Didn't this type of fraud require massive domain expertise?
2. replace timestamp and userIDs fields on the network requests you will replay with Math.random()
3. Profit!
Seems pretty simple and banal to me.
Isn't this _why_ you'd need domain expertise? Random User IDs would be detectable - a French user suddenly clicking on English ads and following East Coast time would be a red flag.
if I send a bid to google with a random browser id, it will assign a new user on the spot (we wont be lucky to match a valid user as in your example) and all goes on normally.