money
viewersGoogle AdWords
money
viewersGo2Net
money
viewersIBIS WebSearch
viewers
viewers
viewersPacket Log - Syndicated
Google Ads Shown Through Ill-Gotten Third-Party Toolbars
Ben Edelman
This page gives a packet log of example traffic passing from IBIS WebSearch to Go2Net to Google to a Google advertiser (here, Orbitz), as shown in the diagram at right. Such traffic may be considered ill-gotten to the extent that the underlying installation of the IBIS WebSearch Toolbar was nonconsensual or obfuscated. See discussion in main article.
In each step of transmissions, yellow highlighting marks redirect instructions, while green highlighting marks the next redirect step.
IBIS WebSearch "Redir[ect]" Page - As Linked from Websearch.com Search Results - Redirects to Go2net
GET /xfb_redir.aspx?CP=X2nq6cfzv1bcCcjFT352OElEOysNAauq8Q8-lcE6WD_6MApij3S0K93RQmd4YecdCc6MtQUFJ3VKm_TU3ZaWxkGGpqSqObwY9ZVLdazgycNAa-Og3PJ0jKVPg5PjbuVfc4V9zhxzdcFfDtlRjWdYmliWTOxLfedb-
1tl0DG6m_9UmmqWdZUhD-X4cFfQ8JBejwWnsJqVgaontl0knqz33b278XY95Rxo1dup8Qn4_KDY7mdBUSmVHWJLor7GmQ9NaQM0eNP9bA3JKIJHSjrAVFITpCDuAlernG8ncNKE4M1Z-LreKRW1g7zmT5dLjAyM8CIhIwEukOeF9G3moGsQv5FY3cS6puZDnEH42Ch2KzlKPDw9d2yiu7pfXIOgCURwrwlqTPcUy3mjmjZ2IHqWA12q089fYjd9MZ7bxa62uctYyZ3-rTOwd4iMAziWw-_YOzfiwtXeX-yoVcL09TmpHF6oKtIgRSTUCkXQd7wzWPNEr33XTS7pPLd5cdM0pujkIIsxsn3QLCLk4j1X3eb7UYYT4rG927fuVYAZJcbGxpaZi_VnOrMuM9GAjc8d58P1su8_DEY_hV4wZJXqhNhRWGgtOT2XpV13hXq2Bx4e6i1dIoEAsic786dsMDKItrTMaM_97hAs65_28gu1Tfly554dH0YMMYeh_dhPlqs-X_6LBIye4PW4V-Bgi58_NSpfNX9mbXQy2MHXSUSxvCdJdIFpAxjlLfY3_7M9BERw3WRysfqNByg2fk74h6imyYfIRYb_4NMa1HTTxxURnoLD1hws_vfc42HO
HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash,
*/*
Referer: http://www.websearch.com/search/results.aspx?qkw=car%20rental&tbid=50252
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Host: www.websearch.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Connection: close
Date: Sat, 04 Jun 2005 03:31:23 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Location: http://clickit.go2net.com/search?pos=1&ppos=1&plnks=5&uplnks=0&cat=web&cid=245874&site=srch&area=srch.comm.gsl_paid&shape=textlink&cp=websrch.gpdxml.ch9&cluster-click=0&pd=1&coll=1&query=car+rental&qq=N&NT43J2$w.@UBaoE2a_Fg43zqVPaQyD!m;F$gUeKjG@EvWjU:rjNMFS.sz6@Rz$$YHOoU;nPgI_Nnu,He2-1NEhlSEl$s;yIBi1OlU_Pun;A9RxmnoN+Rr:P52hO'y$d0$_:1!q'T'B!OE6b0LP9AQ9bu5Zug4IS:xL95q9$s0c+3_Ri6$&amGc.b;AG;7V3&GBWhAAX1IB;S:1!6G'uTEjSUP=ww$bRbHOM
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 615
<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href='http://clickit.go2net.com/search?pos=1&ppos=1&plnks=5&uplnks=0&cat=web&cid=245874&site=srch&area=srch.comm.gsl_paid&shape=textlink&cp=websrch.gpdxml.ch9&cluster-click=0&pd=1&coll=1&query=car+rental&qq=N&NT43J2$w.@UBaoE2a_Fg43zqVPaQyD!m;F$gUeKjG@EvWjU:rjNMFS.sz6@Rz$$YHOoU;nPgI_Nnu,He2-1NEhlSEl$s;yIBi1OlU_Pun;A9RxmnoN+Rr:P52hO'y$d0$_:1!q'T'B!OE6b0LP9AQ9bu5Zug4IS:xL95q9$s0c+3_Ri6$&amGc.b;AG;7V3&GBWhAAX1IB;S:1!6G'uTEjSUP=ww$bRbHOM'>here</a>.</h2>
