GOOD MONEY STILL GOING BAD: DIGITAL THIEVES AND THE HIJACKING OF THE ONLINE AD BUSINESS

A FOLLOW-UP TO THE 2013 REPORT ON THE PROFITABILITY OF AD-SUPPORTED CONTENT THEFT

MAY 2015 A safer internet is a better internet ACKNOWLEDGMENTS APPENDICES SUMMARY AND RECOMMENDATIONS ANALYSIS TRENDS KEY OF BAD GOING STILL MONEY GOOD SUMMARYEXECUTIVE REPORT THIS ABOUT REFERENCES TABLE OF CONTENTS CONTENTS Appendix F: Ad Networks Serving Content Theft Sites Theft Content Serving F: Ad Networks Appendix E:Appendix Premium on Appearing Brands Sample Sites Sites D: Appendix Studied Appendix C: Page Views and Unique Visitors Revenue B: Segment Appendix Detail Appendix A: Methodology Problems for Premium and Brands Secondary Theft Content Cycles in Growth and Whack-a-Mole Fraud and Impression Laundering Malware StreamingVideo Fuels a Growing Revenue Stream—and Threat Tables Figures ...... 3 2 29 2 2 10 14 14 13 3 11 iii iii iii 0 0 8 8 9 9 4 3 3 2 ii 1 1

GOOD MONEY STILL GOING BAD ii TABLE OF REFERENCES FIGURES

Figure 1: Example BitTorrent Portal (torrentreactor.com)...... 4

Figure 2: Example Linking Site (cokeandpopcorn.ch)...... 5

Figure 3: Example Video Streaming Host (vidbull.com)...... 6

Figure 4: Example DDL Host (4shared.com)...... 7

Figure 5: Estimated growth in video ad spending...... 8

Figure 6: Projected Online Video Ad CPMs...... 8

Figure 7: Software download link on zumvo.com...... 9

Figure 8: Virus detected on zumvo.com...... 9

Figure 9: Extratorrent.cc, large BitTorrent portal...... 11

Figure 10: Extratorrent.com to .cc Trend...... 11

Figure 11: Percent of sites displaying ad types...... 12

Figure 12: PIPCU Operation Creative replaces ads with warnings on content theft sites...... 13

Figure 13: 2014 Sites by Functional and Size Segments...... 14

Figure 14: Comparison of 2013 and 2014 samples by functional segment...... 21

Figure 15: Comparison of 2013 and 2014 samples by size segment...... 21

Figure 16: Comparison of 2013 and 2014 revenue by functional segment...... 22

Figure 17: Comparison of 2013 and 2014 revenue by site size...... 22

TABLES

Table 1: Q3 Aggregate Annual Ad Revenue, Margin for Ad-Supported Sites...... 3

Table 2: Torrent Portal Average/Aggregate Results...... 4

Table 3: Linking Sites Average, Aggregate Results...... 5 iii

Table 4: Video Streaming Host Average, Aggregate Ad Revenue...... 6

Table 5: DDL Host Sites Average, Aggregate Ad Revenue...... 7

Table 6: Q3 2014 Average Site Performance by Segment...... 20

Table 7: Q3 2014 Aggregate Site Performance by Segment...... 20

Table 8: Year-to-year comparison of page views and unique visitors by functional and size segment...... 23 GOOD MONEY STILL GOING BAD STILL GOOD MONEY nue source” for the top 250 unauthorized sites. sites. unauthorized 250 top for source” the nue revenues all, not if for some, Europe rely in sites advertising on theft protection firm Incoprothat 88% ofthe most popular content Webreathe. new from know multi-hundred business. dollar million enforcement pursuing content thieves. apps with streaming for law Live of even challenges greater beginning the mark could viewers. 10,000 had fight the of feed one that CNN reported access. forfight were charging which HBO, and away viewers Showtime from of would-be sands thou siphoning coverage, Some fight live the stream to apps the fight. Pacquiao used apps, legitimate both Periscope, and of Meerkat users Mayweather-Manny Floyd 2015 May the raises new challenges for content owners, as illustrated by to pursue them. more money, and it is becoming even harder for authorities make can sites even smaller that is upshot The rates. vertising ad video of higher advantage to take lows thieves content al This universe. theft content to the important more much and technology industries—found streaming sites becoming strategic direction to the media, advertising, entertainment, and counsel critical provides that firm advisory diaLink—an Me dollars. ad audience—and the tohave chase adapted thieves content sites, legitimate through content suming delivered. is content way stolen the is biggest there were some major changes in this “industry.” One of the piracy— online as known theft—also of content business big the investigated first LLC MediaLink and Alliance Citizens tal Digi since year revenue. the In advertising in ayear dollars upserving stolen content generate hundreds of millions of The first ABOUT THIS REPORT Ad revenue is the oxygen that allows content theft to to theft allows content that oxygen Ad revenue the is a remains theft content changed: not has thing one But also technology video of streaming adoption Consumer of con means preferred the become has streaming As Good Money Gone Bad . Incopro called advertising the “predominant reve “predominant the advertising called . Incopro research by the online rights rights online byresearch the report found that the top sites sites top the that found report ------those efforts and hope these these additional hope and those efforts insights encourage launched initiatives to address these issues. We commend safety. for consumer concerns new troubling poses development This song. or movie to a“free” listening or ing to by watch simply are exposed consumers unwitting that es virus other of malware and risk the theft: to content side dark thieves reap. content profits advertising the estimate to seeks rather but harm, economic that on not focuses study This magnitude. These content. of the owners by the incurred losses the with equate from companies. American operators harming legitimate brands as they steal millions such industry-led initiatives in the ongoing fightagainst rogue for is it how important just again shows research This thieves. to content linked by being are damaged that brands the tect pro and marketplace the in we see inventory corrupt the back scale to designed effort smart a is This Providers. ance Assur Advertising Digital as from TAG certification earn and those ad placements can have their technologies validated, limit or block to tools offer that Companies content. pirated or goods counterfeit distribute or promote that websites off signed to help advertisers and their agencies keep their ads de Piracy Against Program Integrity of aBrand launch the TAG 2015, announced (IAB). February In Bureau Advertising Association of Advertising Agencies (4A’s), and the Interactive the Association of National Advertisers (ANA), the American TAG or Group, ability ( for everyone. works that platform open and reliable, more even more activity aimed at making the Internet a stronger, Both the public and private sector worldwide have worldwide sector private and public the Both Separate Digital Citizens research reveals also another The advertising One noteworthy new initiative is the Trustworthy Account losses are unquestionably greater by many orders of of by greater orders many are unquestionably profits https://tagtoday.net garnered by content thieves do not not do thieves by content garnered ), a joint effort by effort joint a ), ------

GOOD MONEY STILL GOING BAD 1 highlights of this study: highlights are Below other fraud. of ad prevalence to malware, the and are exposed who to users danger the ads, brand premium tent theft ecosystem, including the continuing presence of con of the aspects into other insights additional provides size. same the of virtually asample yielded criteria later—yetyear selection same the a for tracking threshold the below dropped or closed had More of than 40%characters. of the 2013 of sample 596 sites cast ever-changing an with are faced problem the to stem working authorities and owners content result, a As off. cut one for each grew heads new two that Hydra mythical the like flourish to back growing copies, spawn simply Others to enforcement. evade and down, shut get do that by those left void the fill to sites new for easy it make quickly mains do to switch of operators ability the and to entry barriers alone. advertising from revenue annual aggregate in million $209 estimated 2013. in examined researchers sites largest of the of some grading turnover in the industry that included the shuttering or de year, previous massive the in as despite revenues for 2014 Money Gone Bad revenues. in of dollars lions of mil hundreds producing business, abig is theft content ad-supported doubt: no is there look, asecond on Based SUMMARY EXECUTIVE sites, often alongside offensive ads. ads. offensive alongside often sites, offending on numbers increasing in up show ads their as threatened to be continues brands of legitimate value and creased industry awareness of the problem, the reputation > sites pirate ad-supported of these analysis MediaLink’s first the in as standards selection same the Using > Premium Brand Advertisers Still at Risk: at Risk: Still Advertisers Brand Premium The 589 sites in the 2014 snapshot generated an an generated snapshot 2014 the in sites 589 The report, MediaLink found nearly the same The content theft industry’s low industry’s theft content The Despite in Good - - - - - or industry initiatives, which have headway. made which initiatives, industry or technical, legal, through is activities these degrade or deter to chance best The theft. content of ad-supported drivers tent theft sites have followed suit. The number of video of video number have The sites followed suit. theft tent con to streaming, downloading from have shifted petites > fraud. and theft on based core is at its that industry for an surprising business—not theft content the in virulent particularly is but awhole, as dustry in the for challenge significant a is This problem. the with to terms to come tried has industry advertising the as year > revenue. annual in millions owners site earn downloads These download. unwanted the to spawn alink on to click even not necessary is it es, hidden behind are links the cases malware. most In other and viruses with computers users’ to infect potential the with links included > The profitability and ease of execution are the primary primary the are execution of ease and profitability The ads. for display those than higher are far that CPMs video to due significantly grew revenue and port, re original the from 40% up was 2014 in sites streaming > > > Video Streaming a Growing Model: Model: aGrowing Streaming Video Fraud: Malware Threatens Consumers: Ad fraud has been in the spotlight over the past past over the spotlight the in been has Ad fraud Download or or Play buttons, but in many cas many in but buttons, One-third of the sites As consumer ap consumer As - - - - -

GOOD MONEY STILL GOING BAD 2 from 86% to as high as 93%. 93%. as high to as 86% from ranged and 89.3%, were advertising by only supported sites for margins profit average Estimated segment. Streaming eo Vid the in and sites, medium and small among by growth offset was sites those of fall The 2013. in revenue ad in million $44.3 BitTorrent acombined large seven generated that sites of loss the even after million, $209 was sites of 589 sample content. video stream that for those ingly increas BitTorrent and sites, for large Linking especially and malware links. side along and sites theft content on appear ads their when aged are dam reputations whose and consumers, to most familiar derscoring the to need protect brands’ reputations and value. un further overall, of sites 15% about before, on year and the 28.9% vs. sites large of 32.3% on appeared brands Premium visibility. public increased and efforts industry despite 2014, sample the in sites on appeared ads away. gone had that those as newsites many as there were criteria, the would fit 2014 Q3 in operating sites what to see process original the used researchers when But sample. 2014 for cut the the make didn’t they that smaller much so or weresites gone of the percent Forty-four decline. in was theft content ed Money Gone Bad 2013’s in studied sites 596 the today to visit you tried If MONEY GOOD The estimated aggregate annual ad revenue for the 2014 2014 revenue ad for the annual aggregate estimated The Ad-supported content theft remains extremely lucrative, Premium brands are those easily recognizable companies Meanwhile, the number of recognizable brands whose research, you might think that ad-support STILL increased from 2013 to to 2013 from GOING BAD GOING Good ------BITTORRENT AND OTHER P2P PORTALS SEGMENT SITES FOR AD-SUPPORTED MARGIN TABLE Q3 AGGREGATE 1: AD ANNUAL REVENUE, DIRECT DOWNLOAD (DDL)HOST SITES LARGE MEDIUM SMALL VIDEO STREAMING HOST SITES LARGE MEDIUM SMALL LINKING SITES LARGE MEDIUM SMALL LARGE MEDIUM SMALL

