Hidden Cookie Stuffing – Black Hat SEO Method

iPage Affordable Web Hosting only $3.50/mo

SEO cookie stuffing black hat

Hidden Cookie Stuffing – Black Hat SEO Method

Always listen to the experts. They’ll tell you what can’t be done and why. Then do it.” – Robert Heinlein, American science-fiction writer, 1907-1988.

There are many ways to monetize websites and get decent profit from them. There are good White Hat SEO guys that work hard to optimize their sites and attract traffic. They monetize their traffic via Google AdSense or affiliate links that actually offer products and services relevant to the visitors. You can see this happening on this blog as well.

We will not look at these boring White Hat SEO techniques, instead we will talk about those bad boys out there, lurking around, always looking for weaknesses to exploit and make money.

In today’s post we will discuss a new sophisticated and undetectable cookie stuffing. This new method of cookie stuffing was recently discussed in the underground Black Hat SEO community. Apparently a user named “Haqer” claiming to be from Pakistan, was spotted using this method first.

Let’s get to the bottom of this issue and try to understand why many talented and well known Black Hat SEO members praised this guy from Pakistan calling his method  of cookie stuffing genius.

Let’s briefly go over what cookie stuffing really is. For example when a visitor clicks on a affiliate link which takes them to the vendor’s site to make a purchase, a vendor will have a record of that affiliate id in the customer’s cookies. Then this affiliate gets paid via the amount of purchases made by the customers carrying this affiliate id in their cookies.

If a customer visited site belonging to one of the cookie stuffing bad boys, their cookies in the browser gets stuffed with an affiliate id without their knowledge. Then when this person goes to a legitimate site and makes a purchase later on (could be a week, a month, or longer), the affiliate id entered into the cookies without the customer’s knowledge gets credited and that person who stuffed the cookies of this customer gets paid. Yes, this is the basic cookie stuffing scheme.

Well all the big time nerds at Google were fighting this and banning sites that were using cookie stuffing. Many White hat SEO and otherwise noble gentlemen are trying to learn how to combat this Black Hat SEO activity.

The problem with direct cookie stuffing is that a large and increasing number of networks are implementing robots and manual flags to detect and ban cookie stuffing resources. It has become difficult for the Black Hat SEO boys to perform their acts of evil, even if their old-school cookie stuffing is based on referrers, using IPs, user agent, random throttling, and so on.

Now let’s look at our Pakistani boy’s cookie stuffing scheme a little closer.

Let’s assume Blog A is his site with high traffic. Let’s go ahead and build another blog and call it Blog B. Now, let’s go ahead and submit Blog B to social networks, blogs, directories, and many other networks. When a visitor comes to Blog A, the cookie stuffing happens, however the referrer gets spoofed to Blog B. Notice that Blog B never does cookie stuffing to any of the visitors. Robots visiting Blog B as well as manual reviewers (flagers) will never find anything shady there. Below is a basic diagram to show what’s happening here.

SEO cookie stuffing

Our friend from Pakistan had made this all look simple by doing the following: His Blog B (that doesn’t do cookie stuffing) had a php page which included javascript redirect (in combination with back up meta refresh redirection) to the affiliate link. Blog A had a 1 by 1 IFrame with the hidden javascript or php code. He did it by hiding it in the image changed for apache to read images as php code. The IFrame loaded up the php Redirection page from Blog B, which in turn loaded in his affiliate link, which does the cookie stuffing to the customer visiting Blog A. The referrer showed Blog B as the original source of this visitor (traffic).

The impressive new idea and implementation of cookie stuffing shows that this guy is very intelligent and sneaky (and rich :-) ). Note that currently there is no known way to combat this approach.

However, the White Hat SEO community will continue to fight against these bad boys from the Black Hat SEO world.

Good luck and be strong!

Beck @ PrfitSEO.com

The video below shows how a guy from a third world country, without access to fancy sport centers, without diet supplements, can be #1 and destroy every heavyweight in the world. If this guy can do it, if “Haqer” could do the impossible, you can do it too. Whatever your goals and dreams are – go get them!

This video was embedded using the YouTuber plugin by Roy Tanck. Adobe Flash Player is required to view the video.

Similar Posts:

Popularity: 34%

8 Responses to “Hidden Cookie Stuffing – Black Hat SEO Method”

  1. Loved reading this post, do you also have some sort of newsletter?

  2. Feel free to sign up for the RSS Feed and you will get the latest updates right to your reader.

  3. Really great post. Understood most of it but got a little lost on

    ‘Blog A had a 1 by 1 IFrame with the hidden javascript or php code. He did it by hiding it in the image changed for apache to read images as php code.’

    I’m thinking a image with php hidden in comments maybe? or maybe I’m just misunderstanding this. Care to elaborate a bit on these two statements. . .

    thanks

  4. No problem. The IFrame with javascript or php code was hidden inside the image itself. This wasn’t hidden in the comments or anywhere outside of the image, but inside the image. The action was being executed on the server side not the client (browser) side, which is necessary in this case to control what happens. You have to have root access to the server where this IFrame and image are located. The way apache reads the images was changed to read them as php code, thus causing the needed effect. I hope this helps.

  5. Thanks for the response. . . but still pondering this question itself so interesting. Have you actually tried to replicate this system and were you able to make it work. I have never seen or heard of anyone faking a referrer with an img stuff. Just wanted to know if you’ve actually witness this technique work for certain.

  6. You are welcome. Unfortunately, I do not get involved with black hat seo. I am 100% white hat.

  7. Yeah I understand. . . Same here. . I’m just saying I don’t think this method is actually possible. Someone may just be hyping it up a bit. I am pretty certain that the browsers can redirect images, but will not do what this post mentioned. This is due to the implementation of the image tag, where the browser will not handle or display anything except valid image, it’s just the way browsers are built. I tested this theory with an .htaccess file and it held true. I just didn’t feel like switching my apache server and all its config files . . lol . . to treat my images like php code.

    Funny thing is you really got me thinking about this, and capabilities of black hatters today. Mind posting where you read this technique?

  8. I am not sure what you tested with your .htaccess file, but simply placing this code (replace “#” with “< " and ">“) in the file section should make it happen:

    #files imagefilethathasphpcodeinside.gif#
    ForceType application/x-httpd-php
    #/files#

    I read the information about using the apache server, config files, and the .htaccess from the information resources like this:

    http://httpd.apache.org/docs/2.0/mod/core.html#forcetype

    The browser will not be handling anything here, instead, the server will handle this image file as php, run the script and then your browser will display the results of the script. All the browser is going to do is to initiate the call (trigger) to the image file. Browsers are very obedient creatures and will handle, display, and do what you tell them to do, if you know how to.

Leave a Reply