Listen to this Post
Introduction:
In a shocking revelation that exposes the dark underbelly of digital advertising, cybersecurity expert María Aperador Montoya has published findings from an extensive investigation into Meta’s advertising ecosystem. Analyzing over 126,570 ads, the research uncovered 8,622 suspected frauds operating through 877 Facebook pages and six coordinated networks. While Meta projects it will earn a fortune from these illicit advertisements—potentially 10% of its 2024 revenue—the technical infrastructure behind these scams reveals a sophisticated, multi-layered operation designed to evade detection, harvest data, and defraud users at scale.
Learning Objectives:
- Understand the technical infrastructure and evasion tactics used by coordinated ad fraud networks.
- Learn how to perform OSINT and forensic analysis on suspicious Facebook pages and domains.
- Identify homoglyph attacks, domain rotation, and emotional engineering techniques used in social media scams.
You Should Know:
- The Scale of the Infrastructure: Mapping the Fraud Network
The investigation identified 877 implicated Facebook pages operating in coordinated clusters. One network consisted of 34 pages utilizing 42 distinct domains and over 10,000 combined ads. This indicates a sophisticated operation using domain rotation and page redundancy to survive takedowns. To analyze such infrastructure, investigators use OSINT techniques including WHOIS lookups, reverse IP searches, and SSL certificate transparency logs.
Step‑by‑step guide to mapping suspicious ad infrastructure:
1. Extract domain from suspicious ad and perform WHOIS lookup whois suspicious-domain.com | grep -E "Registrar|Creation Date|Name Server" <ol> <li>Check for historical DNS records using SecurityTrails API or CLI curl -X GET "https://api.securitytrails.com/v1/domain/suspicious-domain.com/history/dns/a" -H "APIKEY: YOUR_KEY"</p></li> <li><p>Find other domains hosted on same IP using Reverse DNS host 192.168.x.x nslookup 192.168.x.x</p></li> <li><p>Check SSL certificate transparency logs for related domains curl -s "https://crt.sh/?q=%.suspicious-domain.com&output=json" | jq '.[].name_value'</p></li> <li><p>Map relationships using Maltego or SpiderFoot for visual link analysis
- The “Dегilа” Technique: Homoglyph Evasion and Character Spoofing
One of the most technically sophisticated findings was a product named “Dегilа” that mixes Cyrillic characters with Latin script (e.g., using Cyrillic ‘е’ (U+0435) instead of Latin ‘e’ (U+0065)). This homoglyph attack bypasses automated content moderation filters that rely on string matching. The same technique is used in domain names to create visually identical but technically different URLs for phishing.
How to detect homoglyph attacks:
Python script to detect mixed-script strings
import unicodedata
def detect_homoglyph(text):
for char in text:
if 'Cyrillic' in unicodedata.name(char, ''):
print(f"Cyrillic character detected: {char} (U+{ord(char):04X})")
scripts = set(unicodedata.script(char) for char in text)
if len(scripts) > 1:
print(f"Mixed scripts detected: {scripts}")
detect_homoglyph("Dегilа")
3. Rapid Dissection: The 209-Ad Sprint Technique
Fraudsters operate “disposable pages” that launch up to 209 ads, harvest user data for half a day, and vanish. This rapid burn strategy requires automated ad creation and form submission bots. Defenders must implement real-time monitoring and behavioral analysis rather than relying on batch processing.
Windows PowerShell script to monitor for rapid page creation patterns:
Monitor Facebook page creation patterns (simplified example)
$url = "https://graph.facebook.com/v18.0/"
Use Facebook Graph API to check page creation dates
$pages = @("page_id1", "page_id2")
foreach ($page in $pages) {
$response = Invoke-RestMethod -Uri "$url$page?fields=id,name,created_time&access_token=YOUR_TOKEN"
if ([bash]$response.created_time -gt (Get-Date).AddDays(-1)) {
Write-Warning "Newly created page detected: $($response.name)"
}
}
4. Emotional Engineering and Fake Testimonials
Scammers fabricate 2,000-word testimonials mentioning real hospitals and locations to bypass spam filters. These narratives are often generated using AI language models and include localized references to appear authentic. Investigators use stylometry and linguistic analysis to detect machine-generated text.
