Fixing Ad Supply: The Rise and Rise of Placement Laundering, Domain Cloaking, Domain Spoofing

Comscore issued a release on Friday night to detail a method of fraud called website cloaking (also known as placement laundering or domain spoofing). Cloaking is where one website intentionally (and illicitly) represents their ad supply as another website. An example would be an IAB-invalid site like is represented as so that big brands are duped into advertising on their site. The perpetrator may be the website or app publisher themselves or more often an ad network or reseller. It is pretty important to understand the extent of this type of illicit activity, and what can be done about it.

The cloaking fraud announced by Comscore first appeared last year on May 13, 2015. These cloaked impressions have been sold by 9 out of the 10 top exchanges, because of re-traded bid requests from one ad exchange to another. Millions of these impressions continue to appear on RTB exchanges daily.

We have tracked three variants of this type of cloaking so far (including the one disclosed by Comscore which uses Google Safeframe). We work with our ad tech and buyer customers to minimize their exposure through managing blacklists and using predictive models to suppress low quality bid requests at the platform level.

Cloaking techniques like this will always re-occur. Because DSPs represent ad inventory that cannot be directly verified in the browser or app, they have to trust the data their exchange partners provide them. The growing practice of server-to-server trading, where exchanges represent each others’ bid stream, means that cloaking will propagate to all exchanges and DSPs when a single SSP is infiltrated.

These infrastructure problems with RTB can be solved by authenticating supply at the exchange and DSP level. Cloaking, arbitrage, and ghost bid impressions all need to be suppressed before additional services can be successfully layered on top of the bid stream. Authenticated Digital is working with many of the top ad tech platforms to perform these functions.

All exchanges who are not monitoring and filtering raw request streams for these issues should do so if RTB is to get on top of the rise of web or app cloaking.

Please keep in touch or sign up for Authenticated Digital if you want to learn more. Stay tuned.