Getting Clickbombed and Frustrated

[friedclyde]

Hi, I haven't been here for a long time, my adsense income has been a trickle but its been something that helps pays a few bills and I depend on it.

A few months ago I started using gtranslate (paid) on subdomains nl.url.com etc and everything was fine I had a bit of a bump in search engine traffic.

One day I wake up and my adsense is out of the roof, i knew it was a click bomb i dint bother because I knew it would reset, but this went on every reset it went back to getting bombed. I filled up the invalid click form and got no response.

Then I noticed I was getting a lot of activity or visitors from the gtranslate ip, I reached out to them and they said that they pass on the ips etc but my wordfence was still showing me their server ips and not the visitor.

So I just blocked their entire ip range, I del my sub domains, but it dint stop, but the wierdst part is, its been around 36 hours that I have completely removed adsense and im still getting clicks.

I'v looked at my analytics its not showing me any clicks on ads, then iv gone through server logs loads of it, I have not found anything really odd, searched via browsers black listed ips and had no luck, i cleared out my ads.txt file and only left my account.

I also use advanced ads and I used the click fraud feature as well as blocked bots from seeing ads, but nothing seems to have stopped this.

I have clicks from the Netherlands and Zimbabwe and Russia, ads are only allowed to appear on my website and I have no clue what's going on.

Any kind of light here will be appreciated this is the first time in over a decade i'm dealing with something like this. Its been over two weeks now and after a week or so, even my real clicks stopped making any $.

Thank you

[dolcevita]

I managed with help of rules below to take down clawback from 21% to 4.5%

Janvitos and anybody else who have issue please try to apply these rules to CF firewall:

- Challenge TOR users

(ip.geoip.country eq "T1")

- Challenge China, Russia, Brazil, Indonesia. I have apart rules for each country:

(ip.geoip.country in {"CN"})
(ip.geoip.country in {"RU"})
(ip.geoip.country in {"BR"})
(ip.geoip.country in {"ID"})

- Make new rules Apply these rules by expression for challenge another countries:

(ip.geoip.country in {"TR" "KR" "SG" "VN" "CO" "TW" "EG" "HK" "AR" "TH" "LA" "GH" "EC" "NP" "MX" "ZA" "MY" "BO" "MZ" "AE" "NG"})

- Apply than next rules to challenge corporate IP addresses:

