Work.ink - The WORST Ad Network?

What's new (17/05/26 update):§5 explicit ads · §8 YuB-X pattern & phishing

What's new (25/06/26 update):§9 WebSocket dataset: drugs, marijuana, Viagra, ghost tickets - 1,134 ads documented

Work.ink is an ad network used primarily in gaming communities. Think Minecraft mods, Roblox scripts, game cheats. If you've ever clicked a link to download something and been redirected through a wall of ads and fake "verification" screens before getting your file, you've already seen how this works.

The platform promises publishers easy monetization and claims to follow all the rules. But what I found when I started digging was far worse than just annoying ads. We're talking security vulnerabilities exposing personal data, suspicious connections to DDoS operators, affiliate-hijacking browser extensions estimated to redirect millions in commissions, gambling and pornographic ads being served to kids, and a documented pattern of using DDoS attacks as a business weapon against publishers who leave.

This report documents everything I've found, ordered from the merely incompetent to the genuinely criminal. Buckle up.

Related reports #

Work.ink Security Report
Betterdeals Incident

1. Broken captchas, unstable production behavior, and operational failures #

Work.ink repeatedly shows signs of poor engineering and unsafe production practices. I've watched them ship broken changes straight into production, leading to captcha systems that literally don't work, random global rate-limits, and service-wide outages.

The captcha implementation is especially broken. Sometimes it can't be completed at all. Other times the backend doesn't even check the solution, so users get stuck solving the same captcha in a loop for no reason.

Work.ink not returning the result even when the user completes the flow in production

Broken captchas with direct destination routing, with no revenue for the publisher

Users having to solve the captcha multiple times to continue

Work.ink going globally down because updates are poorly handled

Korabi commenting on the situation:

Work.ink not even checking if the captcha solution is correct

The same thing, more detailed

Work.ink self-DDoS

Worth noting that on the day this happened, the website was down or crawling for almost the entire day. They never properly fixed it, just slapped a patch on top of all their poorly optimized code.

2. Broken monetization flow through Opera GX #

A major way Work.ink supposedly generates revenue is by forcing users to install Opera GX. In theory, this should work for publishers. In practice, the verification system that checks whether Opera GX was actually installed is completely broken.

The flow often fails silently or doesn't appear at all. Publishers either receive almost no revenue because nothing tracks properly, or they lose users entirely because the ad flow can't even complete.

3. Leadership behavior, threats, and lack of professionalism #

Work.ink is (or appears to be) primarily represented by Korabi, an individual who loves making legal threats when he doesn't even know what he's talking about.

Korabi threatening me and another minor with legal action: me for exposing the truth, and the other minor for reposting it

Korabi "accepting" that he threw out the threat without knowing what he was talking about (threatening with my payment data in Kyle's account, breaking GDPR again in the process)

One of the most notable contradictions is that the company claims to follow the law while their behavior shows the opposite.

4. Security and privacy concerns #

Work.ink requires publishers to submit highly sensitive personal information to get paid: real name, address, banking information, and sometimes even a photo of their ID. That's already a lot to ask someone to trust you with.

The problem becomes critical when one night, just to see what I could find, I opened devtools and logged into Kyle Butler's Work.ink account, discovering and documenting multiple serious vulnerabilities including IDORs (Insecure Direct Object References) and APIs that exposed personal data such as first names to anyone who knew how to query them. Full details are in the Work.ink Security Report.

5. Exposure of minors to gambling, adult, and explicit ads updated 17/05/26 #

Beyond the technical problems, Work.ink serves some seriously questionable ads. I'm talking gambling ads like Stake, adult-oriented promotions like "AI Girlfriend," and sketchy offers like "get robux for cheap", all clearly aimed at younger users.

This becomes especially concerning when you realize much of Work.ink's traffic comes from Minecraft and Roblox communities where the majority of users are minors.

Explicitly pornographic ads served to users

After this report was initially published, a user from YuB-X's community reported something worse. While screensharing, they got served a directly pornographic ad through Work.ink. Multiple other users confirmed they saw the same thing. This is not a suggestive "AI girlfriend" banner. This is explicit pornographic content, confirmed by multiple people independently, on a platform that mostly serves Minecraft and Roblox communities full of minors.

6. BetterDeals affiliation and estimated $3.5M+ in redirected affiliate commissions #

This is where things get truly disturbing. Work.ink has a direct connection to BetterDeals, a browser extension that hijacks affiliate commissions.

