The Evolution Of Click Fraud: Massive Chinese Operation DormRing1 Uncovered
Summary
The image above depicts a portion of the ring, with each red dot representing a source of fraudulent clicks with similar digital signatures. DormRing1 recruited student click fraud workers on Chinese social networks where and forums participants would post images of checks they were getting for their activities. A briefing paper provided by Anchor describes the operation: These social networks involve a complex set of user access levels. Users with the uppermost levels of access are able to purchase root kits to engage in fraudulent activity and contract out phases of their fraud operations to a large network of willing participants. Through this network, the perpetrators were able to contract money mules (i.e. people with US addresses to which checks can be sent), traffic generators / botnet herders, website template developers, and a host of other service providers.