Clickbots and the Wisdom of Rosie Perez
Posted on February 27th, 2006by Michael Gray in Adsense, Advertising
If you're new here, you may want to subscribe to my RSS feed. Read my top posts or learn more about Michael Gray. Want more frequent updates follow me on Twitter. Thanks for visiting!
So yesterday one of my websites was targeted by a clickbot. They executed the exact same search 400 times from the exact same search engine, visited a few pages on the websites and then clicked on an Adsense ad. Now I’m not sure if it was a script kiddie playing a prank or a malicious attempt to get my AdSense pulled for fraudulent clicks, but either there were no committee’s to select or meeting to be held I had to swoop into action.
First I fired off a quick note to Adsense to make them aware of what was happening with as much information as I had at the time. I haven’t heard back from them yet but will add to this post if I do and it’s relevant. After that I identified the search and caused all incoming requests from that particular engine and phrase to “die”. Ok now that the hemorrhaging had stopped it was time to figure out what was going on. After reviewing the logs the query and search engine were identical but the IP’s were different about 50 different ones with no common range of numbers. After doing some investigating I found they were all coming from one ISP. So I did a little searching and came up with this bit of PHP to give me the ISP info:
$ip = getenv('REMOTE_ADDR');
$host = gethostbyaddr($ip);
Now on almost all of my website I have a variable flag that allows me to turn the affiliate ads, ad sense, yahoo publisher network, chitika, and or banner advertising by changing only one variable in a common include file. I will admit I contemplated just turning AdSense off until I had solved the problem but didn’t want to give the fraudster the satisfaction of victory, but I didn’t want to lose my webmaster welfare check either. I will also admit I wanted to trap for the condition, and send the person over to transvestiteporn.com (NSFW you have been warned) or some other website with 9 bazillion pop-ups, but I remembered the movie “White Men Can’t Jump” and the bit of wisdom Rosie Perez had to share, “Sometimes when you win you really lose, and sometimes when you lose, you really win”. Anyone who’s married can tell you there is truth in that statement. So I realized the joy I got from sending them away would probably make them come back and attack more heavily. Instead I thought about how to make that person think they “won”. I came to the conclusion they wanted my Adsense down, and since I was able to trap for the condition I could turn off all the ads just as easily as sending them away. So when that person checks the script they will see the AdSense turned off and think they won, when they really lost.
Sphere: Related Content
February 27th, 2006 at 6:44 am
Yep, been there, and did similar stuff. But they were more clever and were using multiple IPs through some zombies and so it was harder to fix. I had to disable ad displays on certain pages for a while, and then I asked permission from Google to delay displaying the AdSense ads on my pages in an attempt to dissuade them from visiting the site. (Don’t do that without first asking permission…. these are the kinds of exceptions to normal AdSense rules that are done on a case-by-case basis.) Eventually, though, after forwarding enough log data to Google they were able to adjust their filters to ignore those fraudulent clicks and I returned everything to normal. Now they could click away and it wouldn’t bother me…
February 27th, 2006 at 12:14 pm
Question: how did you know it happened? Presumably you’ve got a bunch of sites going and you are not starting at analytics all day. Do you have an activity trigger of some sort? Care to share your approach?
February 27th, 2006 at 12:34 pm
I have Adsense notifier for firefox I have it set up to show me impressions, clicks and earnings. I’m in the habbit of looking at it throughout the day and know where the numbers should be. So when something looks “wrong” I log into adsense to see what’s going on.
February 28th, 2006 at 12:54 pm
Ah, got it.
Thanks for the AdSense notifier pointer!