Forum Moderators: martinibuster

Message Too Old, No Replies

Taking a stand against click fraud

Using software to limit fraudulent clicks

         

Key_Master

3:22 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Judging by the number of posts on this site about the very real threat of having an account disabled due to click fraud perpetrated by outside influences beyond our control, I feel it's time, as publishers, to take a stand and start to doing something proactive about it. Not just to protect the interests of publishers, but to also protect advertisers and the integrity of the Google AdSense service as a whole.

One thing is in our favor- AdSense requires JavaScript to function. So it is conceivable that JavaScript can be used as a tool to defeat AdSense click fraud. This could be a powerful weapon in fighting the problem. There are also server side solutions to the problem as well.

Some immediate suggestions come to mind:

  • It is possible to limit the number of click-thrus a day by having software in place to disable ad delivery after a preset number of clicks. I refer to this solution as "damage control". For example, if you have an average of 300 click-thrus a day and your limit is set to 600, an attack will only be successful up to the limit.

  • Cookies can be used to limit the amount of clicks a single visitor may have during each session or to deny ad delivery to visitors engaging in rapid fire click-thrus. Yes, visitors can disable cookies but if you don't wish to "chance it", alternative ads can be served to those browsers.

  • It is possible to make the ad block disappear after a click-thru. Perhaps this could be used to control rapid fire clicks.

Implementation of a successful campaign to defeat click fraud is dampened by our inability to test clicks through the AdSense program. I can't see them on my sites- they're disabled for system personnel (come on, accidental clicks can happen- especially with an IBM ThinkPad armed with a roving, self adjusting mouse pointer, cursed with a mind of its own. :))

Any successful solution must be implemented in accordance with the AdSense Terms of Service.

Your thoughts, tips, observations, and suggestions to the discussion are welcome.

Aircut

3:57 am on Jan 16, 2006 (gmt 0)

10+ Year Member



the other day i was researching a subject that the ads were more interesting than the natural search results. (did it ever happen to you?)

i clicked on few ads (from google homepage), and in some cases, i hit the back button immediately when landing on a MFA site. overall i visited 5 advertisers site in couple of minutes. all originated from the same google search results page.

the last ad i clicked on was not relevant to my search, i hit the back button and to my horror, a google error page appeared, saying that google can not complete my request as my computer is infected with a spyware or click generating system.

i run a system check, it was clean. so obviously my rush research triggered a click blocking system.

now google please note, i would be happy to install any server side protection to adsene on my server!

jetteroheller

5:52 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



i hit the back button immediately when landing on a MFA site.

Can not happen to visitors of my sites. I hope they are all in the filter.

The discussion about blocking ads from repeated clicks is sensless, because AdLinks are complete out of the control.

Key_Master

6:37 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Aircut, the Google error you described is interesting.

jetteroheller, your reply is senseless. First of all, you presume (incorrectly) that all AdSense sites utilize link units. Secondly, you conclude that no protection is preferable to partial protection.

tedster

6:42 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Aircut -- I had that happen several times today, just as you describe. Apparently our research surfing can be fast enough to look like a bot. I agree -- it would be good to replicate that kind of protection on our on servers.

Scurramunga

6:45 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Jetter,
Don't be so sure. I find that just when you think they are all zapped, more of them come out of the woodwork. We need filters capable of holding more than 200 urls.

I even thought zapped all my ebays an I am finding ads that go to some obscure url that is redirects back to a specific page in ebay.

Scurramunga

6:59 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



by the way, why are so many people paroniod about click fraud around here?

jchampliaud

7:08 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Judging by the number of posts on this site about the very real threat of having an account disabled due to click fraud perpetrated by outside influences beyond our control, I feel it's time, as publishers, to take a stand and start to doing something proactive about it. Not just to protect the interests of publishers, but to also protect advertisers and the integrity of the Google AdSense service as a whole.

