Click fraud botnet defrauds advertisers up to $6 million

IDG News Service - An advertising analytics company said it has discovered a botnet that generates upwards of US$6 million per month by generating bogus clicks on display advertisements.

Spider.io, based in the U.K., wrote that the botnet code, called Chameleon, has infected about 120,000 residential computers in the U.S. and perpetrates click fraud on 202 websites that collectively deliver 14 billion ad impressions. Chameleon is responsible for 9 billion of those impressions, Spider.io said.

Click fraud cheats Web advertisers by making them pay for clicks on ads that are not legitimate, depriving them of customers and revenue. Spider.io said advertisers pay an average of $0.69 per one thousand impressions.

Spider.io did not identify the publishers of the websites that the botnet targets. But online media buyers have been noticing inconsistencies for some time on websites showing display ads for large companies. Andrew Pancer, chief operating officer of Media6Degrees in New York, said his company stopped buying ad inventory on thousands of sites last year.

The blacklisted sites reported very high traffic numbers even though some would not even turn up in a search, said Pancer, whose agency buys ads for companies including AT&T, HP and CVS Pharmacy.

"You've never heard of these sites," said Pancer, who said many of the sites share the same cookie-cutter templates.

Media6Degrees shared its findings with Spider.io, which then discovered a botnet it calls "Chameleon." The botnet is engineered to visit multiple pages on multiple websites at a time, clicking on ads the way a real person would. But despite at times looking like unique traffic, Spider.io wrote that the botnet traffic as a whole looks homogenous.

"All the bot browsers report themselves as being Internet Explorer 9.0 running on Windows 7," Spider.io wrote on its blog.

Chameleon puts a heavy load on a user's browser and can cause a browser to crash and restart. If it crashes the browser, Chameleon restarts another session.

Media6Degrees stopped buying inventory through companies such as Alphabird due to concerns over the source of their traffic, Pancer said.

Willie Pang, Alphabird's managing director for Asia-Pacific, said the company has immediately stopped the practice of "buying" traffic, or sourcing web site visitors from other companies, due to Spider.io's findings.

"It's a pretty serious issue, and it's not a new one for folks in our space," Pang said. "Our view on this is we're as much of a victim and surprised by the kind of data we are getting back."

Most of the websites run by Alphabird have fairly stable traffic, but a spike in traffic is a clue that something may be amiss, Pang said. Alphabird is working with Spider.io and Adometry, another online advertising analytics company in Austin, Texas, to review the concerns, he said. Spider.io CEO Douglas de Jager contested that claim and said Spider.io is not working with Alphabird.

Pancer said some publishers may have inadvertently partnered with questionable agencies to supply poor quality traffic to their sites. He said it is still early days for ad exchanges, which are highly automated and have a "wide margin for gaming the system."

"I'm so happy we are finally able to get in front of this," he said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk