Assessment: A number of new redirect campaigns entered the ecosystem last weekend, impacting over 16M impressions across the majority of Ad Lightning partners.  One campaign resolving to the "numberonevpn" and other similar domains was traced back to a malicious app, Outlaw VPN, which should be blocked by all sites as an advertiser.

Additional Details: Unique signatures are up almost 10% this week compared to the week prior, reflecting the increase in malicious activity.

Assessment: Redirect campaign attempting to disable ad blocking scripts was detected and blocked.  Over 1M ads have been infected since August 16th.

Affected platforms: Smart Ad Server

Assessment: Redirect campaign hijacking a Nike creative has been detected and blocked.  To date, over 7 million impressions have been blocked on iOS and Android devices across more than 50% of Ad Lightning's partners.

Affected platforms: Google seems to be the most heavily impacted.

Assessment: Ongoing malicious activity leveraging websockets - to fingerprint a user’s browser and load additional known malicious domains - attached to legit creative scripts.

Affected platforms: Sizmek and AOL/AdTech

Update: To date, more than a dozen unique signatures have been identified that follow the previously noted pattern and ADL has blocked over 3M ads.

Assessment: A previously identified redirect campaign was reactivated this past weekend.  This campaign leverages Google CDNs to dynamically host malicious content.

Additional Details: To date, almost 1M impressions have been blocked across both iPhone and Android devices.