9 ms·

Service drains competitor's Adwords budget

177 points by jusben1369 12y ago

FatalLogic 12y ago
Sometimes referred to as 'reverse click fraud'. Here's how it can look from the point of view of one of the sites that hosts the ads paid for by the victim: http://www.dslreports.com/shownews/Adsense-Click-Fraud-88596 http://www.dslreports.com/shownews/Adsense-Click-Fraud-88596 The site gets lots of visits from random IPs, all searching for the same odd phrase, such as 'Female Impotence' in this case.
opendais 12y ago
I do wonder since he is using a gmail account if it is a honeytrap. That seems like a very, very dumb thing to do if one's objective is to defraud Google. His entire client list will be accessible through them.
- jusben1369 12y ago
  Does he really defraud Google? They're still getting paid.
  - opendais 12y ago
    I suppose that was the wrong phrasing. I should have said defraud Google's customers.
  - cyorir 12y ago
    At the very least, it devalues Google's own service. Victims of this service will see lowered impact of advertising through Google, so they are more likely to simply drop/lower reliance on Google as a form of advertising and look for alternatives.
  - dangrossman 12y ago
    They get paid for another month, or maybe a few, until the advertiser sees that their ads now cost more than the revenue they bring in, as the fake/purchased clicks don't ever buy the company's products or services. At that point logic dictates that they cancel their ads with Google. Google would have earned that bit of money either way, but now they've lost all the future revenues from that business. If you dig into almost any AdWords account and make a custom report that includes the "invalid clicks" column, you'll see that they already don't charge advertisers for a very large percentage of ad clicks. I have an "invalid activity" credit in my billing statement just about every month, which is an automatic refund for potentially fraudulent clicks that weren't detected immediately. You don't generally have to ask for the refunds, it's in their best interest to cancel those clicks and keep advertisers' ROI positive so they continue paying in future months.
    - JustinJBM 12y ago
      This is about Company A removing Company B, C, D, & E from the search results so that Company A gets all the sales and leads from that day. Company A would be happy if it scares them away permanently -- then they don't even have to pay the Hacker to deplete their daily budget anymore. These particular hackers obviously have a service that Google's Invalid Clicks detection cannot pick up and it's successfully depleting advertisers' budgets -- hence the positive reviews they have.
      - dangrossman 12y ago
        Right. You can only remove Company B-E's ads by depleting their daily budgets. The service Company A paid for does not include purchasing Company B-E's products or services, just knocking out their ads. Those advertisers will see a negative ROI from their Google ads and eventually cancel them. Now Google has lost four customers and the one that remains no longer has to compete for ad space. Google loses all of Company B-E's ad spend, and most of Company A's ad spend as it can drastically lower its bids. They are not "still being paid", which is why they are heavily incentivized to identify this fraud and ignore or refund for the clicks that company is generating.
- deleted 12y ago
  [deleted]
PaulHoule 12y ago
I was looking for this tool called XRumer but I can't remember the link...
johnvschmitt 12y ago
As opposed to how VC's drain competitor's adwords budgets? Meaning, this is too often how I see competitive bids going over time: 1) You sell a widget for $100, and it costs you $50, so you spend $10 on the ad, & make $40 margin. 2) Your competition gets in, & has similar price/costs, & bids $11 on the ad. 3) After a few iterations, you both bid $49.50 for the ad, making near zero (positive) margins & stay in business. 4) But, VC-backed businesses enter that market. The VC (rightly) tells the startup that they aren't going to make profit in the first year anyway, but they MUST show user-growth. And, here's the VC money to pay for user growth. 5) So, the VC-backed startup bids the ads up to $100+, far above profitability for legit bootstrapped or existing profitable companies. That's how the ad budgets can be drained in the ecosystem. I know a lot of investors here that don't want to take the blame for this impact and may downvote me, but I do see this happening for many keywords over time. I don't need to be popular on this issue.
- opendais 12y ago
  There is a difference between actively and maliciously targeting adwords to destroy people's money and healthy competition b/t pools of capital/businesses. You are engaging in false equivalence.
  - johnvschmitt 12y ago
    I'm not saying that the VC-backed company is intentionally or maliciously poisoning the healthy profit of the competition. I'm saying that it's an unintentional byproduct of the otherwise naturally healthy approach to "grow first, profit later". Just like, I'm about to release a free game in the app market, no IAP, no cost, as I'm generous. But, that can & does have unintended consequences in the ecosystem to make it harder for those who do need to profit from their similar work.
    - opendais 12y ago
      Fair enough but by bringing it up in a thread about someone with a botnet screwing people over...its pretty reasonable to conclude that is what you meant.
at-fates-hands 12y ago
I remember seeing a lot of scripts that did the same thing back in the early 2000's. Back then people were hijacking servers and then using proxies to hide their IP addresses. Back then, you could either use it to increase your own ad revenue, or have them click on your competitors ads so yours would show sooner. Either way, this is why I tend to advise my clients to stay away from any paid advertising on the internet. It's a total sham. Either you get lucky and get some traffic with zero conversions, or your budget is wasted by someone using fraud.
chrischen 12y ago
I'm almost certain my business was targeted by this. I even got an anonymous email from the competitors threatening me to stop the ads, at the same time mysterious click traffic drained my adwords budget. Is anyone out there an expert in this field that could help me investigate?
Throwaway823 12y ago
