Browse the documentation

Reading Scan Reports

Applies to: All users · needs the matching permission on your account

What this is#

Every scan writes a report: what the scanner saw, from which country and device, and every finding. The Overview, Reports and Stats tabs of the Ad Scanner summarise them; View Report opens one in full. This article explains what each part means and how to tell a real problem from noise.

When you'll use this#

  • After a notification, to see what the scanner found.
  • To check a task's first runs before you trust it to watch for you.
  • To collect proof before you contact the network that served a bad ad.

Step by step#

Find the report you need#

  1. Open Ad Scanner → Reports and set the Date range.
  2. Narrow it with Task, Scan Status (With Issues / Without Issues), Country and Device / Browser.
  3. Click View Report on a row. The report opens on its own page.

The Overview tab is the faster route when you don't know where to look: Most flagged items lists the items with the most findings in the period, and Top countries shows where the scans ran.

Read a report from top to bottom#

  1. The verdict. Threats Detected means at least one domain was found on a malware list or flagged by a reputation service. Potentially Unwanted Activity means other findings, such as pop-ups or alerts, but no bad domain. No Threats Detected means the scan found nothing.
  2. The tiles. Malicious Domains, Malware and Safe Browsing count the bad-domain findings; Flagged Events, Requests and Redirects show how much happened.
  3. The scan context. Country, Device, Browser, Scan Type, Target, Referrer and Data Used: the conditions the ad was seen under.
  4. The screenshot. What the page looked like when the scan finished.
  5. Events Captured. Every finding with its Event Type, URL and Details. For a bad domain, expand it to see each reputation engine's verdict.
  6. Clicked URL Report (Landing Page). For an Ad Scan: where the click led, with its own Click Screenshot and findings.
  7. Landing Page Ads. With Scan Landing Page Ads on: each ad found on the page, its creative, its Click destination and Destination events. Click View full scan for one ad's complete scan.
  8. VAST Scan Results. For a VAST Scan: the Initial VAST URL, the Wrapper Chain and the Media File.
  9. Full Scan Results. The complete tree of pages, redirects, requests and cookies. Branches that contain a flagged domain open by themselves.

Share a report#

The report page has its own link that opens without a login. Copy it from your browser's address bar and send it to the network or advertiser: they see exactly what you see. Anyone with the link can open it, so share it only with the people who need it.

Options reference#

Reports columns#

Column Meaning
Scan Time When the scan ran.
Task The task that ran it.
Scanned Item What was scanned; a smart zone shows as website → ad zone → smart zone.
User Agent The browser profile used.
Country The proxy country. Empty when the proxy couldn't be reached.
Issues The number of findings, or Clean.
Bandwidth Data the scan used through the proxy. 0 for scans without a proxy.

Stats#

Stats counts scans per Scan Date, Task or Country (tick one or more under Group By). Total Scans is the number of scans; API Scans the number of live domain-reputation lookups those scans needed. A day with far more scans than usual usually means a task's interval or Total Scans is set higher than you meant.

Finding types#

Most findings show under a readable name. Some still show their technical name in the Event Type column; both are listed here.

Shown as What it means Serious?
Malicious Domain A domain-reputation service lists a contacted domain as malicious or suspicious. Expand it for each engine's verdict. Yes
Malware A contacted domain is on the scanner's malware domain list. Yes
Google Safe Browsing Google Safe Browsing lists a contacted domain. Yes
top_redirect Forced redirect: the ad broke out of its frame and sent the whole page somewhere else. Yes
Popup Abuse The ad opened a window or tab without a click. Yes
Push Notification The ad asked for push-notification permission. Yes
crypto_miner The ad ran crypto-mining code. Yes
alert The ad opened a browser alert, confirm or prompt dialog. No
Suspicious DOM Hidden content, or a frame or element covering the page, typical of click hijacking. No
fingerprinting_canvas / audio_fingerprinting A script tried to identify the visitor through canvas or audio signals. No
Obfuscated JavaScript Deliberately scrambled code, often used to hide what an ad does. No
permission_request The ad asked for a browser permission: location, camera, microphone or other. No
clipboard_access A script read from or wrote to the clipboard. No
worker_creation A script started a background worker, often used by miners. No
blocked_by_client The scanner browser's own malware protection stopped the page from loading. No

"Serious" is what Serious findings only alerts on.

Scan notes#

Two entries describe how the scan ran, not what the ad did. They are shown as notes, never count as findings and never change the verdict:

Note Meaning
Proxy Unavailable The country proxy couldn't be reached, so the scan ran from the scanner's own connection in the Netherlands. Treat its country as unknown.
Consent Overlay Dismissed The scanner closed a cookie or age (18+) overlay so the ads behind it could load.

Example#

Ana gets an alert for her task "Tier 1 banners". She opens the report: Threats Detected, one Malicious Domain. The context shows Mobile, Android Chrome, United States, and her site as Referrer. In Full Scan Results the flagged domain sits three redirects deep behind the network's ad tag. She expands the finding: four engines call it malicious. She copies the report link and sends it to the network.

Tips#

  • Check the context before you act: a finding seen only from one country or one device is still real, but your network contact will need that detail to find it.
  • One Malicious Domain flagged by a single engine as suspicious is weak evidence. Several engines calling it malicious is strong evidence.
  • Look at Full Scan Results to see where in the chain the bad domain appears: in the ad itself, or only on the landing page after the click.

Troubleshooting#

Symptom Likely cause Fix
No reports found Wrong date range, or the task hasn't run yet Widen the Date range; check the task is active and has items.
The report shows no screenshot The page didn't finish loading within the scan time Check the next run; a page that never loads is often a dead tag.
Country is empty on a row The proxy was unavailable for that scan See Proxy Unavailable above.
An event type shows as a technical name Not every finding has a readable label yet Look it up in the finding types table above.
Report Not Found on a shared link The link was cut off when copied Copy the full address again.