The DV Fraud Lab uses sophisticated AI technologies, proprietary techniques and analytical tools to uncover some of the most sophisticated fraud schemes in the industry. Analyzing over two billion impressions per day, the DV Fraud Lab uses advanced analytics and machine learning-powered models to identify and analyze data anomalies, indications of potentially falsified traffic and fraudulent activity.

The DV Fraud Lab is powered by a dedicated team of data scientists, mathematicians and analysts from the cyber-fraud prevention community. This installment of DV’s Ask the Experts series features Gal Badnani, Fraud Analyst. Gal is part of the Strategic Partners team, which is responsible for supporting inquiries from top platforms and strategic clients, providing proactive data-driven insights for commercial teams, finding new invalid traffic (IVT) trends and optimization opportunities and their latest project — Made For Advertising (MFA). 

Below, Gal takes a deep dive into one of her most recent site fraud discoveries and how advertisers can protect themselves moving into the future.

How did you begin working in this field?

As a former intelligence researcher, I joined the DV Fraud Lab over a year ago as a fraud analyst. I love being part of the team, brainstorming and investigating together to discover and prevent fraud.

Where are you based and how do you support DV from your location?

Based in Tel Aviv, Israel, I support DV clients and partners globally. The DV Fraud Lab often collaborates with many different DV teams from all over the world. We analyze and provide insights into various fraud schemes for all markets so DV can offer clients the best protection on the market.

What is one of your most recent fraud scheme discoveries?

While analyzing and reviewing a suspected website, the DV Fraud Lab made an unusual discovery that led us to unveil a complex web of deception. As we delved deeper, we detected a group of seemingly innocent websites, which were later determined to be ad fraud and harmful to our clients’ brand safety. Below, I will share why we suspected fraud on these sites, the motivations behind this scheme and the effect the fraud had on advertisers.

What made you suspect there might be fraud in this case?

The sites in question, displaying recipes, animals, pets or automotive content, were all owned and operated by the same entity and shared common layouts, templates and articles. Below is an example of two websites (screenshots were taken while the sites were still active) that featured nearly identical content at the time of their review. The sites copied images from a legitimate site and illegitimately portrayed them as their own.

We believe the sites likely copied the content from a site called Epicurious due to the similarity we see in the images. 

This example of replicated content does not necessarily indicate ad impression fraud. In fact, many MFA sites exhibit similar patterns without falsifying traffic. We began to suspect, however, that these properties might be a source of fraudulent invalid traffic (IVT) when we noticed a somewhat unusual trend: despite the fact that the websites were written in English, the majority of their alleged traffic originated from South and Central America, which is a primarily Spanish and Portuguese speaking audience. 

Our suspicions grew stronger when we observed the meteoric rise in popularity of these relatively new websites. The data revealed millions of impressions within the first month of operation alone. Such rapid success is extraordinary, as it typically takes time to gain traction and grow organically.

Moreover, the traffic patterns were odd, as the users seemed especially active during the night — a peculiar time to be cooking and baking. 

Another discovery included an intriguing connection among the visitors to these websites. Users who frequented one site also repeatedly visited numerous other sites within this same group. The fact that unrelated topics like baking and cooking, car reviews and pet care captivate the same set of users suggests that this traffic is not organic or natural. 

The most interesting finding that caught our attention was the fact that these sites were categorized as manga, a specific type of animation comics that originated in Japan, but the content didn’t match these categories. Now it was up to us to dig deeper, explore and understand this phenomenon. 

What actually happened here?

One site stood out because it was the only one among the group of sites that all users visited. This site was hugely popular, with nearly 200 million monthly impressions, and was in Spanish. The site categorization ticked all the boxes we look out for, including copyright infringement (CRI), illegal content and adult content. This site’s characteristics correlated with the group of sites reviewed, suggesting it had a strong connection to this scheme. 

We simulated the behavior of users visiting this suspicious site and discovered how the scheme works. As we accessed the manga site, manga content was indeed displayed, but it was served on the domains from the investigated group of “innocent” sites.

As illustrated below, when browsing directly into a website dedicated to animals and pets, you would indeed find content relating to animals and pets.

Browsing to the site directly:

But when browsing to the same site from the user journey simulated in the Fraud Lab, we find manga content that is not related to animals and pets.

Reaching the same site through a simulated fraud scheme:

Upon further investigation, we managed to unearth and classify nearly 40 sites falsified by this manga site as ad impression fraud (AIF), generating over 30 million monthly impressions.

It’s important to note that classifying an app or site as AIF is based on the advertising impressions served on or through the site(s) or app(s) in question. Should a site or app be designated as AIF, it is not a determination that the publisher or the developer of the site or app was aware of or knowingly participated in the activity that resulted in the designation.

The designation of AIF is not intended to represent a determination of fraud as defined by various laws, statutes and ordinances or as conventionally used in courts or other legal proceedings. Rather, it’s a custom definition strictly for advertising measurement purposes in accordance with the Media Rating Council’s (MRC) Invalid Traffic Detection and Filtration Standards Addendum and in accordance with industry standards.

DV flagging a site or app for AIF does not prevent an advertiser or media seller from working with a publisher. Advertisers and media sellers have sole and absolute discretion to disregard the AIF designation. As part of our standard process, DV takes steps to reexamine active sites and apps designated as AIF approximately every 90 days. An AIF designation will be removed only if, during that reexamination process, the site/app in question no longer qualifies for the AIF designation.

Why do they do it?

Manga sites are often flagged for inappropriate/copied content. Advertisers, keen on brand safety, are hesitant to associate their brands with such content. To work around this obstacle and to continue making money from ads, the manga site turned to falsifying its domain, leading advertisers to believe they were advertising on harmless sites. 

The second intention was revenue optimization. Advertising on manga sites typically offers inexpensive inventory. By redirecting their content and users to other domains, the site owners could charge higher rates for each ad whilst still taking advantage of the popularity and high traffic their site attracted. 

How do fraud schemes affect advertisers?

This scheme was deceiving advertisers into believing they were reaching engaged users with relevant interests. Their ads, however, were being displayed to users who willingly visited the original manga site and consumed its content. As a result, they were required to pay for ads displayed to users they didn’t wish to target, causing a loss in their revenue. This type of fraudulent behavior also creates an environment where advertisers are victims of brand safety and suitability violations — running ads on these sites could result in advertisers being unknowingly associated with unsafe or unsuitable content.

In the face of this complex scheme, DV’s mission to protect our clients becomes even more critical. By unraveling the secrets hidden within the digital landscape, we can protect our valued advertisers from financial losses and safeguard their brands’ reputations. With each discovery, we move closer to a stronger, safer and more secure industry, and I am proud to be part of the team that contributes to a better internet. 

Learn more about the latest fraud scheme trends or visit DV’s fraud capabilities page for more information on how advertisers can best protect their media investments.