Sponsors please STOP this THEFT (part#1) - Page 3 - GoFuckYourself.com

RawAlex · 05-16-2006, 02:15 PM

I could every banner view and every outgoing click on every site I own. I know exact ratios, locations, etc. I compare this data regularly to what the sponsors report as traffic, and look for major discrepancies.

I do also randomly click sponsor links on my sites and follow them right through to the signup page, checking to see if there is a cookie or other infomation set that says my referal code is still in effect.

Between hackers and 30 day cookies, there are some pretty bad things going on out there right now. I hope the sponsors clue in to the amount of theiving, stealing, and copyright violation that some sites and "webmasters" are doing to make money, and take action to terminate these accounts (and show an account terminated screen, not just quietly passing the traffic and "not paying")

Ale

JD · 05-16-2006, 02:16 PM

100 assholes

edit: fack...101

David - PG · 05-16-2006, 02:48 PM

You're ever more paranoid than the rest of the poeple in this thread.

Quote:

Originally Posted by Kimmykim

Yep, there's the best idea yet. Give all the would-be idiots that haven't figured out how to do it a good example of what does work.

Wow.

KrisKross · 05-16-2006, 02:48 PM

Quote:

Originally Posted by David - PG

I take it 75% of the Internet is infected with this type of trojan horses? C'mon, please.

Have you ever sat down on a computer used by someone who isn't internet/tech savvy? Seventy-five percent may be a little high, but there are certainly a considerably significant amount of computers infected by some sort of spyware.

The majority of surfers out there use IE and only a small portion of those consistantly run Windows Updates and apply security patches.

David - PG · 05-16-2006, 02:51 PM

Quote:

Originally Posted by KrisKross

Have you ever sat down on a computer used by someone who isn't internet/tech savvy?

Whoever thinks 75% of his sales are being diverted or "rewritten" by Trojans is either joking or compeletely delusional.

--MARIAN-- · 05-16-2006, 02:58 PM

Quote:

Originally Posted by David - PG

Whoever thinks 75% of his sales are being diverted or "rewritten" by Trojans is either joking or compeletely delusional.

Does it make a difference if it's 75, 50, 25, 5? I mean, seriously, how much should the affiliates lose before the sponsors step-in to make the required changes?

We all know that spyware is everywhere around the internet. Of course, no one can tell how much of it is used to steal signups. My point is that some action must be taken before this becomes a really big problem.

Sponsors (still) need affiliates. You give us everything - content, hosting, marketing tools, etc. What's the big deal about protecting our sales from getting stolen?

tranza · 05-16-2006, 03:00 PM

Do you really think big sponsors care? They are getting their sales anyway....

Matt-RevShare · 05-16-2006, 03:01 PM

I do believe most sponsors DO care about this problem and threads like this help to elevate the visibility of theft in general.

Like WG said, I dicussed ratios and theft with everyone I saw in Toronto. While this was not the theme of Webmaster Access, it certainly was the main topic of conversation with the people I talked to througout the weekend.

Like many of you, I have seen a general downward trend with many of my ratios and it just doesn't make sense outside of theft.

However, like David-PG and Jay-TCG said above, I don't truly understand the issue well enough to go to my programmers and say "fix".

Obviously, if this theft is as bad as everyone seems to say, then my webmasters (and me by proxy) are getting scammed out a lot of money so its worth investing in developing solutions, I just don't know where to begin.

So with heavy traffic guys like Wired Guy and Marian, and sponsors like Perfect Gonzo, TCG and Pimp Roll all agreeing that we have a common enemy, the next step seems to be a better understanding of what needs to be done.

Having read this whole thread, I am still unsure if there is a fix that us on the traffic generation side can do, or if this is something that only the programs can do (other than scrutinize new whales).

I am interested in helping stop this theft as its costing me and my webmasters big money, but where do we start???

Matt

AlienQ - BANNED FOR LIFE · 05-16-2006, 03:04 PM

Quote:

Originally Posted by Kimmykim

Yep, there's the best idea yet. Give all the would-be idiots that haven't figured out how to do it a good example of what does work.

Wow.

Holy cow...
I agree with you for once.

AlienQ - BANNED FOR LIFE · 05-16-2006, 03:06 PM

Just today we someone post stats...

1 in 34 while another other run around proudly showing 1 in 800...

So maybe 1 in 34 = Overall declines after the Affilaite ID swap for that credited ID, err....I mean traffic thief...

Go Fish!

KrisKross · 05-16-2006, 03:09 PM

Quote:

Originally Posted by David - PG

Whoever thinks 75% of his sales are being diverted or "rewritten" by Trojans is either joking or compeletely delusional.

I think --MARIAN-- is dead on. Does it matter what the percentage is? I'm not some big shot pulling in six figures. Even it was only 5%, I'd rather not lose it.

Where did the 75% figure come from anyways? I might be wrong, but it seems you pulled it from thin air.

David - PG · 05-16-2006, 03:14 PM

I'm saying there is no problem here until I see proof. Period.

You're asking the sponsors to "step in". Step into what? You're crying for the solution for an issue that is theoretical at best. Theoretical until I see proof. I monitor thousands of affiliates day in day out and have yet to discover anything suspicious that matches the description given.

But I understand people need a scapegoat to bash when sales are down for a week or two. So let's bash sponsors. From a strictly scientific point of view, lower sales can only (!) be explained from two angles

- Sponsors shaving
- Trojan horses redirecting traffic

So everybody chime in into the bashing and demand "Sponsors step up and do something, quickly!". Nothing will happen because there is no issue at hand. In two weeks you will have forgotten this thread.

Okay, enough sarcasm.

Sorry but that's the truth, but then again, maybe I am completely wrong. At this point in time with the numbers I see there is not the slightest reason to panic. Send me proof or at least a little idea of it, and we will put resources (programmers, network engineers) to work.

Good night.

Quote:

Originally Posted by --MARIAN--

Does it make a difference if it's 75, 50, 25, 5? I mean, seriously, how much should the affiliates lose before the sponsors step-in to make the required changes?