(ip.geoip.asnum in {3223 3561 3842 4250 4323 4694 5577 6724 6870 6939 7203 7489 7506 7850 7979 8075 8100 8455 8560 8972 9009 9370 10297 10439 11588 11831 11878 12989 13213 13739 14061 14127 14618 15003 15083 15169 15395 15497 15510 15626 15734 16125 16262 16276 16284 16397 16509 16628 17216 18450 18779 18978 19084 19318 19437 19531 19624 19844 19871 19969 20021 20264 20454 20473 20598 20738 20836 20860 21100 21159 21321 21859 22363 22552 22781 23033 23342 23352 24482 24768 24875 24940 24961 24971 25163 25369 25379 25780 25820 27257 28753 29066 29073 29182 29354 29465 29550 29691 29802 29838 29854 30083 30176 30633 30693 30900 30998 31034 31103 32097 32181 32244 32475 32489 32613 32780 33083 33302 33330 33387 33438 33480 33724 33785 33891 34305 34971 34989 35017 35366 35415 35470 35662 35908 35916 36024 36114 36290 36351 36352 36666 36873 36887 36920 36970 37018 37088 37153 37170 37209 37230 37248 37269 37280 37308 37347 37377 37472 37506 37521 37540 37643 37661 37692 37714 39020 39326 39351 39392 39572 40156 40244 40676 40824 40861 41653 41665 42160 42473 42708 42730 42831 43146 43289 43317 43350 44050 44066 45102 45470 45671 45815 46261 46430 46475 46562 46664 46805 46816 46844 47328 47447 47588 49349 49367 49453 49532 49544 49981 50297 50613 50673 51159 51167 51191 51395 51430 51731 51765 51852 52048 52173 52219 53013 53340 53559 53597 53667 53755 53850 53889 54104 54455 54489 54540 55225 55286 55536 55933 55967 56322 56630 56934 57043 57169 57230 57858 58073 58305 59253 59349 59432 59504 59729 59764 60011 60068 60118 60404 60485 60505 60558 60567 60781 61157 61317 61440 62217 62240 62282 62370 62471 62540 62567 63008 63018 63119 63199 63473 63949 64245 64484 132816 133296 133480 133752 134451 136258 197155 197328 198310 199653 199883 200039 201011 201525 202053 202836 203523 203629 204196 327705 327784 327813 327942 328035 394256 394330 394380 395089 395111 395978 20248 44901 200904 53057 200532 50968 135822 55293 57286 201200 24549 39458 200000 14576 54290 206898 60117 20448 201553 54825 31472 8556 29119 60476 25532 49949 51698 42442 11274 57345 54817 200019 53342 33569 201983 132425 197395 42699 31698 42612 29311 54527 63213 27175 13209 29140 27223 31659 49834 49693 30152 19133 198414 45201 31981 62605 61280 53332 61147 51109 19234 40438 58797 26978 29748 35974 262990 43021 42695 39704 62899 53281 59615 55761 52335 16973 196827 32647 14992 198968 196745 62071 132869 56106 32911 24931 57669 48896 45481 132509 39839 63129 53370 25048 28747 46433 55051 18570 13955 16535 22903 9823 46945 263032 36536 50986 199733 48825 35914 33552 52236 28855 198347 40728 18120 53914 12586 55720 27640 62563 202118 9290 45887 51050 20068 49485 40374 14415 46873 14384 54555 263237 20773 53918 4851 32306 133229 28216 36236 42210 51248 49815 34649 41562 33260 24220 52347 45486 33182 53055 51290 132225 133120 42776 55799 48446 263093 56732 42399 47385 40539 42244 29302 10929 47549 200147 393326 198171 57773 47583 43472 32338 9166 62082 198651 24725 29067 197902 42418 29097 196645 56110 23535 29869 62756 26484 25926 15189 20401 24679 25128 39756 32400 9412 9667 51294 23052 28099 45693 17881 17669 17918 50926 201634 22611 54641 61102 132071 10207 45577 132070 262603 29883 24558 38279 199997 50465 14120 11235 50655 17019 31240 199481 16862 47161 56784 59791 59677 202023 199990 50872 54839 58936 11230 62310 38894 47172 262287 46260 14442 133143 197648 39451 58922 27589 42400 133393 201597 28997 60800 33322 38001 199129 197372 57752 201670 14244 22152 34541 196678 43198 47625 42331 62049 35295 42311 53589 59705 36791 14160 34432 41062 59135 201630 25260 23108 40281 31590 10532 22720 27357 33070 45187 7595 26481 29713 13926 54203 62651 63128 62838 30849 14987 47577 54334 63916 50915 21217 59816 23273 59632 29452 59795 60739 15919 49313 57879 56617 62088 45179 27597 201702 32740 58667 12617 199847 25642 14567 35278 197914 41079 1442 43620 197439 198313 42705 44398 13909 34745 24958 17971 47143 59854 57682 3722 13647 20450 30235 47205})

- Part 2 rules to challenge corporate IP addresses (not enough space in first one, You must make two):

(ip.geoip.asnum in {55229 7349 33251 52465 52270 45152 8477 198153 52925 61412 262978 53225 41427 53101 41369 35467 59554 52674 24611 48812 40715 201449 52321 29331 201709 53221 198432 51241 19969 56799 26277 58113 28333 42120 6718 20692 17439 132717 9925 132779 42622 6188 40819 24997 38107 36408 57363 46177 62026 61107 58325 19604 23470 39287 12876 60033 13830 60094 37963 31624 26496 48287 132839 204641 35913 39572 32592 23881 198047 14986 17920 32275 50608 199213 262170 201862 43541 24381 10200 14708 27229 48093 42465 7598 30475 23969 9371})

Threat score to challenge anyone that have treat great than or equal than 5 and lower than 50:

(cf.threat_score ge 5 and cf.threat_score le 50)

and fInally in new rule block all with threat score higher than 50:

(cf.threat_score gt 50)

You can chose for JS challenge or Captcha. It is on you but this kind of rules will probably solve your issue. If you need help let me know.

[edited by: not2easy at 2:02 pm (utc) on Apr 1, 2021]
[edit reason] readability/added code tags [/edit]

[SweetPotato]

Wow that's a huge list of asn. Thanks
Are we sure these are all web hosting?
I see my own site ASN in there so might wanna check that before blocking it, i don't know what could happen if you block yourself? =D

Also i understand China and Russia but are Brazil and Indonesia bad hombres too now? man...

EDIT: Careful AS15169 is Google. You might want to unblock that....

[SweetPotato]

AS8075 is bingbot, i would whitelist that too, brings real traffic.

[dolcevita]

All good SE are automatically whitelisted by CF but if you want be 100% sure then set as first rules above all others:
(cf.client.bot)
Allow

SweetPotato you do bot block anyone, except last rule to block visitors with threat higher than 50. Read carefully...

