Archive for the ‘Case Studies’ Category

Case Study - Sometimes It Ain’t Click Fraud

Wednesday, June 11th, 2008

I was recently working with a client based in the US who had seen a masive increase in click through and no corresponsing increase in conversion. He contacted me with a view to investigate possible click fraud.

As a starting point I obtained an invalid click fraud report (see below). From this we can see an incredibly suspicious increase in clicks and cost per click

I asked for a copy of their web server logs to run through my analysis tool to see what was causing this problem.

The company works in the US mortgage space, a notoriously competitive and expensive place to advertise. An arena ripe for competitor click fraud attacks.

The client’s technical team went off to retrieve the logs for the particular weekend when the problem occcured, only to come back and report that the logs were not available. They could not be retrieved from the backups, they had gone missing! The month before and after were available but nothing for the suspicious weekend.

Lightbulbs lit up in my mind, but I did not want to alarm my client without any foundation. I thought this was an inside job.

Sure enough my client came back to me, a disgruntled employee had increased the cost per click and expanded the campaign widely . They also deleted the web server log files for the period in an effort to cover their tracks. The nett result was a click bill for perfectly valid clicks to the tune of tens of thousands of dollars. Needless to say the employee was shown the door very quickly.

The moral of the story, it’s not always click fraud, and only very trusted employees should be give the keys to your pay per click budget. The damage to the bottom line can be huge if your Adwords admin goes rogue.

These clicks were perfectly valid, and internal grudges is not an acceptable reason for a refund from Google.

Tags:
Posted in Case Studies, Features | 1 Comment »

Case Study Fraudulent Clicks on Fraudulent Clicks

Tuesday, January 8th, 2008

I am kicking off my first case study by analysing my own campaign.

Site: www.fraudulent-clicks.com

This site is a blog commenting on developments in click fraud. It provides excellent free content on click fraud, but it also has a click fraud consultancy services aimed at SME business to check their exposure to click fraud.

Campaign Details

The site is advertising on Google adwords. The campaign is enabled to display on the search network, including extended search partners and the content network.

The campaign is targeted at all countries and has no time limitations.

Keywords

The keywords this campaign is bidding are on relatively expensive, the max cost per click is GBP 2.00, with the average cost per click of the most popular keyword being GBP 1.30

Content bidding has been enabled at 0.10. This is a very good thing to reduce the cost of content network bids.

Publisher Click Fraud

This site is exposed to publisher click fraud. This is due to the fact that there is advertising on the content network. This is increased by the fact this campaign does not

Competitor Click Fraud

As if they would dare, all of the competitors of this site work in the click fraud arena. Anyone caught committing click fraud from this business sector would loose all credibility so my assessment of competitor click fraud is very low.

At the time of investigation, the main competitors on the keywords in use were:

  • www.ClickTracks.com
  • www.HitsLink.com
  • www.ppcassurance.com
  • www.ValidClick.com
  • www.opentracker.net
  • www.MarkWelch.com

Whilst the above links are reputable companies it is a useful activity to know who your keywords competitors are.

Low Quality Clicks

There were a large number of clicks coming from low quality sites. None of these clicks converted into sales. The following low quality sites were identified

  • www.starware.com
  • ajay.arumugam.googlepages.com
  • www.crimes-of-persuasion.com
  • www.stotis.com/
  • www.goseek.com
  • www.figator.com

etc etc etc etc - that’s what I get for un-targeted content network advertising.

ClickBot Activity

No bot activity was identified.

Actual Click Fraud/Invalid Click Attacks

Five click fraud attacks were identified. All emanated from the content network. The sites create multiple clicks from the same IP addresses.

  • www.markcarey.com
  • www.runcartoon.com
  • www.starware.com
  • ajay.arumugam.googlepages.com
  • xeonxen.googlepages.com

It has not been ascertained if the Google filters captured these attacks, this will become evident once the data has been submitted for a refund request.

The data captured is shown at the bottom of this post.

Recommendations

1) Pass data of actual click fraud to Google for refund.

2) Prevent access to ads from low quality MFA sites using the Google site exclusion tool

3) Tightly target content network advertising. At present, a scatter gun approach to content network advertising is taken. It is recommended that a) content network advertising be stopped b) analyse sites which are related to SEO and internet marketing and attempt to place ads on these sites.

4) Geo-target more tightly. Ads are being shown in all countries including the The High Risk Countries

Misc. Information.

The data was captured using Adwatcher.

Case studies are a cut down version of my consultancy service.

Reparations

A refund request has been made to Google, as yet no reply has been received, I will update this post once details have been confirmed by Google.

