Key findings

• Over a dozen unique domains were found selling ad inventory through Google Ad Manager, even though the pages were embedded invisibly under the content of illegal movie & porn streaming sites
• Streaming sites in the DeepStreamer fraud ring generated an estimated 210,550,928 visits in January 2023, as measured by Similar Web
• There was not a single seller in common between each of the sites used for laundering (the “money sites”), but most offered their inventory for sale through Google Ad Manager
• Using extremely conservative estimates, which factor in a 50% ad-block rate & 70% ad-unit fill rate, we project advertiser spend on this scheme between $120k – $1.2 million in January 2023 alone
• Working with a leading ad buying platform, we were able to confirm there were hundreds of millions of bid requests generated for these domains between January – February 2023

Introduction

Online video streaming sites have always been some of the most visited destinations on the web. Legitimate ones will typically require a subscription fee or rely on advertising as part of their business model. Unfortunately, at any given point in time, there are thousands of sites that allow users to illegally stream pirated content, and they often manage to devise strategies that allow them to monetize their illegally sourced content with programmatic advertising.

Researchers at DeepSee and Malwarebytes have identified an invalid traffic scheme that has gone undetected for over one year via a number of illegal video streaming platforms. DeepStreamer used different techniques to evade detection and forge traffic by surreptitiously loading “money sites” (ad-monetized sites used to monetize/launder the human traffic to pirate sites) filled with Google ads completely hidden from view, while internet users were watching movies.

Not only are these streaming sites breaking the law by using copyrighted material, they are also defrauding advertisers for, possibly, up to $1.2million per month, based on conservative estimates.

A deceptive business model

DeepSee researchers contacted Malwarebytes about a scheme they had observed recently via a video streaming website called moviesjoy[.]to. DeepSee’s crawlers had observed the site mikerin[.]com loading ads deep under the content of moviesjoy, but it wasn’t exactly clear how this was happening.

Interestingly, the site claims to offer free HD movies and TV series with “absolutely zero ads on our site. Once you hit the play button, you can start streaming right away, without any interruptions in the middle.”

On the internet if something is “free”, it usually means you are the product in some shape or form. Hosting and streaming costs money that needs to be recouped so the service can stay online.

What we identified was not entirely surprising but was quite clever. The platform does indeed rely on ads but rather than having them visible on the site, they are embedding and hiding them.

While the site owner could display ads to their visitors, there is no way legitimate advertisers (meaning those that would pay more) would accept traffic coming from a site offering pirated movies.

The trick consists of loading ads from seemingly regular websites and not showing them to anyone. Those “legitimate” websites are embedded and hidden into the page as iframes while users are watching movies.

There are 4 Google ads that load per page and the pages reload periodically. Advertisers are buying ad space for mainstream content but on websites that are inserted as invisible iframes into illegal video streaming platforms.

Anti-debugging tricks

Rather than using more simple techniques such as popunders, DeepStreamer relies on intermediary domains that create hidden iframe containers within the existing page.

The code that they use is highly obfuscated and detects the presence of debuggers. Capturing network traffic externally will only show some static elements, and not the dynamically created iframes.

Here is the overall traffic view, from the streaming site (moviesjoy) to the money site (mikerin):

There are several anti-debugging tricks being used, the first one actually from the online video streaming site itself: 

The domain hosted at adtrue[.]top (or adtrue[.]info) plays an important role in loading the money domains by performing a HEAD /dynamic/ads/ HTTP request, and yet it shows an enigmatic 404 code response.

We were able to replay the attack by putting a breakpoint on adtrue[.]info using an external web debugger (Fiddler) and observed that it started loading the domain immediately responsible for rendering the money site.

It appears though that all these intermediary domains are connected and watching for each other.

Hidden iframe containers

Let’s look at the difference between static and dynamically rendered content with mikerin[.]ml which is related to mikerin[.]com (money site with ads). It only appears to load jquery.js:

This has nothing to do with the popular jQuery JavaScript library, but instead is heavily obfuscated and debugger-proof code that contains the clues on how DeepStreamer is loading their iframe:

However, we can take a shortcut and see what the Document Object Model (DOM) looks like by saving the current webpage as a complete *.html,*.html file using the browser UI.

While the HTML saved from mikerin[.]ml showed very little information (Figure xx), the DOM provides a lot more useful information since it shows objects that have been rendered by the browser.

There is a new element called “containerIframeBlog____” that is referring to the money sites which are ordinary looking blogs with Google ads. The iframe’s properties make it so that nothing is visible to the user.

One way to confirm those iframes without triggering the anti-debugger code is by launching Chrome’s Task Manager:

Evasion techniques

What we refer to as the money sites are WordPress sites with a number of blog articles and Google ads. At first glance, everything looks legitimate but that is simply a decoy to fool everyone.

What we noticed are articles that are completely clean, while others contain ad fraud code. Of course, you will only get to the latter if your referer is one of the movie streaming sites.

There is one problem though. If visitors truly came from a pirated site, then ad networks would not allow their customer’s ads through. 

This is where referral forging comes into play. We can see that DeepStreamer is spoofing the referer and choosing from one of their own (Google, Bing or Facebook):

Another issue is that the invisible iframes will not reflect user activity, and yet it is important to pretend humans are scrolling and clicking on the articles. The next piece of code from the ad fraud script does just that:

If the money site was not hidden as an iframe, this is what it would look like while performing ad fraud:

Perhaps as a measure to avoid creating too many ad requests, these embedded pages do not often refresh ad units within the context of a single page-view. Instead, they generate a visit to a new spoofed page every 2-3 minutes, as demonstrated in this code snippet (looking at the interval object in particular for details on timing):

This is also confirmed by our packet captures from manually generated visits to these pirate sites; a new page is loaded every 2-3 minutes. 

(Un)intended 3rd Party Measurement Evasion

One interesting side effect of embedding the money domain as DeepStreamer here has: estimates from SimilarWeb were completely thrown off! Take for example the SimilarWeb results for 2 money sites that generated hundreds of millions of ad opportunities in the same measurement period (Nov ‘22 to Jan ‘23):

Similarweb has no idea they exist & are generating these kinds of ad traffic volumes. This makes it seem like SimilarWeb measures traffic for domains that are navigated to in the browser address bar, and not accounting for hidden / embedded pages. This could be both a blessing and a curse. 

On the plus side: many ad exchanges check for 3rd party traffic metrics from tools like SimilarWeb before making a publisher’s inventory available, and organizations doing that basic check will protect themselves from exposure to sites like this. Put another way: a quality specialist would see that there’s no traffic to mikerin[.]com, or guiadosabor[.]com, and the sites would not be approved for the platform subsequently. 

• This begs the question: how were these publishers able to sell their inventory through Google’s ad exchange? What checks and balances were in place to ensure that the traffic volumes to those sites were believable?

One negative outcome of this measurement scenario is that researchers who rely on SimilarWeb insights can not know about the “money” sites’ connections to pirate domains; the connection from source -> money site is lost given the absence of SimilarWeb “related sites” data. 

DeepSee’s crawl data revealed ground-truth connections between the pirate & “money” sites, but it could not account for the volume of traffic directed at the “money” sites. Luckily, since these sites load every time someone visits the pirate sites, it’s possible to estimate the visit counts to the “money” domains by understanding traffic volumes to the pirate sites which embed them.

Monetization

The Roster of Embedded Sites

By working with the team at Malwarebytes, DeepSee was better able to profile the activity of a monetized site involved in the DeepStreamer scheme, and set about the task of mapping the active ones to their pirate/source domains. What we found are 14 active content domains, loaded by 250+ unique pirate sites, which cumulatively generated hundreds of millions of visits in January:

In order to arrive at the estimated visit statistics, we used data from Similarweb. Not every pirate domain was found in their dataset due to recent registration, or low traffic volumes.

Now that we had identified a sample of ad-monetized domains, we needed to make sure these ad units were actually firing off impression trackers, meaning the advertiser would be charged for presenting their ads on the page. 

In order to confirm this, DeepSee analyzed data its crawlers had gathered when visiting the pirate sites in question, and compared the number of Google ad requests generated to the number of corresponding Google impression trackers fired. 

This dataset, composed of 6,748 crawls performed between January 1st and February 27th 2023 showed the following:

• Of the 35,269 Google ad requests measured, DeepSee measured 25,387 corresponding impression trackers, making for a fill rate of ~72%
• The “money” sites loaded a median 4 ad units per-page load; confirmed by manual inspection performed by Malwarebytes
• In DeepSee’s limited manual tests, generated by visiting the pirate sites & running packet capture software, there was a measured fill rate of ~80%
• Perhaps more troubling, ~98% of the sessions that DeepSee crawlers generated were from known data centers, performed without any attempt to cloak the IP.

(For more information on how to do this kind of auditing yourself, check out this explainer from MonetizeMore)

These data points in hand, we could now construct an estimate of how much advertisers might be spending on this inventory. For complete insights into the dataset we used to create these estimates, alongside the complete list of Source:Money domain mappings, check out our companion document

• After matching the pirate source domains to SimilarWeb data, and summing the visit counts, we counted 221,823,394 cumulative visits generated.
• Using the visit data, and the time-on-site metrics from SimilarWeb, we arrived at a weighted average time-on-site of ~7.75 minutes per visit
• Visitors immediately cause 4 ads to load upon a page load, and another 4 ads load on average each 2.5 minutes when the page reloads. This makes for an average 16.40 ad exposures per visit for each user
• Multiplying average exposures per user by the number of visits yielded a total of 3,636,840,849 estimated ad exposures in January, but we had to add a few modifiers to this figure:
  • According to data compiled by Statista, ~50% of desktop web users block ads, and that number is ~30% for mobile browser users. We chose to use the more conservative 50% figure, and removed half of the projected impressions from the pool, leaving 1,818,420,425 estimated ad exposures in January
  • As we previously mentioned, DeepSee crawlers measured a fill rate of ~72% for Google ad units on the money sites during our visits. Factoring in a slightly more conservative 70% fill rate left us with 1,272,894,297 estimated ad exposures in January

Given our final figure of 1,272,894,297 estimated ad exposures in January, the advertiser spend was estimated to be between $127k and $1.27 million, depending on the average price of these advertisements, which was never disclosed to us. We broke our estimates down across several probable price points for this media:

At this point, it was clear that advertisers were really buying this space, so we started asking around for evidence that could point us to who was selling the space.

The Non-Google DSP Perspective

The data in this section was provided to DeepSee by a leading DSP (demand-side advertising platform) with global reach, who agreed to participate under condition of anonymity (we’ll call them DSP “A”) . They provided reporting, from their perspective, on the count of bid requests generated by the money domains dating back to 2020. Most helpfully, they also provided the supply-path related to an opportunity, which tells us the exchange & seller name related to the opportunity.

As a disclaimer, there are a few limitations of this dataset:

• This is just the perspective of one DSP, and we can’t claim to know that these sellers created a similarly large share of opportunities presented to all other DSPs. We suspect they do, but without input from Google in particular, it can’t be confirmed.
• These sites seemed to monetize extremely poorly outside of Google; fewer than 1% of requests resulted in an ad being delivered via DSP “A”.
  • That low fill rate was echoed by another non-google exchange we polled, who told us that only .1% of opportunities they created resulted in ads being loaded
  • On the other hand, we observed that these Google ad units were filled upwards of 70% of the time.

Understanding the above, the below table shows the top sellers offering space on these money domains, and the ad exchange the opportunity came through.

Google Was the Top Exchange Offering These Opportunities; There Was Not 1 Particular Seller in Common

Top Seller Per Domain, Ordered by Magnitude of Ad Opportunities Presented to DSP “A”

Conclusion

In this investigation, we uncovered a network of streaming websites and bogus domains created for the purpose of illicitly gaining revenue from advertisements by a threat actor we called DeepStreamer.

We were impressed by the technical complexity of the code and underlying infrastructure. The perpetrators took many steps to prevent reverse engineering and tracking metrics were not accurately representing the scale of the abuse at play.

We have notified Google and other industry partners and some actions have already taken place. Malwarebytes users are not participating in this invalid traffic scheme defrauding advertisers as we already block the fraudulent domains used.

The active domains used for laundering traffic, as well as some other key details related to projections we made are available in the companion data workbook.

