In a sign of just how murky the world of digital ads has become, Myspace and GateHouse Media say they don't know who earned money from a large number of fraudulent video views that took place on their websites.

Myspace — the iconic social network of the early 2000s — seemed to be experiencing a resurgence this summer when millions of visitors flocked to its new video page, potentially generating a wave of ad revenue for the site’s troubled parent company, Time Inc. But Myspace shut the page down this week after a BuzzFeed News investigation revealed that the surge in traffic came primarily from suspect sources that racked up fraudulent ad impressions. Myspace says it was completely unaware of and didn’t profit from any fraudulent traffic or impressions, and that the video page in question was hosted and managed by a partner and not by Myspace itself. “Myspace did not agree to, participate in or condone any ad fraud activity,” said Daniella Krieger, the VP of marketing and communications for Viant, the Time Inc. subsidiary that acquired Myspace in 2011 for $35 million. The fraud on the Myspace video page was part of a larger scheme that also found a home on GateHouse Media, a publisher of more than 600 local newspapers in 36 states. The video pages hosted on roughly 150 of its websites also saw a surge in suspect traffic and associated fraudulent ad impressions. GateHouse told BuzzFeed News it was not aware of any fraud being committed, and like Myspace it said the video pages in question were operated by a partner. This is the latest in an ongoing catalog of fraud in programmatic advertising that continues to shake confidence in the digital media industry. Last week a BuzzFeed News investigation revealed that ad industry insiders profited from a network of “zombie websites” that used special code to trigger an avalanche of fraudulent views of video ads. The growing awareness of ad fraud among brands and agencies is causing major advertisers to pull back budgets and demand more accountability from their partners. Industry leaders expect more than $16 billion to be stolen by fraudsters this year alone. Prior to being shut down this week, the Myspace video page — trendingvideos.myspace.com — streamed videos licensed from reputable publishers. But for months the ad fraud investigators at Social Puncher, a consulting firm, worked with BuzzFeed News reporters to track and document significant amounts of suspicious traffic being referred to that page as well as other publishers. Once on the page, this traffic triggered automatic redirects and page refreshes that generated massive amounts of video ad impressions without any human involvement. It’s similar to how the “zombie websites” generated ad revenue, and represents a new form of ad fraud that researchers say can rack up impressions quickly and under the radar. Audience data from web analytics firm SimilarWeb shows that between May and the end of September, trendingvideos.myspace.com received 9.7 million visits that generated over 450 million pageviews. That video page did not exist prior to April. Fraud detection vendor DoubleVerify also independently identified the same scheme being run on Myspace and GateHouse subdomains as part of a separate investigation, and the company shared its findings with BuzzFeed News. Alain Begun, the vice president of marketing for GateHouse, told BuzzFeed News the company is in the process of shutting down the relevant video pages on its websites and was only made aware of the issue last week when DoubleVerify warned ad exchanges about the traffic on them.

“Fraud follows the money."

“We take any alleged impropriety very seriously and have been engaged in discussion with our programmatic exchange partners,” he said. The focus on video ads in this scheme reinforces how important video has become for publishers — and how it can cause them to launch questionable products in the hunt for video impressions and revenue. Thanks to higher ad rates for video and an appetite for the format among brands, many publishers have enacted a so-called pivot to video strategy to capture the audience and ad dollars available. And so have fraud operations, according Wayne Gattinella, the CEO of DoubleVerify. “Fraud follows the money. Video CPMs [cost per thousand impressions] are much higher than display, so [fraudsters are] clearly focused on where the larger dollars go,” he told BuzzFeed News. This particular fraud operation is designed “to capitalize on this incredible demand for video,” he said. Myspace and GateHouse both point to audience vendors, video platform partners, and external malicious actors as those accountable for any fraud taking place on the video subdomains. The partners in turn say their traffic was verified by reputable verification companies and that they too are unaware of any fraud taking place, or any system that triggers automatic redirects or similar behavior. But Social Puncher, DoubleVerify, and a third independent ad fraud researcher separately documented the malicious automatic redirects and refreshes taking place on these websites. Social Puncher alone recorded more than 200 hours of video of ads being fraudulently displayed on the Myspace and GateHouse subdomains. This footage often shows multiple video players playing at once on a single page, redirects happening between different websites without any user action, and/or editorial content being cut off by automated page refreshes in order to display more ads. All of the aforementioned activity is fraudulent because it takes place without any human activity. “You’ve got websites that are getting some sort of inbound traffic and then this begins a cycle of autoplaying videos with ad pages refreshing and sometimes redirecting to other pages,” Roy Rosenfeld, DoubleVerify’s VP of product management, told BuzzFeed News. This video shows what the experience looked like on the Myspace subdomain:

