152/click.php?go=aHR0cDovLzY3LjI5LjEzOS4yMjAvY2xpY2svP2FmZmlsaWF0ZT1TUzIyJnN1YmlkPTE5MzZfMTYxNSZUZXJtcz10b21hdG8lMjBzZWVkcyZzaWQ9WjAxODA0NTA1MEBFelgxRXpkM2QzWHlNek14Y2pNMUFET3dNak0yZ3pYNWdETjI4Vk81VVRPMFlETzNFVE0=&b=MC4xOTA=&aff=1936&subaff=1615&time=1178649599&searcher_ip=24.119.49.119&cnt=21843&qq=tomato+seeds&mode=&seid=czATgc4633g1Tpvi+H2xw7C/0UMC/RjUkek0QQaz&se=YWJjU2VhcmNoUA==&sid=39&pos=1



GET http://66.250.74.152/click.php?go=aHR0cDovLzY3LjI5LjEzOS4yMjAvY2xpY2svP2FmZmlsaWF0ZT1TUzIyJnN1YmlkPTE5MzZfMTYxNSZUZXJtcz10b21hdG8lMjBzZWVkcyZzaWQ9WjAxODA0NTA1MEBFelgxRXpkM2QzWHlNek14Y2pNMUFET3dNak0yZ3pYNWdETjI4Vk81VVRPMFlETzNFVE0=&b=MC4xOTA=&aff=1936&subaff=1615&time=1178649599&searcher_ip=24.119.49.119&cnt=21843&qq=tomato+seeds&mode=&seid=czATgc4633g1Tpvi+H2xw7C/0UMC/RjUkek0QQaz&se=YWJjU2VhcmNoUA==&sid=39&pos=1

302 Found to http://66.250.74.152/click_second_new3.php?go=aHR0cDovLzY3LjI5LjEzOS4yMjAvY2xpY2svP2FmZmlsaWF0ZT1TUzIyJnN1YmlkPTE5MzZfMTYxNSZUZXJtcz10b21hdG8lMjBzZWVkcyZzaWQ9WjAxODA0NTA1MEBFelgxRXpkM2QzWHlNek14Y2pNMUFET3dNak0yZ3pYNWdETjI4Vk81VVRPMFlETzNFVE0=&b=MC4xOTA=&aff=1936&subaff=1615&time=1178649599&searcher_ip=24.119.49.119&cnt=21843&qq=tomato+seeds&mode=&seid=czATgc4633g1Tpvi+H2xw7C/0UMC/RjUkek0QQaz&se=YWJjU2VhcmNoUA==&sid=39&pos=1&country=US



GET http://66.250.74.152/click_second_new3.php?go=aHR0cDovLzY3LjI5LjEzOS4yMjAvY2xpY2svP2FmZmlsaWF0ZT1TUzIyJnN1YmlkPTE5MzZfMTYxNSZUZXJtcz10b21hdG8lMjBzZWVkcyZzaWQ9WjAxODA0NTA1MEBFelgxRXpkM2QzWHlNek14Y2pNMUFET3dNak0yZ3pYNWdETjI4Vk81VVRPMFlETzNFVE0=&b=MC4xOTA=&aff=1936&subaff=1615&time=1178649599&searcher_ip=24.119.49.119&cnt=21843&qq=tomato+seeds&mode=&seid=czATgc4633g1Tpvi+H2xw7C/0UMC/RjUkek0QQaz&se=YWJjU2VhcmNoUA==&sid=39&pos=1&country=US

302 Found to http://67.29.139.220/click/?affiliate=SS22&subid=1936_1615&Terms=tomato%20seeds&sid=Z018045050@EzX1Ezd3d3XyMzMxcjM1ADOwMjM2gzX5gDN28VO5UTO0YDO3ETM



GET http://67.29.139.220/click/?affiliate=SS22&subid=1936_1615&Terms=tomato%20seeds&sid=Z018045050@EzX1Ezd3d3XyMzMxcjM1ADOwMjM2gzX5gDN28VO5UTO0YDO3ETM

200 OK



POST http://67.29.139.220/jump/?affiliate=ss22&subid=1936_1615&Terms=tomato%20seeds&e=

200 OK

#### This is the top position on abcsearch.com ####

GET http://samson-exotic-gardens.com/14.html

200 OK

In this redirect it appears they are using abcsearch.com.
They use spoofed referrers such as indaxis.info/search.php?q=term-used and many other similarly styled refs.

there we go finally some real info in this thread. these spyware guys are straight up stealing adult traffic and sending it to mainstream PPC buyers.

quickdraw hit me up on icq please:

4162727

Quote:

Originally Posted by FiReC (Post 12399935)

there we go finally some real info in this thread. these spyware guys are straight up stealing adult traffic and sending it to mainstream PPC buyers.

quickdraw hit me up on icq please:

4162727

That's not the only place its going.

