Benjamin Edelman – Page 23

March 9, 2009December 2, 2023

In Support of Utah’s HB450

When a user searches for Hertz, may a search engine show ads for Avis instead?* A natural libertarian instinct might reply yes, sure, do whatever you want. I want to push back on that, offering reasons why such ads are improper.

Modern search engines are notable for their striking ability to give users exactly what they ask for. Search for Hertz, and most of the links will indeed take you to Hertz or bona fide Hertz-related sites (like booking agents or consumer reviews). In this context, what is a user to think when a search engine serves up an ad for something altogether different from a user’s request? Because search engines are generally so good at providing just what users requested, there’s likely user confusion any time a search engine instead replies with links to competitors. After all, if a user asked for Hertz, it’s perfectly reasonable for the user to expect that resulting links will be responsive to the user’s request.

Now, search engines often say their ad labels cure any possible use confusion. I disagree. For one, the labels are easily overlooked — all the way off to the side, all the way in the corner. Moreover, while the words “sponsored links” may be clear to an attorney or an advertising professional, I’ve found that the wording is deeply ambiguous to ordinary users. Sponsored by whom? The search engine? The company the user just asked for? A different label, like “advertisements” or “paid advertisements” would be more effective in curing confusion. But that’s not on the table.

Meanwhile, litigation does not lend itself to resolving these questions. Consider typical litigation about these ads: Blow up an exemplar onto a big posterboard, analyze it from every angle, and discuss it for days on end. The very process of litigating the case makes it amply clearly what’s going on. So it’s hard for a court to get into the mindset of an ordinary user who’s confused, who didn’t know what “sponsored links” meant, and who didn’t really see that label in any case. In this context, it comes as no great surprise that US courts reach mixed results on the question of whether a search engine may show ads for one company when a user requests a direct competitor. European courts, for whatever it’s worth, tend to say search engines must not do so.

Search engines also often claim users benefit from ads for competitors. I guess it’s possible that some users might search for Hertz, not knowing that Avis even exists. But how many users does this really describe? If a consumer actually wants offers from multiple providers, those are easy to get; just search for “car rental” or “rental car deals” to get plenty of choices. In contrast, as described above, when a user searches for a specific provider, competitors’ ads are more likely to be confusing, and less likely to be useful.

Despite lofty claims about consumer benefits, I’ve always thought search engines let advertisers bid on each others’ trademarks for one simple reason: Money. If the only advertiser allowed to bid on ads for “Hertz” is Hertz, a search engine won’t be able to sell many ads. (They’ll sell at most one, to Hertz. But even that one will garner a low price, reflecting that Hertz did not have to outbid anyone else. Furthermore, why should Hertz buy an ad for its own trademark, when it already gets top position through organic listings?) In contrast, if a search engine can get ten different car rental advertisers competing for slots, revenues will increase dramatically. (See my revenue analyses through simulations and counterfactuals.) Now, I don’t mean to say increasing revenue isn’t a laudable goal for search engines. But the financial implications frame my assessment of search engines’ arguments. They say “consumers” and “competition”; I hear “revenues” and “profits.”

The HB450 Approach

Against that backdrop, Utah offers HB450 which seeks to provide an alternative. In those narrow circumstances when Utah has proper cause to regulate — among the key conditions, an advertiser using a search service that knows users are in Utah — Utah would require that advertisers not trigger ads based on competitors’ trademarks. The results? Less confusion for consumers who just want to get what they asked for. Plus, companies can reap where they’ve sowed. If a company invests in offline advertising (like ads on TV or in newspapers) to get users to search for its brand, those searches will show the company’s ads, not offers from competitors. It’s a perfectly natural, sensible approach.

Indeed, HB450 is a narrow approach. HB450 imposes no possible liability on search engines, no matter what. Rather, HB450 applies only to advertisers. Furthermore, an advertiser’s duty under HB450 is only to take down the offending ads, and even that only after notice. In addition, HB450 grants a successful plaintiff no monetary damages; HB450 allows only an injunction requiring that a defendant take down the offending ads, and attorneys fees to cover the cost of the action, but no further payments. In short, HB450 uses a minimalist approach, grounded in private-sector self-regulation and companies notifying each other of ads they believe cross the line. Far from the intrusive morass Eric Goldman seems to envision, this is sensible and appropriate, protecting consumers from confusing or deceptive ads, and protecting advertisers from competitors trading on their good names.