2014 REVENUE $25,831,850 $23,168,330 $22,436,923 $13,265,567 $23,707,625 $16,619,720 $48,435,312 $10,117,644 $5,394,263 $9,261,702 $8,837,813 $1,465,216

2013 REVENUE $92,725,008 $12,908,635 $33,405,782 $14,763,659 $12,336,493 $18,646,142 $17,993,378 $6,725,908 $1,604,348 $5,125,377 $8,317,337 $2,117,922

2014 MARGIN 90.0% 86.6% 90.3% 89.2% 87.0% 93.3% 91.9%

2013 MARGIN 89.8% 85.9% 79.9% 79.9% 84.5% 87.5% 94.1%

GOOD MONEY STILL GOING BAD 3 8.3% of medium (13.9%) and 12.5% of large (13.3%) sites. (13.3%) of large 12.5% and (13.9%) of medium 7.5%),8.3% (vs. small of 9.8% on appeared brands premium size, By (9.7%). 2013 as sites) the of (9.6% 2014 in levels same the at virtually appeared ads brand premium content, of stolen sample aggregate the of 2013. in 40.9% revenue vs. 23.2% represented portals BitTorrent the Large of 2013. in revenue million 24.2% $114 the of from 50.3% and down sample was That million. $79.7 or revenue, ing advertis the of 38.2% for accounted and 2014 in sites sample content infringement. using BitTorrent technology, the most common method for sharing file enable that links provide sites These 92%. about largest sites have the highest average operating margins, revenue overall than any of the other segments, and the ad more generated still BitTorrent sites, large seven portals of the loss the BitTorrent using Despite commonly software. most Internet, the across computers users’ many on stored are that files of sharing (P2P) peer-to-peer offer sites These PORTALS P2P OTHER AND BITTORRENT Despite BitTorrent continued portals’ notoriety as sources 589 the of 23.1% comprised portals BitTorrent 136 The FIGURE 1: EXAMPLE BITTORRENT PORTAL BITTORRENT (TORRENTREACTOR.COM) EXAMPLE 1: FIGURE - LARGE MEDIUM SMALL AGGREGATE QUARTERLY RESULTS LARGE MEDIUM SMALL AVERAGE QUARTERLY RESULTS SEGMENT TABLE 2: TORRENT PORTAL AVERAGE/AGGREGATE RESULTS

2014 REVENUE $12,108,828 $2,209,453 $5,609,231 $1,513,604 $155,812 $24,016 2013 REVENUE $23,181,252 $2,079,334 $3,227,159 $1,545,417

$89,643 $22,358 2014 MARGIN 86.6% 90.3% 93.3%

2013 MARGIN 85.9% 84.5% 94.1%

GOOD MONEY STILL GOING BAD 4 medium (17.1%) and 20.0% of large (28.6%) sites. of (17.1%) (28.6%) of 20.0% large medium and 20.0% 10.2%), (vs. small of 14.3% on appeared brands um premi size, year.By previous the 11.7% with compared 2014, grew by 30%. sites for large and doubled nearly sites revenue for small age aver as million, at $66 steady fairly revenue held aggregate Users click on tolinks download the Despitefiles.Internet. the decline, the on elsewhere hosted are that files of rectories accounting for 40.9% of total the sample. Sites Linking are di this still was the largest segment overall, with the 241 sites year-to-year, 15% but dropped Sites Linking of number The LINKING SITES Premium brands appeared on 15.4% of Linking Sites in in Sites Linking of 15.4% on appeared brands Premium FIGURE 2: LINKING EXAMPLE SITE (COKEANDPOPCORN.CH) - - - LARGE MEDIUM SMALL AGGREGATE QUARTERLY RESULTS LARGE MEDIUM SMALL AVERAGE QUARTERLY RESULTS SEGMENT TABLE SITES AVERAGE, LINKING 3: AGGREGATE RESULTS

2014 REVENUE $5,792,083 $6,457,963 $4,154,930 $830,986 $161,449 $29,551 2013 REVENUE $3,690,915 $4,498,344 $8,351,446 $203,694 $642,621

$15,706 2014 MARGIN 90.0% 89.2% 87.0%

2013 MARGIN 89.8% 79.9% 87.5%

GOOD MONEY STILL GOING BAD 5 ae wt 3.% f ag, 54 o mdu ad .% of 8.8% and 2013. in sites small medium of 15.4% large, of 33.3% with pared com Hosts, Streaming Video small of 6.3% and medium, segment. the sizes in for of sites all up was income Average quarterly ads. for video CPMs higher as well to entry, as to low barriers part in attributable sites, medium in increase 34.6% a and sites small of number the in increase $27.5 and million). 12.1% (vs. million $46.2 or revenue, annual aggregate the of 22.2% for accounted and study), year’s previous the in 12.6% ers to download it. They represented 17.8% of the sample (vs. us of requiring instead pages within content the play they however content, of available are directories also These revenue ad growth. showed that only segment 2013—the from significantly increased generated they revenue the and sites of streaming previously, noted number As the both SITES HOST STREAMING VIDEO rmu bad apae o 2.% f ag, 14 of 11.4% large, of 28.6% on appeared brands Premium 85.3% an reflects revenue for 2014 segment in growth The FIGURE 3: VIDEO EXAMPLE STREAMING HOST (VIDBULL.COM) - - sites offer subscription access, requiring infrastructure for for infrastructure requiring access, subscription offer sites LARGE MEDIUM SMALL AGGREGATE QUARTERLY RESULTS LARGE MEDIUM SMALL AVERAGE QUARTERLY RESULTS SEGMENT REVENUE AD AGGREGATE AVERAGE,TABLE HOST STREAMING VIDEO 4: directly related to advertising revenue. to advertising related directly account management, e-commerce and storage that is not Margins are not reported here because a number of the of the anumber because here reported are not Margins

2014 REVENUE

$5,926,906 $3,316,392 $2,315,425 $846,701 $94,754 $36,753

2013 REVENUE $4,661,535 $1,681,477 $529,480 $310,769 $64,672 $15,573

GOOD MONEY STILL GOING BAD 6 medium and 26 . 8% of small DDL s, compared with 50% of l arge, arge, l of 50% with compared s, DDL small of 8% 22.9% of . medium and of 39.2% small DDLs 26 the year before. and medium or revenue. 8.4% advertising annual in million and $19.2 sample, the of 15.8% were per DDLs 2013, million In $16.9 year. or revenue, ad annual aggregate of 8.1% reported here. are not margins revenue, their to advertising tied directly not support user management, e-commerce, and storage and speeds. download increase and of ads rid to get monthly subscription fee that generally ranges from $5 to $15 a for accounts premium offer sites the and pages, download and upload on are Ads displayed sites. Streaming Video or directly, Linking via or streamed or downloaded be can that content host cyberlockers, as known also DDLs, tion-based. subscrip are revenue primarily ad but some generate DDLs SITES DOWNLOAD HOST (DDL) DIRECT Premium brands appeared on 54.5% of large, 8 percent of of of 8 percent large, 54.5% on appeared brands Premium for accounted and sample the of 18.1% comprised DDLs to are scaled operations and infrastructure DDLs’ Because FIGURE 4: EXAMPLE DDL HOST (4SHARED.COM) HOST DDL EXAMPLE 4: FIGURE - revenue type can be found in Appendix B: Segment Rev Segment B: Appendix in found be can revenue type LARGE MEDIUM SMALL AGGREGATE QUARTERLY RESULTS LARGE MEDIUM SMALL AVERAGE QUARTERLY RESULTS SEGMENT REVENUE AD TABLE SITES AVERAGE, HOST DDL 5: AGGREGATE enue Detail. Detailed breakdowns of revenue by segment, size and of revenue breakdowns by segment, Detailed

2014 REVENUE

$1,348,566 $2,529,411 $366,304 $229,946 $53,943 $5,159 2013 REVENUE $3,084,123 $1,281,344 $401,087 $385,515 $36,610 $7,864

-

GOOD MONEY STILL GOING BAD 7 1 data from video ad platform Turn. platform ad video from data citing forIntelligence, display, $1 to BI less or vs. according range, $8-$12 are the in CPMs video Average global banners. per cost or (CPM views 1,000 pay per advertisers that amount the two years (Figure 5). next the over 60% nearly increase would spending ad video that to eMarketer, projected according time, which that in 41.9% grew spending ad video digital US And 82%. gering astag to 28.7 billion, billion grew views 15.8 from ad video of number the data, to comScore according period, same that In television. are on they as attention—just users’ ing attract at online effective more are which ads, video to ners comScore Video Metrix. from data to according 2013, May in billion 40.9 from 14% up Americans watched billion 46.6 video streams in March 2014, TVs. connected and PCs phones, tablets, via demand on it to consuming video downloading from by shift users’ driven is This content. stolen distribute that those like services gal ille for and others, and Hulu Netflix, like services legitimate did revenue. their year-over-year declined as segments both in of sites number revenue, ad however and views, the page visitors, most the to 68.2% up to have BitTorrent continued sites Linking million. and was $46.2 revenue aggregate and segment, the in for sites doubled Average revenue site than more of sites. ber num the in increase 40% a and CPMs video by higher fueled revenue grew to 2013 from 2014, which in only one the was sites. theft for content opportunity Video streaming has become a tremendous revenue growth THREAT STREAM—AND REVENUE VIDEO STREAMING FUELS A GROWING ANALYSIS OF TRENDS KEY emarketer.com/Article/US-TV-Ad-Market-Still-Growing-More-than-Digital-Video/1010923 US TV Ad Market Still Growing More than Digital Video, eMarketer, June 12, 2014, http://www. 2014, 12, June eMarketer, Video, Digital than More Growing Still Market Ad TV US As with any other commodity, demand drives price, and and price, drives demand commodity, any other with As Meanwhile, advertisers are shifting from traditional ban for both exploding, is for streaming market online the First, This shift mirrors several interconnected, broader trends. segment Sites Host Streaming Video above, noted the As mille ) of a video ad is significantly greater than for digital digital for than greater significantly is ad video a of ) 1 2 Pre-roll CPMs in Q4 2014 Q4 2014 in CPMs Pre-roll

