Paysite owners, let's talk about Spyware again..
 

Let's talk spyware again.....

Lately we have noticed some strange things when comparing our Tour/Join page traffic, when we look at the country stats for each of these separate areas of our sites the results are weird. For example if 50% of the tour visitors are from US this number drops to 10% on the join page and is now dominated by India and so on.
From a paranoid point of view this looks like the traffic we funnel from the tour to the join page is diverted away, but is that even technically possible to do for any of the scamming companies/spyware botnets?

Our theory is that certain paysite join page urls are entered into their systems and when one of the infected surfers requests any tagged url they're diverted away....
Any comments?

Yes, it's possible to do. The same way as you can geo target your surfers the spyware guys can geotarget their spywared zombies.

is there anything that can be done? Like not having a fixed join/bill page URL?

I would be interrested by an answer.