Indicators of Compromise

Domains launching invisible iframes:

adorablefurnishing[.]ml

awscloudfront[.]ml

bigcache[.]ml

brcache201[.]ml

brient[.]ml

cache33[.]ml

cdncache[.]ml

compactembed[.]ml

dbcache[.]fun

dcache[.]ml

embed123[.]ml

fcache[.]ml

filecache[.]ml

financeirocartao[.]ml

fishuflatinned[.]ml

fullcdn[.]ga

harateness[.]ml

honessity[.]ml

hypercdn[.]ml

hypercdn3[.]ml

investwell[.]ml

jestick[.]ml

journeywithvision[.]ga

jscache[.]live

kbyte[.]ml

livrosdereceita[.]ml

maxcache[.]ml

mbyte[.]gq

mcdn[.]ga

megacdn[.]ml

megacdn[.]top

megasearch[.]gq

melhoresdomomento[.]ml

mikerin[.]ml

myplayer[.]ml

newsworldcity[.]ml

poptube[.]fun

primesinfo[.]ml

satishmoheyt[.]ml

supercache[.]top

tapcache[.]ml

tcache[.]ml

tecnowebclub[.]ga

toptube[.]fun

uwatchtube[.]ml

video[.]your-notice[.]fun

videocdn[.]fun

videosdahora[.]fun

whatsappvideos[.]ml

wispields[.]ml

wpcache[.]ml

youbesttube[.]gq

yourtube[.]fun

ytcache[.]fun

pharmabeaver[.]ml

pharmabeaver[.]com

virvida[.]com

guiadosabor[.]com

techyclub[.]in

journeywithvision[.]com

newsworldcity[.]com

mikerin[.]com

primesinfo[.]com

investwell[.]site

streamix[.]tv

guerytech[.]online

brandingjoy[.]in

aitechgear[.]in

adorablefurnishing[.]com

satishmoheyt[.]in

Money domains:

brandingjoy[.]in

aitechgear[.]in

guiadosabor[.]com

mikerin[.]com

adorablefurnishing[.]com

journeywithvision[.]com

satishmoheyt[.]in

primesinfo[.]com

techyclub[.]in

streamix[.]tv

newsworldcity[.]com

pharmabeaver[.]com

guerytech[.]online

virvida[.]com

Malicious JavaScript (iframe):

1701f50afde2db48d58e6789cfa810f2fdfae74ad0b5de983ace21beb9542a4b

2405699d9b90c36950440d8dd0335d8da1574abda11ae9900cfb31a68f80a864

344550fd85db609434f9eb6838642df1e0283ce43b23c02859cb593b7331ef70

5f8598bdf64f2f3c7a6b9134cd80bb44ac46f546d4047d796278437b5c3485b7

86c160f073347d3c810a824ba90de66105882195dd607175a32fa7adffe31163

98d2cd6e4f3a3aa3200d53ac09750d192ca6ba546aba09a935fe4f38d878bc4c

af70188588c75165f919c9c155827eb458f26aed5288ef52bab532dc7bd38015

b6845734220755e8a163d27d30fb0470ac0aa0d6e57e52af38fe59619d4dd1fb

bcb9ee387efcd936e2abd1ede483fda13cfe40320af9df6462398f329e6aae1e

fc2006c24b6153bfeafb3e9dc6e5ffc4d239c021f1e1777265569f672b4e184b

About Malwarebytes

Malwarebytes believes that when people and organizations are free from threats, they are free to thrive. Founded in 2008, Malwarebytes CEO Marcin Kleczynski had one mission: to rid the world of malware. Today, Malwarebytes’ award-winning endpoint protection, privacy and threat prevention solutions and its world-class team of threat researchers protect millions of individuals and thousands of businesses across the globe. 

The effectiveness and ease-of-use of Malwarebytes solutions are consistently recognized by independent third parties including MITRE Engenuity, MRG Effitas, AVLAB, AV-TEST (consumer and business), Gartner Peer Insights, G2 Crowd and CNET.

The company is headquartered in California with offices in Europe and Asia. For more information and career opportunities, visit https://www.malwarebytes.com.

About DeepSee

DeepSee uses highly sophisticated crawlers, combined with rigorous network analysis, in order to capture the behaviors websites present when visited by actual humans, and contextualize those behaviors within the graph of the internet.

DeepSee uses this data to arm advertising professionals with ground-truth signals about content appropriateness, ad-density, on-page technologies, backlink makeup, and more.

This dataset enables the sell-side to effectively & automatically moderate the quality of the inventory they offer, and empowers the buy-side to quickly generate robust blocking / targeting lists.

It’s not enough to avoid fraud or the usual fake news website. Advertising is a numbers game, one that is played long-term. Creating strong positive associations with your brand is important, but its significance is often overlooked in favor of buying inexpensive ad space. Unfortunately, this grab-and-go strategy wastes significant parts of advertisers’ budgets, and it doesn’t have to be that way.

What You’ll Learn

• What is brand suitability?
• How does it impact my advertising strategy?
• What factors impact my brand suitability?
• How can I improve my brand suitability?

Suitability: More Than Brand Safety

We now know that brand suitability is focused on identifying appropriate environments for your advertisements. It’s a holistic view where advertisers have to ask themselves, is this publisher someone my brand wants to associate with? Remember, who you associate with matters. When your ads are auctioned into ad units on websites with low organic traffic alongside unrelated content, you can be sure that you’ve wasted your time and money.

If you’ve ever used an inclusion list, this may sound simple, you curate a list of publishers you are interested in and launch your campaign. However, studies show that almost 11% of all global ad traffic is invalid. Inclusion lists can certainly help reduce this problem, but re-using the same inclusion list may not be enough to stop ads from winding up in low-quality environments that create this invalid traffic. Inclusion lists require ongoing work to ensure you can hit the right scale, too small of a list and you may end up way under your delivery goals. Prospecting for new publishers and monitoring the quality of publishers in your inclusion is vital.

When your advertising strategy is focused more on allocating funds for quick and cheap impressions, it becomes a race to see which advertising space you can occupy first. Prioritizing brand suitability helps you develop a sustainable strategy that doesn’t use a wide net but, instead, a fine-tooth comb.

How to Find Brand Suitable Publishers

There are different factors that can make a publisher brand suitable. Made-for-advertising (MFA) pages, for example, create a low-quality environment for your advertisements. These pages would not be considered brand suitable and, in fact, can even cause higher churn rates.

MFA sites disguise their behavior based on incoming traffic, and they’re also relatively cheap when it comes to CPM (cost per mille) values. This allows MFA sites to easily evade suspicion from anyone buying space on the page. As a result, these arbitrage websites directly impact both direct and paid traffic for advertisers.

When a publisher is brand suitable, they align more with the values, ideals, and aesthetics of your brand. For example, a car manufacturer would not want to advertise on an article about a tragic incident involving a vehicle and pedestrians. Considering brand suitable publishers means evaluating the priorities of your brand and partnering with sites that match your style.

Brand Suitability Factors Worth Considering

Knowing when to work with a publisher starts with evaluating four key aspects. There are a variety of factors that make a publisher brand suitable, many of which focus on avoiding negative, inappropriate, or low-quality content. Today we’ll be covering four important factors.

Content Category

This is a baseline requirement and refers to broad categories such as Sports, Arts & Crafts, Finance, etc. When focusing on brand suitable publishers, it’s necessary to ensure that you can accurately target the right content category on any potential ad space. This applies for inclusion and exclusion alike as there likely are categories that, in relation to your ad, will not yield the right results. Determining the content category of a page or website at scale is tough to do as it is a continuous process. Our platform makes this process simple by accurately categorizing every web page using a state of the art machine learning model.

Brand Association

Brand association is the connection that a customer has to your brand, it’s essentially how a customer remembers you. Any level of brand association requires marketers to identify which organizations, products, and services have complimentary attributes. For example, a Luxury car company may target websites that focus on sophistication or expensive products, such as high-quality watches. However, this could even include a financial news website or a blog about investments. Brand association also encompasses which other brands advertise on those sites and helps to narrow down the type of potential traffic that a site may receive. Generating consistent positive associations with your brand can have both short and long term benefits.

Brand Safety Risk

Certain content can pose a brand safety risk to your advertisement. This includes anything that may not align directly with your brand, but it can also include inappropriate content or fake news. Mitigating this risk means ensuring that all content is safe and preferably shared by a credible publisher. One necessary step is to check disinformation databases that may list websites known to publish disinformation and exclude them from your targeting pool. Our platform provides a convenient flag on all of our results indicating if a publisher has been listed in any disinformation database.

Fraud Risk

Low-quality websites are more than just poorly built — oftentimes, these pages come with serious risks of fraud. If the publisher sources bots or incentivizes traffic to their page, there is a chance that they could be fraudulent or put users at risk. Determining if a page has a fraud risk involves learning whether or not they hide or stack ads, if they use pop-ups, and more. Using a platform that offers a way to view publisher risks from a high level is a great way to meet campaign scale goals while increasing the strength their brand. There is no need to choose one or the other.

Tips for Finding Brand Suitable Publishers

Identifying brand suitable publishers to partner with requires you to start by searching within your target industry. This depends on how well you can ensure that the publishers who host your ads resonate with your product or service. Visit these pages, look for the amount of ads that they display, gauge the quality and uniqueness of their content, verify that they provide a good user experience. These are all key indicators of a strong, brand suitable site.

Identifying these low-quality pages at scale is an issue for many advertisers. That’s why deepsee.io offers an efficient solution for identifying and avoiding low-quality made-for-advertising publishers in your campaigns, making it easier for you to direct your ad traffic to the appropriate locations.

With access to Deepsee’s PublisherRisk Portal, advertisers and agencies can efficiently prospect for publishers and evaluate publishers across many of the factors mentioned in this article. Our system audits millions of websites on a daily basis to provide accurate information at scale. You can upload a delivery report and gauge the quality of a previous campaign, or start anew with our publisher discovery tools.

Learn more about our PublisherRisk Portal. Not sure where to start? We offer a a free media audit where we evaluate one of your previous campaigns and provide you with an inclusion list, all free of charge.

Solitaired.com faces a challenge familiar to many publishers. While our platform and engagement stats are strong, we are still a young company and don’t have the brand recognition from advertisers to drive meaningful direct sales. As a result, our near-term goal is to make our ad inventory as compelling as possible for SSPs and subsequently DSPs and their advertisers.

The concept we were interested in testing is straight forward:

In addition to requiring that our ad units are viewable when refreshing, what happens if we also ensured that ads would not be shown to sessions that have gone idle?

This means for ads to refresh the placement would need to be deemed in-view and the user will have to have performed an action on-page within the last 60 seconds such as a click or scroll event.

In-view refresh is industry standard so adding an engagement requirement takes that a step further. It’s a simple change we hypothesized would increase viewability, decrease total bid requests and have minimal negative impact to topline revenue. 

The concept for this test was driven by a focus on measurement and efficiency. While the casual gaming category has awesome websites, some have fallen under appropriate scrutiny for arbitraged traffic and poor ad experiences and we wanted to create as much distance from those stereotypes as possible. This, in addition to our +99% direct traffic footprint and strong user engagement stats, would help us stand out.

We partnered with DeepSee to evaluate test design and validate results. DeepSee is an industry leader in assessing publisher ad quality and while they typically focus on identifying bad actors, this was an opportunity to shift that focus to a feature that could potentially establish best practices of high-quality ad inventory.

About Us

Solitaired.com is a casual gaming platform with over 500 games. The most popular are classics like solitaire, freecell and a word game called Phrazle. Stats we’re proud of include +400% YoY session growth, 7 games played per user session, an 8x monthly return rate and over 3 million games played daily. 

We’re a small business powered by user growth and monetized by open exchange ad revenue. To balance both, we try to present an ad footprint we believe is reasonable and we experiment with to improve. On desktop our standard layout is two display units with a dismissible outstream (placement=5) video player, on tablet we have two display units, and mweb has a max of two units depending on device type. 

Thoughts heading into the test

I was confident based on Solitaired’s direct traffic profile and engagement metrics that we have very active users, but we had not run a similar test prior so it wasn’t clear what metrics would be affected. However, we had no reason to suspect we had idle users and our domain level viewability was already strong at around 84%.

We defined idle as no activity for 60 seconds. We settled on 60 seconds vs. 30 seconds because we knew some of our users think about their next move or guess within a 30 second timeframe. Extending it a bit beyond our 30 second in-view refresh trigger felt warranted.

Test setup and considerations

This test was set up as a before-after comparison. Although we typically favor A/B testing, we elected not to run this as an A/B test because we thought it would significantly increase complexity while muddling the positive impact of improved viewability to the buy-side, which is often measured on the macro ad unit vs. impression level.

While we recognized that seasonality could impact revenue, we were confident that core metrics like viewability and bid requests wouldn’t be affected and the intention wasn’t short term CPM driven. 

This test went live on July 5th for display. We were initially hesitant to include our dismissible outstream unit since the user has the option of closing that unit at any point during gameplay (making it harder to measure). However, we elected to include it since it could be argued this feature is even more critical to video than display. 

Technical Implementation

For purposes of this test, we defined a user interaction as one of the following events: a click, a scroll, or a touchstart.

In addition to monitoring these events, an ad must meet viewability requirements (as defined by GAM via their impressionViewable event combined with our own viewability monitoring in-browser), regardless of when it is rendered or refreshed. 