- - - - - 3 2

are Streaming Video sites. 111 sites, 239 the Of sample. a 2015 in sites to large medium the to become are poised sites small mostly These sample. primary the in for inclusion threshold were the below fringing in still while that of sites snapshot another examined diaLink more to opportunities reach streaming users. seeking by advertisers paid CPMs higher at the ashot ators oper site theft content offers streams, video the in bedded to eMarketer. $10.08. ry, to 1invento Tier in increase greatest the saw TubeMogul, which to year-over-year, according 24% and Q3 from 9% up were 2011 2010 BY INVENTORY 2010-2017 TIER, AD CPM, VIDEO ONLINE 6: US FIGURE Source: and overlays) andin-text (adsdelivered when usersmouseover relevant words) puters as well as mobilephonesand tablets; includes in-banner, in-stream (suchas pre-roll derived from IAB/PwC data; includes advertigins that appears ondesktop and laptop com Note: % CHANGE DIGITAL VIDEO** % CHANGE TV* %CHANGE) AND (BILLIONS 2012-2018 DIGITAL VS. VIDEO** AD SPENDING, TV* US 5: FIGURE Source: age for onlinedisplay adimpression share Note: 2017 2016 2015 2014 2013 2012 ads-everywhere--increased-ad-spending-will-put-video-ads-on-every-screen-2014- On Every Screen, Bi Intelligence, May 9, 2014, https://intelligence.businessinsider.com/video- TubeMogul Q4 2014 Report, http://more.tubemogul.com/q4_2014_quarterly_report Ads Putting Are Availability Ad Increased And Spending Aggressive Advertising: Video Digital

To explore further the hypothesis of a growth trend, Me em ads with to streaming, downloading from shift this So

Excludes mobiledisplay adimpressions; average CPMcalculated using weighted aver *Includes broadcast TV (network, syndication &spot) &cable TV; **Data through 2013is eMarketer, June 2014 Credit Suisse,“Web 2.012,” Feb 21,2012andeMarketer

INDIRECT $20.50 $25.00 $18.60 $25.00 $16.90 $25.00 $19.60 $25.00 $21.60 $25.00 $22.70 $17.80 $25.00 $16.10 $25.00

3 And the US average is closer to $25, according according to $25, closer is average US the And $64.54 44.5% $2.89 2012 6.4%

$66.35 45.3% $4.20 2013 2.8% MIDTIER $25.00 $68.35 $5.96 41.9% 2014 3.3% $70.59 PREMIUM 30.4% $7.77 2015 3.0% $40.50 $45.00 $36.50 $32.80 $31.20 $31.20 $31.20 $31.20

$73.77 $9.45 21.7% 2016 4.5% $75.98 $78.64 AVERAGE CPM $11.12 $12.71 17.6% 2017 2018 3.0% $26.00 $26.90 $24.60 $25.80 $24.80 $25.30 $25.30 $24.45 14.3% 3.5% ------

GOOD MONEY STILL GOING BAD 8 36% of Linking sites, and 39% of DDLs. of DDLs. 39% and sites, of Linking 36% sites, Streaming Video of 28% sites, P2P of 24% on observed were They overall. sites of 32% on appearing type, common gather personal data, or execute other computer programs. attacks, of service denial launch could that software other for door back a creates that 8) (Figure Trojan a as identified been has that adownload 7launched Figure in screen the of top at the button Player” “Install the For example, clicking without ultimately downloading unwanted some software. content the to tonavigate difficult it find would user typical The updated. to be needed plug-ins other and browser er’s where on the page launched pop-ups warning that the us accepting them. into to users fool incentive have so amajor software, the install or download users when are paid operators site The automatically. download and to launch, aclick even require don’t downloads and pop-ups the cases, many ware. In soft to legitimate update an as or content, to view order in needs told is s/he user the aplug-in promoting popups or links via are presented or buttons, download behind den hid are often They links. of these multiples many included site each cases most in and downloads, software triggered that links carried sites of the however one-third downloads, PPA and involve PPC ads all Not program sample. 2014 the in sites revenue for the annual in million $60 estimated an PPA and generated PPC ads software. installs or downloads and links on clicks auser time each are paid owners site where (PPA) advertising, action” “pay or per (PPC) click” of botnets that perpetrate ad fraud, or steal users’ identities. part make them viruses, with PCs users’ infect can that loads down software malicious and programs unwanted from generating significant revenue for the sites. This threat comes that share stolen content endanger also consumers—while imate advertisers and to the creative community, the sites to legit does theft content that damage to the addition In MALWARE These PPA ads for unwanted software were the most most were the PPA software for unwanted These ads any clicking zumvo.com, where on was example One “pay per called is of what are types downloads These ------FIGURE 8: VIRUS DETECTED ZUMVO.COM ON VIRUS 8: FIGURE DOWNLOAD 7: ZUMVO.COM SOFTWARE ON FIGURE LINK fraudulent means. other and by bots boosted are being counts impression the and theft, content fueling instead is sites legitimate being defrauded. The money they spent to advertise on are they addition, In sites. the on appear also ads whose services illicit the with and itself theft content with ation associ by suffer reputations Their sites. theft content on appear ads their when hit adouble take brands Legitimate FRAUD AND IMPRESSION LAUNDERING -

GOOD MONEY STILL GOING BAD 9 least half of the impressions were laundered on a majority of of amajority on were laundered impressions of the half least At 60. remaining the on available data no was There laun dered. were sample the across impressions the of 60% that 589 2014 the in sites the of 529 on traffic month’s one examined They sites. are seen. never that pay for impressions advertisers creative, ad meaning the to hide code used also vertiser-friendly content, DoubleVerify said. Fraudulent ads ad with sites legitimate on to originate appear ads make the to of redirects aseries through were laundered impressions Ad laundering. impression through amonth million of $6.8 ment web sites that were defrauding advertisers to the tune infringe copyright 1,200 than more identifying 2013 in port even higher. it’s sites, theft For content networks. ad legitimate on nies inserved video ads from one supply-side platform. ob were 62% of levels bot case one in and 23%, at high, as twice was ads for video percentage the said study Ops White ANA/ The members. ANA by 36 181 in campaigns pressions firm WhiteOps, foundthat causedbots 11% of display ad im by the Association of National Advertisers and anti-fraud for an estimated accounts 30% traffic to bot 40% of that ad impressions. estimated have A 2014 associations, study trade at all. visible are not that for ads of impressions lots generating ads, hide otherwise or “stack” of fraud types Other sites. ly bad are on actual they when sites to legitimate are going ads that pear ap it by making impressions to “launder” schemes include also They ads. the place who marketers the from stealing of impressions, millions generate that bots of software use creating huge opportunities for fraud. dig The exploited. be automated, highly and complex is ecosystem can advertising ital that weaknesses offers chain the in changes, networks, publishers, and agencies, and each link may involve ex placement Automated others. or brands um placement of ads on content theft sites, whether for premi DoubleVerify was asked to provide an assessment of the of the assessment to an provide asked was DoubleVerify a re issued DoubleVerify firm effectiveness Advertising And that’s on campaigns for major name-brand compa as well as companies, detection fraud of ad A number the include These of forms. anumber takes Ad fraud from profit ecosystem advertising the in players Many Good Money Gone Bad sample and found ------or dropped below the cutoff point for comScore tracking. tracking. comScore for point cutoff the below dropped or vious livelihoods. and protect rights their challenge for content owners and authorities helping them Hydra-like and ahuge is It by down enforcement. law shut and others shift domains from country to country whenever places, their to up take spring ones new down, are shut sites cycle as by aperpetual marked is industry theft content The THEFT CONTENT IN WHACK-A-MOLE CYCLES GROWTH AND “front” sites. 15% of the sites, on and data, provided DoubleVerify for which sites 529 the the 2014 list entirely. The eight were the P2P sites bitsnoop. sites P2P were entirely. the eight list The 2014 the of out business—dropped the in notorious most of the some million before. year revenuein the $141.7 of 62.5% and sample the of 7.6% from down nue, reve ad aggregate of 47.4% or million $98.9 for accounted sample, 2014 the of 5.3% sites, 31 The 2013. in 45 from down 2014, Q3 in sites on’s were of revenue. large share 31 There fraud. ad and CPMs video higher as well as growth segment reflect increases The 2013. revenue, of the in one-fourth or million, $58 with compared revenue 2014, in of aggregate roughly one-third or million, for $66.9 accounted sites before. year Medium the erated gen of sites number asimilar as much as twice nue, nearly reve aggregate of 20.5% or million $42.8 for accounted ple to significant. startup from grow could sites quickly how reflecting all, at sample 2013 were the in not year’s list this in of 422) (199 sites small the of half nearly of and 136), (46 sites medium of the one-third (10 of 31), sites large of the One-third sample. sizes the in and ment, content companies, and advertisers alike. enforce for law aproblem posing and sites in turnover rapid ology was almost exactly the same size, demonstrating the Even so, the 2014 sample chosen using the same method When MediaLink re-examined the 596 sites from the pre the from sites 596 the re-examined MediaLink When Eight of the 45 large sites in the original sample—including sample—including original the in sites large 45 of the Eight li the to claim continued sites largest the Nevertheless, sam 2014 the of 71.6% comprised that sites small 422 The This challenge is apparent across the range of segments Good Money Gone Bad all of the impressions were delivered through through were delivered impressions of the report, 44% had been shut down down shut been had 44% report,