Slightly different, but I had a user attempt to get my AdSense account banned by repeatedly clicking ads for days. Sadly, for the advertisers, Google didn't do a thing. This user racked up close to 10,000 clicks, my earnings skyrocketed for a day or two, and I contacted Google with clear evidence pointing to a particular IP address, and explained the situation in-depth with server logs. This was submitted through their form to contact them about click fraud, and I never heard back. Those advertisers paid for thousands of fake clicks, and I ended up with a decent chunk of change. I can't understand how they missed it. My clicks are level for years, and then during a couple of days, they increase 50-100x normal levels. This should have been a huge red flag.
- grey-area 12y ago
  Because they have a monopoly on advertising it's not really in their interest any more to detect click fraud.
  - spacemanmatt 12y ago
    They do not hold a monopoly on advertising. They hold the majority of the business, for now, but the structure of how and why they have that business is not monopolistic. Source: Dearth of legal action from competitors or DOJ. And make no mistake -- their competitors are litigious as fuck.
    - grey-area 12y ago
      Yes, it's a slippery term so probably not the best word to use, however the majority of display and search ads are served by google and unfortunately this does mean they have little incentive to actually address click fraud, though they do obviously make some efforts, we wouldn't hear stories like the parent post if those efforts were effective. Fraud was reported and went completely unaddressed - that's not really acceptable to my mind and indicates they feel little pressure to mitigate it as that's not an isolated report. Re the absence of lawsuits, I'm not sure that is positive proof of anything.
- rogerdpack 12y ago
DonPellegrino 12y ago
This reminds me of a nasty attack I learned about recently. I run http://unblock.us.org http://unblock.us.org, a DNS/anti-censorship server. Unblock does tunneling for censored websites. There are scripts out there that scan the whole internet for servers that accept HTTP and HTTPS requests to proxy. Those scripts are set up to simultaneously HTTP(S) GET tons of doubleclick.net etc. URLs to get the site owner kicked off Google Ads. I can imagine the black hat hackers selling their services for anyone willing to hurt a competitor's income. Obviously my server detects those attacks and blacklists them right away, but I was shocked at the ease of carrying that kind of attack. One day I really need to blog about all the shocking stuff going on online that I learned about by running a public service.
- asax 12y ago
  You really should - that sounds super interesting!
- sleep-less 12y ago
  How can your server blacklist requests to doubleclick.net?
  - DonPellegrino 12y ago
    I don't tunnel HTTP/HTTPS requests to doubleclick.net at all to begin with (I use a whitelist for HTTP/HTTS), but if someone were to do too many DNS requests for the same domain in a short period of time I drop those requests as it means the Source IP I'm seeing is actually the IP of the victim of a DNS Amplification attack and sending them the response would make me a participant in that attack.
- unclebucknasty 12y ago
  >but I was shocked at the ease of carrying that kind of attack From affiliate marketing to PPC ad networks, etc., the implementing systems tend to be built as naively as possible. When you survey the implementations you quickly realize that the designers assume there are no bad actors in the known universe. Literally no thought was given to fraud. They generally tend to be wide open to abuse, and frequently through simple URL manipulation/automation and standard HTML. What's amazing is that billions of dollars are at stake, requiring little more than mouse-clicks. So, given that clicks are so insanely easy to simulate, you would think that these systems would be very robust; yet they are frequently the opposite. But, beyond the naivete, it is not entirely the networks' fault. They are locked in a never-ending game of cat-and-mouse with people who have very little to lose and much to gain.
gscott 12y ago
I setup a system to track every google adwords click by ip address then created a spreadsheet of the reverse dns and how many clicks to try and get a refund. It didn't matter how many times one ip address clicks through Google says that sometimes it might take a lot of clicks from one person because they are "deciding" if to buy or not. Anyway I sent several of these spreadsheets to Google and received a refund for a measly $28.00. They say they automatically do refunds but I get about $10 per $10k in refunds back automatically. It is not a very large amount.
bsaul 12y ago
People complain a lot about Google here, but some people working in the business for a while will remember the miva ad network. Boy was that network ugly. Sometimes during the month you would see a bump of traffic of 100x magnitude on all customers and of course no conversion at all. We used to say "looks like miva needs some cash this month". Google adwords/adsense didn't win by being a monopoly, they won because they were simply the best. Then they became a monopoly.
- spacemanmatt 12y ago
  This. Exactly. Google enjoys a natural monopoly (or in my view, a non-monopoly) in search because they continue to earn the most business there, not because they have eliminated viable alternatives.
  - throwawayads 12y ago
    Yes - but now they do a lot of the classic "use a good product in one to gain an advantage in another" tricks - https://medium.com/@ad_insider/googles-latest-monopoly-trick-27baf5983516 https://medium.com/@ad_insider/googles-latest-monopoly-trick...
  - TeMPOraL 12y ago
    Same with webmail. And maps. And other things. They just provide services that work and are optimized for usability, not for trying to upsell you something. I believe they deserve that natural monopoly for doing what they are (as long as they continue this course).
wyck 12y ago
There are services out there that supposedly monitor Google ad click fraud, does anyone have experience with them?
eli 12y ago
I suspect I was a victim of a version of this fraud years ago. Lots of suspicious clicks off of strange queries or weird AdSense blogs (the latter might have been the more straightforward AdSense fraud) and the visitors rarely engaged with more than one page. Google insisted that if there are any fraudulent clicks, they are detected automatically and we are not be charged for them. But it was essentially impossible to know if that's true. I guess it doesn't really matter: at the end of the day you tally up your metrics and AdWords is either worth it or not. Still a very frustrating experience.

