Website excluded. Ads still appearing.

Why an excluded website may still receive advertising

First, straightforward explanations must be checked: Was the list active at the relevant time? Did it apply to the campaign and buying path that actually delivered the ad? Was the entire domain excluded, or only part of it? Did the observed creative come from that campaign at all?

Implementation varies by platform. Google, for example, documents differences between domain and subdomain exclusions and their scope. An active list therefore does not establish that every campaign run by a company is covered. [1]

There are also forms of manipulation that misrepresent inventory origin. Domain spoofing and dark pools are particularly relevant here.

Domain spoofing: the declared website is not the actual placement

In domain spoofing, ad inventory is offered under a false domain. The buyer receives the claim “Website A”, while the creative actually appears in a different environment. Excluding Website B may be ineffective if the buying decision relies on the false claim A.

This is more than a theoretical possibility. Adalytics documented discrepancies between declared and actual page URLs at Gannett over an extended observation period. That case illustrates why bid-request information must be compared with observed delivery. It does not establish the cause of the incident described here. [2]

A filter can process incoming information correctly and still fail to address the actual placement.

Dark pools: shared seller accounts complicate attribution

The relevant research uses dark pooling to describe the problematic pooling of inventory from organisationally unrelated publishers through shared seller IDs. Websites of different quality may consequently be monetised through the same seller account. Vekaria, Nithyanand and Shafiq investigated how misinformation websites use such structures for deceptive monetisation. [3]

A shared seller ID alone proves neither fraud nor the circumvention of an exclusion list. Legitimate sales arrangements also pool multiple websites. Ownership, declared relationships and actual transactions must be considered together before drawing a conclusion.

If the actual domain is correctly transmitted and an effective domain exclusion is applied, a shared seller ID should not override that exclusion. The critical issue is an obscured, false or insufficiently verified relationship between website, inventory and seller.

What ads.txt and sellers.json provide

ads.txt lists the seller accounts authorised for a website. sellers.json describes the entities behind seller IDs. The SupplyChain Object can provide additional information about the participants in a transaction.

These disclosures belong in the investigation. IAB Tech Lab itself stresses that ads.txt serves a specific purpose and must be used alongside other standards and delivery checks. [4]

Authorisation to sell does not prove that a particular impression appeared on the claimed website.

Equally, an unusual entry should not immediately be treated as proof of a payment. A website operator can publish a declaration; whether the named account was actually used for the observed transaction is a separate question.

We previously addressed this distinction on stopfundinghate.ch: in Dr. Augustine Fou’s guest article in November 2022 and in our article on forensic campaign analysis in April 2023. The central task remains comparing declared information with independently observable signals. [5][6]

Our investigation: from a report to a defensible finding

The process follows the H.O.T. AG Forensic Audit Framework: Analyze, Detect, Report, Eliminate, Optimize. [7] For a suspected website-exclusion breach, it translates into the following practical investigation.

1. Preserve the incident and identify the campaign

We document the page address, timestamp and time zone, creative and available browser context. Where possible, the associated network requests and technical identifiers are preserved.

In parallel, we need the campaign configuration at the time: active exclusion lists, their versions and assignments, and the change history. Today’s configuration does not prove which rule applied when the observation was made.

A screenshot records the visible observation. Connecting it to a campaign, delivery time and buying path turns it into a campaign incident that can be investigated.

2. Compare buying information with the observed context

Where available, we compare the declared domain or page address with environmental information measured after delivery.

FouAnalytics can contribute additional evidence through in-ad measurement. Our earlier article describes, among other techniques, the analysis of location.ancestorOrigins: browser information that can expose the origins of ancestor frames and provide clues about how a creative is embedded. [6][8]

It does not automatically supply complete page URLs or all the content of the surrounding page. Browser support, embedding arrangements and referrer policies can limit observability. A measurement tag being called does not, by itself, prove viewability or a human contact.

