White Ops, a global leader in advertising fraud protection, has uncovered a massive advertising fraud operation that has been estimated at costing online Advertisers anywhere between $2 600 000 and $5 200 000 PER DAY.
This massive fraud named MethBot (in reference to the use of the word ‘Meth’ many times in the code) began to scale on 5 October 2016, reaching as many as 137 million impressions per day by the end of the week. The operation continued to expand rapidly. By mid-October, the White Ops MediaGuard Prevention Service was detecting three to five billion bid requests per day from Methbot spread across multiple ad platforms.
Over the last 45 days the Ad Industry could have lost between $117 000 000 and $234 000 000 from fraudulent impressions and counting ….
What is Methbot?
Methbot is essentially a programme that runs on a dedicated network of an estimated 1200 servers located in data centers in Dallas, TX and Amsterdam. Each server runs multiple instances of the Methbot browser component and a proxy.
This programme mimics the actions of many different browsers and human activity. Essentially the programme runs on it’s own – visiting specific web sites and spoofing it’s domain to the Ad Serving server in order to gain maximum revenue for it’s parent domains registered with Ad Serving companies. White Ops has identified over 250 000 spoofed domain pages.
The perpetrators of this fraud purchased over 57 000 IP addresses and provided false registration details along with false country of origin. The value of these IP addresses alone is over $4 million today, according to figures posted by IPv4 Market Group. In comparison Facebook only uses about half this number of IP Addresses.
For Example: This group, on 14 October 2015, falsely registered the following IP Address Block to Time Warner Cable Inc.: 196.62.32.0 – 196.62.63.255 and the Red flags show that the phone number listed as a contact (+2482534202) is in the Sychelles and the e-mail address (adw0rd.yandex.ru@gmail.com) certainly does not seem to relate to Time Warner Inc. The country reflected in the registration is the US (which will garner higher value CPM rates). As an aside that email address makes one wonder just how hard Google Adsense could also have been hit in this fraud.
CLICK HERE to download the full White Ops Report.
Datacenter-based ad fraud operations are usually easy to detect. Therefore, most advanced ad fraud operations have traditionally relied on malware that infects residential computers and sits on the same IP addresses as human users so the botnet can operate fake browser sessions in the background and generate fraudulent advertising activity. However, this approach has been a limiting factor because of the work needed to continually infect new home computers — especially while existing infections are being discovered and cleaned by anti-malware vendors.
Knowing this scenario, Methbot operators invested significant time, research, development, and resources to build infrastructure designed to remove these limitations and provide them with unlimited scale. They used dedicated servers to run proxies in order to hide the single origin source of their operation. Using falsified documents, the perpetrators were able to obtain or lease 571,904 real IP addresses, putting them to work generating fraudulent ad calls that appeared to come from legitimate residential Internet providers such as Verizon, Comcast, Spectrum, and others.
Video advertising on premium web sites fetches some of the highest prices in digital advertising. Methbot hijacks the brand power of premium publishers by spoofing URLs in the call for a video ad in order to attract advertising dollars in the following way:
- Counterfeit page: Methbot selects a domain or URL from a list of premium publishers, and fabricates counterfeit pages. The page contains nothing more than what is needed to support an ad, and the publisher’s server is never contacted.
- Offer inventory: Using the industry standard VAST protocol, Methbot requests a video ad from a network, using one of Methbot’s identifiers so they will get credit for it.
- Produce fake views and clicks: The video ad is loaded through a proxy and “played” within the simulated browser. Any specified anti-fraud and viewability verification code is also loaded and fed false signals in order to make the activity seem legitimate.
To date White Ops has observed 250,267 distinct URLs across 6,111 distinct domains that were generated by Methbot in the act of impersonating a user visiting a web page
While it’s common to see malware-infected computers, as part of a botnet, used for IP diversity, this is the first time data centers have been observed impersonating residential internet connections. This makes the scale of this operation virtually unlimited, with none of the typical durability issues of maintaining a constant base of infected user machines.
The proxies used by Methbot allow its traffic to originate from any of 571,904 IP addresses. It avoids typical data center detection by falsifying registration details of those IPs so that they appear to belong to residential ISPs in the United States. White Ops discovered forged listings for organizations such as Comcast, Cox, AT&T, Verizon, Centurylink and others. In addition to real companies, completely fabricated entities such as “HomeChicago Int”, “AmOL wireless Net””, and “Verison Home Provider LTD” were discovered. Beyond simply avoiding blacklists, this type of forgery allows Methbot operators to sell to advertisers willing to pay a premium to reach US consumers.
White Ops consulted with AD/FIN, a programmatic media intelligence company, for representative cost data on the Methbot URL list. The analysis produced through this partnership showed that Methbot generated ad impressions sell for anywhere from $3.27 CPM to $36.72 CPM. The average CPM (Cost per Thousand Impressions) for URLs manufactured by Methbot was $13.04.
The financial repercussions of Methbot continue to reverberate through the industry. Since early October 2016 White Ops estimates it has been running at a daily rate of 200 million to 300 million impressions per day. AD/FIN’s CPM data places a value of this daily activity between $3 million and $5 million dollars per day.