Nor is HB450 any kind of comprehensive Internet regulation, as AT&T spokesman claimed in statements to ClickZ. Trademark law and consumer protection are both traditional subjects of state regulation, and there’s no reason why states’ advertising regulations shouldn’t apply online too — particularly as geolocation systems become increasingly widespread and as it therefore becomes feasible, indeed easy and the norm, to present ads differently in one state versus in others.

In due course, I’d like to see federal regulation expand HB450 to national scope. After all, HB450’s protections ought not be limited to consumers and advertisers in Utah, and it would be perfectly natural to offer HB450 nationwide. But it’s perfectly normal for new regulatory approaches to begin in individual states — letting experience in a few states guide the decision to expand more broadly. That’s an appropriate approach here, and my hope is that that’s what will happen.

* – My Hertz/Avis example is purely hypothetical. While many advertisers ads targeting competitors’ trademarks, I do not mean to suggest that Avis does so.

February 13, 2009March 1, 2018

Windows Vista (teaching materials)

Edelman, Benjamin. “Windows Vista.” Harvard Business School Case 909-038, February 2009. (Revised December 2010.) (educator access at HBP. request a courtesy copy.)

Microsoft designs, modifies, publicizes, and distributes Windows Vistaagainst a backdrop of consumers already largely satisfied with their existing Windows XP systems. Microsoft must decide what features to include and what to drop, how to compete with its own installed base, and how to mobilize partners to offer Vista-compatible systems.

January 7, 2009February 27, 2018

Restaurant Promotions in 2015 (teaching materials)

Edelman, Benjamin. “Restaurant Promotions in 2015.” Harvard Business School Case 909-034, January 2009. (Revised July 2015.) (educator access at HBP. request a courtesy copy.)

A variety of services offer consumers discounts when dining at participating restaurants. This case examines four such services: Entertainment Book, Restaurant.com, Rewards Network, and Groupon. Despite key functional similarities, each of the services chooses an importantly different approach–different pricing, different benefits to consumers, different benefits to restaurants, and different underlying technologies.

Teaching Materials

Online Restaurant Promotions – Teaching Note (HBP 909063)

January 1, 2009March 21, 2024

Running Out of Numbers? The Impending Scarcity of IP Addresses and What To Do About It

Edelman, Benjamin. “Running Out of Numbers: Scarcity of IP Addresses and What To Do About It.” Auctions, Market Mechanisms and Their Applications 14 (2009): 95-106. (Springer-Verlag Lecture Notes of the Institute for Computer Science.) (Featured in Working Knowledge: When the Internet Runs Out of IP Addresses) (Circulated in 2008 as Running Out of Numbers? The Impending Scarcity of IP Addresses and What To Do About It.)

The Internet’s current numbering system is nearing exhaustion: Existing protocols allow only a finite set of computer numbers (“IP addresses”), and central authorities will soon deplete their supply. I evaluate a series of possible responses to this shortage: Sharing addresses impedes new Internet applications and does not seem to be scalable. A new numbering system (“IPv6”) offers greater capacity, but network incentives impede transition. Paid transfers of IP addresses would better allocate resources to those who need them most, but unrestricted transfers might threaten the Internet’s routing system. I suggest policies to create an IP address “market” while avoiding major negative externalities–mitigating the worst effects of v4 scarcity, while obtaining price discovery and allocative efficiency benefits of market transactions.

Disclosure: I provide advice to ARIN’s counsel on matters pertaining to v6 transition, v4 exhaustion, and possible revisions to ARIN’s v4 transfer policy. But this paper expresses only my own views – not the views of ARIN, its Board, or its staff. I write on my own behalf, not for ARIN, nor at ARIN’s instruction or request.

January 1, 2009December 2, 2023

Adverse Selection in Online ‘Trust’ Certifications

Edelman, Benjamin. “Adverse Selection in Online ‘Trust’ Certifications.” Proceedings of the International Conference on Electronic Commerce (2009): 205-212. (ACM International Conference Proceeding Series.)

