How Ad Fraud Impacts Good Publishers

1. How Ad Fraud Harms Good Publishers April 2017 Augustine Fou, PhD. acfou [at] mktsci.com 212. 203 .7239

2. How publishers are harmed

3. April 2017 / Page 2marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Ad revenue is diverted away 1. Bot visits good publisher site to collect “cookie” 2. Bot then visits fake sites to cause ad impressions to load there; those sites make the ad revenue www.nejm.org healthsiteproductionalways.com

4. April 2017 / Page 3marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Profit margins are depressed www.nejm.org healthsiteproductionalways.com $100 CPMs $0.10 CPMsvs “Media agencies want to buy more of the low- cost stuff to lower their average costs.”

5. April 2017 / Page 4marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou http://www.olay.co m/skin-care- products/OlayPro- X?utm_source=msn &utm_medium=cpc &utm_campaign=Ol ay_Search_Desktop Bad guys pretend to be good publishers Click thru URL passes fake source “utm_source=msn” to ‘launder’ the domain buy eye cream online (expensive CPC keyword) 1. Fake site that carries search ads Olay.com ad in #1 position 2. search ad served, fake click Destination page fake source declared 3. Click through to destination page

6. April 2017 / Page 5marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Premium audiences stolen by cookie matching specialized audience: oncologists jco.ascopubs.org specialized audience can be targeted elsewhere “cookie matching” (by placing javascript on your site)

7. April 2017 / Page 6marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Fake inventory sold on exchanges publisherA.com … but, PublisherA does NOT sell ads on open exchanges! “Dark Revenue” is ad revenue diverted away from publishers, so they don’t even see it’s missing. • Large pubs – “dark” is 1-2X ad revenue • Medium pubs - “dark” is 5-10X ad revenue • Small pubs - “dark” is 20-100X ad revenue

8. April 2017 / Page 7marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Publishers wrongly accused by bad data Incorrect IVT Measurement Sources 1 and 2 on-page Source 3 in foreign iframe 1x1 pixel incorrectly reported as 100% viewable Incorrect Viewability

9. April 2017 / Page 8marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Unfair fight because bad guys cheat “Bad guys have higher (fake) viewability” AD Bad guys cheat by stacking all ads above the fold to fake 100% viewability Good guys have to array ads on the page – e.g. lower average viewability.

10. April 2017 / Page 9marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Publishers get the “short stick”Advertisers Publishers are left with 30% Bad Guys siphon dollars OUT of the ecosystem 30% ($6B) 60% ($11B) Ad Blocking users use ad blocking to protect themselves 10% ($2B) Ad Tech “plumbing” and verification Source: The Guardian, Oct 2016 $5B to Google Display $16B to Facebook Display Display Spend$40B DisplaySpend

11. Background and Context

12. April 2017 / Page 11marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Fraud diverts ad spend to fraudsters Good Publishers “sites that carry ads” • No content • Few humans • Low CPMS $40 Search Spend Display Spend $40 $21$30 $3 Google Search FB+Google Display $29 (outside Google/Facebook) $83 Digital Spend Source: eMarketer March 2017 47% programmatic

13. April 2017 / Page 12marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou $29 (outside Google/Facebook) There’s 160X more “sites with ads” Good Publishers “sites with ads” Source: Verisign, Q4 2016 329M domains est. 164 million “sites that carry ads” “sites you’ve heard of” WSJ ESPN NYTimes Economist Reuters Elle 3% no ads carry ads 160X more 47% programmatic est. 1 million

14. April 2017 / Page 13marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou 700X more There’s 700X more fake apps 7M apps Source: Statista, March 2017 6.99 million 96% “apps that carry ads” 10,000 “apps you’ve heard of” Facebook Spotify Pandora Zynga Pokemon YouTube $29 (outside Google/Facebook) 47% programmatic Facebook, 2015 Users use 8 – 15 apps on their phones. Spotify, 2016 People have 25 apps on their phones, use 5-8 regularly Forrester Research, May 2017 Humans “use 9 apps per day, 30 per month”

15. April 2017 / Page 14marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Examples of fake sites, fake apps Fake Sites (10s of millions) Source: Sadbottrue.com Fake Apps (millions)

16. April 2017 / Page 15marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou How ad fraud works … very simply Source: Distil Networks 2017 1. Start with lots of bots 2X more data center browsers than malware on PCs at home 2. Launder using tech tools Randomize referrer to look legit, user agent, and IP address location 3. Sell traffic to willing buyers “Sites that carry ads” want to buy traffic to increase ad revenues 4. Sell low cost CPMs on exchanges Massive quantities of low cost inventory sold to marketers, fully laundered Source: Ratko Vidakovic, May 2017 Publishers who want it Advertisers who want it

17. What are publishers doing?

18. April 2017 / Page 17marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Publisher myths about ad fraud 1. Fraud doesn’t affect us, there’s low bots on our site Bots don’t come in large quantities to your sites; they just collect a cookie and go elsewhere to create ad impressions 2. We have bot protection on our site Nice. But what if bad guys pretend to be your site by passing fake data, and put your brand reputation at risk? 3. We have high quality traffic Great. We believe you. But what if bot detection tech accuses you of high bots (falsely)?

19. April 2017 / Page 18marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Good publishers take action to reduce bots Publisher 1 – stopped buying traffic Publisher 2 – filtered data center traffic

20. April 2017 / Page 19marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Good publishers protect advertisers On-Site measurement, bots are still coming In-Ad measurement, bots and data centers filtered 11% red -9% (filtered GIVT and data centers) 2% red “Filter data center traffic and not call the ads”

21. April 2017 / Page 20marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Good publishers protect users 42 trackers 24.3s load time 8 trackers 1.3s load time “minimize 3rd party javascript trackers on pages”

22. April 2017 / Page 21marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou About the Author April 2017 Augustine Fou, PhD. acfou@mktsci.com 212. 203 .7239

23. April 2017 / Page 22marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Dr. Augustine Fou – Independent Ad Fraud Researcher 2013 2014 Follow me on LinkedIn (click) and on Twitter @acfou (click) Further reading: http://www.slideshare.net/augustinefou/presentations https://www.linkedin.com/today/author/augustinefou 2016 2015

24. April 2017 / Page 23marketing.scienceconsulting group, inc. linkedin.com/in/augustinefou Harvard Business Review – October 2015 Excerpt: Hunting the Bots Fou, a prodigy who earned a Ph.D. from MIT at 23, belongs to the generation that witnessed the rise of digital marketers, having crafted his trade at American Express, one of the most successful American consumer brands, and at Omnicom, one of the largest global advertising agencies. Eventually stepping away from corporate life, Fou started his own practice, focusing on digital marketing fraud investigation. Fou’s experiment proved that fake traffic is unproductive traffic. The fake visitors inflated the traffic statistics but contributed nothing to conversions, which stayed steady even after the traffic plummeted (bottom chart). Fake traffic is generated by “bad-guy bots.” A bot is computer code that runs automated tasks.