Fraud Detection (Defender)
Defender runs 20 fraud checks on every bid request at 0ms added latency. All checks execute in-process at the edge — no external calls, no performance impact.
How It Works
Every incoming bid request passes through Defender before the auction runs. Invalid traffic is blocked immediately. Legitimate requests proceed to auction as normal.
Bid Request → Defender (20 checks, 0ms) → Auction
↓ (if blocked)
204 No BidFraud Checks
Device Fingerprinting (16 signals)
Defender analyzes 16 device signals to detect spoofed or fabricated devices: user agent consistency, screen resolution, language, timezone, connection type, device model, OS version, and more. Mismatches between signals indicate bot or spoofed traffic.
Network Checks
| Check | What It Catches |
|---|---|
| Data center IP | Traffic from hosting providers, not real users |
| Tor exit nodes | Traffic routed through Tor network |
| VPN detection | Known VPN provider IP ranges |
| Proxy detection | Open proxy and residential proxy networks |
Supply Chain Verification
| Check | What It Catches |
|---|---|
| SSAI spoofing | Fake server-side ad insertion headers |
| Domain spoofing | Mismatched domains in bid request vs actual site |
| ads.txt | Publisher not authorized to sell this inventory |
| Supply chain (schain) | Broken or missing seller chain |
Behavioral Analysis
| Check | What It Catches |
|---|---|
| Geo anomalies | IP location contradicts declared geo |
| Time anomalies | Timezone mismatch with declared location |
| Pacing anomalies | Unnaturally even request distribution |
| Bot detection | Known bot signatures and crawlers |
Auto-Blacklisting
IPs that repeatedly fail fraud checks are automatically blacklisted. Blacklisted IPs receive an immediate 204 response with no auction.
Dashboard
Go to Intelligence > Defender in the sidebar.
KPIs
- Requests scanned — total requests checked today
- Blocked — requests rejected by Defender
- Block rate — percentage of traffic blocked
- Auto-blacklisted IPs — IPs added to blacklist today
Hourly Trend
A chart showing blocked vs allowed traffic by hour. Use this to spot sudden spikes in fraudulent traffic.
Type Breakdown
A breakdown of blocks by check type (e.g., 40% data center IP, 25% bot detection, 15% domain spoofing). Helps identify the main sources of invalid traffic.
Via Broker Chat
“What’s the fraud rate today?”
“Show me Defender stats for the last 7 days”
“Which publishers have the highest block rate?”