Affiliate link hijacking.

[kgun]

Hijacking has as many faces as there are people. It is estimated (do not remember the source) that about 30 % of your hard earned affilate commision is stolen by hijackers. It comes in different forms. The most obvious is to replace your tracking code with the hijackers code.

Various affilate providers and merchants protect their affilates in different ways. And there is software out there to protect you or you may use your own technique:

1. Redirection or cloacking. You hide the code by cloacking (redireting to the merchant site).
2. Frames. You may hide the link in a null frame.
3. Writing your own Java Scripts or encrypt the link in more advanced ways.

As sales through affiliates increases, this will become an increasing problem.

Some useful links:
http://www.linkshield.com/
http://www.affiliatelinkcloaker.com/
http://www.affiliatemarketerstoolbox.com/
http://www.clickbankguide.com/
http://tinyurl.com/
http://compacturl.com/cgi-bin/compact?

It is possible to "redirect every link" to hijackers if they are advanced enough and secure sites is not used. A solution may also be to rename the URL by compacting before cloacking.

Note: Some SE's penalizes cloaked sites, so cloacking may reduce your pagerank.

You find more information on this by the following search "link hijacking" +affiliate

or alternativeliy in my link collection

<<link removed by Catalyst - link is in your sig>>

Page search (CTRL + F +

Prevent Affiliate Links hijacking

A related problem is cookies. Some providers use cookies so your referral may be active for months. Myself, I empty cookies and temporary internet files nearly every day. An abvious solution should be to log the referral in a database on the merchant's site and not in a cookie on the surfers Pc. But then it must (?) be identified by the surfers IP address, and that may be dynamic. Is there other solutiones that does not depend on cookies on the surfers PC? What about syndicated minisites?

Kjell Bleivik
http://www.multifinanceit.com/

[Linda Buquet]

Caution with link cloaking. Be sure what you are using is OK with the merchant and does still track. Many merchants don't allow link framing or i-frames. Always test you links after cloaking to be sure they still track correctly.

[kgun]

http://www.webproworld.com/viewtopic...156&highlight=

if you did not see it.

1. Providers use cloacking as far as I can see.
My loyalty is with my providers / merchants
and not SE's. Period!
2. I do not not use frames myself, and know the
problems with frames. Either you hate or love
them. I do not know the effect of a zero frame
mentioned in my post.
3. And I try to minimize the use of tables, even if
I get lot of table code to paste into my
Ad driven site.

Kjell Gunnar Bleivik
http://www.multifinanceit.com/
http://www.skupot.com/

[freelancemom]

How would you know if you've been hijacked?

My linkshare affiliate commissions have virtually dropped to nothing. I've ignored it because other avenues have been fine, but it's very strange that I'm not making ANY linkshare sales.

Lori

[kgun]

The simple answer: The hijacker exchange your ID with his affiliate ID.

Two links:

http://www.websitemarketingplan.com/...iateHijack.htm

http://www.associateprograms.com/sea...etter205.shtml

If that does not answer your question, make a search on the keywords.

Kjell Gunnar Bleivik
http://multifinanceit.com/
http://www.blognorway.com/

[Linda Buquet]

Well the other big problem these days is anti-spyware and personal firewall type programs that block or delete affiliate cookies and/or affiliate linkes. They primarily target LS and CJ cookies and links the most since those are the biggest networks.

Of course the other issue is parasites, that overwrite affiliate cookies. They are more prevelant in the big networks.

So if you are seeing network sales go down and Indies or small networks staying steady these could also be some of the reasons.

[kgun]

http://www.stevedawson.com/article0001.php

http://www.keywebdata.com/articles.aspx?article=10


Related document:
http://www.w3.org/TR/REC-html40/stru....html#adef-rel

Kjell Bleivik
http://www.multifinanceit.com/
http://www.blognorway.com/

[freelancemom]

Hi Linda,

Any thoughts on how I would find out? Would it be apparent in my redirects? What would you reccomend for link cloaking? Do you take these precautions yourself?

Thanks for your thoughts,

Lori

Originally Posted by Catalyst

Well the other big problem these days is anti-spyware and personal firewall type programs that block or delete affiliate cookies and/or affiliate linkes. They primarily target LS and CJ cookies and links the most since those are the biggest networks.

Of course the other issue is parasites, that overwrite affiliate cookies. They are more prevelant in the big networks.

So if you are seeing network sales go down and Indies or small networks staying steady these could also be some of the reasons.