Widely used online “trust” authorities issue certifications without substantial verification of recipients’ actual trustworthiness. This lax approach gives rise to adverse selection: the sites that seek and obtain trust certifications are actually less trustworthy than others. Using a new dataset on web site safety, I demonstrate that sites certified by the best-known authority, TRUSTe, are more than twice as likely to be untrustworthy as uncertified sites. This difference remains statistically and economically significant when restricted to “complex” commercial sites. In contrast, competing certification system BBBOnline imposes somewhat stricter requirements and appears to provide a certification of positive, albeit limited, value.

December 1, 2008

CPC/CPA Hybrid Bidding in a Second Price Auction

Edelman, Benjamin, and Hoan Lee. “CPC/CPA Hybrid Bidding in a Second Price Auction.” Harvard Business School Working Paper, No. 09-074, December 2008.

We develop a model of online advertising in which each advertiser chooses from multiple advertising measurement metrics–paying either for each click on its ads (CPC), or for each purchase that follows an ad-click (CPA). Our analysis extends classic auction results by allowing players to make bids using two different pricing schemes, while the driving information for bidders’ endogenous selection–the conversion rate–is hidden from the seller. We show that the advertisers with the most productive sites prefer to pay CPC, while advertisers with lower quality sites prefer to pay CPA–a result that may be viewed as counterintuitive since low quality sites cannot proudly tout their conversion rates. This result holds even if an ad platform’s assessment of site quality is correct in expectation. We also show that by offering both CPC and CPA, an ad platform can weakly increase its revenues compared to offering either alternative alone.

October 14, 2008December 2, 2023

Hydra Media’s Pop-Up Problem — Ten Examples

Late last month, I posted an example of Vomba using a Hydra Media affiliate link to defraud VistaPrint — charging VistaPrint for traffic VistaPrint would otherwise have received for free. This was only the second Hydra Media advertising fraud example I had posted on my public web site. (The first showed similar Blockbuster fraud in spring 2007.) So some might think Hydra Media doesn’t have a big adware, spyware problem. Indeed, that’s exactly what Hydra claimed in a comment to ReveNews.

Despite Hydra’s claims of appropriate and ethical behavior, my observations indicate the contrary. Looking back to June 2007, across all my AutoTester’s browsing, my AutoTester has seen a remarkable 1,343 instances of spyware sending traffic to/through Hydra Network — 56 incidents in the past two weeks alone.

Ten Specific Examples

Using my Automatic Spyware Tester, I recently found the following Hydra Media spyware/adware incidents.

Overwrites cookies of any other affiliates previously slated to receive commission for making a referral to the advertiser.

#	Date	Spyware	Advertiser	Traffic flow	Hydra ID	References
1	10/1/08	Zango	Survey Club	Zango > Hydra > Survey Club	27352	video, packet log
2	10/2/08	Outerinfo	Bidz	Outerinfo > MediaTraffic > Hydra > Bidz	17203	video, packet log
3	10/4/08	Vomba	Gevalia	Vomba > Hydra > Gevalia	15387	video, packet log
4	10/4/08	Vomba	Gevalia	Vomba > Offerweb > Hydra > Gevalia	5830	video, packet log
5	10/4/08	Vomba	Video Professor	Vomba > Hydra > Video Professor	6102	video, packet log
6	10/11/08	Zango	Gevalia	Zango > Hydra > Gevalia	11427	video, packet log
7	10/11/08	Vomba	Gevalia	Vomba > Doubleyourctr > Hydra > Gevalia	9136	video, packet log
8	10/11/08	Vomba	Reunion.com	Vomba > Artur2 > Hydra > AdShuffle > Reunion	28138	video, packet log
9	10/11/08	Targetsaver	Reunion.com	Targetsaver > Kchuentracking > Hydra > AdShuffle > Reunion	27039	video, packet log
10	10/12/08	WhenU	Omaha Steaks	WhenU > MediaTraffic > Tcshoppingdeals > Hydra > Omaha Steaks	7386	video, packet log
Effects: Targets advertiser with its own affiliate link — thereby charging the advertiser for traffic it would otherwise have received for free. See extended discussion in Auditing Spyware Advertising Fraud: Wasted Spending at VistaPrint.

