Jessica Goodfellow
Sep 16, 2020

DoubleVerify shuts down million-dollar CTV and mobile fraud scheme

Fraud scheme, which was quashed in 50 days, was on track to steal an estimated US$1 million per month in connected-TV and mobile adspend.

DoubleVerify shuts down million-dollar CTV and mobile fraud scheme

DoubleVerify has quashed an "aggresive" connected TV and mobile fraud scheme that at its peak faked more than 3 million impressions a day and was on track to steal an estimated US$1 million per month in advertising inventory.

The botnet, called 'MultiTerra', created fraudulent inventory on mobile and CTV environments and leveraged stolen IP addresses to generate fake impressions.

The botnet siphoned media investment into its fraudulent inventory and hijacked existing IP addresses to artificially inflate impressions. It employed several user agents per IP to generate the impressions very quickly—then rotated them out and replaced them with new user agents. In just 20 minutes, a single IP in the botnet impersonated 16 different iPhone and Android phones, requesting nearly 50 impressions to at least nine different apps.


The fraud scheme was designed to leverage a high volume of impressions in a short span of time—as opposed to other fraud schemes that are designed to have a longer shelf life.

It generated more than 3 million fake impressions a day at its peak in CTV and mobile environments. If left undetected, the inventory value of the impression requests generated by MultiTerra was on track to reach over $1 million per month, according to DoubleVerify data.

The unusual traffic was first flagged by DoubleVerify’s machine-learning algorithms, which analyse billions of ad impressions daily. The Fraud Lab team then created an algorithm that detected and captured these IP addresses less than an hour after they had been taken over by fraudsters.

But the fraudsters behind 'MultiTerra' employed multiple techniques to evade detection, such as ensuring that each fake user was sufficiently “dressed-up” with the right properties to make it appear innocent, and changing its behavioral patterns every few days.

While DoubleVerify was able to track and block the botnet as it moved between IPs, within a few days  'MultiTerra' began changing its underlying behavior.

In its report on the fraud scheme, DoubleVerify noted that "this has happened with botnets before, but in this instance it was much faster and even more drastic".

After several weeks of cat-and-mouse, in which the botnet transformed twice to evade DoubleVerify's blocks, the scheme eventually shut down—50 days after it was first detected.


Connected TV is one of the channels that has been boosted during Covid-19 as consumers spend more time at home. For example, major DSP The Trade Desk reported a 40% year-on-year increase in CTV spend in Q2, more than double the growth of other channels like mobile and audio. Since fraud follows the money, it has also become a major focus for many fraud-detection firms over the past year.

In a recent report, DoubleVerify found CTV to record the highest volumes of fraud of any device, with  fraudulent CTV traffic rates increasing by 161% in Q1 2020 compared with the same period the previous year. Since March 2019, DoubleVerify has identified 1,300 fraudulent CTV apps—60% of which it discovered in 2020.

In April, cybersecurity and ad verification firm White Ops uncovered what at the time was said to be the largest-ever connected TV fraud operation in history, affecting more than 300 publishers and millions of dollars in ad spend. The ad fraud operation, named Icebucket, spoofed at least 2 million IP addresses from over 30 countries, and at one point accounted for nearly 28% of the total programmatic CTV traffic White Ops had visibility into—equivalent to around 1.9 billion ad requests per day.

In January, DoubleVerify launched what it claimed was the industry’s first connected TV targeting certification, in which it certifies programmatic partners that have demonstrated the ability to prevent fraud and invalid traffic within the CTV space. In order to be certified for CTV targeting, an adtech provider must apply DoubleVerify’s pre-bid app and device fraud protection for CTV inventory transactions.

Related Articles

Just Published

12 hours ago

See the full winners results from the APAC Effies

BMF Sydney and ALDI Australia take the Grand Effie for their entry, Loyalty Pointless Points, while Ogilvy was crowned Agency Network of the Year.

1 day ago

Campaign Crash Course: Leadership lessons for ...

How do leaders create effective teams? Dentsu Aegis Network Greater North chief Cheuk Chiang explains how to foster better talent by applying leadership principles, tips and learnings from past mistakes. Watch his video and test your knowledge with a quiz.

1 day ago

The most beautiful pizzas you will ever see

INSPIRATION STATION: How a pizzeria in Vietnam teamed up with boutique agency Ki Saigon to create beautifully inspiring (and edible) tributes to world peace.

1 day ago

Lenovo eschews high-voltage celeb endorsements for ...

Consumer electronics brand embraces functionality over bells and whistles as it seeks to stand out in competitive market in a campaign by SuperHeroes.