Browse the documentation
Domain Reputation & Domain Check
Applies to: All users · needs the matching permission on your account
What this is#
An ad rarely does its damage from the domain you were given. The tag loads scripts from one domain, redirects through two more and lands on a fourth. The Ad Scanner records every one of them and checks each against what is known about it. That is the domain reputation check, part of every scan.
Domain Check works the other way round: you enter a domain and see on which of your ad zones the scanner has seen it.
When you'll use this#
- To know whether a flagged domain is a real threat or a false alarm.
- After a complaint about a specific advertiser or landing page: "where did this run?"
- Before you contact a network, to tell them exactly which of your zones were affected.
Step by step#
How a domain is checked#
With Scan Domains on (it is, for a new task), every domain the scan contacted, from the ad itself through every redirect to the landing page, goes through these checks in order:
- The malware domain list. A domain on the scanner's list of known malware domains is reported as
Malware. This check always applies. - A domain-reputation service that combines the verdicts of many security engines. When engines call the domain malicious or suspicious, it is reported as Malicious Domain, with each engine's verdict in the report.
- Google Safe Browsing, used when the reputation service has no answer. A listed domain is reported as Google Safe Browsing.
Well-known ad-serving domains that public blocklists list wholesale are exempt from the reputation checks, so they don't flag every scan.
The API Scans column under Stats counts the live lookups these checks needed. Results are cached, so a domain seen often is not looked up every time.
Read a domain finding#
Expand a Malicious Domain row in Events Captured. You get the count of engines per verdict and a table with each engine's Engine, Category, Method and Result:
| Verdict | Meaning |
|---|---|
| Malicious | The engine lists the domain as harmful. |
| Suspicious | The engine has doubts but no firm verdict. |
| Harmless | The engine considers the domain safe. |
| Undetected | The engine has no opinion. |
Look up where a domain ran#
- Open Ad Scanner → Domain Check.
- Enter the domain, for example
example.com, and click Check. Part of a domain is enough: the lookup matches every observed domain that contains what you typed. - The result lists each match with Ad domain, Site, Ad zone, Times seen and Last seen.
Options reference#
Domain settings in a task#
Under Advanced detection in the task editor:
| Option | What it does |
|---|---|
| Scan Domains | Runs the reputation checks. On by default. |
| Report Malicious | Reports domains that engines call malicious. |
| Report Suspicious | Reports domains that engines only call suspicious. Untick it if suspicious-only verdicts are too noisy for you. |
What Domain Check covers#
| Source | The domains seen while scanning your smart zones. Manual items are not linked to a zone, so they don't appear here. |
| Scope | Your own ad zones only. |
| Not included | The ad-serving domains of this platform itself. |
| Freshness | New scans are added every ten minutes or so. |
| Times seen | How many scans saw the domain on that zone. |
Example#
A visitor writes to Marco that one of his pages sent them to a fake prize page on prize-claim.example. Marco opens Domain Check, enters prize-claim and clicks Check: the domain was seen on two ad zones of one site, 14 times, last seen this morning. Both are smart zones of the same network. He opens Reports, filters on that task, finds the scans with issues and sends one report link to the network.
Tips#
- Search Domain Check with the distinctive part of a domain. Landing pages rotate between subdomains, and a partial match catches them all.
- A domain that only one engine calls suspicious is weak evidence. Look at the whole engine table before you act.
- Domain Check only knows what your smart zone scans saw. Scan your smart zones regularly if you want it to answer complaints.
Troubleshooting#
| Symptom | Likely cause | Fix |
|---|---|---|
| No zones of yours have been seen running a domain you know ran | It was served outside your scanned smart zones, or the scans didn't run from the right country or device | Scan the smart zones it may have run on, from the visitor's country. |
| The same harmless domain is flagged in every scan | A reputation engine lists it | Look at the engine table: if it is one weak verdict, untick Report Suspicious, or ignore the domain for that task from the report (see below). |
| No ignore icon next to a flagged domain | The report is from another account's task, or you opened the link while logged out | Open the report from your own Ad Scanner while logged in. |
To ignore a domain for a task, open one of that task's reports and click the circle icon next to the flagged domain in the events table; click it again to stop ignoring it. The icon is shown on your own tasks' reports while you are logged in. An ignored domain skips the reputation lookups only: the malware domain list still applies to it. With the API, PUT /api/v1/ad-scanner/{id}/ignore-domain adds a domain to a task's ignore list, or removes it when it is already there. See API Keys.