------

GOOD MONEY STILL GOING BAD 10 ing in Q3 2014 and is not in this year’s sample. this in not is and 2014 Q3 in ing other would-be content infringement sites. It was not operat to available it made and software its even packaged had and shutdown, before for its years domains hopscotched site had The 2015. early in operation resumed but mid-2014, in seized servers its and down shut was It visitors. unique 62 million 2013 the in site largest Bay, Pirate BitTorrent the The was notorious which portal 2014 the in year. 11 of the the end is It by the month per lion 10 mil almost averaged and 2014 January in visitors unique million to grow. 13.5 began reached It territory) Australian an Islands, for Cocos domain (the extratorrent.cc time, that year, About of that to comScore. November in according ing noth to almost dropped 2013, Q3 in visitors unique monthly recover. quickly can followings big with sites but hit, a brief take revenue and traffic Their domains. country-level switch sites—especially big, highly visible, ones—to well-established and authorities. holders copyright by faced challenge significant the of ples exam further names, new with by clones supplanted been However, had of those both extratorrent.com. and 1337x.org sites torrent the including were four now small, and dium sockshare.com. and nowvideo.eu sites Streaming and zerx.ru; and filestube.com sites Linking net; com, isohunt.com and thepiratebay.sx; the DDL freakshare. year to 13.6 million in October 2013 and to less than amil than to less and 2013 October in million toyear 13.6 of that Q3 in visitors unique million 24 from dropped but > sample. 2014 the in 74th the it by site size making uniques, at 3million domain) Tongan (the by 1337x.to May in 2014 replaced only to be 20,000, than to 2013 less October in visitors unique million Bad ey Gone > BitTorrent also both portals: examples, Other the is behavior cyclical of this example notable Another For instance, extratorrent.com, with 6.3 million average for existing up, easy is to it pop continue sites new While to me shrunk 16 had sites, large former remaining the Of > > isohunt.com was the fourth largest site in the 2013 list list 2013 the in site largest fourth the was isohunt.com the in site largest 38th the was 1337x.org Good Money Gone Bad report on Q3 2013. It trailed off from nearly 5 Good Money Gone Bad list. th report with largest site Good Mon ------FIGURE 10: EXTRATORRENT.COMFIGURE TO .CC TREND PORTAL EXTRATORRENT.CC, 9: BITTORRENT FIGURE LARGE included many top ad tech providers who have committed have who committed providers tech ad top many included list The year’s sample. this in sites 589 the serving exchanges and networks ad different 179 than fewer no identified Link revenue. ad capture licitly plexity and automation of the advertising infrastructure to il com increasing of the advantage take sites The sites. theft reputational damage that come from inclusion on content and fraud the of victims all are companies profile lower but Premium, blue-chipcompanies and other equally legitimate SECONDARY BRANDS AND FOR PREMIUM PROBLEMS 14,000 12,000 10,000 8,000 6,000 4,000 2,000 As one telling sign of that complexity, of Media that Veri-Site and sign telling one As sample. the in largest 40th and site year, of that now amedium is ary and Febru in starting isohunt.to as returned It mid-2014. in lion

NOV 2013 EXTRATORRENT.COM JAN 2014

MAR 2014 EXTRATORRENT.CC

MAY 2014

JUL 2014

- - - - SEP 2014

GOOD MONEY STILL GOING BAD 11 Categories that MediaLink identified were: identified MediaLink that Categories brands. secondary or to premium next placed often vices, were: tified Sites. Theft Content Serving F: Ad Networks Appendix in is sites sample the on links most the with brands networks ad of the say, in, Alist users Ukraine. than and ads different seen have would analysts based US- MediaLink’s so cookies, browser in captured as interests by user and by geography targeted often is Advertising Sites. Sample on Appearing Brands Premium E: Appendix in ed the right thing. enormous challenges for even those networks aiming to do are practices, sites’ above, as well fraudulent as discussed sites the of nature cyclical The efforts. theft anti-content to cort and other sexual services, porn, and body part and and part body and porn, services, sexual other and cort > above. discussed prevalence, as their of because these to include important is it ads, video and banners common more like service or for aproduct ads > ser and sites illicit from came studied ads remaining The flation schemes. in of impression part have may turn sites in been those of Many of legitimacy. degrees varying with information, studies, and of news both aggregators to non-premium in links included sites of 20% over just on appeared which > sites the of 3.5% on 10%. reviewed, from down appeared agencies, other or protection by consumer regulated may be of which many services, > before. year 40%reviewed, from down the sites the of 21% some on appeared ads Game software. download or to create accounts users require typically and multi-player warfare, fantasy and other games that > advertisingSecondary categories that MediaLink iden are list analysts by MediaLink observed brands Premium > > > > > Adult Content: Adult Software/Malware Downloads: Sites: Aggregator Content Gambling: Online Gaming: Casual This category includes ads for es ads includes category This These are a range of online single- single- of online are arange These Ads for online gambling and betting betting and gambling for Ads online This broad category, While these are not are not these While - - - - - were identified by Veri-Site. were identified networks ad to video links and sample the in sites on viewed were ads Video make available. they streams into the ads eo vid incorporate also content video stolen stream that sites types. ad identified the of one than more display typically sites these because sites FIGURE 11: PERCENT OF SITES DISPLAYING AD TYPES SITES DISPLAYING OF PERCENT 11: FIGURE ONLINE GAMBLING EASY MONEY PREMIUM ADULT CONTENT CASUAL GAMING AGGREGATION CONTENT OTHER SOFTWARE/MALWARE DOWNLOADS In addition to the banner and PPC ads described above, described ads PPC and banner to the addition In Note that the categories add up to more than 100% of the 2013. in and 15% 2014 in sites of 6% roughly on appeared ads These ticipate in the advertiser’s scheme for wealth generation. par to or success financial to secrets the receive to pay get-rich-quicktunities and to users encourage offers that > 20% 2013. in over just and 2014 in sites of 17% about on appeared ads content Adult women. naked or clad scantily ly display sexual performance enhancements. Banners frequent > Easy Money: 3.5% 6.2% 10% This category includes business oppor business includes category This 14.5% 17.1% 20% 21.2% 21.9% 26.1% 30% 31.9% - - - -

GOOD MONEY STILL GOING BAD 12 This research will create a comprehensive benchmark of benchmark create acomprehensive will research This tem funded by the Interactive Advertising Bureau (IAB). ecosys advertising of the audit an was 2015, February in sites. theft content to flowdollars ad of the to block industry ad the across and by advertiser opted feit goods or pirated content without their knowledge. counter promote that websites on avoid placements ad cies agen ad their and advertisers help to designed effort, such one is Piracy Against Program (TAG)’sGroup Integrity Brand digital media. of value the and awhole, as industry ad of the perception dustry—also hits advertisers’ budgets and reputations, the in creative for the proportion epic does—of theft content damage the that recognize platforms tech ad and lishers, it. feeds that dollars advertising of flow the and industry the disrupt to steps laudable taken ture significantly. pic the would have changed inclusion its and 2015 January in Bay, Pirate online site, The back ular for example, came pop havemost revenue. greater easily The as shown could later, earlier, or afew results months the conducted been study size. this Had same the virtually criteria—was same the using of sites—developed list 2014 the out, dropped of law. the Despite fact the that 40% of 2013 the sample had ahead step one addresses, at new reopen simply lawsuits siteshigh margins. shut Established down by and authorities and riches of easy continually, promise up bying the lured deception. and theft on built constantly industry, an is mistake—this make no and And evolving industry. flourishing a be to continues theft Content SUMMARY AND RECOMMENDATIONS nte sgiiat d nuty ntaie as launched also initiative, industry ad significant Another ad broadly be to need TAG’s shows efforts research This The previously mentioned Trustworthy Accountability In the advertising industry, marketers, agencies, pub have sectors public and private the in players said, That spring contenders new with industry, a cyclical is also It ------WITH WARNINGS ON CONTENT THEFT SITES CONTENT THEFT ON WITH WARNINGS OPERATION PIPCU CREATIVE 12: ADS FIGURE REPLACES marketing, and are vital if this problem is to be reduced. reduced. to is be problem this if are vital and marketing, that them fuels have since been launched in other countries. sites. infringing on messages warning with ads replaced fringing sites. Another novel effort,called Operation Creative, in on ads to avoid use placing can companies tech ad which Website List, Infringing the of sites, alist maintaining include initiatives Its theft. content to address agencies active visibly most of the one been has (PIPCU) Unit Crime Property tual Money Gone Bad both be will research for the sources data the Among ad to take others and sites theft allows content that corruption of the impact the These are all important initiatives that go beyond talk and and talk beyond go that initiatives important are all These revenue the and sites theft content curtail to efforts Similar Intellec Police of London sector, City the public the In reports. reports. vantage of the digital ad supply chain. chain. supply ad digital of the ­vantage Good - -

GOOD MONEY STILL GOING BAD 13 ing segmented further by size. before be model, business and technology on based ments, seg into functional four were sites categorized sample The SEGMENTATIONSAMPLE study. 2013 the in sites gaged in hosting or distributing infringing content. en were sites substantially the where sites ad-supported to remove: and them, qualify to of sites further hundreds on content infringement. analysts Its then visited and reported sites’ involvement of the in degree the on Incopro Site, and sample using further ratings from Integral Ad Science, Veri- the validated below. by MediaLink size, described sample as the to segment revenue and advertising to calculate used were data comScore The Inc. comScore from were available data view page and visitor unique for Q3 which in requests of sites. such ability profit aggregate the of part a only reflect significant, while findings, the result a As successful. most and largest the ing includ asubset, on focused dive, MediaLink allow adeeper To domains. by 60,000 approximately hosted URLs million to 30 remove around requests receives Google month, Each removal request data from the Google Transparency Report. (DMCA) Act Copyright Millennium Digital with started reports Gone Bad first the after year one 2014, of quarter third the on focused MediaLink research, for this sites selecting In STUDIED SITES APPENDIX A: METHODOLOGY The result was a sample of 589 sites, compared with 596 596 with compared sites, of 589 a sample was result The partially at least were those studied only sites the Thus, shows. TV and > broader pirating audience; or to a interesting to be unlikely movies or programs guage Tamil-lan e.g., localized, nature, in highly or personal ated, > > takedown DMCA more or 25 with sites was baseline The As the basis for sitesfinding in engaged content both theft, > > > Sites where available content was not primarily movies movies primarily not was content available where Sites Sites where most content appeared to be user-gener hate sites; and Porn report, which was based on Q3 2013. 2013. Q3 on based was which report, Good Money Money Good ------AND SIZE SEGMENTS AND SITES BY 2014 FUNCTIONAL 13: FIGURE hosted content. content. hosted DDLs’ DDLs, promoting the affiliationsspecific business with have Sites Linking Many charge. at no hosted, is it where site the from content the download and alink click users The ads. to exposed while the all want, they content for the search browse or Users themselves. content host not do They to content. access to facilitate itself Site Linking the within allow search Some Hosts. (DDL) Download Direct on hosted content to media links index and aggregate portals These Linking Sites charge. at no for use computers own to their content the to download and systems bution distri peer-to-peer on available files for search or browse to software client torrent running let users portals These 2013. January in once sites at least content infringing accessed such to visitors unique of 96.3% that reported which to NetNames, according infringement, content of online od come synonymous with content It theft. is the largest meth have it on be based sites and worldwide, system tribution dis file (P2P) peer-to-peer popular most the is BitTorrent Portals BitTorrent P2P Other and FUNCTIONAL SEGMENTS 7 5 11 8 VIDEO STREAMING HOST SITES LINKING SITES DIRECT DOWNLOAD (DDL) HOST SITES PORTALS P2P OTHER AND BITTORRENT 25 40 35 36 50 LARGE 71 63 92 100 MEDIUM 196 150 SMALL

