Click fraud or normal behaviour?

[dave741]

Hi,
I just can't explain some info from my log. May you help?

The typical "footstep" of a common AdWords visitor looks like this:

Visitor IP - - [date and time] "GET /my_page.html HTTP/1.1" 200 4541 "referrer here" "Mozilla/4.0 (atc...)"
Visitor IP - - [date and time] "GET /css_file.css HTTP/1.1" 200 6340 "referrer here" "Mozilla/4.0 (atc...)"
Visitor IP - - [date and time] "GET /logo.jpg HTTP/1.1" 200 16948 "referrer here" "Mozilla/4.0 (atc...)"

But I am seeing clicks that looks strange:
Strange IP - - [date and time] "GET /my_page.html HTTP/1.1" 200 4541 "referrer here" "Mozilla/4.0 (atc...)"

The first row is OK, but the problem is, that there is only one row (not three or more as for all other users). These users just NEVER ask for CSS file and for logo.jpg.

Another strange thing is, that there is several of these clicks from one IP during one day (about 20 clicks a day) and the same repeats for the same IP during a next day.

Distribution during the day looks like this:
Strange IP - - [23/Jun/2005:03:06:35 +0100]
Strange IP - - [23/Jun/2005:04:38:48 +0100]
Strange IP - - [23/Jun/2005:07:58:10 +0100]
Strange IP - - [23/Jun/2005:08:09:56 +0100]
Strange IP - - [23/Jun/2005:08:10:27 +0100]
Strange IP - - [23/Jun/2005:14:55:41 +0100]
Strange IP - - [23/Jun/2005:14:56:53 +0100]
Strange IP - - [23/Jun/2005:16:22:32 +0100]
Strange IP - - [23/Jun/2005:18:07:32 +0100]
Strange IP - - [23/Jun/2005:18:59:08 +0100]
Strange IP - - [23/Jun/2005:19:03:32 +0100]
Strange IP - - [23/Jun/2005:20:03:53 +0100]
Strange IP - - [23/Jun/2005:20:08:58 +0100]
Strange IP - - [23/Jun/2005:20:14:44 +0100]
Strange IP - - [23/Jun/2005:21:08:19 +0100]
Strange IP - - [23/Jun/2005:21:28:11 +0100]
Strange IP - - [23/Jun/2005:21:50:41 +0100]
Strange IP - - [23/Jun/2005:21:52:36 +0100]
Strange IP - - [23/Jun/2005:22:33:11 +0100]
Strange IP - - [23/Jun/2005:23:37:16 +0100]

And I have found several IPs (4 in this moment), that fit into this model (just one row, repeated clicks).

I receive about 350 clicks a day total in this campaign and about 80 clicks (4x20) is from these strange IPs.

The last info is, that the most of these strange clicks come from very large Google partner in US, this company is also big ISP provider in US. I don't think that this company is involved in click fraud, but that behaviour looks strange to me.

Can somebady explain to me how this can happen naturaly?

Or do you thing that this is really fraud?

[leadegroot]

Its some sort of bot. You might care to block the IP address.
The agent string should tell you who they claim to be and include an url or email address. If not, its an evil masquerading bot, who thinks we can't tell.
Alternatively, you could be receiving visits from people using text browsers, eg lynx. Again, the agent should identify it as such.

[dave741]

The agent strings look like this:
Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; (R1 1.3); .NET CLR 1.1.4322)

Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.0; FunWebProducts; .NET CLR 1.1.4322

Mozilla/4.0 (compatible; MSIE 6.0; CS 2000 6.0; Wal-Mart Connect 6.0; Windows 98)

I am sure this is not any sort of bot.

If it was, it was clicking on my ads - the referrer looks like this:
[search.example.com...]

[Mel123]

I believe that AOL assigns the same IP to a number of different users, so you would log the same "visitor" (or IP address) even though the users are different.