GEO: LatAm, CIS. Payment Models: CPA / SPEND / RS / HYBRID. Predict your CPA rate with PIN-UP Partners

Case Study I followed 3,700+ pop, push and banner ads to where they really end: iPhone exploit kits, Back-button traps and fake "Allow" pages

JohnyMF

Lurker
Joined
Jul 20, 2026
Messages
16
Hi everyone,

Johny from MediaFarm here. We run a network of adult sites with mostly Indian mobile traffic. Luke suggested I start a thread about this, so here it is.

The problem we had
We sell pops, push, banners and preroll on our own sites, and we never really knew what those ads did to our visitors after the click. Network dashboards show impressions and CPM, not "this campaign sends iPhone users to a page that tries to break their phone". Visitors just leave and don't come back.

So we built a scanner for ourselves. It opens our sites the way a real visitor does: on Android phones, iPhones and desktop, on residential IPs in the visitor's country. It taps the ads, follows every pop, push and banner to the page it really ends on, and records a video of the whole visit.

What it found on our own sites in the last 25 days
About 5,800 visits, 3,700+ ads followed to their landing page, around 2,000 pops.
  • 6 domains delivering exploit-kit code through ads, almost all of it aimed at iPhones. Several checked the iOS version first and attacked only versions with known holes, so the same ad
 
To view the premium content in our affiliate marketing forum (including this awesome thread), you must first register and upgrade your account. Register today and become a part of our amazing community!
Top