Recent reports from the IAB show that digital ad fraud is second only to the opium and cocaine trade in terms of crime rates and revenue. That’s a pretty devastating stat for anyone working in the ad tech industry, and anyone buying media. See October’s Coull Quickie for more on the stats and figures.
But it’s not end of days, in fact programmatic is lifting its game and those who can’t or won’t comply to providing better will find themselves ousted come 2017. The most important thing we need to do right now is help publishers understand what forms invalid traffic takes and how to recognise it. And to help buyers ensure efficient and valuable return on campaigns by evading traps and buying blind.
There are many players in the programmatic ad world, many pipes connecting many different suppliers to advertisers, agencies and brands. At the end of that supply pipe exists many different forms of fraud. Understanding what types of fraud exist is important, and we are taking steps to educate our partners about exactly what they are.
Here are some of the most common types of invalid traffic fraud and how to catch them out:
We can prove that ghosts exist because we have an abundance of evidence - here’s how to spot a cyber spook:
Ghost sites are made to resemble real web sites that host a multitude of advertisements but when scrutinised further it’s easy to tell a real site from a false one.
Ghost sites will usually use a standard blog template, meaning that they often look exactly the same as each other and appear to be legitimate sites.. The domain name of a ‘ghost site’ will nearly always describe a contextual category (e.g. food, automotive, fashion) that appeals to advertisers.
Some basic signs of a ghost site are:
Ghost sites referral traffic often comes from an unsafe location such as a porn site but will be camouflaged with another url - usually one that doesn’t link to anything because it’s not real.
Links within content don’t work
Social media links don’t work or direct you to a page that’s pretty much empty
Videos within the content will take an age to load because the player is requesting as many ads as it can. Ads can appear behind the page itself, be hidden in the page or start to load a ridiculous amount - often that you’ll never see.
About us and contact pages will have content that is scraped from other sites
Try emailing the support or sales team - the email will invariably bounce
The page will have incredibly high bounce rates
Real, quality site domains will be copied and the same url with a different path such as .tv will be purchased.The site will look very much the same as the .com version but the content won’t change much. Company addresses will be false and you will often find the layout of ghost sites have many similarities or are exactly the same template.
Copy is scraped from other sites so if you search for it, you’ll it appearing in other places and will eventually find the source.
Got time for a quick test your ad fraud knowledge activity?
Both these sites are blacklisted by Coull - can you identify any of the above ghost site tell tales?
Domain fraud relates to a issue with the actual domain being sent through to us, this will often require a supply partner to block said domain. Domain fraud can come in many different forms, there could be a mismatch between the domain declared and where the ad is actually placed for example.
Domain spoofing can be one of the most difficult to detect as well as prevent and can therefore be the most lucrative form of invalid domains. Those spoofing domains declare inaccurate domains in order to make advertisers believe that invalid, or low quality domains, are reputable and often highly sort after.
Watch-Movies-Online.cc → Changed to show → usatoday.com
IVT (Invalid Traffic)
Invalid traffic relates to the traffic running through a domain being undesirable, this does not mean the domain itself is bad and therefore would not require blocking. However the source of the traffic needs to be found and removed. Here are types of invalid traffic:
A proxy allows access to the internet anonymously and can browse the internet without leaving any kind of footprint. This means all ad requests will go through a proxy, so for those monitoring the requests, the only thing visible is the proxy - there's no way to know who's behind it.
No proxy: User → Domain
Proxy used: User → Proxy → Domain
People using proxies are usually trying to hide themselves - although there can be a few legitimate reasons to use proxies they are more often used to hide malicious activity.
IP reputation means that the detected IP has historically been shown to be high risk due to being associated with characteristics of fraudulent activity.
Automated traffic refers to malicious bots or non-human traffic, designed to generate false ad impressions, or serve hidden, unseen ads, all while avoiding detection. Often they take over a user’s computer, running in the background whilst the user is unaware of the issue.
Spoofing is a practise where a user's browser and/or device are manipulated to resemble a different browser and/or device. The malicious party impersonates another device (or user) on a network in order to show ad requests from more reputable sources. This is often used to simulate traffic from multiple visitors and therefore increases the amount of potential impressions running through an exchange.
Transparency is key to fighting cyber crime
We’ve put a huge amount of time, effort and investment into eradicating invalid traffic from our platform and have added new features to our publisher dashboard to enable our publisher partners to see when we detect any invalid traffic coming from them. We alert them to any problems and help them to clean it up so the value of their inventory and relationships with agencies, brand and advertisers is always credible, and buyers transact with confidence.
Having an ethos of transparency is key to fighting cyber crime in all its formats and we believe in providing unique creative offered at programmatic scale, that’s trusted and efficient.
We have introduced our Traffic Quality Assurance program to help publisher partners reach the quality required to partner with Coull and to help our advertisers buy media with confidence, making the most efficient use of their budgets. We’ve developed a stringent program in line with the MRC’s Invalid Traffic Detection and Filtration Guidelines and we detect and block against (GIVT) and (SIVT) as defined by the IAB, MMA and MRC.
Our platform gives publishers the opportunity to see when they are sending us invalid traffic and work with us to ensure it stops. This strategy has been enforced to ensure we don’t allow invalid media to exist in our platform, helping our publishers increase the value of their inventory and providing a trusted market for brands and agencies to buy valid opportunity to reach their audience.