Service drains competitor's Adwords budget

http://krebsonsecurity.com/2014/07/service-drains-competitors-online-ad-budget/

by jusben1369 • 12 years ago

177 58 12 years ago

FatalLogic• 12 years ago

Sometimes referred to as 'reverse click fraud'. Here's how it can look from the point of view of one of the sites that hosts the ads paid for by the victim: http://www.dslreports.com/shownews/Adsense-Click-Fraud-88596

The site gets lots of visits from random IPs, all searching for the same odd phrase, such as 'Female Impotence' in this case.

opendais5• 12 years ago

I do wonder since he is using a gmail account if it is a honeytrap.

That seems like a very, very dumb thing to do if one's objective is to defraud Google. His entire client list will be accessible through them.

jusben1369• 12 years ago

Does he really defraud Google? They're still getting paid.

opendais5• 12 years ago

I suppose that was the wrong phrasing. I should have said defraud Google's customers.

cyorir• 12 years ago

At the very least, it devalues Google's own service. Victims of this service will see lowered impact of advertising through Google, so they are more likely to simply drop/lower reliance on Google as a form of advertising and look for alternatives.

dangrossman2• 12 years ago

They get paid for another month, or maybe a few, until the advertiser sees that their ads now cost more than the revenue they bring in, as the fake/purchased clicks don't ever buy the company's products or services. At that point logic dictates that they cancel their ads with Google. Google would have earned that bit of money either way, but now they've lost all the future revenues from that business.

If you dig into almost any AdWords account and make a custom report that includes the "invalid clicks" column, you'll see that they already don't charge advertisers for a very large percentage of ad clicks. I have an "invalid activity" credit in my billing statement just about every month, which is an automatic refund for potentially fraudulent clicks that weren't detected immediately. You don't generally have to ask for the refunds, it's in their best interest to cancel those clicks and keep advertisers' ROI positive so they continue paying in future months.

PaulHoule• 12 years ago

I was looking for this tool called XRumer but I can't remember the link...

johnvschmitt3• 12 years ago

As opposed to how VC's drain competitor's adwords budgets?

Meaning, this is too often how I see competitive bids going over time:

1) You sell a widget for $100, and it costs you $50, so you spend $10 on the ad, & make $40 margin.

2) Your competition gets in, & has similar price/costs, & bids $11 on the ad.

3) After a few iterations, you both bid $49.50 for the ad, making near zero (positive) margins & stay in business.

4) But, VC-backed businesses enter that market. The VC (rightly) tells the startup that they aren't going to make profit in the first year anyway, but they MUST show user-growth. And, here's the VC money to pay for user growth.

5) So, the VC-backed startup bids the ads up to $100+, far above profitability for legit bootstrapped or existing profitable companies.

That's how the ad budgets can be drained in the ecosystem.

I know a lot of investors here that don't want to take the blame for this impact and may downvote me, but I do see this happening for many keywords over time. I don't need to be popular on this issue.

opendais5• 12 years ago

There is a difference between actively and maliciously targeting adwords to destroy people's money and healthy competition b/t pools of capital/businesses.

You are engaging in false equivalence.

johnvschmitt3• 12 years ago

I'm not saying that the VC-backed company is intentionally or maliciously poisoning the healthy profit of the competition.

I'm saying that it's an unintentional byproduct of the otherwise naturally healthy approach to "grow first, profit later". Just like, I'm about to release a free game in the app market, no IAP, no cost, as I'm generous. But, that can & does have unintended consequences in the ecosystem to make it harder for those who do need to profit from their similar work.

spullara• 12 years ago

Like open source developers stealing the money of commercial software vendors?

jfoster• 12 years ago

I think the effect that you describe can happen. You seem to be suggesting that it's controversial, but I don't see it. If they want to make a loss and pay that much, good luck to them. They must be doing it with the expectation that it will somehow be worth it in the long-run, and it's their money (or the VC's money) that they're playing with.

crdoconnor2• 12 years ago

They're doing it with the expectation that deeper pockets can substitute for innovative / better products.

