A mysterious shell company revealed by BuzzFeed News to be part of a massive digital ad fraud scheme recently took the unusual step of suing a legitimate ad company in order to recoup its fraudulent earnings.
The resulting court documents provide further evidence of the brazenness of the scheme, the impunity that those committing ad fraud operate with, and why the global digital ad industry is unable to stop its ballooning, multibillion-dollar fraud problem.
The lawsuit was filed in June of last year by a Cyprus-registered company called Imoderatus against Woobi, a reputable Israeli ad tech vendor. Imoderatus claimed in its Israeli civil court filing that Woobi improperly withheld roughly $105,000 in earnings generated by its mobile apps. It also leveled a stream of puzzling and false accusations, including that Woobi created a fake employee to deal with Imoderatus, and that it was running an elaborate scheme to defraud publishers. The suit went so far as to request that the court lift the veil on the private finances of Woobi’s founders in order to reveal their supposed ill-gotten gains.
In reality, the accusations describe the very tactics used by Imoderatus and other shell companies that a BuzzFeed News investigation revealed were part of the same sophisticated ad fraud operation.
As previously detailed, the companies used fake employees, copycat corporate websites, a portfolio of more than 125 Android apps and websites, and advanced techniques for creating fake traffic to defraud brands and other players in the ad industry. Google said the scheme stole close to $10 million from it and its partners.
The revenue earned by the fraudulently viewed ads in the apps and sites was then routed through shell companies registered in Cyprus, Serbia, Bulgaria, and Malta to obscure the ultimate beneficiaries.
One insider involved in the scheme estimated it stole hundreds of millions of dollars in total. BuzzFeed News ultimately connected the network of shell companies to a Maltese company called Fly Apps Ltd. Its owners are two Israelis, Omer Anatot and Michael Arie Iron, as well as two Germans, Thomas Porzelt and Felix Reinel.
In messages sent via WhatsApp last fall, Anatot denied any involvement in the ad fraud scheme. Subsequent responses sent by a lawyer from Harder LLP on behalf of Fly Apps also denied any involvement or connection to the shell companies and their apps.
Reached for comment on the Imoderatus lawsuit last week, Harder LLP told BuzzFeed News it no longer represents Fly Apps. Anatot read but did not respond to a message sent via WhatsApp. A message sent to his Fly Apps email bounced back.
Chaya Soggot, the CEO of Woobi, told BuzzFeed News she was shocked that Imoderatus leveled accusations of fraud against her and her company.
“I didn’t think they had a chance [with the suit], but I was definitely shocked by the confidence and audacity to come and accuse me of things they were doing,” she said.
By the time Imoderstus filed suit in June, Soggot’s team had completed an internal investigation that uncovered a range of incriminating connections between Imoderatus and five other companies that had also approached Woobi to monetize their Android apps. This combined with previous concerns raised by Woobi’s partners and advertisers about the level of fraudulent traffic found in apps from these companies.
But the fraudsters persisted with the case even after a blog post by anti-fraud vendor Pixalate revealed some elements of the scheme in June, and the October BuzzFeed News investigation exposed the shell companies, beneficiaries, and apps involved. The case was only dropped a few weeks ago after it became clear that Imoderatus was required to send someone from the company to appear in person for a court hearing scheduled for Jan. 15.
Soggot said Imoderatus’s lawyer informed her counsel that it wasn’t “convenient” for his client to appear, and they would therefore drop the case.
Reached by phone, Doron Adiri, the lawyer for Imoderatus, declined to speak to BuzzFeed News.
“It’s a shame that companies such as these and actions such as the ones they made create a bad reputation and a burden on the industry,” Soggot said.
Things started to fall apart for Imoderatus in late 2017 when Woobi sent out emails to customers and partners asking for an address to send a Christmas gift to. On its list were six companies that between them owned more than a dozen mobile game apps. Woobi was using its technology to help place ads in the apps, thereby earning money for both parties, but especially for the game developers.
From February until late summer of 2017, Imoderatus often earned tens of thousands of dollars per month from Woobi, which was just one of many advertising partners that the fraudsters worked with. Court documents filed by Imoderatus included an invoice it sent to Woobi for August 2017 for $26,517.06. Another from November was for $30,869.66.
Not long after the November invoice was sent, Imoderatus and other seemingly separate companies responded to a request from Woobi for their address by all sending the same location in Cyprus.
This set off alarms at the Israeli company because in recent weeks some of Woobi’s partners and advertisers had been raising concerns about high levels of fraudulent traffic coming from the apps associated with these same companies.
Woobi’s court filing includes pages of emails and data from spreadsheets showing that the quality of traffic in apps belonging to Imoderatus and companies named Visont, Kheus, Osypo, Morrum, and Bitx, raised red flags starting as early as October of 2017.
On Oct. 30, a Woobi partner emailed to say the Imoderatus apps Twist Your Fingers, Twist Your Fingers! 2, and Quick Draw had more than 94% fraudulent traffic, according to a third-party verification company. Another app, Ghost Detector, had the same level of fraud, but was owned by Morrum. At the time Woobi believed Morrum was a separate company. Other apps from seemingly separate companies soon began getting flagged for similar concerns about fraudulent traffic.
The traffic was identified as fraudulent by Protected Media, an Israeli ad fraud detection vendor. Asaf Greiner, its CEO, told BuzzFeed News his company spotted and blocked the traffic for its customers early on. He said fraudsters are often able to continue to operate because as of now the industry does not have a clear way for a company like his to “warn others from the dangers we find early on.”