We all know that spyware is everywhere around the internet. Of course, no one can tell how much of it is used to steal signups. My point is that some action must be taken before this becomes a really big problem.

Sponsors (still) need affiliates. You give us everything - content, hosting, marketing tools, etc. What's the big deal about protecting our sales from getting stolen?

David - PG · 05-16-2006, 03:15 PM

Nope, I didn't.

Quote:

Originally Posted by KrisKross

I might be wrong, but it seems you pulled it from thin air.

--MARIAN-- · 05-16-2006, 03:32 PM

Quote:

Originally Posted by David - PG

I'm saying there is no problem here until I see proof. Period.

You're asking the sponsors to "step in". Step into what? You're crying for the solution for an issue that is theoretical at best. Theoretical until I see proof. I monitor thousands of affiliates day in day out and have yet to discover anything suspicious that matches the description given.

But I understand people need a scapegoat to bash when sales are down for a week or two. So let's bash sponsors. From a strictly scientific point of view, lower sales can only (!) be explained from two angles

- Sponsors shaving
- Trojan horses redirecting traffic

So everybody chime in into the bashing and demand "Sponsors step up and do something, quickly!". Nothing will happen because there is no issue at hand. In two weeks you will have forgotten this thread.

Okay, enough sarcasm.

Sorry but that's the truth, but then again, maybe I am completely wrong. At this point in time with the numbers I see there is not the slightest reason to panic. Send me proof or at least a little idea of it, and we will put resources (programmers, network engineers) to work.

Good night.

I don't see anyone crying, I see people discussing a potential problem.

Some may be looking for a scapegoat; I'm looking into a reasonable explanation why are sales steadily declining since january. And it's not just me, trust me.

Also, what are we left with but speculating? All you can hear is "Sales have hit the sky! We're having the best month ever! Nothing wrong with us!" and "All sales are processed normally, there's nothing on our end, if you have a problem logging in - contact us", etc.

So, unless you have something useful to add to the discussion, I'd suggest that you go and monitor another 1,000 affiliates and skip on the sarcastic comments.

David - PG · 05-16-2006, 03:50 PM

Quote:

Originally Posted by --MARIAN--

I'm looking into a reasonable explanation why are sales steadily declining since january.

Let's see.

Higher gas prices? Lower consumer confidence? Housing prices coming down gradually? Rising interest rates? Stagnating stock & mutual fund evaluations? Sorry for trying to make some sense here. It's more fun to bash sponsors though.

Quote:

Originally Posted by --MARIAN--

"Sales have hit the sky! We're having the best month ever!

I never posted any garbage even close to that, ever.

The Sultan Of Smut · 05-16-2006, 04:12 PM

Another kick ass post Smokey!

--MARIAN-- · 05-16-2006, 04:21 PM

Quote:

Originally Posted by David - PG

Let's see.

Higher gas prices? Lower consumer confidence? Housing prices coming down gradually? Rising interest rates? Stagnating stock & mutual fund evaluations? Sorry for trying to make some sense here. It's more fun to bash sponsors though.

I never posted any garbage even close to that, ever.

I never said you did but take a look around and see what most sponsors claim in each "sales are down" thread.

WiredGuy · 05-16-2006, 04:33 PM

Ok, so I see a lot of webmasters are in agreement here and from the conversations I've had with program owners and reps, they're noticing similiar trends. So to me, I'm seeing one of two issues, processing or some sort of hijacking going on. I tend not to believe its a processing issue since this has been ongoing for nearly 3 months now and I doubt either processor would put their scrubs like this kind of radical ratios, so the only other case I can think of, is some sort of hijacking. If this is the case, then these joins are going somewhere, there should be some sort of whales who are immensely profiting from any hijacking who is going on, so it shouldn't be hard to find their accounts??
WG

KrisKross · 05-16-2006, 04:33 PM

Quote:

Originally Posted by David - PG

Let's see.

Higher gas prices? Lower consumer confidence? Housing prices coming down gradually? Rising interest rates? Stagnating stock & mutual fund evaluations? Sorry for trying to make some sense here. It's more fun to bash sponsors though.

Who's looking for a scapegoat now? While we're at it, let's blame the nice weather, the weekend, spring break, the summer slowdown, Christmas credit card bills and the start of the new school year.

No one is bashing sponsors. And no one is bashing Perfect Gonzo, so drop your guard a little. Are you really denying the spyware epidemic that has hit the internet in the last couple of years? The scenario described by Smokey is entirely feasible, and the only way to effectively curtail it is on at the affiliate program level. I'd love to hear you argue otherwise, from a technical aspect.

I'm no programming wiz, but the methods suggested to help prevent this are far from being unreasonable or resource-heavy. We're talking maybe a few hours of programming work and an extra hour or two of manual inspection. Worst case scenario, you find no problem, end up short a couple of hundred dollars, but you increase the trust and respect your affiliates have in your program, as well as attract some new affiliates. Or, your discover the issue is rather serious, help catch or inhibit a thief or two, and again increase the trust and respect your affiliates have in you. And this doesn't just apply to PG, but to any programs out there.

SmokeyTheBear · 05-16-2006, 04:39 PM

Quote:

Originally Posted by WiredGuy

Ok, so I see a lot of webmasters are in agreement here and from the conversations I've had with program owners and reps, they're noticing similiar trends. So to me, I'm seeing one of two issues, processing or some sort of hijacking going on. I tend not to believe its a processing issue since this has been ongoing for nearly 3 months now and I doubt either processor would put their scrubs like this kind of radical ratios, so the only other case I can think of, is some sort of hijacking. If this is the case, then these joins are going somewhere, there should be some sort of whales who are immensely profiting from any hijacking who is going on, so it shouldn't be hard to find their accounts??
WG

just a little sleuthing on the backend , and some guts.. like i said i think the biggest problem is when sponsor dont wanna question the whales because it means a loss in sales ( and sometimes they dont realise it wont mean a loss in sales , just a decrease in the amount of "skimmed" sales to that whale )

( p.s. kind of like the wildline thing , although diff topic)

V_RocKs · 05-16-2006, 05:41 PM

Quote:

Originally Posted by WiredGuy

Ok, so I see a lot of webmasters are in agreement here and from the conversations I've had with program owners and reps, they're noticing similiar trends. So to me, I'm seeing one of two issues, processing or some sort of hijacking going on. I tend not to believe its a processing issue since this has been ongoing for nearly 3 months now and I doubt either processor would put their scrubs like this kind of radical ratios, so the only other case I can think of, is some sort of hijacking. If this is the case, then these joins are going somewhere, there should be some sort of whales who are immensely profiting from any hijacking who is going on, so it shouldn't be hard to find their accounts??
WG

Or you are seeing $25K less a month because I am here?