[Linda Buquet]

Hi Lori,

I barely do any affiliate marketing myself and never work with LinkShare. I mainly do consulting for merchants and promote their programs.

If it's one or 2 merchants, you could check to see if they are on any well known parasite merchant lists. Also there is a thing you can add to LS links that is supposed to make parasites NOT overwrite your link. It's something like afrc=1 or something like that. You need to go to ABW and search for it. I don't go there, so can't research for you.

But chances are if you promote LOTS of merchant there and your sales went down for all of them, then it could be increased ad blockers and cookie eaters targeting LS links or it could be a LS tracking issue. I would go over to the LS forum at ABW and ask there, as well as read the threads to see if you see others reporting the same.

[freelancemom]

Thanks Linda,

I appreciate the advice.

Lori

[kgun]

https://www.google.com/webmasters/sitemaps/login

Article:
http://www.sitepronews.com/archives/2005/july/6.html

Kjell Gunnar Bleivik
http://www.multifinanceit.com/
http://www.blognorway.com/

[ciocan]

New way to protect your affiliate links - with Super Affiliate Link Cloaker your affiliate links are just normal <a> links and there is no redirect page.

check www.SuperAffiliateLinkCloaker.com

[jackson992]

ummmm doesn't look free t0 me:)

[StephenR.]

Excellent information kgun. Watching this thread.

[chaunte]

wow, I didn't know they could do that!

[kgun]

1. Hijacker can have stolen your commision without you knowing it.

2. They are becoming more and more advanced. Kw:
- Hacking your site (placing a javascript there).
- Redirecting.
- Replacing ID.
- Other forms.

3. This is serious for small companies like mine:
- My first priority is building sites.
- Do not have time to check if code is replaced.
- Little time to view and analyze logs.

4. Solutions.
- Using automatic programs to monitor your sites.
- Encrypting links like CJ.
- Publishing hackers online when they are taken, if possible with picture.
- Ban visitors (BOTS) to you site via .htaccess (on Apache servers) or PHP.INI.

5. Study and remember these resources

http://browsers.garykeith.com/downloads.asp

(Follow his posts at WMW as GaryK). He knows what he is talking about and in my view one of the top 10 experts on bad bots, bad referrers etc. on the internet.

http://www.loriswebs.com/hijacking_web_pages.html

Also a member of WMW.

May be his nick is Lorel.


P.S. Not directly related to the above:

By using an JavaScript event handler, an action like redirecting or downloading code can be fired when you move the mouse pointer over an (invisible) link. Therefore, check your browser settings, etc. etc. Don't accept automatic downloading of any software, be it an Active X control or anything else.

Use fixed banner size. Variable banner size may destroy the look of your site.

Note: A site that was reliable may have been bought by criminals.

[MattE]

here is an easy test:
Reupload all of your site. What logs and affiliate traffic sales - if they increase (even if only for a day) then you may well have been (and agian if they drop off again) hacked.

[kgun]

Excellent advice.

I have thought of this: Encrypting links is neither secure. It may even be false safety. The hijacker can of course replace the encrypted links with his own encrypted links if (s)he have an account with the same provider.

Affiliate providers that have the best monitoring tools should be preferred:

1. Remind you when links have been changed unless you turn this off when making a larger change of your site.

2. Map links to IP (Geolocation) and warn you when links changes location.

3. An option to send a message to your email (to an account that is different from the registered) every time you have logged in. This email account should only accept emails from your contact list.

4. XHTML 1.0 validation of code that is produced by their tools.

5. Are up to date on security issues.

[jane2008]

good infor there needed it :D

[fbanker]

I have been concerned for quite some time that there is a possibility of link hyjacking going on in my situation. I have been an affiliate for a long time with a health products company and have pretty high level of affiliate sales through my affiliate links to their site.

I understand the concept of a customer taking off the affiliate extention on a url before purchasing, but is it possible for a dishonest affiliate to somehow intercept my traffic and take it, redirect it to their affiliate link? All of a sudden in several areas, my sales have once again disappeared. This has happened before.

I looked at the options you listed, but what I want to know is how can a dishonest affiliate get in between me, my website customer, and the merchant? Is this happening out there?

[kgun]

I can not answer your question in a definite yes or no, but here is my opinion (knowledge).

1. I read, that about 30 % of affiliate commission on the internet is (was) stolen (in that year 2004?). I think it was in a reliable book or on an internet site, but I do not remember where now. It should not be difficult to make relevant searches on Google.

