Forum Moderators: martinibuster

Message Too Old, No Replies

Click fraud attacks

When sites get subjected to click fraud attacks

         

EricGiguere

6:11 pm on Jul 16, 2005 (gmt 0)

10+ Year Member



I'm starting to think someone's gunning for me. Over the last couple of months, my main two sites have been subjected to click fraud "attacks". The pattern is very simple: basically a page gets accessed on a regular basis (every 20 or 30 seconds is the norm) for several hours and my CTR goes through the roof, i.e. over 50%. Until yesterday, the "referer" header was always null, so I was able to handle things by changing the pages to remove the ads whenever there was no referer. That would hinder some legitimate traffic, but at least ads would still show in most cases. Then the other party got smart and started doing the same thing but with a valid referrer, so I had to get smarter and start blocking specific URLs. Very annoying, though, because I have to monitor things closely. I've been reporting things to Google as they happen (they had to deduct $600 in bogus clicks last month) and pass on some of my logs to give them some data.

What I don't know is if these people are trying to get me booted out of AdSense (what I call disbarring click fraud -- maybe they don't like what I write about or they think it would be funny to get me kicked out?) or if they're just targeting specific ads that happen to display on those sites. Anyone else run into this before? Most of the IP addresses don't have DNS entries, either. I wish I could track it to someone specific, but that doesn't seem possible with what I have access to.

Eric

latfood

6:23 pm on Jul 16, 2005 (gmt 0)

10+ Year Member



Say "good bay" to google adsense.
:(
I did.
I had the same problem.

ann

6:38 pm on Jul 16, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



As long as you are working WITH Google there is a good chance these people will be found out and possibly sued, by Google.

Personally I think you are doing the right thing and no one in their right mind could hold you accountable as you appear to be doing all you can. Google has the resources, software, minds and money to throw behind this episode.
Hang in there.

Ann

europeforvisitors

6:51 pm on Jul 16, 2005 (gmt 0)



Tell Google, and offer to supply whatever information they might require to identify the troublemakers. (E.g., server logs.) If my own experience with click attacks is any guide, a publisher who acts legit (and who has a site that looks legit) won't be blamed for the sins of others.

blairsp

7:50 pm on Jul 16, 2005 (gmt 0)

10+ Year Member



Personally I think you are doing the right thing and no one in their right mind could hold you accountable as you appear to be doing all you can

Bear in mind according to the TOS, G can kick you out simply because it is a Monday. This account appears to be mroe trouble than it is worth. What is the cost to G of kicking him/her out- absolutley nothing.

gregbo

8:00 pm on Jul 16, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Most of the IP addresses don't have DNS entries, either. I wish I could track it to someone specific, but that doesn't seem possible with what I have access to.

You may be able to shed some light on where this traffic is coming from by checking the addresses against the regional IP registries (RIPE, ARIN, etc.). Also, try doing some traceroutes; see if the addresses are originating from a small subset of ISPs.

PatrickDeese

8:03 pm on Jul 16, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I wonder if they're doing this attack by hand?

Can you plant an innocuous seeming cookie into their computer(s) that give them fake adsense ads, or even better gives them real ads using the AdSense test publisher ID - they might never catch on that way, and all their clicks won't be on your ID's account.

They are obviously determined to circumvent your counter measures, that's why I think switching the Pub ID might be the way to go - it may be too subtle for them to notice.

gregbo

8:20 pm on Jul 16, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Can you plant an innocuous seeming cookie into their computer(s) that give them fake adsense ads, or even better gives them real ads using the AdSense test publisher ID - they might never catch on that way, and all their clicks won't be on your ID's account.

They are obviously determined to circumvent your counter measures, that's why I think switching the Pub ID might be the way to go - it may be too subtle for them to notice.

If they're sophisticated fraudsters, they'll refuse the cookies.

PatrickDeese

8:38 pm on Jul 16, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



> If they're sophisticated fraudsters, they'll refuse the cookies.

No cookies - no ads. :)

But frankly, I would make your counter measures more subtle. Instead of refusing to serve ads like you have been, change the publisher ID - they'll most likely assume you've given up, or that they've slipped past the detection criteria never realizing that they're hammering the test publisher ID.

EricGiguere

10:44 pm on Jul 16, 2005 (gmt 0)

10+ Year Member



I've definitely been co-operating with Google, and they've told me my account remains in good standing. I'll keep sending them stuff. I'm sure they want to figure this one out themselves, who's to say that the click fraud perpetrators wouldn't just go do it to someone else?

