On Tuesday Harvard Business School professor Ben Edelman blogged about a new form of click fraud that may be almost as insidious as the Bahama Botnet discovered by Click Forensics last year.  Andy Greenberg did a wonderful job summarizing and translating Professor Edelman’s findings into layman’s terms in his Forbes.com article Google Faces The Slickest Click Fraud Yet.

This new fraud scheme is really a compilation of  “Fraudster Greatest Hits,” but with a new twist.  It consists of spyware being installed on unsuspecting user’s machines and clicking on paid links to generate fees for the spyware author and intermediary ad networks, some of whom are complicit and most of whom are not.  Nothing new there.  The spyware that Prof. Edelman tracked, though, was smart enough to click on paid links for sites that the user is already visiting.  What a perfect way to disguise fraud as legitimate traffic!  A visitor to Finishline.com doesn’t notice that a pop-up browser was redirected to Finishline.com, because that’s where he intended to go in the first place.  Visitors browse, shop, and maybe even buy something (convert) at a perfectly normal rate.  The traffic looks completely legitimate to Finishline.com, and to Google.

So, is this it?  The perfect click fraud scheme that successfully foils all attempts at discovery and generates untold riches for the perpetrators?  Well, not quite.  First off, it was discovered.  Prof. Edelman’s blog has been written about on Forbes.com and his discovery will certainly garner some attention in Mountain View.  That’s good, because the spyware perpetrator, TrafficSolar, should be prevented from continuing this fraud.

But it was probably a fairly low-volume scheme to begin with.  It’s limited to machines of users that are infected with spyware who also visit select Google advertisers.  So some small percentage of the organic visitors to Finishline.com generated a click fee instead of visiting for free.  It’s a problem, but probably not a huge one.  What would make it more serious is if there were another version of the spyware that simply clicks on paid links in the background without the user’s knowledge (a la the Bahama Botnet).  By mixing the fraudulent clicks with the real end-user visitor behavior and conversions, a fraudster like TrafficSolar could give the impression of being 100% legitimate.

The concluding recommendation in Prof. Edelman’s report is for Google to fire InfoSpace, its ad syndication partner.  A better solution would be for Google and InfoSpace to deal only with reputable partners who provide verified, audited clicks to ensure advertisers get what they pay for.  Check our client list for some worthy candidates.

While it’s easy to see how the recently discovered Bahama Botnet is cheating online advertisers out of free traffic and generating fraudulent fees for complicit parked domains and ad networks, it’s important to note that ad providers are being victimized as well.

We have conducted additional research into the behavior of the Bahama botnet and found that it acts as a sort of perverted “Robin Hood” among ad networks by robbing ad revenue from the top-tier players and delivering fraudulent traffic to second and third-tier ad networks and publishers.  Chief among the ad provider victims is the one with the biggest treasure to take: Google.

As we’ve seen in this video, when an infected user performs a search on Google.com, they get some peculiar results.  This is because, unbeknownst to the user, they’re not actually on Google.com.  The page looks like Google.com and even says Google.com in the browser’s address bar.  So how can it not be google.com?  The perpetrators behind the Bahama Botnet are able to steal traffic and revenue from Google using a trick called “DNS poisoning”.

All computers on the internet identify themselves with a set of numbers that we know as an IP address.  Computers can find one another using these numbers.  However, humans find words easier to remember than long sets of numbers, so the Domain Name System (DNS) was devised to translate these numbers into names.  When “Google.com” is typed into a browser, the computer uses DNS to translate that domain name into a number.  In the case of Google.com, that number happens to be 74.125.155.99.  The DNS method for translating domain names into numbers is fundamental to making the internet work.

However, in the case of the Bahama Botnet, this DNS translation method gets corrupted.  The Bahama botnet malware causes the infected computer to mistranslate a domain name.  Instead of translating “Google.com” as 74.125.155.99, an infected computer will translate it as 64.86.17.56.  That number doesn’t represent any computer owned by Google.  Instead, it represents a computer located in Canada.  When a user with an infected machine performs a search on what they think is google.com, the query actually goes to the Canadian computer, which pulls real search results directly from Google, fiddles with them a bit, and displays them to the searcher.  Now the searcher is looking at a page that looks exactly like the Google search results page, but it’s not.  A click on the apparently “organic” results will redirect as a paid click through several ad networks or parked domains — some complicit, some not.  Regardless, cost per click (CPC) fees are generated, advertisers pay, and click fraud has occurred.

