In-app bidding has automated most waterfall optimization, yet developers still manage multiple hybrid waterfalls, each with dozens of manual instances. Naturally, this can be timely and overwhelming to maintain, keeping you from optimizing to perfection and focusing on other opportunities to boost revenue.Rather than analyzing each individual network and checking if instances are available at each price point, breaking down your waterfall into different CPM ranges allows you to visualize the waterfall and easily identify the gaps.Here are some tips on how to use CPM buckets to better optimize your waterfall’s performance.What are CPM buckets?CPM buckets show you exactly how much revenue and how many impressions you’re getting from each CPM price range, giving you a more granular idea of how different networks are competing in the waterfall. CPM buckets are a feature of real time pivot reports, available on ironSource LevelPlay.Identifying and closing the gapsTypically in a waterfall, you can only see each ad network’s average CPM. But this keeps you from seeing ad network distribution across all price points and understanding exactly where ad networks are bidding. Bottom line - you don’t know where in the waterfall you should add a new instance.By separating CPM into buckets, (for example, seeing all the ad networks generating a CPM of $10-$20) you understand exactly which networks are driving impressions and revenue and which CPMs aren’t being filledNow how do you do it? As a LevelPlay client, simply use ironSource’s real time pivot reports - choose the CPM bucket filter option and sort by “average bid price.” From here, you’ll see how your revenue spreads out among CPM ranges and you’ll start to notice gaps in your bar graph. Every gap in revenue - where revenue is much lower than the neighboring CPM group - indicates an opportunity to optimize your monetization strategy. The buckets can range from small increments like $1 to larger increments like $10, so it’s important to compare CPM buckets of the same incremental value.Pro tip: To best set up your waterfall, create one tab with the general waterfall (filter app, OS, Ad unit, geo/geos from a specific group) and make sure to look at Revenue and eCPM in the “measures” dropdown. In the “show” section, choose CPM buckets and sort by average bid price. From here, you can mark down any gaps.But where do these gaps come from? Gaps in revenue are often due to friction in the waterfall, like not enough instances, instances that aren’t working, or a waterfall setup mistake. But gaps can also be adjusted and fixed.Once you’ve found a gap, you can look at the CPM buckets around it to better understand the context. Let’s say you see a strong instance generating significant revenue in the CPM bucket right below it, in the $70-80 group. This instance from this specific ad network has a lot of potential, so it’s worth trying to push it to a higher CPM bucket.In fact, when you look at higher CPM buckets, you don’t see this ad network anywhere else in the waterfall - what a missed opportunity! Try adding another instance of this network higher up in the waterfall. If you’re profiting well with a $70-80 CPM, imagine how much more revenue you could bring at a $150 CPM.Pro tip: Focusing on higher areas in the waterfall makes a larger financial impact, leading to bigger increases in ARPDAU.Let’s say you decide to add 5 instances of that network to higher CPM buckets. You can use LevelPlay’s quick A/B test to understand if this adjustment boosts your revenue - not just for this gap, but for any and all that you find. Simply compare your existing waterfall against the new waterfall with these 5 higher instances - then implement the one that drives the highest instances.Božo Janković, Head of Ad Monetization at GameBiz Consulting, uses CPM buckets "to understand at which CPMs the bidding networks are filling. From there, I can pinpoint exactly where in the waterfall to add more traditional instances - which creates more competition, especially for the bidding networks, and creates an opportunity for revenue growth."Finding new insightsYou can dig even deeper into your data by filtering by ad source. Before CPM buckets, you were limited to seeing an average eCPM for each bidding network. Maybe you knew that one ad source had an average CPM of $50, but the distribution of impression across the waterfall was a black box. Now, we know exactly which CPMs the bidders are filling. “I find ironSource CPM buckets feature very insightful and and use it daily. It’s an easy way to identify opportunities to optimize the waterfall and earn even more revenue." -Božo Janković, Head of Ad Monetization at GameBiz ConsultingUnderstanding your CPM distribution empowers you to not only identify your revenue sources, but also to promote revenue growth. Armed with the knowledge of which buckets some of their stronger bidding networking are performing in, some publishers actively add instances from traditional networks above those ranges. This creates better competition and also helps drive up the bids from the biddersThere’s no need for deep analysis - once you see the gaps, you can quickly understand who’s performing in the lower and higher buckets, and see exactly what’s missing. This way, you won’t miss out on any lost revenue.Learn more about CPM buckets, available exclusively to ironSource LevelPlay here.

