POP Bots!!! Can You Confirm My Thinking.

[Bashy]

The other day i ran a very limited amount of traffic from Popads as i was bot testing a specific category.

The stats looked ok but i spotted something that i want to confirm.

I noticed that most of the traffic was being reported as screen resolution 640x960, Popads tracking macro was sending this as 800x600.

On the face of it that looks ok but digging deeper, No iPhone has a resolution of 800x600 and only the iPhone 4 and 4S have a resolution of 640x960.

The problem is that the iphone 4/4S doesn't support IOS 11 and from my research it stopped at IOS 7.

When i look at the ISP's they are all genuine so am i right in thinking this is actually a BOT and maybe the sites linked with these hits are using traffic surfing networks which may spoof certain browser and OS versions.

The bot test i had focused on Click Bots but this seems like impressions bots to me.

Anyone have any other theories?

 

[TheTallGuy]

How about the UA? Can you see theme? And which are they?

 

[Graybeard]

Show me the actual webserver access logs ^^^ like he is saying.
You need to do a real forensic analysis.
You should host your own landing pages then you will have access it true logs.

Do you have a sample of the IP addresses?

 

[Bashy]

How about the UA? Can you see theme? And which are they?

There is no real theme to the UA, nothing that gives it away as a bot or not real as far as i can see

For examples

Mozilla/5.0 (iPad; CPU OS 11_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0
Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit/604.5.6 (KHTML, like Gecko)
Mozilla/5.0 (iPhone; CPU iPhone OS 11_3_1 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko)

Show me the actual webserver access logs ^^^ like he is saying.
You need to do a real forensic analysis.
You should host your own landing pages then you will have access it true logs.

Do you have a sample of the IP addresses?

Sample IPs

174.230.4.85
142.255.85.203
172.6.231.193
24.18.174.169
174.229.129.221

Ip's, UA, ISP's all look genuine. Spoofing the ISP is not possible as far as i know and to have a screen resolution on a device that cannot run the OS version shown seems to be fake traffic.

My guess is these sites are using auto surfing traffic networks such as hitleap, maybe the software is spoofing the browser but they didn't think about what i spotted above. Cant say I've seen anyone else mention this issue or look into what i mentioned.

 

[Graybeard]

TOR Node List
you can only get this tor node list every 30 min! copy and save it check but I think it may be the stats being reported are wrong?

 

[Graybeard]

Screen resolution is a JavaScript function and you are only having problems with iOS -- hmm. Test with your own iOS or in Chrome Developer (F12) emulator and refresh -- see what you get ...