Service drains competitor's Adwords budget(krebsonsecurity.com)
krebsonsecurity.com
Service drains competitor's Adwords budget
http://krebsonsecurity.com/2014/07/service-drains-competitors-online-ad-budget/
59 comments
There is a difference between actively and maliciously targeting adwords to destroy people's money and healthy competition b/t pools of capital/businesses.
You are engaging in false equivalence.
You are engaging in false equivalence.
I'm not saying that the VC-backed company is intentionally or maliciously poisoning the healthy profit of the competition.
I'm saying that it's an unintentional byproduct of the otherwise naturally healthy approach to "grow first, profit later". Just like, I'm about to release a free game in the app market, no IAP, no cost, as I'm generous. But, that can & does have unintended consequences in the ecosystem to make it harder for those who do need to profit from their similar work.
I'm saying that it's an unintentional byproduct of the otherwise naturally healthy approach to "grow first, profit later". Just like, I'm about to release a free game in the app market, no IAP, no cost, as I'm generous. But, that can & does have unintended consequences in the ecosystem to make it harder for those who do need to profit from their similar work.
Fair enough but by bringing it up in a thread about someone with a botnet screwing people over...its pretty reasonable to conclude that is what you meant.
Whilst most VCs aren't doing anything anywhere near as patently unethical as funding a Clickfraud-as-a-Service app, if they're "disrupting" competition through little more than willingness to make negative profit margins on each sale, that competition ends up just as screwed if their pockets aren't as deep. Either if way they're spending money on making you poorer rather than themselves richer in the short term it's not unreasonable to point fingers.
Admittedly, incumbent monopolists are usually far more cynical in this regard, but they're also more likely to get slapped by regulators for this kind of behaviour.
Admittedly, incumbent monopolists are usually far more cynical in this regard, but they're also more likely to get slapped by regulators for this kind of behaviour.
As an aside, I'd like to add this bit of information: People get up in arms when a large "corporation" or "well-established player" in the market throws their capital weight around to bud out budding investors by selling at a loss. But, as you can see in this thread, they turnaround and have a completely different take on the matter when it's a "VC-backed startup" using its newly-acquired capital to drown out competition while it's slowly losing money.
This is why we need anti-trust law. There are cases where throwing your capital around is appropriate, and there are cases where it is anti-competitive.
"There are cases where throwing your capital around is
appropriate"
I'm curious where you think this is the case? Remember, your arbitrary definition of appropriate might not be the same as others'. I probably won't go either way, as I think anti-trust laws in general are not appropriate, but that's a different discussion.
Moreover, may I ask what your moral argument is for such laws? From the looks of it, most people would say: "If you have a lot of money, then you're not allowed to use it to your advantage if we perceive it as predatory". With such vague terms (unless you can make it more explicit), and it will most certainly end up having a favoritist bureaucracy grow around it.
I'm curious where you think this is the case? Remember, your arbitrary definition of appropriate might not be the same as others'. I probably won't go either way, as I think anti-trust laws in general are not appropriate, but that's a different discussion.
Moreover, may I ask what your moral argument is for such laws? From the looks of it, most people would say: "If you have a lot of money, then you're not allowed to use it to your advantage if we perceive it as predatory". With such vague terms (unless you can make it more explicit), and it will most certainly end up having a favoritist bureaucracy grow around it.
Pretty much this ;)
Good points & over all, I really appreciate the rational, yet learning/confrontational discussions here.
I was just trying to spread the word to other startups that the auction-based paid advertising model might work initially, but gets really tough to sustain as it naturally evolves.
In a non-auction based method, the evolution to "zero margin" may be a slower process. Yet those non-auction methods of paid advertising (billboards, magazine, TV) are just horrible for tracking & closing the loop as to be obsolete, and are often too expensive for startups to even enter anyway.
The best advertising is to realize that your customer service/support function is not an cost, but rather an investment in word-of-mouth advertising. Investing in great customer service is often the best modern marketing.
I was just trying to spread the word to other startups that the auction-based paid advertising model might work initially, but gets really tough to sustain as it naturally evolves.
In a non-auction based method, the evolution to "zero margin" may be a slower process. Yet those non-auction methods of paid advertising (billboards, magazine, TV) are just horrible for tracking & closing the loop as to be obsolete, and are often too expensive for startups to even enter anyway.
