Why you got that ad, in plaintext - Vishwanath Subramanian

Skip to content

Vishwanath Subramanian

Data & AI

Search for:

Right now, the reason you got an ad is actually sitting in plain text in a network request that you can read yourself. The browser doesn’t see every server‑side decision, but it shows enough to be informative and useful. The targeting is just written down and you can read it with a browser you already have with no paywalls. For now its still readable so enjoy the last stage of this glorious era as it starts to go quiet. My focus here is to pull one apart in about five minutes with a browser.

By the end of this, you will know:

how to find ad-related network requests in Chrome DevTools

identify which ad server is filling a given slot (Google Ad Manager, Xandr, Magnite, and so on)

read the query-string parameters in an ad request: site, zone, size, key-values, deal IDs

spot the third-party pixels that fire alongside the ad (verification, measurement, cookie syncs)

If you can do that, you can get a general sense of what’s going on with any ad on the internet you come across.

Open any news site (cnn works great). Hit F12, go to the Network tab, and type gampad/ads in the filter box.

A list of calls to securepubads.g.doubleclick.net/gampad/ads shows up. Click one.

F12 on CNN, Network tab, filter set to gampad/ads. Every row is an ad call going out as the page loads.

That query string is what we came for. You don’t need access to anyone’s ad server – you only need to know which requests to read.

As you already noticed on the Network tab – there’s a flurry of activity when you load that webpage, every ad on the web leaves a trail of network requests , the ad server is firing, the parameters are being passed around and tracking pixels are pushed into the network.

The Cheat code: filter strings worth memorizing

Type these into the Network tab filter box, one at a time:

FilterWhat it surfacesgampad/adsGoogle Ad Manager (GAM) ad requests (securepubads.g.doubleclick.net/gampad/ads?...)doubleclickAnything GAM/Google related, including impression pixelsprebid or hb_Header bidding activityadnxsXandr (formerly AppNexus)rubicon or magniteMagnitepubmaticPubMaticcriteoCriteo retargetingpixel or syncCookie syncs and tracking pixels.gifOld-school 1×1 impression pixels

Typing magnite surfaces every call to that exchange.

The domain tells you the vendor and after a couple of weeks of doing this, if so inclined, you’ll start to be very well acquainted with these frequent visitors.

Anatomy of a GAM ad request (Google Ad Manager)

Most of the open web runs through GAM, so its easy to dissect one of its requests.

Find a call to securepubads.g.doubleclick.net/gampad/ads and click it.

The filtered list of gampad/ads calls. Each row is one Google Ad Manager request; click any one to open its request URL.

The query string is long and ugly like those Chrome auto-generated passwords, but a handful of parameters do most of the talking:

https://securepubads.g.doubleclick.net/gampad/ads?<br>iu=/1234567/news_homepage/leaderboard

The same parameters on a real CNN request, scrubbed. iu_parts marks the slot, cust_params carries the targeting.

Two of these you’ll use constantly:

iu tells you which slot. If the homepage leaderboard (first ad you see on the page) isn’t serving, iu confirms the request went out.

cust_params is what the page tells the ad server about you and the page. If a campaign targets section=sports but isn’t delivering, we can check if the page is actually sending section=sports.

If you’re looking at a programmatic deal, hunt for a deal ID in the response or in the header-bidding requests (often a dealid parameter – like hb_deal/hb_deal_ttd header-bidding deal IDs passed from The Trade Desk (ttd) into GAM, amzndeal is an Amazon Publisher Services deal, amznactt=SHARED_PMP confirms it’s a shared private marketplace deal and so on)

Filter for hb_pb or prebid – those are the most likely places to catch deal IDs in flight.

Note – If there is no dealid – this likely means no programmatic deal is being requested. It’s running in open auction. Usually premium sites like WSJ, Guardian etc will have deal IDs all over the place. Like most things in adtech, there are exceptions and these usually apply for standard setups,

Following the chain: who actually served the ad

Now that you know the key parameters to look for the ad request, the next step is to figure out who actually served it.

The ad response is either the creative or a redirect chain (i.e. I asked someone else to serve it at a price). To see who served the ad from who merely resold the impression, follow the hops:

Example: Guardian homepage leaderboard

The Guardian leaderboard, hop by hop. The GAM request, the impression pixel, the creative from s0.2mdn.net, then the verification calls riding along.

1. First hop – Publisher’s ad server:...