A massive botnet that emulates human visitors is earning its creator over $6 million per month from online advertisers, researchers said.

Called Chameleon, the botnet has more than 120,000 hosts located in the U.S., running Microsoft Windows and accessing the Web through a Flash-enabled Trident-based browser that executes JavaScript, said researchers at Web traffic analytics firm spider.io.

Ramnit Malware Back, Better
Born Again Botnet Much Stronger
Life of a Botnet: Growth in Spurts
Botnet Thriving after Six Years

“Chameleon is a sophisticated botnet,” the researchers said. “Bots generate click traces indicative of normal users. Bots also generate client-side events indicative of normal user engagement. They click on ad impressions with an average click-through rate of 0.02 percent; and they surprisingly generate mouse traces across 11 percent of ad impressions.”

The company has been tracking the botnet since last December, searching for specific patterns typical of this bot activity, such as crashing and restarting regularly, targeting a specific cluster of 202 websites, simulating the visitation of a number of web pages across a number of websites.

Schneider Bold

Apart from its obvious sophistication, the botnet is also notable for the amount of money it generates for its master, and for being the first one spotted to affect display ad advertisers instead of text link ones.

Every month the botnet has been serving at least 14 billion ad impressions, using at least 7 million distinct ad-exchange cookies, exchanged after each bot crash.

“Despite the sophistication of each individual bot at the micro level, the traffic generated by the botnet in aggregate is highly homogenous,” the researchers said. “All the bot browsers report themselves as being Internet Explorer 9.0 running on Windows 7. The bots visit the same set of websites, with little variation. The bots generate uniformly random click co-ordinates across ad impressions and the bots also generate randomized mouse traces.”

Spider.io compiled a blacklist of 5000 IP addresses of the worst bots participating in the Chameleon botnet.

Pin It on Pinterest

Share This