An interesting side effect of this whole scheme is that while the perpetrators of the Bahama Botnet turn organic or natural search listings into paid links, they don’t seem to alter the final destination domains of the sponsored links that show up on a search results page.  When an infected user clicks on one of these sponsored links, they always seem to end up on the correct destination domain (so clicking a sponsored link for Dell.com, for example, will always take an infected user to dell.com).  However, due to the DNS poisoning, a click on a sponsored link will never go through Google’s own click-counting redirect.  Google never sees, and therefore never charges for, that click.   The advertiser gets a free click, instead of a paid one, and Google loses the revenue.  The Bahama Botnet strikes again.

Just when you thought the fraudsters couldn’t get any more sophisticated … they surprise you.  Click Forensics researchers have recently discovered one of the most advanced sources of click fraud we’ve seen.  We’ve named it the “Bahama botnet” because when first discovered it was redirecting traffic through 200,000 parked domain sites located in the Bahamas.  It has since been reprogrammed to redirect through other intermediate sites hosted in Amsterdam, the U.K., and even San Jose, CA, but the Bahama name stuck.

Interestingly, the Bahama botnet appears to be closely related to the recent spate of “scareware” attacks, such as the one perpetrated against The New York Times digital site just a few days ago, reported by ComputerWorld.  Visitors to the NYTimes.com site were greeted with a pop-up informing them their computer was infected and directed to an authentic-looking site where they could install a program called Personal Antivirus.  Users duped into purchasing this phony software were then infected with a Trojan that gave control of their computer to an unknown third party that we now know to be part of a gang in the Ukraine.

We believe the Bahama botnet is controlled by this same gang, or their neighbors down the street.  More info about the “Ukranian fan club” can be found in Dancho Danchev’s excellent security blog.  We’re pretty sure the Bahama botnet is related to the Ukranian fan club and the NYTimes.com scareware because they each phone back to a bogus “Windows protection” domain located on the same IP address.

These sources were originally identified by the Black Hat community, but we believe Click Forensics is the first to discover the breadth and depth of click fraud being perpetrated by the botnets it controls.  And the botnet is incredibly insidious.

As seen in this video of the botnet in action, caught on film and narrated by Click Forensic’s own Matt Graham, the infected machine will exhibit some really funky behavior.  Clicks on organic search results are redirected through a series of parked domains across a number of top-tier ad providers (search engines and ad networks), eventually arriving at an advertiser unrelated to the original query.  The user is momentarily confused, but likely just performs the search again, this time with easy success.

What makes the botnet so insidious is that it operates intermittently so that the user doesn’t really know that anything is wrong.  Additionally, it can operate independently of the user because the authors appear to be building a large database of authentically user-generated search queries.  And because the queries come from many different machines (IPs) across a broad segment of the Internet population, it is very difficult to find and identify these clicks as fraudulent.  But these auto-generated clicks were not able to disguise themselves well enough to escape Click Forensics anomaly detection algorithms.  Additionally, large amounts of non-converting clicks were spotted in the data we receive from advertisers.  From there, our team was able to hone in on the source of the Bahama botnet.

In February of 2006, Click Forensics was just getting off the ground.  We recognized the problem of click fraud was a big problem and that building a solution would be tough technical challenge.  We decided to bring in an expert in the field of data mining and anomaly detection in clickstream analysis.  That expert was Dr. Alex Tuzhilin.  Alex spent the day with us at our offices in San Antonio and provided us a roadmap for the evolution of our approach to indentifying invalid traffic. 

His contribution to us at that point was essential and provided tremendous insight.  After reviewing our approach he commented,

“Click Forensics has good data and this is a source of their advantage over the search engines. My role is to work with them to refine the scoring methodology to improve accuracy. Their approach is to incorporate as much data as possible to improve accuracy. The search providers simply don’t have enough data to have the most accurate approach.”

