Click-through Analysis of
Spam Ads
·
Feb. 6, 2007: Spam doorway http://sitegtr.com/all/cheap-ticket.html
redirects to lookuplive.com
o http://sitegtr.com/all/cheap-ticket.html spammed at http://cc.msnscache.com/cache.aspx?q=5956400404089&lang=en-US&mkt=en-US&FORM=CVRE2
(cache of http://pica.tabloid.jp/modules/simpleblog/index.php/3)
o Clicking on the “ORBITZ Low Fares” ad generates the following
redirection chain: à 66.230.173.28 à r.looksmart.com (HTTP 302)à www.orbitz.com
·
Feb. 6, 2007: Spam doorway http://replica-coach-handbag.vot7.info displays
the following ads-portal page:
o http://replica-coach-handbag.vot7.info spammed at
http://cc.msnscache.com/cache.aspx?q=5934017515829&lang=en-US&mkt=en-US&FORM=CVRE8
(cache of http://rexor.eredcom.co.kr/bbs/view.php?id=news&no=3)
o Clicking on
the “Designer Replica Handbags” ad generates the following redirection chain: à 66.230.138.211 à us01.xmlsearch.findwhat.com
(HTTP 302)à www.replicasi.com
·
Feb. 6, 2007: Spam doorway http://8bit.at/delorca/ fetches an ads-portal
page from paysefeed.net
o http://8bit.at/delorca/ spammed at http://cc.msnscache.com/cache.aspx?q=5826885023061&lang=en-US&mkt=en-US&FORM=CVRE3
(cache of http://www.stepupnc.com/your/memorial.htm)
o Clicking on
the “Get 15 Ringtones On Us” ad generates the following redirection chain: à 66.230.173.28 à meta.7search.com
(HTTP 302)à www.flycell.com
·
Feb. 7, 2007: sample URL from a
parasite ads-portal farm - http://phentermine.IEEEpcs.org/
o Clicking on
the “Lose Weight With Phentermine” ad generates the following redirection
chain: à 66.230.138.211 à us01.xmlsearch.findwhat.com
(HTTP 302)à phentermine.ifeelfull.com
·
Feb. 7, 2007: sample URL from a
parasite ads-portal farm - http://www.HistMed.org/Gambling-Online.phtml
o Clicking on
the “1. Play at GoldenCasino.com – 100% bonus” link generates the following
redirection chain: à 66.230.138.211 à meta.7search.com
(HTTP 302)à www.goldencasino.com
·
Feb. 7, 2007: sample URL from a parasite
ads-portal farm - http://ChildrensMuseumOfOakridge.org/PornStar-Finder.dhtml
o Clicking on
the “Porno Celebrities - $1 Access” ad generates the following redirection
chain: à 66.230.138.243 à meta.7search.com
(HTTP 302)à www.porno-celebrity.com
·
Feb. 9, 2007: Spam doorway http://airfare.4t.com redirects to topsearch10.com
o http://airfare.4t.com spammed at
http://cc.msnscache.com/cache.aspx?q=5972721131794&lang=en-US&mkt=en-US&FORM=CVRE
(cache of http://www.imagecure.com/cgi-bin/yabb2/YaBB.pl?num=1162740069)
o Clicking on
the “Cheap Airline Tickets” generates the following redirection chain: 66.230.164.180
à c.goclick.com
(HTTP 302)à c.enhance.com
(HTTP 302)à airlineticktis.com