A discrepancy is therefore checked against alternative explanations, such as legitimate embedding or incorrectly matched events. It is an investigative finding; establishing intentional deception requires further evidence.

3. Reconstruct the seller structure

We compare available transaction information with ads.txt, sellers.json and SupplyChain disclosures. In particular, we ask:

• Which combination of advertising system and seller ID was used?
• Which organisation is behind the account?
• Which other domains use this account, and who owns them?
• Do declared seller roles and the observed buying path agree?
• Are there gaps or contradictions in the documented supply chain?

A seller ID must be interpreted in the context of its advertising system. The same character string on two different exchanges does not automatically identify the same seller.

Timing also matters: current transparency files may have changed since the incident. If historical versions are unavailable, that limitation is recorded. We can confirm the actual payment recipient only to the extent supported by billing or payment records.

4. Report findings, scope and measurement gaps

The report clearly distinguishes what was observed, technically linked, confirmed or remains unresolved.

Confirmed breaches are reported with the relevant data basis: period, campaigns, measured deliveries and observable environments. A rate within a measurable subset must not be extrapolated to the entire campaign without justification.

Missing measurability is reported as such. It does not confirm correct delivery.

5. Address the evidenced cause

The action follows the finding. It may involve correcting a list assignment, blocking a seller account, excluding a supply path or temporarily pausing an affected source.

We recommend vetted inclusion lists and manageable buying paths where appropriate to the mandate. Delivery on allowed domains must still be verified. FouAnalytics supplies measurement data; the necessary changes are implemented in buying systems or by the responsible platforms.

A blanket block on shared seller accounts may also affect legitimate publishers. We therefore document the rationale and expected scope of each action.

6. Measure again after the correction

A change is complete when its effect has been appropriately checked. We revisit the affected campaigns and buying paths and record the follow-up period and measurement coverage.

If no further breach is observed, that is a result for the measured period and scope. It is not an unlimited guarantee.

What advertisers should require from their partners

Advertisers need access to the data required to verify agreed exclusions. This includes traceable delivery information, documented rule changes and, where available, the participating sellers and buying paths.

Named owners, investigation deadlines and an agreed process for confirmed misplacement are equally important. Refunds or credits depend on the evidence and the applicable agreements.

The decisive question is:

“What evidence shows that our exclusions are respected in actual ad delivery?”

That turns a list of settings into a controllable process.

H.O.T. AG: investigate the specific contradiction

We help advertisers investigate suspected exclusion breaches: from preserving the incident and analysing delivery and supply paths to documented follow-up checks.

Before starting, we establish the question, data access, measurement coverage and responsibilities. In an independent audit, the audit role and operational buying responsibility are transparently separated.

Discuss your specific case with H.O.T. AG.

Sources and further reading

1. Google Ads Help: Exclude placements at the account level. Platform-specific documentation; not a universal rule for all DSPs.
2. Adalytics: Marketers & ad tech companies should regularly audit log files. Investigation of discrepancies between declared and actual page URLs at Gannett.
3. Vekaria, Y.; Nithyanand, R.; Shafiq, Z.: The Inventory is Dark and Full of Misinformation: Understanding the Abuse of Ad Inventory Pooling in the Ad-Tech Supply Chain. IEEE Symposium on Security & Privacy 2024; arXiv version last revised on 14 October 2023.
4. IAB Tech Lab: ads.txt: Don’t Blame the Tools, Learn How to Use Them. Purpose and combined use of transparency standards.
5. Dr. Augustine Fou, German translation by Michael M. Maurantonio: How different ad-fraud detection technologies work, 29 November 2022. German-language article.
6. Michael M. Maurantonio: Why ad fraud is consuming the advertising industry, 27 April 2023. German-language article.
7. H.O.T. AG: The Forensic Audit Framework and Domain spoofing and dark pools: why ads.txt is not enough.
8. MDN Web Docs: Location: ancestorOrigins property. Functionality and technical limitations.