Excluding domains one by one is losing the war: the farm just creates another one. Defending yourself properly takes the two things this lesson teaches: scoring a site with objective signals (so you can decide without visiting thousands of sites) and grouping domains by their fingerprint (so you can exclude the whole network when one of them falls).
Scoring a site: the farm signals
An automated analyser visits the domain and measures:
| Signal | What it indicates |
|---|---|
| Ad density (ad blocks per screen, ad network scripts) | Sites made for advertising: 5-10+ blocks per page |
| Content that is copied (duplicated on other sites), generated (templates, meaningless text) or minimal | No editorial value |
| No author, no contact details, no "about us", no legal notice | Nobody stands behind it |
| Domain age (recently registered) and a hidden registrant | Disposable domains |
| ads.txt with dozens of sellers, or with IDs shared with other suspicious domains | Resold inventory; the same operator |
| Technology: the same cheap template again and again | A site factory |
| Redirects and pop-ups | Forced traffic |
Each signal adds points; the total (0-100) is the farm score. With thresholds:
70 exclude, 40-70 watch, < 40 legitimate.
The trust signals that clear a site
So that serious publishers (which also carry plenty of ads) are not condemned, the analyser subtracts points for signals of legitimacy:
- A CMP (a genuine consent banner): serious sites comply with the GDPR; farms rarely do.
- A trust seal / company registration or VAT number / an identifiable company, with tax details.
- A real blog or editorial section with authors and dates.
- Active social media profiles linked from the site.
- Structured data (schema.org for organisation, article).
- Archive presence (visible in web archives going back years), and domain longevity.
- Its own email (MX records on the domain), DNSSEC, its own app.
- A clean ads.txt (few sellers, direct).
With a cap on the discount (a site with every trust signal but extreme ad density is still suspicious), and with vetoes that no discount can cancel: illegal content, deceptive redirects, a language that does not match the market.
Grouping by fingerprint: network clustering
This is the decisive advantage. The domains of a single farm share infrastructure:
| Fingerprint | How you get it | What it links |
|---|---|---|
| Server IP | DNS resolution | Same hosting (with care: shared hosting exists) |
| Name servers (NS) | DNS | Same provider/operator |
| RDAP record (registrant, dates, registrar) | Public lookup | Same owner (if not hidden) or the same pattern of dates |
| Publisher ID in ads.txt (AdSense / Ad Manager pub-ID) | The domain's public file | The same payment account: the strongest signal of all |
| Template and technology | Page analysis | The same factory |
When an excluded domain shares its pub-ID, NS and IP with twenty others that have not yet spent a euro of yours, all twenty are excluded before they ever show up. That is the move from reactive to proactive: exclude the network, not the domain. (Querying sellers.json, the companion to ads.txt, is not viable from Apps Script because of its size; from your own server it is.)
The complete process
- Placement report (Display, video, PMax) every night → list of new domains.
- For each domain: analyse (farm signals − trust signals − vetoes) → score.
- Domains with a high score → account-level exclusion list.
- For each excluded domain: fingerprint (IP, NS, RDAP, pub-ID) → look for siblings in the census → exclude the family.
- Human review of the possible false positives (legitimate sites with a high score): an "to review" tab with a checkbox to reinstate them.
- A shared census: what one account learns protects the rest.
False positives: the other side of it
An aggressive analyser excludes regional press with lots of ads, or legitimate blogs on cheap templates. Hence: weighted trust signals, thresholds by sector, a whitelist of Safe Sites (and a "harvest campaign" to discover them), and human review of anything doubtful. The cost of a false positive is losing a bit of reach; the cost of a false negative is paying a farm. Calibrate knowing which one you prefer.
💡 Ninja trick: Ninja Shield is exactly this process: the Site Analyzer (now on our own server, because many farms block Google's IPs) scores every domain with farm and trust signals, the farm detector groups by IP, NS, RDAP and pub-ID, the exclusions go to the account list, the false positives tab lets you reinstate with a checkbox, and the census is shared across accounts. What this lesson describes in six steps happens every night.
What you should remember
- Farm score = rubbish signals (density, content, nobody responsible, recent domain, ads.txt) − trust signals (CMP, company number, blog, social profiles, schema, longevity, MX), with a cap and with vetoes.
- Fingerprint clustering (IP, NS, RDAP, pub-ID) excludes the whole network, including the domains that have not spent anything yet.
- A nightly process with human review of false positives and a whitelist.
- What one account learns protects the rest.