Eric

Juan_G

11:59 pm on Jul 16, 2005 (gmt 0)

10+ Year Member



Some related threads on blocking IPs, etc.:

[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]
(...)

gregbo

3:52 am on Jul 17, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



No cookies - no ads. :)

Sorry, didn't realize this. But it brings up an interesting point. How much revenue opportunity is lost by people who've disabled cookies in order not to be served with ads? Is it worth more to G to lose revenue opportunities by not displaying the ads when cookies are disabled, because it reduces their exposure to click fraud?

EricGiguere

9:50 am on Jul 17, 2005 (gmt 0)

10+ Year Member



Thanks, I'll look through those other discussions and see if there's anything that can help me. I still haven't figured out if they're trying to go after me or if they're going after certain advertisers (mostly pay-per-click related because of what my site's about) and trying to deplete their ad budget. The attacker's back right now, for example, and has focused attention on a different page now that I removed ads from the home page.

Eric

WallyWorld

3:05 pm on Jul 17, 2005 (gmt 0)

10+ Year Member



This must be getting rampant! My clicks suddenly skyrocketed a few days ago but I don't see that they are coming from my websites. So, someone must have copied my ad (or content with an ad) to another site where it is being clicked like crazy.

I reported this to G and asked for a list of domains giving my acct. clicks but they won't release that info. The clicks are still coming but at a slower rate.

That's about all you can do is alert G and provide any info you have. They shouldn't ban you if it isn't your fault.

beggers

7:30 am on Jul 18, 2005 (gmt 0)

10+ Year Member



No cookies - no ads.

I must have missed this little tidbit of info. Why would rejecting cookies prevent an ad from being displayed?

DamonHD

8:17 am on Jul 18, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Hi,

If I understand the suggestions correctly, the idea is that you set up your site NOT to show ads unless the visitor correctly accepts a cookie from you (and replays it to you).

It's quite a neat idea except that I hate forcing cookies (or even sessions) on visitors if I don't have to.

Rgds

Damon

EricGiguere

4:09 pm on Jul 18, 2005 (gmt 0)

10+ Year Member



I don't think the cookie approach works well generally. You'd be better off with forcing people to register to see ads, which I doubt they'll do unless there's some other benefit you can provide!

I can certainly ban specific IP addresses, but I don't think the same IP addresses are used for this fraud. I still don't know if they're targeting me or specific advertisers. So far they only seem to have targeted pages on two sites that display PPC-related ads. So maybe they're targeting specific ads, and if I could figure out which ones then I guess I could always add them to my filter and avoid the problem that way. Of course, the fraudster would just go to someone else's site and do the same thing there, so it's not solving the ultimate problem, just my own.

Unless Google give me more info about the ads that are being clicked, I may have to figure it out on my own. I know there's some JavaScript code you can use to track actual clicks, maybe I'll have to try out something like that. Still wastes my time, which is what really burns me, time I should be spending on new content or improved SERPs.

Eric

ann

1:06 am on Jul 19, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



have you tried the preview tool to find out the URLs? Most times the ad company name precedes the name of the site being advertised.

Find the dodgy ones, the ones with bad reps, and filter them out. It might help.

Ann

Could be some dodgy company is using hired clickers to "surf" and paying them a penny a click to use up the clients money.

JFels

10:04 pm on Aug 4, 2005 (gmt 0)

10+ Year Member



>>I'm starting to think someone's gunning for me.

We've had that happen to us, too. We reported it to AdSense, we took down the page that appeared to be getting hit by a bot someone aimed at us. We were told by AdSense that we didn't have to take down the ads on that page, that we could put the ads back up and that our AdSense account was in good standing.

Then the other day I got an email telling me our AdSense account had been disabled for invalid clicks.

I've written to AdSense giving them the support ticket number of the original correspondence, but so far no response. Does anyone know how long it takes the AdSense team to respond if they are going to? Or how to find out what exactly caused the account to be disabled?

We are a legitimate publisher - biggish site with real content that gets updated on a regular basis. And we don't click on links on our site, and don't tell or visitors to do so, or hire any outsiders.

We will obviously look for other ways to fill the ad space, but it irks me that we would get disabled for something we haven't done.

miguelito

10:33 pm on Aug 4, 2005 (gmt 0)

10+ Year Member



I've written to AdSense giving them the support ticket number of the original correspondence, but so far no response. Does anyone know how long it takes the AdSense team to respond if they are going to? Or how to find out what exactly caused the account to be disabled?