177 points by jusben1369 12y ago

Sometimes referred to as 'reverse click fraud'. Here's how it can look from the point of view of one of the sites that hosts the ads paid for by the victim: http://www.dslreports.com/shownews/Adsense-Click-Fraud-88596 http://www.dslreports.com/shownews/Adsense-Click-Fraud-88596 The site gets lots of visits from random IPs, all searching for the same odd phrase, such as 'Female Impotence' in this case.

opendais 12y ago

I do wonder since he is using a gmail account if it is a honeytrap. That seems like a very, very dumb thing to do if one's objective is to defraud Google. His entire client list will be accessible through them.

jusben1369 12y ago
Does he really defraud Google? They're still getting paid.
- opendais 12y ago
  I suppose that was the wrong phrasing. I should have said defraud Google's customers.
- cyorir 12y ago
  At the very least, it devalues Google's own service. Victims of this service will see lowered impact of advertising through Google, so they are more likely to simply drop/lower reliance on Google as a form of advertising and look for alternatives.
- dangrossman 12y ago
  They get paid for another month, or maybe a few, until the advertiser sees that their ads now cost more than the revenue they bring in, as the fake/purchased clicks don't ever buy the company's products or services. At that point logic dictates that they cancel their ads with Google. Google would have earned that bit of money either way, but now they've lost all the future revenues from that business. If you dig into almost any AdWords account and make a custom report that includes the "invalid clicks" column, you'll see that they already don't charge advertisers for a very large percentage of ad clicks. I have an "invalid activity" credit in my billing statement just about every month, which is an automatic refund for potentially fraudulent clicks that weren't detected immediately. You don't generally have to ask for the refunds, it's in their best interest to cancel those clicks and keep advertisers' ROI positive so they continue paying in future months.
  - JustinJBM 12y ago
    This is about Company A removing Company B, C, D, & E from the search results so that Company A gets all the sales and leads from that day. Company A would be happy if it scares them away permanently -- then they don't even have to pay the Hacker to deplete their daily budget anymore. These particular hackers obviously have a service that Google's Invalid Clicks detection cannot pick up and it's successfully depleting advertisers' budgets -- hence the positive reviews they have.
    - dangrossman 12y ago
      Right. You can only remove Company B-E's ads by depleting their daily budgets. The service Company A paid for does not include purchasing Company B-E's products or services, just knocking out their ads. Those advertisers will see a negative ROI from their Google ads and eventually cancel them. Now Google has lost four customers and the one that remains no longer has to compete for ad space. Google loses all of Company B-E's ad spend, and most of Company A's ad spend as it can drastically lower its bids. They are not "still being paid", which is why they are heavily incentivized to identify this fraud and ignore or refund for the clicks that company is generating.
deleted 12y ago
[deleted]

