Home / Brand Protection / Affiliate hijacking / Decloaking
Decloaking
An affiliate hides where its button leads. This is called cloaking: the site shows different content to different visitors. With affiliate decloaking, we reveal the path to the final operator. Then we remove the page from Google search in as little as 3 hours.
Free. Delivered within 1 business day.
What an affiliate hides, and from whom
From Google
Google's bot gets a page with your name. A person gets an empty page or someone else's page. So search results show a page that your customer never sees.
From your checks
The money link is not in the page code. A script adds it at the moment of the click. Your check finds a button that leads nowhere.
From other countries
In five countries, the same button led to five different operators. It didn't lead to the brand in any of them. A check from one country finds one destination out of five.
First in search for your name, with a path hidden in a script
- “brand login”
- Hungary
- 2026-08-26
- position 1
- brand-hu.org · click on the button
- stays on the site
- bundle.js: “/go/”
- rotator-xx.org
- three different operators on different visits
We open the site as Google and as a customer
Google sees
a page with your name
Your customer sees
“Page not found”
We accuse only when a site swaps the page
It's a violation when a site shows Google more than it shows people. If a site simply blocks bots, that's protection, not deception. We don't touch such a site. We save what the site showed Google as evidence.
We visit like a normal customer
We use a phone, an IP address in the site's country and a link from Google. Otherwise the site shows a placeholder page and hides where the button leads.
We check several times
The same button leads to different sites at different times. So we click it several times and record each destination with the date.
Where an affiliate hides the link, and how we find it
The link is hidden in the site's code
The button has no link. The URL sits in the site's code and fires when someone clicks. We read the code and follow that URL. This is how we found the link on 82 of 176 sites with the brand's name.
A plugin intercepts the click
The button looks empty. But when someone clicks, a WordPress plugin sends the customer to someone else's site. All sites with this plugin send the click through the same address. So we check this address on each site.
The link is added at the last moment
The buttons have “#” instead of a URL. A script adds the real link when the page loads. We find it in the scripts.
An in-between page
The button leads to another page on the same site. That page then sends the customer on. We open it the same way a customer does and see where it leads.
A hidden “go there” command
The site opens as usual. But along with the page, it tells the browser to go to another address at once. This is a hidden redirect, a jump from one address to another. A normal link check misses it, so we check for it separately.
A link that looks like a site section
Paths like /go/brand or /recommends/ look like normal sections of the site. But they lead to an affiliate. We found such a link on 31 of 174 domains using the brand name.
A revealed link can clear a site as well as accuse it
The dead end was an affiliate
On the home page of a review site, no click led outside the site. The affiliate link was on its internal page about the brand, and it led to the brand. So this was an honest affiliate.
A dead end is not evidence
Until a click leaves the site, we mark it “undetermined”, not “clone”. We accuse only when we have seen the jump to another site.
“Via redirect chain” is a separate label
Sometimes we find the landing page by tracing the link, not by a click. Then the report says “via redirect chain, no click”. We don't mix these two kinds of observation.
A hidden path reveals the whole network
One rotator, seven domains
On seven different domains using the brand name, the path from the script led to the same rotator. A link rotator sends different visits to different sites. One person is behind these domains, not seven.
One affiliate code, two brands
On the domains of two different brands, a hidden “go there” command (the Refresh header) led to the same affiliate code. One account works for both names.
The site's name in the link
One affiliate platform used five domains, one for each country. It received traffic from seven sites. The name of each site was in a parameter of the link.
How we take it down
Google and Bing search
median time from complaint to removal. Grounds: your logo or your text on the page. What the bot saw and the button's path go into the complaint
Letter of authorization (LOA): yes
Cloudflare and hosting provider
the site stops loading
LOA: no — fraud complaint
If your own affiliate is behind the cloaking, the affiliate ID is enough. This is the code in a link that shows which affiliate account gets paid. We give you the ID and the button's path. Then you can close the account or hold back the commission. Affiliate hijacking → · All channels and timelines →
FAQ
An affiliate shows us a clean page. Will you find out where it sends customers?
Yes, if the redirect leaves the site at least once. We visit like a customer: from an IP address in their country, on a phone, from Google search. And we click the button several times, because a rotator changes the destination.
Can you reveal any cloaking?
Yes. Only the method changes. We detect a server redirect without a browser and a script redirect in a browser. We open a rotator behind a Cloudflare check in a real browser from the visitor's country. Until we see the final site, we report “final site not found”, not “clean”.
Do you need access to our affiliate program?
No. We read affiliate IDs from the links on affiliate pages. You check them against your program.
See who's profiting from your brand
Send a request. Within 1 business day we'll show you who is making money off your name and what we can take down. Free.