Integral Ad Science
  • Solutions
    BY PRODUCT TYPE
    Ad Fraud
    Brand Safety & Suitability
    Contextual Targeting
    Viewability
    Efficiency & Optimization
    BY CHANNEL
    CTV & Video
    Programmatic
    Proprietary Platforms
    Mobile & In-App
    Audio
    BY CUSTOMER TYPE
    Brands & Agencies
    Publishers
    Platforms & Partners
  • Insights
    IAS Insider
    Media Quality Report
    Research
  • Innovation
  • About
    Quality Impressions™
    Newsroom
    Leadership & Awards
    Careers
  • Careers
Log in
Investor Relations
Contact
US US
UK UK DE DE ES ES FR FR IT IT JP JP BR BR LATAM LATAM APAC APAC Korean Korean
Integral Ad Science
  • Solutions
    BY PRODUCT TYPE
    Ad Fraud
    Brand Safety & Suitability
    Contextual Targeting
    Viewability
    Efficiency & Optimization
    BY CHANNEL
    CTV & Video
    Programmatic
    Proprietary Platforms
    Mobile & In-App
    Audio
    BY CUSTOMER TYPE
    Brands & Agencies
    Publishers
    Platforms & Partners
  • Insights
    IAS Insider
    Media Quality Report
    Research
  • Innovation
  • About
    Quality Impressions™
    Newsroom
    Leadership & Awards
    Careers
  • Careers
Log in
Contact Us
US US
UK UK DE DE ES ES FR FR IT IT JP JP BR BR LATAM LATAM APAC APAC Korean Korean
  1. Home
  2. | Topics
  3. | Ad Fraud
  4. | Methbot? More Like Mehbot.
January 7, 2017 by IAS Team

Methbot? More Like Mehbot.

Ad Fraud
Resources
Topics
Share:
Methbot? More Like Mehbot.

Jason Shaw, Director of Data Science, Head of the IAS FraudLab

Earlier this week, news broke of “Methbot,” a supposed new large-scale online advertising fraud operation. According to the announcement, Methbot generates non-human traffic primarily affecting video advertising, and snatches advertisers’ budgets away.

After careful examination of our system by the IAS FraudLab, in accordance to the list of compromised IPs released, we confirmed that our models detected and prevented this fraudulent traffic. What’s more interesting, and consistent with many other platforms’ findings (see here, here, and here), is that traffic coming from these IPs was very low in volume – less than 0.03% of the billions of impressions we see a day.

So as head of our FraudLab, I’m intrigued by all the excitement surrounding Methbot – when something old becomes new. And something small becomes big.

Is Methbot a whole new type of ad fraud?
While the most interesting feature of Methbot is the use of falsified IP address registrations, this is not a new type of ad fraud.

In the past years we have uncovered datacenter-based operations using proxy servers to obscure their origin. In those instances, they have opted to use malware-infected PCs to supply the proxy servers, guaranteeing residential IP addresses.

The choice of Methbot to acquire data center IP blocks and falsify registration details is remarkable, not because the operation of the bot but the upfront investment it required – estimated at $4 million in the original report.

Is Methbot the most sophisticated bot out there, evading detection from players like IAS?
Simply put, no. Methbot is a low tech implementation using a new strategy. The bot’s use of Node.js shows a relative lack of sophistication. And our own intelligence on the originators of Methbot has shown that this was their first try at putting together a botnet like this.

In addition, the report asserts that Methbot could evade fraud detection and fool viewability measurement. They did attempt to cover their tracks through spoofing the user agent and mimicking different environments. But any comprehensive fraud detection technology should already be looking for these signals. The bots within the Methbot operation behave like most standard bots out there.

Furthermore, the DIY setup and interference with third-party JavaScript libraries backfired: IAS measured no impressions as in view from Methbot identified sources. While Methbot was clicking, mousing over, and interacting with the video in an elaborate attempt to mimic human behavior, the bots had already outed themselves.

Do we have a billion dollar problem?
Estimating the cost of anything in advertising is notoriously difficult, with very few firms well-positioned to assess the full lifecycle of an ad impression across supply channels, verticals, geographies, and audiences. Particularly problematic is the translation of bid requests into served impressions.

The majority of impressions offered for sale programmatically go unsold, and this is especially true in low-quality inventory often trafficked by bots. This was certainly true in the case of Methbot.

While the botnet spoofed URLs, sometimes targeting premium publishers, it was not generally successful in getting its impressions to monetization. In our own system, we observed a significant imbalance between what was offered for sale and what was actually purchased.

Have the fraudsters behind Methbot recouped their investment in IP address allocation? Probably. Have they extracted over a billion dollars? Doubtful.

Final thoughts
IAS measures billions impressions a day and we see the impact of known and unknown bots on our industry. While Methbot has certainly reached celebrity status, in the grand scheme of things, this is one of the countless bots and permutations of bots that impact brands and publishers on a day-to-day basis.

That’s why IAS invests heavily in data science, behavioral and network analysis, browser and device analysis, and targeted reconnaissance including deconstruction of malware. Ad fraud is an always evolving arms race, and my team of information security professionals and resident hackers remains committed to eradicating it from our ecosystem.


If you would like to learn more about ad fraud, the available botnets, and malware in the market, feel free to download our research.

Ad fraud: the essentials guide
The bot papers: Avireen
The bot papers: Poweliks

Access the content now.
Download
Access the case study now.
Download
Access the guide now.
Download
Access the research now.
Download
Sign up for insights right to your inbox.
Subscribe now ›

Related Posts

Health & beauty retailer exceeds benchmarks with IAS
Health & beauty retailer exceeds benchmarks…
Learn more ›

December 21, 2022 by IAS Teams

The 2023 Industry Pulse
The 2023 Industry Pulse
Learn more ›

December 16, 2022 by IAS Teams

IAS brings media quality to Netflix
IAS brings media quality to Netflix
Learn more ›

October 14, 2022 by IAS Teams

IAS white red logo
Sign up for fresh insights

Solutions

By Product Type

Ad Fraud

Brand Safety & Suitability

Contextual Targeting

Viewability

Efficiency & Optimization

By Channel

CTV & Video

Programmatic

Proprietary Platforms

Mobile & In-App

Audio

By Customer Type

Brands & Agencies

Publishers

Platforms & Partners

Insights

IAS Insider

Research

Media Quality Reports

About IAS

Quality Impressions™

Newsroom

Leadership & Awards

Careers

Helpful Links

Contact

Log in

© 2023 Integral Ad Science, Inc.

Accessibility_Icon Accessibility statement

Site indexing policy

Privacy policy

Subscription management

Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media

Site indexing policy

Privacy policy

Subscription management

Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media

© 2021 Integral Ad Science, Inc.

Search

Hit enter to search or ESC to close

Download Content

Fill out the form to have this content delivered directly to your email inbox.

Subscribe now

Fill out the form to sign up for the latest and greatest IAS updates— delivered right to your inbox.

Thank you for signing up for the IAS Newsletter.