This page shows specific network transmissions that implement 180's double-popup
cookie-stuffing, targeting a request for tgw.com made at approximately 1pm (Eastern)
on July 24, 2004. See also a video (WMV format,
view in full-screen mode, warning: >1.6MB) confirming what took place, including
showing my Cookies folder before and after receiving the 180solutions popup.
The thumbnail at right shows the final on-screen display -- the tgw.com site,
covered in part by the double popup that reached tgw.com through an affiliate
link.
Other Targeted
Merchants: Double and Silent
Popups
In this example, I sought to document how 180 (and its advertisers) can overwrite
cookies set by other affiliates. My testing proceeded in the following way:
I cleared my cookies, such that any cookies set on my PC were set in the
course of the testing shown in my video.
I browsed to dealhunting.com, an ordinary affiliate site that links to tgw.com
via an affiliate link. I clicked through that affiliate link, yielding the
communications shown in HTTP Transaction 1 (with original
affiliate link shown in red highlighting).
I briefly browsed the tgw.com site. (Network logs omitted for brevity.)
In HTTP Transaction 2, Zango (installed on my PC) asked
180solutions' web servers for an ad to be shown -- sending the tgw.com trigger
(as shown in yellow highlighting), and receiving a URL to deal-savings.com
in response (purple highlighting).
In HTTP Transaction 3, Zango loaded the specified deal-savings.com
page in a new window. Via a META REFRESH tag (orange highlighting), the page
redirected the new window to a LinkShare affiliate link which in turn set
LinkShare cookies referencing the same affiliate code used on the deal-savings
page (HTTP Transaction 4) .
Observing my cookies (cookie listing), I see that at the
end of the events described above, my linksynergy.com (LinkShare) cookies
included a reference to the affiliate code used on the deal-savings page (blue
highlighting). However, I see no surviving reference to the affiliate code
used on the original dealhunting.com page.
Consistent with the rest of my site, the network logs below omit my DUID (my
unique 180solutions user ID number). In place of the actual affiliate ID number
used by the deal-savings 180 advertiser, the logs use the phrase "[deal-savings
affiliate ID]".
In my testing of July 24, 2004, tgw.com is but one of many merchants that remain
targeted by 180solutions double popups. Some targeted merchants (like tgw.com)
use LinkShare; others use Commission Junction; others use other networks, or
run in-house affiliate programs. Some double popups (including this one) reach
affiliate links through redirect servers, while others entail 180solutions sending
users directly to an affiliate link via no other intermediaries.
HTTP/1.1 302 Found
Date: Sat, 24 Jul 2004 16:56:12 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: lsn_statp=tVEFAQ%3D%3D; domain=.linksynergy.com; path=/; expires=Fri,
19-Jul-2024 16:56:13 GMT
Set-Cookie: lsn_qstring=km%2FjX8Vq%2F5Y%3A40500%3A; domain=.linksynergy.com;
path=/; expires=Sun, 25-Jul-2004 16:56:13 GMT
Set-Cookie: lsn_track=UmFuZG9tSVYf7fugOXl1HSKEsD8fWRJ5oZNfAQsii4ClsFJrQ4DTC3q3cKYImn%2FgbG6kiYyxULk%3D;
domain=.linksynergy.com; path=/; expires=Tue, 22-Jul-2014 16:56:13 GMT
Expires: Fri, 23 Jul 2004 16:56:13 GMT
P3p: CP="ALL DSP COR NID DEV ADM CUR OUR BUS LEG NAV"
Location: http://www.tgw.com/linkshare.html?siteID=km%2FjX8Vq%2F5Y-LpnORe5lQhUutsusLZoL2g&url=http%3A//www%2Etgw%2Ecom/stores/linkshare%2Ejsp%3FURL%3D/clearance/clear%2Dcenter%2Ejsp
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-1
1bc
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://www.tgw.com/linkshare.html? siteID=km%2FjX8Vq%2F5Y-LpnORe5lQhUutsusLZoL2g&url=
http%3A//www%2Etgw%2Ecom/stores/linkshare%2Ejsp%3FURL%3D/clearance/clear%2Dcenter%2Ejsp"
>here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.29 Server at njws0066.private.linksynergy.com Port
80</ADDRESS>
</BODY></HTML>
GET /showme.aspx?keyword=tgw.com&did=762&ver=5.11&duid=531byhiprtvdgvadrfmfcgtxxyrjmg
&partner_id=183723514&product_id=762&browser_ok=y&rnd=14&basename=zango
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<meta name="vs_targetSchema" content="http://schemas.microsoft.com/intellisense/ie5">
</HEAD>
<body>
<SPAN class="957085619-06032003"><FONT face="Arial"
color="#ff0000" size="5">Thank you
for your patience. You will be redirected to your destination site
in a
few seconds.</FONT></SPAN>
</body>
</HTML>
HTTP/1.1 302 Found
Date: Sat, 24 Jul 2004 16:56:39 GMT
Server: Apache/1.3.29 (Unix) mod_perl/1.29
Set-Cookie: lsn_session=laPbZG136Q0; domain=.linksynergy.com; path=/; expires=Sat,
24-Jul-2004 16:58:39 GMT
Expires: Fri, 23 Jul 2004 16:56:39 GMT
P3p: CP="ALL DSP COR NID DEV ADM CUR OUR BUS LEG NAV"
Location: http://click.linksynergy.com/fs-bin/swat?lsnsig=laPbZG136Q0&id=[deal-savings affiliate ID]&offerid=42808.10000052&type=4&subid=79
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-1
18e
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://click.linksynergy.com/fs-bin/swat?lsnsig=laPbZG136Q0&id=[deal-savings affiliate ID]&offerid=42808.10000052&type=4&subid=79">here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.29 Server at njws0066.private.linksynergy.com Port
80</ADDRESS>
</BODY></HTML>
As
discussed in Affiliate Code Replacement via Popup "Double"
Windows within The Effect of 180solutions on Affiliate Commissions
and Merchants, 180 has implemented a system that can set affiliate tracking
codes by showing a user a duplicate copy of a merchant's site. These popups
set affiliate codes that, in the ordinary course of events, cause 180 to be
paid commissions otherwise payable to other affiliates, and cause 180 to be
paid commissions even if no commissions would otherwise be paid. For a listing
of affected merchants (as of tests of June 2004), see merchants
targeted with double windows. See also merchants
I previously found to be targeted with silent cookie-stuffing.