Sometimes they're right.

for_i_in_range• 12 years ago

There's this thing called CTR. If you can get that up and be more innovative than your VC-backed competitors, you can stop whining on Hacker News on Friday nights. Just sayin.

nitrogen• 12 years ago

Though the HN guidelines discourage it, I thought I'd let you know why I downvoted your comment: "stop whining" and "just sayin".

prostoalex• 12 years ago

Same effect exists in restaurant industry, mainly in the low-end brand-less family-owned space.

Restaurant enters the space, decides to compete on price to build up audience to rake in the profits later on, giddily watches a competitor or two go out of business. Few months later another restaurant enters the same space, see the beginning of the paragraph.

megablast• 12 years ago

This is why it is always hard to compete with startups. You sell an app, they bring out a free app. They don't have to make money like regular people, they just need users to get backing. You need money because you are a regular person.

at-fates-hands• 12 years ago

I remember seeing a lot of scripts that did the same thing back in the early 2000's. Back then people were hijacking servers and then using proxies to hide their IP addresses. Back then, you could either use it to increase your own ad revenue, or have them click on your competitors ads so yours would show sooner.

Either way, this is why I tend to advise my clients to stay away from any paid advertising on the internet. It's a total sham. Either you get lucky and get some traffic with zero conversions, or your budget is wasted by someone using fraud.

chrischen• 12 years ago

I'm almost certain my business was targeted by this. I even got an anonymous email from the competitors threatening me to stop the ads, at the same time mysterious click traffic drained my adwords budget. Is anyone out there an expert in this field that could help me investigate?

Throwaway8233• 12 years ago

Slightly different, but I had a user attempt to get my AdSense account banned by repeatedly clicking ads for days. Sadly, for the advertisers, Google didn't do a thing. This user racked up close to 10,000 clicks, my earnings skyrocketed for a day or two, and I contacted Google with clear evidence pointing to a particular IP address, and explained the situation in-depth with server logs.

This was submitted through their form to contact them about click fraud, and I never heard back. Those advertisers paid for thousands of fake clicks, and I ended up with a decent chunk of change.

I can't understand how they missed it. My clicks are level for years, and then during a couple of days, they increase 50-100x normal levels. This should have been a huge red flag.

grey-area2• 12 years ago

Because they have a monopoly on advertising it's not really in their interest any more to detect click fraud.

spacemanmatt3• 12 years ago

They do not hold a monopoly on advertising. They hold the majority of the business, for now, but the structure of how and why they have that business is not monopolistic.

Source: Dearth of legal action from competitors or DOJ. And make no mistake -- their competitors are litigious as fuck.

rogerdpack• 12 years ago

And you actually got paid for those clicks? That is bizarre, I would have thought that google had some system to automatically detect the "click fraudsters" and not charge for their clicks...I mean how hard is it to stop counting clicks after somebody's done it 5 times or so from the same site? But I guess google is actually making money from those fraudsters [since they charge the advertisers] so...maybe that's why they don't care as much about fraud LOL.

iancarroll2• 12 years ago

They care about fraud. That is a VERY rare case of an advertiser getting paid from fraud. I have been banned (intentionally) by their system and it is very clever at times.

Create a few accounts and see how far you get to $100.

Throwaway8233• 12 years ago

Yes, I was paid for them. I was expecting the numbers to be corrected in the weeks to follow, which occasionally happens during strange activity. However, it was nearly a year ago, nothing happened, and the money arrived in my account.

elorant• 12 years ago

Best thing to do to avoid clickbombing is to write a script that will not allow multiple clicks from the same IP/cookie. Judging by the fact that the guy who clicked your ads didn’t even bother to change his IP chances are he wasn’t a hacker, just someone who holds a grange towards you and tried something utterly stupid to avenge you.

Throwaway8233• 12 years ago

It was a user with a grudge that was banned from the service. They attempted to use a number of online point and click tools to attack the site, until I eventually banned their IP address, and then talked with them and threatened legal action.

throwawayads2• 12 years ago

AdSense keeps doing the most un-Googly, "evil" thing and getting away with it. - https://medium.com/@ad_insider/googles-latest-monopoly-trick...

They don't even realize how much they are hurting Google in that process.

cbr• 12 years ago

    Those advertisers paid for thousands of fake clicks,
    and I ended up with a decent chunk of change.

