{"id":7838,"date":"2026-10-22T17:35:37","date_gmt":"2026-10-22T10:35:37","guid":{"rendered":"https:\/\/adtek.agency\/glossary\/domain-spoofing\/"},"modified":"2026-10-22T17:35:37","modified_gmt":"2026-10-22T10:35:37","slug":"domain-spoofing","status":"publish","type":"mona_glossary","link":"https:\/\/adtek.agency\/en\/glossary\/domain-spoofing\/","title":{"rendered":"Domain spoofing"},"content":{"rendered":"

Domain spoofing is a programmatic ad fraud scheme in which fraudsters pass off ad space on a junk site, or a site with no real readers, as ad space on a reputable website. The advertiser pays a premium publisher’s price for impressions that never appeared there.<\/p>\n

What is domain spoofing?<\/h2>\n

Spoofing means faking an identifier to gain trust. In advertising, the faked identifier is the domain (or app ID) declared in the bid request of an RTB<\/a> auction. Buyers use the domain to decide what to pay, so a fake domain pulls in real money.<\/p>\n

The Media Rating Council classifies “domain and app misrepresentation” as sophisticated invalid traffic (SIVT), covering app ID spoofing, domain laundering and falsified domain or site location (MRC, IVT Standards Addendum, June 2020<\/a>). Google Play also bans apps that misrepresent the package name being monetized or claim to run on a different operating system (Google Play Console Help, Ad Fraud, accessed October 2026<\/a>).<\/p>\n

How does domain spoofing work?<\/h2>\n
    \n
  1. Fraudsters build blank or scraped pages and send bots<\/a> to generate views.<\/li>\n
  2. When sending bid requests, they rewrite the domain field to the name of a major newspaper.<\/li>\n
  3. The DSP sees the premium name and pays a high CPM.<\/li>\n
  4. Real ads load on the fake pages, usually seen only by bots.<\/li>\n<\/ol>\n

    Two major cases: Methbot and 3ve<\/h2>\n

    Methbot ran from September 2014 to December 2016. The group rented more than 2,000 servers, had bots load real ads on blank pages, and claimed the pages belonged to more than 6,000 publishers, including The New York Times. Victim companies paid more than $7 million for ads no human ever saw. In November 2021, Aleksandr Zhukov was sentenced to 10 years in U.S. federal prison (U.S. Department of Justice, November 2021<\/a>).<\/p>\n

    3ve grew during 2017, and one of its branches alone was about the size of Methbot. At its peak, the operation controlled more than 1 million IPs, created more than 10,000 counterfeit domains and generated more than 3 billion bid requests a day. According to Google and White Ops, the goal was to make advertisers believe their ads had appeared on a reputable newspaper’s site (Google and White Ops, The Hunt for 3ve, November 2018<\/a>).<\/p>\n

    Warning signs<\/h2>\n