What is domain spoofing and how does it work?

For an advertising campaign to be successful, advertisers need to ensure that their ad budget is used in the best possible way and reaches as many real people as possible. But fraudsters are lurking everywhere, and so there are a variety of players who want to skim off some of the ad budget.

One fraud technique that has been popular for years is so-called “domain spoofing”. In the following article, you will learn exactly what it is, what different forms it takes, and how you as an advertiser can protect your ad budget from it.

What is domain spoofing and how does it work?

Domain spoofing is a widespread technique used by fraudsters to siphon off ad budget. It involves creating low-quality websites that pretend to be well-known websites and are often an exact copy of them. At first glance, the fake website is very difficult to distinguish from the original.

Fraudsters submit the fake websites to various advertising networks, pass them off as premium inventory and include display and video ads on them. Then, they use bot traffic that interacts with the ads to eventually receive a payout.

The approach sounds simple and effective, and it is. Advertisers pay for this supposed premium traffic, but never see a conversion or the hoped-for branding effects.

There are many reasons why domain spoofing is used:

• To commit ad fraud through low-quality or automated bot traffic
• To disguise the origin of traffic if the website has illegal or unwanted content
• To commit phishing
• To spread malware / spyware
• To steal personal information

What are the different types of domain spoofing?

Domain spoofing can be divided into simple and more complex methods.

Simple domain spoofing methods involve spoofing websites by copying them 1:1 and making them available under a new domain.
More complex methods include spoofing an email address, spreading malware through a website, or stealing personal information.

Website / URL Spoofing

The simplest type of domain spoofing. Fraudsters submit a URL of a real, high-value publisher to the ad server. Advertisers think their ad was served on a real website like forbes.com, but in reality the ad was served on a fake website.

Another way fraudsters can mimic a legitimate website is by using Unicode characters in the domain. Unicode is an international standard for character encoding that provides a unique number for each character in all languages and scripts, making almost all characters accessible across platforms, programs and devices.
For example, the letter “h” is virtually indistinguishable from the Unicode character “һ” (Shha in Unicode). Fraudsters take advantage of this and register domains for their fake websites that resemble the domain name of legitimate websites.

A list of visually similar Unicode characters can be found here.

Cross-domain embedding

This method makes use of iFrames. An iFrame is an HTML element that can be used to embed external content into a website. This content can be e.g. images or videos, but it can also be used to embed entire websites into other websites.

By embedding a high-value website in an iFrame into a fake website, it can look to advertisers as if their ads were served on the higher-value website.

Malware

With the help of infected apps or browser extensions, fraudsters can insert ads into websites and apps without the user’s knowledge.

The way it works is very simple: when a user opens an infected app, invisible advertising banners are loaded in the background, which are then clicked on automatically. Every click on an ad earns the fraudsters money.

One fraud based on this principle was Zacinlo. Among other things, the malware performed fraudulent browser redirects, created fake clicks on online ads in hidden browser windows, and also swapped ads that loaded naturally in the victim’s browser with the attackers’ ads so that they could collect the ad revenue.