Domain spoofing (app spoofing)
Domain spoofing is ad fraud in which a seller disguises low-quality or fake traffic as inventory of a well-known app or site, so buyers pay premium prices for it.
How it works
A bid request carries the app’s identifier (its store bundle ID). A fraudster simply puts a popular app’s ID into requests for its own traffic. Without a way to check, the buyer sees “ads in a top game” and bids accordingly.
How app-ads.txt catches it
- The buyer takes the app ID from the request and finds the app’s developer website in the store listing.
- It reads that site’s app-ads.txt.
- The seller account from the request isn’t in the file → the impression is not from an authorized seller and is rejected.
The fraudster can’t add itself to the file: only the app’s real owner controls that website.
Related fraud types
- Counterfeit inventory — selling ad space the vendor has no access to.
- Unauthorized reselling — reselling real inventory without the publisher’s consent.
- Impression fraud — impressions no person ever saw (bots, stacked or hidden ads).
Closing the gaps
sellers.json (published by each ad system) tells buyers who owns a seller account, and the SupplyChain object shows every company an impression passed through. Together with app-ads.txt they make spoofed traffic easy to spot.
FAQ
Can app-ads.txt alone stop all ad fraud?
No — it stops sellers who aren’t authorized by the app. Bot traffic and hidden ads need other measures, such as fraud detection by the ad network.
Related guides
More
- app-ads.txt generator & hosting
- Top App Publishers
- Top Publishers by Errors
- Top Publishers by Missing Lines
- Top Publishers by Encoding Problem
- Top Ad Optimised Publishers
- Top Publishers by Access Errors
- Top Publishers by Broken app-ads.txt Format
- Recent App-Ads.txt Validations
- Publisher Monetisation Intelligence
- Ad networks in app-ads.txt
- Top Advertising Platforms
- Methodology