4 ms·

All these parts happen within the index2.php of the parked domains (see the section with the title "Re-directions and generating click fraud with normal click p

by Panos 16y ago

All these parts happen within the index2.php of the parked domains (see the section with the title "Re-directions and generating click fraud with normal click patterns"). Take a look at this screenshot: https://lh5.googleusercontent.com/-R9lgD8LQfdw/TXEu7e2Sb5I/AAAAAAAAhsY/cT0tZn1-bDk/s1600/parked-domain-redirects.PNG https://lh5.googleusercontent.com/-R9lgD8LQfdw/TXEu7e2Sb5I/A... and here are the detailed requests https://lh5.googleusercontent.com/-qVyp1ChmmRA/TXExPKhXnOI/AAAAAAAAhsc/qvg_K3bUaWI/s1600/parked-domain-1.PNG https://lh5.googleusercontent.com/-qVyp1ChmmRA/TXExPKhXnOI/A... https://lh3.googleusercontent.com/-3KulINgZhwA/TXExPdCASOI/AAAAAAAAhsg/iybgmapk3qg/s1600/parked-domain-2.PNG https://lh3.googleusercontent.com/-3KulINgZhwA/TXExPdCASOI/A... https://lh3.googleusercontent.com/-q3Cpp0uIM6g/TXExPsl3ycI/AAAAAAAAhsk/W1wY7lz8rdo/s1600/parked-domain-3.PNG https://lh3.googleusercontent.com/-q3Cpp0uIM6g/TXExPsl3ycI/A... https://lh4.googleusercontent.com/-zWpoE6IlyfI/TXExP36fWhI/AAAAAAAAhso/gdQL4qAbuew/s1600/parked-domain-4.PNG https://lh4.googleusercontent.com/-zWpoE6IlyfI/TXExP36fWhI/A... https://lh5.googleusercontent.com/-c0FdFkU0xX4/TXExQF5jHfI/AAAAAAAAhss/BkNvK0wy-QY/s1600/parked-domain-5.PNG https://lh5.googleusercontent.com/-c0FdFkU0xX4/TXExQF5jHfI/A... https://lh4.googleusercontent.com/-oLleFeARs3o/TXExQS95chI/AAAAAAAAhsw/TnyPVDzQf0I/s1600/parked-domain-6.PNG https://lh4.googleusercontent.com/-oLleFeARs3o/TXExQS95chI/A... https://lh4.googleusercontent.com/-_-KqSY7ue5w/TXExQTVttwI/AAAAAAAAhs0/j039lVKHojE/s1600/parked-domain-7.PNG https://lh4.googleusercontent.com/-_-KqSY7ue5w/TXExQTVttwI/A... https://lh4.googleusercontent.com/-Dxp-OfM0oXw/TXExQrQsoLI/AAAAAAAAhs4/5mH5KM0jBSY/s1600/parked-domain-8.PNG https://lh4.googleusercontent.com/-Dxp-OfM0oXw/TXExQrQsoLI/A...