The scale of the problem

BetterDeals has around 90,000 users on the Chrome Web Store. According to various e-commerce studies, the average Amazon user makes roughly 25 purchases per year, with an average order value around $40–$50. Affiliate commissions on Amazon typically range from 1% to 10% depending on category, averaging around 3% to 4%.

Conservative estimate: 90,000 users × 25 purchases × $45 average order × 3.5% commission = approximately $3.5 million per year in affiliate commissions being redirected away from the original referrers and into BetterDeals and their network partners. Every year. Silently. From 90,000 people who installed a free "deal finder." This is a rough estimate based on industry averages, not confirmed figures. The real number could be higher or lower depending on how often users actually shop.

How the hijacking works

BetterDeals operates through a mechanism called "affiliate hijacking." When someone uses an affiliate link, BetterDeals silently replaces the original creator's affiliate ID with their own, stealing the commission. The extension was pushed aggressively through Work.ink's ad network, specifically targeting communities where most of the audience is minors: Minecraft mods, Roblox scripts, that kind of thing.

The installation flow was intentionally deceptive. Work.ink would show what appeared to be a required step to access content, making it look like installing BetterDeals was necessary. Many younger users didn't understand they were installing a tracking and affiliate-hijacking extension that would redirect commissions away from their favorite content creators.

GDPR violations

The operation also involved serious GDPR violations. BetterDeals collected browsing data, purchase history, and affiliate tracking information without proper consent or disclosure. That's already bad enough on its own. It gets worse when you factor in that a big chunk of their user base is minors in the EU. Under GDPR Article 8, processing personal data of children under 16 requires verifiable parental consent. There is no age verification anywhere in this flow.

Full technical details and evidence: BetterDeals Incident Report

7. Work.ink and its connection to DDoS activities #

The initial attack, the day after the security report was published

One day after publishing the Work.ink vulnerability report, my infrastructure got hit hard. We're talking 20 to 30 million requests at peak, around 100,000 requests per second at the highest point.

The attacker wanted to contact me, so I sent a DM. Here's what happened:

I also remembered that my friend Jigger received a message from Korabi, claiming he was in a voice chat with one of the best DDoS tool makers and asking permission if he could test it on skipped.lol. A company claiming to run a legitimate business openly asking permission to commit crimes.

Later, I checked Korabi's Discord profile. By some strange coincidence, he has added the person who's being paid to send constant DDoS attacks against me and all my infrastructure.

When I reposted the Work.ink security disclosure on Red-Square (where I'm a developer, Kyle Butler is the owner), a project created specifically to protect services like Work.ink and Linkvertise from bypassers, the response was immediate retaliation.

Kyle Butler's Work.ink account was frozen even though he wasn't directly involved. Payment for legitimately earned revenue was withheld. A false PayPal complaint was filed against our account alleging click fraud for $20 they had paid us for our legitimate work. One month later, they magically realized we didn't commit click fraud, and PayPal refunded them the $20 without taking it from our account due to "the unique situation." PayPal didn't want to lose a client but also didn't want to be unfair, so they took the $20 out of their own pocket and gave it to the whiny multimillionaire company.

Around the same time, the following Red-Square domains got hit with mass DDoS traffic:

After that, coordinated attacks hit additional MCB services:

8. The YuB-X pattern: DDoS as a business weapon new 17/05/26 #

This section documents what happened after the reports above were published and Work.ink's largest known revenue source, YuB-X, switched away from the platform. What follows is separate from the DDoS activity in §7. These attacks aren't tied to publishing the investigation, they're tied to a business decision.

YuB-X's account of what happened with Work.ink

usslmuk, representing YuB-X, described being approached by Work.ink with a 50 euro "boost" as a retention attempt, followed by a silent 80% CPM cut two weeks later while the Opera GX integration remained broken. The 50 euros were apparently Work.ink's way of buying time, not actually fixing anything.

Attacks on Red-Square coinciding with YuB-X's switch

Shortly after YuB-X rejected Work.ink and announced they were switching platforms, Cloudflare fired an alert for red-square.space. usslmuk speculated on who might be behind it and noted that, since YuB-X's main domain was harder to take down, Red-Square looked like the alternative target. This is usslmuk's personal read, not a confirmed attribution.

Work.ink's failed attempt to win YuB-X back

After the first wave, Work.ink tried again to bring YuB-X back. YuB-X declined. By this point they had already moved on and made it clear that Red-Square with LootLabs was working better for them.

