Ads.txt files were supposed to help the ad industry stamp out fraud but instead, they’re increasingly a conduit for it.
The tool was launched three years ago by the IAB’s Tech Lab as a way for publishers to list all of the companies that are authorized to sell their ads. Essentially, the text file shows when an advertiser buys ads either directly from a publisher or an approved ad tech vendor as well as highlight those sites that do not use an ads.txt file or if inventory is being sold without a publisher’s approval.
In theory, ads.txt files help advertisers avoid illegitimate sellers who arbitrage inventory and spoof domains. The reality, however, is the files are also fertile ground for fraudsters. Since the ads.txt tool launched, fraudsters have exploited the fact that buyers don’t always check the lists with bots that generate fake browser data and create fabricated URLs in order to pilfer media spend. The latest example of this type of fraud is called the 404bot.
The 404bot is essentially domain spoofing, which is when fraudsters impersonate a publisher’s webpage. But with the 404bot, there is no inventory. Instead, there’s a 404 error page in place of the webpage spoofed. The inventory appears like a legitimate buy from an authorized seller when in fact there’s nothing.
Since the 404bot was first noticed by Integral Ad Science in 2018, it has pilfered more than $15 million in ad spend from 1.5 billion video ads sold by large and small publishers across the U.K., the U..S, Canada and Australia. It may not sound like much given the average individual fraudster makes between $5 million and $20 million dollars a year, but the implications of the 404bot go beyond headline figures.
The existence of the 404bot is symptomatic of how ads.txt lists are being used as a plaster to ward off the symptoms of fraud rather than to help heal the cause of it.
Publishers list ad tech vendors in their ads.txt files even when they no longer work with them because they want to avoid showing ad buyers that they rely on unauthorized resellers to drive demand for their inventory. Plus, the more authorized sellers a publisher has, the more money they can potentially generate. Advertisers, on the other hand, either don’t have the internal expertise to push publishers to audit their ads.txt lists or won’t because doing so could theoretically reduce the scale of buys they could make.
Meanwhile, ads.txt files continue to get longer and subsequently become easier places for fraudsters to hide. The longer the ads.txt list, the harder it is to audit for unauthorized sellers.
“I’ve seen ads.txt lists that have more than a thousand ad tech vendors on them,” said one media executive.
Indeed, the only link between all publishers that were impersonated by the bot was that they all had long lists of ad tech vendors in their ad.txts files, according to IAS. In fact, when the ad verification firm worked with publishers to vet the exchanges selling their impressions, instances of the 404bot “weren’t as rife,” said Victoria Chappell, vp of marketing for IAS across EMEA and APAC.
“We cannot provide a specific number to define a large number of resellers, but this discovery brings the question, are publishers vetting their resellers? If they are not, it will defeat the core purpose of ads.txt’s existence,” said Chappell.
The 404bot isn’t the first time ads.txt files have been hijacked by fraudsters. Bad actors have tried to worm their way on to publisher’s ads.txt files since the tool launched in 2017.
“These types of fraud are successful because they prey on the fact that companies selling and buying media aren’t set up properly to audit what’s being traded,” said Dan Larden, managing partner of product and partnerships at programmatic agency Infectious Media. “Programmatic advertisers need to be pushing ad tech vendors for more log-level data so that they can see where the wastage is on the media that’s being bought.”
How the new Web3 loyalty program at Starbucks will be a litmus test for the future of branded NFTs
Starting with a small group of members and employees, Starbucks will invite participants into “journeys” that allow them to collect NFTs and points that unlock new benefits and experiences.
As influencer marketing grows up, brands, agencies experiment with new content tools like bots
Influencer marketing is maturing as a business for many media firms, as they find ways to leverage creator content and gain new audiences.
No more newspaper ads: Why J.C. Penney is going digital-first this holiday season
As shoppers continue to shift to e-commerce, legacy retailer J.C. Penney is making its strategy digital-first to keep up.
SponsoredHow Comscore is simplifying pre- and post-campaign measurement for advertisers
Produced in partnership with Marketecture The following article provides highlights from an interview between Greg Dale, Comscore’s general manager of digital, and Mike Shields, co-founder of Marketecture. Register for free to watch more of the discussion and learn how advanced advertising measurement is providing advertisers access to the deep data they need across all platforms. […]
Confessions of a Super Smash Bros. tournament organizer on Nintendo’s lack of support for competitive gaming
Unlike other publishers such as Activision Blizzard and Riot Games, which have pumped millions of dollars into organizing and marketing esports leagues for their titles, Nintendo has never offered serious prize money for competitive Smash events.
How Yeti is marketing like a DTC brand on social media and in the outdoors
Known for being a brand of indestructible coolers, cups and increasingly lifestyle apparel, Yeti has been evolving from a wholesale company to one that markets more like a direct-to-consumer company as it experiments on platforms like TikTok, Pinterest and its own media properties.