Uncovering an advertising fraud scheme (NSFW) (2011) | Hacker News Reader

Uncovering an advertising fraud scheme (NSFW) (2011)

behind-the-enemy-lines.com

268 pointsDavidChouinard47 comments

Open articleView on HN

Although an absolutely great article, this is 2 years old. Previous discussion here: https://news.ycombinator.com/item?id=2333824

Be sure to also read the follow up for the actual solution that Ad-safe implemented here: http://www.behind-the-enemy-lines.com/2012/03/50-of-ads-are-...

Thanks for the link, I was so drawn in that I didn't even think of checking the date when I started to read it.

This is a major ongoing topic in the ad world. For those interested in the topic, here are two more articles from today on publisher fraud:

http://www.adexchanger.com/online-advertising/to-catch-a-bot... http://www.adweek.com/news/technology/meet-most-suspect-publ...

Two other articles today named ad networks that are making money on this type of fraudulent traffic:

http://paidcontent.org/2013/03/19/massive-bot-network-is-dra...

http://www.adweek.com/news/technology/meet-most-suspect-publ...

Here's the source of the Chameleon botnet details:

http://www.spider.io/blog/2013/03/chameleon-botnet/

comments: https://news.ycombinator.com/item?id=5400573

So whats the major disincentive to people who read this and immediately think "Kaching!"? (me)

There must be a down side, apart from the seedy feeling someone might get from doing this.

I'm no lawyer, but this look like wire fraud. Plus there's a trend of "he did it on a computer so burn him at the stake" in federal prosecution lately.

> "he did it on a computer so burn him at the stake"

This is a result of the general public's incredible ignorance when it comes to how computers work. I hope this trend will fade soon as newer generations that have been raised on computers become older. I really dislike the whole "he did it on a computer so burn him at the stake" mentality that government seems to have today.

I think its more specifically a case of senior legislators and policymakers hatefearing the internet. They're supposed to be the rulemakers.

But not if you wore an expensive suit while doing it.

The guy in the 8,000 dollar suit is going to jail because of ads, COME ON

It's been 2 years and the name of the perpetrator is in the article. Has he faced any charges?

If you notice in the comments, someone with the listed name claims their identity was stolen.

Its quite expected that a competent criminal would use a stolen identity so as not to connect themselves to the crime in any way.

Ad networks know who they cut a check to. There is always a paper trail in this business, even if he registered the domains in somebody els's name (risky strategy if so - that somebody else would be legal owner).

I immediately think "kaching" as well. However this article was published in March 2011, and I imagine the advertising world has evolved slightly to prevent this fraud from happening, so your scheme would have to be clever enough to outwit any changes. If the scheme has been exposed for two years I imagine there are more players utilizing this scheme in the fraud-market. Only way to know for sure is to try it yourself and learn from experience, in which case you'd be breaking the law and taking a risk.

maybe they've closed these holes, but click fraud has been an issue every since the earliest days of banner ads, so I'd be really surprised if it has been eliminated completely.

Yes, there will always be people that invest time/effort into figuring out how to exploit a system when there's money involved! I am sure there are still many exploits, it's just a matter of being more clever than the individual(s) that designed the system, and being willing to take the risk of indictment in case your scheme is discovered.

We stay pretty on top of things, and have a lot of data to look over for suspicious activity. Staying ahead of us means continually iterating methods, at which point, why not just get a job?

That said, it's nice to see this stuff separate the slick from the competent in the industry.

> at which point, why not just get a job?

Considering the pot could be somewhere in the several 100Ks per month (according to the article) range, which 'job' would that be?

I remember a buddy of mine telling me about doing affiliate advertising and using botnets to send fake click throughs to make money.

This was five or six years ago, but it looks like not much has changed.

And hopefully karma catches on with whomever does this and rot in jail.

I'm curious what laws this breaks. Has anyone been prosecuted for similar click fraud? It seems like a contract dispute and the advertiser has the ability to not pay and perhaps come after the scammer for past losses, but it's a TOS violation more than a legal one.

Google is pretty famous for shutting the door on AdSense publishers without much of an appeals process, but I haven't heard of them pursuing anyone criminally. Google even let go a case that involved extortion (someone set on releasing click fraud software unless Google paid up).

http://www.businessweek.com/stories/2006-12-04/the-vanishing...

It appears Google values its secrets more than their losses to click fraud.

I'm not sure what laws it breaks but the laws are so ambiguous you could really be charged with a wide variety of things all depending on how much the prosecution wants to put you away. Could be anything from money laundering to computer abuse to mail fraud depending on a lot of variables involved - and also very much depends on what country the person accused is from.

the irony of this comment coming from Mr. Integrity is not lost on me

I tried running some PPC ads once, for a month or so. I spent a lot of cash and got nowhere. Curiously I showed a healthy conversion rate on some ads, which encouraged me.

I spent an entire day tracking down a lot of these things. Turned out that in every single case, there was no sale, and I couldn't believe in a million years that traffic from these sites were really following my ads.

I stopped spending money with Google. A year later they sent me a voucher and begged me to try again. So I tweaked some settings, cut the list right down and spent their $150. Same results.

