This document discusses how ad fraud harms good publishers in several ways: 1. Ad revenue is diverted away from good publisher sites as bots visit to collect cookies and then visit fake sites to generate fraudulent ad impressions. 2. Profit margins of good publishers are depressed as media agencies seek out low-cost ad inventory, including fake inventory from fraudulent sites. 3. Fake sites pretend to be good publishers and sell premium audiences and inventory that don't actually exist.

1. How Ad Fraud Harms
Good Publishers
April 2017
Augustine Fou, PhD.
acfou [at] mktsci.com
212. 203 .7239

2. How publishers are harmed

3. April 2017 / Page 2marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Ad revenue is diverted away
1. Bot visits good
publisher site to
collect “cookie”
2. Bot then visits fake sites to
cause ad impressions to load
there; those sites make the
ad revenue
www.nejm.org healthsiteproductionalways.com

4. April 2017 / Page 3marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Profit margins are depressed
www.nejm.org healthsiteproductionalways.com
$100 CPMs $0.10 CPMsvs
“Media agencies want to buy more of the low-
cost stuff to lower their average costs.”

5. April 2017 / Page 4marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
http://www.olay.co
m/skin-care-
products/OlayPro-
X?utm_source=msn
&utm_medium=cpc
&utm_campaign=Ol
ay_Search_Desktop
Bad guys pretend to be good publishers
Click thru URL
passes fake source
“utm_source=msn”
to ‘launder’ the domain
buy eye cream online
(expensive CPC keyword)
1. Fake site that
carries search ads
Olay.com ad in
#1 position
2. search ad
served, fake click
Destination page
fake source declared
3. Click through to
destination page

6. April 2017 / Page 5marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Premium audiences stolen by cookie matching
specialized audience:
oncologists
jco.ascopubs.org
specialized audience can
be targeted elsewhere
“cookie matching”
(by placing javascript on your site)

7. April 2017 / Page 6marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Fake inventory sold on exchanges
publisherA.com
… but, PublisherA
does NOT sell ads
on open exchanges!
“Dark Revenue” is ad revenue diverted away from
publishers, so they don’t even see it’s missing.
• Large pubs – “dark” is 1-2X ad revenue
• Medium pubs - “dark” is 5-10X ad revenue
• Small pubs - “dark” is 20-100X ad revenue

8. April 2017 / Page 7marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Publishers wrongly accused by bad data
Incorrect IVT
Measurement
Sources 1 and 2
on-page
Source 3
in foreign iframe
1x1 pixel
incorrectly reported as
100% viewable
Incorrect
Viewability

9. April 2017 / Page 8marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Unfair fight because bad guys cheat
“Bad guys have higher (fake) viewability”
AD
Bad guys cheat by
stacking all ads
above the fold to
fake 100% viewability
Good guys have to array
ads on the page – e.g.
lower average viewability.

10. April 2017 / Page 9marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Publishers get the “short stick”Advertisers
Publishers
are left with 30%
Bad Guys
siphon dollars OUT
of the ecosystem
30% ($6B)
60% ($11B)
Ad Blocking
users use ad blocking to
protect themselves
10% ($2B)
Ad Tech
“plumbing” and verification
Source: The Guardian, Oct 2016
$5B to Google Display
$16B to Facebook Display
Display Spend$40B
DisplaySpend

11. Background and Context

12. April 2017 / Page 11marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Fraud diverts ad spend to fraudsters
Good Publishers “sites that carry ads”
• No content
• Few humans
• Low CPMS
$40 Search Spend Display Spend $40
$21$30
$3
Google Search FB+Google Display
$29
(outside Google/Facebook)
$83 Digital Spend Source: eMarketer March 2017
47%
programmatic