I agree that there is something going on but I think you guys are blowing the scope of its success way out of proportion... Needless to say, we do need to nip it in the butt now before it gets as big as your guys are thinking it is.

What should happen to a whales account when it turns out they are a hijacker? It should be posted to boards so others know to cancel it. The money should be disbursed to affiliates by adding their total sales for the period the hijacker was working and dividing it by their percentage of total sales.

WiredGuy · 05-16-2006, 05:47 PM

Quote:

Originally Posted by SmokeyTheBear

just a little sleuthing on the backend , and some guts.. like i said i think the biggest problem is when sponsor dont wanna question the whales because it means a loss in sales ( and sometimes they dont realise it wont mean a loss in sales , just a decrease in the amount of "skimmed" sales to that whale )

( p.s. kind of like the wildline thing , although diff topic)

If you have any proof of this, please do send it to me (especially if it involves TCG). 3 months of income being shaved adds up to a very substancial amount and based on previous months income, I'd venture a guess its in the high 5 figures already. So if you really do have any kind of proof (even if the sponsors know about it), please do contact me. I'd love to look it over.

WG

WiredGuy · 05-16-2006, 05:49 PM

Quote:

Originally Posted by V_RocKs

Or you are seeing $25K less a month because I am here?

I agree that there is something going on but I think you guys are blowing the scope of its success way out of proportion... Needless to say, we do need to nip it in the butt now before it gets as big as your guys are thinking it is.

What should happen to a whales account when it turns out they are a hijacker? It should be posted to boards so others know to cancel it. The money should be disbursed to affiliates by adding their total sales for the period the hijacker was working and dividing it by their percentage of total sales.

Account termination I'd say is number one priority. The next part is rather tricky, I'd say hopefully based on referral information they can credit the joins back to the webmaster who made the sale (most of them). This can be a bitch I admit it, but I definitely want any hijackers incomes to be halted.
WG

Trixxxia · 05-16-2006, 05:59 PM

Ok I had written a whole page of theories as soon as this thread yesterday but needed more responses from others to confirm some things.

I'm not so sure any of us think it's a new problem. The *new* edge is that this new generation of hijackers are agressive. I believe it's some type of hijacking software/toolbar/adware/scumware.

I've personally noticed awkward differences on my own sites/SE listings/PPC Campaigns in January. If we take notice, a surge in threads/complaints/overall discussions started showing up end of January. February calmed down & was a little better and then March was hard & April wasn't much better - this is overall sponsors/billers/complaints - not confined to one sponsor or biller - more geared towards the straight sites though.

How they *possibly* did it:
My uneducated theory is that it was installed on alot of computers when the adult SERPS were hijacked with non-relevant results - stuff was installed on alot of computers. On or around the time the surge in complaints started showing up in threads (February), the SEs results in adult were practically taken over - most of the SE guys noticed the first & sometimes second page results becoming totally irrelevant and spammy like never before.

1) So somehow, they got into SEs (google comes to mind) by getting PR 5-6-7 pages to link them via the server vulnerability - boosting their SE importance/value by getting the links from mainstream domains with high PR. (Findings mentioned in another thread on last week - I think the thread starter was someone by the name Reprobate if my memory serves me correctly)

2) Some of those results linked to 'real' pages, alot of them were redirecting directly to sponsors and yet others were leading to a trojan/spyware/scumware auto-install then redirecting to a real page - now most of us have some type of software blocking the stuff, but again, an uneducated guess would be *IF* 30-40% of computer users don't have computer protection - of the ones that do, a good percentage don't clean their computers often enough - of the ones that do clean them, they don't keep their Virus Scanners/Protection software up-to-date - so we have a problem with alot of users with infected computers.

3) Even if we report the links to the Search Engine, the damage is done already - the software/trojan/toolbar/scumware and whatever is sitting on the end user's computer & will redirect whenever they decide.

There was a pattern that I personally saw overall with all sponsors & have compared with a few others *big & small* - they all saw the same type of results - different results for straight/gay traffic though.

Why do I think it would be SE traffic primarily? Because if it wasn't, it would be more susceptible to chargebacks & credits and then it would be more noticeable via the sponsors - this way, they go virtually undetected. Also, I'm thinking it's not as noticeable because it's not done through one hijacker account only but through a web of a few/many at the sponsors so they go undetected.

First - we need to help sponsors find a solution by providing a valid copy of these scripts to send to the sponsors so they can have their people look at how it affects 'them' and perhaps to find a common denominator and be able to stop/track it beforehand.

Second - they got into surfers computers via SEs & continue to get in that way. We can all try adult keyword searches and look for them to track them down. If you have a computer that you can afford to get infected, let's let it download and get a copy so the experts can figure out what's it's doing and how it's doing it and perhaps find a vulnerability which prevents it from working. *you can also copy what your screen is doing via SNAGIT Video capture*

If the surfer doesn't have a clue about keeping their computers clean - then they are infected and don't know it. When they type in a keyword on a search engine, instead of going to the affiliate's link or the sponsor's link, it goes to the hijacker's id - a surfer wouldn't know the difference.

Another thing we can do is - cleaning it up - stop it by starting to do something to fight back by getting the word out and getting these surfers' computers clean and get them protected. Let's pull out a list of different solutions to common problems/virus scanners/trojan removers/toolbar removers and put a FPA between your disclaimer and your TGP/MGP/Hubs - put links in your member's areas, put posts in your blogs, if you do only SE work put a link to a reliable source - Let's get the VIRAL EFFECT TO WORK FOR US INSTEAD OF AGAINST US - it will only help your bottom line in the end.

