Click fraud gets most of the attention, but pixel stuffing, ad stacking, and domain cloaking drain ad budgets the same way: by counting impressions that were never actually seen. Here's how each one works and how to catch it.
Residential proxies help with ad verification broadly – authentic visibility from a real local connection, geo-targeting checks, avoiding data center IP blocks, and spotting click fraud by cross-referencing traffic patterns. That's covered in detail in how ad verification works.
This piece goes a level deeper, into four specific deceptive techniques that a general verification check can miss entirely.
Pixel stuffing works because impression counting was built around whether an ad rendered, not whether a human could perceive it.
An ad crammed into a space too small to be seen – sometimes a literal 1x1 pixel – still loads on the page, still fires its tracking, and still counts as a delivered impression. It satisfies the technical condition and fails the meaningful one, and the ad server records a success either way. A publisher running this can stuff a large number of these placements into a page that appears to carry a single visible ad, billing for all of them.
Detection means auditing the rendered page from a real residential connection and comparing actual rendered dimensions against what's being billed. That's a check the ad server can't perform on its own, since its logs report exactly what the fraud is designed to produce: a clean, successful delivery.
Ad stacking layers several ads directly on top of each other in a single placement. Only the top one is ever visible to a real viewer, but every ad in the stack fires its impression pixel and gets charged as though it delivered independently.
What makes this hard to catch is that each layer looks legitimate in isolation – a normal impression, from a normal placement, on a normal page. Nothing in standard delivery reporting stands out, because the numbers are exactly what the stack was built to generate. Viewability measurement catches some of it, which is precisely why stacking tends to show up where viewability isn't being measured closely.
Catching it directly means rendering the page and inspecting the layout: checking the DOM for overlapping ad containers occupying the same coordinates, or comparing the count of ad elements present against the count visibly displayed. A single placement position holding six billed impressions is the signal, and that signal only exists in the rendered page.
A cloaked site shows one version of a page to known ad-verification crawlers or IP ranges – a clean, compliant-looking version – and a completely different one to real visitors, hiding the actual ad placement, content, or ad density from whoever is checking.
The mechanism is straightforward. The site keeps a list of IP ranges and user-agent signatures belonging to verification services, checks each incoming request against it, and branches the response. Verification sees a tidy page with two ads beside reasonable editorial content. A real visitor sees something else entirely: more ads, different ads, or content the advertiser would never have approved.
This is fraud built specifically to bypass verification, which makes the detection method the whole answer. Checking IPs and traffic patterns that look like a genuine consumer, rather than a known verification service, closes the gap, because a cloaked site will happily keep serving the clean version indefinitely to anyone it recognizes.
Beyond outright fraud, a campaign appearing next to harmful, inappropriate, or low-quality content is its own category of damage – and a delivery report will never flag it, because the ad ran exactly as booked.
Placement quality isn't a field in a standard delivery report. Reach, frequency, and viewability are all measurable without anyone looking at the page, which is why an audit that stops at the numbers can return a perfect result for a campaign running somewhere the brand would have rejected outright.
Auditing live placements from a real user's view is the only reliable way to confirm a campaign's actual neighborhood, not its reported reach. That matters most for regulated categories and for brands buying through programmatic exchanges, where no one ever individually approved the specific inventory.
GoProxies' residential proxies are already positioned for ad verification across several product pages on this site, and the same infrastructure applies directly here: pixel stuffing, ad stacking, and cloaking all require viewing placements from a genuine consumer IP rather than a known verification range.
GoProxies' rotating residential proxies cover 30M+ IPs across 200+ locations, with city-level targeting for checking placements in the specific market a campaign is running in.
Gintarė specializes in content related to proxies, web scraping, data collection, and internet infrastructure. With a solid background in information technology, networking, and cybersecurity, she understands both the technical and practical aspects of large-scale data acquisition.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Cramming an ad into a space too small to be seen – sometimes a literal 1x1 pixel – so it technically loads, fires its tracking, and counts as a delivered impression without any real person having the chance to see it.
Layering multiple ads on top of each other in the same placement. Only the top ad is visible to a real viewer, but every layer in the stack fires its own impression pixel and gets billed as though it delivered separately.
By checking a page from traffic that looks like a genuine consumer rather than a known verification service or IP range. A cloaked site shows those two audiences different versions of the same page, so the discrepancy only appears when you check from a real-looking connection.
