Here's how I realized I was being robbed by a Clickbank affiliate

Hi everyone.

I'll make this quick because it's important to know & easy to fix (usually).
I started a thread about an hour ago here. I felt there was an affiliate who had hacked my website and was cookie stuffing. This means that anyone buying my product would create illegal revenue for the fraud affiliate. It robs me and it robs my honest affiliates.

I found the problem in the popular Audio Player plugin. I noticed that Nov 24th someone FTP'd into my hosting account and uploaded a single audio-player.js file to overwrite the original. Obviously a hacked version of the file that cookie stuffs.

I verified that if I deactivate the plugin, the problem goes away. So I have left the plugin deactivated.

HOW TO FIND THESE PROBLEMS YOURSELF:

If you suspect something fishy is going on in your website the best thing to do is narrow down the date to a best guess as to when the problem started. For me it was easy. I looked at the first date when this new affiliate made a sale.

Then either check your web host logs (FTP logs, etc) or simply FTP into your account and look at the "date modified" field so you can see when files were changed in your account. Whatever files were modified around the date of the problem are suspicious files and you should look at them.

If, as happened to me, a plugin was modified and you know you didn't touch it, you can be confident you've found the problem.

In my case, the FTP account used was my MAIN account with a secure password. So I'll be changing that password.

Hope this helps someone ...