Invalid Click Data

Suspect Sites

as.starware.com
ajay.arumugam.googlepages.com
www.markcarey.com
xeonxen.googlepages.com
www.runcartoon.com

===============================
IP ADDRESS: 92.80.65.234
===============================
Number Of Suspicious Clicks: 6
Time Of The First Click: January 5, 2008, 4:59 pm
Time Of The Last Click: January 5, 2008, 5:00 pm
Referring URL:
http://as.starware.com/dp/search?product=esearch&client_id=6D5A2A6001C83E5F00449000&src_id=406&version=4.5.6.0
&qry=http%3A%2F%2Fpagead2%2Egooglesyndication%2Ecom%2Fpagead%2Fads%3Fclient%3Dca%2Dpub
%2D8341831326880882%26dt%3D1199552367906%26lmt%3D1199552367
http://as.starware.com/dp/search?product=esearch&client_id=6D5A2A6001C83E5F00449000&src_id=406&version=4.5.6.0
&qry=http%3A%2F%2Fpagead2%2Egooglesyndication%2Ecom%2Fpagead%2Fads%3Fclient%3Dca
%2Dpub%2D8341831326880882%26dt%3D1199552367906%26lmt%3D1199552367
http://as.starware.com/dp/search?product=esearch&client_id=6D5A2A6001C83E5F00449000&src_id=406&version=4.5.6.0
&qry=http%3A%2F%2Fpagead2%2Egooglesyndication%2Ecom%2Fpagead%2Fads%3Fclient%3Dca
%2Dpub%2D8341831326880882%26dt%3D1199552367906%26lmt%3D1199552367
http://as.starware.com/dp/search?product=esearch&client_id=6D5A2A6001C83E5F00449000&src_id=406&version=4.5.6.0
&qry=http%3A%2F%2Fpagead2%2Egooglesyndication%2Ecom%2Fpagead%2Fads%3Fclient%3Dca
%2Dpub%2D8341831326880882%26dt%3D1199552367906%26lmt%3D1199552367
http://as.starware.com/dp/search?product=esearch&client_id=6D5A2A6001C83E5F00449000&src_id=406&version=4.5.6.0
&qry=http%3A%2F%2Fpagead2%2Egooglesyndication%2Ecom%2Fpagead%2Fads%3Fclient%3Dca
%2Dpub%2D8341831326880882%26dt%3D1199552367906%26lmt%3D1199552367
http://as.starware.com/dp/search?product=esearch&client_id=6D5A2A6001C83E5F00449000&src_id=406&version=4.5.6.0&
qry=http%3A%2F%2Fpagead2%2Egooglesyndication%2Ecom%2Fpagead%2Fads%3Fclient%3Dca
%2Dpub%2D8341831326880882%26dt%3D1199552367906%26lmt%3D1199552367

Keyword Query: adwords click fraud

===============================
IP ADDRESS: 122.164.155.237
===============================
Number Of Suspicious Clicks: 5
Time Of The First Click: January 6, 2008, 8:28 am
Time Of The Last Click: January 6, 2008, 9:52 am
Referring URL:
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-1646322936775491
&dt=1199608094343&lmt=1199608094&output=html&slotname=9089965093&correlator=1199608094343
&url=http%3A%2F%2Fajay.arumugam.googlepages.com%2F&cc=100&ga_vid=1485927419.1199608094&g
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-1646322936775491
&dt=1199610191702&lmt=1199610191&output=html&slotname=9089965093&correlator=1199610191702
&url=http%3A%2F%2Fajay.arumugam.googlepages.com%2F&cc=100&ga_vid=383524832.1199610192&ga
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-1646322936775491
&dt=1199612946202&lmt=1199612946&output=html&slotname=9089965093&correlator=1199612946202
&url=http%3A%2F%2Fajay.arumugam.googlepages.com%2F&cc=100&ga_vid=1563449697.1199612946&g
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-1646322936775491
&dt=1199613118015&lmt=1199613117&output=html&slotname=9089965093&correlator=1199613117984
&url=http%3A%2F%2Fajay.arumugam.googlepages.com%2F&cc=100&ga_vid=1541846055.1199613118&g
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-1646322936775491
&dt=1199613118015&lmt=1199613117&output=html&slotname=9089965093&correlator=1199613117984
&url=http%3A%2F%2Fajay.arumugam.googlepages.com%2F&cc=100&ga_vid=1541846055.1199613118&g