PaulHoule 12y ago

I was looking for this tool called XRumer but I can't remember the link...

johnvschmitt 12y ago

As opposed to how VC's drain competitor's adwords budgets? Meaning, this is too often how I see competitive bids going over time: 1) You sell a widget for $100, and it costs you $50, so you spend $10 on the ad, & make $40 margin. 2) Your competition gets in, & has similar price/costs, & bids $11 on the ad. 3) After a few iterations, you both bid $49.50 for the ad, making near zero (positive) margins & stay in business. 4) But, VC-backed businesses enter that market. The VC (rightly) tells the startup that they aren't going to make profit in the first year anyway, but they MUST show user-growth. And, here's the VC money to pay for user growth. 5) So, the VC-backed startup bids the ads up to $100+, far above profitability for legit bootstrapped or existing profitable companies. That's how the ad budgets can be drained in the ecosystem. I know a lot of investors here that don't want to take the blame for this impact and may downvote me, but I do see this happening for many keywords over time. I don't need to be popular on this issue.

opendais 12y ago
There is a difference between actively and maliciously targeting adwords to destroy people's money and healthy competition b/t pools of capital/businesses. You are engaging in false equivalence.
- johnvschmitt 12y ago
  I'm not saying that the VC-backed company is intentionally or maliciously poisoning the healthy profit of the competition. I'm saying that it's an unintentional byproduct of the otherwise naturally healthy approach to "grow first, profit later". Just like, I'm about to release a free game in the app market, no IAP, no cost, as I'm generous. But, that can & does have unintended consequences in the ecosystem to make it harder for those who do need to profit from their similar work.
  - opendais 12y ago
    Fair enough but by bringing it up in a thread about someone with a botnet screwing people over...its pretty reasonable to conclude that is what you meant.

at-fates-hands 12y ago

I remember seeing a lot of scripts that did the same thing back in the early 2000's. Back then people were hijacking servers and then using proxies to hide their IP addresses. Back then, you could either use it to increase your own ad revenue, or have them click on your competitors ads so yours would show sooner. Either way, this is why I tend to advise my clients to stay away from any paid advertising on the internet. It's a total sham. Either you get lucky and get some traffic with zero conversions, or your budget is wasted by someone using fraud.

chrischen 12y ago

I'm almost certain my business was targeted by this. I even got an anonymous email from the competitors threatening me to stop the ads, at the same time mysterious click traffic drained my adwords budget. Is anyone out there an expert in this field that could help me investigate?

Throwaway823 12y ago

Slightly different, but I had a user attempt to get my AdSense account banned by repeatedly clicking ads for days. Sadly, for the advertisers, Google didn't do a thing. This user racked up close to 10,000 clicks, my earnings skyrocketed for a day or two, and I contacted Google with clear evidence pointing to a particular IP address, and explained the situation in-depth with server logs. This was submitted through their form to contact them about click fraud, and I never heard back. Those advertisers paid for thousands of fake clicks, and I ended up with a decent chunk of change. I can't understand how they missed it. My clicks are level for years, and then during a couple of days, they increase 50-100x normal levels. This should have been a huge red flag.

grey-area 12y ago
Because they have a monopoly on advertising it's not really in their interest any more to detect click fraud.
- spacemanmatt 12y ago
  They do not hold a monopoly on advertising. They hold the majority of the business, for now, but the structure of how and why they have that business is not monopolistic. Source: Dearth of legal action from competitors or DOJ. And make no mistake -- their competitors are litigious as fuck.
  - grey-area 12y ago
    Yes, it's a slippery term so probably not the best word to use, however the majority of display and search ads are served by google and unfortunately this does mean they have little incentive to actually address click fraud, though they do obviously make some efforts, we wouldn't hear stories like the parent post if those efforts were effective. Fraud was reported and went completely unaddressed - that's not really acceptable to my mind and indicates they feel little pressure to mitigate it as that's not an isolated report. Re the absence of lawsuits, I'm not sure that is positive proof of anything.
rogerdpack 12y ago