teyc 16y ago
Panos, Where is the click on the adserver? I don't see that.
- Panos 16y ago
  The screenshots above redirect to a search engine. (My IP had already been used for clicks and I could not generate the ad clicks for the screenshots) If you want to see the scheme in action go to the new domains set up by the scammer: http://www.kidsbeanbags1.com/index2.php http://www.kidsbeanbags1.com/index2.php http://www.kingsizemattress1.com/index2.php http://www.kingsizemattress1.com/index2.php http://www.neckpillow1.com/index2.php http://www.neckpillow1.com/index2.php http://www.pillowtopmattress1.com/index2.php http://www.pillowtopmattress1.com/index2.php http://www.pillowcovers1.com/index2.php http://www.pillowcovers1.com/index2.php http://www.tempurpillow1.com/index2.php http://www.tempurpillow1.com/index2.php http://www.contourpillow1.com/index2.php http://www.contourpillow1.com/index2.php If you want to observe the full click behavior: Chrome->Tools->DeveloperTools->Network Let me know what you see. Curious to see if the scammer changed the behavior.
  - teyc 16y ago
    I saw the same kind of redirects as written up. I still don't understand. Where is the money? Is this CPC or CPM fraud? It couldn't be CPC because there is no landing page served. It couldn't be CPM because there is no ad served.
    - Panos 16y ago
      Confirming your observation. I got the explanation: All the targeted sites (e.g., Mevio or Current.TV) now have filters in place. So you will not be able to see the actual landing pages. The landing page will be a blank page as the ad click will not work. Btw for the record: It is mainly CPC fraud, sending (invisible) traffic to sites like Mevio and Current.TV which serve mainly CPM ads.
      - teyc 16y ago
        no, that still does not make sense. If there is a click on an adserver, where is it in this bunch of redirects?
        to_the_top 16y ago
        thats what I am wondering, how is sending the actual click? does he have access to a PPC feed (from who?) or is he somehow getting the links for the link via javascript and for what ad networks ??
        Panos 16y ago
        That, unfortunately, I could not observe. My intuition says that he had a PPC feed for his parked domains and he was using the click.mygeek.com etc services to click on them. Note that he was not always clicking on the links, to maintain a reasonable low clickthrough rate for the ads.
        teyc 16y ago
        Another commenter explained it this way. You run a video site or a search engine that serves CPM ads. If you can buy PPC cheap enough, you can arbitrage and make money. PPC from Google is expensive, but there are companies that sell cheap clicks. Some publishers on these ad networks run porn sites with hidden iframes that generate the clickthrough. However, iframes generate a http referer, and this gives away the rather dubious traffic sources. The series of redirected clicks are used to subvert click fraud analysis.

by Panos 16y ago

teyc 16y ago

Panos, Where is the click on the adserver? I don't see that.

Panos 16y ago
The screenshots above redirect to a search engine. (My IP had already been used for clicks and I could not generate the ad clicks for the screenshots) If you want to see the scheme in action go to the new domains set up by the scammer: http://www.kidsbeanbags1.com/index2.php http://www.kidsbeanbags1.com/index2.php http://www.kingsizemattress1.com/index2.php http://www.kingsizemattress1.com/index2.php http://www.neckpillow1.com/index2.php http://www.neckpillow1.com/index2.php http://www.pillowtopmattress1.com/index2.php http://www.pillowtopmattress1.com/index2.php http://www.pillowcovers1.com/index2.php http://www.pillowcovers1.com/index2.php http://www.tempurpillow1.com/index2.php http://www.tempurpillow1.com/index2.php http://www.contourpillow1.com/index2.php http://www.contourpillow1.com/index2.php If you want to observe the full click behavior: Chrome->Tools->DeveloperTools->Network Let me know what you see. Curious to see if the scammer changed the behavior.
- teyc 16y ago
  I saw the same kind of redirects as written up. I still don't understand. Where is the money? Is this CPC or CPM fraud? It couldn't be CPC because there is no landing page served. It couldn't be CPM because there is no ad served.
  - Panos 16y ago
    Confirming your observation. I got the explanation: All the targeted sites (e.g., Mevio or Current.TV) now have filters in place. So you will not be able to see the actual landing pages. The landing page will be a blank page as the ad click will not work. Btw for the record: It is mainly CPC fraud, sending (invisible) traffic to sites like Mevio and Current.TV which serve mainly CPM ads.
    - teyc 16y ago
      no, that still does not make sense. If there is a click on an adserver, where is it in this bunch of redirects?
      - to_the_top 16y ago
        thats what I am wondering, how is sending the actual click? does he have access to a PPC feed (from who?) or is he somehow getting the links for the link via javascript and for what ad networks ??
        Panos 16y ago
        That, unfortunately, I could not observe. My intuition says that he had a PPC feed for his parked domains and he was using the click.mygeek.com etc services to click on them. Note that he was not always clicking on the links, to maintain a reasonable low clickthrough rate for the ads.
        teyc 16y ago
        Another commenter explained it this way. You run a video site or a search engine that serves CPM ads. If you can buy PPC cheap enough, you can arbitrage and make money. PPC from Google is expensive, but there are companies that sell cheap clicks. Some publishers on these ad networks run porn sites with hidden iframes that generate the clickthrough. However, iframes generate a http referer, and this gives away the rather dubious traffic sources. The series of redirected clicks are used to subvert click fraud analysis.