SERBIAN MEDIA DECEIVED READERS AND CLIENTS! Report released on fake readership of domestic online portals
Below is the full statement from Gemius.
The company Gemius, responsible for official measurement of traffic on domestic media websites, has identified two types of fraudulent activities that resulted in artificially inflated visitor numbers due to non-existent, machine-generated traffic.
Below is the full statement from Gemius.
In accordance with Article 9 of the gemiusAudience Research Rules, we inform you that a pattern of fictitious traffic has been observed recently, along with internet traffic not in compliance with Article 4 of the Rules. Both patterns have affected the results of gemiusAudience research in Serbia.
In the first case (hereinafter referred to as Type 1), this involves completely fictitious (non-existent) traffic, created by a script that sent false information about website visits from a “source” site to our servers, reporting visits to “receiver” sites that never actually occurred.
In the second case (hereinafter referred to as Type 2), actual traffic on gemiusAudience sites was generated without any intentional user actions, through pop-ups and pop-unders during visits to third-party sites.
Type 1 Fraud
In Type 1 fraud, a malicious script created by an unidentified individual was designed to send fake hits to gemiusPrism and Google Analytics accounts of third-party sites, falsely indicating user visits that, in reality, never took place.
Gemius detected this script, which was presented at a commercial publishers' meeting held on October 22, with additional information shared in a follow-up meeting on October 29 of this year. Due to GDPR, Gemius retains collected data only from the last three years, so it was not possible to determine the script's activity prior to October 2021.
At the time of detection, the script was found on the mobile version of the site republika.rs and had been active until November 2022 on ana.rs. Republika.rs removed the script on October 22 immediately after being informed about its existence during the meeting, thus ending the Type 1 fraud.
While the script was active, whenever a real user visited any of these sites, the script would send information to Gemius and Google servers indicating that the user had also visited certain “receiver” sites, falsely attributing the traffic as originating from Facebook. In reality, the user had not visited the “receiver” site nor had any interaction with it, and the “receiver” site did not need to undertake any technical action or resources for this fake hit to be registered.
However, the “receiver” site could see this “visit” in its gemiusPrism and Google Analytics tools as real, and if the visit was from Serbia, it was included in gemiusAudience data available to the market.
This practice generated about 2% of all hits in the gemiusAudience research for Serbia, spread across the sites listed below.
The following is a list of “receiver” sites and the periods during which the malicious script sent fake hits on their behalf (due to the high volume of data, a reference sample of the 15th day of each listed month was used):
- 24sedam.rs: October 2021 to October 2024.
- alo.rs: January and February 2022, April to November 2022.
- blic.rs: October 2021 to October 2024.
- buro247.rs: November 2021 to February 2022, March to June 2024.
- ddl.rs: October 2021 to April 2024, June 2024 to October 2024 (note: ddl.rs has not been part of gemiusAudience since September 2022).
- ekspres.net: October 2021 to February 2022, April 2022 to May 2024.
- nova.rs: October to December 2021, April 2022 to April 2023, June, August, November, and December 2023, April 2024.
- novosti.rs: October 2021 to January 2022, March 2022 to February 2023, April to December 2023.
- objektiv.rs: October 2021 to February 2022, April to October 2022.
- pink.rs: March 2022, April to July 2024, September and October 2024.
- sportske.net: November to February 2022, July 2022 to April 2023.
Due to the severity of this situation and its impact on gemiusAudience research in Serbia and the websites included in it, legal measures will be taken to find and penalize those responsible for generating these false records.
Some publishers have informed Gemius that they have taken or plan to take legal actions as follows:
Digital Media Network doo (24sedam.rs) – 24sedam has filed a criminal complaint against republika.rs and its responsible persons, as well as all other involved individuals.
Lifestyle Publishing doo (buro247.rs) – Representatives from buro247.rs have contacted lawyers to collect all necessary evidence to file a lawsuit against the company responsible for their Facebook promotion and advertising, as well as the intermediary in this fraud.
