{"id":82005,"date":"2025-03-09T09:00:30","date_gmt":"2025-03-09T09:00:30","guid":{"rendered":"https:\/\/www.cryptocabaret.com\/?p=82005"},"modified":"2025-03-09T09:00:30","modified_gmt":"2025-03-09T09:00:30","slug":"ad-funded-piracys-biggest-open-secret-revealed-by-researcher","status":"publish","type":"post","link":"https:\/\/www.cryptocabaret.com\/?p=82005","title":{"rendered":"Ad-Funded Piracy\u2019s \u2018Biggest Open Secret\u2019 Revealed By Researcher"},"content":{"rendered":"

\"launder-manga-s\"Tranco publishes an updated ranking list<\/a> of a million domains every day. <\/p>\n

In today\u2019s report the usual suspects dominate the top slots \u2013 google.com, microsoft.com, mail.ru and facebook.com. After scrolling through a 22mb .cvs, monosurveys.com eventually completes the million.<\/p>\n

Zonatmo.com can be found at #1576 but, until this week, the domain had yet to appear on our radar. During a brief visit to the site lasting less than 20 seconds, there were two attempts to redirect us to well-known malicious IP addresses registered to a host in the UK. That raises immediate questions over the domain\u2019s insane level of traffic and why millions of visitors just keep going back.<\/p>\n

Piracy Juggernaut<\/h2>\n

According to research conducted by DeepSee.io CEO Rocky Moss, Zonatmo.com is no ordinary domain. First and foremost it presents as a manga piracy site, and a very successful one too. In November 2024, Zonatmo and affiliated sites together generated a cool one billion views, all the more impressive for a domain that made its debut just 90 days earlier.<\/p>\n

Moss says that Zonatmo is the latest new domain for a platform called Tu Manga Online, a manga content directory aimed at the Spanish-speaking market. Before Zonatmo.com, the site reportedly used Visortmo.com, lectormanga.com, and before that, lectortmo.com. Other domains are involved too.<\/p>\n

Traffic Laundering<\/h2>\n

\u201cWhen we talk about piracy that\u2019s supported by programmatic display \/ videos ads, we\u2019re often talking about traffic laundering. In a laundering scheme, there are two classes of domains involved,\u201d Moss explains.<\/p>\n

\u2022 Directories<\/strong>: when you type in something like \u2018watch free movies,\u2019 or \u2018read manga online,\u2019 chances are you\u2019ll be taken to a directory. These are sites that connect you to the pirated content you\u2019d like to consume. They are often easy to find using search (by necessity; they have to change domain names often)<\/em><\/p>\n

\u2022 Laundering fronts<\/strong>: These appear as \u2018clean\u2019 when you visit them directly, but are usually actively managed by the folks behind the directories. They have hidden behaviors that only present themselves if you visit via some prescribed source (the directory). These sites are often able, for at least a short time, to monetize using CPM based ad products [advertisers pay a fixed rate per thousand impressions] such as display \/ video \/ audio ads.\u201d<\/em><\/p>\n

Moss says this scheme has been running for years and over that time, 112 domains have been used to launder site traffic, typically with one or two dozen active at a time.<\/p>\n

Unusually Open<\/h2>\n

To show that these domains are all linked to the same business, Moss says that a key signal is when domains share 100% of their ads.txt files<\/a> with each other; in this case, those files have around 15K lines. Further support of collaboration can sometimes be found in joined privacy policies. <\/p>\n

That\u2019s where another unusual feature becomes evident; there appears to be little or no effort to obscure the name of the company or people involved. Moss describes Nakamas Web SL as a Spanish company responsible for both the main manga site and the \u2018clean\u2019 front sites.<\/p>\n

\u201cClearly Nakamas Web has found a roster of managers \/ sales houses \/ resellers who don\u2019t look too closely at the quality of the inventory they bring to buyers, and thus they\u2019ve had luck laundering their traffic for years,\u201d he notes.<\/p>\n

\u201cAt a high level, it appears the site operators have had to adapt every few months, or every year at least, in order to find a new roster of sellers who don\u2019t know\/care about the way their traffic is sourced.\u201d<\/p>\n

A Lucrative Scheme<\/h2>\n

Moss goes into considerable detail on the various players involved and specifics relevant to the advertising market. Those details include whether various rules may have been skirted or ignored, and how certain scenarios may have helped the scheme to last for so long. <\/p>\n

Links to the research, an explanatory video, and a fairly hefty spreadsheet, can be found below. That leaves the big question; is a scheme like this profitable and if so, what\u2019s the best estimate?<\/p>\n

In broad terms, the formula takes the billion views generated in November across all sites, and factors in a 50% ad-blocking rate. Based on two ad units per a page and an industry hunch here and there, Moss emerges with a conservative estimate of $200,000 per month revenue. He does concede, however, that it could be ten times that amount.<\/p>\n

\u201c[We could be] talking tens of millions, certainly some of that goes to server costs and they have to, you know, always be rotating their demands. It\u2019s not trivial to do this but clearly the juice is worth the squeeze,\u201d he adds.<\/p>\n

\u201cIt\u2019s been going for years and it has not been stopped so what is it with this \u2018Open Secret\u2019 and why is allowed to thrive? My projection is that by the end of the year, it will not.\u201d<\/p>\n

The research is available here<\/a> and the spreadsheet here<\/a>.<\/p>\n<\/p>\n

<\/center><\/p>\n

From: TF<\/a>, for the latest news on copyright battles, piracy and more.<\/p>\n

Powered by WPeMatico<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":"

Tranco publishes an updated ranking list of a million domains every day. In today\u2019s report the usual suspects dominate the top slots \u2013 google.com, microsoft.com, mail.ru and facebook.com. After scrolling through a 22mb .cvs, monosurveys.com eventually completes the million. Zonatmo.com can be found at #1576 but, until this week, the domain had yet to appear […]<\/p>\n","protected":false},"author":2,"featured_media":82006,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[308],"tags":[],"class_list":["post-82005","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-torrent"],"_links":{"self":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/82005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=82005"}],"version-history":[{"count":0,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/82005\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/media\/82006"}],"wp:attachment":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=82005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=82005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=82005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}