danny - 4:33 am on Nov 5, 2003 (gmt 0)

ibiza: Remember that Google has information not only about click-throughs but also about impressions, and over large stretches of time and huge numbers of sites. And all the information from Google itself, too! The script kiddie approach you describe is never going to work for more than peanuts, and that only at the risk of losing legal income from real sites.

I think even big-time criminals are going to find stealing much from AdSense hard: first they'd have to steal Alexa's accumulated user-tracking data (or something like that), then they'd have to find some data-mining PhDs to do their dirty work for them, then they'd have to trojan tens of thousands of computers around the world, ... and they'd still have to risk real sites with real traffic as well.

I think the real threat to AdSense is from attacks on publishers, through attempts to raise "false positives" in the fraud detection system.