Medijska Mreža doo (republika.rs) – republika.rs representatives filed a criminal complaint with the Higher Public Prosecutor's Office in Belgrade, Special Department for High-Tech Crime, against unidentified persons on suspicion of committing the criminal offense of Computer Fraud under Article 301 of the Criminal Code of Serbia and unauthorized access to protected computers, networks, and data processing under Article 302 of the Criminal Code, as well as other offenses to be determined during the investigation.
Novosti AD (novosti.rs) – Representatives from novosti.rs filed a criminal complaint with the Higher Public Prosecutor's Office in Belgrade, Special Department for High-Tech Crime. At the advice of their lawyers, they are unable to disclose further details at this time.
Pink Media Group doo (pink.rs) – pink.rs terminated its contract with the company responsible for its social media promotion and is investigating all aspects of the case. If it is proven that this company generated fake traffic on pink.rs, Pink Media Group will take legal action against those responsible.
Ringier Serbia doo (blic.rs, nekretnine.rs) – Ringier Serbia supports all legal actions Gemius will undertake and will join them if necessary.
Sportske Net doo (sportske.net) – Representatives from sportske.net have contacted their lawyers and plan to file a criminal complaint with the Higher Public Prosecutor’s Office in Belgrade, Special Department for High-Tech Crime.
United Media Digital doo (nova.rs) – Representatives from nova.rs plan to take appropriate legal actions against the individual or company that allegedly caused damage by delivering fake hits instead of genuine visits.
Gemius calls on all publishers who have engaged companies to promote their content on social networks, but instead received fake traffic, to take legal action against those companies and the individuals involved.
Gemius will submit all relevant evidence and information to the responsible state authorities.
Given the rapid advancement of technology and new fraudulent methods, we believe that adequately punishing those responsible and disclosing as much information as possible about the case and perpetrators (while respecting the interests of the investigation) is one of the best ways to prevent similar situations in the future.
Type 2 Fraud
Regarding Type 2, irregularities were observed on the following websites:
- 24sedam.rs
- blic.rs
- espreso.rs
- kurir.rs
- mondo.rs
- n1info.rs
- nekretnine.rs
- nova.rs
- telegraf.rs
Publishers of these sites were given a deadline of three working days from the date of formal warning to cease this practice, which expired on Wednesday, November 6.
In this case, real traffic was generated but without the user's intent to access specific content. According to the Rules, user-unintended traffic should not be included in Audience data, and publishers have the option to exclude the gemiusPrism script from such pages, or, if technically unable to do so, to mark it with a special tag in the URL as instructed by Gemius on November 1, enabling Gemius to detect and exclude it from results.
It is technically challenging to determine the precise period and impact of Type 2 on gA.
Gemius will continue its efforts to objectively, transparently, and impartially study socio-demographic profiles, lifestyle habits, and interests of Serbia's internet audience, following market-agreed rules, to enhance and maintain trust in the internet as the most measurable advertising medium.
Explanation for Readers: The Type 2 fraud refers to situations where, when visiting streaming websites, you encounter pop-up or pop-under windows when pressing buttons like Play/Pause, next episode, fullscreen, etc., causing media sites to open without your intent.
Statement from Srbija Danas, which was not involved in any fraudulent activities mentioned in the report
Srbija Danas (www.sd.rs) informs the public that it has operated according to the highest professional standards and has not engaged in any fraudulent activities related to artificially increasing visitor numbers, as confirmed by the report from Gemius. Recent Gemius reports have clearly documented the fraudulent activities that have occurred within Serbia's digital market over an extended period, leading to the illusion of increased readership on certain portals. As a result, advertising agencies have been misled about the true readership of these portals, ultimately impacting clients and severely compromising the decision-making process for advertising.
Srbija Danas, which has operated transparently and displayed authentic readership data throughout this period, has suffered significant financial harm due to these practices. Our position in the market, built on real audience engagement, has been overshadowed by the inflated numbers of other participants, directly affecting how agencies and clients assess our work and performance.
We call on all media outlets to adhere to professional standards and encourage Gemius to further enhance control mechanisms to maintain report transparency and accuracy. In the interest of protecting its integrity, Srbija Danas will continue to advocate for fair market conditions and expects that all participants will be evaluated solely based on genuine results.