The best advertising is to realize that your customer service/support function is not an cost, but rather an investment in word-of-mouth advertising. Investing in great customer service is often the best modern marketing.
Same effect exists in restaurant industry, mainly in the low-end brand-less family-owned space.
Restaurant enters the space, decides to compete on price to build up audience to rake in the profits later on, giddily watches a competitor or two go out of business. Few months later another restaurant enters the same space, see the beginning of the paragraph.
Restaurant enters the space, decides to compete on price to build up audience to rake in the profits later on, giddily watches a competitor or two go out of business. Few months later another restaurant enters the same space, see the beginning of the paragraph.
I think the effect that you describe can happen. You seem to be suggesting that it's controversial, but I don't see it. If they want to make a loss and pay that much, good luck to them. They must be doing it with the expectation that it will somehow be worth it in the long-run, and it's their money (or the VC's money) that they're playing with.
They're doing it with the expectation that deeper pockets can substitute for innovative / better products.
Sometimes they're right.
Sometimes they're right.
if the product by the bootstrapped startup is indeed more innovative (read: better), then it won't (or at least, shouldn't) matter that the VC backed startup tries tactics like this. If both their products are generic/simple, then yes, draining your competitor's ad budget is akin to you having more budget to spend. Advertising is a zero sum game after all.
But that's not true either. The very point of VC funding is that it allows you to be able to do things and achieve better growth than any bootstrapped could dream of, so even if the bootstrapped companies product is far more innovative, they can easily be squashed. That sucks, although I don't see any way of fixing it. An excellent product isn't enough, as well all well know.
>if the product by the bootstrapped startup is indeed more innovative (read: better), then it won't (or at least, shouldn't) matter that the VC backed startup tries tactics like this.
Life is unfair. You can either be in denial about that or learn to live with it.
Life is unfair. You can either be in denial about that or learn to live with it.
This is why it is always hard to compete with startups. You sell an app, they bring out a free app. They don't have to make money like regular people, they just need users to get backing. You need money because you are a regular person.
Like open source developers stealing the money of commercial software vendors?
There's this thing called CTR. If you can get that up and be more innovative than your VC-backed competitors, you can stop whining on Hacker News on Friday nights. Just sayin.
Though the HN guidelines discourage it, I thought I'd let you know why I downvoted your comment: "stop whining" and "just sayin".
This reminds me of a nasty attack I learned about recently. I run http://unblock.us.org, a DNS/anti-censorship server. Unblock does tunneling for censored websites.
There are scripts out there that scan the whole internet for servers that accept HTTP and HTTPS requests to proxy. Those scripts are set up to simultaneously HTTP(S) GET tons of doubleclick.net etc. URLs to get the site owner kicked off Google Ads. I can imagine the black hat hackers selling their services for anyone willing to hurt a competitor's income.
Obviously my server detects those attacks and blacklists them right away, but I was shocked at the ease of carrying that kind of attack. One day I really need to blog about all the shocking stuff going on online that I learned about by running a public service.
There are scripts out there that scan the whole internet for servers that accept HTTP and HTTPS requests to proxy. Those scripts are set up to simultaneously HTTP(S) GET tons of doubleclick.net etc. URLs to get the site owner kicked off Google Ads. I can imagine the black hat hackers selling their services for anyone willing to hurt a competitor's income.
Obviously my server detects those attacks and blacklists them right away, but I was shocked at the ease of carrying that kind of attack. One day I really need to blog about all the shocking stuff going on online that I learned about by running a public service.
>but I was shocked at the ease of carrying that kind of attack
From affiliate marketing to PPC ad networks, etc., the implementing systems tend to be built as naively as possible. When you survey the implementations you quickly realize that the designers assume there are no bad actors in the known universe. Literally no thought was given to fraud.
They generally tend to be wide open to abuse, and frequently through simple URL manipulation/automation and standard HTML.
What's amazing is that billions of dollars are at stake, requiring little more than mouse-clicks. So, given that clicks are so insanely easy to simulate, you would think that these systems would be very robust; yet they are frequently the opposite. But, beyond the naivete, it is not entirely the networks' fault. They are locked in a never-ending game of cat-and-mouse with people who have very little to lose and much to gain.