My overriding impression is that display ads, PPC ads and the like are an absolute cesspool of fraud and it's a waste of time trying to untangle the mess.

One of the first rules of Adwords is to disable showing ads across the display network (this is enabled by default). You should only be showing ads on the search network (and only google.com at that, not the search partners).

Setup correctly, these types of scams aren't much of a problem with Adwords. FWIW, I've found Adwords to be very very effective, provided you know exactly what you're doing, and know how to adjust your campaign settings such that Google doesn't bleed unnecessary money from you.

Yes, I know that and I had always just used search ads. But I was dominating the SERPs for the terms I was interested in, so tried the display network as an experiment as an alternative to see how it would go.

>I've found Adwords to be very very effective, provided you know exactly what you're doing, and know how to adjust your campaign settings such that Google doesn't bleed unnecessary money from you.

I agree with you there, but you need to learn the ropes when someone else is paying the bills for your mistakes. A wrong setting has the ability to eat your spend very quickly. My point is that the display network is a cesspool of fraud, and I doubt I would touch it again.

By 'healthy conversion rate' do you mean people signed up for your service/ purchased your product? Or are you simply referring to click through rate?

The conversion rate that you get in Adwords. This is supposedly created by having code on your order completion page. But Adwords was showing conversions (implying sales) for sales that never existed. So either scammers were spoofing the conversions or the code was faulty. But the conversion optimization works by increasing the ads that convert. All good as long as the conversions actually are real.

Thanks for the insight, I didn't realize this was even a thing.

>For the technically curious: reading the address of the top frame is a challenging problem. For security reasons, browsers do not allow cross-domain scripting. So, it is not possible to just call the "top" object and read its properties. We have a proprietary solution for this.

Are they exploiting a security bug?

I'll speculate they're using the referrer, although I think that only lets you jump up one level and then you're stuck. The client isn't required to send the referer header so it may not work at all. Still there are some plausible situations in which it works.

you'd be impressed by the amount of snake oil sold in the ad world.

for the latest ones, see the 'solutions' for viewability (i.e. another way to try to not pay publishers for displayed ads). they are all a joke that work on less than 1% of the cases you see in the wild. Yet, no mention of that is made.

When you see "proprietary", "patented", assume "BS".

now, answering your question, this is pretty much a mix of auto/manual monitoring. So with very little effectiveness. And/OR the publishers in question serve the page with Script tags, so they have access to the referrer of the original content page.

Maybe I'm confused as to where their kit runs, but there's no reason to assume they're using a commercial browser. It sounds like they're monitoring sites which screams "bot" to me.

I figure they have some sort of iframe busting script that lets them gain access to the top frame.

I can recognize a lot of stuff I used to do when I was 16 and owned that kind of website. A lot of linking to send traffic to other websites who would send traffic back. A lot of fake traffic through iframes, and often through <img src="url" width="0" height="0"> because iframes fake traffic would be protected against. A lot of exchange with that kind of websites.

There was a huge bubble.

Also those websites gives you what you want to see. We all started doing porn, but the most clever guys understood that you had to post more. Gore, Fights, Shock...

Wow, searching for "buy traffic" or "real human traffic" (sans quotes) is an eye-opener. They may be real humans and not bots (though I doubt it) but it's still fraud.

What a cesspool.

Ironically, this is only possible because advertise resellers created all sort of markets for scamming the publishers of actually getting paid for the ad they show (advertises have to pay for 3rd party reporting, brand protection, etc, etc, etc. all that dillutes the $3~4 cpc the brands pay to the 3c the publishers receivers in the end)

if it worked like it works in TV or radio, this wouldn't be possible to begin with. or wouldn't be profitable.

I think I'm missing the connection to the "legitimate" publisher. Is the publisher paying the scammer for traffic? How are they doing that? unless they're in on the scam as well.

Close... but the business model for most of these operations is traffic generation. Need 1M uniques this month to hit your numbers? No worries!! Enter your credit card here!

FYI: The NSFW content is a handful of tiny pornographic images.

one flaw on the estimates: it assume 100% of the uses leave the popunder running.

anyone have any data on the effectiveness of popunders? this is one area i never have to deal with (thankfully)

Effectiveness? Like click-through rate? It's irrelevant in this model, really.

The popunder loads the page that loads all of the other ad-clicking domain pages, and since it's a popunder it's probably not noticed until the browser has loaded the entire contents.

It's damn brilliant. Paying $3k for low-end $500k? That's a great ROI.

my point is: how many people even let the popupunder load?

i visit a few forums that have popunders for the first sessio n click. it's almost a knee jerk reaction to close the window while i wait for the forum index to load.

He is making the assumption that 100% of the visits translates to a popunder being able to do it's thing. I just want to know if the real world the number is 99% or 10%.

The described scheme has nothing to do with popunders really. A hidden iframe is loaded in which the advertisers ad is "displayed" and the publisher gets payed on cpm. The user doesn't even get to see the ad.

That was a very insightful read, thanks.

Reply on news.ycombinator.com