Verified bot laundering. Ad bistro "Matador"

In this investigation about traffic from 12-letter domains, we will expose the most complex and most profitable scheme from all those already described. In fact, it is a multilevel system, which involves all stages of the supply chain of digital advertising and traffic verification. In this example, you can create a clear understanding of how digital advertising industry really works.


During our research, we found another 3 traffic receivers with 12 letter domains: Fashionizers.com, Sportsreporttoday.com, Thedeadbolt.com.


In December 2016, these sites had only 5 thousand, 50 thousand and 210 thousand monthly visits respectively. In January 2017, these sites greatly increased in traffic, growth the audience to millions of users: 2.85M, 2.8M, and 6.3M. The secret of the success of these sites was the purchase of traffic from 12-letter domains.





What are these sites?


“Fashionizers” is a rarely updated set of short non-original fashion articles. There are so few of them that on the main page there can be up to 4 previews of the same article.


“Sports Report Today” is a sports news site that has not been updated since January 13, 2017. Despite the fact that the latest reports were about the start of the NFL playoff, the site has since been visited by more than 15 million users in 2017.


“The Deadbolt” is the most common music and movie news site. It had 21 million visits from January to April 2017.


At first glance, they don’t look like an ad fraud sites. They have an outdated design and don’t make an impression of popular media. You either will not see advertising at all, or you will be shown ads of online games in the style of the 90's.


But there are very much of programmatic ads, and it is very expensive. A feature of these sites is that the ads are well hidden from human eyes. In order to see it, you need to visit a certain page, at the right time and by the right link. For some reason, the owner doesn’t want the real people to see the ad there.


If you managed to comply with all the conditions, then you will open the shadow side of these sites. You will see video ads of the best brands in a huge amount. Let me remind you that sites have non-original content, and one of them has not been updated for more than 5 months. Here, for example, Procter and Gamble video ad on The Dead Bolt.







It wasn’t difficult to find the owner of these sites. The Deadbolt is owned by Victor Ahumada, Matador Web Group. Sportsreporttoday.com and Fashionizers.com also were owned by Matador Web Group, but December 2016 Victor Ahumada hide it behind the nominal owner Domains By Proxy, LLC.


Victor is the founder and CEO of Matador since 2006. Website matadorwebgroup.com does not look client oriented, there is nothing except the logo on the main page, no contacts or any helpful information.




The suspicious web company, bot traffic, and video advertising, it's all like one of the many examples that we described earlier. But this case is completely unusual.


After viewing ads on one of these sites, a third of users move on to the next 3 sites, arranged in a similar way: Totalnewstoday.com, Tech-camp.net, and Wannasport.com.


They differ only in size, instead of 5-6 million visits of sites of the first level, they have about 2 million. There is also a lot of video advertising, and you can see it only under certain conditions. Total News Today previously was owned by the Matador Web Group up to December 2016. Now all three sites are owned by Domains by Proxy, LLC.


This is not the end. 70% of the traffic from these sites goes further, to three similar sites: Tuvez.com, Allbreakingnews.com, Gadgetcrunch.net.


The short review of other 6 sites, owned or affiliated with by Matador Web Group.


Totalnewstoday.com The previews of copies of not important world news with a delay of up to a week.


Tech-camp.net Automatic posting of tech news fully copied from major media.


Wannasport.com The sports news site, which is not updated since March 21.


Tuvez.com The entertainment magazine, just one new post a day. In contrast to other sites, he has even two reporter with names (not just “posted by admin”) and social accounts.


Allbreakingnews.com Automatic posting of fresh news fully copied from major media, up to dozen an hour.


Gadgetcrunch.net Just 48 non-original short tech news articles and 4,4 million visits for the first 4 months of 2017.


All sites have special pages with native video content, which also shows video ads:

  • 5 sites have the special page videos, for example, Fashionizers.com/videos
  • 3 sites have the special page ‘featured’, like Wannasport.com/featured
  • Sportsreporttoday.com used for video ads both ‘featured’ and ‘videos’ pages
  • 3 sites show video ads on some article pages.

The most interesting are that on 4 of sites there are no links to these pages. That is, a visitor can get there only by a direct link, you can not get there from the main page or any other page.


