What is Methbot Ad Fraud?
Methbot was hosted and controlled by a hacker group in Russia and Operating out with data centres in US and Netherlands. It was also nicknamed as “
These “bot farm” generates approximately $3 to $5 million per day by targeting the premium video advertising ecosystem. Experts from Whiteops detected and blocked the malicious activity generated by Methbot on behalf of their customers.
Overview of Methbot behaviour
Volume and Estimated Financial Impact
- Advanced Techniques to Avoid Detection Operational Infrastructure
- $3 to $5 million in revenue per day for its operators.
- CPMs ranged from $3.27 to $36.72 with the average being $13.04.
- 200 – 300 million video ad impressions generated per day on fabricated inventory.
- 250,267 distinct URLs spoofed to falsely represent inventory.
- 6,111 premium domains targeted and spoofed.
- High value marketplaces targeted including PMPs.
Operation Infrastructure
- 571,904 dedicated IPs, many falsely registered as US ISPs .
- 800 – 1,200 dedicated servers operating from data centres in the United States and the Netherlands
Advanced Methods to Avoid Detection
- Faked clicks, mouse movements, and social network login information to masquerade as engaged human consumers.
- Manipulation of geolocation information associated with the IP addresses under their control.
- Special case countermeasures against code from over a dozen different ad tech companies.
- Fully custom HTTP library and browser engine with Flash support, all running under Node.js.
Impact of the Methbot is unmatched, by fabricating as much as $5 million in video advertising inventory per day
Inorder to avoid detection, developer group implemented array of operations. More than the normal botnet it involves attacks on existing IP addresses and piggybacking on residential computers.
Methbot Ad Fraud Profit Machine
Since both human audiences and premium publisher inventory are in high demand, Methbot Ad Fraud focuses on manufacturing both of these as its product.
By supplying faked audiences and hijacking the brand power of prestigious publishers through faked domains and falsified inventory.
Methbot – Technical Analysis
Bot Characteristics
Methbot uses it’s own customised software’s with a pool of dedicated IP address. White Ops team detection technology was able to use a JavaScript language feature called “reflection” to gather extensive, detailed information about its inner workings.
The bot runs under Node.js, and uses several open source libraries to add other features. It operates primarily on a large scale multi-data center distributed system to leverage parallel, reliable, and redundant operations.
Some open source libraries and tools used in the bot include:
- Tough-cookie for preserving session data between executions.
- cheerio for parsing HTML.
- JWPlayer for running ad tags and requesting video advertisements.
- Node.JS
To date White Ops has observed 250,267 distinct URLs across 6,111 distinct domains that were generated by Methbot in the act of impersonating a user visiting a web page.
Sample of Methbot generated URLs
To find a complete list of URL’s.
- http://ibtimes.co.uk/video
- http://vogue.com/video
- http://economist.com/video
- http://espn.com/video
- http://www.cbssports.com/CBS_Air_Force_Falcons_Fall_Gear
- http://fortune.com/2016/09/28/department-stores-closings/
- http://foxnews.com/video
Methbot form
- 8,000 – 1,200 dedicated Methbot servers.
- Distributed system to leverage parallel, reliable, and redundant operations.
- Browser impersonation to resolve against fabricated premium domains.
- Forged browser aspects including objects like screen information, plugin list, built in functions, and supported events
Financial knock
White Ops consulted with AD/FIN, a programmatic media intelligence company, for representative cost data on the Methbot URL list.The analysis produced through this partnership showed that Methbot Ad Fraud generated ad impressions sell for anywhere from $3.27 CPM to $36.72 CPM.
