WHERE IT STARTED
FIRST SEEN: c. 2004-2006 · GOING FOR: About 20 years
First litigated in the United States in 2004-2006, when advertisers sued Google and Yahoo over invalid clicks; industrial botnet fraud began with Methbot in 2015.
Click fraud appeared with pay-per-click advertising: Google settled a class action over invalid clicks in 2006, and 'click farms' of low-paid workers followed. Botnets replaced humans in the 2010s: 'Methbot' (2015-16) and '3ve' (2015-18), run by Russian and Kazakh operators, used up to 1.7 million infected computers and 10,000 fake websites to generate billions of fake ad views a day, and were dismantled by the FBI, Google and White Ops in 2018. Aleksandr Zhukov, the 'king of fraud', was sentenced to 10 years in 2021. Juniper Research estimated $68 billion lost worldwide in 2022 and projects more than $131 billion by 2030.
HOW IT WORKS
Fraudsters create websites or apps that carry ads, then send fake traffic to them: click farms, hijacked browsers on infected PCs, data-centre servers spoofing residential IP addresses, or 'ad stacking' and hidden pixels that load ads no one sees. Ad exchanges pay per view or click, so the money flows automatically to the fraudster's publisher accounts. Advanced versions spoof premium publishers' domains ('domain spoofing') so advertisers think they bought space on major news sites.
Traffic spikes from data centres or a single region with near-zero conversionsSites with high ad revenue but no real audience or contentClicks at regular intervals or from outdated browser versionsSessions of a few seconds with 100% bouncePublisher domains that resemble major outlets but are newly registered
HOW USEFUL IT IS TO CRIMINALS
Fake traffic costs fractions of a cent per view and is paid automatically by ad exchanges, so a mid-sized operation earns millions a year with modest technical skill. Industry estimates put losses at tens of billions a year, but only one botnet gang (Methbot/3ve) has ever been prosecuted, with a single 10-year sentence.
THE DAMAGE IT HAS CAUSED
$68 billion
Global digital advertising spend lost to fraud, 2022 (estimate) — Juniper Research, Feb 2022
Juniper Research estimated $68 billion in global ad spend lost to fraud in 2022 and projects $131 billion by 2030; the US alone lost about $23 billion in 2022. The largest prosecuted case, Methbot/3ve, cost advertisers more than $29 million. The wider harm is that legitimate publishers lose revenue while ad budgets fund criminal infrastructure.
$68 billion Estimated global digital ad spend lost to fraud in 2022, up from $59B in 2021 (Juniper Research, 21 Feb 2022)
$131 billion Projected annual ad-fraud losses by 2030 (Juniper Research, 2025)
3 billion Fake ad bid requests per day generated by 3ve at its peak (The Record, 2021)
WHO USES IT MOST
MOST OF ALL: 🇷🇺 Russia ▸
The largest prosecuted botnet operations, Methbot and 3ve, were run by Russian and Kazakh nationals, and Juniper Research ranks the US, Japan and China as the biggest loss markets.
Russia (Methbot operators)Kazakhstan (3ve operators)United States (largest advertiser losses, prosecutions)China (major loss market and click farms)India (click farms)
GOVERNMENTS LINKED TO IT
No government is documented as using this method.
NOTABLE PEOPLE WHO USED IT — RANKED BY PROFILE ORDER (NOT BY AMOUNT)
#1 Aleksandr Zhukov CONVICTED (10 YEARS, 10 NOV 2021)REPORT PENDING
$7M defrauded from advertisers; $3.83M forfeiture · 2014-2016
Russian self-styled 'king of fraud' who ran Methbot, renting 1,900 servers and 650,000 IP addresses to fake billions of video-ad views.
SOURCE: CyberScoop and The Record, Nov 2021
#2 Sergey Ovsyannikov PLEADED GUILTY (2019)REPORT PENDING
3ve caused over $29M in losses · 2015-2018
Kazakh operator of the 3ve botnet that used 1.7 million infected computers and fake websites; pleaded guilty to wire fraud and hacking.
SOURCE: BankInfoSecurity, 'Guilty Pleas in $29 Million Online Ad Fraud Case', 2019
#3 Yevgeniy Timchenko CONVICTED (TIME SERVED AFTER 2 YEARS 4 MONTHS, 2019)REPORT PENDING
$4.5M forfeited · 2015-2018
Co-operator of 3ve who forfeited over $4.5M held in Swiss, Romanian and Kazakh accounts.
SOURCE: BankInfoSecurity, 2019; CyberScoop
#4 3ve / Methbot operation DISMANTLED; MULTIPLE CONVICTIONSREPORT PENDING
$29M+ losses; $15M recovered · 2015-2018
At peak generated 3 billion fraudulent bid requests a day using 60,000 accounts, 10,000 fake sites and over a million IP addresses; taken down in Nov 2018 with the US recovering $15M.
SOURCE: The Record and SecurityWeek, US recovers $15 million from 3ve, 2022
SOURCES
Juniper Research, 'Digital Advertising Spend Lost to Fraud to Reach $68bn', 21 Feb 2022
Juniper Research, ad fraud losses to exceed $131bn by 2030, 2025
CyberScoop, 'Aleksandr Zhukov sentenced to 10 years', Nov 2021
The Record, 'King of fraud sentenced to 10 years for Methbot/3ve', Nov 2021
BankInfoSecurity, 'Guilty Pleas in $29 Million Online Ad Fraud Case', 2019
SecurityWeek, 'US Recovers $15 Million From Ad Fraud Group', 2022
BuzzFeed News, 'Meet the men accused of running Methbot and 3ve', 2018