</body></html>
Go2Net Step 1 - Redirect to Other Go2Net Page
GET /search?pos=1&ppos=1&plnks=5&uplnks=0&cat=web&cid=245874&site=srch&area=srch.comm.gsl_paid&shape=textlink&cp=websrch.gpdxml.ch9&cluster-click=0&pd=1&coll=1&query=car+rental&qq=N&NT43J2$w.@UBaoE2a_Fg43zqVPaQyD!m;F$gUeKjG@EvWjU:rjNMFS.sz6@Rz$$YHOoU;nPgI_Nnu,He2-1NEhlSEl$s;yIBi1OlU_Pun;A9RxmnoN+Rr:P52hO'y$d0$_:1!q'T'B!OE6b0LP9AQ9bu5Zug4IS:xL95q9$s0c+3_Ri6$&amGc.b;AG;7V3&GBWhAAX1IB;S:1!6G'uTEjSUP=ww$bRbHOM
HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash,
*/*
Referer: http://www.websearch.com/search/results.aspx?qkw=car%20rental&tbid=50252
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Connection: Keep-Alive
Host: clickit.go2net.com
HTTP/1.1 302 Found
Date: Sat, 04 Jun 2005 03:31:18 GMT
Server: Apache/1.3.12 (Unix) Resin/2.1.2
Cache-Control: private
Location: http://clickit.go2net.com/search/id?pos=1&ppos=1&plnks=5&uplnks=0&cat=web&cid=245874&site=srch&area=srch.comm.gsl_paid&shape=textlink&cp=websrch.gpdxml.ch9&cluster-click=0&pd=1&coll=1&query=car+rental&qq=N&NT43J2$w.@UBaoE2a_Fg43zqVPaQyD!m;F$gUeKjG@EvWjU:rjNMFS.sz6@Rz$$YHOoU;nPgI_Nnu,He2-1NEhlSEl$s;yIBi1OlU_Pun;A9RxmnoN+Rr:P52hO'y$d0$_:1!q'T'B!OE6b0LP9AQ9bu5Zug4IS:xL95q9$s0c+3_Ri6$&amGc.b;AG;7V3&GBWhAAX1IB;S:1!6G'uTEjSUP=ww$bRbHOM
Content-Length: 471
Set-Cookie: p_go2id=PXLUpRp9rtByLQVFMRt9IA; Domain=.go2net.com; Expires=Fri,
30-May-2025 03:31:18 GMT
Set-Cookie: s_go2id=PXLUpRp9rtByLQVFMRt9IA; Domain=.go2net.com
Connection: close
Content-Type: text/plain; charset=iso-8859-1
The URL has moved <a href="http://clickit.go2net.com/search/id?pos=1&ppos=1&plnks=5&uplnks=0&cat=web&cid=245874&site=srch&area=srch.comm.gsl_paid&shape=textlink&cp=websrch.gpdxml.ch9&cluster-click=0&pd=1&coll=1&query=car+rental&qq=N&NT43J2$w.@UBaoE2a_Fg43zqVPaQyD!m;F$gUeKjG@EvWjU:rjNMFS.sz6@Rz$$YHOoU;nPgI_Nnu,He2-1NEhlSEl$s;yIBi1OlU_Pun;A9RxmnoN+Rr:P52hO'y$d0$_:1!q'T'B!OE6b0LP9AQ9bu5Zug4IS:xL95q9$s0c+3_Ri6$&amGc.b;AG;7V3&GBWhAAX1IB;S:1!6G'uTEjSUP=ww$bRbHOM">here</a>
Go2Net Step 2 - Redirect to Google
GET /search/id?pos=1&ppos=1&plnks=5&uplnks=0&cat=web&cid=245874&site=srch&area=srch.comm.gsl_paid&shape=textlink&cp=websrch.gpdxml.ch9&cluster-click=0&pd=1&coll=1&query=car+rental&qq=N&NT43J2$w.@UBaoE2a_Fg43zqVPaQyD!m;F$gUeKjG@EvWjU:rjNMFS.sz6@Rz$$YHOoU;nPgI_Nnu,He2-1NEhlSEl$s;yIBi1OlU_Pun;A9RxmnoN+Rr:P52hO'y$d0$_:1!q'T'B!OE6b0LP9AQ9bu5Zug4IS:xL95q9$s0c+3_Ri6$&amGc.b;AG;7V3&GBWhAAX1IB;S:1!6G'uTEjSUP=ww$bRbHOM
HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash,
*/*
Referer: http://www.websearch.com/search/results.aspx?qkw=car%20rental&tbid=50252
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Cookie: p_go2id=PXLUpRp9rtByLQVFMRt9IA; s_go2id=PXLUpRp9rtByLQVFMRt9IA
