A new botnet known as the 'Bahama botnet' has caused a sharp spike in click fraud because it's able to defeat the most sophisticated filters of search engines, web publishers and ad networks, according to a web-monitoring company.

Click Forensics, which provides services to monitor advertising campaigns for click fraud and reports on click fraud incidence every quarter, said the botnet's architects have figured out a way to mask it particularly well as legitimate search ad traffic.

Click Forensics is calling this the 'Bahama botnet' because initially it was redirecting traffic through 200,000 parked domains in the Bahamas, although it now is using sites in Amsterdam, the UK and Silicon Valley.

The problem of click fraud

Click fraud affects marketers who spend money on pay-per-click (PPC) advertising on search engines and web pages. It happens when a person or a machine clicks on a PPC advert with malicious intent or by mistake.

For example, a competitor may click on a rival's PPC ads in order to drive up their advertising spending. Also, a rogue web publisher may click on PPC ads on its site to trigger more commissions, which is probably what's behind the Bahama botnet.

Click fraud also includes nonmalicious activity that nonetheless yields a click of little or no value to the advertiser, such as when someone clicks on an advert by mistake or two consecutive times.

Click Forensics has been warning recently that click fraud scammers are increasingly resorting to botnets, which are networks of computers that have been secretly compromised for a variety of malicious tasks.

The Bahama botnet is masking the source of its clicks to convince click-fraud filters they are coming from high-quality, legitimate sources, such as US libraries and schools. The botnet is also altering the "interval and breadth" of the attacks from the compromised PCs, according to Click Forensics.

Bad news for advertisers

In a piece of extremely bad news for advertisers running PPC campaigns, Click Forensics has seen worst-case scenarios in which as much as 30 percent of a monthly ad budget is swallowed by Bahama botnet click-fraud traffic.

Ordinary users' PCs are made part of the Bahama botnet with malware. Click Forensics found links to the malware in search results for queries about the non-existent Facebook Fan Check virus.

Last week, security company Sophos and Facebook both warned that malicious hackers were setting up malware-infested websites that falsely claimed to remove a non-existent virus from a new Facebook application called Fan Check.

False rumours spread that Fan Check infected PCs with malware, so scammers tried to capitalise on the concern that many Facebook members had about the application.

As Facebook members used popular search engines to find antivirus information about Fan Check, they got results that pointed to sites that offered false virus removal kits and instead infected their computers with malware.

Click Forensics also said the botnet malware is "extremely similar" to the 'scareware' program found in malicious ads that The New York Times was tricked into serving up on its website last weekend. Before the Times eliminated them, the adverts displayed pop-up messages falsely telling users their PCs were infected so they would buy a fake anti-virus program.

Click Forensics is in contact with major search engines, ad network providers, advertisers, publishers and security companies regarding the Bahama botnet and ways to address it.

Neither Google nor Yahoo, which operate the two largest search engines and PPC ad networks, immediately responded to a request for comment.

Broadband speed test

PC security advice

See also: Click fraud Trojan cheats Google Adsense