"404 Bot": IAS Identifies New Ad Fraud Threat
Integral Ad Sciences, a technology provider specializing in ad verification, is warning of the growing threat posed by the so-called «404 Bot.» This is a rapidly growing form of bot fraud that specifically generates fake browser data and creates fake URLs to siphon off advertisers’ media spend without providing any value in return.

To do this, the 404 bot uses unverified Ads.txt files - the very tool that is supposed to help ad buyers avoid fraudulent ad sellers and prevent the unauthorized sale of ad inventory. The 404 bot has already been able to bypass many preventative techniques and ensure that the fake URLs fall off the radar. Thus, this new bot scam once again demonstrates how sophisticated the latest ad fraud techniques are constantly evolving - and in doing so, also undermining industry-created security methods. To date, approximately 1.5 billion video ads have been affected by the 404 bot. IAS estimates that it has already cost the industry more than $15 million - and counting.
The 404 bot has already attacked quite a number of publisher domains. Many of them have one thing in particular in common: long Ads.txt lists. In response to the rise of fake ad inventory, the IAB Technology Lab launched the Authorized Digital Sellers initiative, known as Ads.txt, a few years ago to increase transparency of inventory flow in the online advertising ecosystem. With success, past implementation of Ads.txt by publishers has resulted in a dramatic decrease in fraud. However, for some time now, unchecked Ads.txt files that are no longer up to date have been causing an increase in ad fraud.
Continuous testing and updating required
"The 404 bot has been active since 2018. Its uncontrolled growth requires industry action," said Evgeny Shmelkov, head of the IAS Threat Lab. "Publishers have done a great job implementing Ads.txt. But this new bot shows us one thing above all: for successful ad fraud defense, it is crucial to continuously check and update Ads.txt files."
"Combating ad fraud is a constant arms race," said Oliver Hülse, Managing Director CEE at IAS. "Fraudsters' methods are becoming increasingly sophisticated and new bot networks are emerging almost daily to scam advertisers' advertising budgets. The 404 bot is a particularly sophisticated candidate that uses unverified Ads.txt files to its advantage. Stamping out this dangerous scam must therefore be part of the collective task of all members of the digital ecosystem."
Domain spoofing
Similar to 3eve and Hyphbot, the 404 bot relies on extensive domain spoofing, where URLs are faked at the browser level. This means that the data from the browsers is also faked. To avoid the vulnerabilities pointed out by previous bots, the 404 bot ensures that the spoofed URLs are difficult for the human eye to detect.
Although the IAS Threat Lab regularly detects bots, IAS refrains from publishing details for each discovery to avoid unnecessary panic in the ecosystem. However, since there is no indication that 404 bots will be shut down for good, the Threat Lab will publish its research findings in the future to allow the industry to clean up its act.



