From affiliate marketing to PPC ad networks, etc., the implementing systems tend to be built as naively as possible. When you survey the implementations you quickly realize that the designers assume there are no bad actors in the known universe. Literally no thought was given to fraud.
They generally tend to be wide open to abuse, and frequently through simple URL manipulation/automation and standard HTML.
What's amazing is that billions of dollars are at stake, requiring little more than mouse-clicks. So, given that clicks are so insanely easy to simulate, you would think that these systems would be very robust; yet they are frequently the opposite. But, beyond the naivete, it is not entirely the networks' fault. They are locked in a never-ending game of cat-and-mouse with people who have very little to lose and much to gain.
You really should - that sounds super interesting!
How can your server blacklist requests to doubleclick.net?
I don't tunnel HTTP/HTTPS requests to doubleclick.net at all to begin with (I use a whitelist for HTTP/HTTS), but if someone were to do too many DNS requests for the same domain in a short period of time I drop those requests as it means the Source IP I'm seeing is actually the IP of the victim of a DNS Amplification attack and sending them the response would make me a participant in that attack.
Slightly different, but I had a user attempt to get my AdSense account banned by repeatedly clicking ads for days. Sadly, for the advertisers, Google didn't do a thing. This user racked up close to 10,000 clicks, my earnings skyrocketed for a day or two, and I contacted Google with clear evidence pointing to a particular IP address, and explained the situation in-depth with server logs.
This was submitted through their form to contact them about click fraud, and I never heard back. Those advertisers paid for thousands of fake clicks, and I ended up with a decent chunk of change.
I can't understand how they missed it. My clicks are level for years, and then during a couple of days, they increase 50-100x normal levels. This should have been a huge red flag.
This was submitted through their form to contact them about click fraud, and I never heard back. Those advertisers paid for thousands of fake clicks, and I ended up with a decent chunk of change.
I can't understand how they missed it. My clicks are level for years, and then during a couple of days, they increase 50-100x normal levels. This should have been a huge red flag.
Best thing to do to avoid clickbombing is to write a script that will not allow multiple clicks from the same IP/cookie. Judging by the fact that the guy who clicked your ads didn’t even bother to change his IP chances are he wasn’t a hacker, just someone who holds a grange towards you and tried something utterly stupid to avenge you.
It was a user with a grudge that was banned from the service. They attempted to use a number of online point and click tools to attack the site, until I eventually banned their IP address, and then talked with them and threatened legal action.
This whole thread people discuss technical mitigations, and I'm thinking "man, this is such a clear case where a bit of law and the tiniest amount of civil damages totally would fix the situation, as long as the attacking person lives in a country with a level of rule of law." What a waste of resources trying to make something impossible, rather than just illegal. (I was thinking mostly of the anticompetitive acts and the title.)
Your comment actually shows a clear example, of how actually threatening legal action makes someone come to their senses, whereas any level of technical measures just gamified the situation.
This is just a case where we can collectively enter an arms race for technical solutions, or just use a bit of law and live in a sane society where this isn't on the competitive menu.
Your comment actually shows a clear example, of how actually threatening legal action makes someone come to their senses, whereas any level of technical measures just gamified the situation.
This is just a case where we can collectively enter an arms race for technical solutions, or just use a bit of law and live in a sane society where this isn't on the competitive menu.
Trouble is a lot of attacks come from places like Russia where it is not convenient to travel to file a legal case.
Those advertisers paid for thousands of fake clicks,
and I ended up with a decent chunk of change.
And you actually got paid for those clicks? That is bizarre, I would have thought that google had some system to automatically detect the "click fraudsters" and not charge for their clicks...I mean how hard is it to stop counting clicks after somebody's done it 5 times or so from the same site? But I guess google is actually making money from those fraudsters [since they charge the advertisers] so...maybe that's why they don't care as much about fraud LOL.
Yes, I was paid for them. I was expecting the numbers to be corrected in the weeks to follow, which occasionally happens during strange activity. However, it was nearly a year ago, nothing happened, and the money arrived in my account.
They care about fraud. That is a VERY rare case of an advertiser getting paid from fraud. I have been banned (intentionally) by their system and it is very clever at times.
Create a few accounts and see how far you get to $100.
Create a few accounts and see how far you get to $100.
