Ad Fraud's Greatest Hits: From Methbot to BADBOX 2.0

Zhukov's operation ran under the name Media Methane, presented as an ordinary ad network. It rented more than 2,000 servers in data centres in Dallas and Amsterdam, and programmed them to simulate people watching video ads: fake mouse movements, fake scrolling, fake social-network logins to look signed-in and therefore human.

The inventory was fabricated. More than 6,000 domains were spoofed, including The New York Times and the New York Post. Advertisers believed they were buying premium video placements on established publications. The actual page was blank — a shell that loaded a real ad and reported a real impression to a real exchange.

The choice to spoof premium domains rather than invent unknown ones was deliberate and is worth dwelling on. Buyers apply less scrutiny to inventory that carries a trusted name, and pay considerably more for it. Methbot's core insight was that the reputation attached to a domain is a transferable asset if you can convincingly claim to be selling it — and in 2016, before ads.txt existed, claiming it was close to free.

The 3ve operation that grew out of and alongside it was larger still: at peak, more than 3 billion fraudulent bid requests a day, over 60,000 accounts, more than 10,000 spoofed sites, and upward of a million IP addresses. Zhukov personally took around $4.8 million. The takedown was a coordinated effort between Google, White Ops (now HUMAN) and federal law enforcement, and produced one of the very few criminal convictions in this field.

ICEBUCKET was, at disclosure, the largest server-side ad insertion fraud operation recorded. It impersonated more than two million people across over thirty countries, fabricating an audience out of nothing.

The mechanism exploited exactly the gap described in our piece on how ad fraud works: in SSAI, the ad request comes from a server rather than from a device, and the buyer has to take the seller's description of the device on faith. ICEBUCKET simply described devices that did not exist.

The detail that ought to have ended the industry's complacency: roughly 46% of the fake traffic claimed to be Roku devices, and Roku confirmed no such activity had occurred on its platform. Two parties looking at the same "impressions" — one seeing billions, the other seeing nothing.

404bot deserves its place here for what it did not use: bots. There was no device farm and no malware. The operation submitted falsified bid requests carrying URLs that returned 404 — pages that did not exist — paired with legitimate seller IDs lifted from real ads.txt files.

It was a numbers game played directly against filtering logic. Enough requests, enough plausible-looking seller relationships, and a meaningful share cleared. The estimated losses ran into the tens of millions of dollars over its life, from an operation whose entire technical apparatus was a script that generated request payloads.

The uncomfortable implication was that the industry had adopted a supply-chain standard and then largely trusted it as a declaration rather than verifying it as a claim.

It is a useful corrective to how ads.txt is often described. The file establishes that a seller is authorised by a domain. It does not establish that a bid request genuinely originated from that domain, that the page exists, or that anybody was on it. Those are separate questions, and 404bot got paid by never letting anyone ask the second one.

Tekya was malware hidden inside 24 children's games and 32 utility apps on the Google Play Store. Once installed, it imitated user actions using Android's MotionEvent mechanism — generating taps and clicks on ads at the operating-system level, so the fraudulent interaction looked, to everything downstream, like a finger on a screen.

The apps passed store review and accumulated over a million downloads before removal. For anyone whose mental model of app-store distribution is "reviewed, therefore safe", Tekya is the correction. Review catches what it is looking for, and a game that behaves itself during review is a game that behaves itself during review.

PARETO ran on more than a million compromised Android phones, and its trick was impersonation: the infected devices masqueraded as connected TV devices, because CTV commands substantially higher CPMs than mobile display.

The apps involved never displayed an ad to anyone. They called the relevant APIs and reported that a video ad had been shown — a claim about an event, with no event behind it. At peak the botnet generated around 650 million bid requests a day.

PARETO is the clearest illustration of why fraud follows CPM. The same compromised device is worth several times more pretending to be a television than being honest about being a phone, and the fraudster's entire job is finding and exploiting that spread.

VASTFLUX is the one that should make anyone in this industry uneasy, because it was not merely large — it was knowledgeable.

The operation injected malicious JavaScript into ad slots, then stacked as many as 25 invisible video players inside a single slot. Each player requested and reported its own ad. The user saw one ad, or none. Twenty-five were billed.

