How to Detect MFA Inventory Before You Launch

Four signals give MFA away: how much of the page is advertising, whether the ads refresh on their own, how old the domain is, and where its traffic comes from. Any two pointing the wrong way is enough to exclude.

You can check all four in a browser, without buying anything. But nobody is opening four thousand domains one by one, so the point of doing it by hand isn't coverage. It's calibration: look closely at twenty domains carrying real spend, learn what the problem looks like in your own inventory, then apply that pattern at scale.

Why blocklists don't get you there

Most advice on MFA amounts to "use a good exclusion list". It isn't wrong, it's just insufficient, and the reason matters.

MFA is not a type of website. It's a business model: buy traffic cheaply, usually through paid social or recommendation widgets, monetise it through ad density, keep the difference. The content exists to hold the ads apart.

Once you see it as a model rather than a category, the limitation of lists is obvious. Domains are cheap and disposable. An operator running the model can spin up fifty new properties in a week, fill them, and route the same purchased traffic through them. Every list records where MFA was. None of them describe what it is.

Lists are a floor. They catch the known offenders and cost you nothing. They will not catch what launched on Monday.

The signals worth checking

Ad-to-content ratio. The most reliable single indicator. Open the page and look at how much of the visible screen is advertising before you scroll. On MFA properties, ads dominate the viewport and content is what fills the gaps. Trust what you see rather than a viewability score.

Refresh and rotation behaviour. Sit on the page and watch. Ads that rotate on a timer, reload without interaction, or stack on scroll are inflating impression counts on a single visit. This is what turns bought traffic into a margin.

Domain age and history. A recently registered domain with no organic search presence, serving significant ad volume, has not built an audience. It bought one. A free whois lookup gives you the registration date, and searching the domain name tells you whether anything about it exists outside its own pages. Fastest disqualifier available.

Traffic sources. If the audience arrives overwhelmingly from paid social or content recommendation widgets rather than from search, direct or referral, the arbitrage is confirmed. Legitimate publishers have a traffic mix. Arbitrage operations have a funnel.

Content quality. Increasingly, generated text with a repetitive structure, thin pages built around a keyword, articles split across many pages to multiply ad slots. Read two paragraphs. You'll know.

How the page behaves via a referral link. Some properties render differently for direct visits than for traffic arriving from an ad or a widget. Always check the path a real user would take, not the one you'd take.

Two of these signals are also available without opening anything. OpenSincera publishes ads-to-content ratio, ad refresh rate, ads-in-view and page weight at domain level, free and via an API. It won't tell you a site is MFA, that judgment stays yours, but it turns two of the four checks into something you can pull for a whole list rather than one page at a time. Which is how you get from calibration to coverage.

MFA and ad clutter are not the same problem

This distinction gets collapsed constantly and it leads to bad decisions.

MFA is arbitrage. The site exists because the model works. There is no version of that inventory you want.

Ad clutter is a legitimate publisher over-monetising. Real audience, real content, too many ad slots. Performance suffers for the same mechanical reason, but the site is not an arbitrage operation and may be perfectly reasonable inventory in a lighter format or a different placement.

Treating both as a single blocklist problem means excluding publishers you'd want, and it means you never have the conversation about placement that would fix it.

Excluding versus including

Everything above assumes you're building a list of what to keep out. That's the default approach, and it has a structural problem worth naming.

If MFA is a business model rather than a fixed set of sites, exclusion is a race you don't finish. Domains are cheap. An operator can replace what you blocked faster than you can block it. Every exclusion list is accurate about last month.

An allowlist inverts the problem. Instead of naming what fails, you name what qualifies, and anything unknown is out by default. Fifty new arbitrage domains launching this week have no effect on you, because they were never on the list.

That's the honest case for it. Here's the honest cost.

You lose reach, and not a little. Every publisher you haven't got around to vetting is excluded alongside the ones you meant to exclude. On campaigns that need volume, this bites immediately.

Someone has to maintain it. A list built in March and left alone is a different kind of stale: it holds sites that have since been sold, redesigned, or quietly loaded with ad slots. Allowlists don't decay as visibly as blocklists, which makes them easier to neglect.

It's slow to build properly. Doing it well means qualifying sites rather than collecting domains, and that work doesn't compress.

So the trade-off is real and it isn't ideological. Exclusion protects reach and chases the problem. Inclusion protects quality and costs volume. Branding work where the environment matters tends to justify the allowlist. Performance work that needs scale is usually better served by exclusion plus active monitoring, because the reach cost lands directly on the outcome you're measured on.

Most teams end up running both: a blocklist as the floor, an allowlist on the campaigns where quality is the point.

And it's worth seeing the third option for what it is. A curated deal is an allowlist that someone else built. Same mechanism, same benefits, same maintenance question, except the list is assembled and maintained by a third party and you may not get to see inside it. Which brings back the question worth asking of any pre-packaged pool: when was it built, and what has updated it since.

What people get wrong

Optimising toward metrics that select for MFA. This is the expensive one. MFA inventory produces impressions in volume and click rates that look acceptable. A campaign optimising on impressions, CPM efficiency or CTR will drift toward it automatically, because on those metrics it genuinely performs. The damage sits downstream in conversion quality and attention, where nobody is looking during the flight.

Blocking after the fact. Post-campaign exclusion feels like control and arrives too late. The impression was paid for when it served. Whatever you exclude in week three, you funded in weeks one and two.

Trusting the label on a deal. A curated pool described as premium is a claim about intent, not a description of contents. Deals are assembled at a point in time and rarely updated afterwards. If a source in the pool drifted, the label didn't change with it.

Assuming quality filters cover it. Standard brand safety and invalid traffic measurement look for different things. A site can be brand safe, free of invalid traffic, and still be pure arbitrage. Nothing about MFA is technically fraudulent, which is exactly why fraud detection misses it.

Assuming you can always act on what you find. Often you can't. On a curated deal supplied by a partner, you may not have the domain list at all, and excluding a single source from someone else's pool is frequently not an option. That doesn't make the check pointless, it changes what you do with it: the finding becomes a question for the partner, and an input into whether that deal stays in the plan.

What to do next

Before the campaign, calibrate. Take the twenty or so domains carrying the most projected spend, check the four signals on each, and cut what fails. You are not auditing the whole inventory, you are learning what the failures look like here so you can recognise them in a report.

Then scale what you learned. Pull the density and refresh metrics for your full domain list from an open source, sort by the thresholds your manual check told you mattered, and work the outliers. The manual pass tells you where to set the line, the data tells you who crosses it.

If you want to run those checks across a full list rather than domain by domain, our sitelist checker is free and requires no signup.

During the campaign, watch for the shape rather than the score. Sudden impression volume from a domain you don't recognise, high impressions with weak downstream outcomes, ad-heavy pages appearing in placement reports. Those patterns are visible in your own reporting without any additional product.

And when a deal is presented as pre-filtered, ask when the filtering happened and what has updated it since. Most pools are assembled once and left as they are. If you can't see inside a deal and can't exclude from it, that answer is the only signal you'll get, which makes it worth asking properly.