Traffic Alchemist disguised Junk Traffic as Quality Views Originating from Google and Twitter
Seattle, WA – Protected Media, a global provider of anti-fraud solutions that ensure digital ads are visible and seen by real people, discovered an online ad scam called “The Traffic Alchemist” that disguises junk traffic as views on reputable sites, with high Alexa ratings originating from Google and Twitter. Beginning in New York in April 2016, the scam evaded detection since it involved real users instead of bots, masqueraded traffic, and cloaked fraudulent sites to keep them off data scientists’ radar. This scam burned through $7 million dollars a month at its peak, and is still continuing but at a slower rate.
“The Traffic Alchemist scam is unusual not because of the sophistication of one single technique but because it combines several methods together to keep the fraudulent activity under the radar”, said Asaf Greiner, CEO of Protected Media. “By looking beyond the technology, and uncovering the mechanism that manipulates traffic attributes, it’s possible to detect similar complicated ad schemes that are always in place but with slightly different variations”.
The fraudster began by buying junk traffic, typically on porn or torrent sites, known for long viewing times. Then long sessions were split into hundreds of short sessions on “legitimate, lucrative” sites operated by the fraudster. These sites were cloaked to appear reputable for direct traffic, but were actually cluttered with pop-up ads that are not viewable. Up to 35 ads were served per user that were refreshed every 15 seconds resulting in 140 ad impressions per minute. The fake web sites were clustered together, into groups of 7-10, and traffic was cycled through each site to keep realistic measurements so an alert wouldn’t be issued to anti-fraud software.
The path to these pop-under sites was disguised so that the viewers appear to be arriving organically from Google or Twitter, from legitimate search and social activity rather than views on porn and torrent sites. The cleaned up traffic was shared with Google Analytics and then reported by reputable third party platforms making advertisers confident the traffic was legitimate. After several weeks, when the performance was no longer good enough to keep the sites on target publisher lists, the websites were abandoned for a fresh cluster, to keep the scam continuing month after month.
Click here to view the infographic that shows each stage of the online ad fraud: The Traffic Alchemist
About Protected Media
Protected Media’s solutions enable buyers and sellers of digital advertising to ensure that display mobile and video ads are properly located, visible, and seen by real people. Protected Media’s technology provides in-depth information at the impression level to detect problematic traffic so agencies can work side by side with publishers to identify and eliminate suspicious activity to dramatically increase over-all ad quality.
For more information, visit Protected Media.
