Underground businesses that employ real people to facilitate fraudulent services such as fake clicks, CAPTCHA hacking and traffic inflation have seen a surge of interest in the past six months as the world has been plunged into a global recession, according to a report by fraud detection firm ClickCease.
While the dark web has copious fraud on offer, those looking to take advantage of these services need not look beyond the open web. Searching for 'buy bot traffic for website' or 'buy clicks for website' in major search engines yields tens of thousands of results. Many of these fraud instigators actually pay search engines to feature first in such search terms.
Fraudsters employ techniques of varying sophistication to facilitate this fraud, such as infecting devices with malware, taking over or spoofing IP addresses, and employing bots to generate clicks. But a new report from ClickCease has uncovered a growing economy of fraudulent marketplaces that pay real people to click on ads.
These sites operate in a similar way to gig-economy firms like TaskRabbit, employing a roster of tens of thousand of freelance workers to complete tasks. But instead of cleaning houses or assembling furniture, these workers are asked to click on ads, download apps and complete CAPTCHAs, and can earn US$100 per month to do so.
During Covid-19, such fraud marketplaces have offered a source of income to the millions of people who have been let go or found themselves in trying financial circumstances. According to ClickCease's report, the majority of workers at such fraudulent sites come from low-income countries including India and Vietnam.
ClickCease co-founder Ilan Missulawin noted: "The underground ad click economy is only increasing in scale due to minimal enforcement and the challenges of Covid-19, as more people are being enlisted to make money without having to leave their homes."
The 20 most prominent Pay to Click (PTC) sites, including Paidvert ScartletClicks and PTCShare, claim to have paid out more than US$13.2 million to online freelancers working in this gig economy, ClickCease found. With each worker paid 5 cents a click, this equates to 266 million ads clicked, ClickCease reports.
Traffic to these sites has surged in the past six months, ClickCease reports. One of the largest sites, NeoBux, has reached a peak of 9 million visitors per month. ScarletClicks achieved a 41% increase in traffic within six months to 1.3 million visits in September 2020. PTC Share has seen a 13% increase in traffic to 1.2 million visits a month.
Some sites offer the ability to evade detection by buying "safe" clicks. For example, Fivesquid offers $5 packages to deliver certain amounts of "safe" AdSense Clicks, such as real human visitors from the US, groups of clicks where the 'user' spends a minimum amount of time on a site, and clicks spaced out across a day.
Despite the fact that these sites violate Google's terms and conditions, several vendors freely advertise on Google's paid search terms for keywords such as "organic clicks". For instance, Serpclix in its ad "discusses a pool of thousands of microworkers to optimize your organic CTRs and boost rankings".
Clicks is one of the easiest advertising metrics to game. ClickCease has found that at least 15% of clicks on pay-per-click (PPC) ads through contracts with online advertising platforms, most notably Google, are invalid.
Beyond clicks, workers are employed to solve CAPTCHA verification tests, which are used to determine whether a user is a human or a robot.
One CAPTCHA-solving farm, 2Captcha, offers to solve 1,000 CAPTCHAS for $0.77 and claims to have more than 2,000 workers online at any one time. Deathbycaptcha.com offers solving rates at $1.39 per 1,000.