How do you "create a few accounts"? I was under impression that once they ban you, it's over. Same person can't create more than one account. And can't create another one after a ban.
I've created at least three with the same name, haha.
Because they have a monopoly on advertising it's not really in their interest any more to detect click fraud.
They do not hold a monopoly on advertising. They hold the majority of the business, for now, but the structure of how and why they have that business is not monopolistic.
Source: Dearth of legal action from competitors or DOJ. And make no mistake -- their competitors are litigious as fuck.
Source: Dearth of legal action from competitors or DOJ. And make no mistake -- their competitors are litigious as fuck.
Yes, it's a slippery term so probably not the best word to use, however the majority of display and search ads are served by google and unfortunately this does mean they have little incentive to actually address click fraud, though they do obviously make some efforts, we wouldn't hear stories like the parent post if those efforts were effective. Fraud was reported and went completely unaddressed - that's not really acceptable to my mind and indicates they feel little pressure to mitigate it as that's not an isolated report.
Re the absence of lawsuits, I'm not sure that is positive proof of anything.
Re the absence of lawsuits, I'm not sure that is positive proof of anything.
AdSense keeps doing the most un-Googly, "evil" thing and getting away with it. - https://medium.com/@ad_insider/googles-latest-monopoly-trick...
They don't even realize how much they are hurting Google in that process.
They don't even realize how much they are hurting Google in that process.
Sometimes referred to as 'reverse click fraud'. Here's how it can look from the point of view of one of the sites that hosts the ads paid for by the victim: http://www.dslreports.com/shownews/Adsense-Click-Fraud-88596
The site gets lots of visits from random IPs, all searching for the same odd phrase, such as 'Female Impotence' in this case.
The site gets lots of visits from random IPs, all searching for the same odd phrase, such as 'Female Impotence' in this case.
People complain a lot about Google here, but some people working in the business for a while will remember the miva ad network. Boy was that network ugly. Sometimes during the month you would see a bump of traffic of 100x magnitude on all customers and of course no conversion at all. We used to say "looks like miva needs some cash this month".
Google adwords/adsense didn't win by being a monopoly, they won because they were simply the best. Then they became a monopoly.
Google adwords/adsense didn't win by being a monopoly, they won because they were simply the best. Then they became a monopoly.
This. Exactly. Google enjoys a natural monopoly (or in my view, a non-monopoly) in search because they continue to earn the most business there, not because they have eliminated viable alternatives.
Same with webmail. And maps. And other things. They just provide services that work and are optimized for usability, not for trying to upsell you something. I believe they deserve that natural monopoly for doing what they are (as long as they continue this course).
Yes - but now they do a lot of the classic "use a good product in one to gain an advantage in another" tricks - https://medium.com/@ad_insider/googles-latest-monopoly-trick...
I'm almost certain my business was targeted by this. I even got an anonymous email from the competitors threatening me to stop the ads, at the same time mysterious click traffic drained my adwords budget. Is anyone out there an expert in this field that could help me investigate?
I setup a system to track every google adwords click by ip address then created a spreadsheet of the reverse dns and how many clicks to try and get a refund. It didn't matter how many times one ip address clicks through Google says that sometimes it might take a lot of clicks from one person because they are "deciding" if to buy or not. Anyway I sent several of these spreadsheets to Google and received a refund for a measly $28.00. They say they automatically do refunds but I get about $10 per $10k in refunds back automatically. It is not a very large amount.
I do wonder since he is using a gmail account if it is a honeytrap.
That seems like a very, very dumb thing to do if one's objective is to defraud Google. His entire client list will be accessible through them.
That seems like a very, very dumb thing to do if one's objective is to defraud Google. His entire client list will be accessible through them.
[deleted]
Does he really defraud Google? They're still getting paid.
They get paid for another month, or maybe a few, until the advertiser sees that their ads now cost more than the revenue they bring in, as the fake/purchased clicks don't ever buy the company's products or services. At that point logic dictates that they cancel their ads with Google. Google would have earned that bit of money either way, but now they've lost all the future revenues from that business.
If you dig into almost any AdWords account and make a custom report that includes the "invalid clicks" column, you'll see that they already don't charge advertisers for a very large percentage of ad clicks. I have an "invalid activity" credit in my billing statement just about every month, which is an automatic refund for potentially fraudulent clicks that weren't detected immediately. You don't generally have to ask for the refunds, it's in their best interest to cancel those clicks and keep advertisers' ROI positive so they continue paying in future months.
