The map of where the views come from is expected (Russia, India, South East Asia). The bit that I find most interesting is: > Vass says that he keeps 500views.

The map of where the views come from is expected (Russia, India, South East Asia). The bit that I find most interesting is: > Vass says that he keeps 500views.com running by paying a monthly retainer to "a number of high-traffic websites to have them run hidden scripts." >"The script contains the YouTube link we need to increase views on..." Looking at the map, you have to assume that the high-traffic websites are specific to those regions. Otherwise you would expect IP addresses from other countries to show up more often Is there a (relatively) easy way of scraping for these malicious tags to create a catalog of what websites are hosting the malicious code? You could pay for the view boost service. Scrape the top 5,000 sites in those regions of the world and hope your bot gets roped into being part of the botnet (as you could identify the video you paid to boost). Just an idea.