State of Ad Fraud Ad Blocking Q1 2016 Update Augustine Fou

The State of Ad Fraud
Q1 2016 Update
April 2016
Augustine Fou, PhD.
acfou [at] mktsci.com
212. 203 .7239

April 2016 / Page 1marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Executive Summary
• Year-over-year, ad fraud has not improved overall; but
individual companies see improvements with greater effort
• Bots remain the key ingredient for all forms of ad fraud and
their actions are polluting analytics, making them unreliable
• Viewability standards are widespread now, but ad blocking
has emerged as the new “crisis du jour”
• Cybercriminals continue to easily avoid or defeat detection
technologies because they cheat and don’t play by any rules
• The proliferation of connected devices and IoT will increase
the capabilities of bots and opportunity for ad fraud
• 4D cybersecurity approaches are needed to fight ad fraud

Ad Fraud Background Update

Year-over-year fraud estimates continue to vary widely
WhiteOps/DCN (Oct 2015)WhiteOps/ANA (Dec 2015)
PublishersAdvertisers
Average Bots 3%
Range: 2% - 7%
Average Bots 11%
Range: 3% - 37%
“there are industry average bot% and very wide ranges;
but what really matters is the bot activity on YOUR site.”

Bad guys continue to focus on where the money is
Impressions
(CPM/CPV)
Clicks
(CPC)
Search
$18.8B
$43 billion
Display
$7.9B
Video
$3.5B
Mobile
$6.2B$6.2B
Leads
(CPL)
Sales
(CPA)
Lead Gen
$2.0B
Other
$5.0B
• classifieds
• sponsorship
• rich media
estimated fraud
not at risk
(86% of digital spend - 2014)

Two main types of fraud have the same 2 key ingredients
Impression
(CPM) Fraud
(includes mobile display, video ads)
1. Put up fake websites and
load tons of ads on the pages
Search Click
(CPC) Fraud
(includes mobile search ads)
2. Use bots to repeatedly load
pages to generate fake ad
impressions (hide the true
origins to avoid detection)
1. Put up fake websites and
participate in search networks
2. Use bots to type keywords
to cause search ads to load
and then to click on the ad
to generate the CPC revenue
(screenshots of
fraud sites)

Bots are the cause of ALL automated ad fraud
Headless Browsers
Selenium
PhantomJS
Zombie.js
SlimerJS
Mobile Simulators
35 listed
Bots are made from 1) malware
compromised PCs or 2) headless
browsers (no screen) in datacenters.

“Ad fraud and ad blocking are
now related because of bots”

Bots of all kinds do all kinds of fraud

Different kinds of bots create different kinds of fraud
Malware (on PCs)Botnets (from datacenters)
Toolbars (in-browser)Javascript (on webpages)

Bad guys’ (advanced) bots are not on any industry list
10,000
bots observed
in the wild
user-agents.org
bad guys’ bots
3%
Dstillery, Oct 9, 2014_
“findings from two independent third parties,
Integral Ad Science and White Ops”
3.7%
Rocket Fuel, Sep 22, 2014
“Forensiq results confirmed that ... only 3.72% of
impressions categorized as high risk.”
2 - 3%
comScore, Sep 26, 2014
“most campaigns have far less; more in the
2% to 3% range.”
detect based on
industry bot list
“not on any list”
disguised as normal browsers –
Internet Explorer; constantly
adapting to avoid detection

Advanced bots need to be detected differently
Confirmed humans
• found page via search
• observed events (mouse click
with coordinates)
“Honest” (declared) bots
• search engine crawlers
• declare user agent honestly
• observed to be 1 – 5% of
websites’ traffic
Fraud bots
• come from data centers
• malware compromised PCs
• deliberately disguised user
agent as normal browsers

Any device with a chip and internet can be used as a bot
Traffic cameras turned into
botnet (Engadget, Oct 2015)
mobile devices
webcams
connected
traffic lights
connected cars
thermostat
connected fridge

Fraud Activities Mess Up Measurement

Bad guys hide fraud by passing fake parameters
Click thru URL
passing fake source
“utm_source=msn”
fake campaign
“utm_campaign=Olay_Search”
http://www.olay.com/skin-care-
products/OlayPro-
X?utm_source=msn&utm_medium=
cpc&utm_campaign=Olay_Search_D
esktop_Category+Interest+Product.P
hrase&utm_term=eye%20cream&ut
m_content=TZsrSzFz_eye%20cream_
p_2990456911

Bad guys fake KPIs, trick measurement systems
Bad guys have higher CTR Bad guys have higher viewability
AD
Bad guys stack
ads above the
fold to fake
100% viewability
Good guys have to
array ads on the
page – e.g. lower
average viewability.

