Integral Ad Science (IAS), the global leader in digital ad verification, today announced a threat alert on 404bot, a growing bot scheme generating fake browser data and creating fabricated URLs in order to steal advertisers’ media spend. The 404bot capitalizes on unaudited Ads.txt files, the very tool created to help ad buyers avoid illegitimate sellers and prevent unauthorized inventory sales from happening. A sign of the continually growing sophistication of ad fraud, the 404bot scheme was able to bypass many preventative techniques and ensured spoofed URLs would slip under the radar.
The 404bot has affected a range of publishers domains, both high and low profile, many of which have one thing in common: large Ads.txt lists. In recent years, in response to a rise in counterfeit ad inventory, the IAB Technology Lab started the Authorized Digital Sellers initiative, known as Ads.txt. to increase the transparency of inventory flow in the online advertising ecosystem. The implementation of Ads.txt by publishers thus far has shown a dramatic decline in bad actors being able to abuse the ecosystem, but fraudsters are constantly evolving and are now capitalizing on unaudited Ads.txt files.
“We detect bots and protect our customers from their effects every day. The 404bot has been active since 2018 and its unchecked growth now warrants industry action,” said Evgeny Shmelkov, Head of the IAS Threat Lab. “Publishers have done an excellent job in implementing Ads.txt but what we are learning from this bot is that it is crucial to continuously audit and update Ads.txt files.”
Similar to 3ve and Hyphbot, the main signature of the 404bot is extensive domain spoofing, where URLs are spoofed at the browser level – meaning that the data from the browsers are faked. To avoid the vulnerabilities exhibited by past bots, the 404bot ensured their spoofed URLs would not be easily detectable to the human eye, allowing the bot to slip under the radar.
The IAS Threat Lab detects bots regularly and ensures that clients are protected from their effects. In order to reduce unnecessary panic in the ecosystem, IAS refrains from releasing details for every discovery. But with no sign of 404bot shutting down for good, the IAS Threat Lab is sharing its findings to allow other players in the ad-tech ecosystem the opportunity to clean up their inventories.
IAS has estimated the 404bot is responsible for costing the industry over $15 million dollars – a number that continues to grow – and has affected over 1.5 billion video ads.
IAS will continue to work closely with publishers and the IAB Tech Lab to improve the Ads.txt model to limit their susceptibility to fraud attacks like the 404bot.
ABOUT IAS
Integral Ad Science (IAS) is the global leader in digital ad verification, offering technologies that drive high-quality advertising media. IAS equips advertisers and publishers with both the insight and technology to protect their advertising investments from fraud and unsafe environments as well as to capture consumer attention, and drive business outcomes. Founded in 2009, IAS is headquartered in New York with global operations in 18 offices across 13 countries. IAS is part of the Vista Equity Partners portfolio of software companies. For more on how IAS is powering great impressions for top publishers and advertisers around the world, visit integralads.com.