http://go.whiteops.com/rs/179-SQE-823/images/WO_Methbot_Operation_WP.pdf
Have a read, it's very interesting. From another thread:
Normally a "real browser" can't run 100s of ad players at once, but "methbrowser" is a node.js application with a C module that speaks Flash's plugin protocol directly. It simulates a dom, runs JavaScript in a node VM, but doesn't have to do any of the messy rendering that things like PhantomJS have to.
It was discovered years ago because:
* Their IP stack was acting like Linux[1]
* Their flash player said "I'm Linux"
* Their user agent said other things (random user agents)
* Their DNS traffic was going UK, but the hosts were coming out of the US
Have a read, it's very interesting. From another thread:
Normally a "real browser" can't run 100s of ad players at once, but "methbrowser" is a node.js application with a C module that speaks Flash's plugin protocol directly. It simulates a dom, runs JavaScript in a node VM, but doesn't have to do any of the messy rendering that things like PhantomJS have to.
It was discovered years ago because:
* Their IP stack was acting like Linux[1]
* Their flash player said "I'm Linux"
* Their user agent said other things (random user agents)
* Their DNS traffic was going UK, but the hosts were coming out of the US
