Domain spoofing

Domain spoofing is a programmatic ad fraud scheme in which fraudsters pass off ad space on a junk site, or a site with no real readers, as ad space on a reputable website. The advertiser pays a premium publisher’s price for impressions that never appeared there.

What is domain spoofing?

Spoofing means faking an identifier to gain trust. In advertising, the faked identifier is the domain (or app ID) declared in the bid request of an RTB auction. Buyers use the domain to decide what to pay, so a fake domain pulls in real money.

The Media Rating Council classifies “domain and app misrepresentation” as sophisticated invalid traffic (SIVT), covering app ID spoofing, domain laundering and falsified domain or site location (MRC, IVT Standards Addendum, June 2020). Google Play also bans apps that misrepresent the package name being monetized or claim to run on a different operating system (Google Play Console Help, Ad Fraud, accessed October 2026).

How does domain spoofing work?

1. Fraudsters build blank or scraped pages and send bots to generate views.
2. When sending bid requests, they rewrite the domain field to the name of a major newspaper.
3. The DSP sees the premium name and pays a high CPM.
4. Real ads load on the fake pages, usually seen only by bots.

Two major cases: Methbot and 3ve

Methbot ran from September 2014 to December 2016. The group rented more than 2,000 servers, had bots load real ads on blank pages, and claimed the pages belonged to more than 6,000 publishers, including The New York Times. Victim companies paid more than $7 million for ads no human ever saw. In November 2021, Aleksandr Zhukov was sentenced to 10 years in U.S. federal prison (U.S. Department of Justice, November 2021).

3ve grew during 2017, and one of its branches alone was about the size of Methbot. At its peak, the operation controlled more than 1 million IPs, created more than 10,000 counterfeit domains and generated more than 3 billion bid requests a day. According to Google and White Ops, the goal was to make advertisers believe their ads had appeared on a reputable newspaper’s site (Google and White Ops, The Hunt for 3ve, November 2018).

Warning signs

• Placement reports show a major newspaper’s name, but the CPM is far below what that publisher charges for direct deals.
• Impressions on a domain far exceed any plausible readership for it.
• A seller in the chain is not listed in the domain’s ads.txt file.

How to prevent domain spoofing

The first layer is ads.txt and app-ads.txt. In early 2018, 80.3% of 3ve’s bid requests came from sellers not listed in ads.txt, so simply refusing unauthorized inventory blocks most of it. DV360 excludes unauthorized sellers by default for web, app and TV (Display & Video 360 Help, accessed October 2026).

Next, favor private marketplace (PMP) deals with publishers you know, use verification tools that measure in the browser, and check placement reports every week.

Hypothetical example: a campaign buys 5 million impressions at a CPM of 50,000 VND, or 250 million VND in total. If 10% of that inventory carries a spoofed domain, 25 million VND pays for ad space that does not exist.

How it differs from similar fraud types

All three belong to the web and programmatic branch of ad fraud.

Frequently asked questions

Is email domain spoofing the same thing?

Same name, different victim. Email spoofing fakes the sender’s domain to fool the recipient. Ad domain spoofing fakes the site’s domain to fool the ad buyer.

Does ads.txt end domain spoofing?

No. ads.txt cannot stop a dishonest platform from swapping a publisher ID for an authorized one before offering the impression. Authorized inventory still needs invalid traffic filtering (IAB Tech Lab, app-ads.txt 1.0, accessed October 2026).

If you want a second look at the inventory sources and placement reports of your display campaigns, you can talk to Adtek through our contact page.