200 250 - - - -

GOOD MONEY STILL GOING BAD 14 the profitability. the of apicture paint that points data 33 chose MediaLink sites, sample the studying and filings, Department Justice US ing review blogs, and forums webmaster combing experts, ing perience and by interviewing advertising and web site host ex industry its Through cost. of revenue and drivers possible numerous considered MediaLink profitability, ad-supported of theft content analysis the for model financial the To create P&L MODEL 13. Figure in shown is size segment and functional per of sites number The segments. functional four of the sizes for each three ments: seg functional/size 12 was result The sites. small myriad economic realities of the industryleaders separately from were: segments The visitors. unique age aver 3-month on based sub-segments, large and medium by size into small, divided were the further segments functional sample, the across scale in differences for account To SEGMENTS SIZE Internet. the across widely content to the links to post users for payments encouraging files, bounty uploaded popular users’ the of users downloads their offer DDLs the of Many point. Sites Linking to which content the providing ecosystem, theft content to the are fundamental DDLs downloads. for faster pay to and avoid ads users lets that version subscription um apremi and model afree, ad-supported revenue streams: generate can Users have dual DDLs content. the to download used to be links storage. cloud-based to files media to upload allow users Sites Host (DDL) Download Direct Sites Host (DDL) Download Direct then allow users to stream the videos. and content to video store want who to users subscriptions offering content, host and stream both sites remaining The elsewhere. hosted videos to stream allow users that players embedded with portals ad-supported are strictly sites the subscription-based storage Ninety-two models. percent of and portal ad-supported the both includes segment This Video Streaming Host Sites This segmentation allowed for analysis of the traffic and and traffic the of analysis for allowed segmentation This > > > > > > Large: Large: Medium: Small: Fewer than 1 million monthly unique visitors Greater than 5 million monthly unique visitors unique monthly 5million than Greater 1 million to 5 million monthly unique visitors ------version rates. con and click-through common as well and as fraud impression click potential included Variables revenue. significant on infringement sites would be lower, while still generating for campaigns rates because discounted sites, legitimate resources. revenue calculations. the in included multiplier fraud for the assumptions its increased also MediaLink sample, 2014 Q3 the in for sites data DoubleVerify on generally, and below. in are detailed assumptions The carried. ads the CPMs the and inserted, ads the viewed, of videos number the about assumptions conservative on revenue calculations its based MediaLink Instead, ads. video of prevalence overall the to assess videos enough view ter mat apractical as not could revenue, ad analysts of video terms In however, is, revenue It calculation. of the sumed. part con of content amount of the representative completely not is viewed pages players, embedded via content their vide factors: by several were predicated for the Video Streaming Host Sites segment. These additions revenue in increase aresulting with model, to the CPMs and MediaLink based these values on rates for similarly sized sized for similarly rates on values these based MediaLink > action of an completion per and link, text or a banner on click per ad, banner or of a video views, > > > > revenue of ad key are: The drivers The key drivers of costs are hosting fees and human human and fees are hosting of costs keyThe drivers fraud ad on data of industry body agrowing on Based pro sites Streaming Video because that noting worth is It sample. the in sites the by Veri-Site serving as > report; first the in were seen not which sample, > > views ad for video variables added year this MediaLink > > > > > > > > Prevalence of fraud. Amount paid per thousand impressions (CPM), or page per positions of ad Number Page views visitorsUnique Video ad networks among the ad networks identified networks ad the among networks ad Video 2014 Q3 the in of sites anumber on seen ads Video sites; Streaming of Video number the in Growth - - - -

GOOD MONEY STILL GOING BAD 15 sulting from downloads. re for subscriptions and content users’ of the for downloads bounties users offer sites Some displayed. ads of types and number the as well as bounties, download sites’ and fees the verified content, downloading and uploading and accounts creating including sites, of the sub exploration Direct scriptions. longer for rate monthly the off 50% as high as counts dis with terms 12-month six- and three-, at one-, typically package, have apremium to buy users downloads, speed To full- to get and ads displayed. ads and eliminate speeds download throttled with but create account, could afree ing. These were typically “freemium” where services users advertis as well as access by subscription were supported Hosts Streaming of Video ahandful and Hosts (DDL) load malware. with loaded to be out turned often which software, download could they where opportunities to sign up for a program or a gaming service, or wherein the sites generated revenue by displaying to users programs, affiliate as identified sometimes was what to plied action-based in models use. The action-based approach ap ad-supported. The research found impression-, click-, and were exclusively by MediaLink examined Sites Linking research. the were from excluded advertising no with content infringing offered that sites above, noted As P&L DETAIL ported by advertising. sup were wholly not that for sites reported are not margins revenue, and cost, subscription theft, content ad-supported on was research of this focus the Because segments. other than capacity storage and processing more requires which ecosystem, of the segment DDL are the low but for all costs Ad- and Subscription-Supported: Almost all Direct Down Direct all Almost Subscription-Supported: Ad- and and BitTorrent Portals, P2P Other and Ad-Supported: With cloud-based hosting a commodity, infrastructure ------action, such as downloading and installing software or reg or software installing and downloading as such action, some completes CPA auser and pays when link; or banner a click users revenue only when gle AdWords, generates Goo ala advertising, click-based ad; of an views thousand per a fee from revenue derives Impression action-based. or CPA- and click-based, or CPC- impression-based, or CPM- Advertising revenue, as noted, has three components: REVENUE sites. theft points and assumptions underlying ad-supported content data of the follows explanation an What is here. reported are not sites for subscription-supported margins and costs the and business, of the aspects ad-supported the just on focuses discussion the so theft, content of ad-supported ity Impression-specific data points are: points data Impression-specific Revenue CPM asite. on istering The goal of this research was to understand the profitabil the understand to was research this of goal The as follows: as are by segment assumptions percentage The research. external as well as sites to the visits MediaLink on based are and revenue ad calculation of the are part sumptions > revenue. ad to estimate used was data this model, the For comScore. from 2014, for July, September and August, > > > all Linking Sites display ads. display Sites Linking all » revenue. ad at CPM arrive to below defined thousand) per (cost CPM by tiplied mul be to average) comScore the of reduction 20% (a 80% is Assumption displayed. pages other all almost on do but page, home the on ads show not do erally » (% Ads): Ads with Views of Page Percent (PVs): Views Page » » Linking Sites:Linking Portals: BitTorrent P2P Other and

Assumed 95% as virtually all pages on on pages all virtually as 95% Assumed

The monthly average of page views views of page average monthly The These sites gen sites These These as ------

GOOD MONEY STILL GOING BAD 16 sources and direct observation of sites’ business models. of sites’ business observation direct and sources third-party of combination a on rely model financial the for assumptions and streams, data or files log of analysis include not did research The see. never can viewers that images single-pixel in calls ad embedding and iframes ed nest in ads stacking as such window, activities as well as browser primary auser’s behind are launched ads where pop-unders, as practices benign such Fraud includes tem. ecosys theft content the in significant more even be to icant challenge to the advertising ecosystem and is likely > observation. direct and visits site researchers’ Link Media on based size segment and byaverage functional > > > for account management and signup, and don’t show show don’t and signup, and management for account pages have sites functional more by DDL far that tions observa visit site on based metric 60% the adjusting » model. like business aDDL- with sites Streaming of Video number for the account to sites Linking and P2P for metric 60% the ing » sites. to P2P equivalence model » fraud. of ad type pression laundering on these sites, which is only one im on comScore from data reports, industry on based » (% Fraud): Fraud Multiplier (# Ads): Page per of Ad Positions Number views. of page at half estimated servatively con pages, download and upload on only display Ads » research. external and visits site are MediaLink Sources model. their in Sites Linking are like sites large All 90%. roughly is Average views. page of 95% on ads have we assume re which sites, are linking-type mainder the views; page of 50% on ads have assume we which small of model, DDL-like 10% a have sites About medium of 15% sites. and large for 95% and medium and » » » » » » » Direct Download (DDL) Host Sites: Sites: Host (DDL) Download Direct Sites: Host Streaming Video Sites:Linking Portals: BitTorrent P2P Other and Sites: Host (DDL) Download Direct Sites: Host Streaming Video

Assumed 60%, based on business business on based 60%, Assumed Impression fraud is asignif is fraud Impression

Assumed 90% for small small for 90% Assumed Assumed 50%, adjust 50%, Assumed

sue 60%, Assumed Assumed 20%, 20%, Assumed Assumed 50%. 50%. Assumed This is an an is This ------expertise and site visits, assumed that video views would would views video that assumed visits, site and expertise > functional and size segment. by average an is point data This displayed. ads premium of number the counted and site each visited researchers > size segment. and by functional average an is point data This displayed. pop-unders and researchersMediaLink counted the number of pop-ups > ads. pop-under or lated that 30% of pop-up page views generated and clicks Ups): > delivered ads. into transparency limited of the light in estimate vative to aconser provide at $3.00 CPMs—weread estimated ad rates—while typically significantlyhigher than display and research with advertising industry members, video > for premium and non-premium ads. same the to be are assumed rates such, As of campaigns. livered programmatically by exchanges to fulfillthe dregs are de they appear ads premium where that is sumption and research with advertising industry members, the as > ads displayed. thousand per cents) (30 of $0.30 aCPM was sumption as The etc. schemes, get-rich-quick games, sites, bling gam and dating adult including advertisers, of most ity qual low overwhelmingly the reflects This CPMs. low at are likely delivered sites theft content on ads members, Link expertise and research with advertising industry > of pages. rate of 0.05% ad video a for streams, those 10% of in appear would ads video that further and pages, ad-bearing of 5% of result a as occur > > > > > > > Percent of Video Ads (% Video): (% Video): Ads of Video Percent (% Prem): Ads Brand of Premium Percent (# Pop-Ups): Multiplier Pop-Up (% Pop- Pop-ups Generating Views of Page Percent for fraud. portunity op apparent less in resulting users, to premium ads Video CPM ($ Video): ($ Video): CPM Video ($ Prem): CPM Premium ($ Non-Prem): CPM Non-Premium Based on MediaLink site visits, researchers extrapo researchers visits, site MediaLink on Based Based on MediaLink expertise Based onBased MediaLink expertise Based on Based MediaLink While visiting sites, sites, visiting While Based on Media on Based MediaLink MediaLink ------