Keyword Query: adwords click fraud

===============================
IP ADDRESS: 203.76.124.203
===============================
Number Of Suspicious Clicks: 4
Time Of The First Click: January 5, 2008, 4:25 pm
Time Of The Last Click: January 6, 2008, 6:54 am
Referring URL:
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-0747454270379786
&dt=1199550311390&lmt=1199550311&output=html&slotname=6046326262&correlator=1199550311390
&url=http%3A%2F%2Fxeonxen.googlepages.com%2Fadsense&cc=100&ga_vid=179783591.1199550311&g
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-0747454270379786
&dt=1199550478593&lmt=1199550478&prev_slotnames=6046326262&output=html
&slotname=6046326262&correlator=1199550478593&url=http%3A%2F%2Fxeonxen.googlepages.com%2Fadsense&cc=100&ga_
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-0747454270379786
&dt=1199551046812&lmt=1199551046&prev_slotnames=6046326262&output=html
&slotname=6046326262&correlator=1199551046812
&url=http%3A%2F%2Fxeonxen.googlepages.com%2Fadsense&cc=100&ga_
http://as.starware.com/dp/search?x=wKX1ILEOi+V4Si9t41cPILeCDXZ2TTLyDmv5wv8hSuvVSqjOZNs
0qOhbKdGOpkZpFjPkKZuSPgLKRCmC67c0nJlCtcpiWSFGDKU0oubcW7XnpB4MBVgiqlB0zuo2YxD6K4A8zOP62Y3
OAYQj7NYUyFtdj+gVMunag5CH+4YBHqzRYYVifgU2fgHljitGRX7qUp1AcWEe43YUxZVv/9Gyqta//1dF

Keyword Query:
click fraud adsense
adwords click fraud

===============================
IP ADDRESS: 193.220.208.72
===============================
Number Of Suspicious Clicks: 6
Time Of The First Click: January 5, 2008, 6:05 am
Time Of The Last Click: January 5, 2008, 6:15 am
Referring URL:
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-3176122997812369&
dt=1199513110656&lmt=1198405846&format=468×60_as&output=html&correlator=1199513110593
&url=http%3A%2F%2Fwww.runcartoon.com%2Fdec_13_2007.htm&ad_type=text&ref=http%3A%2F%2Fwww.ru
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-3176122997812369&
dt=1199513278968&lmt=1199053679&format=468×60_as&output=html&correlator=1199513278890
&url=http%3A%2F%2Fwww.runcartoon.com%2Fdec_20_2007.htm&ad_type=text&ref=http%3A%2F%2Fwww.ru
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-3176122997812369&
dt=1199513419890&lmt=1198405846&format=468×60_as&output=html&correlator=1199513419843
&url=http%3A%2F%2Fwww.runcartoon.com%2Fdec_13_2007.htm&ad_type=text&ref=http%3A%2F%2Fwww.ru
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-3176122997812369&
dt=1199513536328&lmt=1198405836&format=468×60_as&output=html&correlator=1199513536265
&url=http%3A%2F%2Fwww.runcartoon.com%2Fdec_19_2007.htm&ad_type=text&ref=http%3A%2F%2Fwww.ru
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-3176122997812369&
dt=1199513650515&lmt=1198405842&format=468×60_as&output=html&correlator=1199513650437
&url=http%3A%2F%2Fwww.runcartoon.com%2Fdec_14_2007.htm&ad_type=text&ref=http%3A%2F%2Fwww.ru
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-3176122997812369&
dt=1199513716375&lmt=1196637327&format=468×60_as&output=html&correlator=1199513716312
&url=http%3A%2F%2Fwww.runcartoon.com%2Fnov_29_2007.htm&ad_type=text&ref=http%3A%2F%2Fwww.ru

Keyword Query: adwords click fraud

===============================
IP ADDRESS: 84.13.111.70
===============================
Number Of Suspicious Clicks: 4
Time Of The First Click: January 5, 2008, 5:22 pm
Time Of The Last Click: January 6, 2008, 3:39 pm
Referring URL: N/A
Keyword Query: {keyword}

===============================
IP ADDRESS: 41.233.45.194
===============================
Number Of Suspicious Clicks: 11
Time Of The First Click: January 4, 2008, 8:01 pm
Time Of The Last Click: January 4, 2008, 8:02 pm
Referring URL:
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&d
t=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com
%2Fgoogle_adsense_script.html&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372
http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-5115285947811955&
dt=1199476892883&lmt=1199476892&alternate_ad_url=http%3A%2F%2Fwww.markcarey.com%2Fgoogle_adsense_script.html
&format=120×600_as&output=html&correlator=1199476892821&channel=5372

Keyword Query: click fraud search engines

Tags:
Posted in Case Studies, Features | No Comments »