3ve’s operators clearly understood the value marketers place on premium publisher content and audiences. The operation’s two core monetization strategies were based on spoofing premium content in programmatic advertising environments and selling fake traffic to legitimate sites through intermediaries. The resulting impact from 3ve on publishers was lost revenue opportunity, potential damage to brand reputation through association with fraudulent site traffic, and ultimately the depreciation of core inventory value.
All told, 3ve impacted over 60,000 seller accounts in its lifespan, either by directing fake traffic to established websites, selling fraudulent traffic through seller networks or counterfeiting content from prestigious publishers in RTB environments. While 3ve’s traffic selling efforts cast a wide net on effected ad inventory given the variety of advertising found on any individual publisher’s site, its exploits in programmatic environments were more concentrated, disproportionately spoofing over 10,000 domains - most of which were premium video content.
Key Recommendations for Publishers after 3ve:
Adopt Ads.txt. A snapshot of 3ve traffic showed that over 80% of the bid requests it generated were unauthorized (meaning sellers who were not listed as authorized sellers in a domain’s ads.txt file). Even with aggressive adoption of ads.txt, vigilant oversight and enforcement from publishers is required. Though not evident in 3ve, instances of ads.txt manipulation are slowly beginning to emerge as fraudsters find ways to innovate around authorized seller arrangements.
Scrutinize traffic acquisition sources more than you already do. All three of 3ve’s sub-operations made money by selling traffic. There are legitimate ways to bring real human audiences to your site, such as working with established social media or search platforms. But there are also companies selling visitors, engagements, clicks, or other forms of action for very low cost per transaction with absolute statements about quality. If the price and claims of audience purity ("100% human, viewable and brand safe audiences for very low cost per...") sound too good to be true, they probably are.
Partner with SSPs and DSPs that have dynamic, adaptive and comprehensive invalid traffic (IVT) prevention filters. Stringent inventory quality policies and monitoring are table stakes these days for any supply or demand side platform. Most have dedicated teams and processes designed to flag and filter across brand safety, viewability and IVT. But 3ve’s daily churning of up to 40,000 IPs every day and techniques for evading detection (including 3rd party tag suppression) were designed to trick the most sophisticated anomaly based detection systems. Staying in front of 3ve required real-time and adaptive counter detection measures to identify let alone prevent. DSP and SSP platforms with dynamic and adaptive IVT prevention filters in addition to anomaly based inventory quality controls will help ensure a more real-time removal of fraudulent traffic prior to auction fulfillment, thereby lowering the financial impact of fraud on legitimate publishers.