Hidden Cookie Stuffing – Black Hat SEO Method
Hidden Cookie Stuffing – Black Hat SEO Method
“Always listen to the experts. They’ll tell you what can’t be done and why. Then do it.” – Robert Heinlein, American science-fiction writer, 1907-1988.
There are many ways to monetize websites and get decent profit from them. There are good White Hat SEO guys that work hard to optimize their sites and attract traffic. They monetize their traffic via Google AdSense or affiliate links that actually offer products and services relevant to the visitors. You can see this happening on this blog as well.
We will not look at these boring White Hat SEO techniques, instead we will talk about those bad boys out there, lurking around, always looking for weaknesses to exploit and make money.
In today’s post we will discuss a new sophisticated and undetectable cookie stuffing. This new method of cookie stuffing was recently discussed in the underground Black Hat SEO community. Apparently a user named “Haqer” claiming to be from Pakistan, was spotted using this method first.
Let’s get to the bottom of this issue and try to understand why many talented and well known Black Hat SEO members praised this guy from Pakistan calling his method of cookie stuffing genius.
Let’s briefly go over what cookie stuffing really is. For example when a visitor clicks on a affiliate link which takes them to the vendor’s site to make a purchase, a vendor will have a record of that affiliate id in the customer’s cookies. Then this affiliate gets paid via the amount of purchases made by the customers carrying this affiliate id in their cookies.
If a customer visited site belonging to one of the cookie stuffing bad boys, their cookies in the browser gets stuffed with an affiliate id without their knowledge. Then when this person goes to a legitimate site and makes a purchase later on (could be a week, a month, or longer), the affiliate id entered into the cookies without the customer’s knowledge gets credited and that person who stuffed the cookies of this customer gets paid. Yes, this is the basic cookie stuffing scheme.
Well all the big time nerds at Google were fighting this and banning sites that were using cookie stuffing. Many White hat SEO and otherwise noble gentlemen are trying to learn how to combat this Black Hat SEO activity.
The problem with direct cookie stuffing is that a large and increasing number of networks are implementing robots and manual flags to detect and ban cookie stuffing resources. It has become difficult for the Black Hat SEO boys to perform their acts of evil, even if their old-school cookie stuffing is based on referrers, using IPs, user agent, random throttling, and so on.
Now let’s look at our Pakistani boy’s cookie stuffing scheme a little closer.
Let’s assume Blog A is his site with high traffic. Let’s go ahead and build another blog and call it Blog B. Now, let’s go ahead and submit Blog B to social networks, blogs, directories, and many other networks. When a visitor comes to Blog A, the cookie stuffing happens, however the referrer gets spoofed to Blog B. Notice that Blog B never does cookie stuffing to any of the visitors. Robots visiting Blog B as well as manual reviewers (flagers) will never find anything shady there. Below is a basic diagram to show what’s happening here.
Our friend from Pakistan had made this all look simple by doing the following: His Blog B (that doesn’t do cookie stuffing) had a php page which included javascript redirect (in combination with back up meta refresh redirection) to the affiliate link. Blog A had a 1 by 1 IFrame with the hidden javascript or php code. He did it by hiding it in the image changed for apache to read images as php code. The IFrame loaded up the php Redirection page from Blog B, which in turn loaded in his affiliate link, which does the cookie stuffing to the customer visiting Blog A. The referrer showed Blog B as the original source of this visitor (traffic).
The impressive new idea and implementation of cookie stuffing shows that this guy is very intelligent and sneaky (and rich 
). Note that currently there is no known way to combat this approach.
However, the White Hat SEO community will continue to fight against these bad boys from the Black Hat SEO world.
Good luck and be strong!
Beck @ PrfitSEO.com
The video below shows how a guy from a third world country, without access to fancy sport centers, without diet supplements, can be #1 and destroy every heavyweight in the world. If this guy can do it, if “Haqer” could do the impossible, you can do it too. Whatever your goals and dreams are – go get them!
Similar Posts:
- Targeted Cookie Stuffing – Black Hat SEO Method
- Search Engine Link Cloaker – Black Hat SEO Method
- Link Spam with Hidden Redirect – Black Hat SEO Method
- Link Spamming Parasite Blogs – Black Hat SEO Method
- Deep Linking Plugin – Black Hat SEO Method
Popularity: 58%
Loved reading this post, do you also have some sort of newsletter?
Feel free to sign up for the RSS Feed and you will get the latest updates right to your reader.
Really great post. Understood most of it but got a little lost on
‘Blog A had a 1 by 1 IFrame with the hidden javascript or php code. He did it by hiding it in the image changed for apache to read images as php code.’
I’m thinking a image with php hidden in comments maybe? or maybe I’m just misunderstanding this. Care to elaborate a bit on these two statements. . .
thanks
No problem. The IFrame with javascript or php code was hidden inside the image itself. This wasn’t hidden in the comments or anywhere outside of the image, but inside the image. The action was being executed on the server side not the client (browser) side, which is necessary in this case to control what happens. You have to have root access to the server where this IFrame and image are located. The way apache reads the images was changed to read them as php code, thus causing the needed effect. I hope this helps.