--- title: Pixalate discovers sophisticated sites that hijack sessions without malware description: Pixalate has uncovered a family of web site committing session hijacking — a form of Sophisticated Invalid Traffic (SIVT), as defined by the MRC. image: https://www.pixalate.com/hubfs/Blog_Media/Blog%20photos/Momtaxi%20Pixalate%20MRT.png --- [![pixalate-full-logo](https://www.pixalate.com/hs-fs/hubfs/Pixalate_Logos/pixalate-full-logo.jpg?width=150&height=60&name=pixalate-full-logo.jpg "pixalate-full-logo")](https://www.pixalate.com) Search **Menu** ** ** ![](https://www.pixalate.com/hubfs/Blog_Media/Blog%20photos/Momtaxi%20Pixalate%20MRT.png) [Thought Leadership](https://www.pixalate.com/blog/topic/thought-leadership) | [Investigations](https://www.pixalate.com/blog/topic/investigations) | 4 min read # Pixalate discovers sophisticated sites that hijack sessions without malware Written by [Pixalate](https://www.pixalate.com/blog/author/pixalate) Sep 6, 2017 3:38:38 PM Pixalate has uncovered a family of web sites committing [session hijacking](https://blog.pixalate.com/mrc-definitions-sivt-hijacked-devices-user-sessions-ad-tags-creative) — a form of Sophisticated Invalid Traffic (SIVT), as defined by the MRC. The sites in question are capable of hijacking a user’s browser without any malware installed, continually refreshing the browser to generate more ad revenue. **(Update: The sites in question appear to have been taken down. But this post still contains video and data to detail how this type of attack works.)** The “zombie sites” work on both desktop and mobile devices. On mobile devices, the site attempts to pull users away to the App Store. ### **Monkey Frog Media: The family of sites behind the hijacked sessions** [Monkey Frog Media](http://www.monkeyfrogmedia.com/) is the parent site and home to a number of sites that all commit the same type of ad fraud. It claims to be a site dedicated to three topics — food, parenting, and technology — but it appears to be a front to commit ad fraud. The sites under Monkey Frog Media’s umbrella include: - Trendy Recipe - Tech’s Life - Watch the Screen - Right Parent - Mom Taxi - Recipe Dept. - Arcade Duck ### **Session hijacking can lead to 600+ ads served to one browser window within 1 hour** **![mom-taxi-double-chart.png](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/mom-taxi-double-chart.png?width=640&name=mom-taxi-double-chart.png)** The cumulative effect of a hijacked web browser can be devastating for advertisers. In our analysis of MomTaxi.com, using the Chrome browser, after just 10 minutes, nearly 100 ad impressions will be served to a single “user.” All of this data shows just one user session within a single browser. - 10 Minutes: 91 impressions served - 20 Minutes: 215 impressions served - 30 Minutes: 324 impressions served - 40 Minutes: 445 impressions served - 50 Minutes: 539 impressions served - 1 Hour: 655 impressions served ### **More than an auto-refresh: This threat also self-navigates — without malware** This attack is unique because it does not just auto-refresh the page to generate more impressions, like many similar session hijackings. This threat also self-navigates to replicate legitimate human activity. This is a sophisticated attack that linearly spaces automatic redirects to mimic real user behavior. The correlation between redirects and elapsed time has a nearly perfect R-squared, of .999. The fraud attack leads to a tidy 100 internal redirects per hour — or about 5 redirects every 3 minutes. - 10 Minutes: 15 automatic internal redirects - 20 Minutes: 32 automatic internal redirects - 30 Minutes: 49 automatic internal redirects - 40 Minutes: 68 automatic internal redirects - 50 Minutes: 84 automatic internal redirects - 1 Hour: 100 automatic internal redirects ### **Device- and browser-aware ad fraud attack** The Monkey Fraud Media ad fraud ring is also sophisticated in that its technology is capable of identifying which browser or device the "user" is on. The attack uses this data to inform its redirects. For example, the websites make calls to the Apple store. If you were on an iTunes-compatible device, the site will automatically navigate you to the iTunes store through a series of malicious redirects (that likely give the fraudster referral credit). Depending on which browser or device you are using, the attack can attempt to drive you off of the site to another site, again through a series of malicious redirects. ### **Fraudsters could steal millions per year using this site** These sites also auto navigate and refresh within different tabs and browsers, even if you don’t have the tab or browser open. This allows the