Bad guys’ bots earn more money, more efficiently
Cash out sitesCookie collecting
Source: DataXu/DoubleVerify Webinar, April 2015
100 1x1
iFrames

Bad guys’ bots can fake quantity and quality metrics
click on links
load webpages tune bounce rate
tune pages/visit

Turn off 1 ad network to cut out 90% bot traffic (red)
• Bot volumes are flat across (red line at top; green volume bars at
bottom)
• Human traffic patterns are messy and irregular (blue line at top)
• Dark red area decreased after we turned off a single bad ad network
• Share blacklists through central data repository to increase impact

Google analytics view of traffic from single fraud domain
Despite losing all of the traffic from these fake/fraud sites, there was no
change to the number of pledges, during the same period of time.
102,231 sessions
0 sessions
goal events – no change
“ … because bots don’t make donations!”

AppNexus example – cleaned up 92% of impressions
Increased CPM prices
by 800%
Decreased impression
volume by 92%
“AppNexus aggressively detected and discarded fraudulent
inventory; good for them and good for those who buy from
them. This should be an example for publishers.”
Source: http://adexchanger.com/ad-exchange-news/6-months-after-fraud-cleanup-appnexus-shares-effect-on-its-exchange/

What normal (human) traffic patterns look like (5 + 2)
• Notice the normal 5+2 pattern of weekday versus weekend traffic
• Human traffic is lowest between 2a – 5a , because humans sleep
• Bot volumes are now seen to be roughly tuned to human pattern
5 weekdays 5 weekdays
(lower volume on 2 weekend days)

End of month traffic and impressions fulfillment
Traffic surge
end of February
Impressions
surge on
Feb 29th

Bad acting mobile apps and .xyz domains (abnormal CTRs)
.xyz domainssuspicious mobile apps

Connection with Ad Blocking

Ad blocking impacts both CPM and CPC ads
Ad blocking ONNo ad blocking
Search Ads
Display Ads

Humans use adblock, fraud bots don’t block ads
Publisher 1
“We have long used ad block detection as a signal
for human users because humans use adblock.”
“Fraud bots that want the ads to load don’t block ads.”
Note that we focus on the % of ads that successfully loaded, not blocked.
80 – 85% loaded is a good rule of thumb
Publisher 2

University websites (no ads)
University 1
University 3
University 2

Tech and Gaming (tech savvy users)
Site 1
Site 3
Site 2

Ad supported content sites see highest ad blocking rates
Publisher 1
Publisher 3
Publisher 2

Recommended Actions

Debunk ALL assumptions and discard all averages
• Ad Fraud / Bots
• Ad Blocking
• Measurement
• Bots are low; list-based detection catches very little
• Bots are malware on PCs; more and more from data centers
• Bots are simple (cant fake clicks, mouse, scrolling); they do
• Ad blocking is lower in mobile; mobile is less measurable
• Ad blocking is higher among younger users; not necessarily
• Ad blocking is still in the single digits; look at “ads served”
• Higher CTRs are better; not if the clicks are fake
• Higher viewability is better; not if the sites fake viewability
• Data is reliable; not so if you don’t know bot/blocking levels

About the Author

Dr. Augustine Fou – Recognized Expert on Ad Fraud
2013
2014
SPEAKING ENGAGEMENTS / PANELS
4A’s Webinar on Ad Fraud
Digital Ad Fraud Podcast
Programmatic Ad Fraud Webinar
AdCouncil Webinar on Ad Fraud
TelX Marketplace Live
ARF Audience Measurement
IAB Webinar on Ad Fraud / Botnets
Publishers Forum
2015

Harvard Business Review – October 2015
Excerpt:
Hunting the Bots
Fou, a prodigy who earned a Ph.D. from MIT at
23, belongs to the generation that witnessed
the rise of digital marketers, having crafted his
trade at American Express, one of the most
successful American consumer brands, and at
Omnicom, one of the largest global advertising
agencies. Eventually stepping away from
corporate life, Fou started his own practice,
focusing on digital marketing fraud
investigation.
Fou’s experiment proved that fake traffic is
unproductive traffic. The fake visitors inflated
the traffic statistics but contributed nothing to
conversions, which stayed steady even after the
traffic plummeted (bottom chart). Fake traffic is
generated by “bad-guy bots.” A bot is computer
code that runs automated tasks.

State of Ad Fraud Ad Blocking Q1 2016 Update Augustine Fou

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à State of Ad Fraud Ad Blocking Q1 2016 Update Augustine Fou

Similaire à State of Ad Fraud Ad Blocking Q1 2016 Update Augustine Fou (20)

Plus de Dr. Augustine Fou - Independent Ad Fraud Researcher

Plus de Dr. Augustine Fou - Independent Ad Fraud Researcher (20)

Dernier

Dernier (20)

State of Ad Fraud Ad Blocking Q1 2016 Update Augustine Fou