{"id":8820,"date":"2015-04-20T11:42:50","date_gmt":"2015-04-20T10:42:50","guid":{"rendered":"http:\/\/okodigital.wpengine.com\/?p=682"},"modified":"2015-04-20T11:42:50","modified_gmt":"2015-04-20T10:42:50","slug":"highctrattack","status":"publish","type":"post","link":"https:\/\/cool.co\/supply-side-platform-home\/highctrattack\/","title":{"rendered":"High AdSense CTR April 20th. Are you being click bombed?"},"content":{"rendered":"

Many AdSense publishers have run a roller-coaster of emotions today as initial excitement over high earnings turned to fear about unnatural activity. The problem started with unnaturally high Click-Through-Rates over the weekend causing earnings to spike. With CTR on many sites hitting 3X or 4X normal levels, this clearly isn’t down to normal user behaviour.<\/p>\n

It looks a lot like a coordinated attack on AdSense sites by automated “click bots” that is effecting large numbers of website owners.<\/p>\n

Is my site affected?<\/h2>\n

We are seeing large spikes in CTR on many websites on\u00a0April 19th and 20th (UK time). \u00a0If your site has the same then it is likely that you are experiencing the same problems. \u00a0The tell tale sign would seem to be that traffic is coming from Version 27 of of the Firefox browser. \u00a0You can check this for yourself in Google Analytics from Technology > Browser and OS > Firefox > 27, then changing the graph to display AdSense clicks rather than sessions.<\/p>\n

It isn’t hard to block all traffic using that particular browser if you have access to your .htaccess file. \u00a0You can do it with the following:<\/p>\n

RewriteCond %{HTTP_USER_AGENT} Firefox\/27\\.0 [NC]
\nRewriteRule .* – [F,L]<\/p><\/blockquote>\n

Whether you want to block all those users though is not a straight forward call. \u00a0Blocking a browser version means blocking humans as well as bots and you could lose users. \u00a0Checking your historic traffic levels for that particular browser version can help make more informed decisions.<\/p>\n

It is worth noting that this pattern might change. \u00a0It is not unusual for attackers to change ‘footprints’ as they go.<\/p>\n

The source: xlhost.com inc<\/h2>\n

The traffic seems to be coming from a network identified as xlhost.com .\u00a0 You can check this in Google Analytics by looking at Technology > Network. \u00a0We\u2019re seeing traffic from this host as having AdSense CTR of up to 344% !<\/p>\n

This is a traffic source that has been associated with click-bombing in the past. \u00a0With the traffic coming from a single source this does make it easy to block. \u00a0Just monitor the IP addresses and block those through htaccess. Do though remember, if you block a host you will be blocking legitimate traffic from that host as well as the bad.<\/p>\n

\"use<\/p>\n

What is actually happening?<\/h2>\n

Click-bombing is the name given to automatically generating lots of ad clicks on and AdSense publishers website. \u00a0There are a couple of interesting patterns to this particular attack though. \u00a0Firstly multiple pages are being attacked,\u00a0rather than a single page on each site. \u00a0We’re seeing a few dozen clicks to each page rather than hundreds to a single URL. \u00a0Another is an interesting footprint that is being created in that AdSense page impressions are being reported, but not Ad Unit impressions.<\/p>\n

This pattern becomes clear if we create a segment for all traffic on the xlhost.com network and compare it with all sessions:<\/p>\n

\"AdSense<\/p>\n

Why do people click bomb?<\/h2>\n

There are a number of reasons that are usually given to explain click-bombing. \u00a0Not all of these apply to the attack what we are currently seeing:<\/p>\n

“Click bombing isn’t real. It is publishers trying to con Google”<\/strong>
\nThis clearly is not the case with this attack. Many users have experienced problems in the last two days including some of our own clients.<\/p>\n

“Click bombing is designed to get the publisher account cancelled”<\/strong>
\nAt OKO we certainly believe that this is the motivation for some attacks, but probably not this one. \u00a0The reason for this is that a lot of publishers have been targeted and these are seemingly unrelated.<\/p>\n

“Click bombing is designed to hurt the advertiser”<\/strong>
\nAgain, this is feasible, but not likely in this case. To hurt a particular advertiser the attacker would need to find their ads. This would mean targeting sites in a similar niche, or those with custom search ads. This does not appear to be the case.<\/p>\n

“Click bombing harms Google”<\/strong>
\nThis seems the most likely motivation behind the current attack. Possibly a disgruntled publisher or someone else with an axe to grind.<\/p>\n

What should I do about this?<\/h2>\n

The AdSense team are definitely aware of this issue (we have spoken with them about it). \u00a0We would expect that all neccessary steps will be taken from their side. However, it is always good to be safe when it comes to protecting your account. \u00a0At the very least we would recommend reporting the invalid activity. This can be done from this page in AdSense help<\/a>.<\/p>\n

You could additionally block users of that particular browser version either from seeing the ads, or from the site entirely. \u00a0As previously mentioned this might not offer protection if the pattern of the attack changes. \u00a0 If you are particularly concerned then you could remove ads entirely until the patterns return to normality.<\/p>\n

Will I get to keep the money?<\/h2>\n

Probably not. \u00a0Google tries to filter out invalid activity and automated clicks. Much of this happens before the click is even registered in your AdSense dashboard. Other filters can be applied “post click” and result in adjustments in your account. \u00a0Automated clicks cost advertisers money. When they are spotted they are reversed, the advertiser is refunded and the publisher account is adjusted to reflect this.<\/p>\n

Further reading<\/h2>\n

Those affected by this issue (or concerned that they might be next time), might find the following articles intersting:<\/p>\n