Ad Impression

How Ad Impression Works

  +-----------------+      +-----------------+      +--------------------+      +-----------------------+      +-----------------+
  |   User Visits   | →    |    Ad Server    | →    |  Impression Pixel  | →    |  Data Collection &  | →    |   Fraud Score   |
  |   Website/App   |      |    Delivers Ad  |      |       Fires        |      |      Enrichment     |      | (Valid/Invalid) |
  +-----------------+      +-----------------+      +--------------------+      +-----------------------+      +-----------------+
                                     │                                                 │
                                     └───────────────────┐                             │
                                                         ↓                             ↓
                                             +-------------------------+      +---------------------+
                                             |     Ad is Rendered      |      |   Analysis Engine   |
                                             +-------------------------+      +---------------------+

🧠 Core Detection Logic

Example 1: Impression Velocity and Frequency Capping

This logic prevents a single user or bot from generating an excessive number of impressions in a short period. It is a fundamental defense against simple automated scripts designed to repeatedly reload pages or cycle through ads to inflate impression counts. This rule is typically applied in real-time or near-real-time at the session level.

// Rule: Impression Frequency Analysis
FUNCTION checkImpressionVelocity(impressionEvent):
  // Extract user identifier (IP address or device ID) and timestamp
  userID = impressionEvent.ip_address
  timestamp = impressionEvent.timestamp

  // Retrieve past impression timestamps for this user
  userHistory = getImpressionHistory(userID)

  // Define thresholds
  TIME_WINDOW_SECONDS = 60
  MAX_IMPRESSIONS_IN_WINDOW = 15

  // Filter history to the defined time window
  recentImpressions = filterHistoryByTime(userHistory, timestamp, TIME_WINDOW_SECONDS)

  // Check if the number of recent impressions exceeds the cap
  IF count(recentImpressions) > MAX_IMPRESSIONS_IN_WINDOW:
    RETURN { status: 'INVALID', reason: 'High Impression Frequency' }
  ELSE:
    // Record the current impression and return valid
    recordImpression(userID, timestamp)
    RETURN { status: 'VALID' }
  END IF
END FUNCTION

Example 2: Data Center and Proxy Detection

This logic filters out impressions originating from non-residential IP addresses, such as those from data centers, servers, VPNs, or known proxies. Since legitimate human users typically browse from residential or mobile networks, traffic from data centers is highly indicative of bot activity used to scale impression fraud.

// Rule: Data Center IP Filtering
FUNCTION validateImpressionSource(impressionEvent):
  // Extract the IP address from the impression data
  ipAddress = impressionEvent.ip_address

  // Load known data center IP range blacklists
  dataCenterBlacklist = loadDataCenterIPs()
  proxyBlacklist = loadProxyIPs()

  // Check if the impression's IP matches any blacklisted range
  isDataCenterIP = isIPInList(ipAddress, dataCenterBlacklist)
  isProxyIP = isIPInList(ipAddress, proxyBlacklist)

  IF isDataCenterIP OR isProxyIP:
    RETURN { status: 'INVALID', reason: 'Source is a known Data Center or Proxy' }
  ELSE:
    RETURN { status: 'VALID' }
  END IF
END FUNCTION

Example 3: User-Agent and Header Anomaly Detection

This logic inspects the technical details of the request headers, particularly the User-Agent (UA) string, to identify non-standard or known fraudulent clients. Bots often use outdated, inconsistent, or headless browser UAs (like PhantomJS) that differ from those of legitimate, updated web browsers used by humans.

// Rule: User-Agent Signature Matching
FUNCTION analyzeClientHeaders(impressionEvent):
  // Extract User-Agent string from headers
  userAgent = impressionEvent.headers.user_agent

  // Load list of known bot and suspicious User-Agent signatures
  botSignatures = ["PhantomJS", "Selenium", "headless", "bot", "crawler"]

  // Check for presence of any bot signature in the User-Agent string
  FOR signature IN botSignatures:
    IF contains(userAgent, signature):
      RETURN { status: 'INVALID', reason: 'Known Bot User-Agent Signature' }
    END IF
  END FOR

  // Add checks for other header anomalies (e.g., missing standard headers)
  IF NOT hasStandardHeaders(impressionEvent.headers):
     RETURN { status: 'INVALID', reason: 'Header Anomaly Detected' }
  END IF

  RETURN { status: 'VALID' }
END FUNCTION

📈 Practical Use Cases for Businesses

• Campaign Shielding – Real-time analysis of impressions allows businesses to block traffic from known fraudulent sources (like data centers or botnets) before an ad is even served, directly protecting the advertising budget from being wasted on invalid activity.
• Analytics and Reporting Integrity – By filtering out fraudulent impressions, companies ensure their campaign performance metrics (like CPM, reach, and frequency) are accurate. This leads to better strategic decisions based on real human engagement rather than skewed bot data.
• Improving Return on Ad Spend (ROAS) – Ensuring ads are shown to genuine users increases the likelihood of meaningful engagement and conversions. Analyzing impression quality helps optimize ad placements and targeting toward channels that deliver clean, high-performing traffic, thus maximizing ROAS.
• Lead Generation Quality Control – For businesses focused on acquiring leads, validating impressions ensures that the top of the funnel is not contaminated by bot-submitted forms. This prevents sales teams from wasting time on fake leads generated by non-human traffic.

Example 1: Geofencing and Location Mismatch Rule

This pseudocode checks if an impression originates from a geographic location that is part of the campaign’s target market. It also flags mismatches between the IP-based location and other signals (like language or timezone), which often indicate VPN or proxy usage by fraudulent actors.

