Affiliate fraud turns website visits into someone else's commissions.

Affiliate fraud on a website sends traffic through tracked offers without an honest referral. Attackers inject a loader, frame or redirect into the site, then let a traffic controller choose what each browser does.

compromised page or deceptive landing
  -> injected loader profiles the visit
  -> hidden request, forced click or redirect
  -> affiliate tracker records the visit
  -> browser reaches an offer or another redirect

Redirects that wait for the right visitor

Some injections load a small remote script and leave the routing decision to its server. HotejMain retrieves routing text through synchronous XHR, reconstructs the destination and injects a keyed click-stage script. PixelMenu loads remote scripts through a one-pixel GIF's onload handler in a Joomla menu. Its scripts check the referrer and browser state before hijacking clicks and Back navigation or showing a lottery offer. Sign1, planted in WordPress widgets, sends on only visitors whose referrer is Google or Bing. Other injections check screen width and browser details first, so a desktop site owner sees the expected page while a mobile visitor is sent elsewhere. We match WordPress maintenance pages that redirect mobile browsers and loaders that request per-visitor configuration.

Reward pages do the same job with a form. A fake TikTok rewards page collects the visitor's email and carries the affiliate tracking values into the address it sends them to.

Hidden frames and cookie stuffing

An off-screen frame can open a tracked affiliate route without taking over the visible page. The destination can then set an attribution cookie, giving the affiliate credit if that browser later buys something. We have matched injected scripts that create large frames outside the viewport and feed them into redirect trackers carrying referral campaign values.

Look beyond the final address. A chain can replay the current path and query on a mirror, send a token through several controllers or keep a once-per-day marker in browser storage. Those gates make repeat checks look clean.

TrackMyPoss and Lnkr

TrackMyPoss sends the site and referrer to a controller, stores returned state in the browser and runs JavaScript from the reply. The reply redirected the visitor to a push and Back-button advertising page.

Lnkr posts visitor context to a routing server and follows its returned destination. Its newer redirector requests high-entropy browser details and checks automation before replacing the current page.

What we see across infected sites

Month	New sites
September	628
October	946
November so far	149

62% of the affiliate-fraud sites captured since 25 September run WordPress. 19% made requests for Joomla core paths. Of the 622 sites recaptured at least 25 days after their first match, 487 still served affiliate-fraud code (78%).

Checking a site

Test the logged-out site on mobile and desktop, with the browser network log open. Check for:

• unfamiliar script tags added to the page head or footer
• frames positioned off-screen or reduced to an invisible size
• redirects that run only on mobile, after a delay or after a click
• close buttons, backdrops and Back-button handlers that open another address
• browser-storage keys that suppress the redirect for a day or longer
• requests carrying referral, campaign, click or visitor identifiers

Remove the injected loader and every cached copy. Compare themes, plugins and site templates with trusted releases, review administrator and hosting access, rotate those credentials and test the page again from a clean browser profile.