A 180solutions ad for Hawaiian Airlines, covering substantially all of Delta.com.
A 180solutions drive-by installation. If the user presses "yes," then 180 software will be installed. Note absence of any reference to a license agreement.
A 180solutions double display -- of the original HSN site plus HSN reached through an affiliate link directing commissions to 180.
A partner bundling 180solutions software without prominent disclosure.
A partner bundling 180solutions software without prominent disclosure. This is the first of 54 pages of End User License Agreement text.
A partner bundling 180solutions software without prominent disclosure. This is approximately the 16th of 54 pages of End User License Agreement text.
A 180solutions double display -- of the original gateway.com site, plus gateway.com reached through an affiliate link.
A 180solutions double display -- of the original store.apple.com site, plus store.apple.com reached through an affiliate link.
A 180solutions double display -- of the original tgw.com site, plus tgw.com reached through a 180 advertiser affiliate link.
A 180solutions double display -- of the original valuemags.com site, plus valuemags reached through a 180 advertiser affiliate link.
A 180solutions double display -- of the original fogdog.com site, plus fogdog reached through a 180 advertiser affiliate link.
A 180solutions double display -- of the original freshpair.com site, plus freshpair reached through a 180 affiliate link.
A 180solutions double display -- of the original lillianvernon.com site, plus lillianvernon reached through a 180 affiliate link.
A 180solutions double display -- of the original motherwear.com site, plus motherwear reached through a 180 affiliate link.
A 180solutions obfuscated decoy display -- of the original crucial.com site, plus etronics reached through an affiliate link within a hidden frameset.
As
discussed in Affiliate Code Replacement via Popup "Double"
Windows within The Effect of 180solutions on Affiliate Commissions
and Merchants, 180 has implemented a system that can set affiliate tracking
codes by showing a user a duplicate copy of a merchant's site. Such popups set
affiliate codes that, in the ordinary course of events, cause 180 (and its advertisers)
to be paid commissions otherwise payable to other affiliates, and cause 180
(and its advertisers) to be paid commissions even if no commissions would otherwise
be paid.
Beyond the double window and silent
cookie-stuffing I previously documented, 180 has come to serve popups that
show one affiliate merchant's page (the "decoy" merchant), while simultaneously
loading (in a hidden frame) a "double" window of the merchant the
user initially requested. I call this procedure "obfuscated decoy targeting"
because a major function of the popups -- targeting the underlying merchant
the user had initially requested -- is hidden by the featured placement of the
decoy merchant.
This page documents obfuscated decoy cookie-stuffing, performed by Buyingfriend.com
using the services of 180solutions, targeting reqeusts for Crucial.com. When
users visit Crucial.com on PCs with 180solutions Zango software installed, 180
opens a Buyingfriend.com URL frameset. In its left frame, Buyingfriend.com links
to Etronics.com, via a Commission Junction qksrv.net tracking link. In its hidden
right frame, Buyingfriend.com links to Crucial.com, also via a Commission Junctiont
tracking link.
For Buyingfriend.com (and other 180 advertisers), this obfuscated decoy offers
three major benefits:
1) A user might make a purchase through the superimposed decoy merchant page
(here, Etronics), in which case the 180 advertiser (here, Buyingfriend) earns
an affiliate commission from that merchant.
2) Alternatively, the user might make a purchase through the underlying,
requested merchant window (here, Crucial). In this case, the 180 advertiser
(Buyingfriend) still earns a commission, due to Buyingfriend's loading
of the Crucial.com affiliate link in the hidden window.
3) The obfuscated popup (here, showing Etronics when users request Crucial.com)
looks like a "legitimate" competitive target. (In contrast, 180's
"double" windows are inherently suspicious: Why would one merchant
be paying to cover its site with its own site? Such a strange occurrence invites
further investigation.) Because obfuscated decoys fit a notion of competitive
targeting, many testers (be they merchants, affiliates, researchers, or the
media) may fail to notice the hidden frame performing cookie-stuffing targeting
the requested merchant (here, Crucial).
