.svg)
.svg)
알라미 앱을
다운받아보세요
다운받아보세요
QR코드를 촬영하시면
앱을 다운 받을 스토어로 이동합니다.
앱을 다운 받을 스토어로 이동합니다.
%201.svg)
Your app's rating drops 0.3 stars overnight. Open the reviews and they read one after another: "the ads are way too explicit," "is this a scam ad?" You added a placement to lift ad revenue, that placement served a malicious creative, and now the whole app's reputation is taking the hit.
For an app serving 500,000 impressions a day, even 0.01% malicious creatives means 50 bad experiences daily. Assume 10% of those users leave a review and that's 5 a day, or 150 negative reviews a month. The problem isn't that malicious creatives exist. It's how fast you find and respond to them. Catch it in 3 days and 150 cases have already piled up; catch it the same day and you cap it at 50; catch it within an hour and you stop at 2. Depending on whether you have a monitoring system, the damage varies by tens to hundreds of times.
DSPs and ad platforms run creative review systems. Large platforms like Google and Meta pair machine-learning-based automated review with human review. They still get through, for a simple reason: the more provocative the creative, the higher its CTR and CVR, and advertisers have every incentive to pay a higher CPM for it. Slipping past review is a rational investment for an advertiser.
The simplest method is brute force. Advertisers rotate blocked domains constantly, or spin up several at once, to render a blacklist useless. For apps, they do the same with package-name changes or mass app creation. They register the same creative under multiple Creative IDs to defeat per-creative blocking. Some run hundreds of creative variants at once to overload review throughput. With advertisers now churning out AI-generated creatives indiscriminately, provocative creatives slip back in when you block them, and slip back in more cunningly when you block them again.
The more cunning method is to deceive the system itself. The advertiser passes review with a clean creative, then swaps in a provocative version once it's live. These creatives are often concentrated at night or on weekends, when review staffing is thin. There's also cloaking: showing the review bot a normal creative and real users a different one. Hide the final landing URL behind several redirect hops and tracking itself becomes hard.
The hardest case is the borderline creative. These are creatives literally "on the line." The judgment shifts depending on who's reviewing and who your app's users are. Some look problematic at a glance but turn out clean on a closer look. They leave a user wondering, "am I reading too much into this?" These creatives are hard to justify blocking, and they pass platform review too. Chinese e-commerce company T is a prime example. Once you reach this point, "should we even block it" becomes a judgment call in itself.
.png)
Borderline creatives like these are even harder to stomach on a small mobile screen.
Blocking incurs a resource cost and a revenue cost at the same time.
Start with the resource cost. Finding the problem creative, capturing it, requesting the block, and confirming it's processed: each case takes more than 20 minutes. Block it and the advertiser comes back with a new domain and a new Creative ID. More than 20 hours a month gets tied up in repetitive work. Areas that require judgment, like borderline creatives, can't be solved by automation alone. In the end, a person has to look.
The revenue cost is large too. Blocking a malicious advertiser doesn't change your ad request count. It only thins out the competing bidders, so eCPM falls. Block a high-volume advertiser and you feel the drop immediately. Protect the user experience and revenue slips; protect revenue and the user experience breaks. Blocking isn't a question of "whether." It's a question of "how much you can absorb."
Don't be too quick to say, "obviously that's an ad. Who would mistake it for an in-app dialog?" Lookalike creatives keep appearing because people do fall for them.
Try to block every malicious creative and your resources won't hold up. You need priorities. First priority is creatives that clearly upset users: outright fraud, phishing, explicit content. These hit users directly and damage the brand. Second priority is borderline creatives. Judge those against your internal standards and whether actual VoC has come in.
You also have to decide the scope of a block. Per-creative blocking is precise, but advertisers route around it with a new ID. Per-domain blocking solves it in one move, but it can also block legitimate creatives and hit revenue hard. Treat repeat violations at the domain level and one-off cases at the creative level. The creative's impression count, the countries it serves in, and the age range of your core users all factor in. You need a decision standard that weighs all of this together.
If it's just a kiss, should the ad count as explicit? Everyone's standard is different, so you have to weigh several criteria around the creative's actual impact.
Perfect blocking is impossible. Try to stop every malicious creative and your resources run dry; block your high-volume advertisers too and revenue collapses. Leave it unattended and the user experience breaks. The sweet spot sits somewhere between defense and monetization.
The problem is that this balance point doesn't stay fixed. Advertiser tactics keep evolving. The domain you blocked today comes back as a new domain tomorrow; the blocking standard that worked this month gets routed around next month. Platform policies change, new advertisers appear, and user sensitivity shifts too.
This isn't a one-time project. It's ongoing operational work. You have to put a monitoring system in place, review your blocking standards regularly, and keep adjusting the balance between resources and revenue. The spear keeps getting sharper, and advertisers keep finding more cunning methods. This fight doesn't end once you've sorted it out once. Someone has to keep holding the shield.
Track your blocking activity week by week and it ends up looking like this.
.png)
