Comfortably Numb
It is currently Mon Sep 06, 2010 10:48 pm



Post new topic Reply to topic  [ 12 posts ]  Go to page 1, 2  Next
basedvd.com running in 3rd party banners 
Author Message
Elite Member
User avatar

Joined: Sun May 07, 2006 12:35 am
Posts: 3911
Post basedvd.com running in 3rd party banners
This one's in a harrenmedianetwork banner but it may be running in other networks too. Probably causing framebreakers and is doing approximately 100 to 200 autosearches so it does freeze the browser somewhat when you hit it.

This is apparently a sister site to searchingnetwork and searchingmedia that have both been posted about in the past few months and caused no end of problems to viewers of sites running 3rd party banners carrying them.

This is the top iframe from the 3rd party network and loaded on the publisher's webpage:
Code:
<iframe height="250" frameborder="0" width="300" scrolling="no"
src="http://ad.harrenmedianetwork.com
/iframe3?pQkAACKgBgD8UC8AAAAAAK0nDQAAAAAAAAA0AQIAAAAAAAsAAQACAedjCQAAAAAA-
qASAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAA7mAMAAAAAAAIAAgAAAAAAw.UoXI.CtT.D9Shcj8K1P5qZmZmZmck.mpmZmZmZyT8AAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD-
cVgZhtgIB1F5HfGfXVAseGG.puKw53aa.vadAAAAAA==,,http://www.fusionmails.com/pages
/ptp.php?refid=somik" marginheight="0" marginwidth="0">


That loads:
Code:
<iframe height="250" frameborder="0" width="300" scrolling="no" bordercolor="#000000"
vspace="0" hspace="0" marginheight="0" marginwidth="0" src="http://www.basedvd.com
/300base.php">


That loads:
Code:
[quote]<iframe height="926" frameborder="no" width="1280" scrolling="no"
src="http://63.246.153.36/promote.php?username=auto" marginheight="0" marginwidth="0"
style="width: 1280px;">[/quote]


That's loading a bunch of iframes - I don't want to post the codes for this level so I'm going to go into one of the iframes instead, but there's ten iframes being generated by the look of it and they'll all be similar to what I'll post

The first of those ten iframes:
Code:
<iframe height="926" frameborder="no" width="1280" scrolling="no"
src="http://66.118.177.40/promote.php?username=auto&coun=GB&psid=" marginheight="0"
marginwidth="0" style="width: 1280px; height: 926px;">


That loads:
Code:
<iframe height="0" frameborder="0" width="0" src="http://www.ad-seek.com
/search.php?username=adseek&keywords=home%2Bsettlement%2Bloans">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.airppc.com
/search.php?username=air&keywords=toyota%2Bmy">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.alumseek.com
/search.php?username=alum&keywords=audio%2Bconferencing">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.antispamlab.com
/search.php?username=53&keywords=best%2Bcaribbean%2Bcruise">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.arenaway.com
/search.php?username=aren&keywords=job%2Bfor%2Bwork%2Bat%2Bhome%2Bmom">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.a-seek.com
/search.php?username=rock&keywords=best%2Bcaribbean%2Bcruise">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.avayaout.com
/search.php?username=2039&keywords=payroll%2Bsoftware">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.balqiss.com
/search.php?username=bal&keywords=holistic">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.barrap.com
/search.php?username=barrap&keywords=pets">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.boltpark.com
/search.php?username=fixerhip&keywords=alpha%2Blipoic%2Bacid">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.buka247.com
/search.php?username=717&keywords=san%2Bdiego%2Byellow%2Bpages">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.cavitey.com
/search.php?username=cavitey&keywords=florida%2Bdui">
</iframe>
<iframe height="0" frameborder="0" width="0" src="http://www.crpup.com
/search.php?username=108&keywords=free%2Bcredit%2Breports">


Each of those does autosearches and we have ten similar iframes containing similar iframes which is why I estimate a total of 100 to 200 autosearches on the that load... it certainly looked about that many in adblock and searchingmedia also turned up in the adblock list, though I had the contents of that blocked, so if it had loaded that may have added even more autosearches to the total.


Last edited by cconniejean on Sat Oct 17, 2009 1:53 am, edited 1 time in total.

correcting post borders



Mon Sep 28, 2009 12:47 am
Profile
Elite Member
User avatar

Joined: Sun May 07, 2006 12:35 am
Posts: 3911
Post Re: basedvd.com running in 3rd party banners
I just got this again, coming from one of the hidden iframes still loading in Axill banners. It doesn't show in the firebug source codes but the net section of firebug shows this as coming from yieldmanager? I wouldn't be surprised if most of the current problems (rogue AVs and this) are from yieldmanager as they seem to occur on so many sites that have different direct 3rd party networks on them... that suggest to me that it's coming from one of the main feed networks and then spreading out that way.