Jun 13, 2025Ravie LakshmananWeb Security / Network Security Cybersecurity researchers are calling attention to a "large-scale campaign" that has been observed compromising legitimate websites with malicious JavaScript injections. According to Palo Alto Networks Unit 42, these malicious injects are obfuscated using JSFuck, which refers to an "esoteric and educational programming style" that uses only a limited set of characters to write and execute code. The cybersecurity company has given the technique an alternate name JSFireTruck owing to the profanity involved. "Multiple websites have been identified with injected malicious JavaScript that uses JSFireTruck obfuscation, which is composed primarily of the symbols [, ], +, $, {, and }," security researchers Hardik Shah, Brad Duncan, and Pranay Kumar Chhaparwal said. "The code's obfuscation hides its true purpose, hindering analysis." Further analysis has determined that the injected code is designed to check the website referrer ("document.referrer"), which identifies the address of the web page from which a request originated. Should the referrer be a search engine such as Google, Bing, DuckDuckGo, Yahoo!, or AOL, the JavaScript code redirects victims to malicious URLs that can deliver malware, exploits, traffic monetization, and malvertising. Unit 42 said its telemetry uncovered 269,552 web pages that have been infected with JavaScript code using the JSFireTruck technique between March 26 and April 25, 2025. A spike in the campaign was first recorded on April 12, when over 50,000 infected web pages were observed in a single day. "The campaign's scale and stealth pose a significant threat," the researchers said. "The widespread nature of these infections suggests a coordinated effort to compromise legitimate websites as attack vectors for further malicious activities." Say Hello to HelloTDS The development comes as Gen Digital took the wraps off a sophisticated Traffic Distribution Service (TDS) called HelloTDS that's designed to conditionally redirect site visitors to fake CAPTCHA pages, tech support scams, fake browser updates, unwanted browser extensions, and cryptocurrency scams through remotely-hosted JavaScript code injected into the sites. The primary objective of the TDS is to act as a gateway, determining the exact nature of content to be delivered to the victims after fingerprinting their devices. If the user is not deemed a suitable target, the victim is redirected to a benign web page. "The campaign entry points are infected or otherwise attacker-controlled streaming websites, file sharing services, as well as malvertising campaigns," researchers Vojtěch Krejsa and Milan Špinka said in a report published this month. "Victims are evaluated based on geolocation, IP address, and browser fingerprinting; for example, connections through VPNs or headless browsers are detected and rejected." Some of these attack chains have been found to serve bogus CAPTCHA pages that leverage the ClickFix strategy to trick users into running malicious code and infecting their machines with a malware known as PEAKLIGHT (aka Emmenhtal Loader), which is known to server information stealers like Lumma. Central to the HelloTDS infrastructure is the use of .top, .shop, and .com top-level domains that are used to host the JavaScript code and trigger the redirections following a multi-stage fingerprinting process engineered to collect network and browser information. "The HelloTDS infrastructure behind fake CAPTCHA campaigns demonstrates how attackers continue to refine their methods to bypass traditional protections, evade detection, and selectively target victims," the researchers said. "By leveraging sophisticated fingerprinting, dynamic domain infrastructure, and deception tactics (such as mimicking legitimate websites and serving benign content to researchers) these campaigns achieve both stealth and scale." Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

On-device channels are no longer all about preloads. Today, telcos represent another performance marketing channel with transparent reporting and deeper insights. To get the full picture behind the performance of your on-device campaigns, it’s critical to prioritize long-term KPIs. It’s the only way the stickiness of users acquired through these channels really shine. Why?On-device campaigns reach users when they’re setting up their new devices and looking to download apps they’ll use throughout the device lifetime, not necessarily right away. Think about it - if you download a booking app from an ad during device setup, are you planning to book a vacation immediately or later down the road?This means attribution is a waiting game for on-device campaigns, with day 30 as the turning point. In fact, if a user engages with your app 30 days down the line, they’re more likely to stay active for a long period of time. Simply put, LTV is high for on-device campaigns. This means you want to be looking at KPIs that allow you to measure and optimize the value of the users you attract far down the road.ROASROAS is king when it comes to measuring the long-term value of your users. To get the clearest idea of your ROAS and how to optimize it, there are a few things to keep in mind. First, ROAS should be measured on D30/60/90 not D1/3/7. This is because, with on-device channels, users are likely to open an app within the first 30 days or longer - when a user downloads an app during device setup, they do so expecting to open it in the future, not right away.You should also pay attention to how it’s being measured. ROAS is calculated by dividing the amount of revenue a campaign generates by the amount it costs to run it. In the context of on-device campaigns, that revenue comes from in-app purchases, subscriptions, or ad monetization.When measuring the effectiveness of your on-device campaigns, it’s important to calculate ROAS using your on-device ad revenue rather than average ad revenue, which will be lower. That’s because ad revenue is high for users acquired through on-device campaigns - on-device channels use unique data points and deep algorithms to ensure the right bid for each individual user. To get the clearest picture of where you stand in relation to your ROAS goals, you should integrate ad revenue with your on-device platform.Once calculated, ROAS gives a clear monetary view of your campaigns, so it’s clear how much you spent vs brought in. This monetary value is important because it tells you if your on-device campaigns are reaching valuable users. Looking at ROAS by placements, you get insight into which placements are doing it best. With the knowledge of how to maximize ROAS, you’ll maximize the long term value and engagement of your users, too.Cost KPIsComparing LTV to spend will help you determine whether or not your users are spending enough to cover your spend and ultimately turn a profit. You can even pinpoint areas of your strategy that are effective, and those that may need adjustment.There are a few ways to measure cost effectiveness. Here are the most common two, especially for on-device campaigns.Cost per action (CPA)If it’s quality you’re looking for, first, run a CPA campaign to confirm that you’re looking in the right places for users who will engage with your app. To count as a conversion, users must see the ad, install the app, and complete the action you preset. You’ll only pay for the users who reach a chosen point in the app experience after installation. A CPA that is higher than LTV is a clear indicator that your campaigns are focused on less relevant channels or touchpoints, while a CPA that is lower than your LTV confirms that you are attracting high quality users.In the context of on-device campaigns, this is key because it means you won't pay immediately for a user who may not engage for a month or so. The pricing model also integrates in-app revenue, which is useful for apps that rely more on IAPs than ads.Cost per retained user (CPRU)It’s also worthwhile to keep track of how much you’re paying for the user that’s still there on day 30. CPRU takes into account conversions and retention rate - if your budget is $10k, you have 1000 conversions and a day 1 retention rate of 20%, you come away with 200 converted users at a $50 per user acquisition cost. If you can increase retention, you end up with higher quality users at a lower CPRU.Measuring CPRU, retention becomes a success metric for your UA campaigns and can help you determine whether you have enough engaged users to cover spend.On day 30 and beyond, these KPIs can help you optimize your on-device campaigns to reach the most engaged users with high LTV.