Ad fraud & Programmatic

Mcounts Consumer Solutions
Ad Fraud & Programmatic
Neeraj Mishra | Mcounts

Ad Fraud has one or more of these characteristics
Non-human traffic (i.e., bots).
Zero chance of being seen (i.e., 0% viewability).
Intentionally misrepresented.

Non-Human Traffic
Most non-human traffic is used to generate fake impressions (page views)
and fake clicks. In some cases, they go so far as to generate fake form
submissions, and therefore, fake conversions.
Simple Bots
Sophisticated Bots
Botnets

Non-Human Traffic
Simple Bots
Simple bots are essentially just scripts that run from a server somewhere, like
Amazon Web Services or some other hosting provider.
Because they are simple, they are usually easy to identify — since they have a static
IP, user agent, cookie ID and so on — which makes fingerprinting and blocking them
relatively easy.
A simple look at some DSP* auction logs, or even Web server logs from those that click
through, make simple bots fairly easy to detect and block. For example, one could
simply block all known data center IPs.
DSP = Demand Side Platform

Non-Human Traffic
Sophisticated Bots
Sophisticated bots, on the other hand, employ tactics like rotating user agents, using
random proxies (to rotate IP addresses), mimicking normal click-through rates, and in
some cases, even mimicking real mouse movements from captured browser activity.
All of these factors make it harder to fingerprint and block them.

Non-Human Traffic
Botnets
Botnets are generally a large array of personal (residential) computers that have been
compromised by bad actors.
These actors have control of these machines, employing them for tasks like loading
and clicking on ads, which generates legitimate-looking, but ultimately fake,
impressions and clicks for advertisers.
Botnets are the hardest to detect and block, but they are also highly illegal and,
therefore, riskier for bad actors to deploy.

Human Traffic
Human traffic, on the other hand, is perhaps even more sinister because the
end users are real, but the impressions (and in some cases, clicks) generated
are fraudulent. Since they are real people, it can be harder to detect by
vendors that are only looking for bots.
Invisible Ads
Arbitrage
Domain Spoofing
Site Bundling
Ad Injection
Cookie Stuffing
Click Farms

Human Traffic
Invisible Ads
Two Main ways:
“Ad stacking” or “Impression stacking,”
Hiding ads behind other ads. In such cases, the publisher is generating multiple
impressions for a single page view, but the only ad that is visible is the top one.
"Invisible iFrames"
Intentionally hiding ads by loading ads in unviewable (1 pixel by 1 pixel) iFrames, an
impression or multiple impressions are generated, with no chance of ever being seen.
Such tactics are relatively easy to detect using off-the-shelf ad verification tools like
Integral Ad Science or Pixalate.

Human Traffic
Arbitrage
One of the most under-reported but insidious forms of human-based traffic fraud is a
form of arbitrage.
In essence, the bad actors purchase traffic for a very low cost and resell it for a
multiple of the price.
For e.g:, a publisher may sell their inventory for $5 CPM on average but may be
purchasing questionable traffic to their site for a fraction of that cost.

Human Traffic
Domain Spoofing
In the RTB (real-time bidding) ecosystem, publishers are sometimes allowed to declare
their own domain and the label of their Site ID.
Fraudulent publishers use this as an opportunity to misrepresent their inventory.
They may identify themselves as washingtonpost.com, but if you dig deeper, the
actual domain the ad was served on was different. In other cases, the ad-serving
domain is spoofed within the bid request.

Human Traffic
Site Bundling
Site IDs are how inventory is classified in the RTB ecosystem. The way RTB was
designed, each Site ID was supposed to correlate to a single domain.
But in practice, many publishers and exchanges bundle entire networks of domains
under single Site IDs. So an advertiser might think they are buying abc.com but end up
with ads served on xyz.com.
This configuration happens on the supply side, which is outside the control of DSPs
(demand-side platforms). This falls under the “intentionally misrepresented”
inventory category.

Human Traffic
Ad Injection
As a result of browser toolbars and other adware plugins, ads can get injected and/or
replaced on any site, often without the user or publisher noticing.
This creates a situation where ad inventory might show up as facebook.com, for
example, but is no way related to Facebook’s actual ad inventory.
After all, any Facebook user could tell you that there are no 300×250 or 728×90 banner
placements. But with ad injection, inventory can be created on premium websites out
of thin air.

Human Traffic
Cookie Stuffing
Cookies are just as important today, because they are the mechanism through which a
large part of the programmatic ecosystem targets audiences.
And with inexpensive sources of internet traffic available for purchase, cookie stuffing
to dilute or misrepresent audience target data is now a real thing.
It’s also worth noting that cookie stuffing can occur on both human and non-human
traffic, so technically, it could fall into either category, and sometimes both.

Human Traffic
Click Farms
There are incentivized programs, often masked as “work from home” or “make money
online” schemes, that pay real people to click on ads and even fill out forms, resulting
in valueless impressions, clicks and conversions.
Since these are real people, it’s hard for most software vendors to catch these
schemes, but they are most definitely fraudulent activity.

Why Programmatic Ad Fraud Exists
Open nature of the programmatic advertising marketplace
Ad fraud is technically not illegal
Lack of proper incentives across the entire supply chain

The programmatic advertising ecosystem is based on being open. This
means that any advertiser or publisher should be free to participate in the
marketplace.
Because the barrier of entry for new players is so low, anyone can sell and
anyone can buy. This is a good thing for smaller advertisers, agencies and
publishers — but it’s also beneficial for bad actors.
Open Marketplaces

Unlike credit card fraud, nobody is going to jail for ad fraud, and it’s not
exactly the sort of activity that elicits a crackdown from law enforcement,
which means there is significantly less risk involved.
Higher the payoffs, the higher the levels of fraud.
There is roughly twice as much fraud in video as there is in desktop display.
This makes sense when you consider that video CPMs average at about $9,
while traditional display is more in the $1 to $2 range.
Ad Fraud Is Not Illegal

Programmatic advertising, and ad tech in general, almost everyone makes their money
on volume and transactions. In other words, the age-old CPM pricing model rewards
volume.
The first major problem with the whole CPM foundation of practically all display
advertising is that it incentivizes pageview-driven publishing practices: multi-page
slideshows, auto-refresh ads, click-bait journalism, regurgitated reporting and so on
degrading the user experience of the web for everyone.
Since CPM incentivizes and rewards scale, many publisers pursue scale by any means
necessary, including questionable traffic acquisition, which deteriorates the quality of
the ad tech ecosystem.
Lack Of Proper Incentives

Neeraj Mishra
neeraj@mcounts.com
+91-77 99 65 6664
Queries?

Ad fraud & Programmatic

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (19)

Ähnlich wie Ad fraud & Programmatic

Ähnlich wie Ad fraud & Programmatic (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Ad fraud & Programmatic