These are just a fraction of the Hydra incidents my AutoTester observed during the past two weeks. But as the “Effects” entry notes, each of these incidents entails charging an advertiser for traffic the advertiser would otherwise have received for free — a strikingly poor deal for the advertiser. Moreover, each of these incidents entails a distinct Hydra affiliate ID, as shown by the ten unique values in the “Hydra ID” column.

Covering Their Tracks

It is difficult to know whether Hydra and the targeted merchants were aware that these affiliates were using spyware/adware to claim commissions on traffic merchants would otherwise have received for free. In principle it is possible that the affiliates told Hydra and the merchants what they were doing — though I find that unlikely at best. But in each instance, the packet logs reflect that these affiliates’ traffic to merchants did not affirmatively indicate that the traffic came from spyware or adware. In principle such designation could be provided by “sub=” tags on affiliate links, by HTTP Referer headers, or by other indications. But these packet logs include no such disclosure.

In incidents 9 and 10, it seems these affiliates and their spyware/adware partners took additional steps to cover their tracks. In incident 9, Targetsaver invoked the affiliate’s link to LynxtTrack and onwards to Reunion.com, without an on-screen Reunion window appearing, whether as a popup, popunder, Taskbar entry, or otherwise. See the incident 9 video — showing only a brief blip at 0:37 when Internet Explorer briefly loses then regains focus. (Notice the change in color of the Internet Explorer title bar.) With no meaningful on-screen display to report what occurred, even a sophisticated tester might fail to notice that an affiliate link had been invoked and affiliate cookies had been dropped. Incident 10 also reflects significant obfuscation: WhenU opened the affiliate’s link in a window that was initially blank (0:25-0:28). WhenU then moved the window off-screen, and even when I manually clicked the window’s Taskbar entry (video at 0:33), the window did not appear. Only by right-clicking and choosing Maximize (0:38) was I able to force the window to appear in the active screen space, letting me demonstrate and confirm that the window did indeed load the Omaha Steaks site through a Hydra affiliate link.

Taking from Other Affiliates

Not only do these affiliates charge merchants for traffic merchants should have received for free, but these affliates also take commissions that should have flowed to other affiliates. Suppose an ordinary web site affiliate (“A” for short) recommends, e.g., Gevalia. If a user clicks A’s affiliate link to Gevalia, and if a user later makes a purchase from Gevalia, then A is supposed to receive a commission on the sale. But if one of these spyware/adware-using affiliates jumps in with its own link, A gets nothing.

I first demonstrated this commission-stealing in July 2004. See my proof of Zango (then “180solutions”) claiming commissions that would otherwise be paid to other affiliates, as to traffic for Crucial, Freshpair, TGW, and Valuemags. This problem remains in full effect.

Legitimate rule-following affiliates rightly disdain spyware and adware for, among other reasons, their tendency to take commissions that would otherwise flow to legitimate affiliates. For example, my VistaPrint piece last month prompted a spirited response from Linda Buquet at the 5 Star Affiliate Programs Blog (“adware also steals from Vista Print’s HONEST AFFILIATES!”) and a discussion at affiliate forum ABestWeb.

Next Steps

In a recent MediaPost article, Hydra claimed it is “complying with the instructions [it has] been given.” Perhaps a few aggressive marketers are willing to look the other way on spyware and adware issues. But all of the advertisers listed above? All these companies are happy to pay commission on traffic they would otherwise have received for free? Pay commission for placements through spyware known to arrive on users’ computers without users’ consent? It strains credibility. By posting these examples, I intend to alert the corresponding advertisers to the nature of the traffic Hydra is sending them — letting the advertisers decide for themselves whether this is a suitable allocation of their marketing budgets. As detailed in my Wasted Spending at VistaPrint piece, my firm view remains that these placements offer advertisers no bona fide benefit, and that no fully-informed advertiser would willingly pay for such traffic.

Meanwhile, others are also observing Hydra placements through spyware and adware. In a comment at ReveNews, ShareASale CEO Brian Littleton noted that he sees Hydra affiliates using spyware and adware to cover and supersede traffic his company provides to advertisers — reducing earnings of ShareASale and ShareASale’s affiliates. Brian generously offers to provide Hydra with reports of these practices, and I encouraged Brian to post his findings on the web for all to see.

