A USENIX 2012 security video [1] provides a rare glimpse into how the online affiliate programs work. Understanding their economy may be the key to controlling these programs. In this paper they analyze leaked data from three affiliate programs online which amounts to 185M in gross revenue, 1M+ customers, 1.5M+ purchases, and 2600+ affiliates. First, I will provide brief introduction of online affiliate programs. Next, I will present the findings of the USENIX paper, followed the discussion of ideas on how the government could control or get rid of these programs altogether.
Most of us have come across unsolicited emails advertising different types of drugs. But, what we may all not know is this is a part of a full fledged underground economy which has business that functions much like the normal businesses – they keep track of financial records, revenue, cost etc. First player in this economy is the customer, the receiver of the spam email who may turn around and buy drugs online. Next player, is the affiliate marketer, who sent the spam email to begin with. Once, the customer decides to click on the link, the affiliate marketer is out of the game and the transaction is handled from that point on by the affiliate supplier which has staffs for customer service. The affiliate supplier however relies on another entity for payment processing. In general, these affiliate programs like to retain customers. So, they try to keep them happy by promptly addressing any of their concern.
The customers are usually people who are trying to save money by buying cheaper drugs online. The affiliate marketers are mostly spammers who own botnets. They work purely on commission based on the volume of traffic that they generate to the site. Some affiliate program apply screening process to recruit best affiliate marketers while others let anybody join as it does not cost the program anything – they work on pure commission. The payment service providers (PSP) charges a fee each time based on the value of the transaction (~10%). The shipping and handling is around 11.5% of the transaction. The cost of actual item is only around 7% percent of the transaction. After, 30% pain in commission to the marketing affiliate and other costs of operating a business, their average actual profit margin is around 16% and 30% in a highly optimistic case.
From the analysis of the data, they found out that 95% of the customers are from US, Canada, Australia and Europe. Erectile dysfunction drugs make 75% of the orders and generate 80% of the revenue. An interesting fact they found out was that between 2010 and 2011, one of the affiliate programs, RX Promotion’s relation with PSP went sour. This resulted in sharp decline in its profit to the point where it was about to close. No payment means they cannot take any new customer nor can they keep the affiliate spammers. Another point to note here is that three PSP processed 84% of the transactions for all three affiliate programs. Next important insight is that 10% of the affiliates accounted for the 80% of the revenue for these affiliate programs. Most affiliates failed with a median revenue of US$ 350/year. However, the top earners like the operators of Rustock earned US$ 1.9M, and Scorrp2 earned US$3M. The affiliate with the largest revenue, webplanet, earned US$ 4.6M, through web-based advertising.
To, summarize, if we have any hope of fighting these affiliate programs that sell fake or unauthorized drugs online, we have to first cut their life line which is their connection to PSPs. And, since there are only handful of the PSPs that do majority of the processing, it is a cost-effective move. As we saw, a handful of affiliates generate most of the revenue, the most cost effective way curb this industry is to direct operations against these “big player” affiliates.
References:
[1] https://www.usenix.org/conference/usenixsecurity12/pharmaleaks-understanding-business-online-pharmaceutical-affiliate