GOOD MONEY STILL GOING BAD 17 malware) distributors, as well as gaming and gambling sites. content theft ecosystem are overwhelmingly software (and the in model this in participants the site visits, MediaLink on action, generally as of part lead generation activities. Based The final ad model involves paying for users’ completion of an Revenue (CPA) Cost-Per-Action apply: calculations and fields data additional these vertising, ad (CPC) For click-based link. text or abanner on click user The second advertising model involves payment for each Cost-Per-Click (CPC) Revenue here: shown as derived and size segment, and tional CPC Revenue = Total Ad Impressions x CTR xCPC xCTR =Total Impressions Ad Revenue CPC click. per cents) (21 rate of $0.21 acost-per-click sumed and research with advertising industry members, as > one-hun dredths of one percent). (eight 0.08% of rate click-through a assumed andpertise research with advertising industry members, > Revenue CPM +Video Revenue CPM Non-Premium + Revenue CPM =Premium Total Revenue CPM Video) x% Views Page x(Effective =$Video Revenue CPM Video -%Prem) (Total Impressions Ad x =$Non-Prem Revenue CPM Non-Premium x%Prem) x(Total Impressions Ad =$Prem Revenue CPM Premium + Pop-Up Impressions Total Ad Impressions = Base Impressions + Fraud Impressions Pop-Up Impressions = Base Impressions x % Pop-Ups x # Pop-Ups x%Fraud Impressions =Base Impressions Fraudulent =(PVs x#Ads) x%Ads Impressions Base by func calculated site was revenueAverage CPM per > > Cost Per Click (CPC): Click Per Cost Click-Through Rate (CTR): Based on Based MediaLink expertise

Based on MediaLink ex MediaLink on Based

- - - - - fields and calculations apply: calculations and fields ble to all sites. toble all applica costs for these were used calculations and points data additional following The freelancers. or are employees those whether resources, for human cost some and costs have web sites hosting model, of business Regardless Costs General overhead. other and for staff costs indirect and for hosting costs direct considered search re The data. third-party some used and sites, tion-supported subscrip and of ad- types for similar practices ly accepted or operating costs, so assumptions were based on general revenues report not do ecosystem theft content the in Sites COSTS OPERATING pertise andpertise research with advertising industry members, > one of percent). one-hundredth (one 0.01% of rate conversion sumed tise and research with advertising industry members, as > of CTAsize sites. in segment links and by functional number average an is this visits, site Link > were completed. to be actions where pages and size tional of off-site with ads those segment linking to by func percentage average an is this visits, site diaLink > For action-based (CPA) advertising, these additional data for the sites. for the number conservative and aconsistent provides MuStat available, not is observations its about detail more While location. and estimates utilization bandwidth views, page visitors, of unique acombination on calculations its base to appears and of sources anumber from data compiles site The costs. for hosting (www.mustat.com) MuStat > Affils)# x (PVs xCTA xCPA = Affils x% Revenue CPA/Affiliate of $0.75 (75 action cents). completed revenue per assumed > > > > > otPrAto Fe (CPA): Fee Cost-Per-Action (CTA): Rate Action CTA Affils): (# Links Affiliate of Number Percent of Sites with Affiliates (% Affils): Monthly Hosting Costs: Costs: Hosting Monthly Based on MediaLink exper MediaLink on Based MediaLink used the site the used MediaLink Based on MediaLink ex MediaLink on Based Based on Media on Based Based on Me on Based ------

GOOD MONEY STILL GOING BAD 18 works (CDNs), to name afew (CDNs), toworks key name functions. structure, and integration with content distribution net infra storage content significant management,account and subscription involve They e-commerce, plicated. com are more hand, other the on sites, Streaming eo DDL-like and DDLs Vid requests. takedown DMCA with compliance and relationships advertising and affiliate with to deal and servers additional to manage required is effort more as size with increases likely staff for need The employees. full-time additional no with probably person, byBitTorrent one are likely run sites Linking and of site. For example, small type size and the on based significantly varies This operations. site web in expertise in operating the sites, based on research and general > > medium sites, assumed 2.0 FTEs. 2.0 assumed sites, medium For sites. of DDL-type blend date the portal-type and to accommo downward slightly adjusted was count small and medium segments, where the average FTE the in only exists model DDL The sites. Linking rent and BitTor small as same the operate which sites, small » sites. for large 5FTE and medium » dealing with advertising. and indexing monitoring, on focus would mainly ation oper ongoing are built sites once and tocult operate, diffi not and common increasingly is Torrentsoftware sites. for large 5FTE and for medium FTE 1.0 for small, » Count: Head » » » Video Streaming Host Sites: Host Streaming Video Sites:Linking Portals: BitTorrent P2P Other and Estimated number of people involved of people number Estimated Assumed 0.25 FTE for small, 1.5 FTE for for FTE 1.5 for small, FTE 0.25 Assumed Assumed 0.25 FTE for for FTE 0.25 Assumed Assumed 0.25 FTE FTE 0.25 Assumed ------ness, researchers assumed overhead of 0%-1% of revenue revenue of 0%-1% of overhead assumed researchers ness, busi of the opacity To the despite for overhead account have needs. complex noted more as which togard DDLs, re in grow especially sites network. and the as likely changes That and hosting beyond infrastructure significant only the that and offices without operate to presumed are > of $4,000. person per salary monthly average an sumed as developers, and administrators system for web and > across the board for DDLs. board the across 1% and sites Streaming Video and Linking BitTorrent, for > > Overhead: Average Monthly Salary: sites. Linking to and torrent apply doesn’t that resource marketing and service for customer there’s need and maintain to arecomplicated more above, noted these As sites. for large 6FTE and for medium FTE 2.5 for small, FTE » » Direct Download (DDL) Host Sites: Sites: Host (DDL) Download Direct Most sites in the content theft ecosystem ecosystem theft content the in sites Most Based on Based published salaries Assumed 0.5 0.5 Assumed - - -

GOOD MONEY STILL GOING BAD 19 APPENDIX B: SEGMENT REVENUE DETAIL LARGE MEDIUM SMALL DIRECT DOWNLOAD (DDL)HOST SITES LARGE MEDIUM SMALL VIDEO STREAMING HOST SITES LARGE MEDIUM SMALL LINKING SITES LARGE MEDIUM SMALL BITTORRENT AND OTHER P2P PORTALS SEGMENT LARGE MEDIUM SMALL DIRECT DOWNLOAD (DDL)HOST SITES LARGE MEDIUM SMALL VIDEO STREAMING HOST SITES LARGE MEDIUM SMALL LINKING SITES LARGE MEDIUM SMALL BITTORRENT AND OTHER P2P PORTALS SEGMENT

$3,029,606 $305,380.12 $2,849,807 $6,273,638 $1,086,458 $3,376,539 $1,388,482 $1,001,984 $2,126,618 $47,006.20 $1,645,217 $2,137,661 $15,904.51 $186,990 $784,205 $754,330 CPM REV CPM REV $425,324 $126,226 $11,809 $84,413 $30,173 $15,457 $79,161 $2,634 TABLE AGGREGATE 7: Q3 2014 BY SEGMENT PERFORMANCE SITE TABLE AVERAGE 6: Q3 BY 2014 SEGMENT PERFORMANCE SITE

$1,696,580 $1,890,862 $1,190,906 $1,595,892 $171,012.87 $1,197,090 $3,513,237 $26,323.47 $8,906.52 $608,416 $777,550 $439,155 $422,425 $921,322 CPC REV CPC REV $238,181 $104,714 $70,686 $561,111 $44,330 $16,897 $47,272 $8,656 $6,613 $1,475

$5,788.98 $184,986 $152,490 $1,532.24 CPA REV CPA REV $35,840 $53,628 $68,614 $40,523 $38,401 $54,184 $51,539 $12,464 $16,261 $16,817 $258.10 $37,111 $4,236 $1,288 $1,558 $7,168 $2,745 $403 $763 $196

TOTAL AD REVENUE TOTAL AD REVENUE $4,764,588 $9,799,339 $4,598,188 $3,353,364 $2,620,167 $5,318,939 $1,579,356 $1,245,370 $3,375,274 $1,731,985 $2,351,017 $1,224,917 $670,673 $345,888 $482,182 $132,973 $213,729 $127,727 $25,069 $24,309 $18,826 $74,862 $49,815 $4,872

TOTAL COST TOTAL COST $400,034 $789,193 $837,736 $294,242 $534,281 $80,007 $627,141 $98,649 $20,943 $14,841 $3,200 $3,198

MARGIN % MARGIN % 86.8% 89.8% 83.0% 85.9% 88.4% 79.9% 84.5% 84.3% 87.5% 91.6% 88.1% 94.1%

GOOD MONEY STILL GOING BAD 20 functional segment for the 2013 and 2014 2014 and 2013 for the segment functional revenue by breakdown and size and segment functional size and of the views high-level provide graphics following The 23.1% (136) 40.9% (241) 17.8% (105) FIGURE 14: COMPARISON OF 2013 AND 2014 SAMPLES BY SEGMENT SAMPLES FUNCTIONAL 2014 AND 2013 OF COMPARISON 14: FIGURE 2014 SAMPLE 2014 2014 SAMPLE 2014 BY SEGMENT BY FIGURE 15: COMPARISON OF 2013 AND 2014 SAMPLES BY SAMPLES SIZE SEGMENT 2014 AND 2013 OF COMPARISON 15: FIGURE 5.3% DIRECT DOWNLOAD (DDL) HOST SITES PORTALS P2P OTHER AND BITTORRENT (31) BY SIZE BY 23.1% (136) Good Money Gone Bad 71.6% (422) SMALL 18.2% (107) MEDIUM samples. samples. VIDEO STREAMING HOST SITES LINKING SITES 23.2% (138) LARGE 47.5% (283) 12.6% (75) 2013 SAMPLE 2013 2013 SAMPLE 2013 BY SEGMENT BY 7.6% (45) BY SIZE BY 24.2% (144) 15.8% 69.3% (413) (94)

