Study: Top publishers like The New York Times and The Washington Post lose $3.5 million a day to domain spoofing

The findings are significant since that money could be going into the publishers’ coffers were it not for the fraudsters. Advertisers also see worse return on their ad spend when their ads run on mislabeled inventory, but if the advertiser is under the impression that their ads ran on a legit site, then it is the publisher’s reputation that takes a hit when the campaign fails to reach its goals.

The study builds on previous research by the Financial Times where the financial publisher found that 25 ad exchanges were misrepresenting access to its inventory. What the new study shows is that domain spoofing remains prevalent across the largest and most reputable publishers in the industry. The publishers are sharing their findings publicly to show the prevalence of domain spoofing and to promote ads.txt as a treatment for the problem.

“The scale in the study was pretty dramatic,” said Rich Caccappolo, chief operating officer at Daily Mail.

Ads.txt is an Interactive Advertising Bureau-backed text file that publishers host on their web servers to show the companies that have permission to sell their inventory. Since it centralizes each publisher’s list of authorized sellers, it makes it easier for publishers to compare their own data against reports from their tech vendors and advertiser partners. By comparing the discrepancies in these reports, a publisher can quickly find out which vendors are selling fake inventory with the publisher’s name attached to it.

Sara Badler, director of programmatic advertising at The New York Times, said the Times writes cease-and-desist letters at least once a week telling unscrupulous vendors to stop representing access to its site. The Times doesn’t allow any resellers on its ads.txt file, and it doesn’t sell video on the open exchange. Nonetheless, resellers continue to crop up and try to arbitrage its inventory.

Given that ad buyers are pouring money into video advertising and that video CPMs are much higher than display CPMs, it isn’t surprising that the hucksters targeted video.

The results widely varied by publisher, but on the high end, only one of every 400 video impressions listed on open exchanges was authentic, Goldstein said. For display, the most egregious case of domain spoofing occurred when one of every 23 impressions was legitimate. Goldstein wouldn’t share results for specific publishers because the results of the study were aggregated to protect the publishers involved.

The DSPs that publishers used to catch the spoofers were Google DoubleClick Bid Manager, Amobee and Quantcast. Pooja Kapoor, Google’s head of programmatic global strategy, said the DSPs and publishers involved in the study have discussed running another similar study next year to see if increased adoption of ads.txt reduces unauthorized selling, but no date has been set. Google, of course, helped ads.txt take off by rolling out ads.txt filters across its ad products, pressuring everyone else in the industry to follow suit.

Sources contacted for this story advocated for more ads.txt adoption across the digital media industry as a way to fight domain spoofing. The fraudsters aren’t going to disappear overnight, but restricting campaigns to run through authorized sellers should help advertisers reduce their exposure to junk inventory and send off their more money directly to premium publishers.

“It is not going to stop counterfeit inventory from being offered, but it can stop buyers from buying through those channels,” said Jason Tollestrup, director of programmatic advertising at The Washington Post.