Bringing Context to This Week’s Methbot News

When news about Methbot broke this week, it understandably sent waves of concern and confusion through the industry. However, while headlines suggest this is a major new phenomenon that has gone unnoticed by third-party measurement providers, that is not the case. To help contextualize this news, I offer three points to keep in mind when thinking about Methbot:

1. Methbot is neither new nor entirely unique, and schemes such as this can (and should) be caught and filtered in audience and advertising measurement with proper sophisticated invalid traffic (SIVT) filtration methods. In fact, this Methbot botnet leverages a flavor of domain laundering – an advanced form of IVT that Comscore and other verification providers first identified as a threat to the industry in 2014 and has been a leader in detecting ever since. At a thousand machines, Methbot is orders of magnitude smaller than many of the other botnets we have our eye on and filter as part of our MRC-accredited SIVT filtration practices, and we’ve long been aware that certain botnets leverage datacenters to impersonate user traffic instead of using malware-infected personal computers. At Comscore, our technology was designed to leverage a variety of unique data assets and detection techniques, including our human panel and comprehensive census network, for early identification of a wide variety of invalid activity from both human and mechanical sources, including domain laundering. Through these advanced filters, clients can rest assured they are protected from the impacts that Methbot and other, bigger threats can have on their performance – and their bottom lines.
2. To that end, Comscore has been aware of and filtering IVT driven by this Methbot ad fraud scheme since October 2015. Through our SIVT detection filters, leveraged in our MMX® and validated Campaign Essentials™ (vCE®) products, we have been automatically identifying and removing Methbot activity from audience and campaign measurement as standard practice for over a year. If you are working with Comscore, your validated audience numbers have already filtered Methbot and other sophisticated invalid traffic, giving you a clean view of your impact on consumers.
3. When new IVT threats are detected, it is important that they are dealt with delicately to ensure minimal disruption to the industry – and most importantly to avoid tipping off bad actors. Understanding that publicly sharing information about botnet fuels the generation of new, more cunning IVT in the industry, Comscore does not proactively promote these discoveries to the world at large. When Comscore identifies significant new forms of invalid traffic, we provide information through established protocols of MRC and TAG, and we work with those impacted to ensure the issue is resolved before making public announcements.

At the end of the day, the attention that Methbot has generated reinforces that SIVT filtration is critical in digital audience and campaign measurement – and equally important as the industry moves toward making cross-platform measurement the new standard. As media buyers and sellers evaluate critical KPIs such as reach, UVs, GRPs and TRPs, these measures must reflect the true impact on human consumers before TV and digital can speak the same language. Luckily, with advanced techniques in measuring and combatting SIVT, we are keeping ahead of the new schemes that emerge and reporting clean metrics today – not only for digital, but for audiences across platforms.