"For the past year researchers at SophosLabs have been tracking malicious websites with our technology partners and via product-based reporting. Most web attacks are fairly simple and straightforward in nature, though the components of the attack are arbitrarily complex. However, some attacks are more complex in nature and include the passing of information to 'grey' sites before installing malware. These complex attacks are very reminiscent of the links we would see were we to analyse a revenue-generating/advertising/pop-up network. These affiliate-based links look to all intents and purposes like a 'legitimate' network with the added bonus of delivering malware. This paper will attempt to show some simple attacks with a more detailed analysis of some affiliate malware delivery systems."