Sorry for the length of the post

ddfGandalf · 05-16-2006, 06:19 PM

Well we only use ccbill in our program.

and ref codes look like http://refer..blahblah&HTML=http://w...=theirccbillid
(they have the raw click count from this, thats why we need the ccbill cookie too)

It will keep that ref while the visitor browses, and when he gets to the ccbill join page, we have it hardcoded like

input type=hidden name=ccbill_referer value="theirccbillid"

I think the hardcoded passed variable doesnt care with the cookie, so the outside hijack attempts can be lowered this way.

Quick Buck · 05-16-2006, 06:26 PM

i'd venture to guess that it's processor related. we see this trend on sites that are processed by 3rd parties but not on sites that we process in house.

Matt-RevShare · 05-16-2006, 07:25 PM

Quote:

Originally Posted by Quick Buck

i'd venture to guess that it's processor related. we see this trend on sites that are processed by 3rd parties but not on sites that we process in house.

I don't know, it seems so easy to just blame the processors. Plus when you see the trend over several months it doesn't seem to fit the typical blame the processor scenario.

I do think the more ideas that are put out the better we are all able to explore possibilities.

Matt

Quickdraw · 05-16-2006, 07:38 PM

Here is a link to one form of this practice. Mainstream, almost 2 years old, but applies to this I believe. I found it looking for something else, so thought I'd add the before I forgot
http://www.benedelman.org/spyware/18...le-072404.html

SmokeyTheBear · 05-16-2006, 07:54 PM

Quote:

Originally Posted by TopBucksTrixxxia

Ok I had written a whole page of theories as soon as this thread yesterday but needed more responses from others to confirm some things.

I'm not so sure any of us think it's a new problem. The *new* edge is that this new generation of hijackers are agressive. I believe it's some type of hijacking software/toolbar/adware/scumware.

I've personally noticed awkward differences on my own sites/SE listings/PPC Campaigns in January. If we take notice, a surge in threads/complaints/overall discussions started showing up end of January. February calmed down & was a little better and then March was hard & April wasn't much better - this is overall sponsors/billers/complaints - not confined to one sponsor or biller - more geared towards the straight sites though.

How they *possibly* did it:
My uneducated theory is that it was installed on alot of computers when the adult SERPS were hijacked with non-relevant results - stuff was installed on alot of computers. On or around the time the surge in complaints started showing up in threads (February), the SEs results in adult were practically taken over - most of the SE guys noticed the first & sometimes second page results becoming totally irrelevant and spammy like never before.

1) So somehow, they got into SEs (google comes to mind) by getting PR 5-6-7 pages to link them via the server vulnerability - boosting their SE importance/value by getting the links from mainstream domains with high PR. (Findings mentioned in another thread on last week - I think the thread starter was someone by the name Reprobate if my memory serves me correctly)

2) Some of those results linked to 'real' pages, alot of them were redirecting directly to sponsors and yet others were leading to a trojan/spyware/scumware auto-install then redirecting to a real page - now most of us have some type of software blocking the stuff, but again, an uneducated guess would be *IF* 30-40% of computer users don't have computer protection - of the ones that do, a good percentage don't clean their computers often enough - of the ones that do clean them, they don't keep their Virus Scanners/Protection software up-to-date - so we have a problem with alot of users with infected computers.

3) Even if we report the links to the Search Engine, the damage is done already - the software/trojan/toolbar/scumware and whatever is sitting on the end user's computer & will redirect whenever they decide.

There was a pattern that I personally saw overall with all sponsors & have compared with a few others *big & small* - they all saw the same type of results - different results for straight/gay traffic though.

Why do I think it would be SE traffic primarily? Because if it wasn't, it would be more susceptible to chargebacks & credits and then it would be more noticeable via the sponsors - this way, they go virtually undetected. Also, I'm thinking it's not as noticeable because it's not done through one hijacker account only but through a web of a few/many at the sponsors so they go undetected.

First - we need to help sponsors find a solution by providing a valid copy of these scripts to send to the sponsors so they can have their people look at how it affects 'them' and perhaps to find a common denominator and be able to stop/track it beforehand.

Second - they got into surfers computers via SEs & continue to get in that way. We can all try adult keyword searches and look for them to track them down. If you have a computer that you can afford to get infected, let's let it download and get a copy so the experts can figure out what's it's doing and how it's doing it and perhaps find a vulnerability which prevents it from working. *you can also copy what your screen is doing via SNAGIT Video capture*

If the surfer doesn't have a clue about keeping their computers clean - then they are infected and don't know it. When they type in a keyword on a search engine, instead of going to the affiliate's link or the sponsor's link, it goes to the hijacker's id - a surfer wouldn't know the difference.

Another thing we can do is - cleaning it up - stop it by starting to do something to fight back by getting the word out and getting these surfers' computers clean and get them protected. Let's pull out a list of different solutions to common problems/virus scanners/trojan removers/toolbar removers and put a FPA between your disclaimer and your TGP/MGP/Hubs - put links in your member's areas, put posts in your blogs, if you do only SE work put a link to a reliable source - Let's get the VIRAL EFFECT TO WORK FOR US INSTEAD OF AGAINST US - it will only help your bottom line in the end.

Sorry for the length of the post

everyone should pay close attetion here , i think trix , hit on some very valid and key points in this

Quickdraw · 05-16-2006, 08:05 PM

Smokey,
Do you have a list any other urls/info used in Iframes or javascript for planting virus?
Like these?
src="http:/ /traffsale .biz/dl/adv765.php" width=1 height=1>VIRUS--
src="http:/ /persikms .ho.com.ua/xinch/xinch.htm" width=1 height=1>VIRUS--
src="http:/ /traffbest .biz/dl/adv416.php" width=1 height=1>VIRUS--

If you do, swell, if not, no sweat. Thanks

natas · 05-16-2006, 08:34 PM

some great points being bought up in this thread.

mad kudos to Smokey and TopBucksTrixxxia

reynold · 05-16-2006, 10:36 PM

this thread is very interesting indeed and I've already bookmarked it.

