12-letter ad fraud. Scooby Whoop

On April 5, 2017, Sadbottrue.com has published the “12-letter ad fraud” investigation. The ad fraud scheme includes more than 1000 unpronounceable 12-letters domains, that sent more than billion of simulated visitors on different sites, that have made hundreds of billions of ad views total.


Among largest recipients of simulated visitors and beneficiary of 12-letter ad fraud were the blog “travelwednesday” and the sports news site Sportsmanias.com. The next one is...



Scoobywhoop.com


Registered on April 30, 2016




Content


It’s just a standard wordpress template, filled by copy-pasted texts and photos. Its title is “ScoobyWhoop | Just another WordPress site”. Yes, the creators of the site were in such a hurry that not only did not have time to change the default title in the template. The description in footer was not changed too, and contact is“contacts@yoursite.com”. The site has pinned 40% of screen black header. Social media links not working at all. The site has 9 headings, each one consists of 14 articles. In fact, it is the same stolen articles with different headlines and 3 pairs of stolen pictures these has no relation to headline or text at all.




On the homepage, the site has a lot of random pieces of HTML code, posted between articles. This code contains “Facebook app ID”, “Facebook security key”, “Facebook access token”.




This is the lazy slam-bang simulation of media. A couple of hours is enough to fix all bugs, but nobody did it.




Traffic stats, audience characteristics



scoobywhoop.com


In summer 2016 the site had average 300,000 Alexa Rank. On August 14 the rank falls to ~1,000,000. Over the next 60 days, the popularity of site began to grow at an incredible rate. On October 14 the site has got 2,250 place in the global ranking. It holds an advantage in the range 3,000~7,000 place. Since 14 February Alexa rank falls down.


In September 2016, the site had 22,000,000 visits. Next four months it has 5~8 millions.



Since 14 February the site has lost all of its audience. In march, it had completely died.





Traffic stats (2017)


The site has just 4,7 % of direct visitors. Referral visits are about 30%, all of them, more than 3 million were from 12-letter domains.


60% of visitors came from display ads. For last three months, the site has got 5,700,000 visits. All advertising traffic visits were the part of the simulation of the ad campaign. For 5,700,000 visits the site needs 2,850,000,000 display ad views with an average conversion of 0.2%. Average price for 1,000 ad view is $5. Such promotion could cost about $14,250,000 for three months. Hardly this site has paid so much.


97% of 5.7 million display ad visits were from PopAds.net, the owner of 12-letter domains. All PopAds.net outcoming traffic marked by analytical systems as “advertising” not “referral”.




Audience behavior


According to different analytical systems, the average visit duration is from 15 to 60 seconds. All major advertising systems are installed on the site. Ghostery detected 28. The every page has 4 ad units. But the log of advertising activity has shown dozens of ad views for every system during 5 minutes.


The site has the wrapper, that switches the ads systems during one visit every 5 seconds. It means, that for 60 seconds, each can watch up to 48 ad views with just 4 ad units on the page. The main ads source it Google’s DoubleClick, but it shows the ads thru partner systems. Wrapper permanently changes the DoubleClick’s partners during one session, so for every ad system, it will be new visit. There are no detectable stats anomalies of repeatable ad views But in fact, it will be the same brand, which forced to pay а few, or sometimes even dozens of times, for the same simulated visit.


Scoobywhoop.com was relaunched in September especially for the 12-letter domains ad fraud scheme, multiplied by the wrapper for ad systems. Since September 2016 using this scheme could be displayed up to 1,000,000,000 (one billion) ad views.




The beneficiary


Indian students Swapan Monga and Vakul Monga. Their low tech skills are enough to join the AdSense and install the wrapper code to the site and to buy artificial traffic.


The children are active participants in the market of digital simulation audience. They are resellers of various types of social media engagement. Swapan Monga on his FB page offers 1,000,000 youtube views per a day. Few thousand of 12-letter bots go to youtube right after Scooby Whoop.



Affected brands


The answer is simple, every brand that paid for advertising in the countries of Asia and Latin America, where was the main traffic. A more accurate answer can be given only by advertising systems, and first of all, DoubleClick.


Although there is another option, a third party data management platform. They also have primary data. But history does not yet know examples of such information disclosure. We didn’t see a call to action for digital ad systems to really act in the interests of advertisers.



P.S. According to TheDrum.com, in 2016 Google has detected and banned 1,700,000,000 ad views as fraudulent. Now you can imagine, how much is it.


Google took down 1.7bn ‘bad ads’ in 2016 but why has ad fraud become so hard to stop?