CookieStuff — Justin

Affiliate cookie stuffing is commission fraud: sites drop tracking cookies from affiliate networks you never clicked, then collect commissions when you buy something. CookieStuff detects this in real time as you browse.

How it works

Every site you navigate to joins a persistent navigation dictionary. When a domain sets a cookie without appearing in that dictionary — and matches affiliate network URL patterns, cookie name patterns, or timing signatures — it gets flagged. The algorithm is inspired by LZ78 data compression: domains outside your navigation history are "novelty misses," the primary signal for stuffing.

Two tiers of detection

• Affiliate fraud (red badge): confirmed affiliate networks dropping cookies you never earned — Commission Junction, ShareASale, Awin, Rakuten, Impact, ClickBank, Viglink/Skimlinks, DoubleClick, and others. Desktop notification fires on first detection.
• Ad trackers (amber badge): suspicious domains that score high but aren't confirmed affiliate networks — a privacy problem but not direct commission fraud.

Six signals, all active in real time

• LZ novelty — domain not in your navigation history (30%)
• Affiliate URL pattern match (25%)
• Affiliate cookie name match (15%)
• Hidden resource type — image/XHR/beacon (15%)
• Early timing — cookie set within 500ms of page load, before any click is possible (10%)
• Missing Referer header (5%)

Privacy

Everything stays in your browser. No data is transmitted anywhere. The navigation dictionary and session reports live in local storage only.

Open source

Apache 2.0. CLI companion tool available for batch scanning. Source on GitHub.