Using stylometry analysis with Python:
from textstat import textstat
import language_tool_python
tool = language_tool_python.LanguageTool('en-US')
def analyze_testimonial(text):
Check reading ease (scams often score differently)
ease = textstat.flesch_reading_ease(text)
Check for repetitive patterns
matches = tool.check(text)
grammar_errors = len(matches)
Check sentiment consistency
if ease > 70 and grammar_errors < 2:
print("Potential AI-generated or overly polished text")
sample = "I was healed at Johns Hopkins Hospital..." Example fake testimonial
analyze_testimonial(sample)
5. Cluster Analysis: Identifying Coordinated Networks
The discovery of six coordinated fraud networks required graph analysis of shared infrastructure: identical ad copy, overlapping IP addresses, common payment processors, and shared tracking pixels. Using NetworkX in Python, investigators can map these relationships.
Network analysis script:
import networkx as nx
import matplotlib.pyplot as plt
G = nx.Graph()
Add edges between pages sharing the same domain
G.add_edges_from([("Page1", "DomainA"), ("Page2", "DomainA"),
("Page3", "DomainB"), ("Page4", "DomainB")])
Detect communities (fraud clusters)
communities = nx.community.greedy_modularity_communities(G)
for i, community in enumerate(communities):
print(f"Cluster {i}: {community}")
6. Economic Incentives: Why Meta Allows the Fraud
Reuters documents reveal Meta projected 10% of its 2024 revenue would come from ads for scams and banned goods. This economic dependency creates a conflict of interest where detection technology exists but deployment is deprioritized. From a technical standpoint, this means defenders cannot rely solely on platform reporting—they must use independent verification.
Checking ad transparency data via Meta Ad Library API:
curl -G \ --data-urlencode "search_term='Stihl discount 90%'" \ --data-urlencode "ad_type=POLITICAL_AND_ISSUE_ADS" \ --data-urlencode "ad_reached_countries=['US']" \ --data-urlencode "access_token=YOUR_TOKEN" \ https://graph.facebook.com/v18.0/ads_archive
What Undercode Say:
- Key Takeaway 1: Ad fraud is not random crime but organized, technically sophisticated infrastructure using domain rotation, homoglyphs, and AI-generated content to evade detection. Investigators must adopt graph analysis and OSINT methodologies to map these networks.
- Key Takeaway 2: The economic model of social platforms is fundamentally misaligned with user safety. When 10% of revenue comes from fraudulent ads, detection becomes a business decision rather than a technical capability. This demands regulatory intervention and independent auditing.
Analysis: The investigation reveals a cybersecurity blind spot where platform-scale meets criminal-scale. The technical sophistication—from Cyrillic homoglyphs to disposable page farms—mirrors nation-state APT tactics but is deployed for consumer fraud. Defenders are fighting an asymmetric war: fraudsters innovate evasion techniques faster than platforms deploy detection, because detection would cannibalize revenue. The solution lies not in better AI filters alone, but in financial disincentives: holding platforms financially liable for fraud they profit from. Until then, users must treat every “too good to be true” ad as a potential breach waiting to happen.
Prediction:
As detection improves, fraudsters will increasingly leverage generative AI to create unique ad creatives per user, personalized deepfake testimonials, and real-time landing page generation that passes automated checks. We will see the rise of “ad fraud as a service” platforms using LLMs to automate the entire scam lifecycle—from copywriting to domain registration to payment harvesting—making takedowns futile unless payment processors and registrars enforce stricter verification. The next frontier will be adversarial AI fighting adversarial AI, with the platform’s profit margin caught in the crossfire.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Maria Aperador – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