Shortly after Alex’s visit to Texas, I received a call from the lead attorney representing Lane’s Gifts in their lawsuit against Google.  He said, “Tom, I just hired your Ph.D!”  He told me that the judge in that case had mandated that an outside consultant review Google’s click fraud detection methods and publish a paper on the efficacy.  Alex spent many weeks at Google and wrote an insightful paper detailing their approach, ultimately describing it as “reasonable”.  The Lane’s Gift case was settled and Alex returned to his role as a professor at NYU.

Today we are thrilled to announce that Dr. Tuzhilin has joined the Click Forensics Advisory Board.  Few individuals have had more real-world and academic experience in the measurement of online traffic quality and its effect on advertisers.  His work has helped move the industry toward standards and cooperation.  After visiting us in Austin a few weeks ago and meeting with our technology team, Alex said,

“Having firsthand experience reviewing the state of the art in ad network traffic management, I was impressed with the level of technical sophistication the team exhibits and I was impressed with the directions they are going, Click Forensics has played a leadership role in helping the online advertising community to monitor quality of clicks on ads, including identification of invalid clicks. I look forward to continuing to work with the team.”

In addition to Dr. Tuzhilin, we have also added Dr. William Wright, the Chief Scientist at Paypal.  Dr.Wright, a Ph.D. in cognitive science, is an artificial intelligence expert who has built numerous analytical and predictive systems over the past twenty years, including the Falcon Credit Card Fraud Detection System at HNC, the Advanced Fraud Screen system at CyberSource, and numerous adversarial modeling systems for the U.S. military.  After spending time with our team, William concluded,

“Click Forensics has built a strong team of developers using very advanced machine learning and data mining techniques to detect fraud and measure traffic quality, they are pioneering a new area of fraud detection and I’m finding it satisfying to work closely with them on leveraging lessons from my past experience combating credit card and banking fraud.”

One out of every five employees at Click Forensics holds a Ph.D.  Adding the expertise of Alex and William dramatically enhances our ability to meet our goal of providing the state of the art approach to traffic quality management.  I appreciate their contributions and look forward to benefiting from their knowledge in the future.

Congratulations to the newlyweds… after a long, long courtship Microsoft and Yahoo finally managed to get together (the prenuptials are still being sorted out!).  I have been in favor of this union for sometime now.  Google owns a ridiculous share of the pay per click advertising market and desperately needs a competitor.  Microsoft + Yahoo = Competition.  As I have said for the last several years, the lens we look through at Click Forensics is that of the advertiser.  Competition is always good for the advertiser.  

The growth of online advertising, in particular pay per click advertising, has been meteoric. It is a great model and one that has proven hugely successful for hundreds of thousands of advertisers large and small.  It is a model that will continue to grow as large advertisers shift more dollars from unmeasureable and less effective traditional media.  It will grow because it uses context, targeting and relevancy to the highest level.  Yahoo’s audience enhanced by Microsoft’s technology will mean innovation and efficiency.  There is no doubt; Google will continue to have success.  But the new partnership will make the online world even more attractive for advertisers.

Today there are standards in place to help hold the search providers accountable.  There are better reporting, campaign management and keyword tools to add to the efficiency.  I see a world in the near future where display advertising will begin to make significant gains from the data that exists in search. Context, targeting and relevance can improve every medium and this partnership will leverage that data to a much higher level than before.

So congrats to you both for a new start.  The entire advertising community is pulling for you and expecting big things. I do need to warn you… expectations are high and the honeymoon is short.  

Over the past week four major players in the online media space have announced accreditation to the Interactive Advertising Bureau’s Click Measurement Guidelines.  This list includes Yahoo!, Google, Microsoft and Business.com.  I wanted to take a moment and explore why you should care about this development and what accreditation means for advertisers.

The IAB is a publisher-focused organization that has led the process to develop click measurement guidelines.  The task force is made up of thirty or so companies representing the online advertising community.  Click Forensics has been a member since day one and participated in every step of the process.

