Gambling affiliation is broken.

Bookmakers are paying for players they already had

Affiliate marketing should be simple. A tips or review site sends a player to a bookmaker, the player signs up, and the site earns a commission. The bookmaker knows which site sent the player from a tracking cookie set when the player clicks.

That cookie is the weak point. Whoever sets it last gets paid, so a site doesn’t need to persuade anyone. It only needs to set the cookie. We found sites that do it with hidden frames nobody can see, ad scripts that turn an ordinary tap into a bookmaker click, and pop-unders that open the bookmaker behind the page a player is reading. The player signs up later for their own reasons, and the bookmaker pays commission to someone who did nothing.

None of this shows up in a programme report. It looks like a good affiliate.

Nearly half the sites we audited in full were at it

Figure 1 · Full audits

We audited 17 affiliate sites end to end: network captures from real browsers on phones and desktops, in the markets the sites target, with fresh profiles and no clicks, then with real clicks. These are the audits where we can say exactly what the browser did.

• 8 of 17 (47%) were defrauding at least one bookmaker.
• 4 of 17 (24%) set bookmaker tracking cookies without any click, through hidden frames or ads that load the bookmaker’s affiliate link in the background.
• 5 of 17 (29%) hijacked clicks: tapping a menu, an article link or an ad’s close button sent the player to a bookmaker.
• 3 more are on watch, with suspect code we haven’t yet caught firing.

Basis: 17 affiliate sites audited by hand, 15–19 Oct 2026. The sample is small, and some sites were picked because something looked wrong, so this is not a market-wide rate. Six came out clean. Clean means nothing was caught, not proven innocent: these scripts often fire once per visitor and hide from testers.

One ad network, set up to steal clicks

Figure 2 · Ad network configuration

Many betting sites carry ads from the same gambling ad network. Its scripts include a format that opens the bookmaker when the visitor taps anywhere on the page, including on the site’s own links. We read the live ad configuration of every site we could find running it.

• 80 of 223 sites (36%) running the network had that click-hijack format switched on.
• Among the sites players actually find in search, 14 of the 19 carrying the network had it on.
• More than 20 betting brands were the destination of these hijacked clicks, paid for through their own affiliates or media buyers.

Basis: ad configurations decoded directly from the network’s scripts on 223 live sites, 19 Oct 2026. The configuration proves the format is set up; we have caught it firing live on several sites. We don’t name the network: legitimate sites use it too, and the problem is how it is configured and who profits.

Where players search, about 1 in 6 tips sites is a problem

Figure 3 · Top search results by market

To see what an ordinary player meets, we ran the searches they run (“sure football predictions”, “best betting sites”, bookmaker promo codes) in six markets and checked every tips, review and affiliate site in the top 30 results: 372 sites in all.

In Kenya and Nigeria, around one in six top-ranking tips sites was confirmed bad or under investigation. In the UK it was about one in 34. One Nigerian site ranking first for “sure football predictions” carried both a pop-under loader and the click-hijack ad format. Several sites posing as a bookmaker’s official page sent visitors somewhere else entirely.

Basis: 372 sites checked from 1,883 search results, 19 Oct 2026. A site can rank in more than one market. This sweep used a static check of each homepage and its tag manager, which misses most scripts loaded at runtime, so these figures are a floor.

The operators’ own websites aren’t safe either

Fraud doesn’t only live on affiliate sites. We found 97 bookmaker and casino websites carrying tags from the same networks behind the affiliate fraud, usually added through a marketing vendor or agency and left in the tag manager. Some of these tags send the visitor’s landing address, affiliate ID included, to a third party, and run whatever code that server sends back. The operator is usually the victim here, not the culprit, but its own site gives someone else a way to rewrite its attribution.

A handful of operations are behind most of it

Across all 431 findings, six operations account for nearly 9 in 10: ad networks, pop-under loaders and remote-code tag vendors that appear on hundreds of unrelated sites. We have identified 44 bad scripts and archived 182 distinct copies of their code, each with the date, location and fingerprint we fetched it with. Many of the sites carrying them aren’t betting sites at all: music, film, manga and news sites earn bookmaker commission without ever mentioning betting.

Basis: 431 findings recorded 12–19 Oct 2026: 30 caught live in a network capture, 366 proven from the script, ad configuration or historical record, 31 suspected and labelled as such, 4 later explained. Every finding is dated and tied to saved evidence with a SHA-256 hash.

How we counted

• Websites scanned (1,730): distinct sites fetched in a scan-led sweep (sites recorded loading a known bad script), a search-led sweep (the top results players see) and our hand audits. 616 of the scan-led sites were dead or blocked our fetch.
• Affiliate sites assessed (656): affiliate and publisher sites given a verdict: 153 confirmed bad, 3 on watch, 332 clean on our checks and 168 suspects still to investigate.
• Operators assessed (106): bookmaker and casino brands on our register after a check of their own website and tags.
• Bad scripts (44): script hosts we have tied to fraud, from proven (seen setting cookies or hijacking clicks, or carrying code built to) to suspected (shared code or infrastructure).
• Brands affected (117): betting and trading brands named as the target or the paying victim in at least one finding.

No operator, affiliate, website or ad network is named here. Operators we found affected have been, or are being, told directly with the evidence.