AlienQ - BANNED FOR LIFE · 05-16-2006, 10:45 PM

Quote:

Originally Posted by ddfGandalf

Well we only use ccbill in our program.

and ref codes look like http://refer..blahblah&HTML=http://w...=theirccbillid
(they have the raw click count from this, thats why we need the ccbill cookie too)

It will keep that ref while the visitor browses, and when he gets to the ccbill join page, we have it hardcoded like

input type=hidden name=ccbill_referer value="theirccbillid"

I think the hardcoded passed variable doesnt care with the cookie, so the outside hijack attempts can be lowered this way.

Its the scumware that changes the AFF ID before the click even reaches the processor.

CLICK> Swap>Processor>Tour

In Another scenerio say a FHG.
Visitor comes to TGP.
Viewer clicks Gallery> Bang AFF ID swapped by Scum ware at the browser level.

AlienQ - BANNED FOR LIFE · 05-16-2006, 10:53 PM

Some can do it with Hardcode tracking as well via an browser app (Toolbar) or even an small background running application that quaries a server on the net holding a database of link string variables.

www.urlsite.com/TourID?ID=XXX&index.php

Bing swap...
Before the viewer even see's the tour he just clicked.

The stuff is not rocket science, it is tricky theoretically but really nothing will stop a starving russian coder.

AlienQ - BANNED FOR LIFE · 05-16-2006, 10:58 PM

SO when I see a sponsor talk about MAD ratio's some even like 1 in 30 overall for an affiliate I already know how it happened or at least can take a good guess, because nothing is that well targeted these days.

swami · 05-16-2006, 11:41 PM

Great Post By Topbucks Trixxxia

JD · 05-16-2006, 11:45 PM

Quote:

Originally Posted by AlienQ

SO when I see a sponsor talk about MAD ratio's some even like 1 in 30 overall for an affiliate I already know how it happened or at least can take a good guess, because nothing is that well targeted these days.

i'm 1:80ish with princess cameron. does that make me a swapper?

GoLiaT · 05-16-2006, 11:55 PM

seems impossible
i click the activate link and it says all is fine
but when i check back at page one it still say activate your card
am i missing something here ?

OG LennyT · 05-16-2006, 11:56 PM

Quote:

Originally Posted by SmokeyTheBear

Like if i had a whale who was stealing 10% of all my affiliates sales but i didnt realise that , all i would see is 400 sales going bye bye, when in reality they would just be credited to the real affiliates , and not vanish at all .

good words there

Troels · 05-17-2006, 12:22 AM

Haven't you picked up the constant bad board spam from some east europeans?

"We pay hi rate for iframe code" or something like that. Obviously they install some crap.
Contact them and dissect that code.

Troels · 05-17-2006, 12:26 AM

Go to hahahahahahahahahahahaha and search for "buy iframe traffic".

****
We buy iframe traffic for HI rates
Our price is 40 dollars for 1000 uniq installs.
You only need to write our short code on your page .
Weekly payments and online friendly support is guranteed.Good percent of installs.
Hit me up at icq 255584377 - for more info.
****

Troels · 05-17-2006, 12:27 AM

the hahaha is b0ardtrack3r

RawAlex · 05-17-2006, 12:32 AM

If any of you review galleries or free sites, you would know that most surfers are probalby no more than 2 clicks away from infection. Currently there is a program out there that let's affiliates distribute video clips for free, and they pay for every "install" (nice word of saying "infection")... it usually looks like an attempt to install a codec.

Probably 1 in 10 TGPs in the CJ community have a toolbar installer on them, and probably a solid 5-10% of all chat boards are running out of date software that can easily be hacked to add the code onto every page.

75% is probably a high infection rate, but amoungst non-technical "bought my computer at walmart" surfers, the infection rate is probably near to that.

The affiliate system is getting crushed.

Alex

Troels · 05-17-2006, 12:38 AM

There is one big se guy who sets my anti virus off everytime I hit his pages.
A search got me this url:
www.niigata-bandaijima.com/amateur.html
it redirects a couple of times to this url:
http://www.osee.net/1/enter.php?amateur
And all kinds of warnings are popping up.
The first URL probably won't redirect you unless you're coming from google or any of the other engines.
This guy is big. At least 100k SE surfers daily I would guess, probably alot more.

Troels · 05-17-2006, 12:46 AM

Yep it gives you a 404.
Go to google and search for this:
site:niigata-bandaijima.com + amateur
Have your anti-virus in order before you click a result.

germ · 05-17-2006, 01:56 AM

Quote:

Originally Posted by AlienQ

SO when I see a sponsor talk about MAD ratio's some even like 1 in 30 overall for an affiliate I already know how it happened or at least can take a good guess, because nothing is that well targeted these days.

ive had days with 1:30 or better ratios and ive never stolen a click in my life.

V_RocKs · 05-17-2006, 02:48 AM

The swapper ratios will be no different than anyone elses. They are not majically only swapping a buying surfer, they are swapping every surfer and then receiving signups from the entire set of traffic, just like a real affiliate.

So ratios won't work.

Talking to surfers won't work... they are sheep and lazy sheep at that.

How many fucking whales do most programs have? 10? 20? 50?

If you have 1 whale out of 30 whales and the other 29 are Sleazy, WiredGuy, etc, I think the outstanding Russian with Igor Yavstrinski would look pretty fucking obvious... Especially if you went to his homepage and alexa'ed it and saw that it gets 2K in traffic... And then you noticed his referrer log is full of Sleazy and Wired Guy's websites... yeah... it'd be pretty fucking obvious...

