5 ms·

I gotta say... this is an incredibly naive analysis. To demonstrate Reddit Ads isn't doing click fraud protection, you should try to generate a fraudulent clic

I gotta say... this is an incredibly naive analysis. To demonstrate Reddit Ads isn't doing click fraud protection, you should try to generate a fraudulent click yourself. Looking at what is getting through and finding that a lot of it as easily identifiable as fraudulent is NOT a valid signal. It's incredibly likely that there are far more bots that are being blocked and that the bots that are getting through have invested a lot of effort in to fooling Reddit's fraud protection, but really don't care at all about fooling the landing page site (and of course, there are a lot more such sites, so it's a lot more expensive to design & operate a system that would fool all the other sites). Consequently, they're "easily identifiable" (though in truth the author is unfortunately use a very crude model for identifying fraud which will include a ton of false positives) by the landing page, but not by Reddit.

deleted 6y ago
[deleted]
TwoBit 6y ago
OK but doesn't OP demostrate that the same IP clicked 15 times in a short period of time and he was charged for all of them? How could that be complicated to handle?
- cbsmith 6y ago
  Well, for starters, the IP they see might not be the same IP that Reddit sees. If you are a fraudster, obfuscating IPs is something worth investing in to get by the ad network, not the publisher. There's no need to invest in fooling the publisher (in fact, appearing fraudulent to the publisher can be an objective). Secondly, 15 times in a short period of time from the same IP might just be the ad system targeting a particular group of people who all use the same NAT (which does indeed tend to happen). So it might not be fraud at all.
  - tupputuppu 6y ago
    There is no way to obfuscate an IP address on a TCP connection. The TCP sequence numbers are random so if the fraudster spoofs their IP, they won't get the return traffic and will be unable to complete the handshake and even establish a connection. As the original poster noted, 15 requests from a single IP in a short amount of time should be an anomaly. There's no real world scenario where 15 people behind one NAT show interest to a specific ad simultaneously.
    - cbsmith 6y ago
      > There is no way to obfuscate an IP address on a TCP connection. I think you misunderstand how this works/is done. > The TCP sequence numbers are random so if the fraudster spoofs their IP, they won't get the return traffic and will be unable to complete the handshake and even establish a connection. A bunch of misperceptions here. I'm posting this right now from an IP address that is different than the IP address that HN sees on their side. Likely you are as well. I'm not doing IP address spoofing like you are describing (though you can indeed do that, even with TCP... there are RFCs on it and everything, it's just totally unnecessary), because that isn't needed. A simple NAT, VPN, or proxy can obfuscate the IP you are using. Click fraud is really no different from SPAM in the way that perpetrators collect pools of IP addresses/computers and relay their activity through those addresses/computers to obfuscate its true origin. The TCP connection used to click on the ad on reddit is not the same TCP connection used to visit the advertiser's landing page, so there is no need to mess with anything at the TCP level for a different IP address to be presented to the publisher. > As the original poster noted, 15 requests from a single IP in a short amount of time should be an anomaly. There's no real world scenario where 15 people behind one NAT show interest to a specific ad simultaneously. Would you consider it an anomaly for 15 people anywhere on the Internet to show interest in an ad over a short amount of time? If so, you probably should rate limit your campaigns accordingly, but if not then there's no reason why you should consider it an anomaly for 15 people to show interest in an ad over the same IP. Particularly since ad engines have behaviours that make it disproportionately likely that an ad will be shown to people at the same time if they are behind the same IP. I'm not saying it isn't an anomaly. It could well be, but it is far from definitively fraud. This kind of "anomaly" happens all the time for reasons that have absolutely nothing to do with fraud.
stealthbot 6y ago
A company basically did what you described on Facebook, Google, Bing and Yahoo. https://www.methodmi.com/reports/in-plain-sight https://www.methodmi.com/reports/in-plain-sight
- cbsmith 6y ago
  A lot of companies have done this and do this kind of thing as a service. That said, this report's objective isn't really to measure click fraud detection on those networks. It's to highlight that one doesn't have to be very sophisticated to commit ad fraud (which is absolutely true). It also has some really odd ideas (e.g. they contacted the Chrome team to let them know about the existence of the stealth plugin in, and were surprised that the Chrome team said that the browser was working as intended so there was no action for them to take on their part... they similarly drew a false equivalence between defending account creation vs. defending click fraud). They also seemed to think that sites should be blocking bots, which is of course not what you want to do, because that provides a feedback loop to the fraudsters so that they can figure out how to overcome the measures. You want to proceed as if it is working, even let it show up in the ad campaign data at least initially, and as much as possible make corrections in ways that make it difficult to determine which traffic has been identified as fraud.