You challenge visitors via JS challenge or Captcha challenge to be 100% that they are real visitors and not bots. And then not forget to set by Setting Challenge Passage to 1 week example so that real human who has successfully completed a Captcha or JavaScript Challenge, can access your website and set to On browser integrity check and Privacy Pass Support

[SweetPotato]

All good SE are automatically whitelisted by CF

Yes but then you set the ASN rule to challenge them and bots will get 503 for that.
I tested this, and uptime monitor bot cannot bypass your ASN challenge. It considers the site DOWN.

but if you want be 100% sure then set as first rules above all others:
(cf.client.bot)
Allow

yes this is a must!

[not2easy]

As with any shared methods and/or lists - defensive use is important because what one site may need to block may be exactly what another site is hoping for. Copy/paste of blocking methods is not recommended, like anything available online: due diligence required. ;)

[freitasm]

Also make sure your server only accepts connections from Cloudflare IPs or some bots might connect directly via IP instead of using DNS first.

[friedclyde]

You know the funny thing, is the person who's click bombing isn't even hitting our server. I shared the link of the AdSense vulnerability. So its only a matter of time that this increases or adsense does something to fix this, iv given up. My ads were taken down again yesterday and im kindof done with it. Thanks for all those trying, btw when i moved out of cloudflare I had an increase in seo traffic. Google it, the free and cheap plans drop your search engine traffic because the ips are shared and many low ranking sites use it too.

[janvitos]

@friedclyde,

My ads were taken down again yesterday and im kindof done with it

Did you try blocking First-party cookies? That's exactly what solved the issue for me. My ads have been back on for over 72 hours now and I don't see any invalid clicks in AdSense reports anymore.

btw when i moved out of cloudflare I had an increase in seo traffic. Google it, the free and cheap plans drop your search engine traffic because the ips are shared and many low ranking sites use it too

This is an interesting theory. How long after disabling Cloudflare did you notice improvement with SEO?

I'm also on Cloudflare and have been experiencing weird SEO and Facebook ranking fluctuations over the past years. I did a quick search and was surprised to find that other people had experienced huge SEO drops because of Cloudflare ([serverguy.com ]). You would think that Google and Facebook would penalize domains and NOT IP addresses.

But Google says shared IPs have absolutely no impact on SEO: [seroundtable.com ]

I've also disabled Cloudflare for the moment and will see what the impact is after a few days. I really hope it has no impact at all because I believe Cloudflare is a great platform. But if the shared IPs cause issues with SEO and Facebook ranking, it might be time to reevaluate my CDN choice.

serverguy.com CloudFlare SEO Impact on a Site (Case Study) ServerGuy.com Cloudflare SEO issues are rare. But in this one particular case, This case study shows how Cloudflare negatively impacted the SEO of a Site.

[friedclyde]

@janvito i just did what you suggested and let's see if the invalid clicks stop (fingers crossed)

the cloudflare thing was immediate virtually for me, i could see a difference in real-time which I found odd.... but yes you will be able to see a difference in analytics if you compare a few days after disabling

[janvitos]

i just did what you suggested and let's see if the invalid clicks stop (fingers crossed)

It took around 24h for the AdSense penalty to be lifted for me, but I almost immediately saw a difference in AdSense reports when looking at the CTR for my archived ads. Clicks went from 50-100 with 10-50 impressions to 0-1 clicks and 10-20 impressions. It seems like blocking First-party cookies completely disables this bug / hack.

[lammert]

@janvitos, that Cloudflare example is written by someone who is currently serving through Cloudflare. Don't trust sources who say service A is crap, when they are using service A themselves.

In general, don't trust any information you find on the Internet--including on this forum--which you haven't verified yourself. You'll never know the intentions why people write something. Information may be wrong because the writers simply don't know the subject, or because they intentionally try to mislead others.

[friedclyde]

@lammert i wouldn't want to mislead anyone, although i understand you're not specifying me... iv been posting my findings here, with the hope of someone finding it helpful, i do understand it does not have to be the same for everyone and im sure cloudflare has to work for some, im positive on a higher end plan not the free and pro but perhaps business and enterprise cloudflare may actually provide a boost in traffic because of the higher speeds and possibly better quality sites using it... (when on wpe i got a traffic boost due to wpe ns on cloudflare) but lets see what janvitos has to say after this own test

[puente]

can anyone theorize why disabling first party cookies may alleviate invalid clicks? aren't those just site-restricted google/adsense cookies used to manage ad display?

