Web attribution fraud
Image embedding
A publisher replaces an image’s source code with their affiliate link and then places that image on a heavily trafficked public website. While the image will not load (it will render as a broken image icon or blank space), the browser will still follow the link and read and act on cookies sent through it. This technique is relatively unrefined, but what it lacks in targeting specificity it makes up for in broad reach and zero-cost, low-effort effectiveness.
How they do it
- Malicious publisher has registered for advertiser’s affiliate program
- Publisher embeds a signature image with their affiliate link
- Publisher posts a comment on a high traffic forum with the signature appended
- User visits the forum page and views the signature
- User has malicious publisher’s cookie dropped on their browser and is redirected to advertiser’s website
- Some time later, user intentionally and organically returns to advertiser’s website to shop and makes a purchase
- Advertiser attributes credit to the malicious publisher, even though they provided no value in driving the sale, and pays them a percentage of revenue