We continue to see the advertising of big brands. For example, at Total News today we caught Honda, Sonic, Amtrak and Chase.








Among the many affected brands stand out two insurance companies, Geico and State Farm. According to our observations, in May they accounted for more than half of all video ads on the sites of Matador Web Group.







But the traffic path from 12 letter domains doesn’t finish its marathon here. Three traffic routes merge into one stream. On average, 80% of visitors from third-level sites go to a domain Go.Bistroapi.com. This is a technical domain that accumulates traffic and redistributes it between further recipients.





Traffic Laundering Scheme 1.0 (until April 2017)

Three bot traffic through three sites of Matador Web Group (3x3)


12-letter domains → Fashionizers.com → Tech-camp.net → →Gadgetcrunch.net

12-letter domains → Sportsreporttoday.com → Wannasport.com → →Allbreakingnews.com

12-letter domains → Thedeadbolt.com → Totalnewstoday.com → →Tuvez.com


LEVEL 1

From 12 letter domains (80%) + Pop Ads traffic (18%) → to three 5-6 millions visits sites:

Thedeadbolt.com, Sportsreporttoday.com, Fashionizers.com


LEVEL 2

From level 1 sites → (31% of all visitors) → to three 2 millionth sites:

Tech-camp.net, Wannasport.com, Totalnewstoday.com


LEVEL 3

From level 2 sites→ (70% of all visitors) → to three 1.5 million sites:

Gadgetcrunch.net, Allbreakingnews.com, Tuvez.com


LEVEL 4

1.5 million visits → (78% of all visitors) → go.bistroapi.com



In April 2017 Victor Ahumada improved the scheme and released the second version of it.


Now all the traffic goes strictly within one of five topics: Fashion, Sport, Breaking News, Tech News, and Entertainment. Three levels of traffic laundering transformed into a two-tier system. For completeness of the new scheme, one fashionable site was missing.


This place was taken by the site Operandimoda.com, owned by Armine Karapetyan. According to her Linkedin, she is co-founder Fashionisers.com (do not confuse with the previously mentioned FashioniZers.com). But a couple of years ago, Operandi Moda looked just like FashioniZers looked now.





Traffic Laundering Scheme 2.0 (April 2017)

Three bot traffic paths through two sites (5x2)


Fashion:

12-letter → Fashionizers.com (2.4M) → Operandimoda.com (0.5M)

Sport:

12-letter → Sportsreporttoday.com (3.2M) → Wannasport.com (1.2M)

News:

12-letter → Totalnewstoday.com (2.2M) → Allbreakingnews.com (1.5M)

Tech News:

12-letter → Tech-camp.net (2.5M) → Gadgetcrunch.net (0.6M)

Entertainment:

12-letter → Thedeadbolt.com (3M) → Tuvez.com (0.8M)


Level 1 sites have 13.5M total visits in April, level 2 sites 4.5 M visits. The average conversion rate is near to 34%. But 100% of traffic from second level sites goes to go.bistroapi.com.




What is Bistroapi.com and who owned it?


It was created on June 02, 2016. Since February 16, 2017, the domain is owned by the company Contact Privacy Inc., Customer 0143157348. This is the nominal holder of the domain, that hides the real beneficiary.


Until November 15, 2016 the site owned by Andrea Yiordamli, Polarity Technologies LTD, e-mail: domains@adbistro.com. But originally the domain was registered by Glenn Robuck, Senior Director Technical Infrastructure at Adknowledge.



What is Adknowledge?


Adknowledge is a digital advertising technology company founded in 1999.


From its site we can learn, that “Adknowledge’s products connect advertisers with their target audiences, on the right device, and at the right time. With more than a decade of experience in the digital advertising industry, our products deliver results through various channels: video, app and game installs, display, email, native video, and content recommendation”.


According to Bloomberg, “the company uses diverse sources of data to place ads via digital video, social media, apps and mobile, content recommendation, and email. It offers AdParlor, a social and video advertising platform that integrates into the Facebook, Twitter, Instagram, and YouTube ads API platforms; Adknowledge, a pay-per-click platform; AdBistro, a platform that allows customized ad placements and competitive payouts; Giant Media, a native video platform”, and other services.