[janvitos]

@lammert,

In general, don't trust any information you find on the Internet--including on this forum--which you haven't verified yourself

I totally agree with you on that. That's also exactly why I think disabling Cloudflare for a few days / weeks and seeing how it affects (or not) SEO and Facebook News Feed ranking might be a good idea. Worst case, nothing changes, I spawn a new server from a snapshot with a new IP and activate Cloudflare again.

As I said, I've been seeing huge fluctuations in SEO and Facebook News Feed ranking over the past year, and I just can’t find what’s causing that. Nothing has changed on my end. I spent countless hours trying to find the problem, going over Google and Facebook’s guidelines and making sure my website respects all of them.

I know Google and Facebook throw out algo changes a few times every year, but these fluctuations are simply too big to be caused by those changes. They feel more like penalties. For example, for a few days, my articles rank great on Google Search and get in the top 3 spots on Top Stories, and then for a few days / weeks, my articles start ranking like crap and traffic from Google Search drops. The same happens with Facebook. For weeks, even months, my articles will reach hundreds of thousands of people on a daily basis, and then, inexplicably, reach drops to a few dozens of thousands of people for a few days and even sometimes weeks.

Although I don’t think Cloudflare is the culprit, the only thing I didn’t try yet is disabling Cloudflare. What friedclyde said rang a bell, and I think it is definitely worth checking out.

[friedclyde]

@janvitos

thank you so much, the archived unit ad impressions have dropped but more importantly not a single click on them so far.... although my ads are not yet fully back... this seems to be working well.... i even removed my CSP and its still the same wow... thank you... much appreciated brother

[janvitos]

Incredible @friedclyde. I'm really happy I could help you out. You just wait a bit longer and the penalty should be lifted.

Thanks to @Soprano for being the first to suggest blocking First-party cookies as a solution. You are the true hero here!

[dolcevita]

Good point lammert...serverguy claim about Cloudflare and effect on SEO by his customer while he self as SEO guy using Cloudflare for his own website :) :

Domain Name: SERVERGUY.COM
 Registry Domain ID: 104163104_DOMAIN_COM-VRSN
 Registrar WHOIS Server: whois.dynadot.com
 Registrar URL: http://www.dynadot.com
 Updated Date: 2018-07-06T04:22:43Z
 Creation Date: 2003-09-26T18:31:50Z
 Registry Expiry Date: 2022-09-26T18:31:50Z
 Registrar: DYNADOT, LLC
 Registrar IANA ID: 472
 Registrar Abuse Contact Email: [e-mail]
 Registrar Abuse Contact Phone: [phone]
 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
 Name Server: BEN.NS.CLOUDFLARE.COM
 Name Server: GAIL.NS.CLOUDFLARE.COM
 DNSSEC: unsigned
 URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2021-04-06T20:19:29Z

[thecoalman]

If you read through that article they are pointing out this was individual case and is apparently a rare problem. I use CL and I have not seen any traffic anomalies when I implemented it years ago or since. Traffic has increased since but this wasn't unexpected with or without CL. I'm not sure how Google could justify penalizing a site based on IP alone using CL. The sites being served from them cover any topic imaginable.




.

[janvitos]

I disabled Cloudflare for 72h and did NOT notice any change in rankings or traffic from Google Search.

I observed a traffic boost on Sunday, April 4th, but then I realized Google seemed to have pushed a small algorithm update on Saturday, April 3rd, so the boost is most probably attributable to the update.

[janvitos]

Wow. This is incredibly weird & frustrating.

Today, I woke up to find the Confirmed Click penalty back on. But this time, there are absolutely NO invalid clicks hitting my ads.

AdSense Report shows completely normal CTR ([imgur.com ]). Ads on top of the red line are new ads, and ads below the red line are archived ads. Although the archived ads are still receiving a few impressions, they have zero clicks.

So how am I supposed to fix a penalty when there's absolutely nothing wrong with my ads?

This is getting completely ridiculous.

[lammert]

What kind of ad is the second line? 4 clicks and no views seems a bit odd.

[janvitos]

What kind of ad is the second line? 4 clicks and no views seems a bit odd.

Sorry, I cut some data off for privacy. That's just the average.

[janvitos]

So another day with 90% revenue loss because of the Confirmed Click penalty.

Yesterday, I added a Pinterest button over all article images, and I'm wondering if it might've been too close to some ads. Although it didn't seem to generate any accidental clicks, maybe Google checks if there are anchors or buttons close to ads with their Invalid Clicks detection system.

So I completely removed the button in hopes it might make the penalty go away.

