Home / Resources / Blog / The money link hidden in a script
The money link hidden in a script
Some sites take your customers with a button that has no link. A script adds the link at the moment of the click. For one brand, 15 of the 21 sites that took its customers hid the link this way.
Article · Decloaking · October 17, 2026 · 4 min read
By Vlad Pivnev, Founder & CEO
Why a normal check hits a dead end
A check of a page reads its links. It clicks a button and follows the link. Here the button has no link, or the link points back to the same site. The click stays on the site, and the check hits a dead end.
What a normal check finds
- brand-xx.org · click on “Sign up”
- stays on brand-xx.org
Where the customer goes
- brand-xx.org · script on the page: “/go/”
- link rotator
- another casinoa different one on different visits
A normal check stops here and calls the site a possible clone. We don't. We extract the link from the code ourselves.
Six ways to hide the money link
A path inside the site's script
The site's script file contains a short path like /go/. A request to it goes to a link rotator and on to another casino. One site that hid its link this way ranked first in one country's search results for the brand name.
A plugin intercepts the click
The button points to “#go”. A WordPress plugin catches the click and sends it to /wp-admin/admin-ajax.php?action=go_url_redirect. This address is the same on every site with the plugin.
“#” instead of a link
All buttons point to “#”. A script puts the real link in when the page loads. On one network, the link went to a script hosting service, with the site's own name in it.
An in-between page
The button opens another page on the same site: /go/play/?b= plus a code. That page sends the customer on with a script. Without the code after “?b=”, it shows something else.
A link that looks like a site section
Paths like /go/brand or /recommends/ look like normal parts of a site. They lead to an affiliate. For one brand, we found such links on 31 of 174 domains with its name.
A hidden “go there” command
The page loads as usual. Along with it, the server tells the browser to jump to another address at once. Four domains with the names of four brands sent customers to one site this way.
How we extract the link
| Step | How |
|---|---|
| We read the site's scripts and look for paths like /go/ | no browser needed |
| We check the plugin address on every WordPress site | one request |
| We open in-between pages the way a customer does: phone, IP address in the site's country, a link from Google | as a customer |
| We open a link rotator behind a Cloudflare check in a real browser | real browser |
| We record where the customer lands, with the date | every visit |
Reading the code is fast. For one brand, a browser checked 3 sites in an hour and a half. Each of them looked like a dead end. Reading the code of the same brand's sites showed where the customer lands in 32 cases.
We judge by where the customer lands
A dead end is not evidence
Until we see the jump to another site, the result is “not determined”. We accuse a site only after that.
“Via redirect chain, no click”
Sometimes we find the landing site by tracing the link, not by a click. The report says so. We don't mix the two kinds of observation.
A dead end can be an honest affiliate
On one review site, no click from the home page left the site. The affiliate link was on its page about the brand, and it led to the brand.
The landing site changes
A link rotator sends different visits to different casinos. When a rotator blocks us, we report “final casino not identified”. We don't present the middle of the path as its end.
Related pages
We find the money link wherever a site hides it. Then we take the page down or give you the affiliate ID.
Decloaking → · Affiliate hijacking → · Method → · Get a free brand audit →
Related articles
Takedown · 4 min read
Why a clone comes back after a takedown
Clone domains are disposable. We take down the whole network, then fill search results with your content.
Crypto · 4 min read
A “blank page” that posed as an exchange login
A check marked six sites empty. All six were live, and three posed as an exchange sign-in.
More from Vlad Pivnev
Affiliates · 4 min read
127 domains, 2 affiliate accounts: how one ID shuts down a network
Affiliate fraud looks like a hundred sites. Close the account behind it, and the network stops earning.
SEO agencies · 4 min read
Your SEO agency's sites look like clones
Agencies build look-alike sites using your name. Nothing technical sets them apart from clones, so we ask first.
See who's profiting from your brand
Send a request. Within 1 business day we'll show you who is making money off your name and what we can take down. Free.