So I think the real question is why aren't sponsors doing a fucking thing about it? Because just like surfers they are sheep and lazy ones at that... They really don't feel like lifting a finger since they are making money either way and possibly avoiding a whale bonus on some of the sales....

pstation · 05-17-2006, 03:06 AM

While it's possible, i find it very unlikely that any recent trends are related to this. This is absolutely nothing new and has been going on for 5+ years now, since most people in this industry seem to focus on quantity instead of quality it's something that was simply overlooked i suppose. Here's a post on another mainstream forum about the same issue about 5 years ago here

Troels · 05-17-2006, 04:42 AM

Quote:

Originally Posted by Troels

There is one big se guy who sets my anti virus off everytime I hit his pages.
A search got me this url:
www.niigata-bandaijima.com/amateur.html
it redirects a couple of times to this url:
http://www.osee.net/1/enter.php?amateur
And all kinds of warnings are popping up.
The first URL probably won't redirect you unless you're coming from google or any of the other engines.
This guy is big. At least 100k SE surfers daily I would guess, probably alot more.

To me the smoke points towards this guy.
It would explain why WiredGuy who does business in the engines is losing sales.
A huge SEO guy is installing trojans on his landing pages - WiredGuy complains about lost sales.
This guy must have his trojans installed on millions of computers by now. It's been going on for some time.
And still difficult to detect stolen signups for the programs since this guy already does lots of real signups from several different domains.
Those trojans are at least worth a look for the more technical people.

Troels · 05-17-2006, 04:49 AM

Morozov, Alexander
555 8-th Ave #1001
New York, NY 10018
US
+1.2127367465

Although probably not real info.

05-16-2006, 03:00 PM	#107
tranza ICQ: 197-556-237 Join Date: Jun 2003 Location: BRASIL !!! Posts: 57,559	Do you really think big sponsors care? They are getting their sales anyway.... __________________ I'm just a newbie.

05-16-2006, 03:01 PM	#108
Matt-RevShare Confirmed User Join Date: May 2006 Location: The ATL Posts: 298	I do believe most sponsors DO care about this problem and threads like this help to elevate the visibility of theft in general. Like WG said, I dicussed ratios and theft with everyone I saw in Toronto. While this was not the theme of Webmaster Access, it certainly was the main topic of conversation with the people I talked to througout the weekend. Like many of you, I have seen a general downward trend with many of my ratios and it just doesn't make sense outside of theft. However, like David-PG and Jay-TCG said above, I don't truly understand the issue well enough to go to my programmers and say "fix". Obviously, if this theft is as bad as everyone seems to say, then my webmasters (and me by proxy) are getting scammed out a lot of money so its worth investing in developing solutions, I just don't know where to begin. So with heavy traffic guys like Wired Guy and Marian, and sponsors like Perfect Gonzo, TCG and Pimp Roll all agreeing that we have a common enemy, the next step seems to be a better understanding of what needs to be done. Having read this whole thread, I am still unsure if there is a fix that us on the traffic generation side can do, or if this is something that only the programs can do (other than scrutinize new whales). I am interested in helping stop this theft as its costing me and my webmasters big money, but where do we start??? Matt __________________ If you build galleries, free sites or blogs to promote adult sponsor programs then you owe it to your self to check out RevShare Hosting Today! Check out Globally Translated and make money from your existing business by translating your site today! Who is this Matt guy?-Read the Ambush Interview!! ICQ: 254-829-586

05-16-2006, 03:06 PM	#110
AlienQ - BANNED FOR LIFE best designer on GFY Join Date: Mar 2003 Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384 Posts: 30,307	Just today we someone post stats... 1 in 34 while another other run around proudly showing 1 in 800... So maybe 1 in 34 = Overall declines after the Affilaite ID swap for that credited ID, err....I mean traffic thief... Go Fish! __________________ NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo! \| The Alien Blog Adult News Worth Reading Updated Daily \| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 \|ICQ: 78943384 \| Last edited by AlienQ - BANNED FOR LIFE; 05-16-2006 at 03:08 PM..

05-16-2006, 04:33 PM	#118
WiredGuy Pounding Googlebot Industry Role: Join Date: Aug 2002 Location: Canada Posts: 34,460	Ok, so I see a lot of webmasters are in agreement here and from the conversations I've had with program owners and reps, they're noticing similiar trends. So to me, I'm seeing one of two issues, processing or some sort of hijacking going on. I tend not to believe its a processing issue since this has been ongoing for nearly 3 months now and I doubt either processor would put their scrubs like this kind of radical ratios, so the only other case I can think of, is some sort of hijacking. If this is the case, then these joins are going somewhere, there should be some sort of whales who are immensely profiting from any hijacking who is going on, so it shouldn't be hard to find their accounts?? WG __________________ I play with Google.

05-16-2006, 06:19 PM	#125
ddfGandalf Confirmed User Join Date: Feb 2005 Location: Budapest, Hungary Posts: 534	Well we only use ccbill in our program. and ref codes look like http://refer..blahblah&HTML=http://w...=theirccbillid (they have the raw click count from this, thats why we need the ccbill cookie too) It will keep that ref while the visitor browses, and when he gets to the ccbill join page, we have it hardcoded like input type=hidden name=ccbill_referer value="theirccbillid" I think the hardcoded passed variable doesnt care with the cookie, so the outside hijack attempts can be lowered this way. __________________ Last edited by ddfGandalf; 05-16-2006 at 06:22 PM..

05-16-2006, 02:15 PM	#101
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	I could every banner view and every outgoing click on every site I own. I know exact ratios, locations, etc. I compare this data regularly to what the sponsors report as traffic, and look for major discrepancies. I do also randomly click sponsor links on my sites and follow them right through to the signup page, checking to see if there is a cookie or other infomation set that says my referal code is still in effect. Between hackers and 30 day cookies, there are some pretty bad things going on out there right now. I hope the sponsors clue in to the amount of theiving, stealing, and copyright violation that some sites and "webmasters" are doing to make money, and take action to terminate these accounts (and show an account terminated screen, not just quietly passing the traffic and "not paying") Ale

05-16-2006, 02:16 PM	#102
JD Too lazy to set a custom title Industry Role: Join Date: Sep 2003 Posts: 22,651	100 assholes edit: fack...101

05-16-2006, 04:12 PM	#116
The Sultan Of Smut Confirmed User Join Date: Dec 2004 Location: Vancouver Posts: 4,325	Another kick ass post Smokey!

