Anatomy of a bot fraud scheme
How organised fraud rings turn fake websites and hijacked devices into real advertising money, and where they get caught.
Anatomy of a bot fraud scheme
1/7
The goal: real money for fake views
An ad fraud ring earns money every time an ad is “shown”. It doesn’t need people, just traffic that looks like people.
- The goal: real money for fake views: An ad fraud ring earns money every time an ad is “shown”. It doesn’t need people, just traffic that looks like people.
- Build the audience: It runs a Botnet: malware-infected phones and PCs, or rented servers running automated browsers that load pages and scroll like humans.
- Hide where it comes from: Data-center traffic is easy to spot, so traffic is routed through residential proxies: home internet connections, often from people who don’t know their device is involved.
- Send it to “premium” pages: The bots visit sites that are fake, or that spoof famous publishers’ names in bid requests so the inventory looks valuable.
- Launder it through the supply chain: The impressions are sold through resellers and exchanges, sometimes mixed with real traffic (sourced traffic), until they look ordinary.
- Cash out: Advertisers pay for impressions nobody saw. The money flows back up the chain to the ring. At its peak, the Methbot operation was estimated to earn millions of dollars a day.
- Where it breaks: Scale is the fraudster’s weakness. Identical behaviour, impossible device mixes, ads.txt mismatches and IP patterns expose SIVT. Detection firms, platforms and law enforcement have taken down many such rings.
Step by step
- The goal: real money for fake viewsAn ad fraud ring earns money every time an ad is “shown”. It doesn’t need people, just traffic that looks like people.
- Build the audienceIt runs a botnet: malware-infected phones and PCs, or rented servers running automated browsers that load pages and scroll like humans.
- Hide where it comes fromData-center traffic is easy to spot, so traffic is routed through residential proxies: home internet connections, often from people who don’t know their device is involved.
- Send it to “premium” pagesThe bots visit sites that are fake, or that spoof famous publishers’ names in bid requests so the inventory looks valuable.
- Launder it through the supply chainThe impressions are sold through resellers and exchanges, sometimes mixed with real traffic (sourced traffic), until they look ordinary.
- Cash outAdvertisers pay for impressions nobody saw. The money flows back up the chain to the ring. At its peak, the Methbot operation was estimated to earn millions of dollars a day.
- Where it breaksScale is the fraudster’s weakness. Identical behaviour, impossible device mixes, ads.txt mismatches and IP patterns expose SIVT. Detection firms, platforms and law enforcement have taken down many such rings.