Over time we have seen a large variety of bad publishers applying to join ad networks – one of the most frequent tactics is to use a site template that looks functional and deep upon basic inspection, but is actually just a simple template. A year ago, there were several e-commerce sites like this, but the fraudsters probably realized that these are unlikely to make a lot of sense since ecommerce sites usually do not want advertising on them to distract from making purchases.

Thus a common type is the free games for download type of site. Here is an example of a recent site applying to an ad network.

http://www.gameairport.com/ – “free flash games”, click on one of the first games.

You will see a page with lots of empty spaces where ads are supposed to go, e.g. “300*250 Advertisement” and this will proceed further down as you are led around to lots of pages with more ad links on them. Others include:

http://www.debugscript.com

Games are not the only category for questionable sites. Travel works well too — like http://www.Siteaffiliation.com

Click down into a flight search and you’ll find a broken link. But the first two layers look like a real travel site. It’s unclear what each of these sites does or will do but there is a large number of them proliferating out there, and you are certainly seeing them get into some ad networks. If they are just SEO/arb plays that is one thing – but anyone accepting “template” sites like these into their ad network should be on the lookout to see if anything odd happens… and let us know.

games, templates, travel, websites Hide

GamingAhead.com showed up as one of the sites seemingly part of the Web Giant Media network mentioned previously by Yahoo!

In September 2009, two verified incidents were detected that involved this website. Many of the networks who have ad tags that are hosted on URLs that look like CDN links (content distribution network) have been informed, but some of these links still have live links that point to actual current advertising campaigns. One such example is below, rotating between several ads including a Nissan Ad, and several ads for Microsoft’s search engine, Bing, as of October 11th at 9pm Pacific time (click on the image to load the URL):

All of this was initiated by an AdJuggler ad serving call (we called AdJuggler and had them disable this advertiser, they wouldn’t divulge who/what company it was). It then called sites like xml.cdn-businessweek.com and celebgossipnet.com before it started loading up lots and lots of hidden iframes with adcalls like:

http://iskucoeksc.cdn.tinycdn.com/gamingahead_redux300.html

http://iskucoeksc.cdn.tinycdn.com/gamingahead_redux728.html

http://iskucoeksc.cdn.tinycdn.com/Gamingahead/cpx300.html

http://iskucoeksc.cdn.tinycdn.com/Gamingahead/cpx728.html

http://iskucoeksc.cdn.tinycdn.com/gamingahead_realmedia728.html

Here is a CSV file of the log of the several hundred ad calls — and some similar patterns to other previous attacks can be seen here. Many of the same large networks targeted in other frauds including some newer ones like Rocket Fuel.

One of the networks contacted did actually given out the payment information for the GamingAhead publisher, which was as follows, a mail-drop in Scottsdale, AZ with pay-to information for Publisher Direct Networks whose domain name is on the same server as GamingAhead.com:

Publisher Direct Networks

3370 N. Hayden Rd #123 PMB278

Scottsdale, AZ

Note the above payment information provided by one was confirmed by two other ad networks who were informed of this fraud and shut this publisher down.

Finding fraudulent publishers is difficult for networks and advertisers alike. GamingAhead.com seems like a legitimate publisher. While their traffic patterns on Quantcast were up and down, which usually means they were buying traffic and don’t have a lot of organic traffic, they were not completely with zero traffic (another bad sign). The site isn’t a cut-out template indicative of some other types of offshore fraud. The links between people working at Publisher Direct Networks / GamingAhead and the aforementioned sites/company Web Giant Media, including celebgossipnet.com are established in a variety of pieces of information available online:

http://www.gamingahead.com/news/126/

http://www.linkedin.com/profile?viewProfile=&key=22446345

http://www.classmates.com/directory/public/memberprofile/list.htm?regId=8702690189

The following references celebgossipnet.com and relates to the Vizi incident from before, and is from a person who appears to be a convicted felon in AZ with the same last name as the person above.

advertising, fraud Hide