Threat detection
What GoAdScanner flags
The scanner records what an ad and its landing page do in the browser, checks every domain they contact, and reports each finding with the URL it came from.
Findings in a report
The common checks are on by default; the advanced ones you switch on per task.
More in the manual: Every finding type and what to do about it.
Malicious domain
The ad contacted a domain known for abuse. Suspicious domains can be reported too.
Forced redirect
The ad sent the page itself somewhere else, without a click.
Pop-up abuse
The ad opened pop-ups or new windows on its own.
Push notification
The ad tried to get push-notification permission.
Alert abuse
The ad opened browser alert dialogs.
Permission abuse
The ad asked for the camera, microphone, location or other browser permissions.
Crypto miner
The ad ran crypto-mining code.
Obfuscated JavaScript
Deliberately unreadable code, often used to hide what an ad does.
Fingerprinting
A script tried to identify the visitor through canvas or audio signals.
Suspicious DOM
Hidden content, hidden iframes or frames covering the page, typical of click hijacking.
Service workers
A service worker registered by the ad or its landing page.
Cookies
The cookies the ad and its landing page set, shown in the navigation tree.
Domain threat intelligence
Every domain in the chain, from the ad to the final landing page, is checked against Google Web Risk, VirusTotal and ReversingLabs. The report shows each domain’s verdict (malicious, suspicious, harmless or undetected) with the details from each source.
You choose per task whether to report malicious domains, suspicious ones or both, skip reports older than a number of days, and exempt advertisers you trust. A domain you trust can go on the task’s ignore list straight from a report.
More in the manual: Domain reputation and Domain Check.
Why scans run from your visitors’ countries
Malicious ads cloak. A landing page shows its real content only to the country, device and browser it targets, and a clean page to everyone else, including you when you check it from the office. A clean report is only as good as its context, so GoAdScanner scans through proxies in the countries you choose, with the device and browser profiles you choose, and for RTB it replays the exact country, device and publisher site the ad served on.
Use location proxies in the countries you actually get traffic from, and add more browsers when visitors report ads you can’t reproduce.
From finding to action
- Get told. Alerts for serious findings only (malicious domains, crypto miners, forced redirects, pop-ups, push) or for any finding.
- Show proof. Send the report link to the network or advertiser that served the ad; it opens without a login.
- Stop it. Pause the campaign, or the network in your SmartZone, until it’s fixed.
- Refuse RTB bids. For an RTB report, refuse bids from the source the landing page came through. The ad servers apply it within 5 minutes and you can undo it.
GoAdScanner never blocks anything by itself. A wrong block on a shared domain silently costs revenue, so a person always decides.
Keep bad ads off your traffic
GoAdScanner is part of GoAdserver. Tell us what you want to scan and we switch it on for your platform, or read the full manual first.