GOOD MONEY STILL GOING BAD 21 SEP 2014 ($98880,301) 47.4% ($65,619,900) ($46,234,894) 31.5% 22.2% FIGURE 16: COMPARISON OF 2013 AND 2014 REVENUE BY SEGMENT FUNCTIONAL REVENUE 2014 AND 2013 OF 16: COMPARISON FIGURE 2014 REVENUE 2014 2014 REVENUE 2014 BY SEGMENT BY DIRECT DOWNLOAD (DDL) HOST SITES PORTALS P2P OTHER AND BITTORRENT BY SIZE BY FIGURE 17: COMPARISON OF 2013 AND 2014 REVENUE BY SIZE SITE REVENUE 2014 AND 2013 17: OF FIGURE COMPARISON ($16,977,123) 8.1% ($42,733,061) ($66,928,603) 20.5% SMALL 32.1% ($79,710,048) 38.2% MEDIUM ($66,162,819) ($141,701,020) 29.2% 62.5% LINKING SITES VIDEO STREAMING HOST SITES LARGE ($27,489,971) 12.1% ($19,066,218) 8.4% 2013 REVENUE 2013 2013 REVENUE 2013 BY SEGMENT BY BY SIZE BY ($26,803,266) 11.8% ($113,950,981) ($58,165,703) 50.3% 25.7%

GOOD MONEY STILL GOING BAD 22 UNIQUE VISITORS APPENDIX C: PAGE VIEWS AND DIRECT DOWNLOAD (DDL)HOST SITES LARGE MEDIUM SMALL LARGE MEDIUM SMALL VIDEO STREAMING HOST SITES LARGE MEDIUM SMALL LINKING SITES LARGE MEDIUM SMALL BITTORRENT AND OTHER P2P PORTALS

TABLE YEAR-TO-YEAR 8: UNIQUE PAGE AND OF VIEWS COMPARISON

VISITORS BY SIZE SEGMENT AND FUNCTIONAL

MONTHLY AVERAGE UNIQUE VISITORS (000) 16,449.0 18,583.5 8,686.4 2,604.7 2,256.9 GMGB1 2,450.6 6,782.5 2,239.9 2,075.3 2,207.8 2,517.4 709.3 399.3 296.2 348.5 210.3 12,458.2 18,742.5 GMGB2 1,988.2 1,425.6 1,949.6 2,265.5 7,623.6 2,203.2 1,761.4 6,714.9 2,138.1 405.9 682.1 303.7 246.3 313.3 CHANGE -30.0% -36.8% -23.7% -33.0% -10.1% -12.2% -11.7% -3.8% 13.9% -4.5% -7.6% -1.0% 17.1% 6.2% 2.5% 1.7%

GMGB1 MONTHLY AVERAGE PAGE VIEWS (MM) 364.9 169.2 190.1 111.3 29.4 36.9 33.4 52.5 29.9 13.0 24.9 38.2 5.6 3.9 4.2 7.7 . GMGB2 CHANGE 339.3 149.8 149.5 161.1 22.2 27.0 12.0 38.3 31.7 27.8 22.3 38.1 4.0 6.2 6.7 5.2 -39.7% -33.7% -24.7% -10.4% -21.4% -19.1% -11.5% -8.0% -8.4% 44.8% 24.9% 27.4% -7.0% 17.8% 0.4% 4.1%

GOOD MONEY STILL GOING BAD 23 torrent-games.net torrentfunk.com torrentdownloads.me torrentbutler.eu torrent.cd tnttorrent.info t411.me seedpeer.me rarbg.com online-freebee.ru omgtorrent.com nowfilms.ru monova.org mejortorrent.com limetorrents.com kinozal.tv kickassunblock.net katushka.net katproxy.com jptorrent.org isohunt.to ilcorsaronero.info h33t.to elitetorrent.net 1337x.to MEDIUM torrentz.eu torrentino.com tfile.me rutracker.org rutor.org kickass.to fast-torrent.ru extratorrent.cc LARGE PORTALS P2P OTHER AND BITTORRENT sites. theft tent con on brands legitimate serving is ecosystem advertising online of how the real examples provide screenshots The brands. Ad Business,” MediaLink’s researchers revisited content theft sites where they found ads from premium and other legitimate Online of the Hijacking The and Thieves Digital Bad: Gone Money “Good report Alliance Citizens Digital for the research the Note: APPENDIX D: SITES STUDIED Sites marked with an asterisk were no longer active as of January 2014, but were active during Q3 2013. After completing completing After 2013. Q3 were during but active 2014, of January as active were longer no asterisk an with marked Sites free-torrents.org firebit.org fileking.pl extratorrentlive.com extratorrent.to extratorrent.ee extradvdrip.com extorrent.net darktorrent.pl cztorrent.net btmon.com btdigg.org bt-chat.com bit-torrent.bz bitreactor.to bitnova.info bit2bit.org bigtracker.org bigtorrent.org baixartorrent.net ahashare.com 1337x.org 10torrent.net SMALL yts.re yourbittorrent.com yify-torrents.com vitorrent.org torrentz.pro torrents.net torrentreactor.net torrentor.net torrentom.com torrentino.ru torrenthound.com lien-torrent.com kino-zal.tv kinokubik.com jarochos.net houndmirror.com hdreactor.org goldenshara.com fulldls.com subtorrents.com streamzone.org sparkmovies.com smartorrent.com simplecd.me silvertorrent.org sharethefiles.com rutracker.ru rus-torrents.ru rustorrents.org rustorka.com rapidzona.com queentorrent.com psychocydd.co.uk pslan.com polskie-torrenty.pl pirateproxy.nl picktorrent.com ourrelease.org opensharing.org nowtorrents.com newtorrents.info mejorenvo.com megatorrents.org megashara.com malaysiabay.org limetorrents.net torrentdownloadz.com torrentazos.com torrent.to torrent.by torentilo.com thetorrent.org tfile.org tapochek.net zlotracker.org x-torrents.org vertor.com utorrents.org unionpeer.org torrtilla.ru torrnado.ru torrindex.info torrentzap.com torrentz.to torrentz.me torrentszona.com torrent-shara.net torrentsdownload.org torrentroom.com torrentr.eu torrentproject.com torrento.net torrentman.com torrentline.net torrentkereso.hu torrent-free.ru torrentfrancais.net torrent-finder.info torrentfilms.net torrentexpress.net -

GOOD MONEY STILL GOING BAD 24 watchfreemovies.ch vn-zoom.com video.az urgrove.com tubeplus.me streamiz-filmze.com seedoff.net primewire.ag peliculasyonkis.com opensubtitles.org myegy.com mazika2day.com libertyland.tv klipzona.net kkiste.to kinox.to kino-rex.com kinobar.net identi.li ganool.com filmix.net eqla3.com ekino.tv dpstream.net divxplanet.com divxonline.info desitvforum.net desirulez.net dardarkom.com cucirca.eu couchtuner.eu compucalitv.com come.in cokeandpopcorn.ch cinetube.es burning-seri.es argentinawarez.com 1kinobig.ru MEDIUM watchseries.lt movie4k.to megashare.info free-tv-video-online.me filmifullizle.com bobfilm.net LARGE LINKING SITES dpstreaming.fr dpstream.pw downtwarez.com downtr.co downloadarquivo.com divxatope.com direkizlehd.com directoriow.com desicorner.net dasolo.info darmowefilmy.eu darkmachine.pl dacho.co.il cwer.ws couchtuner.me coolmoviezone.com cognitivefiles.com cinemay.com cinemaindo.net btarena.org bochinchewarez.com binmovie.org bajui.com baixeturbo.org baixeadrenalina.com baixardegraca.com.br baixandofacil.com allyoulike.com allcandl.org alive-ua.com adocine.net addic7ed.com 9divx.com 990.ro 720pmkv.com 5fantastic.pl 3gpmobilemovies.com 3gpfilm.org 3dl.tv 300mblinks.com 1divx.info 1channelmovie.com SMALL zmovie.tw watchtvseries.to watchseries.ag fifopartage.tv fdmovie.com extreme-down.net exsite.pl excluzive.net exclusivitees.eu estrenosgo.com esdvx.com ergor.org epidemz.net entertainmenthitz.net emule-island.ru egyup.com egybest.com dvdripfilms.com hinditvlinks4u.ch hd-world.org hdpicture.ru hdkinoklub.ru hdfilm-online.com hatemtai.com gnula.nu gingle.in geektv.ch fzmovies.net fullsharez.com fullpelis.com fullmovie-kolkata.com fullepisode.info french-movies.net free-telechargement.org freerutor.com free-filmy.ru filmy-lektor.pl filmvf.net filmsenzalimiti.co filmlinks4u.net filetram.com fileszona.com filespart.com fileslinx.com filenewz.com filegaga.com fileflix.biz filediva.com filecatch.com kinosik.pl kinolive.co kinohd.net kinogidrogen.com kinodoma.net kino-dom.tv kinobaza.tv kickassmovies.org iwatchonline.to itvmovie.eu ilefilms.com ikinokz.net hotfilesearch.com homekino.kz hnmovies.me ourphorum.com onlinemix.ru oneclickwatch.org obnovi.com nizaika.ru newpct1.com newpct.com neomaks.ru moviz.net moviesnow.co moviesnhacks.com moviesmobile.net moviedetector.com movie-blog.org moviearena.org movie8k.to movie4u.org movie2k.tv mopvideo.com moova.ru mobilesmovie.in micromkv.com mes-ddl.com megashare.ca mega-search.me mega-exclue.com mamzouka.com mamega.com majaa.net m5zn.com kinoxa-x.ru

