Live data from Hacker News

Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

facebook.com

11–20 of 381 posts

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#12
post #3

"We built a page logger. Any time a page was loaded, we'd keep track of it. You know what we found? The 80% of clicks we were paying for were from bots." How do you tell if it's a bot? Just by user-agent string or repeated slamming by IP address, or is there some other technique?

How do you tell if it's a bot? Just by user-agent string or repeated slamming by IP address, or is there some other technique?

A combination of things. Off the top of my head:

* IP address ranges. Are they all from, e.g., EC2 instances?

* Are images and other content (e.g. CSS) linked from the page loaded? How long does the client take to do so? Are other pages being viewed in line with what you've seen from other users?

* What combinations of user agents are you seeing?

* What's in the headers being sent by the browser? Any foreign language support, or oddities when it comes to not accepting compressed content? Is the referer header always the same? Does it always vary?

* Do you see "normal" user behaviour that indicates activity such as clicking the back button, then clicking the ad again a few seconds later once their brain has kicked in? (nb: not sure if this is possible for Facebook with the way their site works).

* Are there any patterns in the page access times? Is there anything to indicate a cron job is kicking off once an hour at the same time?

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#13

Has anyone else analyzed their referrals and also seen a significant proportion of bots?

I've run a significant amount of traffic with Facebook Ads and never saw click fraud anywhere close to these kinds of numbers. By estimates it was somewhere between 3-5%, which is pretty typical across major ad networks.

It's also worth noting that Facebook has given refunds for click fraud in the past. That is if you can actually get a hold of someone in support who will talk to you, which isn't easy.

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#15
post #7

Wow, even if this is a little true the implications are big. Is this similar, or related to other ad space inflation? I'm reminded of Google (and others)(1) sending out free $75 adwords coupons to easily allow the costs of bids to inflate since it's not my own real money (thereby increasing the percentage of real cash being made on the ads)? (1)Edited and clarified

How come, everytime some company does (or seems to be doing) something shady, there is always a bunch of people like this saying "not as bad as Y doing something else that might or might not be true or related". This is not middle school anymore, pointing the finger at other kids is not proper discussion ...

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#16
post #8
post #4

Earlier quoted context omitted.

The main technique is to notice a pattern that is only explainable by bot activity. Generally speaking, in addition to the patterns you mentioned (invalid user-agent strings, rapid succession of same-IP access) there are also other patterns, such as failure to load referenced CSS or image files, or 100% failure on Captcha challenges.

"failure to load referenced CSS or image files" -- is there a way for bots (in particular, mechanize in perl/python) to also download those files? "100% failure on Captcha challenges" -- are captchas generally deployed on click-through ads?

"failure to load referenced CSS or image files" -- is there a way for bots (in particular, mechanize in perl/python) to also download those files?

Very much so, after all your browser does without you having to tell it to do so. It all depends on whether the hassle is worth it for the bot writer.

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#17
post #3

"We built a page logger. Any time a page was loaded, we'd keep track of it. You know what we found? The 80% of clicks we were paying for were from bots." How do you tell if it's a bot? Just by user-agent string or repeated slamming by IP address, or is there some other technique?

They said that for 80% of their clicks , Javascript was off. Now there will be plenty of users who have disabled Javascript but nowhere near 80%. Although they stated they built their own analytics software, so there's also a chance that it wasn't working as they thought it was.

Furthermore, facebook users in specific I would say have javascript enabled, even though its possible to control per site, I would assume most facebook users would not be aware how it works - and facebook without javascript seems rather impossible or at least, very discomforting.

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#18
post #7

Wow, even if this is a little true the implications are big. Is this similar, or related to other ad space inflation? I'm reminded of Google (and others)(1) sending out free $75 adwords coupons to easily allow the costs of bids to inflate since it's not my own real money (thereby increasing the percentage of real cash being made on the ads)? (1)Edited and clarified

You make a valid point.

Re: Company withdrawing from Facebook as analytics show 80% of ad clicks from bots

#20
post #8
post #4

Earlier quoted context omitted.

The main technique is to notice a pattern that is only explainable by bot activity. Generally speaking, in addition to the patterns you mentioned (invalid user-agent strings, rapid succession of same-IP access) there are also other patterns, such as failure to load referenced CSS or image files, or 100% failure on Captcha challenges.

"failure to load referenced CSS or image files" -- is there a way for bots (in particular, mechanize in perl/python) to also download those files? "100% failure on Captcha challenges" -- are captchas generally deployed on click-through ads?

Of course they could -- all they need to do is parse the HTML, look for the img and link and other tags, and then request the URL. If they were trying to act more like a browser, they would. If they are just trying to click ads, they wouldn't.
Post reply on HN