Data Leakage...And How To Take Advantage Of It

finnegan · May 2, 2016

Reading this post, I was intrigued about these methods he spoke of (highlighted in orange):

Affiliate and CPA Networks Also Suffer from Data Leakage.

Due to the way networks operate, one of the biggest leaks of data is the easy identification of the most popular offers on the network and also the affiliates sending the most amounts of traffic to those offers. With this information, it's easy for competing networks to poach top affiliates or advertisers. Additionally other affiliates are able to figure out how the top affiliates are generating leads for those offers.

Sources of Data Leakage for Advertisers or Offer Owners

The same data leakage risks that I described for networks, also apply to advertisers. With the current tools on the market, it's very easy for competing advertisers to find top affiliates and networks sending traffic and replicate everything.

Additionally, there is another huge data leakage issue that many advertisers and offer owners are totally unaware of and should plug up right away.

Advertiser Pixel Data Leakage

These days it is very common for affiliates to get their pixels placed on the conversion pages of an offer. This helps the affiliate to optimize conversions and generate more sales. However when implemented incorrectly, the simple act of placing 3rd party pixels on a conversion page usually means the 3rd party (Affiliate) has full access to all your conversion data. This includes sales not generated by the affiliate.

I'll refrain from fully describing how this works to prevent abuse by affiliates. However, those who know about this, have probably been pulling confidential data from every single conversion you generate without your permission.

Source: http://prosper.tracking202.com/blog/wake-up-and-smell-the-data

Anyone know what he's talking about?

miketpowell · May 2, 2016

The first part he's talking about tools like Alexa, Quantcast and Similarweb - they will tell what the top domains where traffic is coming from and where it is going. Throw in an affiliate networks tracking URL and you can get a decent idea who the biggest advertisers (ie pages they send traffic to) and who the biggest affiliates are (ie domains sending them traffic)

It's far from perfect and has tons of "noise" in the data. But you cannot really be doing high volume and not have the domains show up. The order might not be right but the domain will be there.

The 2nd part is about conditional vs unconditional pixel. They should never be firing an affiliate pixel unconditionally ie fire on all sales - you fire it only on the sales that affiliate generates. If you fire it for all sales you give the an affiliate to retarget or build a lookalike audience of your sales.

This is what Google has been printing money with the last 10 years, all the big web stores that fire a pixel telling Google who buys what on the internet so they can use that data to help them sell ads the those stores competitors.

finnegan · May 6, 2016

miketpowell said:
The first part he's talking about tools like Alexa, Quantcast and Similarweb - they will tell what the top domains where traffic is coming from and where it is going. Throw in an affiliate networks tracking URL and you can get a decent idea who the biggest advertisers (ie pages they send traffic to) and who the biggest affiliates are (ie domains sending them traffic)

It's far from perfect and has tons of "noise" in the data. But you cannot really be doing high volume and not have the domains show up. The order might not be right but the domain will be there.

I'm looking at Alexa right now but I don't have the upgrade so I'm not being shown a lot of data (just a few URLS from major sites). Anyhow, so you're saying if you type in an advertiser, the affiliate tracking URL will show up in the Upstream data they provide?

How would a network poach this person from another network by just knowing their site URL/landing page?

The 2nd part is about conditional vs unconditional pixel. They should never be firing an affiliate pixel unconditionally ie fire on all sales - you fire it only on the sales that affiliate generates. If you fire it for all sales you give the an affiliate to retarget or build a lookalike audience of your sales.

This is what Google has been printing money with the last 10 years, all the big web stores that fire a pixel telling Google who buys what on the internet so they can use that data to help them sell ads the those stores competitors.

How would the affiliate get the data from this if the affiliate network screwed up...or even know the network unknowingly fired it unconditionally?

miketpowell · May 6, 2016

finnegan said:
I'm looking at Alexa right now but I don't have the upgrade so I'm not being shown a lot of data (just a few URLS from major sites). Anyhow, so you're saying if you type in an advertiser, the affiliate tracking URL will show up in the Upstream data they provide?

How would a network poach this person from another network by just knowing their site URL/landing page?

Yes if volume has been done it will almost always show up in the full data. So you can see all sites that have send some traffic to each other to some degree.

They spam your whois info - search for other sites on the same IP and do the same. Obviously not a sure thing but it works.

finnegan said:
How would the affiliate get the data from this if the affiliate network screwed up...or even know the network unknowingly fired it unconditionally?

You know how they let you place a conversion pixel? Well you also place a remarketing/audience pixel. You can get one from Facebook/Google/any DSP. If that pixel is firing more often then you track sales they are firing unconditionally. All major affiliate tracking platforms don't do this unless they set it up wrong. More applicable with a direct deal with an advertiser and likely to happen.

However I know someone that did this with an advertiser that was paying him Net 30 on a large contract. They just stopped paying him so he was out 60 days of traffic when he was expecting a payment. He contacted them and they just laughed at him saying they'd be happy to take this to court with the 8 figure counter suit for how he broke the contract and stole data. He thought he was being clever and sneaky but it bit him in the ass big time in the end.

My rule of thumb is avoiding fucking with those you expect to pay you.

finnegan · May 6, 2016

miketpowell said:
Yes if volume has been done it will almost always show up in the full data. So you can see all sites that have send some traffic to each other to some degree.

They spam your whois info - search for other sites on the same IP and do the same. Obviously not a sure thing but it works.

Wow...just tried this and I had no idea that you could get that info from one IP. There's a great reason not to have your personal name domain on the same server as your other sites.

You know how they let you place a conversion pixel? Well you also place a remarketing/audience pixel. You can get one from Facebook/Google/any DSP. If that pixel is firing more often then you track sales they are firing unconditionally. All major affiliate tracking platforms don't do this unless they set it up wrong. More applicable with a direct deal with an advertiser and likely to happen.

However I know someone that did this with an advertiser that was paying him Net 30 on a large contract. They just stopped paying him so he was out 60 days of traffic when he was expecting a payment. He contacted them and they just laughed at him saying they'd be happy to take this to court with the 8 figure counter suit for how he broke the contract and stole data. He thought he was being clever and sneaky but it bit him in the ass big time in the end.

My rule of thumb is avoiding fucking with those you expect to pay you.

If the advertiser placed your friend's re-marketing pixel on their own server, how is that his fault?