How pirates are using cloaking to deceive traditional brand safety tools

“Cloaking” is an increasingly prevalent technique used by pirate websites to avoid being flagged as high risk.

Traditional brand safety tools, used by the ad industry to check if a website is safe for ad placement, cannot keep up with the dynamism of this phenomenon, highlighting the importance of scoring publisher websites for IP infringement risk in real-time.

White Bullet’s real-time scoring system for IP infringement is using advanced technology to address this problem.

Cloaking is a technique by which pirates set up or interact with a website with an innocent-sounding domain name and non-IP infringing content.

However, just before a popular sporting (or other live stream) event begins, an unauthorised stream is injected into the previously non-infringing URL, either by the website itself or through manipulation of the website by external pirates.

Links to the infringing content are then posted in social media networks minutes before the stream goes live.After the live event ends, the unauthorised streams are removed, and the webpage reverts to the original “brand safe” content. This circumvents traditional “lazy” keyword-based flagging for IP infringing websites, avoids any form of “static” blocklist, and frustrates weak techniques that classify only on website type, demography or overall content.

In essence, only specific webpages temporarily become IP infringing during certain specific times of the week.This means advertising flows and funds the website both when it has non-infringing content presented, and during the distribution of illegal or unauthorised content.

A prime example of a website manipulated by cloaking is healthfirstnews.com , which appears to be safe from IP infringement for much of the time and has no IP infringing streams or indeed any streaming content.

However, White Bullet’s dynamic scoring technique analysed that website during play time for recent Premier League football matches and found healthfirstnews.com hosted many illegal streams of those matches as they were being played live. In all cases, premium advertising was being placed against, and therefore funding, those infringing streams.White Bullet found healthfirstnews.com is one of the hundreds of cloaking websites used by pirates to enable and monetise illegal live streaming.

Cloaking should not be confused with URL masking, where the URL appears to be brand safe in name but consistently displays unsafe content on the webpage. Cloaking will see the IP infringing URL return to non-infringing content once the live stream has ended.

The practice of cloaking is deceiving traditional ad industry brand safety tools into evaluating IP infringing websites as non-infringing, and therefore brand safe, in two key ways. Firstly, as cloaking websites only infringe intellectual property for a few hours each week and at irregular intervals, many traditional brand safety tools currently deployed by the digital advertising industry evaluate these websites statically as non-infringing. Secondly, the use of cloaking websites is highly dynamic, with pirates deploying multiple and ever-changing cloaking domains to hide their illegal activity.

Without dynamic next-generation brand safety tools that score websites for IP infringement risk in real-time, cloaking websites will continue to be saturated with advertising, putting brands at risk. Brands and ad companies alike need to be aware of these techniques and adopt the technology needed to address it.

For more information on cloaking, advertising safety and IP infringement please contact

info@white-bullet.com or visit www.white-bullet.com .