Using Analytics to weed out possible attacks

[ianevans]

As I mentioned in the July 2016 thread, I had an 89% clawback in July. That's not a typo. Eighty-nine. June was about 75, May, 35%.

Is there any sort of Analytics filter, segment, or magic I can use to narrow down if there's a pattern to the invalid traffic?

[netmeg]

I mentioned in the other thread - take a look at your AdSense in Google Analytics for July. The clawbacks won't show up, so you might be able to actually see patterns. If 89% of your earnings were deemed invalid, then a large part of your traffic must have been too. What part of the world is your traffic coming from - did most of the earnings come from one place? What about pages - were your earnings fairly evenly distributed between many pages, or did one or two suddenly stick out as making more? Looking at hostnames and server providers (by using the secondary dimension) - can you find one that appears to be sending more than others?

That's the sort of thing you want to look at - go to the Publisher Pages in GA, and use that secondary dimension option on everything you can think of to see what patterns most of your earnings last month followed.

[ianevans]

After June I stopped serving Adsense to Russia and China. So my clicks are mostly coming from the US. Cities all over the place so it's not like a bad bot in one city.

[engine]

The trouble is, the bots and clickers can spoof their IP.

[robzilla]

Any notable differences is engagement metrics (like time on site, bounce rate, pageviews/session) when you compare July to (pre-)May?

[netmeg]

You can also consider running some other stats programs that would give you some more granular information on your traffic, from StatCounter to Piwik Analytics.

[levo]

Check for browsers (and versions), networks etc. that have more than X visits, 90+% bounce rate and generated Adsense earnings.

[ianevans]

I'll dig around for the other details, but here's some Publisher stats from a July vs March which was normal.

Publisher Coverage
July 80.33% March 99.76%
Publisher Impressions / Session
July 1.62 March 2.18
Publisher Viewable Impressions %
July 62.81% March 49.70%
Publisher CTR
July 1.98% March 0.23%
Publisher eCPM
July $7.98 March $1.32

[ianevans]

Some of the higher CTR pages are Chrome 50.0.2661.102.

[ianevans]

I've reactivated access logs in my nginx server so I'll have raw data collecting. Any grep/sed/sort tricks to look for problems?