Bot Traffic and Impression Fraud

The structural asymmetry, stated first because it governs everything

In a click dispute the advertiser holds one genuinely independent record: its own web server's request log, written on its own infrastructure at the moment a visitor arrived. In an impression dispute there is no equivalent. Nothing arrives at the advertiser when an ad is displayed. Everything the advertiser knows about impressions comes from the platform that sold them or from a measurement vendor's tag placed in the ad-serving path — both of which are third-party accounts of an event nobody on the buy side observed directly.

That asymmetry sets the shape of the work. Impression cases are built from records held by other people, obtained by production or subpoena, and reconciled against each other rather than against ground truth. It also explains why the proven cases here were made by the government with compulsory process, and why the honest ceiling on a buy-side analysis is lower than counsel usually expects when the matter opens.

What has been proven, and by whom

One operation has produced a jury conviction, and it is the right reference point for what proof here requires.

Aleksandr Zhukov was convicted by a jury in the U.S. District Court for the Eastern District of New York in May 2021 of wire fraud conspiracy, wire fraud, money laundering conspiracy and money laundering, and was sentenced on 10 November 2021 by U.S. District Judge Eric R. Komitee to ten years' imprisonment, with forfeiture of $3,827,493. In the Department of Justice's account, between September 2014 and December 2016 he operated a purported advertising network, rented more than 2,000 servers in commercial data centers, and programmed them "to simulate humans viewing ads on webpages." The bots spoofed the domains of more than 6,000 publishers; more than 765,000 IP addresses were leased; the loss to victim companies was stated as over $7 million.

The precision matters. The original indictment named eight defendants across two operations and described losses in the tens of millions; that aggregate is an allegation. The figures attaching to the convicted defendant are those described at sentencing and the ordered forfeiture. The case was made with rented-server records, leased address blocks and payment records — evidence obtained by grand jury process, not by analysis of an advertiser's account.

The technical record behind that case, and why it is worth reading

The published technical account is "The Hunt for 3ve," published by Google and White Ops (now HUMAN Security) in November 2018. It documents three sub-operations: data-center bots using compromised residential addresses and border gateway protocol hijacking; a malware botnet running an embedded browsing engine on infected residential machines; and data-center bots proxying through other data centers. At peak it describes up to 700,000 active desktop infections at any given time, over one million addresses drawn from residential botnet infections and corporate address space, more than 10,000 counterfeit domains, between three and twelve billion daily bid requests, and over 1,000 servers. The takedown involved Google, White Ops, the FBI and fifteen other industry parties, with infrastructure disruption completed within eighteen hours. The U.S. government published its own technical description as CISA alert TA18-331A.

Two cautions for anyone citing it. The white paper states no dollar loss figure; loss numbers circulating in trade coverage are not from it and should not be attributed to it. And the counterfeit-domain mechanism it describes — inventory sold under a publisher's name that the publisher never served — is the thing an expert is usually asked to look for in a civil matter, which makes the paper a useful description of the pattern even though it establishes nothing about any particular buy.

Proven, alleged, reported: keeping the three separate

Most of what is written about ad fraud draws on security-vendor research, which is legitimate evidence of something but is not evidence of what a press release says. Three categories, and a report should label every operation it names.

Alleged. Google LLC v. Does 1–25, No. 1:25-cv-04503-JPO (S.D.N.Y.), pleads Computer Fraud and Abuse Act claims under 18 U.S.C. § 1030(a)(4) and (a)(5)(A) and RICO under § 1962(c)–(d) against twenty-five unnamed defendants, alleging a botnet that infected more than ten million devices, generated hidden ads inside fraudulent apps, and sold access to infected devices as residential proxies. A temporary restraining order issued 30 May 2025 and a preliminary injunction on 27 June 2025. Everything in it has been tested only to the preliminary-injunction standard, against defendants who have not been named.

Reported. HyphBot, published by Adform on 22 November 2017, documented more than 34,000 spoofed domains across over a million URLs, more than half a million addresses, and 400 million to 1.5 billion ad requests daily at peak. Its estimated daily loss of $262,500 to $1,285,714 is unusually well disclosed: the paper gives the derivation as cost per thousand impressions multiplied by requests and fill rate, divided by a header-bidding factor, assuming $7 to $12 average CPM, 30% to 50% fill, and a seven to twelve times multiplier. That is an arithmetic model built on assumed inputs, not a measured loss. There was no prosecution and no named defendant. More recent vendor disclosures follow the pattern: HUMAN Security's SlopAds report of 16 September 2025 (224 Android apps, over 38 million downloads, peaking at 2.3 billion bid requests a day) and its Trapdoor report of 19 May 2026 (455 malicious apps, 183 threat-actor-owned domains, over 24 million downloads, 480 million daily bid requests at peak). In both the identified apps were removed from the app store; in neither was there a prosecution, an adjudication or a named defendant.