With each user interaction, we reset our 60-second user interaction timer. On any display refresh opportunity, we check to ensure that the user interaction happened within the last 60 seconds. If not, no calls are made to SSPs, nor are calls made to GAM to trigger a new auction and ad render. 

Our outstream video runs on its own auction cycle timer and this is subject to the same 60-second interaction time frame as display.

Once a user returns to interact with the page (using any of the above events, or with a window focus event) display ads are re-enabled, and the outstream auction cycle is restarted.

Metrics tracked

• Total impressions – The total number of ad impressions, paid and unpaid, served to a user per game. 

• Paid impressions – The total number of ad impressions monetized above price floors per game.

• Unpaid impressions – The total number of ad impressions that either didn’t receive a bid or fell below established price floors.

• Viewability – The change in viewability by device type before and after implementation.

• Ad requests – The change in total ad requests by domain before and after feature implementation. 

Results

The following metrics describe the period between July 6th and August 5th 2022:

Conclusion

We consider this a successful test and have elected to keep it live across 100% of our inventory.  As we saw no decrease to paid impressions, this is do-no-harm to immediate performance that puts us in a better position to advocate for spend and inclusion in always-on PMPs and high viewability packages. 

Similar to the standardization the industry has seen with refresh on-view, we believe there’s benefit for both buy and sell side with the adoption of refresh on-idle. The more buyers continue to value and reward publishers for increasing viewability and request efficiency, the greater benefit this will have for publishers and with better performance will come more rapid adoption. 

Have any thoughts after reading? Come and join the conversation with us on linkedin or twitter!

What You’ll Learn

• What are made-for-advertising websites?
• How do low-quality websites avoid detection?
• What is brand suitability?
• How can you avoid MFA websites?
• What is an inclusion list?
• How can you reduce digital advertising waste?

Understanding Made-For-Advertising Websites

Made-for-advertising websites rely heavily on programmatic ads that refresh constantly, changing the content they display based on the origin of the user visiting the page. Avoiding these websites can be tricky since many of them have found ways to get around SSPs (Supply Side Platforms) that check for low-quality pages, so oftentimes they go undetected for long periods of time, wasting millions of dollars in the process.

MFA sites behave differently depending on the traffic they get. With direct traffic, for example, a user may have a normal ad-viewing experience. However, if the site identifies paid traffic, it will overload the user with aggressive monetized ads (Check out our study on traffic arbitrage and made-for-advertising websites). This type of dynamic behavior helps MFA sites to avoid scrutiny from advertising partners, allowing them to easily navigate compliance checks from supply site partners.

These fraudulent pages host low-quality or stolen content to appear more legitimate. Combine that with a website that is overloaded with advertisements jockeying for position in front of the user, and you end up with a chaotic and unpleasant viewing experience for anyone visiting the page. 

Placement on these sites is often relatively inexpensive, making it an attractive option for advertisers looking to get the greatest number of impressions out of their budget. These pages boast high view counts and completion rates due to non-stop ads but, unfortunately, the organic traffic to these websites is usually minuscule and inconsequential.

How MFA Websites Pose a Brand Suitability Risk

Brand suitability is centered on identifying a brand’s needs and increasing value through online content placement. Displaying high-quality ads alongside relevant content is the goal, but brand suitability is about finding the advertising space that fits your brand across multiple channels. 

Made-for-advertising websites threaten brand suitability by placing your ads in an environment that discourages organic traffic. In a 2019 study, ads that were viewed in “high-quality mobile web environments” were seen “74% more favorably than the same advertisements seen in low-quality context.” By keeping programmatic ads on MFA sites, you reduce the quality of your brand suitability by not directly optimizing ad placement. It’s almost like throwing money away.

Avoiding Made-For-Advertising Websites

Brand suitability relies on being aware of your brand image. The clearer your vision is for your brand, the easier it is to target your advertisements to relevant websites. Putting your ad spend in the right places lets you effectively increase traffic and reduce digital advertising waste. 

Part of finding a higher-quality environment for your advertisements involves developing an inclusion list that highlights the pages where your programmatic ads will succeed. Avoiding made-for-advertising websites gives you more control over where your ads are found. By narrowing in on these sites, you avoid the clickbait headlines that often drown out your ads while simultaneously creating a better space for consumers to view your content.

This is why deepsee.io offers a Publisher Risk Portal for marketers who want to effectively and easily remove made-for-advertising sites from their inclusion list. Our platform gives advertisers the ability to audit websites where their ads are displayed, as shown in their campaign delivery reports, to identify possible risks and avoid any pages that might host exploitative behavior. deepsee.io also provides access to dynamic domain lists, manual domain lists, and other powerful tools to help agencies and advertisers increase the quality of their programmatic spending at scale.

Want to learn more? Get a free media audit from us and see the impact on your KPIs first hand.

Introduction to Rewarded Traffic

In this article we provide clarity into the practice of “rewarded traffic,” or traffic generated by users who are compensated with in-game currency in exchange for opening ad-monetized publisher pages in a webview during an ad break. There is no real industry documentation about this format for creating web traffic; it could best be considered an abuse / misapplication of rewarded ad placements.

For Example, take this session we captured from the Subway Surfer app on Android:

At ~:15 seconds you can see where a users is asked to choose between using in-game currency to re-spawn, or watching an ad. The “Ad” is actually a whole ad-monetized publisher page (younghollywood[.]com in this case) containing multiple display placements and a video ad. The video doesn’t load properly in this example due to the packet capture software we were using, but normally a video ad would be the first thing you see. After visiting 2 pages for ~15 seconds each, we can drop back into the game.

For years, millions of daily visits to ad-monetized publisher destinations have likely been generated this way. In these situations, advertisers have no idea that they are paying to reach a user who is being compensated to interact with the publisher’s content.

Despite a growing negative sentiment, and public comments by Google and The Trade Desk condemning incentivized traffic as invalid, rewarded traffic maintains a thin veneer of legitimacy due to the fact that users are paid using in-game currency, not gift cards or cash (despite in-game currency having a quantifiable cash value). To make matters worse, the practice remains largely unnoticed / unknown, because such traffic is hardly ever identified as rewarded/incentivized to the buyer.

Our hope is to make this practice more transparent to programmatic ad buyers, and inspire them to ask the questions that need to be asked in order to prevent serving ads to users without genuine intent in the content.

What is Incentivized Traffic?

Incentivized traffic comes from users who are paid to visit a certain web property. They may additionally be required to perform subsequent actions on the page to receive their rewards. Compensation usually comes in the form of points that can be redeemed for cash, prizes, or gift cards.

Is Incentivized Traffic Considered IVT?

The MRC does not consider incentivized traffic invalid, but there is growing sentiment by the largest DSPs that this traffic is invalid. A few months ago, we published research on incentivized traffic sourcing by one of the worlds largest publishers. At that time, both Google and The Trade Desk made fairly unambiguous statements about such traffic being considered invalid.

At the time, Google offered this on-the-record statement:

“Google considers invalid traffic to be ad traffic that does not represent genuine user intent or interest. This includes both incentivized traffic and traffic from pop-unders. Generally speaking, invalid traffic applies to any clicks or impressions that may artificially inflate an advertiser’s costs or a publisher’s earnings.[…]”

This is echoed in numerous places across their publisher policies, for example in the AdSense publisher policies:

Google’s specific mention of “genuine user intent or interest” is helpful when thinking about rewarded traffic as well, because that bar is clearly not met. As we saw in the video featured in the introduction, the user has no idea where they will be sent when they choose to watch an ad. It’s the same for users we showed to visit websites via Swagbucks in the past.

What Are Rewarded Ads?

Do We Really Need Another Term for “Incentivized?”

A quick check of your local thesaurus may reveal that “incentivized” and “rewarded” mean largely the same thing. Unfortunately, within the universe of AdTech jargon, the terms are unlikely to merge. It’s commonly understood that “incentivized” traffic is generated by users paid in something like cash; gift cards, paypal balance, things of that nature are the commonly assumed end-goal of a user generating incentivized traffic.

“Rewarded,” on the other hand, signals a user is compensated using items / currency unique to the game / app-environment they are in. These items generally can’t be turned into cash, though they can often be purchased with cash.

How Are Rewarded Ads Supposed to Look?

According to Google Ad Manager’s feature brief: “Ads that users can choose to view in exchange for an in-app reward — such as watching a video ad to get an extra life in a game […] are called ‘rewarded ads.'” This aligns with the commonly understood definition of a rewarded ad creative looks like: a video, or interactive game demo; certainly not an ad-monetized web page.

A good example is visible at the end of our video in the intro section. For example:

Can Advertisers Identify Rewarded Inventory?

Rewarded video / interstitial ads actually can, and should, be identified using the “rwdd” attribute within the “Imp” object of a bidRequest. This attribute has appeared at least since version 2.6 of the Open Real-Time Bidding (ORTB) standard. For those not in the know, that’s a fancy way of saying that we have standards around rewarded ads, and how they should be identified to advertisers. Bid requests are how publishers announce their ad-inventory to interested buyers, and transmit various attributes of the user & the environment where an ad would be rendered.

However, this standard assumes a “normal” rewarded ad experience wherein the ad placement can be accurately attributed to the app a user has open. Advertisers buying inventory on web pages loaded within rewarded traffic placements generally have no idea the context in which the page is loaded; they would see it as a mobile web impressions, and the visit as organic.

Given what we know, there’s an uncomfortable question here that needs to be asked:

Is Generating Rewarded Traffic a Valid Use of Rewarded Ad Placements?

We put forth that it is not.

Can you think of any other case where an entire website would be considered a valid ad creative? If entire websites were valid ad-creatives, wouldn’t websites often be trafficked within display & video placements all over the internet in order to juice visitor numbers? Unfortunately, we live in a society, and that would not be considered acceptable by any major DSP.

It’s not even just websites that are the destination of rewarded traffic; we captured evidence that users are made to listen to audio advertisements within podcasts. This results in inflated podcast listener counts & audio impression volumes. For example, take this session from the Subway Surfer app on iOS:

Who Generates Rewarded Traffic?

One of the largest companies with skin in the game, and the one we’ve dug into for the purpose of this blog post, is the Jun Group. Since 2013 they’ve operated the HyperMX SDK, which is integrated within hundreds of the top apps across multiple marketplaces. HyperMX is a mediation platform for video ads, and it’s also used to deliver the rewarded traffic experiences we’ve shown examples of.

Which Apps Use the HyperMX SDK?

A sample of the Android apps which can be observed generating Jun Group rewarded traffic is available here. They also integrate with iOS apps, but it’s harder to detect the app in such cases due to differences in available measurement signals between iOS and Android. It’s likely the iOS counterparts of these apps also integrated the HyperMX SDK, and we can certainly confirm that for one in particular.

The most popular app by FAR, and the one we did most of our testing in, is the Subway Surfer app. This app has over a billion installs on Android alone.

In the following video, Jun group’s CEO explains how they’ve included their SDK in several hundred of the most popular apps worldwide in order to to reach hundreds of millions of people back in 2013 (certainly much higher now):

It’s not terribly important you watch the whole thing to understand this blog post, but we found the following quote to confirm our understanding of how the SDK is used:

“We can also bring people to any page from our placements. So, a user might have an opportunity to go see something that’s sitting on a major publisher site, and it might have a video on it, or it might just be a page.”

@1:24 in the above video

Basically, this goes to show they’re not terribly coy about what their tech does. We understand why they feel that way, there are no standards around this traffic, and hardly anyone knows how it’s truly delivered.

That bravado is further demonstrated in their case studies. For example:

Translated to a non-weaselese dialect of English: “the publisher oversold direct campaigns, and had no way to deliver the organic inventory to the advertisers. In order to satisfy the advertiser without any uncomfortable conversations, they paid for over 13 million inorganic visits per-day from users playing mobile games, who had no attachment to the content. The advertiser and the IVT tracking vendors, were none the wiser.”

This next one makes a lot more sense given the forced podcast visits from the example we shared:

When we look at this, the words wiggle & dance around until they look more like: “we forced 6 million people to listen to a couple 15 second snippets of a podcast, and paid them 125 GuGaCoins for their troubles.”

Weak KPIs will always be exploited, and this traffic fills a hole.

Examining HyperMX SDK Signals From Our Packet Captures

Over the course of the past few months, we played Subway Surfer while capturing detailed network logs from our iOS and Android devices. Feel free to skip to the end if additional technical details don’t interest you.

There’s a lot we could say about the flow of traffic, but we want to keep it relatively concise. Folks who want the deepest dive possible can reach out to us on Linkedin or Twitter for more details. Suffice it to say, none of the bid requests we saw from the ad-monetized web pages in the video labeled the placements as rewarded, and why would they? Almost everyone in the supply chain believes this to be a normal mobile-web experience.