Second rejection, second wave of attacks (15/05/2026)

On May 15th, after confirming that Red-Square with LootLabs was working better than Work.ink, Red-Square was hit with multiple successive DDoS waves. At least four of them, escalating from 200 rps to 500 rps to over 1,200 rps. Cloudflare detected the first waves starting at 17:44 UTC (12:44 PM local time). Systems went down and recovered between waves.

With attacks already ongoing, usslmuk connected the timing to the rejection of Work.ink earlier that day. This is their interpretation, not a confirmed attribution. But it comes from someone who was watching the whole thing happen in real time.

The attacks escalated. By 2:41 PM a coordinated strike hit every Red-Square mirror, domain, and VPS simultaneously: red-square.space, trw.lat, and backup infrastructure all at once.

A two-step reputation attack (around 17/05/2026)

Around this period, someone submitted Red-Square to multiple antivirus and phishing databases. The exact date isn't confirmed. It may have happened on the 15th, 16th, or earlier. Red-Square itself wasn't taken down, and no stated reason was recorded.

With Red-Square now flagged in those databases, YuB-X.net was then reported to Cloudflare. The stated reason: that it's a "real website that redirects to fake phishing websites." Since YuB-X uses Red-Square, and Red-Square was already flagged, Cloudflare acted on the report and blocked YuB-X. This happened on 17/05 before 6 AM (approximately 3 AM UTC-5).

The sequence matters: Red-Square gets seeded into phishing databases first, then that gets used as the ammunition to take down YuB-X through Cloudflare. Whether this is related to everything else documented in this section is something I can't confirm. What I can confirm is that none of this happened before YuB-X switched away from Work.ink.

kotakbas: a paid DDoS contractor with unnamed clients

Earlier in this report I documented that kotakbas appeared in Korabi's Discord friend list. When I asked him directly who was paying him to attack my infrastructure, he didn't deny anything. He just said he couldn't share names because clients have privacy.

He had already confirmed in an earlier conversation that he gets paid $350 per attack and that his clients are people with a public presence. He didn't say who. He didn't deny it was related to what I was asking about either.

What's documented without inference: Korabi has kotakbas as a Discord contact. Korabi previously asked if he could test a DDoS tool on skipped.lol. Large attacks have repeatedly coincided with specific events: publishing reports, YuB-X rejecting Work.ink. kotakbas is a paid contractor who won't name his clients. I'll let the reader put that together.

9. Serving heroin, Viagra, sex toys and fake tickets to children: the complete dataset of what work.ink systematically feeds minors new 23/06/26 #

Work.ink serves ads over a separate WebSocket connection with an XOR-obfuscated payload, not actual encryption, as explained at the end of this section. By running work.ink links through residential proxies with per-session anti-fingerprinting and decoding the WebSocket responses, we captured a verified dataset of 2,247 ads across 687 advertisers. The automated filter flagged 239 (10.6%) as inappropriate or age-restricted, across 31 distinct advertisers.

To put that in perspective: work.ink typically serves around 3 ads per link, not one. With 10.6% of individual ads flagged as inappropriate or age-restricted, the probability of hitting at least one flagged ad on a single work.ink link is roughly 29% (1 − 0.894³). Compounded across a normal browsing session, that means if you open 10 work.ink links, there is approximately a 97% probability you will encounter at least one ad serving prescription drugs, opioids, cannabis products, adult novelties, or explicit pornography to minors. If you open 20 links, that probability rises to roughly 99.9%, effectively a certainty. This is not sampling error or edge cases. This is the baseline behavior of the platform.

One fact underlies every case below and will not be repeated for each advertiser: none of the 25 flagged advertisers (financial, pharmaceutical, cannabis, or adult) hits a single age check anywhere in work.ink's flow. Every banner and payload below is served directly from work.ink's own CDN.

The complete dataset is available for independent verification: ↓ wink.json (2,247 ads · 687 advertisers) ↓ wink_risky.json (239 flagged · 31 advertisers)

Financial cluster 6 predatory-lending ads: Upstart, Perpay, SoFi, Fora, Kikoff, Borrowell

The dataset contains six distinct financial services advertisers, all legally adult-only in every jurisdiction where they operate.

