AI Slop Sites & the New Fraud That Looks Better Than Real Traffic

Every fraud scheme in this Journal so far has been trying to hide. Blank pages dressed as newspapers, bots dressed as people, hidden video players stacked behind a visible one — the whole craft was making fake activity resemble real activity closely enough to survive a check.

The 2025–26 generation stopped hiding. It started competing.

The most interesting fraud operating right now does not merely pass verification. It outperforms legitimate inventory on the exact metrics buyers use to identify quality — higher click rates, higher eCPMs, better attention scores. A buyer optimising toward the best numbers on the dashboard is not accidentally funding it. They are being steered into it by the measurement layer itself.

That inversion is the through-line of this article, and it has a consequence worth stating before the case studies: the better your optimisation, the more efficiently it finds this fraud. A buyer with sloppy targeting and no quality signals is, for once, less exposed than one running a tightly-tuned programmatic operation — because the tight operation is the one following the numbers, and the numbers have been arranged for it.

Synthetic Echo: authorisation at scale

In January 2025, researchers documented a network of more than 200 mostly AI-generated content sites monetising across multiple exchanges with minimal human oversight.

Two properties made it a step change rather than a large version of something familiar.

The domains were built to be mistaken for news organisations — constructions in the shape of a recognised outlet with a suffix, a number, or a plausible misspelling. Not convincing under inspection; entirely convincing as a line in a delivery report that nobody reads closely.

And the sites cloned near-identical ads.txt files, replicating legitimate seller lists so the whole network appeared correctly authorised at once. Verification that consists of checking a file was satisfied by files produced specifically to satisfy it.

The underlying shift is worth naming plainly: generative tooling did not invent a new attack here. It removed the cost of the old one. Producing a convincing fake publication used to take a content team; producing two hundred of them used to be unthinkable. Both are now a weekend.

What "minimal human oversight" actually means

The phrase does a lot of work in the original research and deserves unpacking, because it describes the economics rather than the technology.

A traditional content farm needed writers, however badly paid, and an editor, however nominal. Those costs set a floor on how small a viable fake publication could be, and that floor is what limited the number of them. Remove it and the constraint moves from production capacity to domain registration, which costs a few dollars and takes a minute.

The practical consequence for anyone screening supply is that site count stopped being evidence of anything. A network of 200 properties used to imply a real business behind it, because building 200 sites was expensive. It no longer implies anything at all, and screening heuristics that carry that assumption are now backwards.

Pink slime: the same machinery, pointed at politics

The advertising version of this has a civic twin that is worth knowing about, because the infrastructure is identical and the two categories increasingly overlap.

"Pink slime" sites are pseudo-local news operations — names like a county gazette, layouts that resemble a small-town paper, bulk-generated articles, and no journalists. Researchers tracking them have found networks numbering in the hundreds to low thousands of domains, in some counts outnumbering genuine local newspapers in the United States.

They exist for political influence rather than for ad arbitrage, but they monetise the same way, sit in the same long-tail inventory, and pass the same automated checks. For a buyer or a network the practical consequence is that "does this look like a local newspaper" has stopped being a useful screening question. Looking like a local newspaper is the product.

DreamScheme: fraud with a customer acquisition funnel

Documented in 2026, DreamScheme used AI-generated advertising creative — including women in provocative poses, some depicting familiar copyrighted animated characters in suggestive AI-generated form — to lure users into networks of made-for-arbitrage sites.

What makes it structurally interesting is that it defrauds two parties in one motion. The consumer is deceived by the creative into clicking something that is not what it appeared to be. The advertiser is defrauded by having their budget spent on the arbitrage inventory the consumer lands on.

It is also, uncomfortably, a well-run growth operation. Generated creative can be produced in volume, tested cheaply, and iterated toward whatever converts — the same loop a legitimate performance marketer runs, pointed at a destination that exists only to absorb ad spend.