DonPellegrino 12y ago

This reminds me of a nasty attack I learned about recently. I run http://unblock.us.org http://unblock.us.org, a DNS/anti-censorship server. Unblock does tunneling for censored websites. There are scripts out there that scan the whole internet for servers that accept HTTP and HTTPS requests to proxy. Those scripts are set up to simultaneously HTTP(S) GET tons of doubleclick.net etc. URLs to get the site owner kicked off Google Ads. I can imagine the black hat hackers selling their services for anyone willing to hurt a competitor's income. Obviously my server detects those attacks and blacklists them right away, but I was shocked at the ease of carrying that kind of attack. One day I really need to blog about all the shocking stuff going on online that I learned about by running a public service.

asax 12y ago
You really should - that sounds super interesting!
sleep-less 12y ago
How can your server blacklist requests to doubleclick.net?
- DonPellegrino 12y ago
  I don't tunnel HTTP/HTTPS requests to doubleclick.net at all to begin with (I use a whitelist for HTTP/HTTS), but if someone were to do too many DNS requests for the same domain in a short period of time I drop those requests as it means the Source IP I'm seeing is actually the IP of the victim of a DNS Amplification attack and sending them the response would make me a participant in that attack.
unclebucknasty 12y ago
>but I was shocked at the ease of carrying that kind of attack From affiliate marketing to PPC ad networks, etc., the implementing systems tend to be built as naively as possible. When you survey the implementations you quickly realize that the designers assume there are no bad actors in the known universe. Literally no thought was given to fraud. They generally tend to be wide open to abuse, and frequently through simple URL manipulation/automation and standard HTML. What's amazing is that billions of dollars are at stake, requiring little more than mouse-clicks. So, given that clicks are so insanely easy to simulate, you would think that these systems would be very robust; yet they are frequently the opposite. But, beyond the naivete, it is not entirely the networks' fault. They are locked in a never-ending game of cat-and-mouse with people who have very little to lose and much to gain.

gscott 12y ago

I setup a system to track every google adwords click by ip address then created a spreadsheet of the reverse dns and how many clicks to try and get a refund. It didn't matter how many times one ip address clicks through Google says that sometimes it might take a lot of clicks from one person because they are "deciding" if to buy or not. Anyway I sent several of these spreadsheets to Google and received a refund for a measly $28.00. They say they automatically do refunds but I get about $10 per $10k in refunds back automatically. It is not a very large amount.

bsaul 12y ago

People complain a lot about Google here, but some people working in the business for a while will remember the miva ad network. Boy was that network ugly. Sometimes during the month you would see a bump of traffic of 100x magnitude on all customers and of course no conversion at all. We used to say "looks like miva needs some cash this month". Google adwords/adsense didn't win by being a monopoly, they won because they were simply the best. Then they became a monopoly.

spacemanmatt 12y ago
This. Exactly. Google enjoys a natural monopoly (or in my view, a non-monopoly) in search because they continue to earn the most business there, not because they have eliminated viable alternatives.
- throwawayads 12y ago
  Yes - but now they do a lot of the classic "use a good product in one to gain an advantage in another" tricks - https://medium.com/@ad_insider/googles-latest-monopoly-trick-27baf5983516 https://medium.com/@ad_insider/googles-latest-monopoly-trick...
- TeMPOraL 12y ago
  Same with webmail. And maps. And other things. They just provide services that work and are optimized for usability, not for trying to upsell you something. I believe they deserve that natural monopoly for doing what they are (as long as they continue this course).

wyck 12y ago

There are services out there that supposedly monitor Google ad click fraud, does anyone have experience with them?

eli 12y ago

I suspect I was a victim of a version of this fraud years ago. Lots of suspicious clicks off of strange queries or weird AdSense blogs (the latter might have been the more straightforward AdSense fraud) and the visitors rarely engaged with more than one page. Google insisted that if there are any fraudulent clicks, they are detected automatically and we are not be charged for them. But it was essentially impossible to know if that's true. I guess it doesn't really matter: at the end of the day you tally up your metrics and AdWords is either worth it or not. Still a very frustrating experience.