Need some detective advice

Strange IPs

[anallawalla]

I was sent some IIS5 logs from a client that are supposedly from the web server. First question, how can I tell which hits came from Adwords? (I know nothing about the mechanics of using Adwords).

There are dozens of hits from 0.0.0.0, 1.0.0.0 and 1.0.0.1, which are reserved addresses. Many of the hits (overall) are dupes a second or two apart, as though lots of people run the same Google query again and again.

Some identical queries are from the same IP address on different days.

Any suggestions about what to make of these logs? My own Apache logs don't show these weird patterns.

- Ash

[VisiBone]

You want to use unique URL's for the Destination URL. See [adwords.google.com...] under "Track conversion by creative". (I think you'll need to log on.)

The way to distinguish Adwords clicks from all other traffic coming to your site is to add suffixes to the URL that distinguishes them. URL's have a property that's useful in this case that whatever appears after a question mark makes no difference when fetching static HTML. So for example the Display URL for "color codes" in one of my ads is:

 visibone.com/color/kilochart.html 

But the real link under Destination URL is:

 [visibone.com...]  

Hits from those bogus IP addresses could be hostile, but hopefully harmless, hackers. I see no such IP addresses in my logs FWIW.

By the way, I've spent TONS of time analyzing log files to try to ascertain ad performance. It is, for me, a very difficult challenge.

-- Bob Stein, VisiBone

[anallawalla]

Thanks Bob. The real example was useful (although I know about the use of a? to capture strings). I don't have access to the client's Adwords account.

What I am seeing in the logs then does not look like an Adwords issue so I will ask in a more appropriate forum.

- Ash