What is SSAI spoofing?
SSAI spoofing is a connected-TV fraud where servers pretend to be a server-side ad insertion system requesting ads on behalf of real TVs. Because legitimate SSAI traffic naturally comes from a few server IPs for many viewers, fraudsters imitate it to generate millions of fake CTV ad requests that look like genuine streaming viewers, and collect high CTV prices.
In streaming, SSAI stitches ads into the video on the server side, so the ad request comes from the streaming provider's server, not from the viewer's TV. The server forwards details about the device in headers. SSAI spoofing exploits this: a fraudster's servers fabricate those device details and forward "viewers" that do not exist, often cycling through realistic device IDs, IP addresses and app names.
HUMAN (then White Ops) described one such operation, ICEBUCKET, in 2021 as among the largest SSAI spoofing schemes it had seen. Defenses include verifying that SSAI servers are declared by the publisher, the IAB Tech Lab's guidance on passing consistent device signals, ads.cert signing, and measurement that checks device and IP consistency across requests. It is a key reason CTV fraud remains a priority for buyers.