A new survey commissioned by the Motion Picture Association into the revenue sources of 'pirate' sites has found that a third of adverts displayed are 'scam' ads designed to trick users or inject malware. According to the report, "awareness and outreach campaigns" could be helpful in warning people away from sites displaying these ads.

As part of their war against the unauthorized sharing of copyrighted material online, entertainment industry groups and their affiliates commission reports to highlight how so-called ‘pirate’ sites operate.

In 2014, for example, research company NetNames published a report detailing the revenue streams for so-called ‘cyberlockers’. It was later used by a U.S. senator to pressure Visa and Mastercard to stop doing business with such sites.

With continued lobbying efforts in mind, a new report commissioned by the Motion Picture Association (MPA) has again been examining how so-called ‘pirate’ sites generate their income.

The study, carried out by UK-based Incopro, analyzes the revenue sources for the 250 most popular sites offering access to unlicensed content in Germany, Spain, France, Italy and United Kingdom. Due to some overlap in each country’s “most-popular 250” list, 622 sites in three categories (hosting, linking only, P2P) were examined overall.

Advertising, cash – or both

The company looked at two key areas of revenue generation – monies received from companies who advertise on the sites (intentionally or otherwise) and monies received from users who either pay or donate via payment methods including Visa, MasterCard and Bitcoin.

In its analysis Incopro found that 550 of the 622 sites surveyed carried advertising and 142 offered at least one payment method. An overlap between the two groups meant that 122 sites carried advertising and also accepted payments. With just 52 sites out of 622 carrying no advertising and accepting no payments, a total of 570 sites (91.6%) had at least one source of revenue.

The sources of revenue for each of the three site categories were broken down revealing that ‘linking only’ and ‘P2P portal’ sites rely heavily on advertising. ‘Hosting’ sites tended to have both advertising and payments, with free users being shown advertising and premium users often paying to avoid them.

Key advertising intermediaries

Since advertising is viewed as the most important source of revenue for the majority of the sites in the report, Incopro has attempted to identify which advertising intermediaries are responsible. While several companies each served up to 55 sites in the report, three entities are highlighted as market leaders.

“Analysis found that AdCash, Propellerads/OnClickAds….and DirectREV were the top three intermediaries to serve adverts across all unique sites in this study,” Incopro reports.

Noting that the report concentrates on the intermediaries delivering adverts to the 622 sites, Incopro says that opportunities exist to disrupt the flow of ads.

“One possible approach to this would be to engage with the Content Delivery Networks (CDNs) which do not serve the adverts independently but cache the creative elements that are called by ad tags served by other intermediaries. Consideration should be given to approaching the leading CDNs and working with them to block adverts served to unauthorised sites,” the company writes.

Advertising categories

Incopro says that the adverts observed in the study were placed into standard categories such as entertainment (5%), tech (5.9%), retail (6.6%), business/finance (7.4%), games (10%), adult (10.4%) and gambling (18.1%).

However, due to the high number of deceptive ads appearing on ‘pirate’ sites the company had to create a new group (‘Trick button/Malware’) which accounted for 31.5% of the total, the biggest group by far.

“The Trick Button/Malware types of advert typically do not mention the advertiser in the initial ad, and thus they are a form of ‘bait-and-switch’,” the company says.

“Typically, the user is presented with a button that says ‘download’ and/or ‘play’. Believing that these will lead to the desired file, the user then clicks the button. Once clicked, the user is prompted to download an executable file containing a potentially unwanted program.

“These Trick Buttons are a common feature of unauthorized sites and are worth looking at in more detail given the potentially damaging financial and emotional effect on the user.”

Finding that two companies (RevenueHits and Matomy Market) were responsible for up to 89% of these kinds of ads to the sites they serve, Incopro advises that some kind of campaign could be effective in turning users away from the sites serving them.

“Given the likelihood that end users will encounter potentially harmful software from these types of adverts across all types of site, awareness and outreach campaigns around this issue could be reinforced to help to discourage use of unauthorized sites,” the company writes.

Top advertisers

Regular European visitors to file-sharing related sites will be well aware of the high number of ads served up from gambling companies. Unsurprisingly the Incopro report reaches the same conclusion, finding that four out of the top five most prolific advertisers (Trick button ads excluded) are gambling companies.

“These companies may not be aware that their adverts are appearing on these sites and should be considered for an approach in order to once again frustrate the ability of an unauthorised site to generate ad revenue,” the report reads.

“For this reason, Trick button/PUP adverts have been excluded from this section in order to concentrate on companies that are potentially approachable.”

Payment methods

As highlighted earlier, 142 out of the 622 sites studied accept payments from users. Of interest, however, is how many different payment methods are utilized by those sites – 83 in all. In total, four broad areas were identified, as detailed in the image below.

“Host sites were the primary location for payment methods and accounted for 91% of all payment methods detected. Payment to the host site was predominantly via a ‘premium’ subscription service whereas other site types were more likely to accept payment for donations,” the report notes.

Advising again on possible mitigation measures, the report suggests that pressure on payment companies of all kinds could limit the use of their systems on “infringing” sites.

“Visa and MasterCard, the most observed payment service providers in this study, have responded to notifications in the past. In the same way that the major global Brands would most likely not wish to be associated with infringing websites because it could affect their reputation, these companies may feel the same,” Incopro writes.

“In the same way that the payment card providers can be asked to take action, payment processors can also be asked to take similar action to prevent transactions on those merchant accounts where they are facilitating the revenue generation of unauthorized sites.”

Despite best efforts so far, the image below reveals that the usual big names are still servicing the top “infringing” sites.

Conclusions

Overall, Incopro concludes that advertising is far and away the biggest source of revenue for the sites in their study.

“Given this reliance on advertising, concerted effort should be made by brands, agencies, and where possible, the authorities, to work together to persuade the various intermediaries to undermine these revenue streams,” the company says.

“Regarding payment methods, analysis has shown that the payment methods observed broadly consist of four transaction types on the unauthorized websites studied. These are the payment service providers like Visa and MasterCard, payment processors such as Liqpay and Dalpay, virtual wallets such as Google Wallet, RoboKassa and PayPal and resellers such as VIPKeys. Engagement with the first three

is recommended. Resellers should be examined as a separate issue,” the company concludes.

Just like the NetNames report before it, this MPA-commissioned report will be cited by entertainment industry companies during the months to come to put yet more pressure on advertisers and payment companies alike. Whether that will be enough to stifle the revenue arms race will remain to be seen.

The full report can be downloaded here (pdf)