Hydra’s “AdControl” service promises “positive, proactive protection” to provide “control over where [advertisers’] ad[s] [are] placed.” Hydra says it “guards against compliance problems from every angle” to assure that ad placements are “safe[,] secure [and] profitable.” Furthermore, Hydra claims to provide “tough affiliate pre-screening and policing to assure quality.” I applaud these objectives, but it seems Hydra has more to do in order to deliver the ethical, compliant, profitable placements it has promised.

October 7, 2008December 2, 2023

CPA Advertising Fraud: Forced Clicks and Invisible Windows

At first glance, conversion-contingent advertising (cost-per-action / CPA, affiliate marketing) seems a robust way to prevent online advertising fraud. By paying partners only when a sale actually occurs, advertisers often expect to substantially eliminate fraud. After all, if commissions are only due when a user makes a purchase, what can go wrong? Unfortunately, this view is overly simplistic and, on balance, overly optimistic.

I’ve previously written at length about spyware and adware programs that watch a user’s web browsing in order to claim commission on sales that would have happened anyway. See last week’s examples of six different affiliates cheating VistaPrint through exactly this technique.

But CPA fraud does not require the use of spyware or adware on a user’s computer. To the contrary, I’ve seen plenty of CPA fraud that is entirely web based. Below I present three examples representative of this ongoing problem.

The Basic CPA Relationship

CPA advertising generally oblige an advertiser to pay a commission if three events occur:

A user browses an affiliate’s web site;
A user clicks a specially-coded link to a participant CPA merchant; and
A user makes a purchase from that merchant.

The purchase in step 3 may occur immediately, i.e. within a single browsing session. But even if the purchase occurs shortly thereafter, e.g. a day later or even a few weeks later, a merchant will typically credit this purchase to the corresponding affiliate — on the view that the affiliate at least introduced the user to the merchant. This extended credit period is typically known as the “return-days period.”

Example 1: Couponcodesmall Forces Clicks to Drop Buy.com Cookies

The Couponcodesmall Site – Cookie-Stuffing Invisibly

Some affiliates seek to bypass the user-click requirement (event 2 above) by simulating a click on an affiliate link using JavaScript. When the user merely visits the affiliate’s site, the affiliate forces the user’s browser to load an affiliate link — thereby placing affiliate cookies on the user’s PC, and claiming an affiliate commission if the user subsequently makes a purchase from the corresponding merchant.

In 2004, I presented 36 such examples in Cookie-Stuffing Targeting Major Affiliate Merchants, But the problem is ongoing.

In testing this month, I requested a page from Couponcodesmall, a top organic result for Google searches for “buy.com coupon” (without quotes). Couponcodesmall sent more than 65KB of HTML, followed by the following IFRAME:

I preserved a full packet log that shows this IFRAME in context. (Edit-Find on “IFRAME” to skip to the key section.) I also preserved a screen-capture video showing the cookies created after I requested this page — confirming the IFRAME‘s effect. As the HTML instructs, the IFRAME yields no visible on-screen indication — for the IFRAME‘s 5 pixel by 5 pixel size (blue highlighting) leaves too little space for the Buy.com site to be recognized.

Buy.com’s agreement with affiliates requires that affiliates comply with Commission Junction’s Publisher Service Agreement (PSA), and PSA rule 3.a grants credit only when a user “clicks through [a] Link[] to [an] Advertiser.” This affiliate’s IFRAME-delivered forced clicks exactly violate that requirement. If a user merely views this affiliate’s page, without clicking an ad or taking any other action, then this affiliate will receive a 3% to 5% commission on any purchase the user makes from Buy.com within the next 14 days, even though the user never clicked an affiliate link as required under the PSA.

I notified the affiliate program manager for Buy.com, and I gather that Buy.com is taking appropriate action.

Similar infractions remain easy to uncover. My automated testing systems typically uncover a dozen or more violations in a day of searching. I’ve also seen all manner of advances over the popups, popunders, and IMG tags I observed in 2004. For example, I now often observe cookie-stuffing using EMBED tags, OBJECT tags, HTML entity encoding, and doubly-encoded JavaScript.