Particularly, if you are a DSP, SSP, or exchange, and you’re interested in learning how to identify this traffic within your logs, please do reach out. We can help you enact filters for such traffic using the data you have available.

Programmatic Display & Video Supported Web Page

This first example relates to the experience from the following video (shared at the top of the article as well):

Before we are sent anywhere, HyperMX gathers some information relevant to the bid request. That info can be seen in the following request to https://marketplace-android-*.hyprmx.com/trackings/offerImpressionAttempt (my personal information removed and replace with “[REDACTED]”)

{
	"placement_id": 32910,
	"offer_identifier": "[REDACTED]",
	"offer_type": "web_traffic",
	"distributor_id": "1000214203",
	"uid": "[REDACTED]",
	"msdkv": 316,
	"sdk_version": "6.0.1",
	"device_os_version": "8.1.0",
	"device_type": "android",
	"device_model": "[REDACTED]",
	"device_fingerprint": "[REDACTED]",
	"device_manufacturer": "[REDACTED]",
	"device_brand": "[REDACTED]",
	"device": "[REDACTED]",
	"device_product": "[REDACTED]",
	"device_width": 720,
	"device_height": 1404,
	"pxratio": 2,
	"connection_type": "WIFI",
	"bundle_id": "com.kiloo.subwaysurf",
	"bundle_version": "2.31.0",
	"cleartext_traffic_permitted": true,
	"target_sdk_version": 30,
	"permissions": ["android.permission.WAKE_LOCK", "android.permission.INTERNET", "android.permission.ACCESS_NETWORK_STATE", "com.google.android.c2dm.permission.RECEIVE", "com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE", "com.google.android.gms.permission.AD_ID", "com.kiloo.subwaysurf.permission.C2D_MESSAGE", "android.permission.ACCESS_WIFI_STATE", "android.permission.RECEIVE_BOOT_COMPLETED", "android.permission.FOREGROUND_SERVICE", "com.android.vending.BILLING", "com.android.vending.CHECK_LICENSE", "android.permission.VIBRATE", "BIND_GET_INSTALL_REFERRER_SERVICE"],
	"user_permissions": {
		"camera_permission": "denied",
		"calendar_permission": "denied",
		"microphone_permission": "denied"
	},
	"gaid": "[REDACTED]",
	"ad_id_opted_out": false,
	"persistent_id": "[REDACTED]",
	"mobile_js_version": 120
}

In this case, Jun Group has an interested client looking for “web_traffic”, and we get a correlated response from the https://marketplace-android-*.hyprmx.com/embedded_offers/player endpoint:

{
	"offer_skin_path": "boomerang_popup_explore",
	"tracking_view_html": "",
	"tracking_impression_html": "",
	"quarter_1_tracking_html": "",
	"quarter_2_tracking_html": "",
	"quarter_3_tracking_html": "",
	"quarter_4_tracking_html": "",
	"ivt_tracking_html": "https://pixel.adsafeprotected.com/jload?anId=929070\u0026advId=JunGroup\u0026campId=\u0026pubId=1000214203\u0026chanId=\u0026placementId=175484\u0026adsafe_par\u0026uId=[REDACTED]\u0026impID=",
	"viewing_id": "[REDACTED]",
	"token": "[REDACTED]",
	"non_closable_vast": false,
	"svc_clickthrough": false,
	"is_mraid": "false",
	"enable_custom_webview": true,
	"skip_thank_you": true,
	"browser_family": "Chrome",
	"impression_attempt_complete": "",
	"third_party_tracking_provider": "IAS",
	"page_load_timeout": 8,
	"urls": ["https://younghollywood.com/videos/tvfilm/up-close/high-school-musical-the-musical--the-series-cast-play-truth-or-dare.html?utm_source=jun\u0026utm_medium=cpc\u0026utm_campaign=JUN15\u0026wtu_id_h=[REDACTED]", "https://younghollywood.com/videos/lifestyle/star-secrets/how-to-get-into-the-supercars-club-arabia.html?utm_source=jun\u0026utm_medium=cpc\u0026utm_campaign=JUN15\u0026wtu_id_h=[REDACTED]"],
	"page_load_js": {
		"js": ["function ias() {var po = document.createElement(\"script\"); po.type = \"text/javascript\"; po.async = true;po.src = \"https://pixel.adsafeprotected.com/jload?anId=929070\u0026advId=JunGroup\u0026campId=\u0026pubId=1000214203\u0026chanId=\u0026placementId=175484\u0026adsafe_par\u0026uId=8780771519\u0026impID=\";var s = document.getElementsByTagName(\"script\")[0]; s.parentNode.insertBefore(po, s);};ias();", ""],
		"map": {
			"0": 0,
			"1": 1
		}
	},
	"visit_length": 15,
	"maximum_page_load_wait_time_in_seconds": 4,
	"webtraffic_proscenium_delay": 0.0,
	"is_boomeo_web_start": "false",
	"short_first_step": false,
	"is_user_choice": "false",
	"short_step_length": 5,
	"hide_referrer_url": "true",
	"reward_id": 0,
	"reward_quantity": 1,
	"reward_text": "1 reward",
	"reward_token": "[REDACTED]",
	"reward_cost": 1.0e-05,
	"bid": "0.009428",
	"max_bid": "0.00952",
	"bid_throttle": 15.0,
	"step_count": 2,
	"reward_timestamp": "1648504312",
	"open_measurement": {
		"partner_name": "Jungroup",
		"client_version": "1.3.15-iab2507",
		"api_version": "android-6.0.1-316"
	},
	"player_application_origin": "https://marketplace-android-b316.hyprmx.com",
	"cec_url": "https://vast-proxy.hyprmx.com/client_error_captures",
	"redirection_url": "https://static.hyprmx.com/static_skins/boomerang_popup_explore/index.html?device_type=android\u0026distributor_id=1000214203\u0026msdkv=316\u0026offer=web_traffic-a22d044466101ca5d63207773802226e\u0026placement_id=32910\u0026trampoline=[REDACTED]",
	"uid": "[REDACTED]",
	"distributor_id": "1000214203",
	"offer": "web_traffic-a22d044466101ca5d63207773802226e",
	"msdkv": 316,
	"device_type": "android",
	"placement_id": 32910
}

There are some interesting things we can see here:

• This placement is being tracked by IAS, their code plainly viewable in the “ivt_tracking_html” field
• The urls we will be sent to are in an array called “urls”
  • https://younghollywood.com/videos/tvfilm/up-close/high-school-musical-the-musical--the-series-cast-play-truth-or-dare.html?utm_source=jun\u0026utm_medium=cpc\u0026utm_campaign=JUN15\u0026wtu_id_h=[REDACTED]
  • https://younghollywood.com/videos/lifestyle/star-secrets/how-to-get-into-the-supercars-club-arabia.html?utm_source=jun\u0026utm_medium=cpc\u0026utm_campaign=JUN15\u0026wtu_id_h=[REDACTED]
• For each page, the “visit_length” will be 15 seconds
• “hide_referrer_url” is set to “true”; one can imagine what that might signal

Next, the first page loads as you can see in the video. There are many bid requests that go out, from many major SSPs and exchanges, and none of them label the inventory as rewarded or otherwise originating from within an app.

If you are a DSP or SSP, and you’re interested in learning how to identify this traffic within your logs, please do reach out. We can help you enact filters for such traffic using the data you have available.

Audio-Ad Supported Podcast

Loading a full 30+ minute podcast in a rewarded ad placement seems even more egregious than loading a web page. At least with the web page, it’s conceivable a user might accidentally scroll through it in 15 seconds.

In the case of a podcast, the user has no real hope of engaging with the content in 15 seconds; it seems rather blatantly geared towards creating advertising events. Do they really expect people to stop playing a game, and listen to a 30 minute podcast???

In this example, we see the following request to endpoint https://live.hyprmx.com/trackings/offerImpressionAttempt (now using an iPhone):

{
	"placement_id": 34115,
	"offer_identifier": "[REDACTED]",
	"offer_type": "web_traffic",
	"sdk_version": "2.36.0",
	"bundle_id": "com.kiloo.subwaysurfers",
	"ad_id_opted_out": true,
	"msdkv": 225,
	"supported_interface_settings": ["UIInterfaceOrientationPortrait"],
	"pxratio": 2,
	"device_os_version": "15.5",
	"ats_settings": {
		"NSAllowsArbitraryLoads": true,
		"NSAllowsLocalNetworking": true,
		"NSAllowsArbitraryLoadsInWebContent": true,
		"NSAllowsArbitraryLoadsForMedia": true
	},
	"screen_traits": {
		"horizontalSizeClass": "compact",
		"verticalSizeClass": "regular",
		"userInterfaceLayoutDirection": "LTR",
		"accessibilityContrast": "normal",
		"userInterfaceIdiom": "iPhone",
		"userInterfaceStyle": "dark",
		"userInterfaceLevel": "base",
		"displayScale": 2
	},
	"connection_type": "WIFI",
	"maccatalyst": false,
	"identifier_for_vendor": "[REDACTED]",
	"ios_app_on_mac": false,
	"device_width": 750,
	"carrier_data": {
		"0000000100000002": {
			"allows_voip": true
		},
		"0000000100000001": {
			"allows_voip": true,
			"mobile_network_code": "260",
			"mobile_country_code": "310",
			"carrier_name": "T-Mobile",
			"cellular_radio_type": "CTRadioAccessTechnologyLTE"
		}
	},
	"xcode_version": "13A1030d",
	"supports_multiple_scenes": false,
	"uid": "[REDACTED]",
	"hypr_modules": {
		"HYPRPermissions": "5"
	},
	"permissions": ["NSCameraUsageDescription", "NSUserTrackingUsageDescription", "NSMotionUsageDescription", "NSPhotoLibraryAddUsageDescription", "NSCalendarsUsageDescription", "NSPhotoLibraryUsageDescription"],
	"distributor_id": "1000214202",
	"device_model": "iPhone12,8",
	"user_permissions": {
		"microphone_permission": "not_determined",
		"calendar_permission": "not_determined",
		"camera_permission": "not_determined"
	},
	"bundle_version": "2.36.0",
	"framework_type": "core_framework",
	"device_type": "iPhone",
	"persistent_id": "00000000-0000-0000-0000-000000000000",
	"device_height": 1334,
	"mobile_js_version": "137"
}

We get the following correlated response from the https://live.hyprmx.com/embedded_offers/player endpoint:

