CPMs (cost per thousnad) ranged from $3.27 to $36.72 with the average at $13.04.
\nTalking about the volume of the fraud, White Ops estimates between 200 – 300 million video ad impressions generated per day on fabricated inventory.<\/p>\n
Around 250,267 distinct URLs were spoofed to falsely represent inventory. The white book calculates that 6,111 premium domains were targeted and spoofed.
\nAmong the victims of this spoofing practice there are high value marketplaces targeted including PMPs (private marketplaces).<\/p>\n
Advanced techniques to avoid bot traffic detection<\/strong><\/span><\/p>\n Methbot operation uses advanced techniques to avoid detection. Methbot operation also employs special case countermeasures against code from over a dozen different ad tech companies. They own as well a fully custom http library and browser engine with Flash support, all running under Node.js<\/p>\n A mutation of C3 bot dating back to September 2016<\/strong><\/span><\/p>\n In September 2016, White Ops detected a mutation in a previously low volume bot signature which had been flagged as \u201cC3\u201d since September 2015. The security research team continued to track the evolution of C3 as it innovated and grew into what would become known as \u201cMethbot.\u201d<\/p>\n On October 5, 2016, Methbot began to scale aggressively, reaching as many as 137 million impressions per day by the end of the week.<\/p>\n Following the initial ramp in October, Methbot continued to produce massive amounts of impression volumes while continuing to adapt its codebase daily in an effort to elude fraud detection and viewability vendors and avoid discovery in order to continue the operation.<\/p>\n The Methbot business<\/strong><\/span><\/p>\n Both human audiences and premium publisher inventory are in high demand. Thats why Methbot focuses on manufacturing both of these as its product. By supplying faked audiences and hijacking the brand power of prestigious publishers through faked domains and falsified inventory, Methbot is able to siphon away millions in real advertising dollars.<\/p>\n Specially built infrastructure<\/strong><\/span><\/p>\n Methbot relies on specially buit infrastructure rather than on malware-infected residential coomputers as traditional bot networks. Methbot hass opted by investing significant time, research, development, and resources to build infrastructure designed to remove these limitations and provide them with unlimited scale.<\/p>\n Transparency, the only cure<\/strong><\/span><\/p>\n White Ops underscores that in an automatised digital market such as the programatic just \u00aba combination of human best practices and technological vigilance by verification companies can help the industry close ranks against these threats and increase certainty through transparency for everyone across the advertising spectrum.\u00bb<\/p>\n White Ops has partnered with The Trustworthy Accountability Group (TAG) tagtoday.net industry associations to facilitate the delivery and propagation of the data necessary to help bring the Methbot operation to a halt.<\/p>\n \u00abWe hope the public release of this research will result in a rapid end to this enterprise as White Ops remains on constant watch for new threats on the horizon.\u00bb<\/p>\n Image over the headline.-\u00a0\u00a9 White Ops.<\/strong><\/span><\/p>\n Related external links:<\/strong><\/span><\/p>\n The White Ops’ Report on Methbot Operation<\/span>
\nAmong these techniques they find faked clicks, mouse movements, and social network login information to appear as engaged human consumers. They also manipulate geolocation information associated with the IP addresses under their control.<\/p>\n![\"\u00a9](\"https:\/\/eastwind.es\/marketing\/wp-content\/uploads\/sites\/2\/2016\/12\/Methbotoperation_economicimpact_loses_conrecuadro.jpg\")
<\/a><\/a>
\nThis is because of the work needed to continually infect new home computers is huge, especially while existing infections are being discovered and cleaned by anti-malware vendors.<\/p>\n<\/a>
\n<\/a>
\nDownload: Spoofed Domains<\/span>
\n<\/a>
\nDownload: Full List of URLs<\/span>
\n<\/a>
\nDownload: Compromised IP Addresses <\/span>
\n<\/a>
\nDownload: IP Ranges (CIDR Format)
\n<\/span><\/p>\n