I agree that there is always a chance that my AdSense account will de disabled for reasons outside my control. But that said, it seems from many posts here that most that have their account disabled are not playing by the rules. I don’t think Google likes canceling an AdSense account, after all that means one less site they can make money from.
In a lot of business situations, not just with AdSense there are many factors outside my control. Someone/bot coming to my site and clicking on every AdSense ad either on purpose or by accident is one of those. But in the end I really don’t know what I can do that would make me 100% safe. Sure I can do some of the things you suggest but would that really make me 100% safe? I don’t think so and if it did for how long? Things change fast on the Internet and what makes me safe today might not make me safe tomorrow. Just my 2 cents.

It is possible to make the ad block disappear after a click-thru. Perhaps this could be used to control rapid fire clicks.

As I understand it rapid fire clicks are not counted. Someone that uses an independent AdSense tracker once made the comment that often he or she saw many clicks that never made it to the official AdSense count. I’m guessing these were rapid-fire clicks. Personally I think that AdSense does a very good job of discarding rapid-fire and or irrelevant clicks. Sure mistakes are made, but all and all the system seems to work. Or at least has for me.

Mistra

7:21 am on Jan 16, 2006 (gmt 0)

10+ Year Member



by the way, why are so many people paroniod about click fraud around here?

Why? As for my case, my bread and butter (will) depend on Google. Don't wanna be banned by Google.

I prefer to see the script preventing click fraud to come from Google itself instead of utilizing third party software that we are not so sure would be working correctly or not.

I am sure many of webmasters here are decent honest reasonable folks who will never cheat others. So, I can't understand why there are people out there who would do this kind of thing to others. Envy?

Key_Master

7:22 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



It's not paranoia. Click fraud is a serious problem that threatens the entire PPC model. One only has to search this site or Google "click fraud" to find plenty of reasons to take it serious.

jchampliaud, this post has nothing to do with AdSense publishers who click their own ads. I'm sure they have absolutely no incentive to limit fraudulent clicks on their site.

Someone that uses an independent AdSense tracker once made the comment that often he or she saw many clicks that never made it to the official AdSense count.

And there are plenty others who report that their accounts are disabled because of the same activity.

P.S.- Nothing is 100% safe. But I'd rather be 5% safer than 0% safer.

Scurramunga

7:48 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Mistra,
I would stand to lose much also, however I just don't see the possibility of it (click fraud) happening to me as highly unlikely. i would expect that if it did happen that Google allow me every opportunity to state my case.

I can see your point about envy but that is why I never discuss my earnings with people I know.

[edited by: Scurramunga at 8:08 am (utc) on Jan. 16, 2006]

jetteroheller

7:58 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



AdSense sites utilize link units

46,7% of my revenues are AdLinks.

And AdLinks are beyond the controll of the publisher.

jchampliaud

8:09 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



jchampliaud, this post has nothing to do with AdSense publishers who click their own ads. I'm sure they have absolutely no incentive to limit fraudulent clicks on their site.

I didn’t mean to imply it did. It’s just difficult to distinguish between the two.

Someone that uses an independent AdSense tracker once made the comment that often he or she saw many clicks that never made it to the official AdSense count.

And there are plenty others who report that their accounts are disabled because of the same activity.

I must have missed those posts. BTW not to long ago I got an exceptional number of search clicks. I reported this to Google but nothing came of it.

P.S.- Nothing is 100% safe. But I'd rather be 5% safer than 0% safer.

I agree that’s why I report any strange AdSense behavior to Google and have direct advertisers along with affiliate ads.

Aircut

9:42 am on Jan 16, 2006 (gmt 0)

10+ Year Member



jchampliaud

your point that adlinks can not be controlled and that any control can not be 100% safe is NO REASON not to be active in the prevention adsense income. adsense changed many lives, including mine, and i will do everything in my power to protect the program.

i am sure google is working on new technologies every day to prevent click fraud and it would be satisfying to know that some of the fraud elimination is at the server level.

jchampliaud

9:59 am on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



your point that adlinks can not be controlled and that any control can not be 100% safe is NO REASON not to be active in the prevention adsense income.