13. April 2017 / Page 12marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
$29
(outside Google/Facebook)
There’s 160X more “sites with ads”
Good Publishers “sites with ads”
Source: Verisign, Q4 2016
329M
domains
est. 164 million
“sites that carry ads”
“sites you’ve heard of”
WSJ
ESPN
NYTimes
Economist
Reuters
Elle
3%
no ads
carry ads
160X more
47%
programmatic
est. 1 million

14. April 2017 / Page 13marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
700X more
There’s 700X more fake apps
7M
apps
Source: Statista, March 2017
6.99 million
96% “apps that carry ads”
10,000
“apps you’ve heard of”
Facebook
Spotify
Pandora
Zynga
Pokemon
YouTube
$29
(outside Google/Facebook)
47%
programmatic
Facebook, 2015
Users use 8 – 15 apps on their
phones.
Spotify, 2016
People have 25 apps on their
phones, use 5-8 regularly
Forrester Research, May 2017
Humans “use 9 apps per day, 30
per month”

15. April 2017 / Page 14marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Examples of fake sites, fake apps
Fake Sites (10s of millions)
Source: Sadbottrue.com
Fake Apps (millions)

16. April 2017 / Page 15marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
How ad fraud works … very simply
Source: Distil Networks 2017
1. Start with lots of bots
2X more data center browsers
than malware on PCs at home
2. Launder using tech tools
Randomize referrer to look legit,
user agent, and IP address location
3. Sell traffic to willing buyers
“Sites that carry ads” want to buy
traffic to increase ad revenues
4. Sell low cost CPMs on exchanges
Massive quantities of low cost inventory
sold to marketers, fully laundered
Source: Ratko Vidakovic, May 2017
Publishers who want it Advertisers who want it

17. What are publishers doing?

18. April 2017 / Page 17marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Publisher myths about ad fraud
1. Fraud doesn’t affect us, there’s low bots on our site
Bots don’t come in large quantities to your sites; they just
collect a cookie and go elsewhere to create ad impressions
2. We have bot protection on our site
Nice. But what if bad guys pretend to be your site by
passing fake data, and put your brand reputation at risk?
3. We have high quality traffic
Great. We believe you. But what if bot detection tech
accuses you of high bots (falsely)?

19. April 2017 / Page 18marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Good publishers take action to reduce bots
Publisher 1 – stopped buying traffic
Publisher 2 – filtered data center traffic

20. April 2017 / Page 19marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Good publishers protect advertisers
On-Site measurement,
bots are still coming
In-Ad measurement, bots
and data centers filtered
11% red
-9% (filtered GIVT
and data centers)
2% red
“Filter data center traffic and not call the ads”

21. April 2017 / Page 20marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Good publishers protect users
42 trackers
24.3s load time
8 trackers
1.3s load time
“minimize 3rd party javascript trackers on pages”

22. April 2017 / Page 21marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
About the Author
April 2017
Augustine Fou, PhD.
acfou@mktsci.com
212. 203 .7239

23. April 2017 / Page 22marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Dr. Augustine Fou – Independent Ad Fraud Researcher
2013
2014
Follow me on LinkedIn (click) and on Twitter
@acfou (click)
Further reading:
http://www.slideshare.net/augustinefou/presentations
https://www.linkedin.com/today/author/augustinefou
2016
2015

24. April 2017 / Page 23marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Harvard Business Review – October 2015
Excerpt:
Hunting the Bots
Fou, a prodigy who earned a Ph.D. from MIT at
23, belongs to the generation that witnessed
the rise of digital marketers, having crafted his
trade at American Express, one of the most
successful American consumer brands, and at
Omnicom, one of the largest global advertising
agencies. Eventually stepping away from
corporate life, Fou started his own practice,
focusing on digital marketing fraud
investigation.
Fou’s experiment proved that fake traffic is
unproductive traffic. The fake visitors inflated
the traffic statistics but contributed nothing to
conversions, which stayed steady even after the
traffic plummeted (bottom chart). Fake traffic is
generated by “bad-guy bots.” A bot is computer
code that runs automated tasks.