Sextracker Scandal - Pt 4

Nickatilynx · 02-06-2005

Revenue Streams Undetectable to the User

Search Results Insertion

Search results from any major search engine can be replaced/ammended with your own per-per-click XML feed(s). When the user searches google he cannot tell the results are not coming from google itself.

This is not limited to 3rd party XML feeds: with the addition of commonly avaiable server-side scripts, one could display your paysite as search result #1 when a niche keyword is searched for, with the pay-per-click results following.

Affiliate income from purchases made directly via retailer's sites

For example, if the user types www.wal-mart.com in their browser, they are first redirected through your own link code for Wal-Mart's affiliate program. The user sees no difference at all.

Ability to override other webmasters' affiliate codes

Similar to the above, but this is for when the user navigates to the retailer or paysite via an affiliate link or another site. The referring URL can be forged so the real originating site does not appear in server logs.

Other Capabilities

Redirect any URL to another location
Most useful for paysite join pages, but can be used for just about anything. When the user navigates to somesite.com/join/, he can be sent to yoursite.com/join/ instead.

Custom 404/NoDNS error pages

Instead of the ErrorDocument presented by the server, the user is shown your own custom document for 404's and DNS errors, such as a portal page. This feature is currently turned off due to its extreme visibility.

"Splash" pages for any site

The user is shown a full-page ad with a "Continue" link at the bottom of the page which allows him to finish navigating to the site intended.

Splash pages based on search engine keyword

Similar to the above, but here the ad is displayed when the user searches for a specific keyword using any major search engine. In the case the Continue link leads to the actual search results.

Anti-Detection

Does not show up as an IE "Browser Helper Object" (where one usually finds run-of-the-mill malware)
In the process list, can show up as any system-sounding process you choose, such as taskmgr.exe, svchost.exe, or even explorer.exe.
Under Win9x it does not show up in the process list at all.
The file itself can reside anywhere on the hard drive, and can have the appropriate icon associated with it. For example, if one chose Program Files\Internet Explorer as the installation directory, then the .exe's icon could be Microsoft's 'e' logo.
The application does not request an internet connection at random times (so as not to alert users using software firewalls). If a connection is needed for an update, it is only done so when the user is loading a web page.
Only one registry entry is needed, and it can reside anywhere in the registry. Perhaps alongside Internet Connection Wizard's registry settings. Actually the registry entry can be omitted altogether if so desired: it is only used for detailed installation stats, which can be fairly accurately calculated using unique IPs instead.
The same redirect/override is never triggered twice in a row, so as not to prevent the user from getting where he wants to go. If the user sees something unexpected happen, he will try to load the page again and it will work properly the second time. This will cause him to think it was just a typo initially.
With judicious use of available features, there is no reason for the user to ever know it is there.

02-06-2005	#1
Nickatilynx Banned Want to see your own Advertising Here! Join Date: Oct 2002 Location: Vancouver Canada Posts: 15,115	Revenue Streams Undetectable to the User Search Results Insertion Search results from any major search engine can be replaced/ammended with your own per-per-click XML feed(s). When the user searches google he cannot tell the results are not coming from google itself. This is not limited to 3rd party XML feeds: with the addition of commonly avaiable server-side scripts, one could display your paysite as search result #1 when a niche keyword is searched for, with the pay-per-click results following. Affiliate income from purchases made directly via retailer's sites For example, if the user types www.wal-mart.com in their browser, they are first redirected through your own link code for Wal-Mart's affiliate program. The user sees no difference at all. Ability to override other webmasters' affiliate codes Similar to the above, but this is for when the user navigates to the retailer or paysite via an affiliate link or another site. The referring URL can be forged so the real originating site does not appear in server logs. Other Capabilities Redirect any URL to another location Most useful for paysite join pages, but can be used for just about anything. When the user navigates to somesite.com/join/, he can be sent to yoursite.com/join/ instead. Custom 404/NoDNS error pages Instead of the ErrorDocument presented by the server, the user is shown your own custom document for 404's and DNS errors, such as a portal page. This feature is currently turned off due to its extreme visibility. "Splash" pages for any site The user is shown a full-page ad with a "Continue" link at the bottom of the page which allows him to finish navigating to the site intended. Splash pages based on search engine keyword Similar to the above, but here the ad is displayed when the user searches for a specific keyword using any major search engine. In the case the Continue link leads to the actual search results. Anti-Detection Does not show up as an IE "Browser Helper Object" (where one usually finds run-of-the-mill malware) In the process list, can show up as any system-sounding process you choose, such as taskmgr.exe, svchost.exe, or even explorer.exe. Under Win9x it does not show up in the process list at all. The file itself can reside anywhere on the hard drive, and can have the appropriate icon associated with it. For example, if one chose Program Files\Internet Explorer as the installation directory, then the .exe's icon could be Microsoft's 'e' logo. The application does not request an internet connection at random times (so as not to alert users using software firewalls). If a connection is needed for an update, it is only done so when the user is loading a web page. Only one registry entry is needed, and it can reside anywhere in the registry. Perhaps alongside Internet Connection Wizard's registry settings. Actually the registry entry can be omitted altogether if so desired: it is only used for detailed installation stats, which can be fairly accurately calculated using unique IPs instead. The same redirect/override is never triggered twice in a row, so as not to prevent the user from getting where he wants to go. If the user sees something unexpected happen, he will try to load the page again and it will work properly the second time. This will cause him to think it was just a typo initially. With judicious use of available features, there is no reason for the user to ever know it is there.