05-16-2006, 05:59 PM	#124
Trixxxia Confirmed User Industry Role: Join Date: Aug 2004 Location: Montreal, Canada Posts: 5,600	Ok I had written a whole page of theories as soon as this thread yesterday but needed more responses from others to confirm some things. I'm not so sure any of us think it's a new problem. The new edge is that this new generation of hijackers are agressive. I believe it's some type of hijacking software/toolbar/adware/scumware. I've personally noticed awkward differences on my own sites/SE listings/PPC Campaigns in January. If we take notice, a surge in threads/complaints/overall discussions started showing up end of January. February calmed down & was a little better and then March was hard & April wasn't much better - this is overall sponsors/billers/complaints - not confined to one sponsor or biller - more geared towards the straight sites though. *How they possibly* did it: My uneducated theory is that it was installed on alot of computers when the adult SERPS were hijacked with non-relevant results - stuff was installed on alot of computers. On or around the time the surge in complaints started showing up in threads (February), the SEs results in adult were practically taken over - most of the SE guys noticed the first & sometimes second page results becoming totally irrelevant and spammy like never before. 1) So somehow, they got into SEs (google comes to mind) by getting PR 5-6-7 pages to link them via the server vulnerability - boosting their SE importance/value by getting the links from mainstream domains with high PR. (Findings mentioned in another thread on last week - I think the thread starter was someone by the name Reprobate if my memory serves me correctly)** 2) Some of those results linked to 'real' pages, alot of them were redirecting directly to sponsors and yet others were leading to a trojan/spyware/scumware auto-install then redirecting to a real page - now most of us have some type of software blocking the stuff, but again, an uneducated guess would be IF 30-40% of computer users don't have computer protection - of the ones that do, a good percentage don't clean their computers often enough - of the ones that do clean them, they don't keep their Virus Scanners/Protection software up-to-date - so we have a problem with alot of users with infected computers. 3) Even if we report the links to the Search Engine, the damage is done already - the software/trojan/toolbar/scumware and whatever is sitting on the end user's computer & will redirect whenever they decide. There was a pattern that I personally saw overall with all sponsors & have compared with a few others big & small - they all saw the same type of results - different results for straight/gay traffic though. Why do I think it would be SE traffic primarily? Because if it wasn't, it would be more susceptible to chargebacks & credits and then it would be more noticeable via the sponsors - this way, they go virtually undetected. Also, I'm thinking it's not as noticeable because it's not done through one hijacker account only but through a web of a few/many at the sponsors so they go undetected. First - we need to help sponsors find a solution by providing a valid copy of these scripts to send to the sponsors so they can have their people look at how it affects 'them' and perhaps to find a common denominator and be able to stop/track it beforehand. Second - they got into surfers computers via SEs & continue to get in that way. We can all try adult keyword searches and look for them to track them down. If you have a computer that you can afford to get infected, let's let it download and get a copy so the experts can figure out what's it's doing and how it's doing it and perhaps find a vulnerability which prevents it from working. you can also copy what your screen is doing via SNAGIT Video capture If the surfer doesn't have a clue about keeping their computers clean - then they are infected and don't know it. When they type in a keyword on a search engine, instead of going to the affiliate's link or the sponsor's link, it goes to the hijacker's id - a surfer wouldn't know the difference. Another thing we can do is - cleaning it up - stop it by starting to do something to fight back by getting the word out and getting these surfers' computers clean and get them protected. Let's pull out a list of different solutions to common problems/virus scanners/trojan removers/toolbar removers and put a FPA between your disclaimer and your TGP/MGP/Hubs - put links in your member's areas, put posts in your blogs, if you do only SE work put a link to a reliable source - Let's get the VIRAL EFFECT TO WORK FOR US INSTEAD OF AGAINST US - it will only help your bottom line in the end. Sorry for the length of the post

05-16-2006, 06:26 PM	#126
Quick Buck Confirmed User Join Date: Feb 2006 Location: Free-Trials.......... Weekly-Payouts..... 100+Sites Posts: 1,026	i'd venture to guess that it's processor related. we see this trend on sites that are processed by 3rd parties but not on sites that we process in house. __________________ $50 FREE TRIALS! Every Day til 2008!!! Only at QuickBuck

05-16-2006, 07:38 PM	#128
Quickdraw Confirmed User Join Date: Mar 2004 Location: → → → Posts: 1,717	Here is a link to one form of this practice. Mainstream, almost 2 years old, but applies to this I believe. I found it looking for something else, so thought I'd add the before I forgot http://www.benedelman.org/spyware/18...le-072404.html

05-16-2006, 08:05 PM	#130
Quickdraw Confirmed User Join Date: Mar 2004 Location: → → → Posts: 1,717	Smokey, Do you have a list any other urls/info used in Iframes or javascript for planting virus? Like these? src="http:/ /traffsale .biz/dl/adv765.php" width=1 height=1>VIRUS-- src="http:/ /persikms .ho.com.ua/xinch/xinch.htm" width=1 height=1>VIRUS-- src="http:/ /traffbest .biz/dl/adv416.php" width=1 height=1>VIRUS-- If you do, swell, if not, no sweat. Thanks

05-16-2006, 08:34 PM	#131
natas Confirmed User Join Date: Mar 2002 Location: : unknown Posts: 3,375	some great points being bought up in this thread. mad kudos to Smokey and TopBucksTrixxxia

05-16-2006, 10:36 PM	#132
reynold Too lazy to set a custom title Join Date: Oct 2002 Location: Global Traveler Posts: 51,271	this thread is very interesting indeed and I've already bookmarked it.

05-16-2006, 10:53 PM	#134
AlienQ - BANNED FOR LIFE best designer on GFY Join Date: Mar 2003 Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384 Posts: 30,307	Some can do it with Hardcode tracking as well via an browser app (Toolbar) or even an small background running application that quaries a server on the net holding a database of link string variables. www.urlsite.com/TourID?ID=XXX&index.php Bing swap... Before the viewer even see's the tour he just clicked. The stuff is not rocket science, it is tricky theoretically but really nothing will stop a starving russian coder. __________________ NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo! \| The Alien Blog Adult News Worth Reading Updated Daily \| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 \|ICQ: 78943384 \| Last edited by AlienQ - BANNED FOR LIFE; 05-16-2006 at 10:55 PM..