// Use Case: Ensure ad impressions are from the target country and not masked by proxies.
FUNCTION validateGeoLocation(impression, campaignRules):
  ip_location = getLocationFromIP(impression.ip_address)
  device_timezone = impression.device.timezone

  // 1. Check if impression is within the campaign's allowed countries
  IF ip_location.country NOT IN campaignRules.target_countries:
    RETURN { valid: FALSE, reason: "Geofence Mismatch" }
  END IF

  // 2. Check for timezone and location inconsistencies
  expected_timezones = getTimezonesForCountry(ip_location.country)
  IF device_timezone NOT IN expected_timezones:
    RETURN { valid: FALSE, reason: "IP-Timezone Mismatch" }
  END IF

  RETURN { valid: TRUE }
END FUNCTION

Example 2: Viewability and Interaction Scoring

This logic scores an impression based on whether it was actually viewable and if there was any human-like interaction. An impression that is served but never comes into the user’s viewport or receives no mouse movement is considered low-quality or potentially fraudulent (e.g., ad stacking).

// Use Case: Score impressions to pay only for those seen by humans.
FUNCTION scoreImpressionAuthenticity(impression, interaction_data):
  score = 100
  reasons = []

  // 1. Penalize non-viewable impressions
  IF impression.viewability_percentage < 50 OR impression.viewable_duration_ms < 1000:
    score = score - 50
    reasons.append("Low Viewability")
  END IF

  // 2. Penalize impressions with no human-like interaction
  IF interaction_data.mouse_events_count == 0 AND interaction_data.scroll_events_count == 0:
    score = score - 40
    reasons.append("No User Interaction")
  END IF
  
  // 3. Penalize impressions from suspicious device types (e.g., emulators)
  IF isEmulator(impression.device_id):
      score = 0
      reasons.append("Detected Emulator")
  END IF

  RETURN { authenticity_score: score, issues: reasons }
END FUNCTION

🐍 Python Code Examples

This function simulates checking a stream of impression events to identify IPs that generate impressions too quickly. It maintains a simple in-memory log to track impression times for each IP and flags those that violate a frequency threshold, a common sign of bot activity.

from collections import deque
import time

IP_LOGS = {}
TIME_WINDOW = 60  # seconds
MAX_IMPRESSIONS = 20

def is_impression_fraudulent(ip_address):
    """Checks if an IP is generating impressions too frequently."""
    current_time = time.time()
    
    if ip_address not in IP_LOGS:
        IP_LOGS[ip_address] = deque()
    
    # Remove old timestamps from the log
    while (IP_LOGS[ip_address] and 
           current_time - IP_LOGS[ip_address] > TIME_WINDOW):
        IP_LOGS[ip_address].popleft()
        
    # Add the current impression timestamp
    IP_LOGS[ip_address].append(current_time)
    
    # Check if the count exceeds the max allowed impressions in the window
    if len(IP_LOGS[ip_address]) > MAX_IMPRESSIONS:
        print(f"FLAGGED: IP {ip_address} has {len(IP_LOGS[ip_address])} impressions in {TIME_WINDOW}s.")
        return True
        
    return False

# --- Simulation ---
impressions_stream = ["1.2.3.4", "1.2.3.4", "5.6.7.8"] + ["1.2.3.4"] * 20
for ip in impressions_stream:
    is_impression_fraudulent(ip)
    time.sleep(0.1)

This example demonstrates how to filter impressions based on their User-Agent string. It checks each impression's User-Agent against a blocklist of known bot and crawler signatures to weed out obvious non-human traffic before it contaminates analytics.

BOT_SIGNATURES = [
    "bot", "crawler", "spider", "headlesschrome", "phantomjs", "selenium"
]

def filter_by_user_agent(impression_event):
    """Filters out impressions with suspicious User-Agent strings."""
    user_agent = impression_event.get("user_agent", "").lower()
    
    if not user_agent:
        return {"is_valid": False, "reason": "Missing User-Agent"}
        
    for signature in BOT_SIGNATURES:
        if signature in user_agent:
            return {"is_valid": False, "reason": f"UA contains bot signature: {signature}"}
            
    return {"is_valid": True, "reason": "Clean User-Agent"}

# --- Simulation ---
impression1 = {"ip": "1.2.3.4", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"}
impression2 = {"ip": "2.3.4.5", "user_agent": "My-Awesome-Bot/1.0 (+http://example.com/bot)"}

print(f"Impression 1: {filter_by_user_agent(impression1)}")
print(f"Impression 2: {filter_by_user_agent(impression2)}")

Types of Ad Impression

• Served Impression - This is the most basic type, counted when an ad server sends an ad to a publisher's website. In fraud detection, relying solely on this type is risky, as it doesn't confirm the ad was actually seen, making it a primary target for bots that generate views without visibility.
• Viewable Impression - This type is counted only when a certain percentage of the ad's pixels (e.g., 50%) is visible on the user's screen for a minimum duration (e.g., one second). It is a crucial metric for combating impression fraud like ad stacking or pixel stuffing, where ads are loaded but never seen by a human.
• Tracked Impression - This refers to an impression that includes an advanced tracking script or pixel. The script collects additional data points beyond a simple view, such as mouse movements, scroll depth, and browser properties. This enriched data is vital for behavioral analysis to distinguish sophisticated bots from genuine users.
• Pre-Bid Verified Impression - In programmatic advertising, this is an impression opportunity that has been analyzed for fraud signals *before* an advertiser bids on it. Fraud detection services scan the request for red flags like a data center IP or bot signature, helping advertisers avoid wasting money on fraudulent inventory from the start.
• Sophisticated Invalid Traffic (SIVT) Impression - This is not a desired type but a classification of fraudulent impressions generated by advanced bots, malware, or hijacked devices designed to mimic human behavior. Detecting SIVT impressions requires complex techniques like behavioral analysis and device fingerprinting because they evade simple filters.