There are three main benefits for advertisers and conversely, three concerns advertisers need to keep in mind associated with the entire process.  First, the benefits;

IAB Accreditation Represents a Commitment
The process to become accredited to the IAB guidelines is time consuming and certainly not free.  At Click Forensics, we have first hand knowledge of this and can assure you that any company that takes time and spends the money to become accredited is committed to their customers.  The level of detail the auditors go into is amazing.  Our community is fortunate to have auditors that have demonstrated a deep commitment to both the development of the process and the implementation of the guidelines.

IAB Accreditation Demonstrates Leadership
The IAB established a gating period to allow member companies and others to become accredited to the guidelines.  The companies mentioned above were the first to announce compliance.  This is important because it represents a sense of urgency among these four that enhances the urgency for others.  As an advertiser, you should reward these leaders with business.  They were first out of the gate and in my book that demonstrates leadership.

IAB Accreditation Means Better Quality Traffic
The IAB Guidelines are a lengthy narrative of “best practices” and rules in delivering quality traffic to advertisers.  While it is not intended to be a complete list, it serves as a firm foundation and includes practical steps to help ensure advertisers get what they pay for.  By working with an accredited ad provider, advertisers will be assured that the clicks they are buying have met the guidelines established by the industry.  This is a good thing and an excellent first step.

While we applaud the efforts of the IAB, Media Rating Council and member companies who participated in this process, there are things advertisers need to keep in mind.  There was a great deal of discussion and debate during the nearly three years of meetings it took to develop these guidelines.  In that process, there were a lot of valuable and important items that fell to the floor.  This is a good start, not a perfect process.  Keep in mind the following;

IAB Accreditation is a “Moment in Time” Process
The process for an ad provider to become accredited is a long one.  The auditor is invited in for a pre-assessment then the actual audit begins.  At the end of the process accreditation is awarded.  The problem is there is no mechanism for ongoing compliance.  When we buy gas at the gas station there is a meter that is routinely calibrated to ensure that when we fill our tank with 20 gallons of gasoline, we get 20 gallons.  This approach is not taken nor addressed in the guidelines.  While an annual audit is suggested in the guidelines, it is still important for advertisers to be monitoring their campaigns and holding the ad providers feet to the fire for every click.

IAB Accreditation Does Not Cover Everything
The 27 page Guideline document is quite comprehensive.  Our task force worked hard to ensure that both the guidelines are made clear and that the standard for measurement is defined.  However, when you consider that the dominant constituency in this process was multibillion-dollar ad providers, you might imagine not everything met their liking.  A few examples of chaff that hit the threshing room floor included:

Click ID – Each click should have a unique identifier so investigations can be “apples to apples”
Persistent Cookie – It’s important that ad providers can identify unique visitors to ensure they are billed for only once.
Standards for Investigation – Advertisers deserve to feel confident that they get what they pay for.  By setting an investigation format and agreeing to a timeline, ad providers can build trust with customers.

IAB Accreditation is a Roadmap
There is a Japanese proverb that says, “Beginning is easy and continuing is hard”.  There is truth in this as it relates to the guidelines.  We have begun the process.  We have released guidelines that will make the world of online advertising a better place.  Now we should look to leadership to take the next step and continue what we have begun.  The current guidelines will serve as a roadmap to the future standards.  We need to examine the items removed, listen to the community and think of better ways to ensure advertisers get what they pay for in the future.  The roadmap has been built.  Now we need to move on.

In January of 2006 as Click Forensics was just beginning as a company, I wrote the following challenge to our industry:

“Define standards for what an unwanted click looks like. We believe that there are certain characteristics or attributes that are common to a large percentage of click fraud. We are working with publishers and advertisers to agree on common ground and work together to expose it. Once this is developed it should be published so that the entire community can benefit from it.”

Today, over three years later, we have the cooperation of community leaders, the foundation of technical standards and the desire to continue to improve on what we have built.  I invite you, to join us as we build a future of ongoing growth and improving effectiveness by enhancing the process of online advertising.  I can assure you that both the Click Quality Council and Click Forensics will continue to support the work of the IAB and other industry organizations to work together to make our community a better place.  Let’s not stop with the foundation.

Wow!  Click fraud is real?  Click fraud costs online advertisers millions of dollars?  Click fraud can be uncovered and the perpetrators caught and punished?   Who knew?   Well, we did.