2. As far as my knowledge go, this is the situation by most affiliate providers. I am not 100 % sure, so if someone from affiliate providers read this thread they may correct me.
- It is not enough to steal your code. That may even be an advantage, since you may get comission from those that have stolen your code and put it on their site. I do think hijackers also know that and are smarter.
- Then they have to
1. Sign up by the same provider.
2. Insert their ID on your site by hacking (there are security holes in most programs as long as they are not on a secure server), placing a javascript on the site that redirects the affiliate links to their own site) or using other unknown techniques.

[MattE]

Yes but in your point 2, subpoint 2 this can be tested by reloading your own pages (thus eliminating the hacked pages) and then watching logs and saels closely

[kgun]

Yes, I took that point and have been aware of it even if my post above can indicate the opposite.

You should delete all files on the webserver first. Uploading is not enough if there is installed a file on the server that you are not aware of.

KW's: Namespaces, priority in locating files with identical names ...

If your site is hacked, the best may be to change hoster.

[Web Artist]

Its mostly from spy/adware programs installed on infected computers that cause this problem. There is nothing a website owner can really do about this because the spy/adware targets keywords in the links.
An example of a company that does this is 180solutions/zango. Do not promote this type of scumware as it hurts all legit webmasters.

[StephenR.]

If you want to protect yourself from link hijacking and adware/spyware you may want to check out http://www.covertlinks.com (no affiliate link). This software takes care of both in one shot.

[mnsandy]

Originally Posted by Web Artist

Its mostly from spy/adware programs installed on infected computers that cause this problem. There is nothing a website owner can really do about this because the spy/adware targets keywords in the links.
An example of a company that does this is 180solutions/zango. Do not promote this type of scumware as it hurts all legit webmasters.

e.g. we at MoreNiche do regulary test on adwares all our sites to ensure they're okay, time to time we have to chase these adware guys all over industry as they try to hide from sponsor to sponsor. It's not easy, but if company wants, they can prevent significant portion of adware intervence and cooperation will help to get rid of these.

[ciciak]

Very interesting thread! I'm going to make more research, I believe there could be done more by affiliate software to prevent link hijacking. Seems like basic cryptography excercise from university:-)

Originally Posted by kgun

A related problem is cookies. Some providers use cookies so your referral may be active for months. Myself, I empty cookies and temporary internet files nearly every day. An abvious solution should be to log the referral in a database on the merchant's site and not in a cookie on the surfers Pc. But then it must (?) be identified by the surfers IP address, and that may be dynamic. Is there other solutiones that does not depend on cookies on the surfers PC? What about syndicated minisites?

As regards classical cookies, there already is technological background to track without browser cookies. It's tracking by Flash, so called flash cookies. Anyway I don't see many merchants including flash tracking, despite the fact that it is available since flash player 6 was released..
Probably because they would have to ask all affiliates to update integration codes.. Or is it because volume of sales would go up? :-)

[ciciak]

Edited: I posted twice by mistake - sorry I'm new here:-)

[kgun]

No problem and with that comment, I give new life to this thread that should be a sticky IMO.

Related links that make encrypting less secure:

Two Qubits In Action, New Step Towards The Quantum Computer

Quantum Computer Could Solve Problems In A Few Months That Would Take Conventional Computers Millions Of Years

[kgun]

Some related articles:

Protect your commissions

More on Google's Secret Review Labs & Why Google Hates Affiliate Sites : SEO Book.com

Retaining Page Rank with Affiliate Links Outdated?

[michigan]

your website reads like you are engaging in unethical behavior, the opposite of what the other posters are writing about, why are you talking about "partnering" with the folks you techniques rob from? or maybe i have read this entire thread the wrong way.

Originally Posted by dstreet3003

I'm surprised to see this thread-but then again I guess not-I am new to this forum but I am currnently promoting an e-book named "Sneaky Affiliate Cheat" that launches on January 24th and covers many of the topics discussed in this thread. I would love for some of you guys to JV Partner with us to help spread the word and help those affiliates who may not be familiar with these concepts. If you are interested you can go here and read the JV Invite page.

Thanks

[deepsand]

Originally Posted by dstreet3003

I'm surprised to see this thread-but then again I guess not-I am new to this forum but I am currnently promoting an e-book named "Sneaky Affiliate Cheat" that launches on January 24th and covers many of the topics discussed in this thread. I would love for some of you guys to JV Partner with us to help spread the word and help those affiliates who may not be familiar with these concepts. If you are interested you can go here and read the JV Invite page.
Thanks

Even the pop-up on your site is deliberately deceptive; the {Close Box] merely links to another URL.