deleted 6y ago

[deleted]

TwoBit 6y ago

OK but doesn't OP demostrate that the same IP clicked 15 times in a short period of time and he was charged for all of them? How could that be complicated to handle?

cbsmith 6y ago
Well, for starters, the IP they see might not be the same IP that Reddit sees. If you are a fraudster, obfuscating IPs is something worth investing in to get by the ad network, not the publisher. There's no need to invest in fooling the publisher (in fact, appearing fraudulent to the publisher can be an objective). Secondly, 15 times in a short period of time from the same IP might just be the ad system targeting a particular group of people who all use the same NAT (which does indeed tend to happen). So it might not be fraud at all.
- tupputuppu 6y ago
  There is no way to obfuscate an IP address on a TCP connection. The TCP sequence numbers are random so if the fraudster spoofs their IP, they won't get the return traffic and will be unable to complete the handshake and even establish a connection. As the original poster noted, 15 requests from a single IP in a short amount of time should be an anomaly. There's no real world scenario where 15 people behind one NAT show interest to a specific ad simultaneously.
  - cbsmith 6y ago
    > There is no way to obfuscate an IP address on a TCP connection. I think you misunderstand how this works/is done. > The TCP sequence numbers are random so if the fraudster spoofs their IP, they won't get the return traffic and will be unable to complete the handshake and even establish a connection. A bunch of misperceptions here. I'm posting this right now from an IP address that is different than the IP address that HN sees on their side. Likely you are as well. I'm not doing IP address spoofing like you are describing (though you can indeed do that, even with TCP... there are RFCs on it and everything, it's just totally unnecessary), because that isn't needed. A simple NAT, VPN, or proxy can obfuscate the IP you are using. Click fraud is really no different from SPAM in the way that perpetrators collect pools of IP addresses/computers and relay their activity through those addresses/computers to obfuscate its true origin. The TCP connection used to click on the ad on reddit is not the same TCP connection used to visit the advertiser's landing page, so there is no need to mess with anything at the TCP level for a different IP address to be presented to the publisher. > As the original poster noted, 15 requests from a single IP in a short amount of time should be an anomaly. There's no real world scenario where 15 people behind one NAT show interest to a specific ad simultaneously. Would you consider it an anomaly for 15 people anywhere on the Internet to show interest in an ad over a short amount of time? If so, you probably should rate limit your campaigns accordingly, but if not then there's no reason why you should consider it an anomaly for 15 people to show interest in an ad over the same IP. Particularly since ad engines have behaviours that make it disproportionately likely that an ad will be shown to people at the same time if they are behind the same IP. I'm not saying it isn't an anomaly. It could well be, but it is far from definitively fraud. This kind of "anomaly" happens all the time for reasons that have absolutely nothing to do with fraud.

stealthbot 6y ago

A company basically did what you described on Facebook, Google, Bing and Yahoo. https://www.methodmi.com/reports/in-plain-sight https://www.methodmi.com/reports/in-plain-sight

cbsmith 6y ago
A lot of companies have done this and do this kind of thing as a service. That said, this report's objective isn't really to measure click fraud detection on those networks. It's to highlight that one doesn't have to be very sophisticated to commit ad fraud (which is absolutely true). It also has some really odd ideas (e.g. they contacted the Chrome team to let them know about the existence of the stealth plugin in, and were surprised that the Chrome team said that the browser was working as intended so there was no action for them to take on their part... they similarly drew a false equivalence between defending account creation vs. defending click fraud). They also seemed to think that sites should be blocking bots, which is of course not what you want to do, because that provides a feedback loop to the fraudsters so that they can figure out how to overcome the measures. You want to proceed as if it is working, even let it show up in the ad campaign data at least initially, and as much as possible make corrections in ways that make it difficult to determine which traffic has been identified as fraud.