ads.txt Verification
Cross-reference every bid request against the publisher’s ads.txt file to confirm that the selling entity is an authorized reseller. Reject impressions from unauthorized sellers immediately.
Fraud Type Guide
Domain Spoofing in Ad Fraud: How Fraudsters Fake Premium Inventory
Fraudsters misrepresent low-quality sites as premium publishers, tricking advertisers into paying premium CPMs for worthless placements.
What Is Domain Spoofing?
Quick answer: Domain spoofing is when fraudsters falsify the domain name in programmatic bid requests, making low-quality sites appear as premium publishers to charge higher CPMs.
Domain spoofing is an ad fraud technique in which bad actors falsify the domain information in programmatic bid requests, making low-quality or fraudulent websites appear to be premium publishers. Advertisers end up paying premium CPMs for inventory that is entirely worthless — their ads never appear on the sites they think they purchased.
The mechanism is straightforward: when an ad exchange receives a bid request, it includes the domain where the ad will supposedly be shown. Fraudsters manipulate this field, replacing the real (low-value) domain with a well-known publisher’s domain. Because the buying side trusts the declared domain, they bid aggressively — and the fraudster pockets the difference.
Why It Matters
- Falsified bid requests — The domain field in OpenRTB bid requests is altered to impersonate premium publishers, deceiving demand-side platforms and advertisers.
- Fake publisher domains — Fraudsters register look-alike domains or compromise legitimate sites to host fraudulent ad placements that appear credible.
- Premium CPM theft — Advertisers pay top-tier rates for inventory that delivers zero genuine impressions, draining budgets without any real audience reach.
Step by Step
How Domain Spoofing Works
Fraudsters exploit multiple weak points in the programmatic supply chain to disguise low-value inventory as premium placements.
- 1
Bid Request Manipulation
The fraudster modifies the domain field in the OpenRTB bid request, replacing the actual site URL with a premium publisher’s domain. DSPs see a reputable domain and bid accordingly.
- 2
Fake ads.txt Entries
Sophisticated fraudsters create counterfeit ads.txt files on spoofed domains or exploit misconfigured ads.txt records to appear as authorized sellers of premium inventory.
- 3
URL Substitution
Using techniques like cross-domain iframes, URL masking, or server-side redirects, the fraudster ensures the ad request appears to originate from a legitimate publisher page.
Detection Methods
How to Detect Domain Spoofing
No single check is sufficient. Effective detection requires layering multiple verification methods across the supply chain.
sellers.json Validation
Verify seller identities by checking the exchange’s sellers.json file. Confirm that the seller ID, domain, and entity name match the declared inventory source.
Supply Path Optimization
Map the full supply path from publisher to DSP. Eliminate unnecessary intermediaries and flag suspicious reseller chains that could be used to launder spoofed inventory.
Placement-Level Analysis
Analyse individual placements for anomalies: mismatched content categories, unusual traffic patterns, impossible viewability metrics, and inconsistencies between declared and actual page content.
How Opticks Helps
How Opticks Detects Domain Spoofing
Supply Chain Verification
Opticks automatically validates ads.txt and sellers.json records across every impression, flagging unauthorized sellers and mismatched domain declarations in real time.
Domain Integrity Analysis
Every placement is checked for domain-level anomalies: mismatched content signals, suspicious traffic fingerprints, and discrepancies between the declared URL and the actual rendering environment.
Behavioral Pattern Detection
Machine learning models analyse traffic patterns at the placement level, identifying statistical anomalies that indicate spoofed domains — before budget is wasted.
Frequently Asked Questions
Learn More
Related Resources
Blog
Domain Spoofing in Ad Fraud: What You Need to Know
A deep dive into how domain spoofing works, real-world examples, and practical steps advertisers can take to protect their programmatic budgets.
Read the articleGlossary
Ad Fraud Glossary: Domain Spoofing
Quick-reference definition of domain spoofing and related ad fraud terminology, including bid request manipulation, ads.txt, and supply path optimization.
View glossaryStop Paying for Spoofed Inventory
Detect domain spoofing and other ad fraud techniques across your programmatic campaigns. Start your free trial or talk to our team.
Start Free Trial
No credit card required