DoubleVerify Uncovers ‘SneakyTerra’ — the First SSAI Fraud Scheme to Hijack Real CTV Device Sessions

DoubleVerify (“DV”), a leading software platform for digital media measurement, data and analytics has uncovered the first server-side ad insertion (SSAI) scheme known to hijack real CTV device sessions. At its peak, the highly sophisticated scheme spoofed over 2 million devices each day and could have cost unprotected advertisers more than $5 million per month, based on an average $20 CPM across CTV.

Marketing Technology News: WEX Expands Presence In Europe With OMV Win

SneakyTerra operates by purchasing a real impression and then inserting impression trackers from multiple ads, obtained through spoofed SSAI calls, into one creative response. When an actual CTV device receives this response, pixels fire for all the impression trackers — meaning although only one ad is seen, impressions for multiple ads are generated.

DV Video Filtering, launched in November 2020, played a critical role in helping DV’s Fraud Lab detect and prevent SneakyTerra. With DV Video Filtering, the Fraud Lab could see SneakyTerra’s spoofed SSAI transactions before the fraudsters were able to execute their impression on a real CTV device.

SneakyTerra marks an important evolution in CTV fraud. This scheme is far more sophisticated than other large schemes, such as LeoTerra/StreamScam and ParrotTerra, which DV’s Fraud Lab first identified and began blocking in July 2020 and December 2020, respectively.

The use of purchased impressions — stuffed with multiple fake ads that will never be seen by a real person — makes SneakyTerra more difficult to detect. Ad servers and measurement vendors get real data on where the ad served, rather than spoofed SSAI data, because SneakyTerra’s stuffed impressions serve on real devices.

Marketing Technology News: Latest in Content Advertising: No more Facebook News for Australian Users

“Fraud follows the money, and the revenue opportunities in CTV are growing rapidly,” said Mark Zagorski, Chief Executive Officer at DV. “In 2020 alone, DoubleVerify identified more than 10 SSAI schemes, and we’re seeing fraudsters execute increasingly sophisticated, larger schemes meant to divert more revenue from unprotected advertisers. Trusted, independent measurement is critical in the CTV space to give global brands confidence in their CTV buys.”

DV’s Fraud Lab — powered by a dedicated team of data scientists, mathematicians and analysts — performs ongoing detection and analysis of new types of digital ad fraud in order to uncover the latest schemes as they occur. Through continuous analysis, scenario management and research, the Fraud Lab pinpoints the sites, apps and devices responsible for fraudulent activity and updates protection for DV clients in real-time.

Video Filtering is an industry-first solution that evaluates video impression opportunities against fraud, brand safety and geo rules. If an opportunity is compliant, DV returns the standard DV Omnitag response, and the ad loads. If an opportunity is not compliant, DV returns a blank Omnitag response, which filters non-compliant traffic and allows the publisher to remonetize the impressions. Video Filtering provides a last line of defense for advertisers in video environments, such as CTV, where blocking fraudulent, non-brand safe or non-brand suitable and out-of-geo impressions requires a technology standard called VPAID — which is not widely available across video and is not supported in CTV.

Marketing Technology News: Leaders in the Profession Identify Skills Financial Planners Need to Succeed in Today’s Environment