## 7 Fraud in Ad Ecosystem
### Categories of Ad Fraud
#### 7.1.1 Placement Fraud  
Placement fraud is a general category of fraud in which ingenuine ads or other related content are placed on a legitimate publisher's website (perhaps through malicious means such as misuse of certain HTML features) or on a site entirely set-up by a fraudster, with the ultimate aim to inflate the number of user-clicks and/or impressions on these ads. (Note that advertisement contents, including texts, pictures, and videos, are commonly posted on publishers' websites through an embedded iframe HTML-tag.) The five most significant mechanisms and strategies that can be used to facilitate placement fraud include Malvertising, Stuffing and Stacking, Fake Sites, Domain Spoofing and Ad Injection. 1. Malvertising: Malvertising is a form of placement fraud that is carried out by utilizing advertising malware that gets injected into a publisher's website, and that ends up displaying unwanted ads or pop-ups on the computers of users visiting this site. [PERSON] et al. [48] have pointed out that the common defects in the design of some website widgets pose a high risk of malvertising. Moreover, they have shown that Content Delivery Networks (CDNs)--as third-party ad servers which provide content to different domains on the Internet--are the primary means of spreading malvertising malware. By exploiting the servers of a particular CDN, attackers can inject malicious code in the form of malvertisement and achieve a broad distribution. 2. Stuffing and Stacking: Ad fraud techniques that make use of components which are placed inside a web page but cannot be viewed by the naked eye are called'stuffing' and'stacking. Stuffing fraud include two primary forms: keywords stuffing and placement stuffing. Keyword stuffing occurs when specific keywords are hidden in the HTML tags of a fraudster's web page with the intention to increase the value/ranking of this page and its respective ads. On the other hand, placement stuffing is the act of hiding non-textual (i.e., multi-media) components inside a web page, such as: an ad in a small 1 \(\times\) 1 pixel iframe (refer to Figure 4). Placement stacking is a fraud technique where two or more ads are placed/stacked on top of one other, with only the top ad being actually visible to the user [49]. A single impression or click on such stacked ads would enable the fraudster to bill multiple advertisers. 3. Fake Sites: Placement of ads on fake websites is another strategy commonly deployed by online fraudsters. Fake websites used for the purposes of ad fraud typically have one or more of the following features: * they use legitimate domain names but have no legitimate content except for the ad slots; * they contain legitimate looking content, which is simply copied from other well-known websites; * they deploy domain names that are look-alikes of some highly popular domains (this is also known as domain-name spoofing and is discussed next). Unfortunately, the high-quality appearance of these sites often makes it very difficult for ordinary users to recognize them as fraudulent. \begin{table}
\begin{tabular}{c c} \hline \hline
**Category** & **Subcategory** \\ \hline \multirow{4}{*}{Placement Fraud} & Malvertising \\  & Stuffing and Stacking \\  & Fake Sites \\  & Domain Spoofing \\  & Ad Injection and Malware \\ \hline \multirow{2}{*}{Traffic Fraud} & Impression Fraud \\  & Click Fraud \\ \hline \multirow{4}{*}{Action Fraud} & Conversion Fraud \\  & Re-targeting Fraud \\ \cline{1-1}  & Affiliate Fraud \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Ad Fraud Categories. Domain-name Spoofing: Domain-name spoofing is a general type of online fraud in which the fraudster deploys a (fake) domain-name that appears as a legitimate/whitelisted domain-name. There are several different ways of how domain-name spoofing can be utilized specifically for the purpose of ad fraud: (i) A low-quality publisher disguises its domain-name as the domain-name of another premium publisher in order to sell its inventory to advertisers at higher prices.