If this is not the cause of the penalty, I am totally cluecless since there's absolutely no evidence of any kind of invalid click activity in the AdSense reports.

[dolcevita]

Have you tried to implement the CF rules I set above? At least challenge Tor, China and corporate IP addresses?
Did you set the new CF option 'Configure Super Bot Fight Mode' Definitely automated to challenge?

Try it, it will filter out malicious traffic and reduce your bounce rate (what is your bounce rate now?)

[friedclyde]

@Janvitos i still dont have my ads back fully after the implemention of the suggested cookie fix, i had auto ads and on the homepage the ads are showing everywhere

in the post page google shoves 2 ads on top of each other just above the footer........... so i manually put in 3 resp ads in the content and am making 1/3 rd of what i make with auto ads

but google shows the anchor and vignette ads which generates nothing much and probably pisses off people...

if you try what dolcevita suggests let me know, iv tried cloudflare and sadly im hesitant to try it again as i have the same issue as server guys client.... i dont know why ... but both his client and I are from india not sure if that has something to do with it (i also did all the things mentioned though except the ip mentioned here and it dint work for me maybe this list is better)

im already in the process of looking for affiliate ads and now that we're going through our next massive wave of covid here and probably lockdowns things aint looking good for offline work ......

Have you by chance posted this in the adsense community it will be interesting to see what happens there ....

[friedclyde]

@dolcevita if there are no impressions being generated, the person/bot doing the clicking is not hitting the server.... if he hits the server there should be an impression

the code is being executed without the server, i switched hosting 3 times.... and not cheap hosting all managed hosting.... cloudways, wpe, wpx all 3 did not find anything odd with the traffic or any invalid traffic.... i had cloudflare with rules mentioned above but not the same ip range, wordfence and malacare on at the same time so i really doubt this

my bounce rate is 60% approx so i really honestly doubt this is an issue on our end

[dolcevita]

Either Adsense has never been so strict with traffic or bots have suddenly become a problem, I'm not one hundred percent sure, but it still seems to me that Adsense has become stricter when it comes to making a difference between real visitors and BOT traffic. I’ve been with Adsense since 2004 and up to a year back it was never a problem.
Even once when I personally sent an email 5=6 or even more years ago about the Bot attack (and many had it on this forum at the same time) I got the answer don't worry and in the end the clawback was normal and I got about 20% -25% higher earnings for that month.

So BOT traffic has become a real problem and Adense has also decided to act proactively in this regard, and fighting this type of traffic without CF or similar service is practically impossible.BOT traffic makes up for sure 50% -60% of visits where 10% falls on good Bots, and the other 50% is divided between malicious bots and ordinary bots that take bandwidth and increase bounce rates.

The CF rules above were made before CF itself introduced the Bot Fight mode option where one can choose the option to challenge ‘likely bot automated traffic’ and one can see statistics like likely human, likely bot, good bot etc. ..
And I warmly recommend, especially to those who have had a problem and are stunned for malicious traffic or clicks, to implement a minimum challenge for TOR and challenge for threat score from 5 to 50 and to block visitors for threat score above 50. And then look in the CF graph 'bot fight configuration mode' how much CF traffic is from bots, and how many of the human and then to implement possibly challenge to likely automated Bot traffic. That's minimal.

The rest is arbitrary as far as the countries that someone will challenge as well
Corporation IP addresses, although they are usually addresses from VPNs, proxies, and web domains.

As for impression 0 and clicks, I don't think Adsense is crazy to see that you don't have it under control. It could be that your page is in cache, it could be that the bot clicks open in new page and does not generate an impression but clicks yes.

In terms of bounce rate 60% is quite high. Between 40% -60% is taken as normal. Below 40% ideally, Anything over 60% is too high a bounce rate.

[friedclyde]

Well iv been on adsense as long as you, iv never had a problem until recently, now cache i would believe if i removed the ads a few days ago, but 4 months ago just doesn't seem right to pin it to cache.... the ads weren't on the website for 4 months.... iv cleared cache multiple times during these four months and i moved to auto ads,,... if you see the start of this thread i thought i was cache as well... anyway thanks for taking the time .... cheers

[lammert]

@dolcevita, Please don't generalize your problems to others. Invalid clicks can have many origins. Some can be treated with by blocking sources in Cloudflare, others not. And bounce-rate depends heavily on the vertical the site is operating in. For authority information sites, a 80%+ bounce-rate can be normal. It indicates that the searcher found what they needed and don't have to look further on the site. But for sites needing user engagement a 40% bounce-rate may be pretty bad.