Lesson 3 of 8 · 9 min read · intermediate
How bots fake humans
From data-center scripts to malware on your TV box: the tiers of bot sophistication, and how Methbot and 3ve faked billions of views.
A bot is just software that does something a person would normally do. Most bots on the internet are useful. The ones this lesson is about exist to be counted as audiences. To earn money they must pass as human at three moments: when the ad is requested, when it renders, and when anyone later checks the numbers. Each generation of detection has pushed fraudsters to build a more convincing disguise.
Picture a fake guest trying to get into an exclusive party. The crude version wears a paper mask and walks in with forty identical friends. A better version rents a real tuxedo. The best version quietly borrows the invitation, car and phone of a real guest who is asleep at home. Ad bots have evolved in exactly this order.
The five tiers of bot sophistication
| Tier | What it is | How it is usually caught |
|---|---|---|
| 1. Simple scripts | Programs on cloud servers that request pages and ads with no real browser at all | GIVT: data-center IP lists, non-browser user agents, non-rendering checks |
| 2. Headless browsers | A real browser engine running without a screen (headless browser), able to execute ad scripts | Inconsistencies in the browser environment, missing rendering, automation fingerprints |
| 3. Disguised automation | Automated browsers on servers routed through residential proxies and fed forged device details | Signal mismatches (time zone vs location vs language), device fingerprinting, proxy intelligence |
| 4. Hijacked real devices | Malware on ordinary computers, phones and TV boxes loading hidden ads in the background (botnet) | Population-level analysis, malware reverse-engineering, threat intelligence |
| 5. Hybrid and human | Click farms, device farms, emulator farms and humans assisting bots | Behavioural clustering, device-graph anomalies, investigations |
Why residential proxies matter so much
The cheapest place to run a bot is a data center, but data-center IP ranges are published and filtered as GIVT. So fraud moved to borrowed home internet connections. A residential proxy routes traffic through someone's home broadband or mobile connection, so a bot in a server rack appears to be a person in Ohio, Berlin or Pune. Some proxy networks are built from apps whose users agreed, often in fine print, to share bandwidth. Others are built from malware: the BADBOX 2.0 operation, which you will meet in the CTV lesson, sold access to infected devices as a residential proxy service. For detectors, the IP address stops being proof of anything on its own.
Headless browsers and fake fingerprints
Modern ad measurement runs JavaScript inside the page to check the environment: screen size, fonts, graphics card, battery, touch support and dozens more properties. That bundle is a device fingerprint. A headless browser can run that JavaScript, and bot operators patch it to report plausible values. The weakness is consistency. Faking one property is easy. Faking hundreds of properties that must all agree with each other, with the user agent string, and with the network, across millions of sessions, is very hard. Detectors look for impossible combinations, such as an iPhone reporting a desktop graphics card.
Faking behaviour
Once the device looks real, the behaviour must look real too. Bots simulate scrolling, mouse movement, dwell time and clicks. Some even pick up tracking cookies by visiting retail and travel sites first, so that they look like valuable shoppers to audience-targeting systems and command higher prices. Behavioural analysis catches them statistically: real humans are messy, and a thousand "people" who scroll at identical speeds or only ever visit high-priced sites are not.
Anatomy of a bot fraud scheme
An ad fraud ring earns money every time an ad is “shown”. It doesn’t need people, just traffic that looks like people.
- The goal: real money for fake views: An ad fraud ring earns money every time an ad is “shown”. It doesn’t need people, just traffic that looks like people.
- Build the audience: It runs a Botnet: malware-infected phones and PCs, or rented servers running automated browsers that load pages and scroll like humans.
- Hide where it comes from: Data-center traffic is easy to spot, so traffic is routed through residential proxies: home internet connections, often from people who don’t know their device is involved.
- Send it to “premium” pages: The bots visit sites that are fake, or that spoof famous publishers’ names in bid requests so the inventory looks valuable.
- Launder it through the supply chain: The impressions are sold through resellers and exchanges, sometimes mixed with real traffic (sourced traffic), until they look ordinary.
- Cash out: Advertisers pay for impressions nobody saw. The money flows back up the chain to the ring. At its peak, the Methbot operation was estimated to earn millions of dollars a day.
- Where it breaks: Scale is the fraudster’s weakness. Identical behaviour, impossible device mixes, ads.txt mismatches and IP patterns expose SIVT. Detection firms, platforms and law enforcement have taken down many such rings.
Case study: Methbot (2016)
In December 2016 the security firm White Ops (now HUMAN) exposed Methbot. It ran from hundreds of servers in data centers in the US and Amsterdam, used a custom-written browser, and made its traffic look residential with fraudulently registered IP addresses. It spoofed thousands of premium publishers: White Ops published 250,267 fake URLs across 6,111 domains. The firm estimated Methbot produced 200 to 300 million fake video impressions a day, earning $3 to $5 million daily. Methbot aimed at video because video CPMs were high.
Case study: 3ve (2018)
3ve (pronounced "eve") was the evolution. Its operators used a mix of data-center bots and malware (Kovter and Boaxxe) on real computers, spoofed domains and hijacked IP addresses. A coalition including Google, White Ops, Proofpoint and others mapped it, and on 27 November 2018 the US Department of Justice unsealed a 13-count indictment against eight defendants covering both schemes, alongside an FBI-led takedown of the botnet infrastructure. Aleksandr Zhukov, charged as the leader of Methbot, was later convicted in Brooklyn and sentenced to 10 years in prison.
The human tier
Not every fake audience is software. Click farms and device farms, rooms full of real phones operated by low-paid workers or simple automation, have been documented across Asia and elsewhere. Human fraud is valuable because it defeats behavioural checks, but it is expensive, so it is usually reserved for high-value actions like app installs, sign-ups and social engagement. Purchased traffic from unvetted vendors often blends all five tiers together.
Key takeaways
- Bots evolved from data-center scripts to headless browsers, disguised automation, hijacked real devices and hybrid human operations.
- Residential proxies make a server look like a home user, so IP addresses alone prove little.
- Detectors win on consistency: hundreds of device and behaviour signals must all agree, and fakes rarely manage it at scale.
- Methbot (2016) and 3ve (2018) proved fraud could be industrial and prosecutable; the DOJ indicted eight defendants.
Questions people ask
How do bots click on ads?
Ad bots are programs, often running in headless browsers or as malware on real devices, that load web pages and apps, render ads and simulate human actions like scrolling and clicking. Sophisticated bots route traffic through residential proxies to hide their origin and fake device fingerprints to look like ordinary phones or computers. Detection vendors catch them by finding inconsistencies across many signals rather than any single tell.
What was Methbot?
Methbot was a video ad fraud operation exposed by White Ops (now HUMAN) in December 2016. It used servers in US and Amsterdam data centers, a custom browser and falsely registered IP addresses to fake 200 to 300 million video views a day on more than 6,000 spoofed premium domains, earning an estimated $3 to $5 million daily. Its alleged leader was later convicted in the US.
What is a residential proxy in ad fraud?
A residential proxy routes internet traffic through someone's home or mobile connection, so traffic from a server appears to come from an ordinary household. Fraudsters use them to get past data-center IP filters. Some proxy networks are built from infected devices, such as the BADBOX 2.0 TV boxes. Because of this, detectors combine IP data with device, behaviour and supply-chain signals.