According to Crunchbase, total funding of Adknowledge is $262,000,000. The last funding round was in January 2011. Adknowledge raised $200 million (valuation $900,000,000) from JMI Equity (Lead), Bank of America, and Nokia Growth Partners.


AdBistro is Adknowledge's content recommendation and visual advertising product. What do they offer for their clients? According to its site, Abistro works with publishers and advertisers, and it has special offers for both of them.


Offer for Publishers. “AdBistro helps you to monetize your traffic by connecting your users with hundreds of campaigns across various verticals. Since every publisher is different, the AdBistro platform allows for fully customized ad placements and competitive payouts. Our advertisers are looking for unique users to engage with their content (videos, articles) through implementations including value exchange models, mobile, in-game, search, in-text, domain, etc…”


Offer for Advertisers. “AdBistro drives users to your desired landing pages for full page ad monetization. Our direct publishers are certified by third party security companies, including Integral Ad Science and comScore. [...]”


The technical redirecting domain, owned by the largest digital advertising company receives traffic from the 12-letter domains, laundered through the group of ad fraud sites. How is this possible? Why the agency and verification companies does not see, from what sources it come?


According to its site, Adbistro cares about the quality of its services.


“AdBistro strives to provide high quality traffic. Our proprietary AdVerify system uses more than 60 filters as well as third party verification companies [Integral Ad Science and ComScore] to ensure the authenticity of the users. We understand quality also means that we are meeting our advertisers’ specific KPIs.


AdBistro prides itself on delivering quality, performance-based products and services to some of the biggest names in the industry and we are dedicated to continuing to help make your business successful


Our comprehensive suite of traffic quality tools include: … Source Level Targeting, Realtime Fraud Detection Engine, User Frequency Capping, Brand Safe....”


In our study, it was found 10 obvious signs of artificial traffic on the main sources of Bistroapi.com.







10 reasons why these Matador’s websites have no real audience


1. The starting point for most of the audience is direct visit to 12 letter domain, registered a few hours/days before it.


2. Sharp take-off (50-500 times) of the audience on a group of related sites right from the beginning of the new year. And there were no changes on these sites at that time.


3. Before the rapid increase in traffic half of the sites already hidden its owner behind the anonymous nominal holder.


4. Content is small, it is rarely updated (except for one, which is automatically updated with stolen breaking news), articles are verbatim copies from other media.


5. Two sites are abandoned and are not updated for a long time. But these sports news, the last time updated in January and March, however, still attracts millions of visitors.


6. All these sites have an abnormally high traffic conversion rate (from 30% to 100%) and send traffic to the next similar site.


7. Even more suspicious at this level of conversion rate is the change in traffic destination. Right from the 1st day of the month, the site can begin to send up to 100% of the visitors to a different site than the previous month.


8. None of these sites have links to the site where the traffic goes further. Real people can’t simply go to the next site.


9. All sites have very short visits, sufficient only to download and display the first seconds of advertising.


10. Among the most visited pages, video ads prevail. That is, a million audience goes to sites mainly to watch the non-original video from content delivery network.






What is not taken into account when checking sites by any verification system


1. Where from user came. Which site was the first in the session.


2. The total absence of backlinks on the group of sites, which has a lot of traffic exchange.


3. Audience behavior. An abnormally sharp rise of traffic, short visits and incredibly high conversion rate.


4. Only most visited pages on the site have the ads, and it isn't easy to find this pages.


5. Primitive stolen content, that attracts a multi-million audience.


6. Significant advertising payments for sites without any updates for a long time.



All these anomalies verification companies did not find even a little suspicious. We would like to draw your attention to the fact, that their main task does not just verify the traffic, but to approve the payments for ad views. This is not about abstract users, but about real money.


The main partner of Adbistro in ad fraud detection is Integral Ad Science (IAS). It is a global technology and data company that builds verification, optimization, and analytics solutions to empower the advertising industry to effectively influence consumers everywhere.


According to Crunchbase.com, it raised $76.75M in 5 rounds, according to Zoominfo.com, its revenue was $93,200,000 in 2016. That's what is on the site Integralads.com about its services.


Viewability. For digital ads to make an impact on consumers, they have to be seen. We help you reach consumers by making sure all ads have the opportunity to be viewed. By real people.


