Byline: Lena Whitmere

Photo Courtesy of: Freepik

Automation made performance advertising global. It also made fraud scalable.

As campaigns became easier to launch across markets and formats, moderation systems were forced to evolve in parallel. What once relied on post-launch enforcement increasingly shifted toward prevention, with networks investing in earlier detection tools and infrastructure-level monitoring. The 2025 Ads Safety Report released by PropellerAds offers a snapshot of how that shift is taking shape inside one of the industry’s largest performance platforms.

Founded in 2011, PropellerAds is a global performance advertising platform. Its internal Policy and Security teams reviewed moderation and enforcement activity across the platform in 2025 to identify how fraud patterns, advertiser behavior, and technical violations are changing.

Preventive Moderation Expands

According to the report, more than 729,794 campaign rejections were issued across ad submissions in 2025 for policy violations detected during moderation. These rejections were issued during moderation, meaning the affected submissions did not go live, often due to content compliance failures or malware-related signals. The report notes these figures reflect the number of rejections (not unique rejected campaigns), meaning a single campaign may receive multiple restrictions.

While the number of moderation restrictions may appear large in isolation, the company notes that these cases represent a small fraction of total ad submissions processed across billions of daily impressions. The scale of enforcement reflects platform volume rather than disproportionate exposure to risk — and, according to the report, most high-risk activity is intercepted before reaching users.

The number of campaign rejections increased by 35% compared to 2024, which the company attributes to expanded moderation coverage and broader preventive controls rather than increased exposure to risk.

Content validation remained the most common driver of rejections, though infrastructure-related signals gained prominence. Malware-related domain alerts accounted for 26% of rejected campaigns (191,103 cases), suggesting that technical delivery methods are now assessed alongside creative content during review.

PropellerAds frames these measures not as reactive compliance adjustments but as core infrastructure. Structured advertiser verification, layered moderation, and documented enforcement workflows were formalized before such controls became broadly standardized across performance advertising — positioning fraud prevention as an architectural principle rather than a regulatory response.

The company notes that repeat violations represent a declining share of enforcement actions year over year, suggesting that structured verification and early detection reduce the persistence of high-risk actors within the system.

From Primitive Cloaking to Infrastructure-Heavy Schemes

Account suspensions were applied only after confirmed or repeated violations identified through automated detection and expert review processes. Among these, cloaking remained the most significant enforcement category.

Between 2022 and 2024, cloaking accounted for roughly 45% of suspended advertiser accounts on the platform. In 2025, cloaking accounted for 78.2% of confirmed suspensions (1,311 cases), reflecting a move toward fewer but more complex violation types.

The report describes a transition from simple redirect-based cloaking toward infrastructure-heavy setups involving:

Such systems can obscure campaign destinations or alter user flows after moderation, complicating verification processes designed to ensure compliance with platform policies.

Targeted Regions and Technical Exposure

Geographic patterns observed in 2025 moderation data suggest that Tier-1 markets - countries with higher purchasing power and digital advertising demand - continue to attract fraudulent activity.

Attempts originating from Turkey, for example, included cloaking-based scenarios targeting both local users and audiences in Spain, frequently linked to malware distribution campaigns. Across detected attack vectors, approximately 80% targeted Windows and Android users, indicating continued concentration on widely used operating systems.

The company noted that fraud-related GEO patterns tend to align with broader industry observations, in which regions with large online audiences attract both legitimate advertisers and malicious actors due to market scale and engagement levels.

New Fraud Vectors Beyond Redirects

Moderation teams also reported emerging campaign setups designed to distribute malicious files directly through advertising flows, replacing traditional redirect-based attacks with:

Separate cases involved phishing landing pages intended to compromise messenger accounts on platforms such as Telegram and WhatsApp. These scenarios rely on fake login forms or mobile-first social-engineering tactics that exploit user trust in personal communication tools.

Other attempts included hosting campaign landing pages on compromised infrastructure, such as expired domains or breached corporate servers, requiring deeper infrastructure analysis beyond surface-level URL validation.

AI as Support, Not Replacement

Machine learning tools were used to detect behavioral anomalies and interaction patterns at scale, though the report emphasizes that automated systems function primarily as support instruments for expert moderation teams.

Policy reviewers identified instances in which AI-generated documents were submitted for identity verification or used to localize advertising materials across languages and markets. Campaigns impersonating well-known artificial-intelligence tools or brands were also observed but blocked during early moderation stages.

Performance advertising platforms continue to process billions of daily interactions. The systems used to monitor them now operate under a different assumption: that fraud attempts are persistent rather than exceptional.

As automation advances on both sides of the ecosystem, fraud prevention is increasingly defined by anticipation rather than reaction. Platforms capable of integrating verification, behavioral analysis, and infrastructure monitoring into a unified operating model may determine not only campaign safety but long-term advertiser trust in performance-driven environments.

This story was distributed as a release by Jon Stojan under HackerNoon’s Business Blogging Program.