Invalid traffic and ad fraud: how an honest publisher stays protected

Ad fraud is not always committed by the site owner: quite often it merely passes through the house and leaves the bill in their name. Here is what invalid traffic means, why platforms look for it, and what you can do so your numbers survive a review.

What invalid traffic is

The industry calls it invalid traffic, or IVT, meaning any advertising activity that does not correspond to a real person with real interest in what is being shown. An impression served to an automated program, a click nobody meant to make, a page reloading itself in a tab nobody is looking at: none of that is any use to the advertiser and none of it should be paid for.

It helps to separate two words that get used interchangeably. Fraud implies intent: somebody builds a system to get paid for advertising nobody saw. Invalid traffic is the broad category, and it also covers the accidental. A clean site, run by honest people, always has some invalid traffic. The problem starts when the proportion draws attention.

General and sophisticated: two different problems

General invalid traffic, GIVT (General Invalid Traffic), is the kind identified with rules and lists: search engine bots, uptime monitors, declared crawlers, requests coming out of known data centres, browsers that announce themselves as automated. It does not hide. It is filtered out almost entirely before billing and is rarely a sign of anything bad.

The sophisticated kind, SIVT (Sophisticated Invalid Traffic), is built not to be caught. It imitates human behaviour: it moves the mouse, scrolls, waits before clicking, comes out of residential connections belonging to infected devices. It also covers ads stacked one behind another, one-pixel slots and domain spoofing, where someone sells inventory claiming it is yours. You do not catch this with a list, but by comparing behaviour.

Where it comes from when you never went looking

The question that comes up most is how this appears on a site whose owner has done nothing strange. The usual routes are fairly mundane:

• Crawlers and monitors you hired yourself: SEO tools, downtime checkers, screenshot services.
• Browser extensions installed by the user that open tabs or reload pages in the background.
• Aggregators and copies: sites that replicate your content and, with it, your ad tags.
• Traffic bought by a third party: an agency, a contractor or someone on the team who decided to «help» with a cheap visits campaign.
• Push notification and content recommendation networks of doubtful quality.
• Links from content farms that found you without you doing anything.

None of that requires bad faith from the publisher. Several of those routes only require not knowing, and one, buying traffic, usually starts with the best of intentions: reaching the minimum number of visits an ad network asks for.

Click spam and why it hurts even when you did not cause it

Click spam is the mass generation of clicks the user never consciously made. In the publisher world it almost never shows up as an attack: it shows up as unfortunate design (an ad glued to the «next» button), as clicks injected by extensions, or as a traffic partner who promised results and decided to manufacture them.

The damage is indirect, which is why it takes a while to become visible. Click-through rate goes up, conversions do not. The advertiser measures return per site, not per user, so the correction lands on your domain: the bid drops or they stop buying you. You get no warning: you see the CPM (cost per thousand impressions) sink and you do not know why.

Fraud does not always come through your door. Sometimes it just passes through the house and leaves the bill in your name.

How platforms detect it

No platform publishes its method, but the types of signal are well known: technical fingerprints (coherence between browser, system and screen, where the connection comes from), time patterns (flat traffic in the small hours, identical spikes every day at the same time), on-page behaviour and correlation across sites. When the same identifiers turn up on dozens of unrelated domains, a flag goes up.

On top of that sits the supply chain. The ads.txt file declares who is authorised to sell your inventory, and each intermediary's sellers.json declares who it represents: they let a buyer tell your domain apart from whoever claims to be your domain. Having them correct and up to date is the bare minimum; their absence is a negative signal in itself.

What happens once they detect it

The consequences come in stages. First the deduction: revenue already visible in the dashboard is adjusted downwards when the period closes, because invalidated impressions are not paid. Then payment is held while the account is reviewed. In serious cases, the account is closed and the balance goes back to the advertisers.

But that is not the expensive part. The expensive part is losing demand: buyers who put your domain on their exclusion list and stop bidding. That arrives with no notification and no appeal form, and it is not fixed next month. A domain with a questionable history takes time to attract premium demand again.

Warning signs in your own dashboards

You do not need a verification system to spot the obvious symptoms. With your analytics and your ad server you can already watch for:

• Session spikes with no editorial cause: you published nothing, nobody linked you, and traffic doubles.
• Near-total bounce, with sessions of a few seconds, across a large group of visits.
• A click-through rate that is impossible for a format that never produced one.
• Referring sites you have never heard of, or a suspicious volume of «direct» traffic with no campaign behind it.
• A flat hourly distribution: human traffic follows the country's clock, automated traffic does not.
• A country that was never your audience suddenly appearing near the top.
• A widening gap between the page views in your analytics and the ad requests in your server.

None of these signs proves anything on its own. Two or three together, sustained over several days, deserve that you stop and look before somebody else does.

Brand safety: advertisers buy where they appear, too

Brand safety is the set of controls an advertiser uses to keep its ad from running next to content that damages it: violence, disinformation, coverage of a disaster, an unmoderated comment thread. It is not fussiness: a large brand answers to its customers for the place where its logo shows up.

That is why it belongs here. Direct advertisers and fixed-CPM campaigns are negotiated by looking at the site: who writes it, what it talks about, what surrounds the ad and what traffic it receives. A domain suspected of invalid traffic does not get into those conversations however much volume it has. Traffic quality and brand safety are the two entry conditions for premium demand.

How to protect yourself

The realistic defence for an honest publisher is boring, and it works:

• Do not buy traffic to reach a minimum. It is the fastest and most common way to lose an account.
• If you ever buy promotion, make it identifiable advertising on serious platforms, with source reporting and the ability to stop it.
• Control who has access to your tags and your ad server, and review the third-party scripts sitting on the page.
• Keep ads.txt and sellers.json current, and remove from ads.txt the partners you no longer work with.
• Do not place ads where they get clicked by accident, do not ask for clicks, and do not reward interaction with advertising.
• Read the invalid traffic reports your monetisation partner gives you and ask when something does not add up.
• If you spot an anomaly, report it yourself first and document what you did: demonstrated good faith changes how a review ends.

At ADEQ we review the traffic of every site before taking it on and we keep reviewing it afterwards. Not out of distrust: it is what makes it possible to connect inventory to premium demand, to direct advertisers and to fixed-CPM campaigns through Header Bidding with SmartTag. An honest publisher does not need to defend against an accusation; they need their numbers to survive a close look.