AdSecure analyzed over 50 million violation scans conducted on client campaigns in Q4, 2025. In this article, we will explore six violations that increased in this quarter. So let’s dive in!
Number of violations per campaign
1 violation was detected across over 10 million scanned campaigns, a 20.6% increase compared to the number of campaigns scanned in Q3, 2025. Additionally, the number of campaigns with 2, 3, and 4 violations increased by 14.3%, 4.8%, and 3.2%, respectively.
Technical & Ad Performance Violations
These violations pose a direct threat to the user’s safety, potentially leading to financial loss, identity theft, or malware installation. Here are the violations relating to technical and ad performance that had significant increases in Q4, 2025.
IAB Ad Weight
This violation occurs when the total file size of an advertisement, like the assets such as images, scripts, and videos, exceeds the maximum limits established by the IAB, which is typically set at 50KB for the initial load. “Heavy” ads can slow down page performance and consume excessive amounts of user data. Notably, this violation saw a 60.2% increase in detections in Q4 2025 when compared to Q3 2025.
Auto-download
Also known as a “drive-by download,” this is a high-severity violation where a website or ad triggers a file download to the user’s device automatically without consent or interaction. In Q4 2025, this violation had an increase of 48.1% detections in Q4.
IAB Ad Request Count
This measures the number of HTTP requests an ad makes to fetch resources. The IAB recommends a maximum of 10 requests to ensure the ad doesn’t negatively impact the hosting website’s load speed. In Q4 2025, detections for this violation increased by 3.6%.
Uncommon Protocols
This flags the use of non-standard or obsolete network protocols (e.g., legacy Windows protocols like LLMNR or NetBIOS) that bypass typical security filters, often used by attackers to mask data exfiltration or internal lateral movement. This increased by 8.1% in Q4.
Security & Malicious Activity Violations
Security & Malicious Activity Violations refer to digital actions specifically designed to harm users, steal sensitive data, or compromise the integrity of a system. Unlike technical errors or performance-based violations, these are characterized by malicious intent. Here are two of the most detected violations from Q4 2025.
Cryptocurrency Miner
Often also known as “cryptojacking,” this violation involves malicious JavaScript embedded in an ad or site that hijacks the visitor’s CPU/GPU power to mine cryptocurrency for the attacker, leading to device overheating and performance lag. This rose by 41.3%.
Malicious URL: Sucuri
This violation is triggered when a URL is flagged by Sucuri’s threat intelligence database as hosting malicious content, such as phishing pages, malware payloads, or known command-and-control (C2) domains. This showed a 19.6% increase.
Conclusion: Malvertising prevention in 2026
In 2026, it is crucial to invest in a strong compliance team and effective ad security software to protect your ad supply chain and users from harmful advertisements. If you are looking to effectively protect your online platform, contact our team today to learn how to start securing your ad network or website!