{
	"offer_skin_path": "boomerang_popup_explore",
	"tracking_view_html": "",
	"tracking_impression_html": "",
	"quarter_1_tracking_html": "",
	"quarter_2_tracking_html": "",
	"quarter_3_tracking_html": "",
	"quarter_4_tracking_html": "",
	"ivt_tracking_html": "https://pixel.adsafeprotected.com/jload?anId=929070\u0026advId=JunGroup\u0026campId=\u0026pubId=1000214202\u0026chanId=\u0026placementId=191942\u0026adsafe_par\u0026uId=[REDACTED]\u0026impID=",
	"viewing_id": "9249948818",
	"token": "[REDACTED]",
	"coppa": 1,
	"non_closable_vast": false,
	"svc_clickthrough": false,
	"is_mraid": "false",
	"enable_custom_webview": true,
	"skip_thank_you": true,
	"browser_family": "Safari",
	"impression_attempt_complete": "",
	"third_party_tracking_provider": "IAS",
	"page_load_timeout": 8,
	"urls": ["https://www.iheart.com/podcast/256-bloomberg-surveillance-30972795/episode/surveillance-market-timing-with-bitterly-podcast-98773848/?embed=true\u0026sc=widget\u0026pname=JunGroup\u0026campid=Bloomberg\u0026keyid=PageView\u0026cid=1000214202\u0026wtu_id_h=[REDACTED]", "https://www.iheart.com/podcast/256-bloomberg-surveillance-30972795/episode/surveillance-recession-chances-with-hatzius-podcast-98692521/?embed=true\u0026sc=widget\u0026pname=JunGroup\u0026campid=Bloomberg\u0026keyid=PageView\u0026cid=1000214202\u0026wtu_id_h=[REDACTED]"],
	"page_load_js": {
		"js": ["var _jgPlayButton=undefined;var jgPlayButton=function(){var t=document.querySelectorAll(\"button\");if(typeof _jgPlayButton===\"undefined\"){for(var e=0;e\u003ct.length;e++){if(typeof _jgPlayButton===\"undefined\"\u0026\u0026t[e].dataset[\"test\"]===\"play-button\"){_jgPlayButton=t[e];break}}}return _jgPlayButton};var jgIsPodcastPlaying=function(){var t=jgPlayButton();return typeof t!==\"undefined\"\u0026\u0026(t.getAttribute(\"aria-label\")===\"Pause\"||[\"playing\",\"buffering\"].includes(t.dataset[\"testState\"]))};var jgPlayVideo=function(){if(jgIsPodcastPlaying()){clearInterval(jgInterval)}else{var t=jgPlayButton();if(typeof t!==\"undefined\"){t.click()}}};var jgInterval=setInterval(jgPlayVideo,500);function ias() {var po = document.createElement(\"script\"); po.type = \"text/javascript\"; po.async = true;po.src = \"https://pixel.adsafeprotected.com/jload?anId=929070\u0026advId=JunGroup\u0026campId=\u0026pubId=1000214202\u0026chanId=\u0026placementId=191942\u0026adsafe_par\u0026uId=9249948818\u0026impID=\";var s = document.getElementsByTagName(\"script\")[0]; s.parentNode.insertBefore(po, s);};ias();", "var _jgPlayButton=undefined;var jgPlayButton=function(){var t=document.querySelectorAll(\"button\");if(typeof _jgPlayButton===\"undefined\"){for(var e=0;e\u003ct.length;e++){if(typeof _jgPlayButton===\"undefined\"\u0026\u0026t[e].dataset[\"test\"]===\"play-button\"){_jgPlayButton=t[e];break}}}return _jgPlayButton};var jgIsPodcastPlaying=function(){var t=jgPlayButton();return typeof t!==\"undefined\"\u0026\u0026(t.getAttribute(\"aria-label\")===\"Pause\"||[\"playing\",\"buffering\"].includes(t.dataset[\"testState\"]))};var jgPlayVideo=function(){if(jgIsPodcastPlaying()){clearInterval(jgInterval)}else{var t=jgPlayButton();if(typeof t!==\"undefined\"){t.click()}}};var jgInterval=setInterval(jgPlayVideo,500);"],
		"map": {
			"0": 0,
			"1": 1
		}
	},
	"visit_length": 10,
	"maximum_page_load_wait_time_in_seconds": "4",
	"webtraffic_proscenium_delay": 0.0,
	"is_boomeo_web_start": "false",
	"short_first_step": false,
	"is_user_choice": "false",
	"short_step_length": 5,
	"hide_referrer_url": "true",
	"reward_id": 0,
	"reward_quantity": 1,
	"reward_text": "1 reward",
	"reward_token": "[REDACTED]",
	"reward_cost": 1.0e-05,
	"bid": "0.013518",
	"max_bid": 0.0153,
	"bid_throttle": 1.0,
	"step_count": 2,
	"reward_timestamp": "1656627095",
	"open_measurement": {
		"partner_name": "Jungroup",
		"client_version": "1.3.15-iab2507",
		"api_version": "ios-2.36.0-225"
	},
	"player_application_origin": "https://live.hyprmx.com",
	"cec_url": "https://vast-proxy.hyprmx.com/client_error_captures",
	"redirection_url": "https://static.hyprmx.com/static_skins/boomerang_popup_explore/index.html?device_type=iPhone\u0026distributor_id=1000214202\u0026msdkv=225\u0026offer=web_traffic-d0b3a41964ce379a7b6fd732749d4584\u0026placement_id=34115\u0026trampoline=[REDACTED]",
	"uid": "[REDACTED]",
	"distributor_id": "1000214202",
	"offer": "web_traffic-d0b3a41964ce379a7b6fd732749d4584",
	"msdkv": 225,
	"device_type": "iPhone",
	"placement_id": 34115
}

This time we can see the “urls” array contains podcast embeds from iHeart media.

• https://www.iheart.com/podcast/256-bloomberg-surveillance-30972795/episode/surveillance-market-timing-with-bitterly-podcast-98773848/?embed=true\u0026sc=widget\u0026pname=JunGroup\u0026campid=Bloomberg\u0026keyid=PageView\u0026cid=1000214202\u0026wtu_id_h=[REDACTED]
• https://www.iheart.com/podcast/256-bloomberg-surveillance-30972795/episode/surveillance-recession-chances-with-hatzius-podcast-98692521/?embed=true\u0026sc=widget\u0026pname=JunGroup\u0026campid=Bloomberg\u0026keyid=PageView\u0026cid=1000214202\u0026wtu_id_h=[REDACTED]

We can additionally see tracking tech from IAS applied to this transaction.

The experience is plainly visible in the video; the podcast auto plays, and the user is dropped immediately into an advertisement. Audio ads in this case are by Triton Digital, recently acquired by iHeart media.

Conclusion

Rewarded traffic exploits the lack of MRC standards around traffic sourcing, and the lack of policing around Rewarded ad formats in general. As an industry, we need to decide if we want to allow this precedent that an entire ad-monetized webpage is a valid creative. It would be insane to attempt that in any other environment outside of incentivized traffic marketplaces, so why is it accepted for rewarded ads?

Though it may be hard to identify, we have developed several ways to flag such traffic. We had to take multiple approaches given the differences in what certain supply chain participants are able to see in the bidstream.

Are we totally off base? Do you have a success story you’d like to share from your rewarded traffic campaign? A spectacular failure? Reach out to share it with us on Linkedin or Twitter.

Introduction

In this post, we’ll examine if a Tranco List without Alexa Rank data would be suitable for marketers looking for a new source of site performance data.

Would they find the switch over to be jarring? Would the sites they saw on Alexa Rank lists still be present? If so, what sort of consistency could they expect with respect to how sites rank relative to each other?

We’ll also examine if there are alternative data sources that can fill in the gaps between Alexa and Tranco.

For Marketers Unconcerned With the Technical Findings

If the technical & academic research doesn’t appeal to you, you can head to the Conclusions section, where there are open questions you can help contribute answers to!

Saying Goodbye to Alexa Ranks

On May 1st, Alexa.com retired its API and web lookup tools. Most importantly, it stopped providing Alexa Rank reports, which are commonly used as a measure of website popularity.

The methodology for creating that rank is described at a high level on the Alexa.com blog, which is no longer up (a cached copy is linked):

“Alexa rank is calculated using a proprietary methodology that combines a site’s estimated traffic and visitor engagement over the past three months. Traffic and engagement are estimated from the browsing behavior of people in our global panel, which is a sample of all Internet users.”

-“What is Alexa Rank?” from the Alexa.com blog

For many years, researchers and marketers from a variety of disciplines relied on Alexa.com’s site rank data to inform them of trends, and to identify opportunities. Its recommended uses include:

• Evaluating a site’s commercial potential
• Checking to see if a site’s traffic is rising or falling
• Finding potential affiliates

You should consider checking out this post (“7 Ways to Use Alexa Rankings to Grow Your Business”) for more insight into how marketers might have used this data to grow their businesses.

Fraud researchers have an additional concern: to prepare for the next exploit, it’s very important for us to understand what sites people actually visit.

What is the Tranco List, and Why do we Use It?

At deepsee.io, we profile the behaviors of websites, and the relations they have with each other, but we can’t estimate how many people visit a site from this experiential approach. For that reason, one of the few external data sources we consume is the Tranco List, “A Research-Oriented Top Sites Ranking Hardened Against Manipulation”.

It combines several ranking sources in order to create a single list that gives researchers a wider view of the websites people visit.

Prior to May 1st, 2022, the list was composed of the following 3 data sources:

• Alexa.com: based on page visits reported by a user panel and on a tracking script
• Majestic Million: a link-based ranking system
• Cisco Umbrella: based on the number of IPs requesting a certain domain, sourced from Cisco’s database of DNS traffic

List Generation Methodology

We compared three lists that were generated using the Tranco API on April 5th 2022. This API allows users to choose the data sources they incorporate, which was perfect for the purposes of our analysis. We are providing links to the analysis datasets for transparency:

• A “normal” Tranco list, composed of data from all three sources: https://tranco-list.eu/list/K2W2W/full
• A list that included Majestic Million & Cisco Umbrella data sources, and excluded Alexa.com data: https://tranco-list.eu/list/25N59/full
  • Referred to as “Tranco Without Alexa,” or TWA, in the context of this research
• A list composed strictly of Alexa.com data: https://tranco-list.eu/list/5YXYN/full

Note: Tranco recently announced that Domaintools would be allowing them to incorporate their Farsight ranking system into the Tranco List. This means that there won’t be a “Tranco Without Alexa” list exactly like we use for forecasting purposes in this article.

The Tranco List will include Alexa.com data as available (once unavailable, it will decay off their list over 30 days), and is now additionally informed by Farsight passive DNS data. Still, we see the analysis of the Tranco List’s makeup pre-May as informative to those trying to understand the scope and scale of various website ranking systems. We will conduct additional analysis of the list that includes Farsight data once a sufficient sample of data is available.

Results of Our Analysis

Huge Portions of the List Are Sourced Exclusively from Alexa Data

Of the 7,552,154 unique domains on the “normal” Tranco list, nearly 81% of them appeared on the Alexa list, and were not otherwise present on either the Cisco Umbrella or Majestic Million lists.

Even though each list is <=1,000,000 items daily, over 30 days we saw many more unique entries on the Alexa list. This suggests that it’s more volatile than the Cisco Umbrella & Majestic Million lists, but also gives us a wider view of the web’s surface.

Interesting Exceptions

We also repeated this analysis for various subsets of our data, and found some interesting exceptions:

Domains with backlinks from >=10 unique root domains

In contrast to the list at large, this subset of 375,277 domains is much more likely to be found across multiple data sources. Given that the Majestic Million list is primarily based on backlinks, this result could be expected.

Sites Loading the Google Publisher Tag (GPT) Script

Of 118,132 unique domains we crawled which loaded the GPT.js script, the majority of them are sourced from multiple lists. The presence of this script signals intent to display advertisements.

The Same Sites Are Ranked Quite Differently Between Alexa and TWA

~96% of the Alexa top 10,000 would be present somewhere within the Tranco file without Alexa, however, they are scattered far and wide (not concentrated at the top). To find 9,500 of the top 10k ranked sites from Alexa.com data, you’d have to expand your search to the top 1,330,000 domains in the TWA list.

The rank reshuffling is further demonstrated by the following chart, which shows how much ranks have changed for sites that exist on both the Alexa & TWA top million lists.

For sites that appear on both the Alexa top million and the TWA top million, ~48% of sites saw their rank move 200k or more.
For sites that appear on both the Alexa top million and the TWA top million, ~68% of sites saw their rank move 100k or more.

Quantifying Rank Bucket Similarity

This section describes the differences in the makeup of top “N” site lists (top 10k, top 100k, etc…). This is a common way that media buyers consider the popularity of sites.

This tells us that only 32% of the Alexa top 10k are in the TWA top 10k, and that number holds steady all the way up to a million.

Clearly, the rank thresholds aren’t transferable; someone targeting the top 10k Alexa rank sites couldn’t just apply the same rank threshold if they were using a tranco list without Alexa.

Analyzing Relative Rank Preservation with an Analysis of Site Pairs

Another way to compare two different sets of rankings is to analyze how sites compare to each other across the various lists being compared.

Consider three sites: A, B, and C.
The Alexa ranks for those sites are:

• A: 100
• B: 250
• C: 1,000

The TWA ranks for those sites are:

• A: 50
• B: 100
• C: 10,000

For both lists, A>B>C, so they are relatively 100% similar with respect to these 3 sites.

We can determine this by looking at all unique pairs that can be constructed from those 3 sites:

• A:B – Agreed
  • Alexa: A (100) is ranked better than B (250)
  • TWA: A(50) is ranked better than B (100)
• B:C – Agreed
  • Alexa: B (100) is ranked better than B (250)
  • TWA: B (100) is ranked better than C (10,000)
• A:C – Agreed
  • Alexa: A (100) is ranked better than C (1,000)
  • TWA: A (50) is ranked better than C (10,000)

3/3 pairs agree, so pairwise similarity is 100%

Now, Imagine that we change the TWA rankings for those sites to the following:

• A: 50
• B: 100
• C: 75

The comparison of all unique pairs now changes:

• A:B – Agreed
  • Alexa: A (100) is ranked better than B (250)
  • TWA: A(50) is ranked better than B (100)
• B:C – Disagreed
  • Alexa: B (100) is ranked better than B (250)
  • TWA: B (100) is ranked worse than C (75)
• A:C – Agreed
  • Alexa: A (100) is ranked better than C (1,000)
  • TWA: A (50) is ranked better than C (75)

This time, only 2/3 pairs agree, so pairwise similarity is 66.6%

This is the basic logic that fuels the following data points:

• Of pairs of sites that appear on both the Alexa top 10k and the TWA top 10k, ~61% preserve the same rank order
  • 3,177 sites were on both lists, and each was compared to the other as a pair.
    • Using the formula N(N-1)/2 to find the number of unique pairs analyzed, we find that 10,093,329 pairs were analyzed.
• The same can be said for sites on both the Alexa top 100k and the TWA top 100k; ~61% preserve the same rank order
  • 32,558 sites were on both lists, and each was compared to the other as a pair.
    • Using the formula N(N-1)/2 to find the number of unique pairs analyzed, we find that 529,995,403 pairs were analyzed.

