Click Fraud on the Rise: How AI Slop is Causing Millions of Spoofed Clicks

By Arik Nagornov and Noam Gil, DV Fraud Lab

Have you ever clicked through a link or an ad, only to find yourself in a totally unexpected (and even troubling) destination?

According to DV’s AI slop and fraud research teams, this is becoming an increasingly wide-spread phenomenon, and it’s closely tied to the rise of AI-powered fraud.

Since vibe-coding new websites is a matter of minutes, AI-Slop websites became handy for harvesting advertising dollars from unsuspecting advertisers. Consumers who reach these websites often report frustration and an erosion of trust towards the digital ecosystem. What they don’t realize is that, under the hood of AI slop, there’s also an ocean of fake/manipulated clicks, as further discussed below.

Thanks to the DV Fraud Lab’s domain expertise, paired with DV’s engagement measurement capabilities and click data research, we can zoom in on a case study where bad actors manipulated clicks within networks of “vibe-coded” websites. Fraudsters execute this mass deployment in minutes via website copying tools, allowing hundreds of websites to be launched instantly from a single codebase where only the domain name changes. DV researchers have coin-named this massive multi-domain ad fraud ring as the “Watch-Me” scheme.

Secret “Watch-Me” Links Lead Users into Click-Harvesting Videos, Hidden Behind Website-Cloaking Deception

Websites on the “Watch-Me” fraud ring were luring in viewers by planting their links into suggestive social posts. AI-generated images of young women are often used by this network, overlapping with the AI-Slop “Dream Girls” fraud scheme that DV has exposed earlier in 2026.
Can anyone actually watch the video if you click on these posts? That depends. In reality, the video version of each website is only available to those reaching the website through certain flows, designed to monetize clicks. For example, a completely different website awaits desktop users, compared to mobile users.

The following snippet of a custom http headers employed when testing one of the sites on the network reveals the mechanism, only users who reach the website from designated countries, via certain social media posts, will see the adult video streaming version of the site. The rest will get a misleading article about finance, made to trick any brand or agency into thinking that the content is brand-suitable and benign.

If the user passes the five checks, they get a video that encourages the user to keep clicking and engaging with the website. Ads will be running behind the video, ensuring a steady flow of money into the fraudster’s pockets. If the user does not pass the five checks, they get a standard AI slop site, including ads, but the content isn't so engaging (e.g. finance articles) and users rarely click on anything within these sites. This "vanilla" version of the website is a decoy, made to look like a legitimate website to a verifier/reviewer.

To recap, only users who are targeted by the scheme, i.e. users who are found eligible as victims of click manipulation/monetization, will see the video player version of the “Watch-Me” websites. These users will also experience manipulated clicking mechanisms. For example, they will be prompted repeatedly to click on certain ads in order to keep watching the video to its very end. At its peak, operators of the “Watch-Me” Scheme ran hundreds of websites, monetizing over 500,000 daily impressions and tens of millions of ad placements.

Who Benefits from Cloaking and Clicks Misredirection/Misrepresentation?

Clicking on a link that leads to the wrong page can be the result of a variety of fraud schemes that have dozens of names in the industry: URL cloaking, property misrepresentation, arbitrage, adware, MFA (made-for-advertising), DNS/domain takeover, SEO hijacking. All of the above are fraud methods that typically involve tampering with a user’s click flow.

The main vehicle for monetizing clicks goes through an overwhelming load of ads. Operators of low-quality websites often bombard users with ads to an extreme, while showing nearly no regard for editorial integrity, nor for user experience. The high volume of impressions, obtained through such aggressive monetizations, is paired with abnormally high click-rates, sometimes reaching or even surpassing 50% impression-to-ad-click rates.

DV Helps Advertisers Protect Their Campaigns from Click Fraud Operations Like The “Watch-Me” Scheme

The operators of the “Watch-Me” scheme attempted to hide their activity behind finance websites, gaming websites, fashion, style, entertainment and more. DV’s advanced, AI-powered solution repeatedly caught on to these operations, thanks to a combination of expertise in AI slop schemes, made-for-advertising (MFA) or arbitrage schemes, misrepresentation, spoofing, cloaking and other forms of fraud.