Axill skyscraper:
Code:
<iframe height="609" frameborder="0" width="120" scrolling="no"
allowtransparency="true" src="http://www.axill.com/cpm/Cpm.aspx?affid=27278&W=120">


webpage stuck in that skyscraper loading five 3rd party banners (4 of them invisible when the page is stuck in a banner iframe)
Code:
<iframe height="600" frameborder="0" width="120" scrolling="no"
src="http://www.axill.com/CPM/120.aspx" marginheight="0" marginwidth="0">


second hidden banner on that webpage:
Code:
<iframe height="250" frameborder="0" width="300" scrolling="no"
src="http://ad.globe7.com
/iframe3?XDg9AHsPCwD8UC8AAAAAAK0nDQAAAAAAAgBEAAIAAAAAAP8AAAAEFwclEwAAAAAACc
QHAAAAAAD6oBIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AB7rQUAAAAAAAIAAwAAAAAATMgHPZtVrz9MyAc9m1WvP-omMQisHLo.6iYxCKwcuj-
amZmZmZnJP5qZmZmZmck.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD.7DUyJb
MMB4dDM6OqYqAZaTNpYiuhJzrgeD-YAAAAAA==,,http://www.axill.com/cpm/120.aspx"
marginheight="0" marginwidth="0">


That loads the basedvd.com which does all the hidden autosearches:
Code:
<iframe height="250" frameborder="0" width="300" scrolling="no" bordercolor="#000000"
vspace="0" hspace="0" marginheight="0" marginwidth="0" src="http://www.basedvd.com
/300base.php">


The Net section of firebug gives this info where you can see yieldmanager showing as the referrer:
Code:
Response Headers
Date   Wed, 30 Sep 2009 21:33:25 GMT
Server   Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By   PHP/5.2.8
Keep-Alive   timeout=1, max=100
Connection   Keep-Alive
Transfer-Encoding   chunked
Content-Type   text/html
Request Headers
Host   www.basedvd.com
User-Agent   Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.14) Gecko/2009082707 Firefox/3.0.14 (.NET CLR 3.5.30729)
Accept   text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language   en-us,en;q=0.5
Accept-Encoding   gzip,deflate
Accept-Charset   ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive   300
Connection   keep-alive
Referer   http://ad.yieldmanager.com
/iframe3?XDg9AHsPCwD8UC8AAAAAAK0nDQAAAAAAAgBEAAIAAAAAAP8AAAAEFwclEwAAAAAACc
QHAAAAAAD6oBIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AB7rQUAAAAAAAIAAwAAAAAATMgHPZtVrz9MyAc9m1WvP-omMQisHLo.6iYxCKwcuj-
amZmZmZnJP5qZmZmZmck.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD.7DUyJb
MMB4dDM6OqYqAZaTNpYiuhJzrgeD-YAAAAAA==,,http://www.axill.com/cpm/120.aspx


Last edited by cconniejean on Sat Oct 17, 2009 1:54 am, edited 1 time in total.

correcting post borders



Wed Sep 30, 2009 10:45 pm
Profile
Elite Member
User avatar

Joined: Sun May 07, 2006 12:35 am
Posts: 3911
Post Re: basedvd.com running in 3rd party banners
Nearly a month later I'm still getting hit by this one and its 200 or so autosearches at least once daily.

I get it mostly coming from Harrenmedianetwork banners but today also got it from one of the hidden Axill banners. The firebug codes showed it coming from a globe7 banner hidden on the axill webpage that they stick into their banners and use to load more banners than can possibly be visible in one banner iframe, but the referrer in the net section of firebug said the direct referrer was yieldmanager...not a good sign.


Sat Oct 17, 2009 12:27 am
Profile
Elite Member
User avatar

Joined: Sun May 07, 2006 12:35 am
Posts: 3911
Post Re: basedvd.com running in 3rd party banners
Running in mediaservers/Media Shakers

Code:
<!-- BEGIN STANDARD TAG - 300 x 250 - ROS: Run-of-site - DO NOT MODIFY -->
<iframe height="250" frameborder="0" width="300" scrolling="no" src="http://ad.media-servers.net/st?ad_type=iframe&ad_size=300x250&section=348888" marginheight="0" marginwidth="0">


That loads:
Code:
<iframe height="250" frameborder="0" width="300" scrolling="no" src="http://ad.media-servers.net/iframe3?9UBlANhSBQD8UC8AAAAAAK0nDQAAAAAAAgAAAAIAAAAAAP8AAAAEB.YgBwAAAAAAG9cGAAAAAAD6oBIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC66QIAAAAAAAIAAwAAAAAAiIVa07zjpD-IhVrTvOOkP-omMQisHLo.6iYxCKwcuj-amZmZmZnJP5qZmZmZmck.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADhxObC93snB0Pya8H4J6XZV9KLJCP1aAUd0ofmAAAAAA==,,http://wowmytraffic.com/pages/ptp.php?refid=mtolyan" marginheight="0" marginwidth="0">


That loads:
Code:
if (window.rm_crex_data) {rm_crex_data.push(3100924);}

<iframe height="250" frameborder="0" width="300" scrolling="no" bordercolor="#000000" vspace="0" hspace="0" marginheight="0" marginwidth="0" src="http://www.basedvd.com/300base.php">


Wed Oct 21, 2009 6:12 am
Profile
Elite Member
User avatar

Joined: Sun May 07, 2006 12:35 am
Posts: 3911
Post Re: basedvd.com running in 3rd party banners
This basedvd is now doing about 350 autosearches for me in each load :shock: It could be more, I managed to hit stop part-way through then copied the adblock list into a spreadsheet to get a rough count from that. The 350 frames is a ount of those that look directly attributable to the basedvd, then there were about 100 other elements listed that didn't come from that.

