Linkshare Affiliate ‘smaqEgQUEvQ’ Targets att.com

Posted by on Jul 29, 2013 in Affiliate Fraud, Cookie-Stuffing, Mad Monday, Wire Fraud

If you are a Linkshare affiliate competing for the same traffic as today’s rogue affiliate, know that you do not stand a chance. The reason for this is because Linkshare affiliate ‘smaqEgQUEvQ’ is unfairly using Cookie-Stuffing techniques to maximize his affiliate revenue. Let’s look at how the scam is put together. When visiting this page […]

Bestpcantivirus targets antivirus vendors

Posted by on Jul 22, 2013 in Affiliate Fraud, Cookie-Stuffing, Mad Monday, Wire Fraud

Upon casual inspection, bestpcantivirus.com reviews antivirus solutions for your PC. In their own words: We recommend you the best antivirus software for your PC. Our reviews and recommendations are balanced from the performance, budget and easy to use. Below are the Top 3 Antivirus programs that will give you the best performance and are Worth The […]

Bargain Hunter Scam through Cars.com

Posted by on Jul 15, 2013 in Bargain Hunters, Wire Fraud

Recall that the Bargain Hunter scam is a four pronged attack: 1. Scammer Sets the Trap This cars.com ad has a 2002 Toyota Tacoma PreRunner up for grabs at $5,582. It’s a pretty good deal, designed to whet my appetite and have me get in touch with the seller thinking that there’s a great deal […]

Perion Incredibar adware, CJ 7164280 invisibly claiming commission on organic traffic to Cafepress

Posted by on Jul 12, 2013 in Adware, Affiliate Fraud, Cookie-Stuffing

Co-authored with Ben Edelman On a computer running Perion Incredibar adware, our crawler browses the cafepress.co.uk site.  Incredibar sees this traffic and invisibly invokes the CJ click link with publisher ID 7164280, which redirects back to Cafepress. Because the toolbar drops CJ cookies invisibly, there is nothing for us to show in a screenshot.  But […]

Perion Incredibar adware, CJ 7164280 invisibly claiming commission on organic traffic to Webroot

Posted by on Jul 11, 2013 in Adware, Affiliate Fraud, Cookie-Stuffing

Co-authored with Ben Edelman On a computer running Perion Incredibar adware, our crawler browses the Webroot site.  Incredibar sees this traffic and invisibly invokes the CJ click link with publisher ID 7164280, which redirects back to Webroot. Because the toolbar drops CJ cookies invisibly, there is nothing for us to show in a screenshot.  But […]

CJ Affiliate 7115795 claiming commission on organic traffic to Gap

Posted by on Jul 10, 2013 in Adware, Affiliate Fraud, Cookie-Stuffing

Co-authored with Ben Edelman On a computer running Zango adware, our crawler browses the oldnavy.gap.com site.  Zango sees this traffic and opens a window to surveysclick.com (packet trace).  Surveysclick.com returns tricky redirects and eventually does a POST through to a CJ click link with publisher ID 7115795, then on to Gap.  As shown in the […]

CJ Affiliate 3970235 invisibly claiming commission on organic traffic to Skinstore.com

Posted by on Jul 9, 2013 in Adware, Affiliate Fraud, Cookie-Stuffing

Co-authored with Ben Edelman Using a computer running Zango adware, our crawler browses www.skinstore.com.  Zango sees this traffic and opens a window to firststopmall.com (network trace).  A user sees a popup offer from corehq.com.  But at the same time, an invisible image redirects to the CJ click link with publisher ID 3970235, then on to […]

CJ Affiliate 5898178 claiming commission on organic traffic to 123Inkjets

Posted by on Jul 8, 2013 in Adware, Affiliate Fraud, Cookie-Stuffing

Co-authored with Ben Edelman Using a computer running Perion Incredibar adware, our crawler browses the 123Inkjets site.  Incredibar sees this traffic and invisibly invokes the CJ click link with publisher ID 5898178, which redirects back to 123Inkjets. Because the toolbar drops CJ cookies invisibly, there is nothing for us to show in a screenshot.  But […]

CJ Affiliate 5740999 claiming commission on organic traffic to Tirerack

Co-authored with Ben Edelman On a computer running Zango adware, our crawler browses the tirerack.com site.  Zango sees this traffic and opens a window to Trackmyads (packet trace).  Trackmyads returns tricky JavaScript that redirects to Offershack which redirects to the CJ click link with publisher ID 5740999, then on to Tirerack.  As shown in the […]