Log-level ad fraud audit and sophisticated IVT forensics

The invalid traffic that costs you money is not the general IVT your verification vendor already filters and credits back. It is sophisticated IVT that passed filtration, and it is only visible in log-level data. On in-app accounts in Southeast Asia I typically find between four and eleven percent of open-exchange spend on traffic that fails at least two independent forensic checks. Roughly half of that is recoverable in negotiation. Not all of it, and anyone quoting you a recovery figure before seeing the logs is selling something else. The evidence: I work from your own raw logs — The Trade Desk Raw Event Data Stream or DV360 Data Transfer files landed in BigQuery — joined to your MMP event data from AppsFlyer, Adjust or Singular, and to a crawl of app-ads.txt and sellers.json taken on the same dates as the impressions rather than today. Vendor dashboards are an input, never a finding. If a claim cannot be reproduced from a SQL file I hand you, it does not go in the report. What the logs give up: Impressions per device identifier per day, where the tail is not a curve but a cliff. Device model mix against actual handset share in the country being bought, because a model holding two percent of a market does not deliver nineteen percent of your impressions. ASN classification separating consumer carriers from hosting providers. SDK version strings that were never shipped. Bundle IDs that resolve to no store listing, or resolve to one whose app-ads.txt never declared the seller that sold you the impression. Duplicated advertising IDs, zeroed IFAs, and session timing with an entropy signature no human population produces. Any one of those is an argument. Two independent ones is a claim. I write claims. Recovery: The output is an evidence pack per counterparty: findings, method, reproducible queries, date ranges, and the money attached, in a form an SSP compliance team can verify rather than dispute. I will sit in the call. What I will not do is forecast what you recover, because that depends on your contracts, how much you spend with them, and whether the SSP wants to keep you. Limits: This looks backwards. It does not stop next month's fraud on its own. The forward fix lives in supply paths and lists, which is separate work that I will scope honestly rather than bundle in here. I do not accept a percentage of recovered spend. Paid that way I am incentivised to find fraud rather than to be right, and every number in the report becomes worth less to you. I do not name partners publicly and I do not write findings for press. Do not hire me for this if: You want confirmation of a conclusion already reached internally. If the logs say the traffic is clean, that is what the report says, and you will have paid for an answer nobody wanted. You cannot get log-level access. Without raw logs this degrades into dashboard interpretation, which your team can do and which will not survive an SSP compliance review. The account runs under roughly two million US dollars a year of programmatic. Forensic work costs the same regardless of spend and below that the arithmetic does not close. Access required: read-only DSP seat, raw log export enabled, MMP read access, and one named person who can request data from the SSPs. I work in English and Mandarin and read Chinese-language SDK documentation directly, which shortens the SDK-spoofing part of the investigation considerably.