Connection: Keep-Alive
Host: clickit.go2net.com
HTTP/1.1 302 Found
Date: Sat, 04 Jun 2005 03:31:18 GMT
Server: Apache/1.3.12 (Unix) Resin/2.1.2
Cache-Control: private
Location: http://www.google.com/url?sa=l&q=http://www.orbitz.com/App/DisplayCarSearch%3Fsemsource%3Dgoog%26semkeyword%3Dcar%2Brental&ai=BaxexdyChQr_pGs72YOrp0LkNkaKDB_u4yZIBxc2YBaCOWRABGAEgqPb0ASgKSIs5qgEDY2g5yAEB6AEB&num=1
Content-Length: 251
Connection: close
Content-Type: text/plain; charset=iso-8859-1
The URL has moved <a href="http://www.google.com/url?sa=l&q=http://www.orbitz.com/App/DisplayCarSearch%3Fsemsource%3Dgoog%26semkeyword%3Dcar%2Brental&ai=BaxexdyChQr_pGs72YOrp0LkNkaKDB_u4yZIBxc2YBaCOWRABGAEgqPb0ASgKSIs5qgEDY2g5yAEB6AEB&num=1">here</a>
Google Step 1 - Redirect to Other Google Page
GET /url?sa=l&q=http://www.orbitz.com/App/DisplayCarSearch%3Fsemsource%3Dgoog%26semkeyword%3Dcar%2Brental&ai=BaxexdyChQr_pGs72YOrp0LkNkaKDB_u4yZIBxc2YBaCOWRABGAEgqPb0ASgKSIs5qgEDY2g5yAEB6AEB&num=1
HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash,
*/*
Referer: http://www.websearch.com/search/results.aspx?qkw=car%20rental&tbid=50252
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Connection: Keep-Alive
Host: www.google.com
HTTP/1.1 302 Found
Cache-Control: private
Location: http://www.google.com/url?q=http://www.orbitz.com/App/DisplayCarSearch%3Fsemsource%3Dgoog%26semkeyword%3Dcar%2Brental&sa=L&ai=BaxexdyChQr_pGs72YOrp0LkNkaKDB_u4yZIBxc2YBaCOWRABGAEgqPb0ASgKSIs5qgEDY2g5yAEB6AEB&client=
Set-Cookie: PREF=ID=167ffff4031fce43:TM=1117855878:LM=1117855878:S=ME98O37wUR_lZpod;
expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com
Content-Type: text/html
Server: GWS/2.1
Transfer-Encoding: chunked
Content-Encoding: gzip
Date: Sat, 04 Jun 2005 03:31:18 GMT
<HTML><HEAD><TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.google.com/url?q=http://www.orbitz.com/App/DisplayCarSearch%3Fsemsource%3Dgoog%26semkeyword%3Dcar%2Brental&sa=L&ai=BaxexdyChQr_pGs72YOrp0LkNkaKDB_u4yZIBxc2YBaCOWRABGAEgqPb0ASgKSIs5qgEDY2g5yAEB6AEB&client=">here</A>.
</BODY></HTML>
Google Step 2 - Redirect to Orbitz
GET /url?q=http://www.orbitz.com/App/DisplayCarSearch%3Fsemsource%3Dgoog%26semkeyword%3Dcar%2Brental&sa=L&ai=BaxexdyChQr_pGs72YOrp0LkNkaKDB_u4yZIBxc2YBaCOWRABGAEgqPb0ASgKSIs5qgEDY2g5yAEB6AEB&client=
HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash,
*/*
Referer: http://www.websearch.com/search/results.aspx?qkw=car%20rental&tbid=50252
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Connection: Keep-Alive
Host: www.google.com
Cookie: PREF=ID=167ffff4031fce43:TM=1117855878:LM=1117855878:S=ME98O37wUR_lZpod
HTTP/1.1 302 Found
Location: http://www.orbitz.com/App/DisplayCarSearch?semsource=goog&semkeyword=car+rental
Cache-Control: private
Content-Type: text/html
Server: GWS/2.1
Transfer-Encoding: chunked
Content-Encoding: gzip
Date: Sat, 04 Jun 2005 03:31:18 GMT