1. Ad Fraud Creates Big
Risks for Advertisers
September 2016
Augustine Fou, PhD.
acfou@mktsci.com
212. 203 .7239 (New York)
2. September 2016 / Page 1marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Advanced bots can do everything a human can ….
Javascript installed
on webpage
Malware on PCsData Center BotsOn-Page Bots
Headless browsers
in data centers
Malware installed on
humans’ devices
Less sophisticated Most sophisticated
Source: AdAge/Augustine Fou, Mar 2014 Source: Forensiq Source: Augustine Fou, Oct 2015
“understanding what bots can do is the first step to
understanding the risks they create for advertisers
placing ads programmatically on open exchanges.”
Load pages, click Fake scroll, mouse
movement, click
Replay human-like
mouse movements,
clone cookies
3. September 2016 / Page 2marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Ad Fraud Risks for Advertisers
(scenarios illustrated with examples)
4. September 2016 / Page 3marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
How many impressions do you want to buy?
Rectangular traffic patterns
– turn bots on, turn bots off on demand
“sourcing traffic”
5. September 2016 / Page 4marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
http://www.olay.co
m/skin-care-
products/OlayPro-
X?utm_source=msn
&utm_medium=cpc
&utm_campaign=Ol
ay_Search_Desktop
What safe sites do you want to buy from?
Click thru URL
passes fake source
“utm_source=msn”
buy eye cream online
(expensive CPC keyword)
1. Fake site that
carries search ads
Olay.com ad in
#1 position
2. search ad
served, fake click
Destination page
fake source declared
3. Click through to
destination page
“domain laundering”
6. September 2016 / Page 5marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
What click through rates are you shooting for?
Programmatic display
(18-45% clicks from advanced bots)
Premium publishers
(0% clicks from bots)
0.13% CTR
(18% of clicks by bots)
1.32% CTR
(23% of clicks by bots)
5.93% CTR
(45% of clicks by bots)
Campaign KPI: CTRs
7. September 2016 / Page 6marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
What is your target viewability?
Bad guys cheat and stack
ALL ads above the fold to
make 100% viewability.
Good guys have to array ads on
the page – e.g. 50% or lower
overall average viewability.
Fraud SitesGood Publishers
“100% viewability?
Sure, no problem.”
AD
“ad stacking”
8. September 2016 / Page 7marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
How many clicks/pages per session do you want?
click on links
load webpages tune bounce rate
tune pages/visit
“bad guys’ bots are advanced enough to fake most metrics”
9. September 2016 / Page 8marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Need 0% NHT traffic? Or Middle East traffic?
• “IntegralAdScience filtered traffic, she says,
can be monetized on any banner network
from “the exchanges.”
• Pixalate filtered traffic, she says, can be
monetized on any search feed.
• MOAT filtered traffic, she says, works well
with video networks but not one in
particular.”
Source: Shailin Dhar, Ad Fraud Researcher
10. September 2016 / Page 9marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
How scalable is the traffic? Really, really scalable…
Cash out sites are massively scalable
131 ads on page
X
100 iframes
=
13,100 ads /page
One visit redirected dozens of times
Known blackhat
technique to hide
real referrer and
replace with faked
referrer.
Example how-to:
http://www.blackhatworld.co
m/blackhat-seo/cloaking-
content-generators/36830-
cloaking-redirect-referer.html
Thousands of requests per page
Single mobile app calling 10k impressions
Source: Forensiq
“pixel stuffing”
“iframe stuffing”
11. September 2016 / Page 10marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
How profitable is ad fraud? Really, really profitable…
Source: https://hbr.org/2015/10/why-fraudulent-ad-
networks-continue-to-thrive
“the profit margin is 99% … [especially
with pay-for-use cloud services ]…”
Source: Digital Citizens Alliance Study, Feb 2014
“highly lucrative, and profitable… with
margins from 80% to as high as 94%…”
12. September 2016 / Page 11marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Ad fraud creates real risk for advertisers
Budget risk – ads shown to bots are wasted
Analytical risk – bad data makes bad conclusions
Business risk – losing the business, possibly
abetting criminals
“What portion of your $10 million ad
budget was shown to bots?”
“Are you optimizing for higher viewability? You
may have just sent more dollars to the bad guys.”
“Did your ad just show up on a hate site that
also planted malware?” Your customers just
had a bad ad experience.”
13. September 2016 / Page 12marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
About the Author/Researcher
14. September 2016 / Page 13marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Dr. Augustine Fou – Recognized Expert on Ad Fraud
2013
2014
SPEAKING ENGAGEMENTS / PANELS
4A’s Webinar on Ad Fraud
AdCouncil Webinar on Ad Fraud
TelX Marketplace Live Panel on Cybersecurity
ARF Audience Measurement / ReThink
IAB Webinar on Ad Fraud / Botnets
AdMonsters Publishers Forum / OPS
DMA Webinar – Ad Fraud & Measurement
2016
2015
15. September 2016 / Page 14marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Harvard Business Review – October 2015
Excerpt:
Hunting the Bots
Fou, a prodigy who earned a Ph.D. from MIT at
23, belongs to the generation that witnessed
the rise of digital marketers, having crafted his
trade at American Express, one of the most
successful American consumer brands, and at
Omnicom, one of the largest global advertising
agencies. Eventually stepping away from
corporate life, Fou started his own practice,
focusing on digital marketing fraud
investigation.
Fou’s experiment proved that fake traffic is
unproductive traffic. The fake visitors inflated
the traffic statistics but contributed nothing to
conversions, which stayed steady even after the
traffic plummeted (bottom chart). Fake traffic is
generated by “bad-guy bots.” A bot is computer
code that runs automated tasks.