1. What is click fraud?

Click fraud is usually defined as the act of purposely clicking on ads on pay-per-click programs with no interest in the target web site. Two types of fraud are usually mentioned:

• An advertiser clicking on competitor ads to deplete their ad spend budgets, with fraud frequently taking place early in the morning and through multiple distribution partners: AOL, Ask.com, MSN, Google, Yahoo, etc.


• A malicious distribution partner trying to increase its income, using clickbots or paid human beings to generate traffic that looks like genuine clicks.

While these are two important sources of non-converting traffic, there are many other sources of poor traffic. Some of them are sometimes referred to as invalid clicks rather than click fraud, but from the advertiser or publisher viewpoint, there is no difference. In this paper, we are considering all types of non billable or partially billable traffic, whether it is the result of fraud or not, whether there is or there is no intent to defraud, and whether there is or there is not a financial incentive to generate the traffic in question. These sources of undesirable traffic include:

• Accidental fraud: a home-made robot not designed for click fraud purposes, running loose, out of control, clicking on every links, possibly because of a design flaw. An example is a robot run by spammers harvesting email addresses. This robot was not designed for click fraud purposes, nevertheless ended up costing money to advertisers.


• Political activists: people with no financial incentives, but motivated by hate. This kind of clicking activity has been found against companies recruiting people in class action lawsuits, and results in artificial clicks and bogus conversions. It is a pernicious kind of click fraud because the victim thinks its PPC campaigns generate many leads, while in reality most of these leads (email addresses) are bogus.


• Disgruntled individuals: it could be an employee working for a PPC advertiser or a search engine, who was recently fired. Or it could be a publisher who believes to be unjustifiably banned.


• Unethical guys in the PPC community: small search engines trying to make their competitor look bad by generating unqualified clicks, or shareholder fraud.


• Organized criminals: spammers and other internet pirates used to run bots and viruses, who found that their devices could be programmed to generate click fraud. Terrorism funding comes in this category, and is investigated by the both FBI and the SEC.


• Hackers: many people have now access to home made web robots (the source code in Perl or Java is available for free). While it is easy to fabricate traffic with a robot, it is more complicated to emulate legitimate traffic as it requires spoofing thousands of ordinary IP addresses – not something any amateur can do well. Some individuals might find this as a challenge and generate high quality emulated traffic, just for the sake of it, with no financial incentives.


• Traditional media losing market share to PPC advertising have incentive to contribute to click fraud.

In this paper, we will be even more general by encompassing other sources of problems not generally labeled as click fraud, but sometimes referred to as invalid, non-billable, or low-quality clicks. This includes

• Impression fraud: impressions and clicks should always be considered jointly, not separately. This can be an issue for search engines, as their need to join very large databases and match users with both impressions and clicks. In some schemes, fraudulent impressions are generated to make a competitor’s CTR look low. Advanced schemes use good proxy servers (e.g. AOL) to hide the activity. When the CTR drops low enough, the competitor ad is not displayed anymore. This scheme is usually associated with self-clicking, a practice where an advertiser clicks on its own ads though proxy servers to improve its ranking, and thus improve its position in search result pages. This scheme targets both paid and organic traffic.


• Multiple clicks: while multiple clicks are not necessarily fraudulent, they end up either (i) costing lots of money to advertisers when they are billed at the full price or (ii) costing lots of money to publishers and search engines if only the first click is charged for. Another issue is how to accurately determine that two clicks – say five minute apart – are attached to the same user.


• Fictitious fraud: clicks that appear as fraudulent, but are never charged for. These clicks can be made up by unethical click fraud companies. Or they can be the result of testing campaigns, and we call them click noise. A typical example is Googlebot. While Google never charges for clicks originating from its Googlebot robot, other search engines that do not have the most updated list of Googlebot IP addresses might accidentally charge for these clicks. Another example of fictitious fraud further discussed in this paper is fictitious clicks. We explain what fictitious clicks are and how they can be detected.

New fraud scheme on Google (phishing / click fraud) 
Fraudsters send you a fake email about your AdWord account being terminated. They ask you to renew your account by login on to a fake Google AdWord website that looks real. That's how they steal your login/password. Once your account is hijacked, they increase your daily budget and your bid for keywords that are part of their botnet system. In the process, they might also steal your credit card info or other useful info (your address for identity theft, your keyword list to feed their botnet).

Complaint received from a client:

Vincent....don't know if you'd be interested in this...but i use
google ad words & just recently someone hacked into my profile &
changed my daily max from $10 to $6,810, and then miraculously i
received over 1,000 clicks that day at $5.50 per click....they were
trying to charge me over $7K. I reported it and about a week later
they admitted it was not legitimate. Have you heard of this

Email sent by fraudsters:

Renew Your Account Now !

Dear Member,

This is your official notification from Google Inc. that the service(s) listed below will be deactivated and deleted if not renewed immediately.