Social Puncher recorded ads being shown during fraudulent sessions for major brands such as Coca-Cola, Fios (Verizon), State Farm, Hershey’s, the Home Depot, Chase, and at least 14 brands belonging to Procter & Gamble, such as Tide and Always.

Social Puncher

Krieger of Myspace told BuzzFeed News the trending videos subdomain was set up and hosted by a company called ScreenRush in order to test driving paid traffic to the site. The traffic was to be sourced from a website called Swagbucks that enables people to earn reward points for engaging in activities such as watching online videos. “We contracted to purchase a limited test of traffic specifically from Swagbucks through a company called ScreenRush,” said Krieger, adding that the video subdomain “was natively hosted by ScreenRush and integrated into the Swagbucks site.” Myspace’s goal was to pay less to acquire traffic from Swagbucks than it would earn by showing those people video ads. This week BuzzFeed News and Social Puncher provided Myspace with information, including data from SimilarWeb, showing that hundreds of millions of pageviews had been generated on the video site from sources other than Swagbucks. “After reviewing all of the information you provided combined with our own internal review, we have suspended the test with Swagbucks and ScreenRush, effective immediately,” said Krieger. Similar to Myspace, Begun told BuzzFeed News that Tout, an online video platform, operates the video subdomains attached to roughly 150 of its websites. Begun said GateHouse is in the process of ending its relationship with Tout. “We’ve been working to wind down our relationship with Tout for close to a year based on player performance issues and a poor user experience including slow load times which affected overall page load times,” he said. As part of the relationship with Tout, GateHouse earned revenue from the ads being shown in the Tout video player. Begun said the traffic on the Tout video pages was low, as was the resulting revenue. Both GateHouse and Myspace say they were not aware of any significant spikes in traffic on these pages. “We aren’t privy to how traffic is driven to those pages,” Begun said. “That’s probably a question better fielded thru Tout.”

"Nobody wants to disclose or be responsible for where the money of these advertisers went."

In statements to BuzzFeed News, Tout and ScreenRush both say the traffic coming to the video pages they manage is verified by multiple reputable traffic verification companies, and they too deny any knowledge of, or participation in, fraud. "We work closely with our publishing partner sites, brand safety vendors and multiple 3rd party verification services to confirm that Tout inventory consists of real users and is of premium quality," wrote Trinh Bui, Tout's vice president of client services, in an email to BuzzFeed News. Tout said it sourced some traffic for the GateHouse websites through ScreenRush, making the latter the only source of paid traffic for both Myspace and GateHouse video pages. The finger-pointing between publishers and partners once fraud has been uncovered is common in the industry, according to Vlad Shevtsov, the director of investigations for Social Puncher. His company has been publishing fraud investigations at SadBotTrue.com for more than a year. "Nobody wants to disclose or be responsible for where the money of these advertisers went,” Shevtsov told BuzzFeed News. In order to execute the scheme, the suspicious traffic flowing to the video pages on Myspace and GateHouse sites was directed to special URLs that download code, which tells a web browser how long to stay on the page, when to refresh to start new ads, or when to trigger a redirect to another site in the fraud scheme so it can show video ads. The result was that the pages generated a massive number of video ad impressions with no human interaction. That’s fraud, according to definitions from the Media Rating Council, the key industry body. The scheme is set up so a regular user visiting the websites in question is not exposed to the automatic redirects. A visitor to trendingvideos.myspace.com, for example, was shown a normal video player that displays ads only after the editorial content is completed. This is where the real traffic from Swagbucks or other reward sites was directed, researchers say.

