• by Joe Mandese  @mp_joemandese, October 28, 2009

Starcom MediaVest Group has contacted federal authorities who are conducting a criminal investigation of a fraudulent online media buy placed on behalf of client Suzuki by someone posing as an executive of SMG's Spark Communications unit. The buy, which placed a banner ad on Gawker.com that launched a malware attack to users of the site, is the latest in a string of online insertion orders being placed by malware purveyors on major publishers' sites, is believed to be the first to successfully mimic the identity of a major advertising agency. It also comes just weeks after SMG and other units of Publicis Groupe sent letters to online publishers warning them to be vigilant of such attacks, and to take extraordinary manual steps to confirm the orders directly with one of the agency's executives before placing them (Online Media Daily, Oct. 12th).

 "The Gawker situation is currently under investigation. We will continue to work closely with our vendors to be diligent and absolute about insertion orders and ad placement," said a spokeswoman from VivaKi, the unit that oversees Publicis' digital and media buying operations.

Publicis executives said they do not know who the perpetrator is, even though the person or persons demonstrated sophisticated knowledge of the agency's media-buying process, and successfully navigated through several checks and balances undertaken by the Gawker sales team before they processed the order. The sophistication is evident in the email exchange below, which the Gawker sales team leaked to industry blogger Silicon Alley Insider to draw attention to the incident.

Among other things, the poser closely mimicked Spark Communications' email address, and exhibited behavior consistent with that of an actual online media buyer, going so far as attempting to negotiate the price of the buy with Gawker's sales team.

"This guy wanted to negotiate rates with us. Spammers don't negotiate rates," Gawker sales executive James Del told OMD, adding, "They were asking questions that only someone who worked in advertising would know. This was not some kid in the basement in Kiev trying to get their maleware out there."

Del said the buyer demonstrated other sophisticated behavior that led the Gawker sales team to believe it was a legitimate insertion order being placed on behalf of Suzuki by Spark Communications. For example, when Gawker was offered the ad from an ad server the sales team was not familiar with, the perpetrator responded by serving it via AdJuggler, a server the Gawker team routinely conducts business with.

"These guys were sophisticated enough to use a server that they knew we were familiar with to get their ads accepted. And they were also redirecting through DoubleClick," Del said.

That level of sophistication demonstrates how quickly the problem of fraudulent online insertion orders is evolving. When The New York Times' Web site accepted a bogus ad ostensibly placed directly by a maleware purveyor posing as broadband telecommunications provider Vonage, it changed the protocol of its ad operations team to only accept ads from servers listed as recognized providers to the paper's Web site.

Publicis executives claim that the Gawker sales team failed to take the extra step the agency requested when it sent letters to publishers earlier this month asking them to be vigilant against fake online insertion orders: to confirm suspicious orders verbally with someone they knew to be a Publicis agency executive with the authority to place the insertion order.

Publicis executives said they had no prior knowledge that such a buy would actually occur, but they said the recent acceleration of fake insertion orders such as those placed through ad network buys on major publishers ranging from the Times to Foxnews.com to the Huffington Post, gave them reason to believe that something could occur and to that it would be necessary to put publishers on notice. It's unclear whether any other major advertising agency groups have sent out similar notices to date, but none of the publishers contacted by OMD said they were aware of other agencies taking similar steps.

"We're not singling anyone out here," a Publicis executive said, "but if you're getting an insertion form somebody that you're not familiar with, or doesn't normally do business with you, you should take the extra step and contact the agency and speak to someone you know. In the short-term, this is going to create some manually checks and balances, but in the long-term it will help our industry."

Editor's note: The following is the email correspondence leaked to Silicon Alley Insider by Gawker's sales team:

> ---------- Forwarded message ----------
> From: George Delarosa <george@spark-smg.com>
> Date: Wed, Sep 23, 2009 at 10:56 PM
> Subject: Agency Inquiry
> To: advertising@gawker.com
>
>
> Dear All,
>
>
>
> I am writing from Spark Communications - a full-service media agency
> with a client-centric approach. We are looking to place display
> advertisements for some of our premium clients.
>
> Spark is a part of - and backed by the power of Starcom MediaVest
> Group - one of the largest and most celebrated global brand
> communications and consumer contact organizations, with more than 110
> offices in 67 countries worldwide.
>
> I work with Automotive and Entertainment clients in Spark. First and
> foremost, we want to run a performance

campaign for Suzuki across your
> network. Our budget to start is $25k+. Campaign should be live by the
> end of the month. We can also run on moviefone and/or entertainment
> verticals.
>
> Please let me know your rates, inventory and volume so we can include
> you in our upcoming media plans.
>
>
>
> Thank you,
>
>
>
> George Delarosa
>
> Spark Communications
>
>george@spark-smg.com
>
> 222 Merchandise Mart Plaza
>
> Suite 550
>
> Chicago, IL 60654
>
>www.spark-smg.com
>
> (312) 376-8131
>
> Skype - george.delaros

The full correspondence follows in reverse chronological order below, ending with this warning from Gawker.  Note that this fellow knew how to talk the talk.

From: GAWKER SALES GUY

• Someone is approaching publishers as a representative of Spark-SMG on the Suzuki account, even though Suzuki very recently switched agencies.
• George Delarosa and his accomplice Douglas Velez claim that there's a limited amount of money left in the Suzuki account for them to spend, and they need to spend it quickly.
• They have intimate knowledge of online ad sales, including terms like eCPM, roadblocking, RON, IAB sizes, lead generation, traffic coordinators, etc.
• Email comes from @spark-smg.com instead of @sparksmg.com, though the who-is for their spoof domain is very close to the actual domain (Erin has links in her original email)
• They maintain a Chicago area code (where Spark is based) but claim to be in London, even though they couldn't give us the actual time in London when asked.
• Unlike most spammers, these guys were happy to jump on the phone to get ads back up and running.
• Clue that should have tipped us off was that we had to use our IO template...most major agencies like Spark have their own IO template.

Look at how together this guy was! Corporate politics, eCPM, premium branding, IAB sizes, re-evaluating rates! Outrageous.

To: GAWKER SALES GUY
Cc: douglas.velez@spark-smg.com

Just FYI, we'll need tags this afternoon if we want to do the roadblock tomorrow. Let me know if we're good to go!