Where did I say I was not active in protecting my AdSense income? BTW you are not the only person for whom Adsense has changed his or her life. Before AdSense I made little if any from my site.

sailorjwd

1:17 pm on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I find that a prozac chased with a vodka & tonic make the click fraud issue much less of a problem.

OldWolf

3:31 pm on Jan 16, 2006 (gmt 0)

10+ Year Member



This kind of topics is very important (IMO)cause i feel G doesnt protect their publishers well but protect their advertisers.

They will ban you for click fraud [ they dont protect you] and they will take your earnings and pay back to advertisers [ they protect their advertisers]

Webmasters can protect their sites from hacking attacks etc. or if we hacked we can find a solution to plug that hole by asking for help at forums like WebmasterWorld.

We cant protect our sites from click fraud ,we cant know why someone visits our sites we cant say them CLICK OUR ADS we cant say DONT CLICK ADS MORE THEN ONCE and i believe we are not the one who are responsable to protect our ads but G does.

Im a honourable person even i earn only 1-2$ daily but kicking out by G for fraud clicks is my nightmare.Im scaring to open outlook express every morning for see a mail from G which says bye bye.

If they care us they would already give us weapons to protect our ads. Is it so hard to give us an option at our control panel like something 'Dont count clicks if an IP already cliked once' I would like to earn less but sleep tight.They can even put another option our control panels for the publishers who has static IP 'dont count/pay the clicks from 00.00.000.000'

all they need to add 1-2 line code in their program...

jetteroheller

4:28 pm on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



'dont count/pay the clicks from 00.00.000.000'

I have this actual in my SSI serving the ads.

So my new web design student sees only Amazon as long as he is in the company with fixed IP address.

europeforvisitors

4:34 pm on Jan 16, 2006 (gmt 0)



It seems to me that it's Google's job to protect against click fraud, and they have better resources to do it than we do.

Aircut

5:09 pm on Jan 16, 2006 (gmt 0)

10+ Year Member



while its google job to protect the system from fraud clicks it is surely the publisher interest. I am sure that there are measures that can be installed at the server level and if google reads that please note that many publishers will surely join the battle!

frox

6:09 pm on Jan 16, 2006 (gmt 0)

10+ Year Member



[quote]
If they care us they would already give us weapons to protect our ads. Is it so hard to give us an option at our control panel like something 'Dont count clicks if an IP already cliked once' I would like to earn less but sleep tight.They can even put another option our control panels for the publishers who has static IP 'dont count/pay the clicks from 00.00.000.000'
[quote]

Agree 100%

Also, 'don't count clicks outside of my list of web sites'.

Key_Master

6:29 pm on Jan 16, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I started this thread so that the members here could collectively brainstorm possible server or client side solutions to aid in preventing click fraud- not to engage in a debate over ones disinterest in implementing them on their own sites. If this is a subject that doesn't interest you, then there is really is no need to reply with an opinion.

Now I like a good challenge and this is a subject that really hasn't been explored here or elsewhere. So let's stay on topic and get back to brainstorming.

hjuan99

12:43 am on Jan 20, 2006 (gmt 0)



As the owner of a blogging site where people blog to make money with adsense, I have seen somewhere between 20-40 adsense accounts disabled over the past month.

I'm sure that some of those people committed click fraud. They may not have realized it, but they did it nonetheless.

However, I'm SURE that some of the people didn't do anything. Their account being disabled was a result of someone else coming to their site and clicking on the ads incessantly.

Their account got disabled. Nothing they could do about it. Appeals don't help, even me appealing for them doesn't help.

It's gotten to the point now where I know ton's of people who are so afraid of getting their adsense account disabled that they're taking ads completely off their sites.

In other words, Google has become so nazi about this over the past few months, and they offer zero help to their publishers, that it's time for us to do something for ourselves.

An ideal solution would put a cookie on every visitor and track if they click on an ad. If they click more than 3-5 ads within a 5 minute period (those numbers would need to be configurable), they would be banned from seeing the site, or they would be stopped from clicking on the ads in the future.

The key with it would be to try and figure out what google looks at when disableing adsense accounts and try and prevent those situations from happening.

