From a Domain to an Identity Lead: Following the Advertising Trail

A website can reveal very little about its operator while still carrying the advertising infrastructure that helps it earn revenue. For investigators examining a domain that rehosts content or is suspected of fraud, that infrastructure offers another place to look when the site itself provides few useful ownership details. Advertising identifiers, the identifying values associated with ads running on a website, can connect an otherwise anonymous domain to other sites. One of those connected sites may disclose a detail that the original doesn’t, giving the investigator a new lead to follow. Security analyst Tushar Karumudi explores those connections through his scraping threat intelligence work, where he investigates who is behind observed activity and what motivates them. His approach follows advertising identifiers across domains, then examines connected websites, archived pages and corporate records for information that could help identify their operators. Starting With a Domain and an Identity Question Karumudi's day-to-day work involves moving from evidence of an action toward the person behind it. He investigates actors through telemetry, the data systems record about activity, and contributes search directives to intelligence vendors, including vendors that gather information across the deep and dark web. “I investigate actors based on telemetry data. I work on attribution, essentially to identify who the person is behind the keyboard of said action,” Karumudi says. The ad-tech inquiry applies that attribution work to a specific starting point: a domain whose operator is unknown. Karumudi points to sites that rehost content or engage in suspected fraud while continuing to run advertisements. When the site provides little useful ownership information, those advertising relationships offer another place to investigate. The value of an identifier depends on what it connects. Finding the same ad ID on another domain gives the investigator somewhere else to examine, potentially reaching information absent from the original site. Karumudi includes information left on the domain itself or in its back-end data among the possible sources of an ownership clue. “Essentially, you have a domain X,” Karumudi explains, “and you need to identify who the owner is. There is a decent chance that the owner has left some of that information somewhere on the domain or in the back-end data. Or if the same ad ID is used on 10 other sites, one of those sites has a detail that we can use for attribution.” In Karumudi’s ten-site example, the useful detail can come from a website other than the one that prompted the investigation. The shared identifier links the search locations; a disclosure on one of those sites gives the investigator something more specific to pursue. That shifts the inquiry from finding connected domains to examining what they reveal about their operators, including information they may have published in the past. Checking What Connected Sites Have Disclosed A connected website may reveal little today but have shared useful details in the past. Karumudi uses The Wayback Machine to look through archived versions of the starting domain and other sites that share its advertising identifier. An earlier page can offer another lead when the current site provides little information about its operator. He also turns to OpenCorporates to investigate possible company connections. These sources let him pursue different parts of the same question: what a website has disclosed over time and whether those details point toward a business behind it. He wants to find out, in his own words, if “any of those domains that share the same ad ID, by any chance, have information that we can use to identify the actors.” The shared advertising ID gives that search a direction. Instead of examining the original domain in isolation, Karumudi can follow its connections to sites that may have disclosed more. A detail found on an archived page can then guide a search through corporate information, helping him piece together who may be operating the websites. That movement from a lead to a more focused investigation also runs through Karumudi’s broader threat intelligence work. When vendors supply information about a behavior, he searches internal logs for traffic associated with the data points they provide. He uses those findings to recommend mitigations for engineers to build and coordinates with legal and policy colleagues. His role is to connect outside intelligence to activity within the systems he investigates, giving the team something concrete to act on. Building Around the Investigative Workflow Karumudi’s open-source work brings one part of that investigative practice to other practitioners. He already uses the ad-tech attribution technique internally and is bringing that approach into paytrace, a project that follows a website’s advertising relationships to information about the people or businesses receiving its revenue. “That could be a mechanism for us to identify who the person is behind that website,” Karumudi says of the advertising infrastructure used by sites that rehost content or engage in fraud. The project carries forward the investigative sequence behind that observation. A domain gives the inquiry its starting point, and shared advertising identifiers lead to other websites worth examining. Historical pages and corporate information can then help turn those connections into more specific identity leads. The tool gives investigators more information to work with; their task is to connect the findings into an explanation of who may be operating the sites. Paytrace remains a pre-release project, with code and examples available in its public repository. By sharing the work, Karumudi gives other practitioners something they can examine, try and build on, extending a technique from his own investigations to others facing the same ownership question. Making Advertising Clues Useful to Other Investigators Tushar Karumudi’s open-source development effort centers on a practical observation: the advertising infrastructure that helps a website earn revenue may also provide leads about its operator. Following those leads through connected domains, historical disclosures and corporate information gives the inquiry more places to develop. His aim is to make that approach available to others while the eventual identity assessment depends on the evidence they can bring together. This story was distributed as a release by Jon Stojan under HackerNoon’s Business Blogging Program.