fraudster to exponentially multiply the attack and the amount of money stolen. According to our data, the estimated price paid for ads on Mom Taxi is $0.75 CPM. Based on all of this data, if the fraudster were able to keep 2,000 browsers/tabs open on Mom Taxi all day (via a farm, for example), then they would steal nearly $25,000 per day from advertisers. - 1 browser/tab left open for 24 hours: $11.79 stolen - 100 browsers/tabs left open for 24 hours: $1,179 stolen - 500 browsers/tabs left open for 24 hours: $5,895 stolen - 2000 browsers/tabs left open for 24 hours: $23,580 stolen - 5000 browsers/tabs left open for 24 hours: $58,950 stolen To be clear: These figures represent hypothetical scenarios that depict how this site — or similar sites/attacks — could impact marketers’ pocketbooks. Even if we take one of the more modest hypotheticals (500 browsers/tabs left open for 24 hours), a sustained attack would net the fraudsters over $2 million per year. ### **Monkey Frog Media: A growing threat?** **![monkey-frog-media-alexa-rank.png](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/monkey-frog-media-alexa-rank.png?width=640&name=monkey-frog-media-alexa-rank.png)** You may not have ever heard of Monkey Frog Media or its subsidiary sites, but the site has catapulted up the [Alexa rankings](https://www.alexa.com/siteinfo/monkeyfrogmedia.com) in recent months. As of this writing, monkeyfrogmedia.com ranks #2,330 in Canada and #7,794 globally. In September of 2016, it wasn’t even in the top 40,000. ![Momtaxi Pixalate MRT.png](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/Momtaxi%20Pixalate%20MRT.png?width=640&name=Momtaxi%20Pixalate%20MRT.png)The Pixalate [Media Rating Terminal](https://www.pixalate.com/ratings/) (MRT) shows that MomTaxi.com is a high-risk site for both desktop and mobile ad impressions. Interestingly, while Monkey Frog Media has seen a meteoric rise in its Alexa rankings, none of its subsidiary sites have dramatically improved, according to their individual rankings. By looking at the SimilarWeb information, we can see that 100% of this site's traffic goes to "click.monkeyfrogmedia.com," and each of the individual properties has "click.monkeyfrogmedia.com" as a top referral traffic source. This referral loop boosts Monkey Frog Media’s rankings, making it appear legitimate. Looking at the SimilarWeb information once again, one can see that the top sources of inbound referral traffic are porn or illegal streaming sites for each individual property. *Want more data-driven insights? Sign up for our blog! * ### Search Blog Search ### Follow Pixalate ### Subscribe to our blog *By entering your email address and clicking Subscribe, you are agreeing to our [Terms of Use ](https://www.pixalate.com/terms)and [Privacy Policy.](https://www.pixalate.com/privacypolicy) Previous Story [← Pixalate Week in Review: August 28 - September 1, 2017](https://www.pixalate.com/blog/programmatic-ad-fraud-news-week-in-review-september-1-2017) [** ](https://www.pixalate.com/blog) Next Story [Marketing Land: Tips to avoid programmatic ad fraud →](https://www.pixalate.com/blog/tips-to-avoid-ad-fraud-in-programmatic-click-fraud-marketing-land) ## You May Also Like These Stories on Thought Leadership [![](https://www.pixalate.com/hubfs/Q%26A%20with%20Krush%20Media%20-%20cover.png) ](https://www.pixalate.com/blog/krush-media-qa) [Case Studies](https://www.pixalate.com/blog/topic/case-studies) ### [Q&A with Steven Slaughter, Head of Ad Ops & Yield at Krush Media, on managing a clean CTV and Mobile Ad Supply Chain](https://www.pixalate.com/blog/krush-media-qa) Jun 27, 2023 12:00:00 PM | 4 min read [![](https://www.pixalate.com/hubfs/Q%26A%20with%20Screencore%20-%20cover.png) ](https://www.pixalate.com/blog/screencore-qa) [Case Studies](https://www.pixalate.com/blog/topic/case-studies) ### [Q&A with Jess Okan, Co-founder and CEO of Screencore, on strategies for minimizing ad fraud in the connected TV ecosystem](https://www.pixalate.com/blog/screencore-qa) May 30, 2023 7:00:00 AM | 6 min read [![](https://www.pixalate.com/hubfs/Oleksandra%20Kazantseva.png) ](https://www.pixalate.com/blog/bizzclick-qa) [Case Studies](https://www.pixalate.com/blog/topic/case-studies) ### [Q&A with Oleksandra Kazantseva, Head of Programmatic at BizzClick, on transparency, trust, and security](https://www.pixalate.com/blog/bizzclick-qa) Apr 17, 2023 2:00:00 PM | 4 min read ** ### Subscribe to our blog *By entering your email address and clicking Subscribe, you are agreeing to our [Terms of Use ](https://www.pixalate.com/terms)and [Privacy