AdSense blackmailer – Bitcoin or blocking of the account!

M.Sc. Chris Wojzechowski

AdSense blackmailer – Bitcoin or blocking of the account!

So-called AdSense blackmailers are targeting the function with which operators of a website can earn money. It has been a successful business model for years, and some site operators and media houses can still (survive) on it. Google integrates banners on the website. If these are clicked, the website operator receives a share. Criminals use this dependency and send blackmail attempts to websites that would be severely affected by a potential failure. The claim amounts to USD 5,000. If this is not paid, the AdSense account will be blocked.

A targeted AdSense manipulation rarely takes place in practice!

A lot of things on the Internet are data-driven. Among them is the advertising system of Google. To place advertising on Google an AdWords account is necessary. In order to integrate advertising, and thus earn money proportionately, AdSense is necessary. If the search engine giant finds an irregularity, the account will be blocked. That is at least the acceptance of the blackmailers and the threat to the victims. So here is not threatened at all with the publication of a secret, as it is often the case with other extortion mails – it is threatened to block the AdSense account. A loss of income or missing days in the calculation would be the consequence.

With the help of bots, which suddenly visit the website and click on links, the suspicion of manipulation should be established. Since Google pays the website operator for each click, the willingness on the part of Google to block highly fraudulent users is highly suspect. The AdSense blackmailers take advantage of this – because at least in the short term the advertising revenues of victims can be blocked in this way. The blackmailing model is based on this principle. Either pay 5,000 USD or run the risk of the account being blocked and in the worst case even more money is lost.

AdSense blackmailers have a hard time with the precautions of Google

An official statement from Google itself says that although the potential for sabotage is great, in practice it is extremely rare. Additional security measures help to filter out the invalid traffic. The company concerned, which reported this case to Brian Krebs, noticed an increase in invalid traffic in any case. For publishers there is also a contact form. This can be used to report invalid traffic – this way you can avoid an AdSense blackmailer. A potential blackmailing email reads as follows:

“Very soon the warning notice from above will appear at the dashboard of your AdSense account undoubtedly! This will happen due to the fact that we’re about to flood your site with huge amount of direct bot generated web traffic with 100% bounce ratio and thousands of IP’s in rotation – a nightmare for every AdSense publisher. More also we’ll adjust our sophisticated bots to open, in endless cycle with different time duration, every AdSense banner which runs on your site. Next an ad serving limit will be placed on your publisher account and all the revenue will be refunded to advertisers. This means that the main source of profit for your site will be temporarily suspended. It will take some time, usually a month, for the AdSense to lift your ad ban, but if this happens we will have all the resources needed to flood your site again with bad quality web traffic which will lead to second AdSense ban that could be permanent!”

Photo of author

M.Sc. Chris Wojzechowski

My name is Chris Wojzechowski and I studied my Master in Internet Security in Gelsenkirchen a few years ago. I am one of two managing directors of AWARE7 GmbH and a trained IT Risk Manager, IT-Grundschutz practitioner (TÜV) and possess the test procedure competence for § 8a BSIG. Our bread and butter business is performing penetration testing. We are also committed to promoting a broad understanding of IT security in Europe, which is why we offer the majority of our products free of charge.