It spoofed more than 1,700 applications and 120 publishers, ran across roughly 11 million devices, and reached a peak of around 12 billion bid requests per day — the highest recorded for a single scheme. Critically, it was engineered specifically to evade verification tags: the fraudulent players were constructed so that the ad-verification code which should have detected the stacking could not run.

The economics of player-stacking are worth stating plainly, because they explain why this design keeps reappearing in variations. Every additional hidden player is nearly free — the traffic, the device and the slot are already paid for — while each one adds a full billable impression. Stacking turns a linear fraud into a multiplier, and a multiplier applied to eleven million devices is how you arrive at twelve billion daily requests without needing twelve billion devices.

HUMAN Security led the disclosure and takedown. But the design lesson stands independently of the outcome: this was an operation built by people who had studied the detection layer closely enough to construct an environment where it was blind.

BADBOX moved the attack upstream, past every defence that assumes a clean device. The malware was pre-loaded during manufacturing onto unbranded, low-cost Android phones and TV boxes sold through mainstream online retailers. Powering the device on for the first time was sufficient to compromise it.

PEACHPIT was the ad-fraud module running on that installed base — a network of apps generating hidden ad requests from devices sitting in living rooms, on real residential connections, indistinguishable at the network layer from a household watching television.

There is no consumer remedy here worth the name. A device that arrives compromised cannot be secured by careful behaviour, and the buyer has no visibility into what shipped inside the firmware they paid for.

Konfety paired every operation with two apps. One was a legitimate, functional app, published on the store and behaving exactly as advertised — the decoy. The other was an "evil twin", side-loaded rather than distributed through the store, carrying the same package name.

The twin generated the hidden ad requests. Because it shared the decoy's identity, the traffic appeared to originate from an app that anyone checking could inspect, install and verify as real. The thing being audited and the thing generating the fraud were different programs wearing one identity.

This is impersonation at the level of a specific identifier rather than a general category — a meaningful escalation from spoofing a domain, and considerably harder to spot from the buy side.

BADBOX returned an order of magnitude larger. Where the original was measured at roughly 74,000 devices, BADBOX 2.0 exceeded a million, spread across 222 countries — the largest connected-TV botnet documented to date.

The affected hardware was off-brand AOSP-based equipment: tablets, streaming boxes, digital projectors, and — a detail that reads as science fiction until it does not — car infotainment systems. The compromised devices did three jobs simultaneously: ad fraud, click fraud, and residential proxyjacking, in which the device's home internet connection is rented out to route somebody else's traffic.

That third function is the one to watch, because it is what feeds the residential-proxy problem that has broken IP-based detection industry-wide. The response was unusually multilateral: the German federal government disrupted parts of the infrastructure, the FBI issued a public advisory, and Google filed suit in July 2025.

It is worth connecting that proxyjacking function to the detection problem directly. When a compromised living-room device rents out its home connection, any traffic routed through it inherits a genuine residential IP address with a clean history and a real geographic location. This is the supply side of the residential-proxy market — the thing that has made IP reputation close to useless as a standalone signal across the entire industry. BADBOX is not only an ad-fraud botnet; it is infrastructure that makes other people's fraud harder to catch.

The structural read is that specialisation has arrived. One group compromises hardware. Another operates the botnet. A third monetises the ad fraud. A fourth rents out the proxy capacity. Each can be disrupted without ending the others.

The largest ad-fraud laundering marketplace documented so far operated across more than 3,000 domains and 63 Android applications, generating in the region of two billion bid requests a day, with device estimates running as high as 40 million.

The model is worth understanding precisely because it is where the industry is now. HTML5 "cashout" sites — ghost properties that exist only to hold ad slots — absorb traffic from the app network and convert it into billable impressions. The sites are cheap to produce in volume, which is what generative tooling changed.

What makes this model durable is that it separates the traffic problem from the inventory problem and solves each cheaply. Traffic comes from the app network — real devices, real connections, hard to fault at the network layer. Inventory comes from the generated sites — infinite, disposable, and replaceable within hours of any one domain being blocked. Neither half is expensive, and losing either half costs almost nothing.

The most quoted tell from the research is also the most instructive: Play Store apps in the network showed download counts between 1,000 and a million, and zero reviews. Not few. Zero. A million people had supposedly installed software and not one had a word to say about it, because not one of them existed.