Conclusions & Takeaways

The most applicable conclusions affecting marketers:

• Someone targeting the top 10k Alexa rank sites couldn’t just apply the same rank threshold if they were using a tranco list without Alexa.
• Alexa ranks were more volatile than the Cisco Umbrella & Majestic Million ranks, but also gave us a wider view of the web’s surface.
• For researchers to stay ahead of the next threat, a source of ranking data that accounts for site-visit metrics is likely imperative

As we mentioned in the introduction, there won’t be a “Tranco Without Alexa” list exactly like we use for forecasting purposes in this article. Due to the way that Tranco is permitted to use Farsight data, it’s not possible to create custom lists including/excluding that dataset. Basically, that means we won’t be able to see exactly how well the Farsight data fills the gaps left by Alexa.com’s exit.

All that said, this study has highlighted to us the importance of including a data source based on page visits reported by some user panel, or tracking script. So much of what’s known about the web’s surface would be lost without the availability of such measurement systems.

Realistically, there are very few companies that can match the breadth of knowledge that Alexa.com had acquired. It makes sense that Amazon, whose ad business is booming, would want to keep those insights close to the chest as a competitive advantage.

It is generous of Domaintools to contribute their Farsight passive DNS dataset to the open-source research efforts of the Tranco team, but it has yet to be seen how DNS requests relate to site visits. This is an admitted blind spot, as the Domaintools team puts it:

“[…]since this is only seeing traffic that would go to the internet, if the organization’s nameservers already have a domain cached, that request won’t be seen in this feed.”

Mirror, Mirror, on the Wall, Who’s the Fairest (website) of Them all?
Aaron Gee-Clough, Senior Data Engineer @ Domaintools

It’s an open question as to what datasets can give researchers & marketers the best view into what sites are actually getting visited the most. A few top contenders come to mind:

• SimilarWeb: data sourced from a multiplicity of useful POVs; likely to achieve most parity with Alexa.com’s methodology
  • Like Alexa.com, this data is partially sourced by a panel of users with their extension installed
  • Voluntary submission of data from publishers who connect their Google Analytics accounts
  • Partnerships with ISPs and DSPs
• Ahrefs: data is based on clickstream data & backlinks gathered from their massive crawling efforts
  • The organic search data (clickstream) can be extremely helpful in determining the most used sites.
  • The backlinks data may be comparable to the Majestic data, so it could be expected that this slice of their data wouldn’t contribute many new unique sites to our view of the web’s surface.
• BuzzSumo: data sourced from social media engagements
  • Along with search, social media is a huge engine for content discovery.
  • Someone with a view of what’s being shared & engaged with on social media can contribute much to the way researchers understand the web’s surface.

Obviously, companies like Google & Facebook could contribute a huge amount of knowledge to this topic, but it can’t be expected that these companies would suddenly open up their historically opaque data to the public.

At this point we turn to you, our readers, to help us understand what you consider the most useful measure of site popularity. Is it one we listed above, or a product we hadn’t considered? What kind of methodology do they use? How has it helped you achieve your business goals?

If you using Alexa.com ranking data, how have your processes changed since moving to a new data source?

We’d love to hear all about it on Twitter or LinkedIn. Not about socials? E-mail us a line at hello@deepsee.io.

Introduction

In this post, we’ll be sharing what we know about a traffic sourcing campaign that affected multiple Yahoo properties between February 2021 (at minimum; possibly earlier) and February 2022. The sites affected were: yahoo.com & its subdomains, techcrunch.com, and autoblog.com.

The traffic was sourced by multiple means, and it’s hard to quantify exactly how much traffic came via specific paths without analyzing logs of buyers at a large scale. In this post we will describe the avenues by which we observed sourced traffic flowing, and give readers the tools to flag related impressions using their own log data.

If you would like to identify ANY and ALL of the invalid sourced traffic we refer to in this article, you need simply look for the presence of a “yotavid” string in the full page URLs you have relating to yahoo advertising events.

A Quick Primer on Incentivized Traffic

Incentivized traffic, for those unaware of this term (we will be using it quite heavily in this post), comes from users who are paid to visit a certain web property. They may additionally be required to perform subsequent actions on the page to receive their rewards. Compensation usually comes in the form of points that can be redeemed for prizes, or gift cards.

There are many such platforms that offer users rewards for doing these kind of activities; a very popular example of such a platform is Swagbucks, owned by Prodege, who operates several other popular platforms like Swagbucks.

These platforms are often leveraged in order to get prospective customers to take actions like:

• Signing up for free trials (that convert to paid membership after a month)
• Filling out surveys
• Installing mobile / ctv apps

Most relevant to this post, users are also sometimes encouraged to visit ad-supported publishers, and create multiple page / ad views. In such cases, these platforms open destination pages in new tabs / windows in order to create visits that appear as direct.

Is Incentivized Traffic Considered Valid?

In the past, this was more of a gray area. After all, real people are the ones who participate in incentivized traffic programs, right? The MRC has no guidelines on intentionally purchased incentivized traffic.

The most important thing you can takeaway from this article is: human does not matter in this case. The biggest ad buying platforms in the world consider this activity invalid, and will offer make-goods on this traffic.

We shared the data from our own internal investigations with Morning Brew in order to get help quantifying the effect on the industry at large. As part of their due diligence, they asked Google about their stance on incentivized traffic being used to fulfill advertising campaigns, and Google offered this on-the-record statement:

“Google considers invalid traffic to be ad traffic that does not represent genuine user intent or interest. This includes both incentivized traffic and traffic from pop-unders. Generally speaking, invalid traffic applies to any clicks or impressions that may artificially inflate an advertiser’s costs or a publisher’s earnings.[…]”

This is echoed in numerous places across their publisher policies, for example in the AdSense publisher policies:

When the Morning Brew asked The Trade Desk their thoughts on incentivized & pop traffic, The Trade Desk said:

“We consider popunders and incentivized traffic as IVT“

Additionally, they said:

“Since our founding, The Trade Desk has been committed to ensuring our clients, brands and their agencies, are buying the most valuable digital media available.

Our Marketplace Quality team has long focused on a transparent supply chain, including working on industrywide initiatives that have improved the entire ecosystem such as sellers.json and ads.txt. They work closely with partners and researchers to ensure that we only buy legitimate inventory and clean up the supply chain. Our work here has made fraud reports and discoveries less prominent than many years ago, and our team continues to stay at the forefront of new technologies and ways to maintain a transparent and fair marketplace.

Our publisher team focuses on building an efficient supply chain, with close relationships with publishers and their SSP partners, which ensures we are closely integrated with the biggest media companies in the world and are directly connected through them. This is even more evident in initiatives such as OpenPath, where we buy directly from the publisher themselves.

The Trade Desk has led the way on these initiatives and will continue to do so in service of a transparent, competitive and trusted market for advertising on the open internet, and both teams continue to evolve to stay at the forefront of the marketplace.”

Readers: be sure to ask your DSP their policy on incentivized traffic, and the means they have in place to detect it. You should not be paying for ads served to visitors without genuine interest in visiting whatever site they’re on.

How Did Traffic Arrive at Yahoo Properties, and How Can I Identify It?

As mentioned in the intro, multiple means were leveraged in order to create visits to Yahoo properties. The most observable means were:

• Pop Traffic, coming from a vendor called “Viral Sparks”
  • This was identified during Q4 of 2021, but may have been occurring earlier
• Incentivized Traffic, coming from Prodege properties (and perhaps others, but it hasn’t been observed directly)
  • Happened as early as February 2021, likely detectable earlier as well

Describing the Pop Traffic With Examples

In previous articles, we’ve covered how pop traffic is leveraged to create “clean” impressions that take advantage of real users on real devices; take the below links as examples.

In typical fashion, when visitors to porn, piracy, and other such sites interact with the page, they were sometimes taken to yahoo properties.

This is exemplified in this video from November 2021:

In this video, it seems the pop campaign destination leads to a redirect domain meant to leech off bit.ly’s reputation, “getbitly.pro;” again, this is not a domain operated by bit.ly, the popular link shortening service.

Subsequently, users are sent to another redirect domain: viralsparks.io

In these examples, we can see that the query string parameters are preserved; the user is simply bounced to anonymize upstream sources of traffic.

We believe that the Viral Sparks (the entity in the domain field above) is the one who purchased the pop traffic to be sent to Yahoo properties. This is kind of obvious, when you consider that viralsparks.io sent users to viralsparks.com (cached version linked) until late Q4 2021.

Likely they realized their fraud activity would become too obvious if they used their corporate domain to redirect pop traffic, so they later changed the redirect domain to adverify.cloud while still using the same query string params / values during the act of redirecting pop traffic to yahoo properties; more on this later.

Ultimately, the user lands on a yahoo page with a video ad (this is a consistent observation from both the pop & incentivized traffic).

Again, in this url we can see preserved query string parameters from the original “getbitly.pro” request. This is one way that we are able to flag the sourced traffic, and this lets us give readers the means to identify traffic in their own data.

The behavior is quite similar for pops that took users to other Yahoo family properties, like techcrunch.com:

The methodology in this case is nearly exactly the same, though the entity redirecting the traffic in this case has changed their url from viralsparks.io to adverify.cloud.

How to Identify the Pop Traffic in Logs

For anyone who has access to full page URLs on their programmatic buys, this will be easy. The pop visits are signified by the presence of several possible query string parameters relating to Viral Sparks. These filters should only be applied to the following domains & their subdomains: yahoo.com, techcrunch.com, autoblog.com

• Look for the presence of a query string parameter called “aolapubid” which has a value starting with “vsp” (vsp likely signals Viral Sparks)
  • Example: aolapubid=vsp237bedbaa9038610fe9b2c34c8d50432
• Look for the presence of a query string parameter called “cid” which has a value starting with “vs” (vs likely signals Viral Sparks)
  • Example: cid=vs_yv

For anyone looking for more examples, we’ve compiled hundreds of cases from November 2021: https://docs.google.com/spreadsheets/d/1xxAIqVBHandZdLWCmprHSVsg53sCnr_GBrZTJ-CSEi4/edit?usp=sharing

In the examples, the “from_domain” is the domain we visited, and which prompted the pop / redirect activity. The “to_domain” is the ultimate destination of that pop / redirect activity. The full urls in the “examples” tab are cases from which we were able to reverse engineer the identification strategy.

Describing the Incentivized Traffic With Examples

In February 2021 we decided it would be in the best interest of the industry if we checked into who was currently buying traffic from some of the top incentivized traffic platforms. We started by checking into the active campaigns on: mypoints.com, swagbucks.com, prizerebel.com, zoombucks.com, and inboxdollars.com.

We found that yahoo had active campaigns on swagbucks.com, mypoints.com, and inboxdollars.com. They weren’t the only site purchasing traffic, but we did find it particularly noteworthy due to the fact that yahoo inventory is purchased across many campaigns worldwide. Their volume is very high, and we were curious to know how much was supported by incentivized traffic.

It was additionally noteworthy due to the time period across which traffic was purchased. Between these sites, there was at least one active campaign until mid-February 2022, which makes at least a year-long incentivized traffic campaign.

The following videos show the flow of traffic from swagbucks.com to yahoo.com:

As we can see, participation in this program requires enabling pop-ups in your browser. This is likely to obfuscate the true source of traffic.

As we can see, users are required to view multiple pages for 30 seconds+ each in order to claim their swagbucks / points. This amounts to a blatant manipulation of bounce & time-on-page metrics; no way around it.

Here’s another video showing how the experience appears to potential swagbucks users; they don’t even need to be tabbed-in to the content, they can be browsing in another tab and still reap the rewards:

How to Identify the Incentivized Traffic In Logs

As we mention in the intro, and as exemplified below, the traffic can be characterized by the presence of a query string value like “yotavid“:

In every case of incentivized activity, this query string value appears, and it is confirmed to not appear during organically generated sessions. The exact meaning behind it is not as clear as the Viral Sparks related query string parameters.

Additionally, the pop traffic we identified ALSO carries the “yotavid” string in the full page URL. Basically, you can use that information in the following way (only for yahoo, techcrunch, and autoblog urls):

• To find incentivized traffic that was NOT a popup, look for the following combination of factors:
  • Full page URL contains “yotavid”
  • URL does NOT contain the Viral Sparks indicators

Conclusion and Takeaways

If you would like to identify ANY and ALL of the invalid sourced traffic we refer to in this article, you need simply look for the presence of a “yotavid” string in the full page URLs you have relating to yahoo advertising events.

However, in the course of researching the effects of this scheme on the industry at large, we found that it’s very common for buyers to not even be privy to the full page URLs they serve ads on. This can sometimes be related to the technological limitations of measuring the top level URL from within the context of an ad-unit, but often it’s just information the SSP / DSP doesn’t deign relevant to include in reporting.