Example 2: Allebrands Banner Ads Invisibly Load Affiliate Links

Other affiliates load affiliate links and drop affiliate cookies as users merely view a banner ad. From a rogue affiliate’s perspective, this attack is more effective than the attack in Example 1, for the affiliate need not get the user to visit the affiliate’s site. Instead, merely by viewing a banner ad on a third party web page, the affiliate can drop its cookies and obtain a commission on purchases users make from the targeted merchants within the return-days period.

That is, the affiliate bypasses both the user click requirement (event 2 above) as well as the browsing requirement (event 1 above). Removing this additional requirement lets the affiliate claim commission on more users’ browsing that much more easily.

To targeted merchants, this attack is importantly worse than the attack in Example 1. In particular, through this kind of attack, a merchant receives no promotional benefit whatsoever. Under this attack, merchants pay out commission only on sales that would have happened anyway — so every commission paid is entirely wasted.

I recently observed such an attack via a banner ad running on the Yahoo RightMedia Exchange. Merely by viewing an ad from Allebrands, a user’s computer was instructed to load three affiliate links, each in a 0x0 IFRAME. Below is the relevant portion of the HTML code (formatted for brevity and clarity):

GET /iframe3? …
…
Host: ad.yieldmanager.com
…

HTTP/1.1 200 OK
Date: Mon, 29 Sep 2008 05:36:02 GMT
…

<html><body style=”margin-left: 0%; margin-right: 0%; margin-top: 0%; margin-bottom: 0%”><script type=”text/javascript”>if (window.rm_crex_data) {rm_crex_data.push(1184615);}</script>
<iframe src=”http://allebrands.com/allebrands.jpg” width=”468″
height=”60″ scrolling=”no” border=”0″ marginwidth=”0″
style=”border:none;” frameborder=”0″></iframe></body></html>

GET /allebrands.jpg HTTP/1.1
…
Host: allebrands.com
…

HTTP/1.1 200 OK
…

The three IFRAMEs (green highlighting) load three separate affiliate links in three separate windows. Because these windows are each set to be 0 pixels wide and 0 pixels tall (blue highlighting), they are all invisible.

I preserved a full packet log of the entire HTTP sequence — showing traffic flowing from the underlying Smashits web site to Right Media to Allebrands to the target affiliate programs. (Edit-Find on “allebrands” to skip to Allebrands’ code.) I also notified the targeted merchants — McAfee, Microsoft, and Symantec. They’re taking appropriate action.

Allebrands’ Decoy Ad

Notice Allebrands’ tricky use of the misleadingly-named /allebrands.jpg URL (yellow highlighting). In particular, Allebrands instructed Right Media to send traffic to http://allebrands.com/allebrands.jpg — a .JPG extension, so seemingly an ordinary JPEG compressed image. But despite the URL’s extension, the URL actually provided ordinary HTML — creating the A HREF, IMG, and IFRAME‘s set out above. Meanwhile, if a user happened to look at this ad, the user would see only the http://allebrands.com/images/allebrands.JPG image specified by the IMG tag (pink highlighting; image shown at right). Because the IFRAMEs are invisible (blue highlighting), the IFRAMEs yield no on-screen display whatsoever.

In my testing, Allebrands distributed its rogue banner ad via a variety of web sites. One that particularly caught my eye was Smashits, a spyware-delivered banner farm which buys widespread pop-up traffic and shows voluminous ads. Beyond Smashits’ dubious traffic origins, Smashits is also notable for its placement of ads in invisible windows: Via the two-row FRAMESET presented below, Smashits creates a 0-pixel-tall “part1” frame of /audio/empty.html, which in turn ultimately displays the Allebrands ad at issue.

Reviewing the packet log in the context of my prior observations of Smashits’ spyware-originating traffic, the full sequence of relationships proceeds as follows: A variety of spyware sends traffic to Smashits (often via the MyGeek / AdOn Network / Mynaagencies run-of-network ad loader), and some users may affirmatively request the Smashits site. Smashits creates a 0-pixel-tall FRAME row in which to load ads off-screen. In that frame Smashits sends traffic to Traffic Marketplace, which redirects the traffic to Theadhost, which redirects it to RightMedia Exchange, which selects an ad from Allebrands, which stuffs cookies to claim commission from the three target affiliate programs.