“No user would actually spend time looking at that. A human being will not sit through this.”

But when the special URL is accessed on these subdomains, the experience is completely different. BuzzFeed News used URLs identified by Social Puncher and DoubleVerify to trigger the redirect scheme. In one case, the browser was redirected to trendingvideos.myspace.com where a video ad began to play. Over the ensuing minutes, ads played for Gillette, Spectrum (multiple times), the University of Phoenix, and for the upcoming Thor movie from Marvel Entertainment. The page automatically refreshed to show another ad before editorial content played, in effect creating a near-constant loop of ads. At times, more than one video played at the same time, further increasing the money being stolen. “No user would actually spend time looking at that,” said Rosenfeld of DoubleVerify. “A human being will not sit through this.” At the core of the scheme is technology that enables it to eliminate the need for human activity or even complicated bots in order to trigger ad impressions. Once a page is loaded the sites go on autopilot and rack up ad views in a constant loop until being redirected, or until a browser crashes. It’s the same on GateHouse sites. Social Puncher and DoubleVerify separately analyzed the traffic flowing to the video subdomains on these sites and found they are benefitting from the same fraudulent traffic as Myspace. These video pages are in some cases responsible for the vast majority of traffic going to the entire site, though GateHouse says it does not factor this traffic into its audience reporting. (Myspace also said it did not install analytics tracking on its video subdomain due to the fact that it was controlled by ScreenRush.) Still, the traffic is being measured by external analytics services. For example, the videos.salina.com page for the Salina Journal in Kansas is currently responsible for 92% of its total traffic, according to data from SimilarWeb. Alexa, another web analytics service, shows a similar percentage. The chart showing the site’s Alexa traffic rank also illustrates how a recent surge in traffic to the video page led the Salina Journal to become one of the top 5,000 most-visited sites in the US:

Alexa

To put that into perspective, Salina has a population of just under 50,000 people, according to US Census data. In the case of Myspace’s trending videos page, the influx of new traffic helped the site temporarily reverse an ongoing decline in its traffic rank:

Alexa

Notably, the vast majority of this new traffic to Myspace came from desktop users, which had previously made up a minority of Myspace’s visits. These new visitors also watched a huge number of videos and, by extension, ads on the videos page. SimilarWeb found that from its launch to the end of September the average visitor to trendingvideos.myspace.com spent over 23 minutes and viewed more than 58 pages. To put that into perspective, SimilarWeb’s data for YouTube shows the average user spends 20 minutes and views an average of just under 10 pages. This means the Myspace video page run by ScreenRush almost instantly became more addictive than YouTube in terms of average time spent, and caused people to view more than five times the average number of pages. Along with the high session time and number of pages viewed, SimilarWeb found that these new desktop visitors were referred from the same group of websites, and accounted for close to 100% of Myspace's referral traffic from May to September. These sites had not previously referred significant traffic to Myspace. As a result, they provided the path that ad fraud researchers and BuzzFeed News followed to identify where the traffic is coming from. This helped determine whether it was the result of humans engaging with Myspace and other sites, or fraudulent traffic according to industry standards. Prior to May, Myspace’s biggest sources of referral traffic were Wikipeda and PeekYou, an online people-search tool. “They were responsible for an average of 27% of the site's referral traffic between September and April,” according to a SimilarWeb report for BuzzFeed News. (Roughly half of Myspace’s total traffic comes from search, and another close to 30% of visitors go directly to Myspace.) But in June and July, Wikipedia and PeekYou only accounted for a tiny percentage of all referral traffic because this new network of referral sites suddenly began throwing millions of desktop visitors and pageviews at the Myspace video page. (The company told BuzzFeed News its internal traffic logs and comScore reports did not reflect this increase in referral traffic. As noted, the video page was operated by ScreenRush and did not have Myspace analytics tracking installed.)

BuzzFeed News / SimilarWeb

The biggest group of these new referrers is more than 20 online arcade websites that were registered on similar dates and are clones of one another. They offer the same games and largely use the same website template, albeit with different colors. The source code of each site also includes the same boilerplate text in the description, “Welcome to SiteGenerator.” This shows they were all created using the same product.