John

[edited by: jatar_k at 1:01 am (utc) on Jan. 20, 2006]
[edit reason] no personal urls thanks [/edit]

fredw

12:49 am on Jan 20, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



hjuan99: In big bold letters on your home page you advise your users not to click on their own ads. Doing this on your part is probably a really bad idea, it only encourages people related to (and or people who have an axe to grind against) your users to click on the ads and commit click fraud!

A much better idea might be advising users to not click on their own ads in an automated sign-up email...

jomaxx

1:39 am on Jan 20, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



So let's stay on topic and get back to brainstorming.

What brainstorming? You laid out exactly what needs to be done in post 1, so just do it.

Key_Master

1:50 am on Jan 20, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I laid out some possible options but I am sure there are other options available that I don't know about. I would like to hear them.

I can remember way back some years ago that there was a hack to defeat smart tags using CSS. That's the kinda ingenuity I'm looking for.

triso

7:58 pm on Jan 24, 2006 (gmt 0)

10+ Year Member



There are a lot of things webmasters can do to limit fraudulent clicks - server-side and client-side mechanisms. The problem is, the harder you tighten the screws, the less revenue you get from adsense. Click patterns in the past on my sites suggest that a lot of people who click, click on more than one add and may click on more than one add on more than one site in the duration of their browsing.

Server-side, if you want to use php, which I do, you can control the display of the adblock to only certain circumstances. The two biggest factors I have thought of (I am sure there are others) are limiting 'non-real' users such as badly coded robots, and limiting the rapid fire clicks or excessive clicks by the one user.

The tools to achieve these ends are:

1. a useragent id ($_SERVER['HTTP_USER_AGENT']) to make sure it is a real user. In extreme cases you could limit to only the main browsers: if(strstr($_SERVER['HTTP_USER_AGENT'],"MSIE")) for example.

2. using either session control or logged access to limit repeat clicks in time.

As I mentioned at the top, these kind of measures would see a drop off in adsense income. Perhaps G needs to be making changes at its end so that these server side hacks don't have to be done. I also agree with earlier comments that there is really nothing you can do to protect against a determined malicious attack. These measures though could protect against things that have had publishers banned.

As a footnote, I am a publisher who was banned mid last year for 'invalid clicks' beyond my control. If I had my time over I would implement these kinds of controls and suffer the income drop to protect the continuation of the program.

sputnick

8:18 pm on Jan 24, 2006 (gmt 0)

10+ Year Member



the real issue is transparency. taking measures against click-fraud would be so much easier if google were less opaque about which clicks generate how much for publishers. google need to be more open and introduce some glasnost about how the adsense accounting is done.

the status quo is that, basically, we just have to trust google that their bean-counting program knows what it's doing and that the amount we get is fair and correct. that's actually fine with me. i trust google.

but if you throw the click-fraud factor into the equation - does google trust you - it would be much better if we know exactly which ip addresses clicked on what to generate how much income. because if i had that information i would be able to take much firmer measures against it.

i could also look at my report and say, hey, googs, these clicks, here, here, and here, these were mistakes, my 5-year-old was just playing around. you'd better deduct those and reimburse your advertiser's account.

i'd lose maybe 37 cents but at least i'd know everything is clean and right and the way it's supposed to be.

nick

jetteroheller

8:43 pm on Jan 24, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



The problem is, the harder you tighten the screws, the less revenue you get from adsense

There could be also an other problem.

Let's assume some sort of click attack. 20 clicks.

Google evaluates the clicks as invalid and does not count.

Let's assume the server has some of the methods applied like descriped in this thread, only 3 clicks from an IP. After this, no more AdSense ads shown.

Google evaluates as valid and count them.

europeforvisitors

9:13 pm on Jan 24, 2006 (gmt 0)



the real issue is transparency. taking measures against click-fraud would be so much easier if google were less opaque about which clicks generate how much for publishers.

It definitely would help the get-rich-quick crowd decide where to target their efforts.

This 37 message thread spans 2 pages: 37