Rogue CPL Activity

Posted by on Oct 22, 2013 in Affiliate Fraud, Arbitrage, CPL

Cost Per Lead (CPL) is an advertising model where the advertiser pays for sign-ups from interested consumers. Affiliates play the middle men in these transactions for they send the interested consumers in the direction of the advertiser. So for each consumer that signs up with the advertiser, the affiliate in question is paid a commission […]

The Ad Networks and Advertisers that Fund Ad Injectors

Posted by on Sep 18, 2013 in Ad Injectors

Ad injectors insert ads into others’ sites, without permission from those sites and without payment to those sites. See example screenshots below showing injections into YouTube, Amazon, CNN, Dell, and eBay. In this article, we review the basic operation of ad injectors, then examine the ad networks, exchanges, and other intermediaries that broker the placement […]

YouTube Spam

Posted by on Aug 6, 2013 in CPL, Spam

Spend some time on YouTube and you may run into comments like Make money working from home, get paid $$$ to fill in surveys. Go here… Needless to say, the comments bring no value to the context of the video that you may be watching. More often than not it is exactly the same comment […]

Linkshare Affiliate ‘smaqEgQUEvQ’ Targets att.com

Posted by on Jul 29, 2013 in Affiliate Fraud, Cookie-Stuffing, Mad Monday, Wire Fraud

If you are a Linkshare affiliate competing for the same traffic as today’s rogue affiliate, know that you do not stand a chance. The reason for this is because Linkshare affiliate ‘smaqEgQUEvQ’ is unfairly using Cookie-Stuffing techniques to maximize his affiliate revenue. Let’s look at how the scam is put together. When visiting this page […]

Bestpcantivirus targets antivirus vendors

Posted by on Jul 22, 2013 in Affiliate Fraud, Cookie-Stuffing, Mad Monday, Wire Fraud

Upon casual inspection, bestpcantivirus.com reviews antivirus solutions for your PC. In their own words: We recommend you the best antivirus software for your PC. Our reviews and recommendations are balanced from the performance, budget and easy to use. Below are the Top 3 Antivirus programs that will give you the best performance and are Worth The […]

Bargain Hunter Scam through Cars.com

Posted by on Jul 15, 2013 in Bargain Hunters, Wire Fraud

Recall that the Bargain Hunter scam is a four pronged attack: 1. Scammer Sets the Trap This cars.com ad has a 2002 Toyota Tacoma PreRunner up for grabs at $5,582. It’s a pretty good deal, designed to whet my appetite and have me get in touch with the seller thinking that there’s a great deal […]

Perion Incredibar adware, CJ 7164280 invisibly claiming commission on organic traffic to Cafepress

Posted by on Jul 12, 2013 in Adware, Affiliate Fraud, Cookie-Stuffing

Co-authored with Ben Edelman On a computer running Perion Incredibar adware, our crawler browses the cafepress.co.uk site.  Incredibar sees this traffic and invisibly invokes the CJ click link with publisher ID 7164280, which redirects back to Cafepress. Because the toolbar drops CJ cookies invisibly, there is nothing for us to show in a screenshot.  But […]

Perion Incredibar adware, CJ 7164280 invisibly claiming commission on organic traffic to Webroot

Posted by on Jul 11, 2013 in Adware, Affiliate Fraud, Cookie-Stuffing

Co-authored with Ben Edelman On a computer running Perion Incredibar adware, our crawler browses the Webroot site.  Incredibar sees this traffic and invisibly invokes the CJ click link with publisher ID 7164280, which redirects back to Webroot. Because the toolbar drops CJ cookies invisibly, there is nothing for us to show in a screenshot.  But […]

CJ Affiliate 7115795 claiming commission on organic traffic to Gap

Posted by on Jul 10, 2013 in Adware, Affiliate Fraud, Cookie-Stuffing

Co-authored with Ben Edelman On a computer running Zango adware, our crawler browses the oldnavy.gap.com site.  Zango sees this traffic and opens a window to surveysclick.com (packet trace).  Surveysclick.com returns tricky redirects and eventually does a POST through to a CJ click link with publisher ID 7115795, then on to Gap.  As shown in the […]