Redirecting web traffic transparently

I am thinking of setting up a service (something along the lines of clickbank) which involves the redirection of web requests. What I want is for a customer's request to come through me, which I will pass on to the correct web site for the product; but as far as the receiving web site is concerned, the IP address etc. should be the same as if the user has gone to their site directly.

My networking knowledge is basic, but I would have thought that if I set up a proxy, the "true" web site will receive the request from my proxy's address, or am I wrong? If I set up a landing page on a web server and redirect, will I not have the same problem?

Can someone please point me in the right direction of what I need to read up on...!

Shakes.

Um.. Can you explain better I dont quite follow...

Where is the server located? On a private lan? or is it a regular server that has a .com or something? Or are there multiple servers?

Will the customers all accessing the site(s) from the web?

To use clickbank as an example:

Affiliates (advertisers) and sellers both sign up for the service. I provide the affiliate with a link which will send a potential customer (via me) to the seller's web site. The affiliate's details are recorded and if a transaction takes place, the seller pays me a commission, and I pay the affiliate.

The forwarding must be transparent to the customer, and the IP address must stay intact so that any anti-fraud measures taken by the on-line shop doing the business remain valid. I don't want dodgy credit card transactions coming back to me instead of the perpetrator.

So yes, the server will be an internet-available domain, and the customers worldwide.

The affiliates should provide you with banners or links that direct them to their site. Either way if you made a link to another site when some one clicks it the other site could look at the referrer in the headers and see it comes from your site.

Most sites just give u a link like this:
www.advertiser.com/blahblah?AffiliateID=YouSite

So the ad company will have a script that logs the "affiliateid" by using the "blahblah" script

I'm the one providing the links to the affiliates.

The problem with the method you mention is that the affiliate has to trust the web site owner to be honest. The owner gets all the business, and only pays the affiliate if he feels like it. The affiliate pays for the ad, and doesn't have any record of who clicked through it. There are plenty of people who advertised some of the casino sites, and the casinos took the business and didn't pay the affiliates. I'm sure there must be plenty more examples.

The way clickbank operates is by logging clickthroughs, then forwarding the request. That's the bit I'm trying to emulate.

What if you implemented some sort of system that logged the clicks on your server and makes them in a readable format. Then the affiliates can have their own login to that part of your site that lets them see the raw logs. I suppose you "could" still alter the logs.

Just to clarify you will be the one with ads on your site? Arent they supposed to pay YOU when some one clicks on the link since you are providing THEM customers?

oofki, I think you're still struggling with the concept...

The affiliates post their adverts on their sites, or Google, or wherever. The adverts are to bring customers to OTHER people's web sites (sellers). What I provide is a central point where affiliates can browse for shop owners they want to represent, and where shop owners can offer affiliate programs to prospective affiliates. I sit in the middle and log the transactions to ensure "fair play" between both parties.

All I want to know at this point is HOW do I forward a web request without losing the IP info? I know it can be done because that's exactly what clickbank, mutualpoints, mrs cashback et al are doing.

Well the easy way would be a cookie I suppose then. The link sets the cookie and the site reads it.

You want me to get all the world's online shops with affiliate programs to change their sites to read a cookie I set?

I'm sure you're trying to be helpful, but you obviously don't understand the problem. Either that or you normally post on /.

I guess I still dont understand then.

Who has the page(s) with the ads?
Who is advertising?
Who is getting paid?

I think that will help me understand...

Hi oofki,

Quote:

---

I guess I still dont understand then.

---

There isn't very much to understand mate, it is a classic MITM (man in the middle attack).

It won't work though. Whilst I have absolute confidence in human stupidity, I have even more confidence in their greed ;)

In answer to your questions:

1. The ads/site links are on websites run by "affiliates"
2. The vendor is doing the advertising.
3. The vendor gets paid for the goods and the advertiser for the contact.

So, there is no need for a parasite in the middle?

If you set up a website with details of "affiliate" schemes, people will simply visit, write down the details and then deal directly with the vendor. Thus cutting out the MITM and maximising their revenues?

Furthermore, security software will start to pick up that the initial contact is not what it should be, and will identify it as a potential MITM attack. This will get the vendors and affiliates on RTBLs, which they certainly don't want :eek:

These things are either based on trust or on providing a secure vendor billing service. The only way you can be reasonably sure that a transaction has taken place is by monitoring customer confidential information, with all the security implications that such activity entails.

Hi Nihil, we meet again!

Quote:

---

Originally Posted by nihil

So, there is no need for a parasite in the middle?