Brand safety, which is a separate problem wearing the same clothes

There is a failure here that is not fraud at all and costs advertisers anyway.

Generated environments are unpredictable in a way editorial ones are not. A publication with an editor has a subject range and a tone that a media buyer can assess once and rely on. A site generating articles from whatever is trending produces, eventually, a page about a disaster, a crime, or a public health scare — and an ad placed algorithmically lands next to it.

Nobody defrauded the advertiser in that transaction. The impression was real, the reader was real, the page was real. It was simply worthless-to-negative for the brand, and no invalid-traffic filter has an opinion about that.

That is why brand-safety controls and fraud controls are genuinely different tools, and why treating one as a substitute for the other leaves a gap. Verification vendors responded to the 2025 wave by shipping AI-site and scaled-content classifications precisely because the existing fraud taxonomy had nowhere to put this.

Papyrus: the one that should worry you

Papyrus, documented in 2026, is the scheme that inverts the entire detection model — and it is the reason this article exists.

The vehicle was a set of reading applications. They generated hidden traffic, which is ordinary enough. What was not ordinary is that they actively manipulated the buyer's metrics.

Two mechanisms did the work. A click module passed a user's genuine taps through into hidden web views, registering clicks in the background on ads the user never saw or intended to interact with. And the apps were instructed to scroll pages, inflating the attention and engagement signals that measurement vendors read as evidence of quality.

The result, as reported:

Read those three numbers together and the problem becomes clear. This is not inventory that slipped past a quality filter. This is inventory that won the quality filter. A buyer ranking supply by click rate, eCPM efficiency and attention score would have promoted Papyrus traffic to the top of their allow-list on the evidence.

The operation reportedly generated in the region of a million dollars a month.

The detail that makes it different from a botnet

Note what Papyrus did not do: it did not fabricate users. The people using those reading apps were real, on real devices, doing something they actually wanted to do.

The fraud sat between the genuine user and the measurement layer, intercepting real human signals and redirecting them onto ads the human never saw. That is why it is so hard to catch with anything device-shaped — there is no device farm, no emulator signature, no impossible hardware profile. Every device is a real phone belonging to a real person who installed a real app from a real store.

It is closest in structure to the click injection described in our piece on the three attribution frauds: the activity is genuine and the attribution of it is stolen. Papyrus simply applies the same idea to attention rather than to installs.

Why this breaks conventional detection

Attention measurement was supposed to be part of the answer to ad fraud. The logic was sound: bots do not pay attention, so measuring attention rather than mere presence should filter them out. For a while it did.

Papyrus demonstrates that attention is a signal like any other, and any signal that can be measured can be manufactured. Scroll a page programmatically and the attention metric moves. Route a genuine human tap into a hidden view and the click metric moves. The measurement was never watching attention; it was watching the observable correlates of attention, and those correlates are code.

That is the operational lesson, and it generalises well past this scheme. A quality assessment that rests on one number is a quality assessment with a single point of failure. Faking one metric is engineering. Faking six that must remain mutually consistent — click rate against scroll depth against session length against return rate against conversion against time-of-day distribution — is substantially harder, because each additional constraint narrows the space of fabrications that survive.

The new red flag: performance that is too good

There is a practical inversion here that is worth adopting as a habit.

Historically, suspicious traffic underperformed. It converted badly, engaged shallowly, and showed up as a disappointing line in a report. The instinct the industry built was to investigate the bad numbers.

Papyrus-class fraud produces the opposite. A traffic source delivering a click rate twenty-five times the norm is not a discovery. It is an anomaly, and anomalies in your favour deserve exactly the same scrutiny as anomalies against you — arguably more, because nobody investigates good news.

Why publishers should care specifically

It is easy to read all of this as a buy-side problem. It is not, and the mechanism by which it reaches publishers is worth spelling out.

Buyers allocate budget against measured quality. If fraudulent inventory posts a click rate twenty-five times the norm and attention scores above yours, then in any competitive allocation your honest inventory loses — not because it is worse, but because it is being compared against numbers nobody generated honestly.