Social Puncher

Traffic rank data from Alexa also shows that many of the arcade sites share identical patterns, suggesting they are receiving the exact same visitors at the exact same times, which researchers say is a telltale sign of fraudulent traffic. (Identical Alexa traffic rank patterns were also present in the sites exposed by BuzzFeed News last week.)

Social Puncher

In June, 21 arcade sites were responsible for over 70% of all referral traffic to the video page on Myspace, according to SimilarWeb. That month also saw referral traffic account for 44% of all traffic going to the site, a huge increase from the typical range of 10% to 12%. The referral traffic again increased to 48% of all Myspace traffic in July, and was 41% of total site traffic in August. It began to fall off in September. “The site sees an abnormally high traffic peak in June and July, and this is driven by a handful of referral sites that account for 90% of the increase,” Gitit Greenberg, the director of digital insights for SimilarWeb, told BuzzFeed News. Greenberg also noted that the trending videos subdomain specifically saw a massive spike in referral traffic from these sites.

Social Puncher / SimilarWeb

The arcade sites all have private domain ownership records, and it’s unclear who owns them. But after conducting a detailed analysis of the the traffic flowing through the sites, DoubleVerify concluded that it is fraudulent. DoubleVerify believes the traffic is either generated from malware installed on personal computers, or comes from surreptitious popunder windows that are loaded on unsuspecting users. After flowing from the arcade sites, the traffic either went straight to Myspace, or was redirected through a group of other domains that connect back to ScreenRush, the company Myspace partnered with. Researchers say a complicated web of referrals between ScreenRush domains and arcade sites helped mask the fact that a comparatively small amount of real human traffic was actually coming from Swagbucks. Two key referral domains are Adioio.com and ScreenRush.com. The websites for both companies say they offer products that deliver traffic to publishers. Adioio says its service has been verified by top traffic verification vendors and shows the logos of Moat Analytics, Integral Ad Science, DoubleVerify, Nielsen, and comScore. DoubleVerify told BuzzFeed News it has no relationship with Adioio, and the company’s false claim of association was one reason DoubleVerify began looking into the traffic flowing via the Adioio website. IAS and MOAT also told BuzzFeed News they do not work with Adioio and have never heard of the company. Along with making false claims about working with these verification companies, Adioio’s site incorrectly refers to “MRCC Brand Safefy [sic] Vendors.” The correct acronym for the industry accrediting body is MRC. The site also misspells the word “safety.” (Nielsen and comScore did not reply to email inquiries from BuzzFeed News.)

Adioio’s site does not list anyone who works for the company, but it does cite 15 websites in its “Publisher Network.” These sites focus on lucrative niches such as parenting, sports, and entertainment. Many of them consist of content that appears to have been automatically aggregated from other sources. Some of them are powered by the Paper.li content curation system. Nearly all of the sites also have an active video subdomain just like Myspace and others in the scheme. The subdomains on the Adioio sites account for over 95% of traffic going to them, according to data from Alexa. SimilarWeb, DoubleVerify, and Social Puncher also found that the sites also act as referrers of traffic into the scheme. Domain registration records show that a man named Daniel Aharonoff owns five of the sites. He is a longtime entrepreneur and consultant in the online video industry, according to his LinkedIn profile. Aharonoff is also the general manager of ScreenRush, and he told BuzzFeed News that Adioio and ScreenRush are part of the same company. Aharonoff said the traffic he was contracted to provide Myspace came from rewards companies like Swagbucks and others like it. The Watch section of the Swagbucks website invites users to view videos and earn reward points that can be redeemed for gift cards. During a recent visit, BuzzFeed News was offered the chance to earn reward points for watching a collection of 20 news videos from AFP. (Swagbucks opens the content in a new window and informs the user when they can advance to the next video in the playlist. It required the user to click to play the next video.) Aharonoff said the ScreenRush platform facilitates real-time bids for traffic from sources like Swagbucks to secure audience at the right price point. In Myspace’s case, he said it was willing to pay up to $6 per thousand impressions for users who spend at least 45 seconds on the site. The use of Swagbucks to generate traffic for both Myspace and GateHouse seems to explain why a key referrer to Myspace (and at times to GateHouse sites) in recent months is Entertainmentcrave.com, a domain owned by Prodege LLC, the parent company of Swagbucks. SimilarWeb’s data shows that in July Entertainmentcrave.com became the single biggest referrer to Myspace, sending 43% of all referral traffic to the site. It was not even among the 25 top referrers the month before, when Myspace also saw a massive traffic increase. Researchers at Social Puncher and DoubleVerify both say there is likely some real human traffic flowing from Swagbucks to Myspace and the GateHouse sites. But they found this traffic does not access the secret site URLs that unleash automatic redirects and constant ads. Importantly, they also found the majority of traffic coming from Entertainmentcrave.com does not originate at Swagbucks or other incentive sites. Data from SimilarWeb in fact found that the majority of traffic flowing through Entertainmentcrave.com from April to September came from the from the highly suspicious arcade sites and Adioio.com. As for Adioio, SimilarWeb found that just over a quarter of its traffic is from the arcade sites, too. That means the arcade sites are passing traffic to both Entertainmentcrave.com and Adioio.com, and in some cases Adioio then passes that same traffic through Entertainmentcrave.com. Then it is sent along to Myspace or the GateHouse sites to trigger the video impressions.

