Fraudulent traffic: adventures in ad farming

Where does MaxVisits traffic come from? The company’s site says it is delivered “by placing an iframe on domain names and websites in [its] network. The iframes are 250×250 up to full page.” In other words, it’s unlikely real users will actually see the ads Sovrn is charging advertisers for.

I have no way of telling which marketers’ ads were served to the MaxVisits traffic, but according to Sovrn’s dashboard, the advertisers that are “most aligned to my site and my reader audience” include Lexus, Comcast, Ford Motor Company, AT&T, Chase, Toyota, Zappos and other major brands.

From a publisher perspective, $30 in profit is minuscule. But a 30 percent profit is significant, nonetheless, especially considering I did very little work to generate it. Based on this model, it’s easy to see how sites spending thousands of dollars a month to acquire cheap traffic could have healthy businesses on their hands. Or how legitimate publishers could use it to augment and inflate their existing audiences.

The HypeHound site itself was straight-forward to produce. I bought a $10 domain and created a simple WordPress-powered site populated with around 30 pieces of content I “aggregated” and stole from elsewhere on the Web. This one features images by talented photographer Gavin Sanders, for example, which I took from his portfolio on photography site 500px.com in what I assume is a violation of its copyright policies.

From there, I applied to a range of ad network and exchange operators in an attempt to gain access to some advertisers, including Google, ValueClick, Technorati Media and Sovrn. I specifically targeted companies that did not require me to speak to a human to join their networks and, ideally, those that would pay out via PayPal.

Google rejected my application citing content-quality issues, as did ValueClick because my traffic volume was lacking. Technorati said my site was “not fit” for its network. Sovrn, however, accepted my application almost immediately. I’m not sure if the site was reviewed by a human or not, but within a matter of hours, ads from major brands including McDonalds, Zappos and TradeKing were appearing across my site.

Now that HypeHound was churning out ad impressions, I needed some traffic. I Googled “cheap traffic,” and the third organic listing was for MaxVisits, which sounded like it would do just the trick. I purchased 10,000 U.S. visitors for $11.98 using PayPal to see if the traffic would render ad impressions Sovrn would actually pay me for. It did.

MaxVisits is operated by a company called Raven Wise Media LLC and says it is based out of this UPS Store in Syracuse, N.Y. According to LinkedIn, Raven Wise Media was founded by Keith Baldwin, who also founded a company called Elite Website Traffic.

By this point, I had established it’s easy to serve ads to traffic purchased for $0.0012 a visit, but I still wanted to prove that doing so can be profitable. I emailed MaxVisits and asked how many visitors it could deliver for $100. It said it could guarantee 65,000 visits that would register in Google Analytics, but in reality, it would deliver a lot a more. “GA poorly tracks redirected/frame traffic,” someone on the company’s support team told me.

That sounded reasonable, so I purchased the traffic and drove it all to this article I cobbled together about “cool creative bookmark designs.” The article page featured a total of five IAB ad units and automatically refreshed every 20 seconds.

In 10  days, MaxVisits drove 44,000 visits to my site and generated around 52,000 pageviews, according to Google Analytics. More importantly, I sold a total of 600,000 impressions through Sovrn, which generated $130 in ad revenue and represented $30 profit on my original $100 outlay.

When I made Sovrn aware of the fact I’d been feeding its network low-quality, potentially fraudulent traffic, the company was unable to identify which site was mine. That speaks to the complexity of the problem and how difficult it actually is to pinpoint and filter iframe and bot traffic, despite what some vendors might claim.

All of the ads I sold were facilitated by Sovrn’s network, but it’s also worth noting other ad tech middlemen probably played a part. As soon as I dropped Svorn’s ad tags on HypeHound.com pages, I noticed trackers from other exchanges and DSPs popping up, including Rubicon Project, AppNexus, TradeDesk, Criteo, AdRoll, BlueKai, Burst Media and others.

Walter Knapp, Sovrn Holdings CEO , said the news of my site was “alarming,” and that the company is making immediate modifications to its self-serve signup system as a result. He also expressed disappointment in the third-party verification vendors the company partners with that promise to filter low-quality traffic.

“Our system was designed for very long-tail publishers, and clearly this is a loophole that we did not anticipate someone exploiting,” he said.

Knapp added this traffic issue is one that plagues the entire industry, however.

“I’m committed to driving out suspicious and fraudulent traffic in all its forms across our network. As co-chair of the Traffic of Good Intent Solutions group at the IAB, it’s exactly this sort of malicious behavior that we are trying to solve. Clearly, we and the ecosystem at large still have work to do here,” he said.

But despite efforts from the IAB, the industry has a long way to go before it’s even close to stamping out the type of suspicious traffic that I so easily purchased. According to some, it’s the responsibility of the exchanges themselves to better police their networks.

“The exchange is the front door,” concluded Andrew Casale, vp of strategy at Casale Media. “Until all of us are locked up tight, the money continues to be too easy to grab. And that depletes budgets that ought to be going to real publishers.”

Digiday asked Sovrn to donate all ad revenue generated from HypeHound.com to the Tom Deierlein Foundation.