As the Primary Contact, you must renew the service(s) listed below or it will be deactivated and deleted.

Renew Now your Google AdWords services. [link deleted]

SERVICE: Google AdWords
EXPIRATION: August, 19 2008

Thank you for using Google Inc service.
We appreciate your business and the opportunity to serve you.

Google AdWords Service .

Invitation to join Analytic Bridge 
Analytic Bridge has grown from 20 to about 400 people in just one week. We invite you to revisit our network, and sign up if you are not already a member.

In the last seven days, we have added many groups, several white papers, dozens of useful links. Also, members have contributed to several forums, including

• Explanation of Variance Inflation Factor


• Data Validation


• Post your best graphs in our photo section


• How to produce nice graphs with R?


• Data Warehousing, ETL and Business Intelligence opportunites


• Professional Certificates (chartered statistician, SAS certified, series 6, etc.)


• Spatial ETL Pros Needed for Leader in Geographic Business Intelligence Solutions


• Genetic Data Mining Method for the Proper Use of the Correlation Coefficient


• Who makes $100K or more a year?


• Companies hiring statisticians and data miners


• Best books for learning data mining


• Basic Introduction to Text Mining


• Non-Linear ARIMA using neural nets?


• Statistics handbooks now available in the links section


• Jobs in Switzerland


• Interesting discussions on the Web Analytics group


• Data mining blog


• LinkedIn, Plaxo, Facebook and other networks


• Building Statistical Regression Models: Straight Data are Necessary


• Domain names for sale


• Career paths: switching to a different industry


• Generalized Goldbach Conjecture and Integer Coverages


• XML job feeds available for your blog


• Starting Salaries for Analytic Graduates


• Useful links


• Statistical Software - Comparative Analysis

To join Analytic Bridge, visit us at http://www.analyticbridge.com/. Members are also entitled to a 20% discount on all products available on DataShapingStore.com. Please contact us for details.

Vincent Granville, Ph.D.
Founder and Principal
http://www.datashaping.com/
http://www.analyticbridge.com/

Massive Click Fraud Case Unearthed in our Laboratory 
Here we provide specific details about a widespread botnet still operating. As many as 50% of all advertisers may be victims, albeit with a low frequency. It is connected with a particular search distribution partner on the largest search engine network. We will call it Spiralup, although its real name is different. Their brand is associated with spyware, though they have clearly added click fraud to their areas of focus.

1. Their traffic has been growing exponentially over the last few years, according to Alexa (see graph below). Note that Alexa can’t always discriminate between real and fake traffic. Software (AlexaBooster) is available which allows a user to artificially inflate Alexa rankings.


2. Note two sharp dips in early 2006 and 2007 (see graph below).


3. In 2006, the browser distribution was different, with more Firefox, possibly indicating a network of human beings paid to click.


4. In 2007, the browser distribution shifted, favoring Internet Explorer, as they employ a botnet programmed specifically for IE but not for other browsers.


5. They continually add new advertisers to their target list, but rarely generate more than 3 clicks per day per advertiser. Newly infected computers are assigned to advertisers recently added to their list.


6. Advertisers accepting clicks from foreign countries, and small advertisers, are hit hardest. 


7. A portion of their traffic is real, a portion of it is bogus, generated by botnets (clicking agents attached to viruses), and a portion of it comes from human beings paid to click according to a pre-specified schedule.


8. Because they have infected so many computers, they are able to use a very large pool of IP addresses, though the traffic skews towards international, and some specific IP blocks and foreign transparent proxies are widely used.


9. Their traffic patterns are associated with unrealistic variances and they generate an extremely high proportion of bogus conversions.


10. Below is a table with four sample clicks:�
    
    
    
    • 13/May/2007:08:58:54, query=data marts, IP=xxx.139.16.154
    
    
    • 02/May/2007:04:31:47, query=on line shopping sears canada, IP=xxx.55.121.2
    
    
    • 06/Jan/2007:02:22:23, query=malpractice, IP=xxx.115.106.226
    
    
    • 13/Feb/2007:19:33:17, query=fort myers mesothelioma lawyers, IP=xxx.152.21.8
    
    
    
    

    Details:

    
    
    
    
    • Each click is from a different advertiser.
    
    
    • Each click has a Google gclid tag.
    
    
    • The time zone is from the advertiser log.
    
    
    • The first click was billed at full price (even days later, the charge did not disappear). It resulted in a bogus conversion. It also triggered an HTTP request on the target page for a blank stylesheet.
    
    
    • This means that the botnet is a parasite of Internet Explorer, and does not have its own code to connect to the Internet, but rather relies on Internet Explorer to do so. 
    
    
    • All four clicks have IE 6 as a user agent, as one would expect.
    
    
    
    

Spiralup's exponential traffic growth:
