Combat Fraud — Yellow Web

Clearing the way to profit!

DISCLAIMER: This post was written solely to raise the level of awareness of the community. The author does not engage in fraud, stands for fair competition and condemns unethical actions towards colleagues in any form.

Today we will introduce you to security holes that can be used todestroy our competitors in the bud. For illustration, we will look for examples intop spa for gut and crypt MTWSpy (I recommend!), but I will give approximate fraud options for other verticals.

Both solo arbitrageurs and teams really don’t like it when competitors use their creatives and other promotional materials. But they don’t even suspect that there are things much worse than stolen credentials. And one of these things is FROD?

Usually, everyone perceives fraud as a method of fraud that allows you to make money on affiliate networks or advertisements. It would seem that there is nothing interesting from the point of view of the pouring brethren? But in fact, with the help of fraud that is cleverly mixed into a competitor’s traffic, you can achieve the following things:

overflow drip
reduction in traffic quality
call center paralysis
removal of guarantors/bumps
disconnect from offer
ban in affiliate network

How do affiliates get scammed?

They find links to streams from affiliate programs where traffic flows, and then send fraud there. There are a couple of options:

Immediately throw in 100,500 leads, at the expense of which all possible caps will be poured and, if we talk about the inside, completely overload the CC.
Fraud a little at a time, gradually increasing the volume, until the advertisers/affiliate network of your competitors say that their traffic is crap, cut their rates, or even simply ban you.

It all depends on the vertical, but the general rule is this: the simpler the funnel, the easier/cheaper it is to fraud:

SOI sweeps? Okay, we need to buy a bunch of mail.
DOI? Okay, let’s write software that will read letters and click on the link viaproxy.
PIN-submit? We use the API of services for receiving SMS to a number.
COD-nutra? Sometimes you don’t even needproxy, I’ll show you a little lower ;-)
CC-submit? This is where stolen cards come into play (I highly condemn).
iGaming via Prills?Proxy, services for receiving SMS + virtual phones to add the Ministry of Defense.

Why is this type of fraud even possible?

Firstly, just as you cannot be completely protected from spaying, you cannot be completely protected from fraud. And secondly, the current situation in the market is such thatno one even thinks about defending themselves. Thunder won’t strike — the man won’t cross himself.

In most cases, fraud will not be visible intracker, but will go directly to affiliate network. And, since fraud clicks do not have a clickid/subid, the leads left by the fraud machine will not be displayed intracker. Accordingly, if you do not check the postback log daily for suspicious twitches (and you don’t check), then the fraud will most likely be detected at a fairly late stage, when affiliate network/advertises howl like a beluga.

The main “protection” that arbitrators put in place is the flow filters they have in theirtracker, and then at least the grass won’t grow?‍♂️ Let’s look at a couple of the most egregious examples that are just asking to be frozen.

Passing the IP address in the form

Before us is COD-nutra in Chile. All that the fraudster needs in this case is to write a simple script via ChatGPT that will send Chilean IP addresses, phone numbers and names similar to local ones to the action of this form. Putting together a working version of the script to slightly clear the Chilean market of competitors will take a couple of hours MAXIMUM.

Conclusion:Under no circumstances DO NOT DO THIS! The IP address should NOT be obtained from the outside, but should be taken INSIDE the script for sending leads from$_SERVER['REMOTE_ADDR']or$_SERVER['HTTP_CF_CONNECTING_IP']if cloud is used.

Headline spoofing

Here is the code for determining the user’s IP address, located inside the standard script for sending leads, the creation of one of affiliate network. If you know a little about code, you will understand that if there is no cloud (which is not at all uncommon) preference when determining the visitor’s IP address will be given to two headers:CLIENT-IP and X-FORWARDED-FOR. Both of themcan easily be faked. By the way, in affiliate programx there is similar code, butwithout checking cloud, Ahaha.

It is enough for the attacker to know where you are sending offer (and if this is your competitor, then he is most likely aware), and then study the standard script for sending leads for such problems. Half an hour of proceedings — and now there is no need to spend money onproxyto throw a bunch of shit on the fan.

The output is exactly the same as in the first example. Rely ONLY on data that cannot be falsified.

What does a fraud machine consist of?

Here is a short list of what the creators of combat fraud systems use in their “work.”

Professionals usually work in one vertical and create universal systems based on HTTP requests, into which you just need to insert a link and configure a set of transmitted data. Beginners, as well as those who want to get started quickly, use ZennoPoster/BAS or Selenium/Puppeteer/Playwright.

When working with mobile traffic, it can reach entire farms of smartphones — it is much easier for them to pass under the antifraud radar of some bookmakers, for example. The coolest thing about this is that often you don’t even need to assemble your own farm — now you can rent ready-made solutions and pay for the time. Fraud as a Service, so to speak :-)

Towards the end, let’s take a brief look at the data that will be required for high-quality fraud.

Lists of first and last names

Found by Google for queries like: “the most popular male names/surnames in GEO«. We save first names separately, last names separately, and then randomly combine them — ready!

Phone number lists

They are pulled from any js library that checks the validity of the number. We collected masks and wrote a generator — PROFIT!

Lists of IP addresses of the desired country

We take free MaxMind databases in CSV format:GeoLite2-Country-Blocks-IPv4AndGeoLite2-Country-Blocks-IPv6. We pull out ranges and masks from there and generate suitable addresses.

Proxy

Any that support changing the address by link or by time will do. Payment is for traffic. The more IP addresses the better. Another option is to quickly deploy a pool of your IPv6proxy— cheap and accessible.

SMS services

Here without comments, everyone knows everything and without my references to SMS Activate.

CONCLUSION

Just like with scams, hacking and data leaks — if you haven’t been scammed yet, then your bread is not of much interest to medium/large players, or you justfor nowlucky.

Remember, the task is not to find or buy for 100,500 thousand dollars some unique prodigy that will supposedly protect you from everything in the world. NO. Task —remove obvious holes and make the task as difficult as possible for dishonest competitors. How exactly? It will depend on your funnel: hire a good techie and puzzle him with this question.

Was Yellow Web with you, guys, give it a plus?