BuzzFeed News

Aharonoff disputes this conclusion. He said the traffic he sources for publishers, and that advertisers place ads against, has been cleared by multiple traffic verification vendors before ending up on a site like Myspace. “It isn’t uncommon for different leading vendors to score traffic inconsistently, but the advertiser makes that decision based on their own [key performance indicators],” he said. Aharonoff is correct that it’s common for different verification vendors to score traffic differently in terms of how much is invalid versus real. However, real-time traffic scoring is not the same as the weeks-long investigation undertaken by DoubleVerify to analyze the traffic going to Myspace and GateHouse sites, and to track it back to its origins, according to the company. Social Puncher also spent months tracking the traffic and ads being shown. BuzzFeed News contacted Prodege, the parent company of Swagbucks, to ask if it was aware that arcade sites identified as malware by DoubleVerify were passing traffic through its Entertainmentcrave.com domain. Similar to Aharonoff, Prodege’s senior vice president, Stacey Olliff, said by email that all traffic going through that domain is verified by multiple vendors. (Aharonoff was a consultant for Swagbucks for several years, but left to work on ScreenRush, Olliff told BuzzFeed News.) “We are mystified as to why DV or the other consultants you mentioned would conclude that traffic coming out of that domain is non-human traffic or otherwise invalid traffic,” he said. “We think it is extremely implausible that IAS, Pixalate, Forensiq and the other leading vendors scoring that traffic are not accurately classifying vast quantities of traffic, and the parties you are relying upon for contrary information are in fact the only ones accurately detecting non-human traffic.” BuzzFeed News contacted some of the vendors Olliff said verify the traffic on Entertainmentcrave.com. “We do not verify traffic for entertainmentcrave.com for anyone, including Prodege,” said Tyler Loechner, the marketing manager for Pixalate. He also confirmed that they saw an increase in invalid traffic going to trendingvideos.myspace.com over the summer. A spokesperson for IAS told BuzzFeed News they flagged Entertainmentcrave.com “for high brand risk across either one or several of our brand safety categories.” For his part, Aharonoff said his system acts as a “clearinghouse” for traffic coming from incentive sites and other sources, and that verification companies consistently rate the traffic as authentic. He questioned why he is “required to go by all the rules and support half a dozen scoring providers and still get slapped on the [wrist] because they can't agree on the definitions.” When asked why Adioio.com listed the logos of traffic verification vendors who told BuzzFeed News they don’t actually work with his company, Aharonoff said he listed them because the vendors he sources traffic from use these companies. “As you know loyalty partners filter supply before they offer us to bid on it,” he said. Yet Aharonoff said he doesn’t know anything about the 21 arcade sites that provided the lion’s share of traffic that flowed through his system and onto the Myspace video page, as well as the GateHouse pages. “We tap into several supply partners and I don’t know what the sites you are referring to are,” he said.

"That's kinda like a pack of coffee labeled Kona, but only 5% is real Kona coffee, the rest being cheap filler."