Incentivized traffic is a huge industry, and it touches all device types and ad experiences. One of the best, if not ONLY, ways to identify such traffic is by analyzing full page URLs inclusive of query strings. Informed media buying platforms need access to this information, so be sure to request it of all supply partners you work with. Unwillingness to provide such information can be a big red flag, so tread carefully.

Thus-far-unreleased findings of ours indicate that this scheme is just a drop in the bucket, so look forward to learning about the even larger incentivized traffic events we are currently tracking.

Remember: the line for invalid traffic has officially been drawn at the user’s intent to visit an ad-supported publisher page.

Introduction

In this research we dig into traffic sourcing on chessmoba.us, a site creating well over a hundred million daily impression opportunities. It is one of a handful of sites which have acted as cover for MangaOwl (a site which links readers to pirated web cartoons), and the extended MangaOwl family of web properties.

Using code snippets captured from live traffic, and other publicly available data sources, we will show how the vast majority of visits to chessmoba.us & its cohorts are actually laundered visits of users who are reading pirated manga / web cartoons (often sexually explicit in nature).

What’s of additional interest here is the laundering mechanism; users get an experience free of pop-unders & redirects, but advertisers still get zero visibility into the true source of traffic.

Maintaining & Monetizing a Piracy Site

Pirated content is, and always has been, one of the top things people will search for on the internet. Due to the questionable legal status of the content, most supply-side platforms (SSPs; aggregators of publisher inventory) have rules against pirated content appearing on their member publishers’ sites, and some advertisers try to avoid this content.

Google, the worlds largest aggregator of publisher inventory, has policies which specifically forbid pirated & sexually explicit content, both of which are in the scope of our conversation today. Without access to Google ad products, it becomes much harder to monetize at a large scale, especially if you are an individual, or small team.

Depending on the number of copyright claims made against these sites, they may have to constantly rotate domain names in order to avoid users arriving to a site that has been disabled by the hosting provider. The chances of this are more likely if the site hosts links to content produced by big Hollywood studios, because these studios have the resources to programmatically hunt down & make copyright complaints against each new site.

Sites hosting pirated content often turn to less-reputable ad networks which have no policy against their content. These 2nd / 3rd string monetization partners usually litter the page with near pornographic ads (adult sites are limited by which networks they can run their ads with; example below), or they create tons of pop-unders / redirects that take users off-site.

As we’ve written about in the past, these pop/redirect ad networks play a large part in the global cookie stuffing & traffic laundering marketplace:

• How Pop Traffic Fuels Affiliate Fraud
• Turning Bad News Into Ad Views: How Some Publishers Get Laundered Traffic from Controversial Content

If you’re looking for further reading into this topic at a high level, the Digital Citizens Alliance and Whitebullet have also done significant research into who supports piracy sites with on-page advertising (our writing today focuses more on the laundering aspect of the problem).

Teasing Out the Grey Areas

There exists a moral / technical grey area here when it comes to advertising to users on sites with pirated content: advertisers want to reach real people, and real people consume pirated content in high volume. As a consequence, there are billions of laundered impressions generated every day.

Advertisers often optimize their campaigns towards human users & viewable placements; both these things are often true of impressions generated from laundered traffic.

One of the main reasons that we built DeepSee is to suss out these opaque traffic laundering marketplaces. The laundering process tends to remove the true source a visitor was sent from, and creates destination-site visits that appear direct. This is clearly visible when you look at the inbound traffic mix for sites who buy a lot of laundered traffic using the free version of tools like Alexa or SimilarWeb, but more on that later.

Honestly, we wouldn’t think as poorly of these traffic acquisition channels if advertisers were alerted about the nature of the traffic sourcing in subsequent bid requests generated by the destination-site (the “clean” content site). This never happens though, and we won’t hold our breath.

We’re very interested to hear the opinions of our readers when it comes to the value of laundered traffic, please drop us a line on Twitter or LinkedIn to voice your opinion!

Introducing the Players & Explaining the Evidence

There are 2 seemingly separate factions involved here. In truth, they are all owned and operated by the same entity, allowing for some unique publisher fraud opportunities that would be very difficult to detect from within an ad creative.

On the other hand, the user experience here is one of the best you can find when it comes to reading pirated comics. As opposed to sites who monetize with pop-unders & redirects, users aren’t routed through dozens of nefarious intermediaries; instead, users stays in a single environment, controlled end-to-end by the MangaOwl developer.

The Players

1. A group of piracy sites centered around MangaOwl, including (but not limited to):
   • mangaowl.net – Alexa rank ~17.8k
   • mangaowl.com – Alexa rank ~193k
   • mangaowls.com – Alexa rank ~51k
   • animeow.me – Alexa rank ~1.1mil
   • animeowl.net – Alexa rank ~525k
2. A group of content sites headed by chessmoba.us in terms of visit volume (all bid volume projections made using Xandr’s forecasting API):
   • chessmoba.us – Estimated daily bid volume of over 100 million(forecast date: 10-27-2021)
   • mostraveller.com – Estimated daily bid volume of over 30 million (forecast date: 10-22-2021; seemingly discovered & cut-off by 10-27-2021)
   • fromyourinside.com – Estimated daily bid volume of over 10 million (forecast date: 10-27-2021)
   • chill-game.com – Estimated daily bid volume of just a few thousand (forecast date: 10-27-2021)
   • portablegamingdude.com – Estimated daily bid volume currently ~0 (forecast date: 10-27-2021)

The piracy sites are most obviously linked by footer links which are clearly visible on mangaowl.net, and also by naming convention

The Content sites are not as clearly linked, but we argue that they behave in such a specific & atypical way that there is no other possibility besides that they have been configured by the same entity to do the same thing.

The Evidence

There Is a Common Owner Between Chessmoba.us and MangaOwl

Let’s get this out of the way first: chessmoba.us is absolutely registered by the operator of MangaOwl, and the proof is surprisingly easy to acquire.

It’s particularly easy to prove who the owner of chessmoba.us is, because you can’t register a domain with a .US suffix using WHOIS privacy protection. You can even check this right now by typing in the domain name on the .US WHOIS lookup service.

Here is a summary of what you’ll see:

The “owl” in the registrant email “zzowl099@gmail.com” is a good hint, but we can additionally see that this email is linked to the moderator of MangaOwl by doing a quick google search for the email address.

If you go through that process, you’ll end up on the above post before reaching the 2nd page of the Google search results. It shows a message from a MangaOwl moderator named “ZZ” who instructs members to send their copyrighted materials to “zzowl099@gmail.com” in order to have them shared with the community.

The other domains in our “content-site” group are registered as sites with a .COM suffix, and they are WHOIS privacy protected such that you can’t as easily infer ownership. However, we will show they are linked by means of behavior, in such a way that they could ONLY be managed by the same person.

When MangaOwl Users Are Reading Pirated & Adult Content, Advertisers Think They Are On Chessmoba.us

The following video demonstrates how a typical mangaowl.net reader generates laundered impressions to chessmoba.us:

• Note: Due to the fact that many of our readers may be watching this while at work, or in a professional setting, we chose to showcase a comic that is safe for work. However, you will have no trouble finding sexually explicit content on MangaOwl if you go looking for it.

We asked our CTO to break down the activity into a summary for those who can’t watch the video, or just need more elaboration. Particularly, we asked him to elaborate on if it’s even possible for this to happen without collaboration between the piracy & “clean” content sites:

The behavior kicks off when a user clicks a link from mangaowl, and is navigated to a reader URL over at chessmoba.us such as (https://chessmoba.us/reader/reader/73165/1461957/{…}). If the advertiser saw this URL, the whole scheme would become obvious to them, because this is the URL which takes you to the manga content.

This reader page loads an image based slideshow viewer, presenting the user with the content they intended to browse to, however, upon page load there is a somewhat obfuscated script that constructs a new, advertising friendly URL (https://chessmoba.us/team/{…}) that replaces the reader one using History.replaceState().

The important detail is that the containing site does not react to this change by redirecting to the advertiser friendly page. This allows chessmoba to render ad impressions attributed to a URL that shows different content if you browse to it directly. Furthermore, History.replaceState() only works to modify the URL the browser displays if the new URL belongs to the same origin as the one housing the script making the change.

That, along with other signals (like a verified SSL certificate) point to the fact that, barring an exploit and a very (to put it lightly) relaxed system administrator at chessmoba, this would definitely require cooperation from the operators of mangaowl and chessmoba.

Moreso there is evidence of referrer spoofing, and the presence of chessmoba’s google tag manager account IDs on the fraudulent reader page signals that chessmoba is 100% in on it. Another tidbit that shows intent is the fact that the script that updates the URL to the advertiser friendly one removes itself after 500 milliseconds.

-Antonio Torres, CTO & Co-Founder @ deepsee.io

For anyone interested, he also did a breakdown of the code which manipulates the URL that advertisers would detect.

As you may recall from the video, this reader code is recycled across all of the content sites that show manga, further confirming the shared purpose / ownership assigned to each. You can take a “reader/reader/” link from chessmoba.us, replace the host with mostraveller.com, or fromyourinside.com, and the link still works the exact same way. Essentially, the content sites are interchangeable; just fancy fronts for the advertising business of MangaOwl.

The anime video laundering fronts aren’t as interchangeable, but work in basically the same way to obfuscate the source of traffic. For example:

Piracy is the Primary Reason Anyone Ends Up On These Content Sites

Using publicly available information, such as Alexa traffic flows, we can confirm that over 50% of visits to these content sites are precipitated by a visit to one of the MangaOwl sites.

For example, take chessmoba.us’ traffic flow:

Or, take the mostraveller.com flow:

This exercise can be repeated ad-nauseam for each of the content sites we list, but we don’t want to bloat the page. Suffice it to say, 50% is a conservative estimate of how much traffic is spoofed to each of these sites. We project the number is closer to 80-100% depending on the site.

Conclusion

This novel approach to impression laundering is only made possible by shared management between the content sites and the pirate sites. It succeeds, because:

1. The URLs that advertisers & verification services detect takes you to a real content page, with a completely “safe” look & feel.
2. The pirate sites don’t have any advertising on them; they were very careful to keep the advertising aspect of the business separate from the pirated content indexing.
   • This means there is no chance for advertisers, or any ad-tech org whose primary source of data comes from scripts appended to ad creatives, to leverage user cookies to detect that a user was on MangaOwl before they went to chessmoba.
   • Tools like Alexa are able to infer the traffic flow because they track users outside of the context of advertising.
3. Users get a clean browsing experience, and don’t really have a reason to complain. For this same reason, the site doesn’t set off malware / maladverising flags.

Based on this research, and using our robust historical data on how sites relate to each other, we have developed the tools to flag such sites dynamically as they appear. If you are looking for an audit of your media spend, don’t hesitate to reach out! We are happy to look over delivery reports with you, and point out any risky patterns & publishers.

If you would like to continue the conversation, or if you have any questions that are not covered here, please reach out to us on Twitter, or on LinkedIn.

To quote their product page, Peer39 is “[t]he industry’s largest and most accurate pre-bid contextual category library to find the most relevant, suitable, safe, and quality inventory to target,” and we are super excited to be a part of that!

The benefit to us, and to you readers out there, is that Peer39 is already integrated into many of the worlds leading ad-buying platforms!

To that marketplace, we are adding the following lists which can be positively or negatively targeted (we detail the intended purpose in the Purpose column):

Today you can find our targeting options in Xandr, and soon they’ll be available wherever Peer39 is available. Until the end of the year, we are making these options available at the price of $.11 CPM (cost for a thousand impressions), which is extremely competitive for this space!

Our goal, as it has always been, is to show buyers just how much better their campaigns can perform when advertising on sites with great user experiences. This integration makes it easier then ever to do just that!

Please reach out to us at hello@deepsee.io with any questions, or visit our socials:
Twitter: @deepsee_io
Linkedin: linkedin.com/company/deepseeio

Table of Contents:

• • Introduction to Ad Arbitrage
  • A Layman’s Approach to Identifying Arbitrage Sites
  • How Does One End Up Visiting An Arbitrage Site?
    
    • Checking the Inbound Link Profile
    • Analyzing Inbound Traffic Channels
  • Two Tales of One Website
    
    • Why Show Two Formats? Why Not Just Embrace the Slideshow?
  • Scaling Our Insights With Data
    
    • Page Activity Levels – Direct Link vs Paid
    • Ads Units Above The Fold – Direct Link vs Paid
    • Ads Units on Page – Direct Link vs Paid
  • Conclusion
    

Introduction to Ad Arbitrage

Ad arbitrage is the practice of buying web traffic, then selling ad space on your website for more than you paid to acquire the user. It’s not a new practice, not by any means, but we’ve detected a new strategy used to keep it profitable.

