Outbound Instant Gaming

The Instant Gaming banner's hop, routed through us like every other.

Three path segments, like /out/promo/... and /out/store/..., and not the tidier /out/ig: that is two segments and would be matched by /out/{offer_id} above, which is declared first and types the id as an int — so the tidier spelling is a 422 on every click. Depending on declaration order instead would work until somebody reorders the file.

Their widget builds its own anchor in the browser, pointing straight at their site — so unlike every other advert here the click never touched our origin, and nothing we measure could see it. The frontend rewrites that anchor to this endpoint and hands the destination along.

The destination is carried rather than configured because the creative rotates: it was advertising FC 27 when this was written, and sending that click to the front page instead of the page the picture promised is the kind of tidy-looking change that quietly costs conversions.

Two things are enforced rather than trusted. The host must be theirs, or this is an open redirect wearing our domain. And the partner id is OVERWRITTEN with ours, so a hand-edited link cannot point our traffic at somebody else's account — which is the one thing a caller could otherwise change to their benefit and our cost.

Recorded like every other exit, as placement 'partner' with no store row (Instant Gaming is not a store we compare), tagged when our partner id went on.