Suspected Botnet Click Fraud

Every now and then I dig deep into log files and crunch some numbers.

Yesterday I stumbled upon some disturbing stats.

I get a lot of traffic from two domains that are MFYPN Sites via my YSM account. Nothing wrong with that normally but these were very high numbers with no conversions.

So I had a closer look and they almost all come from search strings on those two websites that make no sense at all.

We sell a product called say "word1 word2". The search strings in the log are all "word2 word1" so it does trigger our ad (I should phrase match) but it makes no sense at all. No one searches like that for this product according to keyword suggestion tools.

I ran all the IPs through ip2location and they're not the same. They were almost all from European countries and they seemed OK.

However, I don't believe these are user generated. The search string makes no sense at all, the countries make no sense at all and certainly the conversion rate in comparison to direct search performance makes no sense at all. The refering websites aren't of the type I would expect to send my site this much traffic. None of it stacks up.

The offending URLs are www.netster.com via URLs like this and www.upspiral.com via URLs like this.

Netster sends 5 clicks consistently every day (overall on this site that makes a significant contribution to the overall traffic) without any timing patterns. Upsiral is less consistent but sometimes as many as 8 for the same nonsense phrase from countries that wouldn't search in this language or visit my website.

I'm not saying these two websites are doing this on purpose, maybe infected computers are trying to get them banned but it is rather suspicious. They aren't related if Whois is anything to go by. Looking it their 'marketing' efforts, they seem more interrelated: (netster OR upspiral) fraud

What I wanted to ask is whether any of you have seen similar clicks happen, those that really make you doubt whether it is actually human generated.

 

I can't say I've seen this particular thing, T0Ps, but I have seen these types of search come high up on Google or Yahoo when I've been hunting for stuff, with various types of 'Engine' as the examples you gave.

When you click on the link expecting some info all you get served is an ad from Adsense or YPN.

In the process of creating the keyword-relevant search string when Googlebot or Slurp or Whatever visits so the page created ranks in the SE's, various odd terms get combined.

This isn't what the user actually searches for in their search term; e.g. "word1 and word2 or word3 or word4" is the user term but the page that ranks on the SE's is the spammy one with only an ad from YPN or Adsense.

I hope that makes sense ...

 

Ahh right so you're saying, the user didn't search on upspiral's homepage for "word2 word1" to get to my ads and then my webpage but instead they search Google for my actual phrase "word1 word2" and then landed on upspiral's result page which was indexed by G/Y etc.

That makes more sense. But is still a PITA.

I'll check their ranking for those phrases. They must be cloaking or something since those pages hardly have any content at all.

 

Yes, exactly.