This week Microsoft filed the a complaint in U.S. District Court (Microsoft v. Lam, et. al., case number 09-cv-0815) seeking injunctive relief and damages from a group of people found to be perpetrating click fraud through the Microsoft adCenter platform.  This is only the second time (Google sued Auctions Expert International in 2004) that a search provider has ever caught and sued an individual (or a family, in this case) for click fraud.  We congratulate Microsoft for their efforts to root out this activity and encourage them in their pursuit of relief.  Online advertisers should appreciate knowing that click fraud does not always go undetected or unpunished.

For those not familiar with the case, it’s an example of what we call “competitor click fraud.”  The motivation of the perpetrators was simply to obtain higher-placed ad positions for lower bid amounts by depleting the daily budget of their competitors.  The verticals affected were auto insurance and the online role-playing game World of Warcraft.  Microsoft identified two brothers and their mother who controlled adCenter accounts that benefited from this fraud.  They believe that this scheme affected more than just adCenter advertisers, but also the advertisers on competitive search engines.

Microsoft’s complaint, now public information, is so well written it could be used as a tutorial on click fraud detection.  The most fascinating section describes the nearly year long game of cat-and-mouse played with the defendants.  Reading from the complaint: “When Microsoft took steps to mitigate these automated attacks, the perpetrators followed by implementing countermeasures to Microsoft’s actions.  A cycle of events ensued whereby the Defendants would update their attack methods to bypass the fixes implemented by Microsoft, and Microsoft would take additional steps to combat the new click fraud attacks.”

The lessons here are pretty clear:  Click fraud is still a problem and solving it requires constant vigilance.  The online advertising community needs to work together – search engines, ad networks, advertisers, and third-party auditors – to protect ourselves from this threat.

Q1 2009 internet media revenues were announced by the IAB today, with the industry experiencing an overall drop of 5.5% from Q1 last year.   Given all the bad economic news over the first three months of 2009, along with poor results announced by internet stalwarts Google, Yahoo, AOL and MSN, it’s not much of a surprise.  However, it is the first time since 2002 that the IAB reported number experienced a year-over-year decline.

There is some solace that online media results fell at a much lower rate than offline:  newspaper ad revenue plummeted 28% and radio revenues sunk over 24% – both some of the YOY worst declines in our lifetime.  TV revenues are also sure to fall, as soon as TNS reports Q1 results later this month.  That said, it’s never good to see our industry experience a YOY decline, no matter how small.  And, frankly, it was only a few months ago where I predicted that online media would show (much slower) YOY growth.

What’s changed was the depth of the economic crisis and the swift response by marketers to tighten up their spend.  Combine this with the free-fall in traditionally strong categories (finance, automotive to name a couple), and its surprising overall online media revenue hasn’t fallen more severely.   And, frankly, I don’t think the decline is over.  Based on conversations I’ve had over the last few months with folks whose opinions I respect, it seems like Display Media may have bottomed out, but we may see a continued decline in CPC spend.  This is being driven mainly by cuts in spending on second and third tier providers, as advertisers concentrate their spend with perceived higher quality networks and providers.

In an environment of shrinking budgets and more demanding buyers, increased transparency and tangible ROI are becoming requirements not “nice to haves.”  Those networks that actively manage and cull their traffic sources to ensure high quality traffic will continue to win out as advertisers increase demand that they “get what they pay for.”

A few weeks ago I spoke at the Search Engine Strategies conference in New York.  I was struck at the conference that people in our industry had their heads down.  I recognize the economy is tough and that jobs can be hard to find and keep.  But guess what… online advertising will win!  Like you, I have friends in traditional media.  Newspapers and print in general have been hammered.  Radio and outdoor is fading and television is showing signs of weakness.  The dollars are shifting to online and with good reason.

In my preparation for the presentation (which can be found here) I spoke to senior executives at digital agencies and leading online advertisers.  While the title of my presentation was, “Measurement Matters” the focus was change.  There is no doubt that the world of online advertising is at a crossroads.  According to a recent IBM survery, over 60% of all advertisers are cutting budgets… 80% of them are trimming more than 15% of the spending.  This urgency was clear in this quote from the report,

“Advertisers are aggressively shifting their spend to even more interactive, measurable formats, as providers struggle to move “beyond advertising” to new forms of communication that combine the ROI characteristics of direct marketing with the brand characteristics of traditional advertising.”