I see one of the searches going to asklots and then to jokeroo (used to be a commonly complained about framebreaker, so if anyone's seeing this around now it's probably from one of these banners).


Fri Oct 23, 2009 5:43 pm
Profile
Elite Member
User avatar

Joined: Sun May 07, 2006 12:35 am
Posts: 3911
Post Re: basedvd.com running in 3rd party banners
And a new sister site for basedvd (new to me): comshat.com/buy72890.php doing hundreds of autosearches and running in clicksor which is being served by aladdin ads. Have reported to the site where I saw the banner.

estimate 300 autosearches at a minimum.

There are ten iframes similar to this one:
Code:
<iframe height="926" frameborder="no" width="1280" scrolling="no" src="http://66.118.177.40/promote.php?username=jack&coun=GB&psid=" marginheight="0" marginwidth="0" style="width: 1280px; height: 926px;">


Each contains 30 iframes loading webpages loading search results (due to having done an automated bot search)

I tried loading that comshat page in a new window and I found no autosearches but I did find the adserver.exchange that Strolly was noticing a few weeks/months ago with one of the sister sites when it kept breaking frames to asklots/jokeroo -- adserver.exchange is the title of the webpage loading the ebay/0iframes.

When I see the basedvd in the box banners they've sort of half covered it with an ebay ad...this one is doing the same thing so that when I load the comshat I get what appears to be an innocent ebay banner. I am guessing they've got this page referrer dependent and that may be why I get no 0 iframes on this load outside of the third party banner.

According to my interpretation of what I'm seeing, the comshat in clicksor is directly coming from clicksor and not via RMX as the harren and media shakers appeared to be..


Fri Oct 23, 2009 11:31 pm
Profile
Elite Member

Joined: Mon Jul 17, 2006 7:49 pm
Posts: 2899
Location: USA
Post Re: basedvd.com running in 3rd party banners
Anyone that has run into this without a block in place has had a real mess on their hands, and all over their PC.


Sat Oct 24, 2009 5:53 am
Profile
Elite Member
User avatar

Joined: Sun May 07, 2006 12:35 am
Posts: 3911
Post Re: basedvd.com running in 3rd party banners
new name: binsave.com (page name: binsave.com/bin1.php)

Found in a Clicksor banner. Approximately 800 related hidden iframes/autosearches.


Wed Nov 04, 2009 5:32 am
Profile
Elite Member
User avatar

Joined: Sun May 07, 2006 12:35 am
Posts: 3911
Post Re: basedvd.com running in 3rd party banners
new name: cowreps.com

Running in Clicksor via Aladdin.

I have searchingnetwork adblocked and yet this cowreps still managed to do approximately 300 autosearches.


Fri Dec 04, 2009 3:32 am
Profile
Elite Member
User avatar

Joined: Sun May 07, 2006 12:35 am
Posts: 3911
Post Re: basedvd.com running in 3rd party banners
basedvd is still active

Running today in a rectangle banner from globalinteractive

Code:
<iframe height="250" frameborder="0" width="300" scrolling="no" src="http://ad.globalinteractive.com/iframe3?pQkAALMqBADDPToAAAAAAHCkDwAAAAAAAgDAAAIAAAAAAP8AAAACDVUvBQAAAAAAq8QGAAAAAADi4RUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBZQIAAAAAAAIAAwAAAAAAmpmZmZmZqT-amZmZmZmpP5qZmZmZmbk.mpmZmZmZuT-amZmZmZnJP5qZmZmZmck.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACt4GJeS3imB5-NnvhvVxP00-9v-fr1OhV2F1KKAAAAAA==,,http://www.fusionmails.com/pages/ptp.php?refid=claudio" marginheight="0" marginwidth="0">


that loads:
Code:
<iframe height="250" frameborder="0" width="300" scrolling="no" bordercolor="#000000" vspace="0" hspace="0" marginheight="0" marginwidth="0" src="http://www.basedvd.com/300basead.php">


That loads:
Code:
<iframe height="866" frameborder="no" width="1600" scrolling="no" src="http://63.246.153.36/promote.php?username=auto" marginheight="0" marginwidth="0" style="width: 1600px;">


Estimated 300 to 400 autosearches done in hidden iframes inside that frame.


Mon Jan 25, 2010 2:02 pm
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ]  Go to page 1, 2  Next


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
Installed by Installatron.
Forum theme by Vjacheslav Trushkin for Free Forum/DivisionCore.