---

What do you think shopkeepers are? Why don't the public all contact the distributors direct, and miss out the MITM? Because they like to wander into a shop and see what is on display. They then buy the goods from the shopkeeper because he's provided them with a service, and shown them what there is available. Once they know an item is available, they COULD go hunting for the distributor and buy one direct, but most of them don't because either a) they're too stupid or b) they're too lazy. Most people fit into the latter category.
Personally, I don't mind paying a little extra if I save a few hours of my life to do what I want with. Our time on this planet is limited!

Quote:

---

Originally Posted by nihil

Furthermore, security software will start to pick up that the initial contact is not what it should be, and will identify it as a potential MITM attack. This will get the vendors and affiliates on RTBLs, which they certainly don't want.

---

This does interest me. You are from the UK, you know MutualPoints and the like. They pass a customer on to another's web site in the same manner, by a simple redirect. Why do they not get tagged as evil baddies?

I think that you are confusing your business models here?

Quote:

---

What do you think shopkeepers are? Why don't the public all contact the distributors direct, and miss out the MITM? Because they like to wander into a shop and see what is on display. They then buy the goods from the shopkeeper because he's provided them with a service, and shown them what there is available. Once they know an item is available, they COULD go hunting for the distributor and buy one direct, but most of them don't because either a) they're too stupid or b) they're too lazy. Most people fit into the latter category.

---

The shopkeeper is a retailer just like web vendors are. Customers find an advert on an affiliated website and follow it through to the vendor. Please remember that a lot of this business is "pay per click" rather than transaction based.

That is why most of these providers also offer a complete web retailing service, even including the shopping cart.

From your original post, you appear to be proposing a service for affiliates and vendors, not for customers? As these people are actually in business in some fashion or other I think it reasonable to expect them to spend the 30 minutes or so it would take to steal the information from your website.

Even Google searching for an hour or two would provide the information, as we are talking small sites that cannot host very many adverts.

If I click on an advert on most sites I get a simple redirect. That is it simply passes me on to the genuine site, which will work provided the site is not blacklisted. If that didn't happen there wouldn't be any third party advertising.

You don't have to be a math genius to figure out that paying commission to someone who is doing absolutely nothing for you (which is what you are proposing) is a total waste of space. You are not dealing with the public here, but with webmasters and web vendors, who are not the same.........the last two are out to generate revenue;)

Also remember that the big boys in Web transaction management are well known and established, so they and their methods are recognised, and their sites trusted. Unless you were a subsidiary of something pretty well known then I would say that a new start in this field is virtually impossible.

The "baddie bit" comes when you try to sit in the middle and intercept customer confidential information. Obviously, that is exactly what scammers try to do? They can even spoof secure links :eek:

Quote:

---

I think that you are confusing your business models here?

---

OK, so I changed the example to try to prove a point ;)

The fact is that ClickBank have been using a business model similar to my original proposition for about nine years, and have some 100,000 affiliates working with them. Maybe I'm missing something in the logistics at the moment, but the basic theory obviously works for them.

Quote:

---

Also remember that the big boys in Web transaction management are well known and established

---

This is definitely a valid point as far as competition is concerned, but there's usually a niche or alternative way of offering the same concept to make it attractive.

Hi, an earlier point:

Quote:

---

You want me to get all the world's online shops with affiliate programs to change their sites to read a cookie I set?

---

Something like that. If you look at how these guys work, they give each affiliate (advert holder) a unique URL to locate the vendor and product. The vendor also has to make amendments to allow tracking of transactions.

Quote:

---

The fact is that ClickBank have been using a business model similar to my original proposition for about nine years, and have some 100,000 affiliates working with them. Maybe I'm missing something in the logistics at the moment, but the basic theory obviously works for them.

---

Not really, they all seem to offer something along the lines of:

1. A total e-commerce solution. Customer deals with Service Provider.
2. Payments processing. Customer deals with vendor and SP for payment.
3. Affiliate programmes. Customer deals with either vendor or SP or both.

The affiliates just select individual products from their catalogue to promote. They are typically bloggers out to make a few bucks.

Please remember that ClickBank are a trading unit of a much larger corporation. They started off with technical staff and venture capital.;)

Quote:

---

This is definitely a valid point as far as competition is concerned, but there's usually a niche or alternative way of offering the same concept to make it attractive.

---

It is not so much the competition I was concerned about as getting a start in the first place. The big boys have been around since before internet fraud really caught on, so they are well known and on whitelists. You are not.

As an analogy I would say it is a bit like asking a first time jobber for experience............ without it they won't get a job, and without a job they won't get experience?

Your idea of niche markets seems sound, as they tend to be specialists and enthusiasts, and the items they deal in tend to be of a higher value which makes up for lower volumes. Also, dealing with vendor sites rather than individual products may be more attractive to smaller websites as there are more sales opportunities.

Obvious things to steer clear of are: pharmaceuticals, adult content, get rich quick, loans & finance, and gaming.................you know you will get ripped off.

:)