Pathetic.

[deepsand]

Originally Posted by michigan

your website reads like you are engaging in unethical behavior, the opposite of what the other posters are writing about, why are you talking about "partnering" with the folks you techniques rob from? or maybe i have read this entire thread the wrong way.

Yup; you nailed.

[crishgil]

This is really interesting....

Never thought this could be possible...

So how can I know if my site is hacked?
Do I have to check the links and see if they point to
the right destination?

[kgun]

Originally Posted by crishgil

This is really interesting....

Never thought this could be possible...

So how can I know if my site is hacked?
Do I have to check the links and see if they point to
the right destination?

Originally Posted by MattE

here is an easy test:
Reupload all of your site. What logs and affiliate traffic sales - if they increase (even if only for a day) then you may well have been (and agian if they drop off again) hacked.

That is one way to test it. If affiliate ad increases sharply that is one indication that you links may have been hijacked.

Another more paranoid metod is to change hoster and look for the same.

To sum up other points:

1. By advanced methods, your affiliate ID can be stolen and redirected to another site.
2. TCP Connecting Hijacking: MAN-In-The-Middle Attack.
3. Stealing your password etc.

Study the details and links given above for additional information.

[ITBeings]

You can hide you affiliate link via INTURL™

[uberanimal]

so what method do most people use for cloaking? what do you suggest?

[kgun]

1. Go to the second link in my signature.
2. Site navigate to IT + Marketing.
3. Click links in upper right corner.
4. Site search (CTRL + F) KW:
   Cloaking.
5. Repeat search until you do not find more links.

[darius.simonson]

Interesting and scary too. I always thought earning commissions through affiliate marketing was safe.

[uberanimal]

I hear some affilate programs are seeking legal action against those that hijack links. weird because they still get the sales don't they.

[darius.simonson]

Yes they do.

[kgun]

You have to fix the link in your signature. It is added to the WPW URL.

[ziffgone]

Originally Posted by darius.simonson

Interesting and scary too. I always thought earning commissions through affiliate marketing was safe.

It is safe. Not having a secure web site is what's not safe.

Originally Posted by uberanimal

I hear some affilate programs are seeking legal action against those that hijack links. weird because they still get the sales don't they.

Yes, and no...Many times the other Affiliates will boycott the Affiliate Management company if it's found that they are allowing any affiliate associated with Parasite Software to use their service. Therefore, keeping the Parasite related affiliate could become more costly than profitable.

All about Link Cloaking/Hijacking:

Ultimately, cloaking your links is mostly determined by what Niche you promote. If you promote a Niche that is full of Internet Savvy people, you'll want to protect your links. If your Niche is targeted to people who aren't to knowledgeable about the internet, or more so affiliate programs, then you'll probably never have to worry, (with the possible exception of Parasite Software).

The only real ways your affiliate commissions are stolen are the following:

- People bypass your affiliate link:

• If people can see where the link leads to, they may sometimes type in the destination URL into their web browser themselves, bypassing your affiliate link, not allowing your affiliate cookies to be set.

Solution: Hide your affiliate link in either a redirect script/page, or hide it in a frame. These two methods can be encrypted, obfuscated with Javascript to further hide your link.


- Other affiliates who are also affiliated to the same product/affiliate management company may "hijack" your link by taking their own link, with their affiliate id, and purchase through their own link:

• It is impossible for another affiliate to actually "Steal" your commission by sending someone to your website/affiliate links. The only way they can "steal" your commission is by either buying the product themselves through their own link after they have viewed your web page and have seen that the affiliate links you are using are through an affiliate program they are affiliated with, or, and this is a big OR,
  
• If they some how learn who you are promoting to, ie: learn what email addresses you promote to or use the same leads, they can go after you and promote the same product with their link.

Solution: Same as above, but if your link/affiliate id is not hidden after they have clicked through your link to the merchant's site, it won't be very effective. You can protect your link after they have clicked through by either using Frames on your own web site or by using advanced link cloakers like covertLinks that don't use frames.

It must be noted, that unless your affiliate program, (CJ, Linkshare, ClickBank, Regnow, Shareasale etc.), use a Compact Privacy Policy Header, your affiliate cookies will likely be blocked by the Internet Explorer web browser. Approx. 60% of people use IE.

