Methbot’s modus operandi was to view video ads on spoofed websites, creating impressions that looked like genuine human activity. The operators of Methbot had obviously put a lot of time, money, and effort into developing the scheme, as it was deceptively simple but devastatingly effective.
Although the Methbot program used infected computers to generate the views, much of the activity was controlled from centralised servers in the USA and Netherlands. These servers ran dedicated proxies which masked the true location of the infected devices, adding in the details of real IP addresses that they had acquired.
At its peak, it’s thought that Methbot was making up to 400,000 impressions per day across its whole infrastructure.
These impressions were all channelled through an incredible 250,000 fake domains, copied (spoofed) from genuine and well-respected websites.