Normally a "real browser" can't run 100s of ad players at once, but "methbrowser" is a node.js application with a C module that speaks Flash's plugin protocol directly. It simulates a dom, runs JavaScript in a node VM, but doesn't have to do any of the messy rendering that things like PhantomJS have to.
It was discovered years ago because:
* Their IP stack was acting like Linux[1]
* Their flash player said "I'm Linux"
* Their user agent said other things (random user agents)
* Their DNS traffic was going UK, but the hosts were coming out of the US
It was discovered years ago because:
* Their IP stack was acting like Linux[1]
* Their flash player said "I'm Linux"
* Their user agent said other things (random user agents)
* Their DNS traffic was going UK, but the hosts were coming out of the US
[1]: http://geocar.sdf1.org/browser-verification.html