In short, obfuscated framed targeting offers a financial advantage to 180 (and
180 advertisers), who profit (via affiliate commissions) whether users purchase
from the originally-requested sites or from the superimposed ("decoy")
sites. Meanwhile, affiliate networks (here, Commission Junction) also
profit either way: Whether the user makes a purchase from the superimposed merchant
(Etronics) or from the originally-requested merchant (Crucial), an affiliate
commission will be paid, and CJ will collect its fee as a percentage of that
commission.
This page shows specific network transmissions that implement 180's obfuscated
decoy cookie-stuffing, targeting a request for Crucial.com made at approximately
11pm (Eastern) on October 17, 2004. See also a video (WMV
format, view in full-screen mode) confirming what took place, including
showing my Cookies folder before and after receiving the 180solutions popup.
The thumbnail above at right shows the final on-screen display -- the Crucial.com
site, covered in part by the decoy popup of Etronics as reached through the
decoy popup frameset and the Commission Junction affiliate link.
Other Targeted
Merchants: Double and Silent
Popups
My video and testing proceed as follows:
I cleared my cookies, such that any cookies set on my PC were set in the
course of the testing shown in my video.
I browsed to Crucial.com.
Zango sent a request to 180solutions servers for an ad targeted at Crucial.com.
This request and response are shown in the targeting HTTP log,
below.
Zango opened the Buyingfriend link specified by the 180 targeting response.
After a redirect, the HTTP response included a FRAMESET giving a Commission
Junction qksrv.net link to Etronics in the left window, and a Commission Junction
qkserv.net to Crucial in the hidden right window. The corresponding HTTP communications
are in the ad HTTP log, below.
I viewed my cookies, observing that Commission Junction cookies had been
created.
Consistent with the rest of my site, the network logs below omit my DUID (my
unique 180solutions user ID number) as well as the 180 affiliate publisher ID.
For brevity, network logs omit internal line spacing and indentation.
In my testing of October 2004, crucial.com is but one of many merchants that
remain targeted by 180solutions affiliate tampering. Some tampering continues
to use double windows, but obfuscated decoy sites are more frequent in my recent
testing, targeting a variety of merchants from Commission Junction, LinkShare,
and elsewhere. My testing also shows that even major merchants are targeted
in this way: Crucial.com is but one of the Commission Junction Featured
Advertisers I have found to be targeted by 180's obfuscated decoy popups.
GET /showme.aspx?keyword=crucial.com&did=762&ver=5.12&duid=531byhiprtvdgvadrfmfcgtxxyrjmg
&partner_id=215082838&product_id=762&browser_ok=y&rnd=20&basename=zango
HTTP/1.1 200 OK
Date: Mon, 18 Oct 2004 03:24:01 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 3255
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<meta name="vs_targetSchema" content="http://schemas.microsoft.com/intellisense/ie5">
</HEAD>
<body>
<SPAN class="957085619-06032003"><FONT face="Arial"
color="#ff0000" size="5">Thank you
for your patience. You will be redirected to your destination site
in a
few seconds.</FONT></SPAN>
</body>
</HTML>
778
<!--hppage status="protected"-->
<!--Source code for this page unavailable - HTTP Error 808--> <html>
[s.i.c. In fact, 808
is not a valid HTTP error code. -Ben]
[495 blank lines omitted. -Ben]
creating
a frameset where left frame takes entire
width, right frame is 0.1 pixels wide (i.e. invisible)
<head>
<title>Etronics.com - Discount camcorders, DVD players, home audio, digital
and 35mm cameras, VCR's, televisions plus small appliances.</title>
</head>
As
discussed in Affiliate Code Replacement via Popup "Double"
Windows within The Effect of 180solutions on Affiliate Commissions
and Merchants, 180 has implemented a system that can set affiliate tracking
codes by showing a user a duplicate copy of a merchant's site. Such popups set
affiliate codes that, in the ordinary course of events, cause 180 (and its advertisers)
to be paid commissions otherwise payable to other affiliates, and cause 180
(and its advertisers) to be paid commissions even if no commissions would otherwise
be paid. 
