[Dynamoo]

I spotted something off in Alexa's movers and shakers table - a domain called Advnt01.com, traffic rank 378, but with a site that appears to be blank.

A little digging around comes up with a network of sites, with a very high reach per million each:

Advnt01.com - 3,350
Advnt03.com - 95
Advnt05.com - 1,010

I don't know if adding them together is meaningful, but that gives a reach of 0.45% of all machines in the world visiting these sites.

These seem to belong to an ad network called 7AdPower. A bit of Googling shows a lot of dialer related activing and some sort of BHO generating popups.

That's a lot of activity.. but I've never heard of them. Anyone else?

[bedelman]

I searched my network logs, which report URLs requested in various of my spyware testing (mostly testing of security exploits). I see some traffic going to advnt0_.com in several rounds of testing I did last month. Nothing good. For example, I see them receiving traffic from folks called azebar.com. Looks like they're then sending the traffic on to paypopup.com. From there, hard to say.

I have video and packet log proof on file, showing traffic to this network originating in ways that don't entail meaningful user consent.

[Rhea]

http://groups.google.com/groups?hl=en&q=Advnt01
http://groups.google.com/groups?hl=en&q=Advnt02
http://groups.google.com/groups?hl=en&q=Advnt04
http://groups.google.com/groups?hl=en&q=Advnt05

Lots of mentions in Google Groups virus forums.

[Dynamoo]

When I checked out the 7AdPower.com site, it hadn't been updated since 2003. That part of the operation looks pretty dormant.

However, if we say that they've got a reach of 4,500 per million, then look at the Alexa stats for Paypopup.com, we can see that Paypopup.com has a reach of only 5,600 per million.

So, allowing a wide margin for statistical error, Paypopup.com is getting perhaps 60%-80% of its traffic through the 7AdPower servers? OK, it's not a smoking gun, but it's interesting.

Paypopup.com is owned by yesup.net who also run popinads.com. They've been linked with the Pugi/WhyPPC and FavoriteMan parasites.

I wonder what kind of relationship 7AdPower have then.. an affiliate of Paypopup.com perhaps?

[bedelman]

I wonder what kind of relationship 7AdPower have then.. an affiliate of Paypopup.com perhaps?

I'd say that's consistent with what I observed and recorded. Hard to know for sure.