A legitimate publisher with a real audience, sensible ad density and unremarkable-but-genuine engagement is, on that dashboard, the underperformer. The fraud does not merely steal budget in the abstract. It sets the benchmark that real publishers are then measured against and found wanting.

The trajectory

None of this is levelling off. DoubleVerify reported detecting 140% more CTV fraud schemes in Q1 2026 than in Q1 2025, and more than 50 distinct bot attacks across 2025. Juniper Research projects losses reaching approximately $172 billion by 2028 as bot networks adopt generative AI and agentic automation.

The direction of travel in those numbers is not simply "more fraud". It is more distinct schemes — which indicates a lowering barrier to entry rather than existing operators scaling. That is the generative-AI effect showing up in the shape of the data: not bigger operations, but many more of them.

The copyright dimension, which is a real liability

DreamScheme's use of familiar copyrighted characters in generated creative is not only distasteful — it puts a rights problem into an advertiser's supply chain.

A brand whose ad appears alongside, or is served through a network alongside, unlicensed use of a protected character has an exposure that has nothing to do with invalid traffic and will not be caught by anything measuring it. The same applies to synthetic likenesses of real people, which are now cheap enough to generate at campaign scale.

The honest position is that this is early and the enforcement picture is unsettled. What is not unsettled is that the volume is rising and that "we bought it programmatically" has never been a strong defence for anything.

Consumers get defrauded too, and that is what changes the trajectory

Most of this Journal treats ad fraud as a money-transfer problem between businesses. This generation is different in a way that matters for anyone predicting what happens next.

DreamScheme deceived consumers directly — deceptive creative luring people to destinations that were not what they appeared to be. Pink slime networks deceive readers about who is telling them something. Papyrus turned genuine users' taps into clicks they never intended.

Advertiser losses are a commercial dispute the industry has tolerated for fifteen years. Consumer deception is the thing that attracts regulators, and regulation is the mechanism most likely to change the economics — because it is the only one that raises the cost of operating rather than merely the cost of being detected.

What defenders actually do about it

Three things, none of which is a product on its own.

Corroborate rather than measure

Stop asking whether a source passes a check and start asking whether its signals are consistent with each other. High click rate with shallow scroll depth is a contradiction. High attention with near-zero return visits is a contradiction. Fraud can produce any single number; producing a coherent set is where it becomes expensive.

Baseline everything, including the good

You cannot spot an anomaly without a normal, and most publishers and networks have never written theirs down. That means source composition, engagement depth, click rate and time-of-day distribution per property, recorded continuously — so that "this is unusual" is a measurement rather than an impression.

Keep the record where you can read it

When a source turns out to be a problem, the questions are always historical: when did this start, what did it look like before, what else changed at the same time. Those are unanswerable without a retained baseline, and reconstructing one after the fact has never worked for anybody.

Both are described by what they do. There is no first-party performance figure in this article and there will not be one — putting an invented statistic in a piece about manufactured statistics would be its own punchline.

The uncomfortable conclusion

The industry spent a decade building measurement to answer "is this real". That question now has an answer that fraud can supply. Attention, viewability, click quality — each was, at some point, described as the metric that would fix ad fraud, and each has now been demonstrated as gameable by an operation with sufficient motivation.

What has not been defeated, and probably cannot be at reasonable cost, is coherence. A fabricated audience can look right on one axis. Making it look right on six axes at once, over months, across properties, while remaining commercially profitable, is a genuinely hard problem — and it is the only ground where defenders have a structural advantage.

For a publisher with a real newsroom, the practical version of all this is uncomfortable but simple: you are now competing for budget against inventory that can fabricate the numbers you earn honestly, and the burden of proving you are not that is shifting onto you. The evidence that separates you is the boring kind — a traffic history that predates the conversation, an audience that returns, named people who wrote things. Keep it where you can show it.