How does a merchant / network spot spyware?

[Keith]

Tweet

Forgive me if this has been answered elsewhere but 'How does a merchant or a network spot if an affiliate is using spyware?'

[Rich]

As far as I know, there has been no discussion on this. But with most network's tracking setups it would be very easy to spot adware that is showing affiliate linked popups or redirects after a user has clicked on an affiliate link, which is one area that is particually important to affiliates.

Stopping adware that just shows a popup, or even a url refresh, which does not follow the use of a normal affiliate link, e.g. on the user typing the merchants domain or following a non-affiliate link, would be hard to spot without also having access to the merchants logs.

In the first example, most networks don't set a cookie including details of who clicked what when. Instead they set a cookie with a unique ID and then store the details of who the link was from, what merchant it was to and what time it was clicked, etc along with this ID in their database. If the user has used a previous affiliate link thru that network (from any affiliate to any merchant) they will already have an ID cookie set and that will be used again so as the database keeps track of all their clicks.

Lets say at 12:25 a user clicks on an affiliate link from my site to B&Q. The tracking table will have a new row added to it something like: -

+----+-----------+----------+-------------------+
| ID | Affiliate | Merchant | DateTime          |
+----+-----------+----------+-------------------+
+ 85 | Rich      | B&Q      | 30/08/04 12:25:00 |
+----+-----------+----------+-------------------+

Now, if there is some spyware on that users PC that shows an affiliate ad over the merchants site and the user clicks on it, the tracking table will look like: -

+----+-----------+----------+-------------------+
| ID | Affiliate | Merchant | DateTime          |
+----+-----------+----------+-------------------+
+ 85 | Rich      | B&Q      | 30/08/04 12:25:08 |
+----+-----------+----------+-------------------+
+ 85 | Dodgy Aff.| B&Q      | 30/08/04 12:25:15 |
+----+-----------+----------+-------------------+

It would be (is) easy for the network to check for clicks generated by one user, but via different affiliates within some time frame.

SELECT click1.*, click2.Affiliate
FROM tracking AS click1
JOIN tracking AS click2
ON click1.ID=click2.ID
AND click1.Affiliate!=click2.Affiliate
AND (click1.DateTime + INTERVAL 30 SECONDS)>click2.DateTime 

the above is just free typing, but should be some thing like right.
The above test should also work to detect if the popup is displayed for another merchant, which as far as I understand it is still allowed by TD.

Its not perfect, but the networks do have more info than that above, so for example the could ignore users clicking on a number of PPC ads in quick succession by filtering based on the referring URL.

It would be good to know if any networks actually perform these kinds of tests.