Lnkr affiliate fraud kit
Lnkr is an affiliate redirector loaded as a third-party website script. We have matched it on 183 sites since 23 August.
Lnkr in numbers
Since 23 August, the first Lnkr match in our records, counted on 12 October 2026. How we count.
| Sites loading Lnkr code | 183 |
|---|---|
| Sites with a match in the last 30 days | 150 |
| New sites in September | 86 |
| Still loading it when recaptured at least 25 days later | 7 of 9 sites (78%) |
| Sites running WordPress (captured since 25 September) | 82% |
An extension-era name on website code
Paul Buonopane's 2019 Lnkr research says the name appears in the operators' bootstrap scripts and server-side lnkrApi directory. That campaign used cloned browser extensions to inject advertising code into every page the browser opened (Lnkr research). Netskope later found Lnkr in browser extensions, applications and scripts included directly by websites (Netskope).
The code in our records is the website form. A page loads a script from a dedicated third-party host. The visitor profiling and redirect are inside that response, so the embedding page source shows only the script tag.
The classic once-a-day redirect
The older redirector writes MenuIdentifier to local storage for 86,400 seconds. A browser with that marker skips the next attempt until the day has passed.
On the first visit, the script posts the page address as vhref, an identifier as juh and a campaign value as cs. It parses the JSON reply and reads fw. When that field is present, parent.top.window.location.href moves the whole tab, including when Lnkr started inside an iframe.
That storage gate explains why a repeated manual check can look clean: the first visit has already used the browser's daily turn.
The current script profiles each eligible visit
The newer generation removes the daily storage gate. The 11 October production copy waits five milliseconds, then sends a URL-encoded POST with the current page, campaign fields, a Unix timestamp and an iif flag saying whether it runs in a frame. Chromium visitors also contribute high-entropy client hints: platform and platform version, full browser versions, device model, bitness, architecture and WOW64 state.
It exits for navigator.webdriver, named search crawlers, AI crawlers and old Firefox or Internet Explorer versions. The request times out after 15 seconds. A successful reply must contain an fw string beginning with HTTP or HTTPS. Lnkr then calls location.replace; if it is inside a frame, it first tries the top window. The destination replaces the infected page in browser history.
What we see
| Month | New sites |
|---|---|
| September | 86 |
| October so far | 58 |
Of the 9 sites recaptured at least 25 days after their first match, 7 were still loading Lnkr (78%). 82% of Lnkr sites captured since 25 September run WordPress.
Lnkr and TrackMyPoss overlap on 51 sites. Their server replies have different jobs: Lnkr follows an fw URL, while TrackMyPoss runs JavaScript from a two-item array.
Checking a site
Open the logged-out page in a fresh browser profile and preserve the network log. Look for:
- a third-party script that posts the current page as
vhref MenuIdentifierin local storage with an 86,400-second lifetimegetHighEntropyValuescalled with platform, browser version, bitness and architecture fields- checks of
navigator.webdriver, crawler names and frame state - a URL-encoded POST followed by a JSON
fwvalue andlocation.replace
Remove the script tag and the site change that writes it, then purge server and CDN caches. Repeat the test with another fresh profile so the older daily marker cannot suppress the redirect.