Who is Allebrands? Allebrands’ web site offers no contact information, and Allebrands’ Whois is equally uninformative. But Allebrands’ DNS servers reside within creativeinnovationgroup.com, and Creativeinnovationgroup’s Whois references a Simon Brown at 700 Settlement Street in Cedar Park, Texas. Google Maps confirms that this is a bona fide address — seemingly a residential unit in a development.

Example 3: Avxf Stuffing Amazon and Hostgator Cookies through Signature IMG Tags in DealOfDay Forum

In Example 1, Couponcodesmall managed to lure a user to its own web site — in part through successful search engine optimization. In Example 2, Allebrands bought traffic from Right Media. In this Example 3, affiliate rogue Avxf manages to stuff cookies using others’ traffic — without paying for that traffic.

To get traffic, Avxf places images in the footer of a message it posts to a DealOfDay.com forum discussion. The associated HTML:

Originally Posted by <strong>somerset1106</strong> …

Ditto. I am still researching some other sites that are similar. If I find out any information I will keep ya posted. …

Avxf’s footer specified two .JPG URLs, /img16.jpg and /img17.jpg — seemingly image files based on their use of the standard .JPG file extension. But in fact these URLs redirect to affiliate programs for HostGator and Amazon:

GET /img16.jpg HTTP/1.1
…
Host: www.avxf.com

HTTP/1.1 302 Found
…
Location: http://secure.hostgator.com/cgi-bin/affiliates/clickthru.cgi?id=dsplcmnt01
…

GET /img17.jpg HTTP/1.1
…
Host: www.avxf.com

HTTP/1.1 302 Found
…
Location: http://www.amazon.com/?Fencoding=UTF8&tag=qufrho-20

Avxf Cookie-Stuffing:
The Resulting On-Screen Display

The resulting two pages then go on to drop affiliate cookies as usual. Thus, if a user makes a purchase at Amazon or Hostgator within their associated return-days periods, then Avxf gets paid a commission. The only on-screen indication of cookies being dropped is the two “broken image” icons shown at right — indications that something is missing, but in no way sufficient to inform a typical user (or even many advertising professionals) of what is occurring. Nonetheless, if a targeted user makes a purchase from Amazon within 24 hours of receiving Avxf’s forced click, or if a targeted user signs up with Hostgator within 30 days, then Avxf receives a commission.

I preserved a full packet log of the underlying HTML and redirects, showing Avxf’s images and redirects in context. (Edit-Find on “avxf” to skip to the code at issue.) I also preserved a screen-capture video confirming the destinations of the broken images.

Avxf’s practices violate applicable policies at Amazon and Hostgator. Amazon’s Associates program allows credit only if a customer “click[s] through” a special link (agreement 4¶1), whereas no click occurs in the example shown above. Furthermore, Amazon specifically prohibits atempts to “caus[e] any page of the Amazon Site to open in a customer’s browser other than as a result of hte customer clicking on a Special Link on [an affiliate’s] site” (agreement 4¶4). Similarly, the HostGator Affiliate Agreement prohibits the similar practice of forcing clicks through IFRAMEs (except “on pages or sites in which the other content represented on the site is related to HostGator” — an exception unavailable here, since the DealOfDay site is entirely unrelated to HostGator).

Who is Avxf? The Avxf web site offers adult content, but no mailing address on its Contact Us page. However, the site’s Whois offers a name and address: Kyle Hahn of Muncie, Indiana. Google Maps confirms the existence of the specified address, 480 W Skyway Drive.