DV delivers comprehensive invalid traffic (IVT) and fraud protection across the entire impression flow; from pre-bid avoidance through post-bid measurement and blocking, spanning desktop, mobile web, mobile app, CTV and social platforms. Powered by the DV Fraud Lab's deterministic AI/ML detection framework, this protection helps prevent fraudulent traffic before it can distort optimization signals, waste media spend, or degrade downstream lead quality.

DV's primary mitigation is preventing the underlying impressions from being purchased in the first place: pre-bid avoidance, video filtration, and post-bid blocking keep media dollars away from the sites, apps, and devices behind click-farm activity. Ad hoc click-farm case studies, reporting, and testing are available on request.

Not All Click Fraud is as Harmful as the “Watch-Me” Scheme

The “Watch-Me” scheme is an outlier in being a fascinating glimpse into the world of manipulated clicks. We’ve barely scratched the surface of fraud signals detected for this scheme. However, the world of click discrepancies is far wider and more complex than this scheme. For context, below is a list that covers some of the common buckets of invalid click reasons, organized into some of the most common categories you may encounter across the ecosystem.

Only a handful of the behaviors on this list will reach magnitudes of impact that the “Watch-Me” scheme can generate. More importantly, the vast majority of discrepancies can be minimized by turning on IVT avoidance and/or monitoring solutions earlier in the funnel, i.e. during the impression or bid phase. This is where root cause analysis into impressions and clicks alike becomes vital in supporting transparency and trust.

Shades of Click Fraud and Invalid Clicks: A Non-Exhaustive List

Forced / Deceptive UI Clicks

1. Forced clicks via unskippable overlays with fake "X" close icons
2. Forced clicks via auto-redirects triggered by page load or scroll (accidental navigation)
3. Forced clicks via fake system/OS dialog boxes (e.g., fake virus warnings, "update now" prompts)

Excessive Clicks Motivated by Incentivized Browsing Business Models

1. Incentivized clicks via reward-app "offer walls" requiring ad clicks for in-app currency
2. Incentivized clicks via click-to-earn browser extensions or paid-to-click sites
3. Automated / Scripted Clicks, often with randomized evasion techniques and/or misrepresented headless browser automation
4. Manipulated clicks via human-operated click farms
5. Manipulated clicks via agent/bot-operated click farms
6. Manipulated clicks via crowdsourced "get paid to click" gig platforms

Excessive Clicks Operated From Hijacked Devices/Sessions

1. Generating false clicks via malware-infected devices (botnets)
2. Generating false clicks via install-time click injection (e.g. hijacking install broadcasts)
3. Generating false clicks via SDK/API spoofing (fabricated click events sent directly to ad or attribution servers with no real click)

Manipulated Clicks Using Cloaking/Misrepresentation

1. Click device misrepresentation via emulators
2. Click device misrepresentation via device/advertising-ID spoofing or reset-and-recycle fraud (ADID/IDFA cycling)
3. Click device misrepresentation via physical device farms (racks of rooted/jailbroken phones)
4. Click geo misrepresentation via VPN or proxy IPs
5. Click geo misrepresentation via residential proxy networks and data centers
6. Click geo misrepresentation via GPS/location-spoofing apps
7. Click context misrepresentation via website cloaking
8. Click context misrepresentation via app cloaking
9. Click context misrepresentation via hidden ads behind video players
10. Click context misrepresentation via pixel stuffing (1x1 invisible clickable ad units)
11. Click context misrepresentation via ad stacking (multiple ads layered so one click registers across several)
12. Click hijacking via last-click attribution theft (adware/affiliate intercepting a genuine click right before conversion)
13. Click spamming via broad, blind click-flooding across many placements to opportunistically claim attribution credit

Invalid Clicks as a Side Effect of Unrelated/Unintentional Bot Activity

1. Competitor clicks: manually or automatically clicking a rival's PPC ads to exhaust their budget, influence algorithms, gather intel, etc.
2. DDOS attacks: automatically flooding a rival's ads to exhaust their budget
3. GIVT crawlers and scrapers: transparent/declared AI-powered scraping and crawling bots
4. GIVT creative audit bots: crawling bots employed by creative audit organizations
5. SIVT Scorpio botnets: evasive AI-powered scraping and crawling bots.