Click Attacks.

[Keano16]

Hi,

We are having lots of problems with click-attacks. It all started in the begining of this year. We had attack one day and that was it.

Now in last 10 days 3 of our sites are under attack. Attacker is obviously someone close to us, that knows what are we doing and how are we doing it.

We even suspect who is he but we will not mention his name because we are not 100% sure.

Problem is we cannot do anything to stop him... When we removed ads from our pages, he started to attack us using Google Cache versions of our sites.

We have informed Google about this case, supplied them with server logs, his IP address, network name, etc., even reported him to his ISP, but what else is in our power?

We are decent AdSense publisher for one and a half year, and this situation is very hard to us.

please help us and give some advices.

Thanks!

[edited by: jatar_k at 9:05 pm (utc) on May 31, 2006]

[loganz]

if you have his IP you can easily block him through .htaccess

[Keano16]

Yes, but he can still access our website using Google Cache (I've added my site to filter, then tried to visit it using Google Cache and I was not restricted).

Restricting IP adresses if definatly not a solution because he can use proxy, etc.

Thanks!

[drshields]

Aside from blocking IP's or restricting public access to the attacked pages, there is not much you can do execept your part in notifying google.

[martinibuster]

You may want to explain to AS that you are being attacked on ads showing up in a cache (are they showing up in Archive.org, too?) and that you wish to be assigned a new publisher ID so that malicous clicks on the cache will stop.

It may be in your best interest to talk to an attorney, too.

[Keano16]

We can probably change my publisher ID, but that is all I can do. When I return ads to my site he will probably continue to click.

Maybe I should see a attorney.

[loganz]

Aslong as you notified G everything should be ok.. they should be able to figure out what steps to take to prevent this guy from attacking you.

[Keano16]

I've notified them, of course.

They have thanked me for bringing this case to their attention.

Also they have thanked me during this days when I supplied them with more details.

[Keano16]

Yesterday we had 2000 clicks and CTR of 4,500.00% (aprox). Horrible!

[anton23]

...and remember: never disclose your url. Your (girl/boy)friends of today can be your enemies of tomorrow.

[Keano16]

Yes, and every angry (for any reason) visitors also... there is no way to protect yourself :(

[wolfadeus]

Stupid question: What is a click attack? Something to hit competing web-publishers or to hit competing web-advertisers? Who does that, if not the party operating the website? I don't understand the whole click-attack thing, but it sounds worrying...especially the "attack" part of the name.

[Keano16]

Click Attack: When someone comes to your site and click 1000 times on Google ads... Not only 1000, if someone clicks 20 times it is again obvious attacking.

[wolfadeus]

But why is one doing that? To harm the adwords user who pays for it or the webmaster who might get kicked out of Adsense? Or is there a conspiracy of google-employees?

[Keano16]

Only God knows why is he doing this, and only God know why are persons like him alive... and even born.

[incrediBILL]

he can still access our website using Google Cache

Why would anyone allow themselves to be in a search engine cache?

Scrapers use that cache too so you don't catch them hitting your site and can't block them.

Put this in the top of your pages today:

<META NAME="ROBOTS" CONTENT="NOARCHIVE">

Besides, even blocking his IP is useless, just a temporary annoyance really, as they can get to your site using anonymous proxies and there are a bunch of those.

Best you can do is set NOARCHIVE to get rid of cache, block his IP, then if you detect a proxy server simply don't server up Google Ads. The PHP/CGI-BIN proxies are easy to spot as they append the port ":80" to your domain name so HTTP_HOST environment variable will contain the ":80".

Won't stop them all, but it's a start.

[Keano16]

I have implemented:

<META NAME="ROBOTS" CONTENT="NOARCHIVE">

Will this also mean that Google will completely stop indexing my website?

[incrediBILL]

No, it means it won't ARCHIVE the site, no cache pages

[jmorgan]

Just with regards to the noarchive directive.

Is it generally a good idea to make your pages non-cached, or only in special circumstances such as this?

Are there any benefits at all to having your pages cached in SEs?

[OptiRex]

And just who is this incrediBILL...

Where did he come from?

What does he know?

Yo! Been on a beer/tequilla vacation iBill? :-))

[ann]

Welcome back ibill, missed your wit and good humour (?).

I would try to help the OP but not sure how. :)

Ann

[Keano16]

I have been contacted by the person that is clicking...

He told me I need to make public apology to him and then he will stop clicking.

I know I was telling bad words about him, but problem is I never knew why is he attacking me because I have never did anything wrong to him.

So, this is public APOLOGY, and this is public appeal to STOP CLICK-ATTACKING my website. If anything is needed please contact me, because we can solve this in friendly way.

Thank you in advance!

[Hobbs]

I understand your wanting to apologize in public Keano16 to that person..

I am just shocked and disgusted you were forced to do this to save your account. If we don't carry our business with dignity and pride, every dog and his sister will wet our pole, AdSense should not be a weakness.

[ann]

One thing for sure, you don't go around bad mouthing people in public. I am surprised you were not sued for slander.

I think the person probably wants the apology from the same place you bad mouthed him/her. Probaly your website, not here.

Ann

You also need to name the person in your apology---not here but on your site.

[jomaxx]

I am just shocked and disgusted you were forced to do this to save your account.

It's not clear it WAS necessary in order to save his account.

Keano16: If you agree you were in the wrong, then you might as well apologize in the manner Ann has suggested. But regardless, save all records of your communications with this person. If the demand was delivered verbally, write down the entire conversation as exactly as you can. This will be invaluable if you have the need to prosecute or sue them.

[jatar_k]

>> you don't go around bad mouthing people in public

you also don't blackmail people with click attacks

I don't see that Keano16 said he was bad mouthing this person before hand but definitely was once he was being attacked

I would be careful about naming anyone who click attacked you, that might not get the desired result

[Hobbs]

jomaxx,
I have gone beyond Keano16's case and as I said, I understand his wanting to do it. As for his motivation for the apology, I cannot find any other reason why he apologized, I do not think it was out of decency or wanting to do the right thing, it was out of fear from a mad person, if you have a public argument or even do one wrong act of badmouthing, that should not make you a candidate to someone burning your house or business down.

[jomaxx]

I meant that it's not obvious the blackmailer would actually be able to get the account cancelled. Google know what is going on and can easily filter the bogus clicks. Even as click attacks go, this one seems kind of brain-dead.

[Hobbs]

agreed jomaxx, the only problem is that publishers are low on Google's pecking order compared to advertisers (understandable), which does not instill a lot of self confidence in publishers.

[Keano16]

People, thanks for comment, support, advices, and everything else you said.

I am thanking "him" in advance for stop attacking my account. Thanks!