Thousands of posts on many forums linking to snagpic.com "clear.gif" -

[Azonaco]

I'm alerting webmaster's to a potentially harmful practice that I found on my forum this evening.

A forum member of mine posted the following picture,

http://www.snagpic.com/users/img/4092/n09x0302vnsn/clear.gif

which is practically impossible to see. I only noticed it after quoting the member in a response in which the forum placed the pic within my post too.

So. What exactly is it? I've searched the net and have yet to find any real discussions about it. Shockingly, I've found upwards of maybe thousands of posts on different forums with it too.

Is it some form of cookie stuffing?

[Brian Cummiskey]

I opened up the gif in a text editor

Looks like a plain old blank gif with nothing harmful in it. It it were, it would contain a LOT more characters of data.
It only has 1 line and about 30 chars of data in it. the default vb clear.gif is nearly identical in ascii mode.

but, that doesn't mean they can't change the image later.

All the posts on google tend to look like spam posts anyway. Just keep up with your spam and useless replies from 1-3 post members. Don't be scared to give them the ban.

[Azonaco]

Thanks Brian. Thought it was alarming with just how many of those links were planted on other forums. I spent some more time last night looking up info, etc. on cookie stuffing; there are vids on youtube and forums dedicated to instructing people how to do it and "get away with it". I'm in the process of adding a few notes in my user registration agreement.....

[Ace Shattock]

This is a handy tool to check if there is cookie stuffing going on: Check Server Headers Tool - HTTP Status Codes Checker

If it redirects, you will be able to see where it redirects to.

Something to bear in mind, if that member comes back later and adds a redirect to the image it can be nasty. Just because it is benign now doesn't mean it won't be made malicious later.