Ad fraud. Ad fraud is defined as any deliberate activity that prevents ads from being served to human users. No matter the cause — illegal bot activity, historically fraudulent URLs, or specific page-level fraud — we’re here to protect you.”


How did it happen that Adbistro began to cooperate with such a partner as Matador Web Group and Integral Ad Science have verified its traffic?


To understand this, we need to know what Victor was doing earlier and what connections he managed to acquire. A lot of information can be given from his Linkedin profile. Victor has only one recommendation, but from the top client, Romain Vetter (Lufthansa), 2013.


"Victor is a top web designer with a full SEO view and a clear understanding of the importance of a clean web design. I would recommend him to anyone looking to build a new website, put in place a clear SEO strategy and even consult with him about PPC business. I had the great pleasure of working with him and will probably do it again in the future."


What happened if the digital specialist worked in 2013 with top clients, retrained in ad fraudster? What was an outcome of the work of previous campaigns, the real future customers or just stats which meet the KPI?


Every professional knows how to imitate a digital audience for his client, no successful SEO (as well as SMM, or another digital marketer) can survive in the current digital ecosystem without knowing the technologies how to simulate the audience. Even for those who attract real people, still heavily overstate the stats, adjusting it to the customer's parameters.


What prevents Victor Ahumada from using these skills for ad fraud? As you can see, nothing. The group of 9 sites got 87 million visits and near 140 million page views during 4 months of 2017. If its price was just $7 for 1000 video ad view (it could be much more) than Victor Ahumada has already become a millionaire this year. At it is far not all its digital assets.


But even more interesting is that another 2 million received all the other participants in the ad supply chain, selling advertisers this stats of forged impressions. It includes the main agency, the digital buyer, and the numerous elements of programmatic.


The question arises, how did it happen that the artificial traffic was verified by trusted digital companies? The answer to this question can be found in Victor Ahumada Linkedin profile again. Here is the recommendation from Victor to Isaac Hattem, Business Development Manager at Integral Ad Science, July 15, 2015. Victor was a client of Isaac’s.


"I’ve had the pleasure of working with Isaac for two years, during which he facilitated Matador Web Group’s transition into the ad safety space. I was impressed with Isaac’s ability to get things done and make me feel unique in a sea of clients. And, of course, his easy-going personality made him very accessible. Isaac is a true asset to Integral Ad Science."



Seven months later Isaac Hattem also received a recommendation from ...Celine Hassan, General Manager at AdBistro, February 18, 2016. Celine was a client of Isaac’s.


“I had the pleasure of working with Isaac for the last couple years. He’s tremendously helpful, understanding, respectful, responsive and overall just a great guy to work with.”


It has recommendations from only 4 clients, two of them you see above.

So you can understand what is common between the owner of Matador Web Group, and the and General Manager of AdBistro. Both of them were clients of Integral Ad Science.


Now we have only one unlighted question, to which publishers AdBistro delivers its traffic.


Read about it in the next part of investigation “Not funny. Just die".





Update. As you can see, as long as we did this investigation, the situation changed many times. The last change occurred on 19 May. Both sports sites Matador Web Group suddenly began to be updated after 5 and 2-month break. It's just an automatic repost with popular sports outlets. On the behavior of the audience and traffic, this did not affect. However, as in our investigation.








The appendix. Video links



Level 1. Sites with 5-6 millions visits


Thedeadbolt.com

1 video on each article, special pages not found


Sportsreporttoday.com

www.sportsreporttoday.com/videos

www.sportsreporttoday.com/featured


Fashionizers.com

www.fashionizers.com/videos





Level 2. Sites with 2 millions visits


Tech-camp.net

www.tech-camp.net/videos


Wannasport.com

www.wannasport.com/featured


Totalnewstoday.com

www.totalnewstoday.com/videos


Video ads are on pages with tag ‘video’

www.totalnewstoday.com/category/videos





Level 3. Sites with 1.5 millions visits


Gadgetcrunch.net

www.gadgetcrunch.net/videos


Allbreakingnews.com

www.allbreakingnews.com/videos


Tuvez.com

1 video on each article and special page and

www.tuvez.com/featured