We have been deep into this shit since this thread was started and we are finding some things that when made public, it will rock the industry and not only will it shut down one of the biggest companies in the biz, it will also make the owners run and never look back.

Quote:

Originally Posted by joy (Post 12401081)

You mean shut down, change their name and come back like nothing happened like megapornbucks? :disgust

Quote:

Originally Posted by FiReC (Post 12399935)

quickdraw hit me up on icq please:

Done . .

bump..................

too long for me to read, but I'll bump it

Quote:

When this become as big a problem for mainstream as it is for adult, then we will see improvements, not until then. I'm afraid that the only solution in the end is that microsoft fixes the rootkit problem and puts a really good anti-malware program in windows update.

there needs to be an organization of webmasters to document what is going on and draft an email that everyone can send to M$ along with making surfers aware that they are infected who knows what else they are stealing besides traffic.

Quote:

Originally Posted by Tanker (Post 12404170)

Not only that.. there need to be an adult webmasters organization to cover our asses in everything that's hurting adult bizz.. Something that actively tracked down spyware installers, website hackers, password traders, shaving programs etc. and worked to shut them down..

Problem today is that with no organization we are just easy targets waiting for the next bad thing to happend :Oh crap

Quote:

Originally Posted by Tanker (Post 12404170)

What might actually make things happen is if we could show Microsoft, Yahoo and google how much money they are loosing on ad traffic due to malware. But that means the affiliate progams needs to step up and track how much of the traffic is lost.

Quote:

Originally Posted by milambur (Post 12404715)

But that means the affiliate progams needs to step up and track how much of the traffic is lost.

Most program owners think this is just bullshit and are blaming the economy and the card processors.

ATTENTION PROGRAM OWNERS

Do yourselves a favor and please give me the benefit of the dought. See how nice sales were yesterday and how shitty they are today? Now, go look deep into your stats and compare yesterdays join page (YOUR JOIN PAGE) to processor page. You will see that your surfers never leave YOUR join page nor do they make it to the processor. Ain't that a kick in the ass?

BUMP - this is some scary shit :mad:

this thread needs to be bumped

bump....................

Bumps only work when sales are down, the past couple days sales have been up so no one will give a fuck.

ask yourself this question:
What is my ratio of spyware users ?
10% 20% 50%
if it is 50% you will go from 1 to 1000 to 1/2000
with 1/40000 starting from 1/1000, it means only 1 user on 40 that is clean.

97.5% of users with spywares !
and no one with an antivirus...
For sure with 1/40000 the problem is elsewhere.

pornmasta, nice math, but you fail.

Let's play this game:

1 in 10 surfers to your blog, tgp, free site, guide, whatever clicks on a sponsor link.

1 in 1000 of those that click a sponsor link actually signup.

say 20% of all surfers are infected with spyware (low number, I have heard numbers closer to 50% in some cases, probably better now as Microsoft is giving away their malicious software removal tool).

1 in 10,000 turns to 1 in 12,000, straight numbers. But in reality, it gets worse, because the people most likely to have the spyware has hardcore porn surfers. So the number is likely much worse when it comes to porn.

It gets worse if the spyware companies are popping the same site over the one people are going to (or a very similar competitive site) as you are not only losing control of the surfer, but they are going to steal sales as well. 1 stolen sale moves your from 1 in 12,000 to 1 in 24,000 in a blink.

The numbers are truly depressing at times.

mediaacrivexpro.com

You can add this domain to the happy list ...
http://free3xmovies.com/movies/hardc...e2.php?id=1102

Is there a way to add something to my site, www.newpornchicks.com that will pop something up to notify people they have Zango / spyware? anything that will detect it?

Quote:

Originally Posted by Huggles (Post 12451035)

Is there a way to add something to my site, www.newpornchicks.com that will pop something up to notify people they have Zango / spyware? anything that will detect it?

Once they are infected its to late really. Not only is it almost impossible to remove but you have lost your surfers trust. One thats gone, he is gone.

The ONLY way to stop this is to shut down the installers..the ones banging our traffic with this.

Quote:

Originally Posted by joy (Post 12451050)

Hmmmm :disgust

bump....................