Consequences – Winners and Losers

I see five basic consequences of these commission schemes:

Fraudsters win from the bogus commission they receive, despite failing to provide merchants with a bona fide marketing benefit.
Merchants pay extra commissions without getting anything in return. In particular, merchants pay commission on sales they would have made anyway. Moreover, merchants overestimate the effectiveness of their CPA marketing programs: Merchants mistakenly conclude that their CPA programs yielded sales that in fact would have happened anyway.
Legitimate affiliates lose commissions that are seized by fraudsters. Whenever an ordinary affiliate was about to receive a commission, but one of these fraudsters jumps in to claim the commission instead, the first affiliate loses a commission it had fairly earned.
Advertising intermediaries profit from the additional commissionable sales that purportedly occur. Affiliate networks typically charge merchants in proportion to the number (or dollar value) of commissionable sales. So every time a rogue affiliate claims commission improperly, the merchant must pay additional fees to the affiliate network.
Affiliate marketing staff typically benefit, directly or indirectly, from growth in the reported size of their affiliate programs. For example, an affiliate manager might earn a bonus for rapid quarter-over-quarter growth in affiliate program size.

In principle, merchants’ losses to fraud should encourage merchants to prevent such scams. But in practice, many merchants fall victim to these attacks. Why?

For one, enforcement requires fact-intensive technical investigation — examining HTML code and packet logs to uncover infractions. The required skills have little overlap with the relationship-building and communication that otherwise drive affiliate marketing.

For some merchants and networks, mixed incentives further hinder efforts to prevent these fraudulent practices. In the short run, affiliate networks and merchants’ in-house affiliate marketing staff stand to lose from rigorous enforcement — reducing their commissionable base, reducing the size of their marketing programs, and distracting their attention from activities that more directly increase their respective short-run compensation. Thus, in the short run, both groups may perceive that they can increase their profits by deemphasizing fraud prevention.

Of course, in the long run, affiliate networks have reputations to protect. Similarly, affiliate marketing staff must consider their duties to their employers; in the long run, employers may learn about these scams and think unfavorably of marketing staff who failed to take effective action to uncover improper practices.

Large Merchants at Heightened Risk

For many cookie-stuffing attacks, large merchants are at highest risk. For example, Avxf is essentially betting that the users who read DealOfDay will subsequently go on to make purchases from Amazon. As to Amazon, that’s a safe bet, for many users buy from Amazon with remarkable regularity. But if Avxf were to target a lesser-known merchant, it would face tougher odds and lower earnings.

Thus, these random cookie-stuffing attacks (as in Examples 2 and 3) tend to target large merchants. In contrast, SEO-based attacks, as in Example 1, can prey on CPA merchants of any size.

Prevention and Response

For merchants and networks seeking to uncover and prevent these practices, I see three clear ways forward:

Analyze statistics already on hand . Look for unusually high click-through rates, unusually low conversion rates, blank or unexpected HTTP Referer headers, unusual HTTP User-Agent headers, long delays between clicks and sales, and other errata. But beware of affilates who manage to manipulate these statistics.
Provide a report / complaint page. It’s surprisingly difficult for independent affiliates, users and researchers to report fraud to many online marketers. But such reports can be extremely useful — particularly when gathered by those with a special interest in catching these scams. There’s ample evidence that affiliates enjoy reporting scams: In the ParasiteWare forum at ABestWeb, affiliates and others analyze and reveal improper marketing practices; some merchants pay bounties to anyone reporting fraud by their affiliates (1, 2).
Conduct hands-on testing. Browse the web looking for such scams. Run a network monitor to detect any unexpected “click” events. Or, design appropriate software to conduct such tests automatically.

Separately, merchants and networks can sensibly deter violations through tough penalties. At present, affiliates face little downside to attempting to defraud most merchants. In Deterring Online Advertising Fraud Through Optimal Payment in Arrears, I suggest a different approach — paying affiliates more slowly so that they face greater losses if they are found to be cheating. Meanwhile, some merchants have resorted to suing fraudulent affiliates. See eBay v. Digital Point Solutions (accusing affiliates of cookie stuffing through invisible code claiming unearned commissions — like the examples above) and Lands’ End v. Remy (accusing affiliates of typosquatting on Lands’ End trademarks and redirecting to Lands’ End’s LinkShare affiliate links).

More generally, merchants ought not assume infallibilityof their online marketing schemes. Certainly CPA marketing programs avoid some of the more obvious problems of pay-per-click marketing (e.g. click fraud), but CPA campaigns remain vulnerable to other kinds of abuse. Shrewd merchants should anticipate what can go wrong, and design and audit accordingly.