Blogger skimming Amazon affiliate links?

Hi,

I've noticed the affiliate id (tag) I put on my Blogger blogs are rewritten on-the-fly as heaprcom05-20, then the visitor is redirected to the Amazon product page.
As the operation is very fast, the regular visitor does not even see it.
But in the end, any sale made from my blogs are paying out someone else, like in a classic man in the middle attack.

heapr.com seems to be a meta-search engine, so maybe that affiliate id has nothing to do with it.

If you want to check it out, here are two of my posts:
http://web-technos.blogspot.fr/2012/08/christian-guemy-c215.html (book link at the end of the post)
http://web-technos.blogspot.fr/2012/06/responsive-web-design.html (book links at the end, in the "A bit of reading" section)

Well, I'd like to know if other people than me are skimmed this way, as I can't find anything on the web at the moment.

 

I have heard this happening to a few affiliates and I dare say it's more commonplace than you'd expect. Have you reported your concerns to Amazon?

 

The issue I've encountered is not linked with Blogger at all, as it occurred with other websites too.
It is due to a spyware disguised as a legitimate Google Chrome plugin, which has been removed from the Chrome Web Store.

The spyware/malware plugin is "YouTube Downloader: MP3 / HD Video Download 12.0", for both Google Chrome and Firefox (I don't know to which extend it acts the same with Firefox though).
It is used to add a button on YouTube pages to download MP3s or videos.

When installed, one of its actions is to replace the legitimate Amazon referral tag id with this one: heaprcom05-20
When this plugin is uninstalled, the tag id is not rewritten any more.

Other websites data are at risk, like Twitter, Tumblr, Orkut, Google, and ClickBank, even if we don't know yet which data is spied upon or rewritten.

The username/password can potentially be intercepted.

More information on this forum: http://www.gamedev.net/topic/629427-curious-problem-locally-injected-javascript/

 

This sound like you have malicious software. Have you tried running a full scan to see if you have any malware/trojan viruses. This could be what's mimicking your information? I also clear my browsing history everyday just before I shut down my laptop as an extra precaution.

I hope you sort this out.

 

As I said, the issue is only linked with that Chrome plugin. Once removed, the links are not rewritten anymore (I tried it on different computers too).

 

Nice detective work, man, that would be heartbreaking to have legit traffic and get no credit for conversions on the other end.

 

french-webbie is right this sounds like spyware you should scan/clean your computer.

 

My wp blogs were deativated yesterday

 

That's the second person on this site to have mentioned this about WP sites. I wonder if they're doing a blitz on certain blogs, as I've randomly checked a few of my own and they're all still there and working fine?

 

Cheers french-webbie

I noticed this on my main amazon site... I had that chrome extension... feckin scumbags, surely the amazon account, heaprcom05-20 has been terminated by now.

Anyway, thanks for letting us know the cause.