How long does it take them to realise that they have absolute idiots working for them? Difficult question, they should have correspondence records but the fool who took down your website obviously didnīt bother to read it and is probably now desperately trying to cover up his mistake by deleting and intercepting any correspondence you send.

I would send a message to adsenseadvisor (this forum) he may know someone you can email to avoid your emails getting intercepted by the troll who messed up your account.

Dantol

10:37 pm on Aug 4, 2005 (gmt 0)



maybe they don't like what I write about or they think it would be funny to get me kicked out

What do you write about? Is it politics?

edited

JFels

3:09 pm on Aug 5, 2005 (gmt 0)

10+ Year Member



I don't use this forum very much. Are there any instructions for the sticky mail? Should mail you sent show up in the sent mail folder? (I just tried twice, and it doesn't show up.)

bose

3:32 pm on Aug 5, 2005 (gmt 0)

10+ Year Member



While you are focusing on doing whatever you can to block Ads from being shown to those guys, have you looked into reporting this to those reponsible for administering those networks?

Look up contact detals (at Arin.net) to find out to whom those IP blocks are assigned to, and their "Abuse contact" details. Notify them of such abuse stemming from their network. Most admins will glady yank/disable those accounts in a heartbit. Of course, this gets a bit difficult if they are using proxies or if the traffic originates from other countries, but it may be something you may want to look into.

Hope this gets sorted out for you.

dRkE

3:46 pm on Aug 5, 2005 (gmt 0)

10+ Year Member



Well i had the same prob, contacted G several times no luck. in one of the emails they even reminded me that they can tirminate your account at anytime and thats it.

So i'd just wait for the tirmination email, i was told that the email is final and they cant re-activate your accounts if its been tirminated for invalid clicks.

Goodluck man, i cant participate in adsense anymore because of people who find it funny to attack your ads.

bose

4:00 pm on Aug 5, 2005 (gmt 0)

10+ Year Member



JFels wrote:
We were told by AdSense that we didn't have to take down the ads on that page, that we could put the ads back up and that our AdSense account was in good standing.

Then the other day I got an email telling me our AdSense account had been disabled for invalid clicks.

Sorry to hear that. Hope your account gets reinstated.

What kind of revenue scale (judging from numbers of click & total earnings) are we talking about here? I do not know anything about your site, so I am not implying/assuming anything here one way or the other. However, it may have ultimately boiled down to whether or not continuing to spend time/money on a "chronically problematic" (especially if it is a small-time) publisher account makes business sense (cost justification) for Google. We (the adsense publishers) may not like it, but it may make perfect sense to their stockholders. Just a thought...

[edited by: bose at 4:04 pm (utc) on Aug. 5, 2005]

vincevincevince

4:03 pm on Aug 5, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



How about this suggested routine? Would something like this help?

::At top of page
<?php
$mypublisherid="123456789";
$testpublisherid="abcdefghi";

if ((`grep /path/to/logs/access.log $_SERVER[REMOTE_ADDR]`)&&(!$_COOKIE['returning'])) $use=$testpublisherid;
else
{
setcookie("returning","1",time()+3600*24*365);
$use=$mypublisherid;
}
?>

Then within your adsense block, where you require the publisher id put:

...id="<?=$use?>"

uk_webber

5:04 pm on Aug 5, 2005 (gmt 0)



Don't rely too much on Adsense - it is easy to get booted out if someone has it in for you.

Concentrate on Affiliate links more...

JFels

5:09 pm on Aug 5, 2005 (gmt 0)

10+ Year Member



Our account was just reinstated based on the information I had provided.

From this experience, I'd suggest that anyone who does see strange clicks on their site report it immediately to AdSense (as we did), and keep a copy of any correspondence and support ticket number to make it easy to find if needed.

JFels

5:14 pm on Aug 5, 2005 (gmt 0)

10+ Year Member



Someone above asked about revenue scale. Rather than posting numbers, I'll just comment that we reach over a million unique visitors each year with an audience that often refers our site to their friends. It's a demographic where we can still get sort of decent CPM rates too.

dRkE

6:10 pm on Aug 5, 2005 (gmt 0)

10+ Year Member



vincevincevince

thats a clever way to get around it but its against the tos to edit the ad code in anyway.

Nice to have heard that you got your account back.
Also i find it unfair on how i got booted out while i was away so couldnt check my site and yet anything i said to google gave me the same reply. Its life!

This 32 message thread spans 2 pages: 32