I see how you know the second one, but how do you know the first? Maybe they have a grey area of fraud detection where they pay the publisher but don't charge the advertiser?

DonPellegrino2• 12 years ago

This reminds me of a nasty attack I learned about recently. I run http://unblock.us.org, a DNS/anti-censorship server. Unblock does tunneling for censored websites.

There are scripts out there that scan the whole internet for servers that accept HTTP and HTTPS requests to proxy. Those scripts are set up to simultaneously HTTP(S) GET tons of doubleclick.net etc. URLs to get the site owner kicked off Google Ads. I can imagine the black hat hackers selling their services for anyone willing to hurt a competitor's income.

Obviously my server detects those attacks and blacklists them right away, but I was shocked at the ease of carrying that kind of attack. One day I really need to blog about all the shocking stuff going on online that I learned about by running a public service.

asax• 12 years ago

You really should - that sounds super interesting!

sleep-less• 12 years ago

How can your server blacklist requests to doubleclick.net?

DonPellegrino2• 12 years ago

I don't tunnel HTTP/HTTPS requests to doubleclick.net at all to begin with (I use a whitelist for HTTP/HTTS), but if someone were to do too many DNS requests for the same domain in a short period of time I drop those requests as it means the Source IP I'm seeing is actually the IP of the victim of a DNS Amplification attack and sending them the response would make me a participant in that attack.

unclebucknasty• 12 years ago

but I was shocked at the ease of carrying that kind of attack

From affiliate marketing to PPC ad networks, etc., the implementing systems tend to be built as naively as possible. When you survey the implementations you quickly realize that the designers assume there are no bad actors in the known universe. Literally no thought was given to fraud.

They generally tend to be wide open to abuse, and frequently through simple URL manipulation/automation and standard HTML.

What's amazing is that billions of dollars are at stake, requiring little more than mouse-clicks. So, given that clicks are so insanely easy to simulate, you would think that these systems would be very robust; yet they are frequently the opposite. But, beyond the naivete, it is not entirely the networks' fault. They are locked in a never-ending game of cat-and-mouse with people who have very little to lose and much to gain.

gscott• 12 years ago

I setup a system to track every google adwords click by ip address then created a spreadsheet of the reverse dns and how many clicks to try and get a refund. It didn't matter how many times one ip address clicks through Google says that sometimes it might take a lot of clicks from one person because they are "deciding" if to buy or not. Anyway I sent several of these spreadsheets to Google and received a refund for a measly $28.00. They say they automatically do refunds but I get about $10 per $10k in refunds back automatically. It is not a very large amount.

bsaul• 12 years ago

People complain a lot about Google here, but some people working in the business for a while will remember the miva ad network. Boy was that network ugly. Sometimes during the month you would see a bump of traffic of 100x magnitude on all customers and of course no conversion at all. We used to say "looks like miva needs some cash this month".

Google adwords/adsense didn't win by being a monopoly, they won because they were simply the best. Then they became a monopoly.

spacemanmatt3• 12 years ago

This. Exactly. Google enjoys a natural monopoly (or in my view, a non-monopoly) in search because they continue to earn the most business there, not because they have eliminated viable alternatives.

throwawayads2• 12 years ago

Yes - but now they do a lot of the classic "use a good product in one to gain an advantage in another" tricks - https://medium.com/@ad_insider/googles-latest-monopoly-trick...

TeMPOraL• 12 years ago

Same with webmail. And maps. And other things. They just provide services that work and are optimized for usability, not for trying to upsell you something. I believe they deserve that natural monopoly for doing what they are (as long as they continue this course).

wyck• 12 years ago

There are services out there that supposedly monitor Google ad click fraud, does anyone have experience with them?

eli• 12 years ago

I suspect I was a victim of a version of this fraud years ago. Lots of suspicious clicks off of strange queries or weird AdSense blogs (the latter might have been the more straightforward AdSense fraud) and the visitors rarely engaged with more than one page.

Google insisted that if there are any fraudulent clicks, they are detected automatically and we are not be charged for them. But it was essentially impossible to know if that's true. I guess it doesn't really matter: at the end of the day you tally up your metrics and AdWords is either worth it or not. Still a very frustrating experience.

Service drains competitor's Adwords budget

Related Stories