- The big BADDY, the one that should worry most affiliate marketers...Parasite Software:

• Parasite Software is software/adware that is usually on your visitor's computer. Stats suggest that approx. 80% of computer users have parasite software, (otherwise known as Adware and Spyware), on their computers. Parasite software steals your commission by monitoring the web sites that people visit. If it finds one that it's affiliated with, it sets affiliate cookies on the user's computer for that product either through pop-up window ads, redirecting that person through it's own affiliate url, or by setting the cookies directly. If it so happens that the person has arrived at that product's web page having come through your affiliate link, your affiliate cookies that were set will be overwritten by the Parasite Software's, stealing your commission.
  
• Parasite Software makes it onto peoples computers usually by being bundled with free software that is downloaded to the user's computer. Another form of Parasite Software is through Browser Toolbars. These toolbars usually offer some form of helpful service, like giving tools for online shopping etc. However, they have the hidden agenda of either redirecting people through the Parasite Software's affiliate links, using Pop-up Ads, or by sabotaging search queries sending visitors to affiliate sites/links.

Solution: Try and hide the fact that the web site you referred is one the Parasite Software is affiliated with. This can be done using encrypted frames, (see warning note above), or by the afore mentioned advanced Link Cloakers like covertLinks.


It's exceptionally rare, and virtually impossible, that anybody can gain access to your web site and hijack your affiliate links by inserting code into your web pages, or re-writing any of your affiliate links. Chances are, if they're able to hack your site, they'll be doing something far worse than stealing your affiliate commissions, like setting up a Phishing Site, (this happened to me once!).

However, here's some tips to ensure your web site is as secure as can be:

- If using third party scripts, such as Blogs, Forums, Content Management Scripts, Email Scripts etc., make sure they are secure by always having the latest versions for that script. Most popular Forum scripts like PhpBB, vBulletin, Invision Board, Blogs like Wordpress, and CMS scripts like PHPNuke, etc., when using the latest versions, are secure. If you're unsure about any script you use, check the coding for URL Inclusion/Injection, whether or not Form fields are URL Encoded when submitted etc., or pay a programmer to do it for you.

- Try to have as few files on your site as you can that are CHMODed to 777, (or have file permissions set to 777). Meaning they are writable by anybody, not just you or your site. If you must have a file set to 777, see if you can keep it set at a more secure 644 or 755 setting until the time you need it set at 777 and then quickly, either through your web site CPanel or through a FTP program, reset the permissions to the required 777.

(For example, I have an article site that requires a file to be set at 777 permissions so it can write back-ups. Instead, I keep this file at 644 until I run a back-up. I then quickly set the file permissions to 777, do my back-up, then reset the file's permissions to 644).

- Don't use easy to guess passwords for access to your web site CPanel or Web Site Management program. Even if your passwords are only meaningful to you, there are Brute Force programs that will run millions of words/word combinations at your login to try and guess the password. The best passwords are ones that contain random letter/number combinations.

-----------

Over all Link Hijacking isn't a big enough problem for most Affiliate Marketers that you should be overtly worried about it. Some simple precautions and simple protective strategies, such as cloaking or redirecting, are all that most affiliate marketers need. Ultimately, Affiliate Marketing can be one of the most rewarding and profitable ways to earn money online even if you lose some commissions to link hijackers/bypassers and parasite software.

Regards,
Perry.

[activeco]

Originally Posted by Web Artist

Its mostly from spy/adware programs installed on infected computers that cause this problem. There is nothing a website owner can really do about this because the spy/adware targets keywords in the links.

'Nothing' depends on one's set of mind and a view angle.
I have created a procedure/scripts that virtually eliminates rewriting ID data on my affiliate pages. It also provides sale tracking with all the buyer's data all the way to the merchant, so it effectively record all orders and reveals fraudulent merchants too.
Of course, I can't control charge backs and returned merchandise, but in such cases it is possible to contact buyer based on his data.

Does anyone think I should go more serious about it and maybe commercialize the procedure in a compact software product?
How much could it be worth for an end user?

[1stgirl.com]

This is a very interesting thread because I'm promoting more than 1,000 digital products at one of my sites (see my signature).

I'm using a free link cloaking tool (no redirection). The browser shows http://------.com/recommends/theproduct.htm not the merchant's website. The beauty is that SEs index those pages and those pages are getting good traffic (entry pages).

[kgun]

A related thread here: Fooling Search Engine very smartly