Using an Ad-Network as a Click Fraud Botnet
Friday, February 2nd, 2007February 2nd, 2007
We’ve just recently uncovered a new click-fraud strategy that I think is important to raise awareness of. As you probably know, click-frauders tend to use large botnets to try to fool adservers that clicks are legitimate. The large number of distributed IP addresses makes it difficult to identify which clicks are fraudulent and which aren’t.
We’ve recently discovered that click-frauders have gotten smarter and are turning ad networks into virtual botnets. Frauders are buying inventory at a CPM price and, with some fancy javascript, using the ad space to fake clicks. This gives them an unimaginable distribution of IP addresses and makes it practically impossible to catch the clicks. The ad network isn’t looking for the behavior because it’s getting paid on a flat CPM basis, not per-click.
The creatives that are given to the network are quite crafty. In general they are ‘landing page pops’ that work as follows:
- Browser loads some content from ad.someadserver.com
- A small snippet of javascript is loaded and downloads a regular banner from a 3rd party adserver
- After a random delay (1-4 seconds) the javascript triggers a click for said banner and displays the landing page
By doing the above these advertisers manage to show landing page pops for brand advertisers that would never allow this to happen. The brand advertiser will probably never notice this because he’ll most likely still get conversions for his service, and hence won’t assume that the traffic is fraudulent.
We are now automatically auditing creatives on the RMX to detect and stop this behavior, and we urge all networks to take similar steps. If you have any questions please feel free to contact me at mnolet@rightmedia.com.





