Advertisers already do this, but part of the report claims that Methbot spoofs common domains. They provide a sample here: http://www.whiteops.com/methbot/domains.txt

They do whitelist. MethBot was faking URLs though so it's hard for platforms to detect that in milliseconds. This goes to the IP level at this point with that list posted online.

Our company is already getting asked to provide full reports by IP address to see how far this goes.

isn't the whitelist bound to the user? i mean if i register account as a publisher on some ad exchange, i should be asked for domains where i will be showing my ads. in that case i can not simply report that my username is generating traffic from cnn.com f.e. as this domain is not associated with my account. or this is not how it works?

Got it. So preventing domain spoofing would solve this problem. Who's job is that?

You take a decision based on an offer called the bid request, domain/url/page is part of said metadata.

The catch is that almost all fields in said offer can be faked by a malicious adversary due to lack of security/competence from the exchange.