anonumos
@insightbb.com
| reply to eric726
Re: [Other] Insight is Injecting Pop Up Ads into customer web se
uhmmm....the cache1.insightbb.com tells me that it's being cached in insight's dns servers, not injected into your browser session. Sounds to me like you've got some spyware on your computer, and want to place the blame elsewhere.
change your dns servers, and you will find no reference to insight at all. |
|
eric726
join:2009-04-29 | Re: [Other] Insight is Injecting Pop Up Ads into customer web se
This has also been tested with a Knoppix boot CD and multiple systems. I have packet dumps of all sessions and proof that this is ad injection. |
|
eric726
join:2009-04-29
| If you would like to see some of the other great Netflix ads that Insight is sending out to their customers see these links:
»b.casalemedia.com/V2/67739/130838/index.html
»b.casalemedia.com/V2/67739/130837/index.html
»b.casalemedia.com/V2/67739/130839/index.html
Insight DNS servers are resolving b.casalemedia.com as:
74.128.17.203
74.128.17.201
Both are Insight owned IP addresses. Both of these IP addresses are Akamai ghost/mirror servers. |
|
eric726
join:2009-04-29
| reply to anonumos
said by anonumos :
uhmmm....the cache1.insightbb.com tells me that it's being cached in insight's dns servers, not injected into your browser session. Sounds to me like you've got some spyware on your computer, and want to place the blame elsewhere.
change your dns servers, and you will find no reference to insight at all.
This has nothing to do with being cached in a DNS server. Insight Communication's DNS servers are resolving b.casalemedia.com to two servers under their control. This is where the ads are coming from. Anyone on the Louisville Insight network has the ability to do an nslookup on b.casalemedia.com and see the results for themselves. The IP addresses that this hostname resolves to is what is being used to inject the ads. |
|
Captain_S
join:2008-05-16
Lexington, KY
| I'm not an Insight customer, did the nslookup for b.casalemedia.com and it resolved to 64.213.163.83. Not an Insight owned IP.
Have a look for yourself:
»whois.domaintools.com/64.213.163.83
Insight is not generating this activity. Probably the sites you're surfing to that are dropping pop-unders. |
|
eric726
join:2009-04-29
| Do you guys not understand what I'm saying here?
Insight Communications (cable ISP) is wanting to inject popups into HTTP data. So what they do is install these Akamai devices to serve out the HTML popup ads. They make a change in their DNS servers so that b.casalemedia.com resolves to this server which lives in their datacenter. Of course it has to be THEIR ip address. Look at my nslookups in the picture attached to the first message. This was an nslookup on Insight Communication's DNS server. So that means THEIR DNS server is answering requests for b.casalemedia.com and resolving it to 74.128.17.201 and 74.17.203. So now the ad doesn't look like its going to insight. They do this to mask where the ad is coming from.
I'm getting these DNS servers via DHCP of course. My primary DNS server is 74.128.17.114 and my secondary DNS server is 74.128.19.102.
Here are the results of nslookups to each DNS server:
******************
C:\nslookup b.casalemedia.com 74.128.17.114
Server: cache1.insightbb.com
Address: 74.128.17.114
Non-authoritative answer:
Name: a1083.g.akamai.net
Addresses: 74.128.17.203
74.128.17.201
Aliases: b.casalemedia.com
b.casalemedia.com.edgesuite.net
**********************
C:\nslookup b.casalemedia.com 74.128.19.102
Server: cache2.insightbb.com
Address: 74.128.19.102
Non-authoritative answer:
Name: a1083.g.akamai.net
Addresses: 74.128.17.203
74.128.17.201
Aliases: b.casalemedia.com
b.casalemedia.com.edgesuite.net
***********************
Of course your DNS servers are not going to resolve an Insight address to this hostname. This is a change that Insight has made in THEIR DNS servers. |
|
eric726
join:2009-04-29
1 edit | When you click on the pop up ad itself you go to:
»c.casalemedia.com/c/1/1/67739/aH···Y3QvMDEv
c.casalemedia.com also resolves to an Insight Communications address:
************************
C:\nslookup c.casalemedia.com
Server: cache1.insightbb.com
Address: 74.128.17.114
Non-authoritative answer:
Name: a1195.g.akamai.net
Addresses: 74.128.17.241
74.128.17.211
Aliases: c.casalemedia.com
c.casalemedia.com.edgesuite.net
*************************
So the solution here is to either add a entry into your hosts file to point b.casalemedia.com and c.casalemedia.com to 127.0.0.1 so you will not see the data or you can use recursive DNS servers that do not belong to Insight. Either one will block these pop ups from your system. |
|
N4AOF
join:2009-04-01
Louisville, KY
 ·Insight VOIP
| reply to eric726
said by eric726  :Do you guys not understand what I'm saying here? Yawn -- Do you not understand what everyone else is saying? No one else is seeing this problem. I use Insight continuously in the Louisville area and have never seen the problem you claim -- although I can't say that I would care if it did happen.
casalemedia is nothing but a popup ad service used my numerous websites, so if Insight were substituting their choice of stupid popup ad instead of the website's choice of stupid popup ad, I don't see that as a problem for the consumer (although I can see where casalemedia might care). |
|
