POP Bots!!! Can You Confirm My Thinking.

Discussion in 'Pay Per View' started by chicherito, Jun 15, 2018.

  1. chicherito

    chicherito Well-Known Member

    The other day i ran a very limited amount of traffic from Popads as i was bot testing a specific category.

    The stats looked ok but i spotted something that i want to confirm.


    I noticed that most of the traffic was being reported as screen resolution 640x960, Popads tracking macro was sending this as 800x600.

    On the face of it that looks ok but digging deeper, No iPhone has a resolution of 800x600 and only the iPhone 4 and 4S have a resolution of 640x960.

    The problem is that the iphone 4/4S doesn't support IOS 11 and from my research it stopped at IOS 7.

    When i look at the ISP's they are all genuine so am i right in thinking this is actually a BOT and maybe the sites linked with these hits are using traffic surfing networks which may spoof certain browser and OS versions.

    The bot test i had focused on Click Bots but this seems like impressions bots to me.

    Anyone have any other theories?
  2. pudge

    pudge Well-Known Member

    How about the UA? Can you see theme? And which are they?
  3. homer

    homer Well-Known Member

    Show me the actual webserver access logs ^^^ like he is saying.
    You need to do a real forensic analysis.
    You should host your own landing pages then you will have access it true logs.

    Do you have a sample of the IP addresses?
  4. Mobzilla

    Mobzilla Well-Known Member

    There is no real theme to the UA, nothing that gives it away as a bot or not real as far as i can see

    For examples

    Mozilla/5.0 (iPad; CPU OS 11_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0
    Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit/604.5.6 (KHTML, like Gecko)
    Mozilla/5.0 (iPhone; CPU iPhone OS 11_3_1 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko)

    Sample IPs

    Ip's, UA, ISP's all look genuine. Spoofing the ISP is not possible as far as i know and to have a screen resolution on a device that cannot run the OS version shown seems to be fake traffic.

    My guess is these sites are using auto surfing traffic networks such as hitleap, maybe the software is spoofing the browser but they didn't think about what i spotted above. Cant say I've seen anyone else mention this issue or look into what i mentioned.
  5. homer

    homer Well-Known Member

    TOR Node List
    you can only get this tor node list every 30 min! copy and save it check but I think it may be the stats being reported are wrong?
  6. Liza

    Liza Well-Known Member

    Screen resolution is a JavaScript function and you are only having problems with iOS -- hmm. Test with your own iOS or in Chrome Developer (F12) emulator and refresh -- see what you get ...