05-16-2006, 10:58 PM	#135
AlienQ - BANNED FOR LIFE best designer on GFY Join Date: Mar 2003 Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384 Posts: 30,307	SO when I see a sponsor talk about MAD ratio's some even like 1 in 30 overall for an affiliate I already know how it happened or at least can take a good guess, because nothing is that well targeted these days. __________________ NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo! \| The Alien Blog Adult News Worth Reading Updated Daily \| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 \|ICQ: 78943384 \|

05-16-2006, 11:41 PM	#136
swami Confirmed User Join Date: Aug 2003 Location: vanuatu Posts: 1,989	Great Post By Topbucks Trixxxia

05-16-2006, 11:55 PM	#138
GoLiaT Confirmed User Join Date: Mar 2002 Posts: 1,130	activate my new epass atm card seems impossible i click the activate link and it says all is fine but when i check back at page one it still say activate your card am i missing something here ? __________________ "where ever you go..there you are."

05-17-2006, 12:22 AM	#140
Troels Confirmed User Join Date: May 2002 Location: Between the clouds Posts: 1,035	Haven't you picked up the constant bad board spam from some east europeans? "We pay hi rate for iframe code" or something like that. Obviously they install some crap. Contact them and dissect that code. __________________ These guys steal your signups: Read here. And sexsearch.com profit from it. Check out which sponsors pay thieves here. And here's a list of clean sponsors.

05-17-2006, 12:26 AM	#141
Troels Confirmed User Join Date: May 2002 Location: Between the clouds Posts: 1,035	Go to hahahahahahahahahahahaha and search for "buy iframe traffic". ** We buy iframe traffic for HI rates Our price is 40 dollars for 1000 uniq installs. You only need to write our short code on your page . Weekly payments and online friendly support is guranteed.Good percent of installs. Hit me up at icq 255584377 - for more info. ** __________________ These guys steal your signups: Read here. And sexsearch.com profit from it. Check out which sponsors pay thieves here. And here's a list of clean sponsors.

05-17-2006, 12:27 AM	#142
Troels Confirmed User Join Date: May 2002 Location: Between the clouds Posts: 1,035	the hahaha is b0ardtrack3r __________________ These guys steal your signups: Read here. And sexsearch.com profit from it. Check out which sponsors pay thieves here. And here's a list of clean sponsors.

05-17-2006, 12:32 AM	#143
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	If any of you review galleries or free sites, you would know that most surfers are probalby no more than 2 clicks away from infection. Currently there is a program out there that let's affiliates distribute video clips for free, and they pay for every "install" (nice word of saying "infection")... it usually looks like an attempt to install a codec. Probably 1 in 10 TGPs in the CJ community have a toolbar installer on them, and probably a solid 5-10% of all chat boards are running out of date software that can easily be hacked to add the code onto every page. 75% is probably a high infection rate, but amoungst non-technical "bought my computer at walmart" surfers, the infection rate is probably near to that. The affiliate system is getting crushed. Alex

05-17-2006, 12:38 AM	#144
Troels Confirmed User Join Date: May 2002 Location: Between the clouds Posts: 1,035	There is one big se guy who sets my anti virus off everytime I hit his pages. A search got me this url: www.niigata-bandaijima.com/amateur.html it redirects a couple of times to this url: http://www.osee.net/1/enter.php?amateur And all kinds of warnings are popping up. The first URL probably won't redirect you unless you're coming from google or any of the other engines. This guy is big. At least 100k SE surfers daily I would guess, probably alot more. __________________ These guys steal your signups: Read here. And sexsearch.com profit from it. Check out which sponsors pay thieves here. And here's a list of clean sponsors.

05-17-2006, 12:46 AM	#145
Troels Confirmed User Join Date: May 2002 Location: Between the clouds Posts: 1,035	Yep it gives you a 404. Go to google and search for this: site:niigata-bandaijima.com + amateur Have your anti-virus in order before you click a result. __________________ These guys steal your signups: Read here. And sexsearch.com profit from it. Check out which sponsors pay thieves here. And here's a list of clean sponsors.

05-17-2006, 02:48 AM	#147
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,405	The swapper ratios will be no different than anyone elses. They are not majically only swapping a buying surfer, they are swapping every surfer and then receiving signups from the entire set of traffic, just like a real affiliate. So ratios won't work. Talking to surfers won't work... they are sheep and lazy sheep at that. How many fucking whales do most programs have? 10? 20? 50? If you have 1 whale out of 30 whales and the other 29 are Sleazy, WiredGuy, etc, I think the outstanding Russian with Igor Yavstrinski would look pretty fucking obvious... Especially if you went to his homepage and alexa'ed it and saw that it gets 2K in traffic... And then you noticed his referrer log is full of Sleazy and Wired Guy's websites... yeah... it'd be pretty fucking obvious... So I think the real question is why aren't sponsors doing a fucking thing about it? Because just like surfers they are sheep and lazy ones at that... They really don't feel like lifting a finger since they are making money either way and possibly avoiding a whale bonus on some of the sales....

05-17-2006, 03:06 AM	#148
pstation Confirmed User Join Date: Jul 2003 Location: chicago Posts: 1,135	While it's possible, i find it very unlikely that any recent trends are related to this. This is absolutely nothing new and has been going on for 5+ years now, since most people in this industry seem to focus on quantity instead of quality it's something that was simply overlooked i suppose. Here's a post on another mainstream forum about the same issue about 5 years ago here

05-17-2006, 04:49 AM	#150
Troels Confirmed User Join Date: May 2002 Location: Between the clouds Posts: 1,035	Morozov, Alexander 555 8-th Ave #1001 New York, NY 10018 US +1.2127367465 Although probably not real info. __________________ These guys steal your signups: Read here. And sexsearch.com profit from it. Check out which sponsors pay thieves here. And here's a list of clean sponsors.