The line to hold: vendor research describes a mechanism and a scale the vendor observed. It does not establish that a particular advertiser bought that inventory, and it is not a finding of any tribunal.

The ANA programmatic transparency work, its methodology and its critics

The most-cited buy-side evidence about programmatic waste is the Association of National Advertisers' transparency series, and it is quoted far more often than it is described accurately.

The June 2023 "first look" analyzed log-level data — the detailed record of everything about an impression, obtained from the technology vendor — contributed by 21 member companies, covering $123 million of spend and 35.5 billion impressions between September 2022 and January 2023. Its headline was that as much as $20 billion of an $88 billion open-web programmatic market, about 23%, was waste recoverable as efficiency gains, with the average campaign running across 44,000 top-level domains and made-for-advertising sites taking 15% of spend.

It became a recurring benchmark. The Q1 2025 edition covered 39 participating marketers, 23 actively contributing log-level data, $242 million of spend and 41.9 billion impressions. The Q2 2025 release, dated 14 August 2025, reported $26.8 billion in global media value lost annually to inefficiency, made-for-advertising spend at a median of 0.8% but reaching 28.7% for some buyers, and active domains falling from 53,799 to 28,958.

Now the methodology, which decides how the figures can be used. The data are impression-level logs matched between demand-side platforms and ad-verification vendors; the cost waterfall is built from sequential calculations on averaged advertiser data; the benchmark reports medians rather than averages; and "TrueCPM" is cost per thousand impressions that are non-invalid, measurable and viewable, with the gap against headline CPM presented as optimization opportunity rather than fraud. Critically, the benchmark does not define made-for-advertising itself — it adopts a third-party vendor's classification.

The criticisms follow from that disclosure rather than from any published methodologist, and should be attributed that way. The ANA is the advertiser-side trade body and commissioned the work to support supply-path reform. Participants are self-selected among members willing to hand over log-level data, which skews toward the more transparency-motivated buyers. Made-for-advertising is a judgment about editorial quality and business model applied under undisclosed vendor criteria, and different classifiers produce materially different lists over the same inventory — which makes the movement in the ANA's own series, from 15% of spend in 2023 to 0.4% in Q1 2025, consistent with genuine buyer improvement, with a change in the classifier, with a change in participants, or with all three. And "waste" is not "fraud." The figure aggregates fee leakage, poor supply paths, low-quality inventory and non-transparent intermediation. Writing that 23% of programmatic spend is fraud misstates the source.

What can actually be reconstructed from the buy side

Where the records exist, four artifacts do the work.

• Log-level data from the demand-side platform, at impression level, with the domain or app, the exchange, the price paid, and the identifiers needed to match it to verification data. This is contractual with the platform and is frequently not available through the standard interface, so it should be requested by name and early.
• The verification vendor's determinations, where one was deployed. Vendors accredited by the Media Rating Council classify invalid traffic against the MRC standard and are subject to annual audit, which makes their output the more defensible artifact in a matter that has one.
• Supply-chain declarations — the IAB Tech Lab's ads.txt and sellers.json files, which let a buyer check whether the seller of an impression was authorized to sell it for the domain it claimed. These are voluntary specifications with uneven adoption, and non-adoption is not negligence; what they support is a narrower point about whether a specific supply path was declared.
• The domain and app lists actually delivered against, compared to the inclusion or exclusion lists the campaign was supposed to run on.

One platform-side category is worth naming separately, because it fits a competitor claim rather than a bot claim. Google's own enumerated categories of invalid traffic include "[i]mpressions meant to artificially lower an advertiser's clickthrough rate" — a documented acknowledgment that impressions can be served with the object of depressing an advertiser's click-through rate, and therefore its quality score and auction position, without anyone ever clicking.

What impression evidence does not settle

That an impression occurred. There is no advertiser-controlled record of one, so every figure originates with a counterparty or a vendor whose tag was in the serving path. Where log-level data was not retained, the question is not hard — it is unanswerable, and a report should say so.

Which of your impressions were affected. A published operation's list of counterfeit domains describes inventory the researchers observed. Connecting it to a particular buy requires matched impression-level records for that buy. Without them, the operation's existence is context, not causation.

That two vendors' numbers can be compared. Two MRC-accredited vendors measuring the same inventory routinely report different invalid-traffic rates, because accreditation certifies adherence to process standards rather than identical outputs.

That an industry rate applies to this campaign. Estimates in this field vary by an order of magnitude depending on who published them: verification vendors publish the largest figures and sell the remedy, platforms publish the smallest and are the parties charged with catching it. Where a figure is used at all, name the publisher and its interest in the same sentence.

Who operated the scheme. The one operation with a conviction behind it was established with server rental records, leased address blocks, payment records and international cooperation. Nothing in a buy-side log identifies a person, and an opinion that names one from domain and address data has traveled well past the record.

Frequently Asked Questions

Published 2026-08-12