“Though we detected the attack within multiple customers' traffic there was no trigger for us to investigate the source at the time, as we had no action for us to take against the offender once we find them,” he said. “There are no central means of sharing the information for the greater good.”
Similarly, Soggot said Woobi blocked specific apps for customers who requested it, but that different ad fraud detection companies often come to different conclusions about the same traffic, so they were not yet ready to block the apps completely. Her team pressed their rep at Imoderatus, who went by the name Ada Rose, for answers.
“They were very good at answering questions that came up. They definitely created a sense of, you know, they definitely reassured us,” she said. “We weren’t able to connect the big picture until November, when we asked for an address to send a Christmas gift.”
Ada Rose has a threadbare LinkedIn profile that describes her as an “ad operation manager” for Imoderatus, based in Cyprus. She was the person who, in early 2017, signed the contract with Woobi on behalf of Imoderatus. After the Christmas gift address slip-up, Woobi went back and saw that the person who digitally signed the contract as Ada Rose did so using an IP address based in Romania, not Cyprus.
As its investigation kicked into high gear at the end of 2017, Woobi discovered more evidence that connected the shell companies to one another, and suggested that in some cases the same person was pretending to work for different companies.
“We had emails from different companies that had the exact same text and were sent five minutes apart from each other,” Soggot said. “Let’s say we had John Doe working for one company and Jane working for a different company, then John signed his name on Jane’s email … If things are legit you don’t go through those lengths to go and hide yourself.”
On Dec. 21, 2017, Soggot’s team sent emails to the relevant companies telling them they were suspending their accounts and would not work with them again. That was largely met with silence from the affected companies, except Imoderatus. Ada Rose pushed back, demanding more detailed evidence, according to a lengthy email exchange filed with the court as part of Woobi’s defense. She asked for “solid proof and reports for each accusation and you will provide it as soon as possible,” and demanded that Woobi pay the $43,326 that Imoderatus’s apps had earned in August and September.
Woobi told Imoderatus it would not be paid, noting that they had never seen such high levels of invalid traffic, the industry term for fraudulent views and/or users. “To be honest, we were shocked seeing these IVT findings,” wrote Ohad Preger, the Woobi account rep that Imoderatus would later claim was not a real person. (Woobi’s court filings included a photocopy of his Israeli ID card.)
Soggot is still amazed at the lengths the fraudsters went to with their operation.
“I’ve never seen anything like this before. In this industry, fraud isn’t new, but something like this? No, not to the best of my knowledge — I’ve never seen this.”
Soggot didn’t hear anything more about Imoderatus until June 14, when she was sent a link to a blog post from ad verification firm Pixalate.
It reported the discovery of a sophisticated fraud scheme involving an app called MegCast that was pretending to be a wide range of other apps in order to fraudulently earn revenue. MegaCast was one of the apps that Woobi had helped monetize, and that clients had raised some initial concerns about. She also recognized other apps listed in the Pixalate blog post and realized how big of an operation it was.
“We didn’t really understand the method of fraud or what really happened until the Pixalate article came out. That validated the science behind it,” Soggot said.
Hours later, the lawsuit from Imoderatus landed on her desk. “It was a lot to take in that day,” she said.
Soggot felt the Pixalate blog post helped her case. Her lawyers included a Hebrew translation of it in their more than 100-page defense filed with the court. Then, in October, BuzzFeed News published its investigation that revealed just how big the scheme was, how it worked, and who was involved.
“In terms of the lawsuit I was hoping [the BuzzFeed News] story would give me more material to prove my case,” Soggot said. “But them pulling the lawsuit wasn't something I necessarily [expected]. It was surprising they went through with it — but a lot of the things that happened were surprising.”
Last month, Soggot and her lawyer headed to a court-mandated mediation session with Imoderatus and its lawyer. Parties involved in civil suits in Israel must meet with a mediator to see if they can resolve the issue before proceeding to trial, she said. The attorney for Imoderatus, Doron Adiri, arrived by himself.
“I was really looking forward to meeting them in person,” she said.
The mediator informed Adiri that his client would need to appear in person for future mediation sessions, or if the trial went ahead. At that point, the case ground to a halt. “Their lawyer claimed they are not in Israel and therefore can’t show up, it’s too much of a hassle for them to do that,” Soggot said.
Weeks later, Adiri contacted her lawyer to propose a settlement for roughly a tenth of the amount of money they were claiming. Soggot declined the offer, believing it was mostly an attempt for the other side to recoup legal fees. “I already paid a lot of money for my legal fees, I didn’t feel the need to pay his,” she said.
On Dec. 19, the case was dropped. But even with that vindication, Soggot was reluctant to speak with BuzzFeed News. She’s concerned that any association with the people who executed the scheme could hurt her business, even though her team connected the shell companies long before anyone was publicly aware of what they were up to, and took action to stop working with the apps.
Soggot’s also frustrated by how much of her and her team’s time was spent piecing together the scheme and defending against a lawsuit — all because of some very determined ad fraudsters.
“I spent too much time on this, it’s not how I want to spend my day,” she said. “I want to focus on delivering a good service to my clients, so it’s a shame and it’s definitely something for this industry to clean up."
Additional reporting by Miriam Berger.