Hacker News Reader

Comment by teyc | Hacker News Reader

no, that still does not make sense.

If there is a click on an adserver, where is it in this bunch of redirects?

OK, I added the screenshots that show the adservers as well. When I was writing the article, I was told not to involve any party that has been defrauded and did not give explicit permission to be involved in the story. Since I see them mentioned in the WSJ article, I feel that I can put the relevant screenshots there as well.

thats what I am wondering, how is sending the actual click? does he have access to a PPC feed (from who?) or is he somehow getting the links for the link via javascript and for what ad networks ??

That, unfortunately, I could not observe. My intuition says that he had a PPC feed for his parked domains and he was using the click.mygeek.com etc services to click on them.

Note that he was not always clicking on the links, to maintain a reasonable low clickthrough rate for the ads.

Another commenter explained it this way.

You run a video site or a search engine that serves CPM ads. If you can buy PPC cheap enough, you can arbitrage and make money.

PPC from Google is expensive, but there are companies that sell cheap clicks. Some publishers on these ad networks run porn sites with hidden iframes that generate the clickthrough.

However, iframes generate a http referer, and this gives away the rather dubious traffic sources. The series of redirected clicks are used to subvert click fraud analysis.

Definitely the target publishers were "video sites or a search engines that serve CPM ads". So this explanation is most probably pretty accurate.

Reply on news.ycombinator.com