Summary

We recently neutralized a sophisticated botnet, showcasing our proactive duty of care. Supporting our entire subscriber-base, we used enterprise-grade monitoring and edge filtering, while still charging very reasonable fees.

Continue reading for the full story.

Introduction

As a cloud ad serving provider, our responsibility goes beyond simply keeping systems online; it includes a proactive duty of care to protect our subscribers’ data integrity and campaign accuracy. Recently, our internal monitoring tools flagged a highly sophisticated, global bot network targeting the impression logging feature in Revive Adserver Hosted edition. Rather than attempting to cause system downtime, these bots quietly generate ghost ad impressions, while trying to fly under the radar to avoid detection. Even though this carries no real-world value for advertisers, it can silently pollute analytics and reporting statistics if left unchecked.

How we mitigated

To neutralize this non-human traffic without impacting legitimate operations, we implemented a multi-layered filtering system at the very edge of our network infrastructure. By analyzing the traffic patterns, we identified the unique footprints of these automated bots and configured our proxy servers to intercept and drop their requests before they could ever reach our delivery nodes. This approach ensures that the invalid traffic is completely absorbed at the perimeter for virtually zero computing cost, keeping the platform’s shared data backend clean, statistics accurate, and campaigns running smoothly.

How our subscribers benefit

This scenario highlights the operational advantages of our multi-tenant cloud service. Because all accounts run within our globally managed, highly optimized hosting infrastructure, subscribers benefit from automatic protection without needing to monitor traffic anomalies or manage security rules themselves. Our platform isolates and handles live logging efficiently, and deploys platform-wide countermeasures instantly.

This shields subscribers from skewed statistics and ensures that automated bot volume targeting the network don’t cause any delivery delays, reporting slowdowns, or performance issues for our systems and our subscribers. And since the monthly subscription fee and overage use payments are based on actual volumes, any traffic that we can block so it doesn’t make it into the statistics, means subscribers don’t have to pay more than necessary.

Enterprise-Grade Security at an Affordable Price Point

What makes this level of protection unique is how accessible it is for businesses of all sizes. By hosting a very large number of subscribers all around the world on a unified cloud architecture, we achieve significant economies of scale. This allows us to provide enterprise-grade monitoring, custom anomaly detection, and proactive security perimeter filtering to every single subscriber, while still keeping our monthly subscription fees very modest. Subscribers benefit from a world-class infrastructure defense system that would normally cost hundreds or even thousands of dollars per month to build and maintain independently, all bundled into a very affordable cloud service.

How we plan to fight non-human traffic in the future

While this current wave of invalid traffic has been successfully neutralized on our platform, we will continue to monitor our systems closely to stay ahead of any evolving bot tactics. Furthermore, as the core maintainers of the Revive Adserver open-source project, we are currently evaluating how we can bring an additional level of protection to the wider community. We are looking into contributing new functionality to the Revive Adserver Download edition that introduces a cryptographic signature directly to the impression logging pixels. This level enhancement would allow servers to mathematically verify each request and block these types of “replay attacks” directly within the core software, even when a self-hosted user of  Revive Adserver doesn’t have the kinds of filtering capabilities that we have. Any enhancements we add to the Download edition will also make it into the Revive Adserver Hosted edition immediately, ensuring that everyone across our ecosystem benefits equally from these ongoing security advancements.

The advantage of choosing Revive Adserver Hosted edition

Ultimately, this experience demonstrates that modern ad serving requires active, enterprise-grade infrastructure security. When you choose the Revive Adserver Hosted edition, you are backed by a unique operational synergy: the experienced software development team that actively maintains the Revive Adserver open-source codebase, combined with the specialized infrastructure staff at Aqua Platform who run the underlying cloud infrastructure. Partnering directly with these core experts ensures your ad serving is defended around the clock, allowing you to run your campaigns with total peace of mind.