Upstart is the most frequent financial services advertiser in the dataset, appearing 9 times. Their banner advertises personal loans from $1,000 to $50,000 to anyone who clicks. A minor reading this sees a promise of immediate funds and a 5-minute approval process.

raw ad payload (Upstart)

{
  "title": "Fast Personal Loans",
  "description": "Checking your rate only takes 5 minutes and you could get funding the next day.",
  "bannerImageUrl": "https://offerimages-creatives.work.ink/1295070472647178/item_0_d83d5f619c32.jpg",
  "offerUrl": "https://betterdeals.gg/betterdeals-offers/?token=[token]",
  "publicTemplateData": {
    "advertiserName": "Upstart",
    "openButtonText": "Learn more"
  },
  "template": "oneclick"
}

Every flagged ad shares this exact shape, the same betterdeals.gg redirect and oneclick template. The rest of the raw payloads are omitted for readability; all 2,247 are in wink.json, and the pre-filtered flagged set in wink_risky.json.

Perpay uses a PS5 console as the banner image to deliberately attract gamers, with "$71/pay" in small text. Perpay is a buy-now-pay-later credit service, not a gaming retailer. This is a bait-and-switch targeting young people interested in gaming.

Additional predatory financial advertisers documented in the dataset: SoFi (personal loans, crypto, student loan refinancing), Fora Financial (business loans), Kikoff (credit builder, "No Credit Pull, No Hidden Fees"), and Borrowell (Canadian credit score service). All adult-only financial products.

viagogo: ghost concert tickets 21×, shows cancelled years ago

viagogo appeared 21 times across all capture windows selling tickets to concerts that were cancelled years ago, including Metallica (2019), Keith Urban (2020), and Madonna (2020). The ads are still live in 2026 with no indication the events no longer exist. Users who click and purchase receive tickets to events that will never happen.

For context on the advertiser: Google suspended viagogo from advertising on its platform for deceptive practices. Australian courts found their conduct was deliberate and made misleading claims "on an industrial scale," resulting in a $7M AUD penalty. Italian regulators fined them an additional €23.5M. In 2025, Euroconsumers filed a formal complaint alleging violations of the EU Digital Services Act.

Cannabis paraphernalia and psychoactive marijuana products to minors

Diamond CBD (advertised as "Diamond Offers") sells Delta-8 THC and HHC, psychoactive marijuana-derived drugs. Delta-8 THC is synthesized from cannabidiol extracted from the cannabis (marijuana) plant and produces intoxicating effects. Their own website blocks entry with: "You must be 21+ to enter this site." That gate is absent from the entire work.ink flow. The company that sells marijuana-derived drugs to adults explicitly declared the age restriction. work.ink served their ads to minors anyway.

CBDistillery is the single biggest cannabis advertiser in the entire dataset, with 38 distinct creatives, second overall only to hims (54, below). The banners sell hemp-derived CBD with medical-sounding wellness claims: relief for "mild or temporary anxiety" and for "stiffness and discomfort after physical activity." Its own sub-brand, The Cbdmovement, added 8 more, pushing a downloadable "CBD User Guide" that links straight to thecbdistillery.com. That is 46 cannabinoid ads from a single company, fed to a Minecraft and Roblox audience.

Extract Labs and Shop Bloomz (bloomzhemp.com) are two more hemp-cannabinoid advertisers, same marijuana-derived category as Diamond CBD.

E420 is a cannabis paraphernalia shop, "The ultimate herb accessory shop," selling bongs, pipes, and vaporizers. The name is an unambiguous reference to marijuana (420). The banner leaves no room for interpretation: an animated marijuana leaf smiling out of a mystery box, with pipes and bongs floating around it. In most jurisdictions, selling drug paraphernalia to minors is explicitly illegal, separate from the legality of cannabis itself.

Adult sexual content served to minors

Spencer's served 12 different ad creatives in the dataset; at least two explicitly self-describe as selling adult content. One ad title, served verbatim through work.ink, reads: "Jewelry, T-Shirts & Adult Novelties | Spencer's Store Locator." Another, for a physical mall location, describes the store's offering in its own text as "jewelry, t-shirts, sex novelty products and more." The advertiser self-identified as selling adult content in both cases.

Prescription drug diversion to minors: Viagra, Ozempic, and other controlled medications

The single most-served flagged advertiser in the entire dataset, hims appears 54 times, ahead of CBDistillery's 38. hims sells sildenafil (the active ingredient in Viagra), finasteride, and other prescription drugs through an online telehealth flow. These are controlled medications that require a licensed physician's prescription and are restricted to adults in every jurisdiction where hims operates. A 13-year-old clicking this ad reaches a page offering Viagra with no gate between them and a purchase.

Ro (ro.co) is a second telehealth advertiser cut from the same cloth as hims, selling prescription erectile-dysfunction medication direct to the consumer: "Get fast-acting ED treatment, 100% online... prescription ED meds and pills." Delivered to the door, prescription-only.