GOOD MONEY STILL GOING BAD 25 rlsbb.com rapidok.com rapidmoviez.com rapidfiledownload.com rapide-ddl.com rapid4me.com raidrush.ws ps3iso.com programasfull.com proc.com.ua powerddl.com potorentam.com pordescargadirecta.com pirat.ca peliculas4.tv peb.pl thedarewall.com tehparadox.com subs4free.com subom.net stream-vostfr.net stepashka.com speedlounge.in skymovies.in shaanig.com seriesforever.net seriecanal.com serialnet.pl serialeonline.pl rus-media.org ru-admin.net rpds-download.net vpsite.ru vidics.ch vcdq.com usenet-crawler.com usabit.com unlimstream.com ultra-vid.com uakino.net tvshow7.eu tv-release.net tvcric.com tuserie.com ttmeiju.com top-film.net topanalyse.com tnt24.info zzstream.li zzstream.li zpeliculas.com za-friko.com worldfree4u.com.co worldfree4u.com world4ufree.com wawacity.su watchtvseries.ch watchseries.biz watchonlineseries.eu watchmoviesonline.mobi watchmovies.to watchfullepisode.com watch-free-movie-online.net warezturkey.net warcenter.cz

GOOD MONEY STILL GOING BAD 26 movpod.in movierulz.com moiserialy.net kinostok.tv kinoprosmotr.net kinomoov.net kinoman.tv kinokrad.net kinobanda.net flashx.tv filmpertutti.eu filmenoi.ru faststream.in dream-film.net dpstream.net arabseed.com amovies.tv allmyvideos.net MEDIUM ziddu.com seasonvar.ru filmifullizle.com ex.ua chomikuj.pl bigcinema.tv baskino.com LARGE SITES HOST STREAMING VIDEO dpstreaming.org dpstream.tv dizihdtv.net cinemay.com cinemavf.net allserials.tv alekino.tv 3dplayer.pl 1channel.ch SMALL zumvo.com zalukaj.tv watch32.com videoweed.es videobam.com vidbull.com verseriesynovelas.com veoh.com tushkan.net played.to pelis24.com peliculasmas.com peliculaschingonas.org nosvideo.com movzap.com movshare.net movreel.com kino-az.net kino-action.ru intv.ru iitv.info gofilm.pl freezee.ru films-online.su films-online.pl filmodrom.net filmochki.ru filmix-online.net film-en-entier.com film4ik.ru fifostream.tv efilmy.net mytv.kz movieberry.com mopvideo.com minizal.net lovekino.tv linecinema.org krasview.ru kinolubim.ru kinolot.com kinokontakt.ru kinohome.net kinoclips.net the-cinema.ru swefilmer.com smotrim-serial.com smotri-filmu.ru series-cravings.tv seans24.pl purevid.com pollystreaming.com playtube.pl open-cinema.ru oko-kino.ru nzbmovieseeker.com nowfilm.net novamov.com nontonmovie.com zserial.net zserial.net zalukaj.to zajefajna.com zachowajto.pl yify.tv webteizle.org watch-tvseries.net vodly.to videozal.net vidbux.com uploadc.com tubemotion.com

GOOD MONEY STILL GOING BAD 27 sharebeast.com nowvideo.ch hugefiles.net ge.tt fshare.vn filerio.in filepost.com filenuke.com filefactory.com eyny.com download-genius.com datafilehost.com billionuploads.com 1fichier.com 180upload.com MEDIUM zippyshare.com uptobox.com uploadable.ch turbobit.net sendspace.com rapidgator.net letitbit.net dfiles.ru depositfiles.com bitshare.com 4shared.com LARGE SITES DOWNLOAD HOST (DDL) DIRECT fileflyer.com filedropper.com filecondo.com file4go.com fastshare.cz expressleech.com exoshare.com euroshare.eu easydownloadnow.com directmirror.com data.hu crocko.com brupload.net boxca.com asfile.com akafile.com 4upfiles.com SMALL yunfile.com xvidstage.com videowood.tv uploading.com ulozto.net uloz.to tusfiles.net thefile.me solidfiles.com share-online.biz junocloud.me jumbofiles.org jumbofilebox.com jheberg.net hulkload.com howfile.com hostingbulk.com hitfile.net hellupload.com gigasize.com filevice.com filesflash.com fileplaneta.com fileparadox.in filenuke.net queenshare.com project-free-upload.com nowvideo.co nowdownload.ch novafile.com multiup.org muchshare.net mirrorupload.net megavideoz.eu megashares.com load.to kingfiles.net keep2share.cc stiahni.si speedyshare.com speedvideo.net speedshare.eu sharingmaster.com sharerepo.com sendspace.pl sendmyway.com sendfile.su sanshare.com sakurafile.com rosharing.com rodfile.com rghost.net rapidfileshare.net vip-file.com vidplay.net uppit.com uploadscenter.com uploadhero.co uploadboy.com uploadbb.co uploadbaz.com uplea.com unlimitzone.com turo-bit.net

GOOD MONEY STILL GOING BAD 28 Ethan Allen Esurance Lauder Estee EMC Emblem Health eFax Eddie Bauer eBay DirecTV Digital Entertainment World DeVry University Crest &Barrel Crate Consumer Reports Citrix Citibank Row Chelsea Chase Capital One Canon Brooks Brothers University Bridgeport Bose Booking.com BMW Bitstream Bing Buy Best Baidu Anthem Blue Cross Association American Heart Amazon.com Ally Bank sample. the in sites to the visits during analysts by MediaLink were observed brands premium following The APPEARING ON SAMPLE SITES APPENDIX E:PREMIUM BRANDS Lenovo Lego Kmart Kia Kaltura Jones Sausage Join.Me Jeep J Brand dia) (via Solve Me iStockphoto ING Bank Incapsula If/Then (Broadway Musical) Hulu HP Hotel Indigo Honda Helzberg Diamonds Hartford Courant Google Daddy Go Glad ResearchGigaOm Geico Full University. Sail Ford Firstmediahub.com FilmOn.com Fiat Fan Duel Fairfield University Facebook - Mini Cooper Microsoft McCormick Mazda StewartMartha Living Marriott Marie Callender’s MapQuest Macy’s l a re O L’ Bean L.L. LifeLock LG Port AdrianaPort Polk Peugeot PCMag PayPal Pandora P.F.Chang’s Overstock.com Orbitz Oracle Online Optimum Depot Office 365 Office Nissan Nike 6 Nexus Myspace Mucinex Mountain Dew MoneyGram

Shakira Sears Children Save The SAS MaeSallie Salesforce Roku Rite Aid Next Retail Bull Red Quibids Oats Quaker Publisher’s Clearinghouse Zappos Zales Weebly Webster Bank Vonage Volkswagen Vevo Verizon TruTV Toyota T-Mobile Time Warner Cable Tide York New The Times Target Staples Spiceworks Media Solve Snapfish Vegas Hotel Las SLS

GOOD MONEY STILL GOING BAD 29 Here are the networks and exchanges that appear on double-digit numbers of sites. numbers double-digit on appear that exchanges and networks are the Here mate publishers. legiti as masquerading by identities true their conceal to attempts fraudulent and nature cyclical sites’ the by difficult more made acommitment theft, content to battling have committed of those Many world. the in companies tech ad top the clude in others industry, theft content the servicing about likely have qualms no networks of those many While sites. the serving on This the on data sites. is 179 a based identified of and 2015 Feb. ad snapshot exchanges Researchers networks the sites. 24, Working with Veri-Site, MediaLink was able to determine ad networks that supplied content thieves with the advertisements SITES THEFT CONTENT APPENDIX F: AD NETWORKS SERVING directadvert.ru xtendmedia.com exoclick.com adk2.com epom.com rightmedia.com pubdirecte.com advertising.com adlabs.ru advmaker.ru marketgid.com directrev.com propellerads.com doubleclick.net zedo.com rubiconproject.com matomymedia.com revenuehits.com AD NETWORK appnexus.com infolinks.com adcash.com popads.net recreativ.ru adnxs.com openx.net adriver.ru adap.tv

SITES 109 36 63 38 29 53 43 34 34 25 24 10 10 10 10 22 16 19 14 13 17 21 12 21 11 11 11

- -

GOOD MONEY STILL GOING BAD 30 tions of analysis and data were provided by: were provided data and of analysis tions contribu significant researchers, MediaLink’s to addition In and project. have into this put effort partners its and MediaLink that care the appreciates greatly Alliance Citizens Digital ACKNOWLEDGEMENTS More information at landscape. media digital the across for players ROI and efficiency, visibility, improved drives technology gral’s Inte performance. and quality its control and monitor can side sell the exposure—while favorable receive and enables advertising to appear in quality environments that set solution acomprehensive on focuses Integral media. of quality selling and buying to the essential is that platform valuation evolved media into a global has Integral innovation, pow and growth by constant ered 2009, in solution safety brand preventative first for rating media quality. Since launching the industry’s and sellers of digital media and the industry’s standard er of actionable advertising intelligence data for buyers > doubleverify.com acrossty to campaigns drive performance. Learn more at quali audience and delivery impression accurate tection, safety, pro brand fraud viewability, ad ensuring market, ers by bringing transparency and accountability to the sell and buyers for create media value DV solutions line. on advertisers largest world’s the for effectiveness and technology and insights that assure brand performance > at tional, regulatory, and reputational risk. More information targets these threats with intelligence to manage opera sanctioned entities operating online. Veri-Site uniquely crime, web-enabled transnational organized crime, and cyber theft, property intellectual websites, rogue ing regard Veri-Site risk-relevant provides intelligence ment. risk associated with the rapidly changing online environ > > > > www.verisiteglobal.com Integral Ad Science Inc. Ad Science Integral DoubleVerify Veri-Site , a global leader in assessing and mitigating mitigating and assessing in leader , aglobal , the proven market innovator with the . integralads.com . , the leading global provid global leading , the . ------Incopro’s market-leading service is designed to meet the the to meet designed is service Incopro’s market-leading don-based consultancy dedicated to anti-piracy services. > at information More clients. 2,000 than more for its scale aglobal on ics analyt data power big and amonth interactions of digital trillions to capture infrastructure technology world-class The proprietary comScore Census Network™ leverages a world. amulti-platform in to succeed solutions custom and analytics real-time software, of on-demand a variety Analytics product suites, comScore provides clients with Analytics, Advertising Analytics, and Digital Enterprise Audience its Through investments. digital of their value the to maximize clients enable that behavior consumer TV and web, on mobile insights delivering analytics, and > targeted action and shape your ongoing strategy. take decisions, make informed can clients that ensuring livers a near real-time view of the infringing environment, de technology clustering and analysis unique Their ment. to enforce approach intelligent and innovative an secure to Incopro use who owners IP of prestigious requirements > > Incopro Inc. comScore , or Intelligent Content Protection, is a Lon comscore.com , a global leader in digital measurement measurement digital in leader , aglobal . - - - -

GOOD MONEY STILL GOING BAD 31