1. A computer-implemented method, comprising: based on an attempt by an online endorser to generate an endorsement at a target, receiving a request for a token; in response to the request, generating the token, and providing the target with an encrypted version of the token; receiving the encrypted version of the token and an endorsement action from the target; generating an endorsement log comprising an endorser identifier, a target identifier, endorsement data, and the token indicative of the endorsement event, wherein the generating the endorsement log comprises: receiving the request for the token from the endorser identifier; generating, encoding and encrypting a signal, including the token, in response to the request; transmitting the signal and an endorsement object to the endorser identifier; and in response to an endorsement action by the endorsement identifier that occurs after the attempt, providing an indication of endorsement and passing the endorsement action and the token from the endorser identifier to the server; analyzing the endorsement log with respect to a user aggregator and a target aggregator, to generate an online endorsement abuse candidate associated with endorsement abuse, wherein the endorsement abuse comprises an endorsement that identifies an online user as a source of the endorsement, without authorization by the online user; generating an endorsement overlap graph for the online endorsement abuse candidate based on the endorsement log, the user aggregator and the target aggregator, wherein nodes of the endorsement overlap graph represent ones of the online endorsement abuse candidate, and edges represent a number of shared endorsements; and determining whether the endorsement event is authorized based an analysis of the endorsement overlap graph and an orthogonal signal at least one of transmitted and received by the ones of the online endorsement abuse candidate.