Fraudsters block traffic quality scanners

About 5 months ago we published a post in our LinkedIn account where briefly described how fraudsters avoid the detection by popular traffic quality scanners, but this kind of fraud still exists in market.

The solution is quiet simple and unfortunatelly appeared to be working and now it’s widely spreaded.

Let’s start from the begning. Traffic scanners are head aches for fraudsters. A call to any traffic scanner code from banner technically always is a loading of a remote script from scanner’s webserver having specific know domain.

Fraudsters made a filter using DNS or proxy which blocks all requests to the domains of popular scanners. The code isn’t loaded, isn’t launched and the scanner got nothing for the impression.

And in this case a SSP-manager sees thousands of impressions delivered, zero impressions scanned and no alarms about high IVT received.

Mostly likely fraudsters use general users’ PCs as proxies to provide SSPs and DSPs a wide range clean IPs:

That sounds frightfuly simple but it works.

If a scanner bypass this block it may see the ugly truth: impressions happen on DigitalOcean servers (it’s not Proxy or VPN servers, it’s the device where impressions happens):

Real IP address	ISP
104.131.93.92	Digital Ocean
162.243.166.172	Digital Ocean
104.236.29.57	Digital Ocean
104.236.82.236	Digital Ocean
104.236.35.126	Digital Ocean
159.203.77.155	Digital Ocean
107.170.72.59	Digital Ocean
104.236.233.123	Digital Ocean
45.55.163.40	Digital Ocean
192.241.132.54	Digital Ocean
159.203.122.208	Digital Ocean
104.236.0.206	Digital Ocean
162.243.219.96	Digital Ocean
104.131.96.166	Digital Ocean
104.131.93.129	Digital Ocean
104.131.131.116	Digital Ocean
104.131.244.140	Digital Ocean

Also we’re sharing examples of publisher IDs mainly used in bid requests:

Publisher ID
1074847869
1058631328
1057583005
1014833134
1023553717
1063323060
1068179721
1008783157
1044380513
…

As you can see they have same similar format: a 10 digit length number with leading 1. But pay attention that any reseller in chain may set it’s own.

We recommend to check the discrepancies between the number of impressions you got and the number of scans performed by you traffic quality scanner.

Stay tuned and follow un on LinkedIn to stay up to date or drop us a line to email if you have any qustions.

Good luck!