Methbot – How the King of Fraud made $3 million per day with advertising fraud

Image Source

Before we dive deeper into the technical mechanics of how Methbot operated, it is important to understand the scale of the Methbot scheme and why it was one of the biggest advertising frauds of all time.

At its peak, 200 to 400 million video ad views per day were faked by using over 2,000 different servers with over 650,000 residential IP addresses. With a relatively high CPM for video ads, ranging from $3 to $36, it is estimated that the scheme earned its operators $3 to $5 million in ad revenue per day! The Methbot operation spoofed over 6,000 domains with over 250,000 URLs and targeted high-value marketplaces including private marketplaces (PMPs).

In a nutshell Methbot delivered real ads from real advertisers and advertising networks to fake and non-existing users (bots) via fake and spoofed websites. The bots used were very sophiticated, pretending to be real users by visiting the spoofed domains through a fake browser, faking mouse movements, scrolling the page, starting and stopping a video player midway and falsely pretending to be logged in to Facebook (DOJ).

With the overall strategy explained, let us have a look at some more technical mechanisms the Methbot operation used.

Distributed servers

Methbot used over 2,000 physical servers located in data centers in Dallas, Texas, and Amsterdam, the Netherlands. Each server ran multiple instances of the Methbot browser component and a proxy in order to obfuscate the IP address.

Proxy network with lots o residential IP adresses

Ad fraud operated from data centers is usually easy to detect due to various reasons, one being the IP address. Therefore, most ad fraud operations infect private computers through malware. Once infected, the botnet uses the IP address of the infected device and runs fake browser sessions in the background without the victims’ knowledge. This approach entails hard and continuous work, as new computers need to be constantly infected while existing infections are detected and cleaned by anti-malware vendors and other tools.

Methbot’s operators took a different approach: they rented over 650,000 different residential IP addresses with fake registration details and made the bots appear to be real American Internet users coming from legitimate Internet service providers (ISPs) such as Verizon, Comcast, and AT&T.

Sophisticated tech-stack with open source software

The custom software running the Methbot operation used several open source libraries to add the required features.

• js as the underlying JavaScript (JS) runtime environment in order to run JS code.
• tough-cookie to set cookies in the fake sessions while retaining persistent identities like a Facebook login. This was primarily used to achieve higher CPMs, as certain information is considered more valuable to advertisers due to more precise targeting capabilities.
• cheerio in order to parse HTML markup and traversing / manipulating the resulting data structure.
• JWPlayer to request video ads and to programmatically interact with the video player.