How fraud0 works

Data Center

Data centers are a popular location for malicious bot networks. As data centers are secured locations that humans generally do not have access to, traffic originating from a data center is most likely a bot. For example, a session originating from an Amazon AWS data center IP address block is unlikely to be a valid human user.

Proxy

By routing their traffic via residential proxies, bot developers obfuscate their location and identity. Allegedly, this is relevant traffic from important markets such as the USA, Germany, or the UK. However, it actually originates from countries such as India, Pakistan, or Bangladesh. We keep a blocklist of known proxy connection details and IP addresses and flag traffic from these sources.

Tor

Tor, short for The Onion Router, is a protocol designed to anonymize internet traffic. Fraudsters can use Tor to disguise their location and usage information.

Scrapers

Malicious bots that scan websites for specific information such as email addresses, phone numbers, inventory details, or pricing data. This is often the case on e-commerce websites, where scraper bots are mostly used by competitors to undercut prices and increase their sales.

Behavioral Anomalies

Since bots are programs that perform repeatable actions, the exact repetition of activities can be an indication of non-human traffic. For example, to detect non-human traffic, we measure the intervals between clicks on a website. A human user has variable click intervals and patterns and does not behave with inhuman precision. Another example is measuring the number of clicks within a given session. A deviation from normal human activity may indicate that the user is a bot. When actions are performed by a script, the number of clicks can be very high or very low. Both can indicate suspicious activity.

Automation Tools

Fraudsters use tools like Puppeteer or Selenium, which were originally programmed to help developers test their work. However, these tools can also be used to easily create bots that visit websites and click on ads.

False Representation

False representation, also known as “user agent spoofing,” occurs when the browser’s user agent string is altered to disguise the user’s identity. When user agent tampering is present, there is a very high probability that the traffic is caused by a fraudulent user. The same is true for the rotation of the user agent identifier. Bots use rotating details (e.g., different browser type or operating system) for new sessions to impersonate a legitimate user. However, it is highly unlikely that the IP address of a real user would have constantly changing user agent details, since real people usually use the same devices and browsers.

Cookie Rotation

To avoid detection, bots also rotate cookies and referrer information. It would be suspicious if the same IP address (or other identifiers) is recorded with different cookies, since the normal ratio between a real user and his cookies is one-to-one.

Plugin Analysis

We analyze irregularities between installed plugins and browser functions to identify bot traffic.

Blacklisted Referrer

We maintain a block list of referrers that are known sources of poor traffic. These include bot farms, click farms, or fake websites based solely on bot traffic.

Malicious Publisher

Malicious publishers set up fake websites, fill them with plagiarized content, sign them up to ad networks, and then direct bot traffic to them. We maintain a block list of “malicious” publishers and flag traffic from these sources.

Click Farms

Click farms employ numerous low-paid workers to:

• click on advertisements

• like content

• share content

• comment on content

• subscribe to / follow accounts

Typically, these organizations are located in developing countries such as China, India, Indonesia and Bangladesh.

Known Bots 

We maintain a blocklist of known bot and crawler names.