How 404bot generates fake browser data and URLs to siphon away brands’ media spend

Even as advertisers have reportedly lost more than $23 billion globally to ad fraud in 2019, bots and click fraud continue to grow apace, threatening digital advertising. Integral Ad Science (IAS), a digital ad verification company, recently posted a threat alert on 404bot, a growing bot scheme generating fake browser data and creating fabricated URLs in order to steal advertisers’ media spend.

IAS said it is triggering industry action since the bot has been siphoning away brand money since 2018, and is showing “no clear signs of being shut down”. The agency has estimated the 404bot is responsible for costing the industry upwards of $15 million — a number that continues to grow and has affected over 1.5 billion video ads.

The bot involves a practice known as domain spoofing, in which a network of infected devices is used to generate billions of ad calls to fake URLs masquerading as legitimate businesses. Since the fake URLs do not actually exist, the scheme was dubbed 404bot, based on the 404 error message displayed when an internet page is not found.

Sophistication of fraud

Experts have termed it a sign of the continually growing sophistication of ad fraud, since the 404bot scheme was able to bypass many preventative techniques and ensured spoofed URLs would slip under the radar.

The 404bot bears similarities with other domain-spoofing operations such as 3ve and Hyphbot, and is the first significant bot scheme targeting Ads.txt files.

Interestingly, the 404bot capitalises on unaudited ads.txt files, the very tool created to help ad buyers avoid illegitimate sellers and prevent unauthorised inventory sales. The bot has been taking advantage of large unaudited ads.txt files, impacting billions of video advertisements and stealing millions of dollars from advertisers.

Sam Balsara, Chairman of Madison World, pointed out it is becoming extremely difficult to identify the different types of ad frauds that are prevalent in the digital realm. “While Click Spamming, which simulates a high number of clicks from real devices to get credit, and Coupon and Cashback fraud, where coupon and cashback sites publish ads of fake and fraudulent coupons and cashback offers in the name of advertisers, are very common in India, many advertisers have also lost huge sums to app fraud,” he said.

Balsara told BusinessLine it is time advertisers re-targeted optimisation. “Advertisers should avoid wasting their money on bots and invalid traffic by automatically blocking fraudulent users from re-targeting campaigns. They need to set custom thresholds,” he said.

He maintained it was high time advertisers and marketers “paid for performance and not just the clicks that are generated, since many of them could be fake”. “Marketers want outcomes, but it is necessary to design a performance incentive structure that is based on results. Advertisers should also do a thorough monitoring of all the metrics within the digital funnel — right from impression to final conversion and take action against any suspicious activity,” he added.

COMMENT NOW