Four more prescription advertisers pushed GLP-1 / semaglutide (the same molecule as Ozempic and Wegovy) in the same week: AgelessRx (also selling sermorelin, a synthetic growth hormone, from $199), Noom, WeightWatchers (its "NEW Wegovy Pill"), and Ivím Health. All prescription-only.

Keeps advertises topical finasteride and minoxidil, prescription-grade drugs for hair loss, with the drug names visible on the banner.

Seven separate prescription-drug platforms in the dataset.

Opioid-class drugs to minors: 7-hydroxymitragynine

7oh Factory appeared 3 times across multiple scrape batches with two distinct ad creatives, selling 7-hydroxymitragynine (7-OH) tablets - an opioid-class drug derived from kratom. 7-OH binds directly to mu-opioid receptors. It is pharmacologically classified as a controlled substance in multiple jurisdictions.

To give you an idea of the damage this pill causes: these people got high on 7-OH itself and ended up like this:

Source: @SLAYAMURK on X

The drug is banned or controlled in Alabama, Arkansas, Indiana, Rhode Island, Vermont, and Wisconsin (USA), as well as Australia, Denmark, Latvia, Lithuania, Poland, Romania, and Sweden. Multiple jurisdictions have classified it as a controlled substance specifically because of addiction and overdose risk.

The second ad creative uses pharmaceutical pain-relief language: "Fast Relief, Small Price, Only $1.65 a Tablet," deliberately mimicking over-the-counter drug advertising to lower perceived harm and drive impulse clicks. work.ink served this to minors on Minecraft and Roblox communities.

Geographic reach and GDPR implications

The dataset covers users across at least seven language regions: 906 ads in English, 79 in French, 39 in Dutch, 32 in German, 24 in Spanish, 20 in Swedish, and 5 in Norwegian. This confirms work.ink actively serves ads across the EU, meaning GDPR applies to all interactions captured above. Under GDPR Article 8, processing personal data of minors under 16 requires verifiable parental consent. No such mechanism exists anywhere in the documented flow.

"Bypass-proof by design"

This is work.ink's actual marketing copy, presented without modification:

"Other shorteners get bypassed in seconds - your traffic vanishes, your earnings tank. Our anti-bypass tech actually holds, so every ad impression counts."

Here is their complete anti-bypass architecture, reconstructed from the source:

1. Cloudflare IUAM challenge. Bypassable by sending the challenge token to CapMonster for automated solving.
2. Deliver ads over a WebSocket instead of a plain HTTP response. Does not affect bypassability in any way.
3. XOR the WebSocket payload against a static key, then run it through the free tier of obfuscator.io. XOR against a static key is not encryption. It is a substitution cipher any developer can reverse in under five minutes by reading the obfuscated source.
4. Threaten legal action against bypassers. Documented earlier in §3 of this report.
5. Ship the login page with AI-generated code that skipped basic input validation, authentication hardening, and rate limiting. Documented in the Work.ink Security Report.

The most ambitious anti-bypass measure they ever shipped was hiring a real human to manually rotate the XOR decryption key every two hours and re-obfuscate the full client-side HTML after each rotation. A real person. Doing key rotation by hand. Every two hours.

The practical outcome: the human kept forgetting to update the server-side key after rotating the client-side one. Every rotation produced a key mismatch between client and server, breaking the WebSocket for all active users until someone noticed. "Bypass-proof by design" was causing more downtime than bypasses.

Conclusion #

I started investigating Work.ink because of some broken captchas and security issues. What I found was a pattern of behavior that goes far beyond technical incompetence.

From pushing affiliate-hijacking extensions on minors, to serving gambling and explicit ads to kids, to documented connections with DDoS operators. The evidence points to a platform that shouldn't be trusted with anyone's data, money, or users.

The YuB-X case makes this concrete: a major publisher looked at the evidence, made their own decision, and left. The response wasn't improvement. It was retaliation: DDoS attacks, false phishing reports, frozen accounts. That's not how a legitimate business responds to losing a client. That's how an operation responds to a threat.

This report exists to document everything I've found and give people the information they need to make their own decisions about whether to trust Work.ink.

One last thing: the legal stuff referenced throughout this report (GDPR articles, FTC rules, what counts as fraud or deceptive advertising in a given country) came from actually reading the regulations and news coverage of prior enforcement actions, not from a law degree. I'm not a fucking lawyer (yet), so treat the legal framing as informed research, not legal advice, and if you're a regulator or a journalist who wants to take this further, verify the specifics yourself before citing them as fact.