If you dig into almost any AdWords account and make a custom report that includes the "invalid clicks" column, you'll see that they already don't charge advertisers for a very large percentage of ad clicks. I have an "invalid activity" credit in my billing statement just about every month, which is an automatic refund for potentially fraudulent clicks that weren't detected immediately. You don't generally have to ask for the refunds, it's in their best interest to cancel those clicks and keep advertisers' ROI positive so they continue paying in future months.
This is about Company A removing Company B, C, D, & E from the search results so that Company A gets all the sales and leads from that day. Company A would be happy if it scares them away permanently -- then they don't even have to pay the Hacker to deplete their daily budget anymore.
These particular hackers obviously have a service that Google's Invalid Clicks detection cannot pick up and it's successfully depleting advertisers' budgets -- hence the positive reviews they have.
These particular hackers obviously have a service that Google's Invalid Clicks detection cannot pick up and it's successfully depleting advertisers' budgets -- hence the positive reviews they have.
Right. You can only remove Company B-E's ads by depleting their daily budgets. The service Company A paid for does not include purchasing Company B-E's products or services, just knocking out their ads. Those advertisers will see a negative ROI from their Google ads and eventually cancel them. Now Google has lost four customers and the one that remains no longer has to compete for ad space. Google loses all of Company B-E's ad spend, and most of Company A's ad spend as it can drastically lower its bids. They are not "still being paid", which is why they are heavily incentivized to identify this fraud and ignore or refund for the clicks that company is generating.
At the very least, it devalues Google's own service. Victims of this service will see lowered impact of advertising through Google, so they are more likely to simply drop/lower reliance on Google as a form of advertising and look for alternatives.
I suppose that was the wrong phrasing. I should have said defraud Google's customers.
I suspect I was a victim of a version of this fraud years ago. Lots of suspicious clicks off of strange queries or weird AdSense blogs (the latter might have been the more straightforward AdSense fraud) and the visitors rarely engaged with more than one page.
Google insisted that if there are any fraudulent clicks, they are detected automatically and we are not be charged for them. But it was essentially impossible to know if that's true. I guess it doesn't really matter: at the end of the day you tally up your metrics and AdWords is either worth it or not. Still a very frustrating experience.
Google insisted that if there are any fraudulent clicks, they are detected automatically and we are not be charged for them. But it was essentially impossible to know if that's true. I guess it doesn't really matter: at the end of the day you tally up your metrics and AdWords is either worth it or not. Still a very frustrating experience.
There are services out there that supposedly monitor Google ad click fraud, does anyone have experience with them?
I was looking for this tool called XRumer but I can't remember the link...
I remember seeing a lot of scripts that did the same thing back in the early 2000's. Back then people were hijacking servers and then using proxies to hide their IP addresses. Back then, you could either use it to increase your own ad revenue, or have them click on your competitors ads so yours would show sooner.
Either way, this is why I tend to advise my clients to stay away from any paid advertising on the internet. It's a total sham. Either you get lucky and get some traffic with zero conversions, or your budget is wasted by someone using fraud.
Either way, this is why I tend to advise my clients to stay away from any paid advertising on the internet. It's a total sham. Either you get lucky and get some traffic with zero conversions, or your budget is wasted by someone using fraud.
Meaning, this is too often how I see competitive bids going over time:
1) You sell a widget for $100, and it costs you $50, so you spend $10 on the ad, & make $40 margin.
2) Your competition gets in, & has similar price/costs, & bids $11 on the ad.
3) After a few iterations, you both bid $49.50 for the ad, making near zero (positive) margins & stay in business.
4) But, VC-backed businesses enter that market. The VC (rightly) tells the startup that they aren't going to make profit in the first year anyway, but they MUST show user-growth. And, here's the VC money to pay for user growth.
5) So, the VC-backed startup bids the ads up to $100+, far above profitability for legit bootstrapped or existing profitable companies.
That's how the ad budgets can be drained in the ecosystem.
I know a lot of investors here that don't want to take the blame for this impact and may downvote me, but I do see this happening for many keywords over time. I don't need to be popular on this issue.