Many doubt that arbitrage is still a lucrative strategy; take this poster on BlackHatWorld (a forum for marketers to share how they game the system to make $$$):

In short: yes they still do it. You need significant volume to make it work, and the tools have changed a little bit from days past, but it still is happening at a staggering scale. In this article, we focus on arbitrage which starts from native ads placements, aka sponsored content boxes.

If you’re not familiar with the term, you’re probably familiar with the look of these placements (highlighted red below):

When buying traffic from native ads providers with the intention of performing ad arbitrage, the key factors you have to optimize are:

1. CPC (cost-per-click) when acquiring a visitor
   • This goes down as CTR (Click-through rate) increases, because people buying space in these boxes pay on a per-impression basis.
   • There are tons of levers to pull here, including:
     • the geos you target
     • the sites your ads show up on
     • the user’s device make/model
     • the keywords you target
     • your creative / destination article headline
     • much more!
2. RPM (revenue-per-thousand-impressions), or how much you make from your visitors
   • Someone focused on long-term stability might focus on organic user growth by writing unique & helpful content.
     • The more return users you have, the more predictable your revenues will be
     • Reputable content providers get access to better affiliate deals, and private programmatic marketplace opportunities
   • Someone focused on getting as much money as possible from a user who arrives on their site might:
     • Add more ad units, increasing the clutter of the page
       • Particularly, adding a bunch of placements above the fold guarantees you will have coveted viewable placements that you can charge for.
     • Paginate the content so that users are always triggering new page loads, and digital ad auctions. Paginated content is also known as “Slideshow” content.
     • Put ad placements on an aggressive refresh schedule.

In this article we seek to educate the reader on the lengths these publishers go to milk readers for revenue, but we also want to answer a question that’s been tumbling around in our heads while writing: is the activity we are profiling even of concern to advertisers?

Anyone who claims that content quality correlates with campaign performance will be skeptical of arbitrage sites, and has probably already added such sites to their domain block list. However, there are many marketers who still prefer to buy inventory on these sites. After all, the arbitrage sites won’t make money if their users are found to be fakes; they specialize in bringing real humans to their sites with eye-catching headlines & common-denominator content.

The real question is: do advertisers get a good value for their ad-dollars when they buy space on these sites? We’d love to hear your answer to this after reading.

A Layman’s Approach to Identifying Arbitrage Sites

Arbitrage practitioners tend to choose some niche, or vertical, and design their site around that. It’s important to note that the content on these sites is often non-unique, and shared between any number of other sites. Because of this, the content rarely lines up with what you’d expect from the name of the site.

Take the site parentingfactor[.]com for instance:

This is the landing page, and you can see that they are trying to cultivate the image of being a source for family / parenting content. However, the links that are promoted do not necessarily meet that mold.

The top promoted link for this site that we detected in June led users to the following page:

There are quite a few alarming things about this image, but before we deep dive into that, lets reflect on the content a bit.

We grabbed a couple random lines of text from the article above, and plugged them into Google:

It seems affluenttimes[.]com has an article sharing the same exact text.

It seems magellantimes[.]com ALSO has an article sharing the same exact text.

Lets take a look at the design for those sites:

As we can see, the sites header has the exact same font. It may be too small for you to see, but the articles even share the same author: David Rule.

Confirming what we can tell for ourselves based on the design & authorship, the footer of these sites shows they all share the same corporate owner.

Arbitrage sites tend to be created & managed this way; the owners either diversify their portfolio by creating site templates for a variety of verticals (which really share a lot of content between each other), or they specialize in a certain vertical that gets a lot of attention, like: pets, fitness, finance, pop-culture, etc…

How Does One End Up Visiting An Arbitrage Site?

Unless you just woke up with a burning desire to find out why Lily from the AT&T ads is causing a stir, chances are you clicked an ad in a sponsored content box, or on a social media platform.

It used to be that arbitrage experts would accomplish the whole feat using Google products. In the before times, one could cost-effectively buy traffic using the AdWords PPC advertising platform, and direct users to your blog monetized with AdSense. These days, not so much. The GoogleAds destination requirements state that “Destination content that is designed for the primary purpose of showing ads” is forbidden.

ibmjango, another user of BlackHatWorld describes the process fairly succinctly:

There are some key statements here that are relevant to the rest of the article that we want to reiterate:

This will be confirmed later based on our own research, and insights from Similarweb.

The sites we are exploring today are being monetized by many different platforms/networks. This isn’t a small-potatoes blog site; we’re talking billions of avails per-day across hundreds of well-ranked arbitrage sites.

Having a content format that exploits every available inch of space for advertising is key to bringing up revenue-per-page. This strategy is tried and true, but off-putting to SSPs (Supply-Side Platforms; publishers apply to these platforms to get access to programmatic demand).

It’s common for these sites to have articles on the front page that have a single-page format, and few ad placements. This gives the illusion of quality, while the most clicked links are actually stuffed to the gills with ad units that refresh aggressively (more on this later).

Let’s test these claims with the example family of sites we have identified: parentingfactor[.]com, magellantimes[.]com, and affluenttimes[.]com; there’s a couple ways we can go about determining how users are ending up there.

Checking the Inbound Link Profile

Using data from our crawlers, we checked for any sites that loaded a link to these 3 domains, and checked if those links were from paid sponsored content placements belonging to Revcontent, Taboola, or Outbrain:

We can see that there are hundreds of inbound links for each site that we’ve discovered in just the past month, but almost 100% of them are from sponsored content boxes. That is to say, they have no real reputational authority.

Another way to go about this would be to analyze the referral values for all the users visiting these sites.

Analyzing Inbound Traffic Channels

Since we don’t base our insights on user-generated data at DeepSee, we sometimes turn to Similarweb for second opinions on these matters.

Echoing our own analysis, Similarweb shows the vast majority of parentingfactor[.]com’s traffic comes from display ads. Let’s see how it looks for the other two as well:

Further solidifying the point that ibmjango of BlackHatWorld made, we can see that all 3 sites rely heavily on paid display, and social traffic. Similarweb doesn’t separate out paid social from organic in this chart, but judging by the extremely high rate of paid display, it’s not a far leap to assume that the social is paid as well.

This is extremely relevant, because our research shows that many arbitrage sites behave VERY differently when accessed via paid link vs directly.

Two Tales of One Website

Now we get to the core of the “Misleading Content Formats” issue that we warn about in the title. Believe it or not, the image above shows the same page on the same site; the image on the left is what you’d see if you visited directly, and the one on the right is how it looks when visiting via paid link.

On the left we see zero ads above the fold, on the right, there are 6 display ads plainly visible, with an out-stream video placement out of view of my screenshot. It’s not clearly visible in the image, but the paid page is actually a slideshow (compared to the direct link, which is single-page format).

Let’s recall something we mentioned in the intro:

• Someone focused on getting as much money from a user as soon as they arrive on their site might:
  • Add more ad units, increasing the clutter of the page 
    • Particularly, adding a bunch of placements above the fold guarantees you will have coveted viewable placements that you can charge for.
  • Paginate the content so that users are always triggering new page loads, and digital ad auctions. Paginated content is also known as “Slideshow” content. 
  • Put ad placements on an aggressive refresh schedule.

We know the paid version of the site has way more ad units, and paginated content, but it’s not clear from the image if there is an aggressive refresh schedule. We can clear that up with the following video, which shows the different ways this site presents content:

To summarize:

• We saw ~30 second refresh timing on the slideshow ad placements.
  • Not particularly aggressive, but still, refresh on slideshows seems entirely unnecessary
    • Slideshow readers are expected to click to a page every 30 secs to 1 minute, and adding refresh on top of that is just another way to milk ~10 ad loads out of a user in between slide clicks.
  • This isn’t captured in the video, but out-of-view placements did not refresh on the single-page style version of the site.
• The single page format had 1-2 ads per content block, while the slideshow format has 10+ placements per content block

This video shows a single site, but the pattern is typical of SO many more sites.

Why Show Two Formats? Why Not Just Embrace the Slideshow?

This is a tough question to answer, and we’re going to venture into the realm of educated guesswork here while trying to answer.

There are certainly many sites which are upfront about their slideshow content, and manage to monetize it to some extent. Why hide the format that your content predominantly appears in?

Think back to what our spirit guide, ibmjango, says:

As we mentioned earlier, slideshow content can be off-putting to SSPs, because their reputation is staked on the quality of their publisher network. Having content that makes SSPs uneasy limits the amount of demand you can get access to. For modern arbitrage operations to work, they need access to multiple SSPs / ad-networks, and perhaps this is the reason we find so many sites with a disconnect between direct & paid visits.

As part of the onboarding process at each SSP, there is likely to be a human reviewing the sites of each publisher who applies. While each SSP has different publisher requirements, it hardly seems a stretch to imagine that reputable SSPs don’t want sites with slideshows that are 80% ads / 20% content.

So, in order to protect themselves, the arbitrage specialists design sites in such a way that advertising analysts who click around their home page wouldn’t find anything objectionable.

Once they do make it into a reputable ad-network, that’s when the problems begin. We spoke off the record to someone responsible for ensuring publisher quality at a major SSP, and they told us “that’s the problem we have; it’s not straight fraud, and there’s a huge demand for this inventory.”

This is confirmed by a contact of ours on the demand side, who described the inventory as “crack for advertisers” due to the high viewability, and the high availability of inventory (due to the inflated placement count per-page).

Thus back to our initial question: do advertisers get a good value for their ad-dollars when they buy space on these sites?

One might venture a guess to say these ones did not:

Scaling Our Insights With Data

The following research is based on analysis of 111 domains with Misleading Content Formats we discovered during the last week in June (available here). To arrive at this sample, we visited thousands of sites who had high representation in sponsored content boxes, and compared how they performed based on if the visit was direct vs paid. This comparison included a lot of manual verification while we built the capability for automated detection.

While many sites buy most of their visitors from sponsored content boxes, it is unique for a site to completely transform their layout, and this is the activity we highlight in this study. That’s how we ultimately arrived at this sample; these sites, of all the sites buying visitors for arbitrage purposes, showed anomalous behavior when visited by direct visit vs sponsored content box.

You may notice the list of publishers we provide is over 111 items; this is because we discovered additional sites in the same publishing groups as Misleading Content Format sites by carefully analyzing ads.txt & sellers.json records. In order to give you maximum protection, we proactively flag these sites.

For the purpose of this article, we compared three things:

1. The activity level of the page; this is approximated by the count of document, script, and XHR requests intercepted.
2. Ad units above the fold
3. Ad units on page

Many thanks to data scientist Edward Krueger, who assisted us with visualizations and statistical analysis for this research.

Page Activity Levels – Direct Link vs Paid

This chart shows how much more busy these sites are when accessed from the sponsored content box vs loaded directly.

Simple but effective, the takeaway is pretty clear from this bar chart: we can see that paid visits are over twice as active on average!

Ads Units Above The Fold – Direct Link vs Paid

Ad units that are “above the fold” are visible right when you land on a page. These are coveted, because they tend to be marked viewable by the measurement tech most advertisers employ, and this gives advertisers more confidence the ads were seen.

Right away, we can see there is a stark difference in the median number of ad placements above the fold here. Remember, we are talking about the same exact sites & pages here; the only difference is how the user arrives.

This violin plot is another way to visualize the typical number of ads above the fold for direct vs paid visitors. The fat bottom of the “Direct” plot shows that many sites in this group never display ads above the fold. It’s clear that much of the “Paid” figure’s area lies at 2 or above, with a big bulge around 4 ad units. These are completely different shapes.

Ads Units on Page – Direct Link vs Paid

Similar to the last chart, this one shows the difference in the total number of ad units encountered per-page.

The maximum figure here is especially interesting, because it shows the difference in limitations between single page and slideshow design formats. The single page format can go on forever hypothetically, and so the upward bounds of ad units per page are higher. On a slide, where most of the content is above the fold, there’s only so many ad units you can cram into the page before it fills up.

While the differences visible in the violin chart here are not quite as stark as the same visualization for “above the fold” ad units, there is a clear takeaway: the paid visits result in many more ad units loading on the page. The higher maximum value in the “Direct” plot shows that there are exceptions to the previous statement, but they appear as outliers.

Conclusion

Publishers with Misleading Content Formats straddle the line between valid & invalid activity. Unlike GoogleAds, sending visitors to “[d]estination content that is designed for the primary purpose of showing ads” is not forbidden by the tech companies providing these sponsored content boxes.

In this situation, any violations that exist likely occur between the publisher and the SSPs / ad-networks they are a part of. Such organizations may have specific publisher content requirements that forbid the behaviors displayed by the hidden, hyper-active, versions of these sites.

Now, having made it to the end of the article, do you think advertisers get a good value for their ad-dollars when they buy space on these sites?

Is there something we’re missing here? Feel we are off base? Please keep the conversation going, and drop us a line on twitter @deepsee_io, or on Linkedin!