Policy.](https://www.pixalate.com/privacypolicy) ![pixalate-logo-red-small](https://www.pixalate.com/hs-fs/hubfs/2018NewTemplate/pixalate-logo-red-small.png?width=208&name=pixalate-logo-red-small.png "pixalate-logo-red-small") ** By entering your email address and clicking Subscribe, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and [Privacy Policy](https://www.pixalate.com/privacypolicy) Products [Analytics](https://www.pixalate.com/products/analytics) [Blocking](https://www.pixalate.com/products/blocking) [Media Rating Terminal](https://www.pixalate.com/products/mrt) [Publisher Trust Indexes](https://www.pixalate.com/rankings/?group=app&reportId=publisherTrustIndex) [Seller Trust Indexes](https://www.pixalate.com/rankings/?group=app&reportId=publisherTrustIndex) [IoT Device Rankings](https://www.pixalate.com/rankings/?group=app&reportId=iotDeviceReach) Resources [Blog](https://blog.pixalate.com/) [Press](https://www.pixalate.com/press) [Careers](https://www.pixalate.com/jobs) [Team](https://info.pixalate.com/pixalate-leadership-team) Contact Email [** sales@pixalate.com ](mailto:sales@pixalate.com) [** privacy@pixalate.com ](mailto:privacy@pixalate.com) US: [** +1 888 749 2528 ](tel:+1%20888%20749%202528) EU: [** +44 (0)800 011 2050 ](tel:+44%20(0)800%20011%202050) Slack: [Join ATSAPI Slack Channel ](https://atsapi-pixalate.slack.com/join/shared_invite/zt-10dtow5cj-OEtlNr5yzJkrZMQUqcEEow#/shared-invite/email) Offices Global Offices US 1775 Greensboro Station Place, Suite 425, McLean, VA 22102 UK 20 North Audley Street London, W1K 6WE, United Kingdom EU 10 Earlsfort Terrace Dublin 2, D02 T380, Ireland Singapore 10 Anson Road, #22-02 International Plaza, Singapore 079903 [![facebook](https://www.pixalate.com/hubfs/footer/icons/facebook.png) ](https://www.facebook.com/pixalate) [![x](https://www.pixalate.com/hubfs/footer/icons/twitter-x.png) ](https://twitter.com/pixalateinc) [![linkedin](https://www.pixalate.com/hubfs/footer/icons/linkedin.png) ](https://www.linkedin.com/company/pixalate) ![wechat](https://www.pixalate.com/hubfs/footer/icons/wechat.png) [![slack](https://www.pixalate.com/hubfs/footer/icons/slack.png) ](https://atsapi-pixalate.slack.com/join/shared_invite/zt-10dtow5cj-OEtlNr5yzJkrZMQUqcEEow#/shared-invite/email) [Terms of Use](https://www.pixalate.com/terms) [Privacy Policy](https://www.pixalate.com/privacypolicy) [GDPR Compliance](https://www.pixalate.com/gdpr) Disclaimer Copyright © 2025 Pixalate [Back to top **](https://www.pixalate.com/blog/momtaxi-session-hijacking-auto-refresh-ad-fraud-site#) # Disclaimer Disclaimer: The content of this page reflects Pixalate’s opinions with respect to the factors that Pixalate believes can be useful to the digital media industry. Any proprietary data shared is grounded in Pixalate’s proprietary technology and analytics, which Pixalate is continuously evaluating and updating. Any references to outside sources should not be construed as endorsements. Pixalate’s opinions are just that - opinion, not facts or guarantees. Per the MRC, “'Fraud' is not intended to represent fraud as defined in various laws, statutes and ordinances or as conventionally used in U.S. Court or other legal proceedings, but rather a custom definition strictly for advertising measurement purposes. Also per the MRC, “‘Invalid Traffic’ is defined generally as traffic that does not meet certain ad serving quality or completeness criteria, or otherwise does not represent legitimate ad traffic that should be included in measurement counts. Among the reasons why ad traffic may be deemed invalid is it is a result of non-human traffic (spiders, bots, etc.), or activity designed to produce fraudulent traffic.” ** ** *By clicking Download and entering your email address, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and have read and acknowledge our [Privacy Policy](https://www.pixalate.com/hubfs/2024-08-20_Pixalate_Privacy_Policy.pdf). *Copyright © 2025 Pixalate** * * * * * * * * * * * * * * * * * * * * * * * * * * * * × ## Subscribe to the Pixalate Blog The first step in ad fraud prevention. Loading... By entering your email address and clicking Submit, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and [Privacy Policy](https://www.pixalate.com/privacypolicy). ![pixalate-logo-white](https://www.pixalate.com/hubfs/Blog_V2_08_26_2016/logo/Pixalate_Logo_WHITE.png) ##### Contact Us12 Loading... ![pixalate-logo-white](https://www.pixalate.com/hubfs/Blog_V2_08_26_2016/logo/Pixalate_Logo_WHITE.png) ##### Download GSTI Loading... Schedule your demo today Please complete all fields Loading... By entering your email address and clicking Submit, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and [Privacy Policy](https://www.pixalate.com/privacypolicy). * * * * *