Hacker News Reader

Comment by Panos | Hacker News Reader

All these parts happen within the index2.php of the parked domains (see the section with the title "Re-directions and generating click fraud with normal click patterns").

Take a look at this screenshot: https://lh5.googleusercontent.com/-R9lgD8LQfdw/TXEu7e2Sb5I/A...

and here are the detailed requests

https://lh5.googleusercontent.com/-qVyp1ChmmRA/TXExPKhXnOI/A...

https://lh3.googleusercontent.com/-3KulINgZhwA/TXExPdCASOI/A...

https://lh3.googleusercontent.com/-q3Cpp0uIM6g/TXExPsl3ycI/A...

https://lh4.googleusercontent.com/-zWpoE6IlyfI/TXExP36fWhI/A...

https://lh5.googleusercontent.com/-c0FdFkU0xX4/TXExQF5jHfI/A...

https://lh4.googleusercontent.com/-oLleFeARs3o/TXExQS95chI/A...

https://lh4.googleusercontent.com/-_-KqSY7ue5w/TXExQTVttwI/A...

https://lh4.googleusercontent.com/-Dxp-OfM0oXw/TXExQrQsoLI/A...

View on HN

Panos,

Where is the click on the adserver? I don't see that.

The screenshots above redirect to a search engine. (My IP had already been used for clicks and I could not generate the ad clicks for the screenshots)

If you want to see the scheme in action go to the new domains set up by the scammer:

http://www.kidsbeanbags1.com/index2.php

http://www.kingsizemattress1.com/index2.php

http://www.neckpillow1.com/index2.php

http://www.pillowtopmattress1.com/index2.php

http://www.pillowcovers1.com/index2.php

http://www.tempurpillow1.com/index2.php

http://www.contourpillow1.com/index2.php

If you want to observe the full click behavior: Chrome->Tools->DeveloperTools->Network

Let me know what you see. Curious to see if the scammer changed the behavior.

I saw the same kind of redirects as written up.

I still don't understand.

Where is the money? Is this CPC or CPM fraud?

It couldn't be CPC because there is no landing page served.

It couldn't be CPM because there is no ad served.

Confirming your observation.

I got the explanation: All the targeted sites (e.g., Mevio or Current.TV) now have filters in place. So you will not be able to see the actual landing pages. The landing page will be a blank page as the ad click will not work.

Btw for the record: It is mainly CPC fraud, sending (invisible) traffic to sites like Mevio and Current.TV which serve mainly CPM ads.

no, that still does not make sense.

If there is a click on an adserver, where is it in this bunch of redirects?

OK, I added the screenshots that show the adservers as well. When I was writing the article, I was told not to involve any party that has been defrauded and did not give explicit permission to be involved in the story. Since I see them mentioned in the WSJ article, I feel that I can put the relevant screenshots there as well.

thats what I am wondering, how is sending the actual click? does he have access to a PPC feed (from who?) or is he somehow getting the links for the link via javascript and for what ad networks ??

That, unfortunately, I could not observe. My intuition says that he had a PPC feed for his parked domains and he was using the click.mygeek.com etc services to click on them.

Note that he was not always clicking on the links, to maintain a reasonable low clickthrough rate for the ads.

Another commenter explained it this way.

You run a video site or a search engine that serves CPM ads. If you can buy PPC cheap enough, you can arbitrage and make money.

PPC from Google is expensive, but there are companies that sell cheap clicks. Some publishers on these ad networks run porn sites with hidden iframes that generate the clickthrough.

However, iframes generate a http referer, and this gives away the rather dubious traffic sources. The series of redirected clicks are used to subvert click fraud analysis.

Definitely the target publishers were "video sites or a search engines that serve CPM ads". So this explanation is most probably pretty accurate.

Reply on news.ycombinator.com