Photosnag.com? What is it?

[aram535]

Has anyone noticed that you get a clear.gif inserted in some comments by people?

For example:

"nice shots, thanks for the shareImage: h.t.t.p.://photosnag.com/img/3322/n09x0302vnsn/clear.gif"

What is photosnag.com and why is it getting inserted into the comments? Obviously it's tracking, but what is the question.

Whois is saying that enom.com is the owner, and that seems to be a domain registration site.

[Rense]

Yes I have noticed it. I'm tracking it now.

[swampler]

Usually a clear gif file is used to prevent people from right clicking an image and saving it to their hard drives. Or, perhaps in this case, to keep people from hot linking to an online image?

[aram535]

Nah, this is a 1x1 image. I'm 100% sure that its for tracking. What for, and whom is a different story.

[SyCo]

Here the whois for the doman.

WHOIS information for photosnag.com :
[Querying whois.internic.net]
[Redirected to whois.enom.com]
[Querying whois.enom.com]
[whois.enom.com]
=-=-=-=
Visit AboutUs.org for more information about photosnag.com

Registration Service Provided By: Online Marketing Investments
Contact: ceo@omitraffic.com

Domain name: photosnag.com

Registrant Contact:
OMI
OM I ()

Fax:
POBox 224
Oxford, MS 38655
US

Administrative Contact:
OMI
OM I (omitraffic@gmail.com)
+1.6628015828
Fax:
POBox224
Oxford, MS 38655
US

Technical Contact:
OMI
OM I (omitraffic@gmail.com)
+1.6628015828
Fax:
POBox224
Oxford, MS 38655
US

Status: Locked

Name Servers:
ns1.hawkhost.com
ns2.hawkhost.com

Creation date: 17 Jun 2006 20:10:51
Expiration date: 17 Jun 2010 20:10:00

Here's there address
Investing Online, Investing Online Companies at b2bYellowpages.com.
Online Marketing Investments Inc
128 Garden Terrace, Oxford, MS, 38655
(662) 801 -5828
Email: omitraffic@gmail.com
(662) 801-5828

[aram535]

Thanks for the whois, and the agency.

It actually looks like the poster was hacked or is using an infected browser.

It's used as "Cookie Stuffing". If you're using a old browser, they can read in your cookies from other sites. It also can be used to force-click ads and such from usually adult oriented websites. I highly suggest the Mods take a look at it and see if they can auto-block them or remove the [ img ] tags from them.

I've added a block to my ABP software so that it auto block them.

[SyCo]

No problem, it only took a minute. Thanks for the info.

[Rense]

Originally Posted by aram535

Thanks for the whois, and the agency.

It actually looks like the poster was hacked or is using an infected browser.

It's used as "Cookie Stuffing". If you're using a old browser, they can read in your cookies from other sites. It also can be used to force-click ads and such from usually adult oriented websites. I highly suggest the Mods take a look at it and see if they can auto-block them or remove the [ img ] tags from them.

I've added a block to my ABP software so that it auto block them.

The mods are already looking in to it.

BTW: the best way to get attention of a mod is to report (the original) post by using the red triangle button (report post) on the left of the posting.