Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

We need some real facts here, I've done a lot of FB advertising and have not seen results like this. This smells to me like an incorrectly configured campaign(s).

Here are a few points that need addressing:

What volumes are we talking about for the clicks?

How many ads did you run per campaign and how many clicks did you receive per ad? Facebook do use bots to verify the landing page of an ad url, this will usually lead to one or two tracked conversions per ad. These will show up in the external website analytics software but won't be charged as clicks by FB.

Were you running ads that drove directly to your website, or did you direct ads to your Facebook page? - Obviously ads that land on your Facebook page won't be tracked by your analytics software.

How did you identify that links coming to your website had indeed originated from Facebook. Did you loose conversions through badly formed tracking urls and could it be these suspect page loads were actualy coming from a web crawler?

Did you run CPM or CPC campaigns? - Maybe a misunderstanding of the charges involved?

Indeed.

Most of the parsing required for the logfile analysis I describe is written in awk, and goes through roughly 1 million lines of logfile in about 75s on a commodity 2Ghz Intel Xeon.

Pre-caching of host lookups is done via xargs and a suitably high '-j' value. Running on a pre-sorted and de-duped list of IPs, this takes another few minutes. Lookups are read into hash tables for faster processing in the main awk parser (avoids system calls, DNS latency, and especially negative result caching failures).

It's fast and simple. Not a 100% solution, but quick to add bits to over time as new needs arise.

Just a brief note: bot sophistication is off the hook. I worked at an ad network where one of the clients demanded we prove that the mouse had moved prior to "clicking" on one of their ads. No problem, we said, and most of the traffic passed the test. The traffic had referrers, legit user agents, javascript, and they were triggering the mousemove and click events. Out of curiosity, we sent a fraction of traffic to a test page, wherein the actual page was displayed in a full window iframe, then blocked access until the user clicked, and tracked their mouse movements. Easy enough; annoying for a user, but not a deal breaker for most.

The user movement maps we ended up with were straight lines of randomly spaced dots with sudden acute corners. A human could not replicate the pattern with a ruler and a pen pad, and we certainly didn't expect 90% of our human users going for that client's sites to be sitting around with rulers and pen pads drawing lines of randomly spaced dots. We checked the testing code and ran a dozen tests, and we couldn't figure out how a human could replicate it on any browsing device. Our conclusion is that somebody bothered to program a bot that would replicate mouse movement and we accidentally broke it by blocking programmatic access to the page, so it couldn't find a link to click and went crazy.

This whole thing seems fishy to me. Facebook is one of my best sources of traffic. It's cheaper than AdWords, I can do keyword, demo, and geo targeting all built in. And if I have a hit campaign, it's pretty easily scalable. If you tie it into specific performance, like $ / email sign up, or $ / pageview, it blows away adwords. Getting in touch with someone from Facebook can be a pain, but it's drastically easier than AdWords or other ad networks.

This whole thing seems like one big linkbait/PR play. It's a really big claim from a company that doesn't even have an about us page, has only 500 Facebook likes, and basically has 0 traffic.[1]

I'd like to know if they have tried other paid traffic sources, or have concrete evidence. Inexperienced advertisers tend to spend $50-$100, expecting instant results. And when it inevitably doesn't work out, they blame anyone and everyone.

The second point seems way exaggerated. Facebook isn't "holding your name hostage" and being "scumbags". You didn't sign up with the right name from the beginning, and now you're complaining. You could have told the ad rep that you'll do $2,000 budget at some point, just change the url now. You could have also taken the 5 minutes to sign up for a Facebook Page with name@limitedrun.com and get the page you want. With only 500 facebook likes, the switching cost is low.

[1] http://siteanalytics.compete.com/limitedrun.com/ https://www.facebook.com/limitedpressing http://who.is/whois/limitedrun.com/

The linux equivalent is p0f (http://freecode.com/projects/p0f)

I can't speak to Java classes, but they'd need to be dealing with raw packets which isn't an option in a typical stack.