The tone I heard when speaking to advertisers and agencies was consistent… “Now more than ever, we need to be sure we get what we pay for.”  Jobs are on the line, performance is not optional and measurement matters.  Where can advertisers get better value and solid analytics for performance advertising?  Online of course!

I’ve identified five specific attitudes that need to be addressed to fully capitalize on the shifting dollars…

1. Stand on our strengths – Online advertising is measurable, has a growing reach and new and creative ways to deliver meaningful ad impressions to consumers.  These are meaningful strengths that need to be communicated.
2. Tout the targeting – Saying that television advertising can target is like saying you can tell what kind of fish are in the water from the boat.  Targeting (behavioral, demographic and geographic) are a strong suit of online advertising that is unmatched in traditional advertising.
3. Get creative with compensation – Advertisers need to (and will) hold agencies feet to the fire.  Agencies that embrace this and are open to new models of compensation, will win.
4. Measure, measure and measure – Performance standards, benchmarking and goals are critical for success.  The good news is that online holds that as a competitive advantage over traditional media.  More tools are available to help with this and insight into campaigns makes a major difference in success.
5. Look beyond the “Big Two” – Yahoo and Google hold a lot of the cards when it comes to online.  However, there is a growing community of quality ad networks and publishers that can deliver strong results.  I’ll talk more about how to find them in a future project.

My presentation included the chart below highlighting a SWOT (strengths, weaknesses, opportunities, threats) analysis I did on our space.

The current economic conditions create an opportunity for those of us in the digital world.  Now is not the time to complain… it is the time to aggressively promote the benefits that online holds over traditional media.

On a recent trip to New York, I was asked by an ad provider executive, “Which side are you on?” At first I didn’t know what he meant, but he clarified it for me by saying that in the world of advertisers, ad networks, publishers, and ad providers, it’s important to know whose side you’re on.

When I told him that we are on the side of the advertiser he paused, thought about it and then the light bulb went off. What’s good for the advertiser is good for our entire industry. 100% of the over $22B spent on search advertising comes from advertisers. They pay the bills for search engines, ad providers, parked domain companies publishers as well as those of us that are working to provide tools to improve traffic quality.

Despite our diverse client base, the lens Click Forensics looks through for every decision we make is that of the advertiser. While Click Forensics works with a number of advertisers and agencies, we also have many clients that are ad providers. This list includes search engines, ad networks, publishers and even parked domain companies. The reason these companies choose to work with us is that we provide insight into the traffic quality they are selling to advertisers. They are able to use this information to route, block, price and value the traffic to help advertisers get a better return on their ad spend.

Smart sellers look through this lens too. Companies like Yahoo that asked advertisers how they could improve communication. The result was the cooperative development of the FACTr system enabling advertisers to communicate concerns to Yahoo. Companies like Lycos, who realized early on that “quality matters” and began working to enhance their quality using traffic insight tools. And industry organizations including the Click Quality Council, while made of all parts of the ecosystem, is always advertiser focused.

Advertisers drive our industry and that reality will become even clearer in the future as mobile grows more important and display begins to look like search. We are proud of our involvement and the work of the Click Quality Council. The CQC is an example of an industry organization that is not dominated by one constituency. The over 100 members include companies from every corner and every perspective of the eco-system. They sit around the virtual table as equals, all understanding it is the lens of the advertiser that matters.

So this week, as the IAB releases the Click Measurement Working Group Guidelines, it is important that they are reviewed through the lens that matters, that of the advertiser. We should be asking, are these guidelines fair? Do they have enough substance to improve traffic quality and help ensure advertisers get what they pay for? Do the guidelines improve transparency and enhance trust between buyers and sellers?

I attended the IAB’s annual conference in Orlando this week and have a clear picture of their lens. We applaud the IAB’s leadership and the work of the Media Rating Council and task force members who produced a foundational document. Our hope now is that we can work together to build on this foundation to build trust, enhance transparency and accelerate the growth of online advertising.