3 ms·
What is a click other than a "redirect" from one page to another? Add the appropriate parameters in the HTTP call and you are done. There is no need for actual
by Panos 16y ago
What is a click other than a "redirect" from one page to another? Add the appropriate parameters in the HTTP call and you are done. There is no need for actual user interaction for an HTTP call to be considered a "click".
Take a look at the screenshots: You will see that the redirects are URLs that you would "click" as a user to see an ad.
The clever part is that the "clicks" come from a wide variety of IPs, wide variety of browsers, and on different times.
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]
- Panos 16y agoAll these parts happen within the index2.php of the parked domains (see the section with the title "Re-directions and generating click fraud with normal click patterns"). Take a look at this screenshot: https://lh5.googleusercontent.com/-R9lgD8LQfdw/TXEu7e2Sb5I/AAAAAAAAhsY/cT0tZn1-bDk/s1600/parked-domain-redirects.PNG https://lh5.googleusercontent.com/-R9lgD8LQfdw/TXEu7e2Sb5I/A... and here are the detailed requests https://lh5.googleusercontent.com/-qVyp1ChmmRA/TXExPKhXnOI/AAAAAAAAhsc/qvg_K3bUaWI/s1600/parked-domain-1.PNG https://lh5.googleusercontent.com/-qVyp1ChmmRA/TXExPKhXnOI/A... https://lh3.googleusercontent.com/-3KulINgZhwA/TXExPdCASOI/AAAAAAAAhsg/iybgmapk3qg/s1600/parked-domain-2.PNG https://lh3.googleusercontent.com/-3KulINgZhwA/TXExPdCASOI/A... https://lh3.googleusercontent.com/-q3Cpp0uIM6g/TXExPsl3ycI/AAAAAAAAhsk/W1wY7lz8rdo/s1600/parked-domain-3.PNG https://lh3.googleusercontent.com/-q3Cpp0uIM6g/TXExPsl3ycI/A... https://lh4.googleusercontent.com/-zWpoE6IlyfI/TXExP36fWhI/AAAAAAAAhso/gdQL4qAbuew/s1600/parked-domain-4.PNG https://lh4.googleusercontent.com/-zWpoE6IlyfI/TXExP36fWhI/A... https://lh5.googleusercontent.com/-c0FdFkU0xX4/TXExQF5jHfI/AAAAAAAAhss/BkNvK0wy-QY/s1600/parked-domain-5.PNG https://lh5.googleusercontent.com/-c0FdFkU0xX4/TXExQF5jHfI/A... https://lh4.googleusercontent.com/-oLleFeARs3o/TXExQS95chI/AAAAAAAAhsw/TnyPVDzQf0I/s1600/parked-domain-6.PNG https://lh4.googleusercontent.com/-oLleFeARs3o/TXExQS95chI/A... https://lh4.googleusercontent.com/-_-KqSY7ue5w/TXExQTVttwI/AAAAAAAAhs0/j039lVKHojE/s1600/parked-domain-7.PNG https://lh4.googleusercontent.com/-_-KqSY7ue5w/TXExQTVttwI/A... https://lh4.googleusercontent.com/-Dxp-OfM0oXw/TXExQrQsoLI/AAAAAAAAhs4/5mH5KM0jBSY/s1600/parked-domain-8.PNG https://lh4.googleusercontent.com/-Dxp-OfM0oXw/TXExQrQsoLI/A...
- teyc 16y agoPanos, Where is the click on the adserver? I don't see that.
- Panos 16y agoThe screenshots above redirect to a search engine. (My IP had already been used for clicks and I could not generate the ad clicks for the screenshots) If you want to see the scheme in action go to the new domains set up by the scammer: http://www.kidsbeanbags1.com/index2.php http://www.kidsbeanbags1.com/index2.php http://www.kingsizemattress1.com/index2.php http://www.kingsizemattress1.com/index2.php http://www.neckpillow1.com/index2.php http://www.neckpillow1.com/index2.php http://www.pillowtopmattress1.com/index2.php http://www.pillowtopmattress1.com/index2.php http://www.pillowcovers1.com/index2.php http://www.pillowcovers1.com/index2.php http://www.tempurpillow1.com/index2.php http://www.tempurpillow1.com/index2.php http://www.contourpillow1.com/index2.php http://www.contourpillow1.com/index2.php If you want to observe the full click behavior: Chrome->Tools->DeveloperTools->Network Let me know what you see. Curious to see if the scammer changed the behavior.
- teyc 16y agoI saw the same kind of redirects as written up. I still don't understand. Where is the money? Is this CPC or CPM fraud? It couldn't be CPC because there is no landing page served. It couldn't be CPM because there is no ad served.
- Panos 16y agoConfirming your observation. I got the explanation: All the targeted sites (e.g., Mevio or Current.TV) now have filters in place. So you will not be able to see the actual landing pages. The landing page will be a blank page as the ad click will not work. Btw for the record: It is mainly CPC fraud, sending (invisible) traffic to sites like Mevio and Current.TV which serve mainly CPM ads.
- 16y ago