14,000+ Uniques per DAY, 404 Error Traffic

[Blarian]

Currently taking offers

The URL is http://www.sweetestlife.biz

Traffic screenshots:
http://uploadhut.com/view.php/55675.jpg
http://uploadhut.com/view.php/55680.jpg
http://uploadhut.com/view.php/55682.jpg

17th through 22nd the domain was set to the current nameservers full-time. Stats update around 1am the following day, so todays traffic for 3/23 for example has not been calculated yet.

The domain appears to have been used in the past by a trojan of some kind.. I found a MCAFEE page that lists a trojan with this domain name.

The domain receives an average of over 14,000 uniques per day as shown through my webalizer stats. BARE MINIMUM daily coversion should you decide to monetize this traffic as opposed to offering a free Trojan removal resource. 1,000 uniques earns $3 on services such as Trafficz (CTR tests were done last week and the rate is too low to earn through services which pay based on per click, maybe somebody with a bigger portfolio can get better rates.) That in mind, 1 year revenue would be $15,330 per year. This is of course BARE MINIMUM monetization that can be accomplished with this domain name.

This is a very nice "sit back, do nothing, earn $15k+ per year" domain :-D

Your offers, questions and comments are welcome via PM.

[Blarian]

Still accepting offers on this one. Nothing tempting yet ;-)

[GT Web]

stats link doesnt work

[lindmar]

where does all this traffic come from?

[acronym007]

stat links still do not work. All links point to website, not stats.

[lindmar]

Does this have anything to do with the traffic?
Is all this traffic generated by a massive virus?

This detection is for malware intended to serve as a proxy on the victim machine. Once running the infected host may be used as an email relay, which is likely to be used for routing spam messages.

It is probable that this trojan is related to Proxy-Regate .

When run on the victim machine, a notification is sent to the hacker via HTTP. For this, a script on one of the following remote servers is used:

* www.sweetestlife.biz
* makeyrday.biz
* b00sterpac.biz

I know the seller originally said its been associated with a virus.. Does this just mean that the 14,000 hits per day are coming from infected computer.. Therefore, you have no chance of getting both clicks or any type of revenue from these visits?

[Blarian]

Nameservers have been on lease, forgot to update post. Links are now updated in original post - domain still available.

Yes, the domain appears to be associated with a Trojan of some kind. Before the nameserver change there was a removal page on the domains index page with the information you just posted Lindmar.

The bare minimum this domain can earn is $3 per 1,000 uniques. The CTR is under a few %, my theory is that the people visiting the domain are obviously aware that there is a Trojan and they don't click around to find out if they are going to be infected further ;-) That's why it needs to be monetized based on something other than clicks, like unique impressions...

Feel free to PM me with further questions.

[lindmar]

I see, I guess I just dont understand.. I'm new to this but to me its like a sham, right , its basically fake traffic and I dont know if even youd get 1% of a CTR, most people would just close the window automatically..

again, im just trying to understand (if anything I am interested and curious) not impying anything but why then have you not been making the minimum $3 dollars which is 60 bucks a day in your case?

[Blarian]

again, im just trying to understand (if anything I am interested and curious) not impying anything but why then have you not been making the minimum $3 dollars which is 60 bucks a day in your case?

If you read my post, I said that the nameservers are on lease. If you don't know what that means, it means that the traffic is going to someone else, who can make more than $3 per 1,000 off of it. The $3 per 1,000 uniques is a an extremely low way to profit off of 1,000 unique impressions x 14 per day.. which would make you a bare minimum of $15,000 per year. NOW, if you had a large portfolio your ad company would offer you a whole lot more than $3 per 1,000 unique impressions.... Look into the service at www.Trafficz.com and maybe that will help you understand what I'm talking about as far as monetization goes.

Note: This is REAL traffic.

[lindmar]

Thank-you

[Blarian]

Welcome :-D

[Blarian]

Still accepting offers, although I'm considering keeping this name for myself

PM me if you would like to talk details.

[Blarian]

A few mid $x,xxx offers on the table, looking for a bit more. PM me for more info!

[octobus]

I've read quite a but about the trojan. My understanding is that, although the trojan's HTTP queries show as unique visits, no human sees an actual webpage. The trojan only uses the HTTP protocol to communicate with the master who uses those domains as "beacons" so to say.

[GT Web]

this could get interesting...

[MediaHound]

whats the url to the file its calling, (x out the domain)

[lindmar]

whats the url to the file its calling, (x out the domain)

what do you mean by this?

[MediaHound]

what file is being called
in other words
http://x.com/my%20trojan/fu.js
or
http://x.com/my%20trojan/fu.html
or
http://x.com/my%20trojan/fu.cfm
etc

whats the url to the file it's calling?

[Blarian]

I've read quite a but about the trojan. My understanding is that, although the trojan's HTTP queries show as unique visits, no human sees an actual webpage. The trojan only uses the HTTP protocol to communicate with the master who uses those domains as "beacons" so to say.

The traffic is genuine unique visitors.

PM me if you would like to talk about further traffic details.

[Bob]

I've read quite a but about the trojan. My understanding is that, although the trojan's HTTP queries show as unique visits, no human sees an actual webpage. The trojan only uses the HTTP protocol to communicate with the master who uses those domains as "beacons" so to say.

Uh-huh. I did research on this about 4 weeks ago. I really don't think there is a way to convert any traffic. There are no pages being displayed. Computers that are infected with the virus communicate the the domain via an HTTP Post to a specific file on the server. The server recorded whatever details it was supposed to, and that was the end of the communication.

This file on the server will obviously not output anything to the infected computer.

-Bob