This document discusses search ad fraud and provides details on how it works. It explains that fraud involves fake sites and fake users (bots). Bots are automated browsers that load webpages and ads to generate fake impressions and clicks. Bad actors create fake sites with no real content and use bots to click on expensive search ads on those sites to siphon revenue from advertisers. The document analyzes data on ad spending and estimates of fraud. It also provides examples of domains used for fraud and discusses different types of bots used. In the end, it shares a case study where allocating spend away from fraudulent sites led to a large shift to more legitimate publishers.

1. Search Ad Fraud Explainer
May 2015
Augustine Fou, PhD.
acfou [at] mktsci. com
212. 203. 7239

2. May 2015 / Page 1marketing.scienceconsulting group, inc.
CONFIDENTIAL
UPDATED: Full Year 2014 Digital Ad Spend – $50B
Impressions
(CPM/CPV)
Clicks
(CPC)
Leads
(CPL)
Sales
(CPA)
Search 38%
$18.8B
Video 7%
$3.5B
Lead Gen 4%
$2.0B
10% Other
$5.0B
Source: IAB, FY 2014 Internet Advertising Report, May 2015
$42.5B
Display 16%
$7.9B
Mobile 25%
$6.2B$6.2B
CPM Performance
• classifieds
• sponsorship
• rich media
$7.0B

3. May 2015 / Page 2marketing.scienceconsulting group, inc.
CONFIDENTIAL
Impressions and clicks remain the biggest targets
Impressions
(CPM/CPV)
Clicks
(CPC)
Search
$18.8B
86% digital spend
Display
$7.9B
Video
$3.5B
Mobile
$6.2B$6.2B
Leads
(CPL)
Sales
(CPA)
Lead Gen
$2.0B
Other
$5.0B
• classifieds
• sponsorship
• rich media
estimated fraud
not at risk
(84% in 2013)

4. How Click (CPC) Fraud Works

5. May 2015 / Page 4marketing.scienceconsulting group, inc.
CONFIDENTIAL
Two ingredients to commit fraud
Fake Sites Fake Users
1
2
3
4
5
6
7
8
9
10
Designed with no real content;
exists only to carry ads
Bots are automated browsers
which load webpages to load ads

6. May 2015 / Page 5marketing.scienceconsulting group, inc.
CONFIDENTIAL
1. Bad guys put up fake sites
• Algo generated using
templates (e.g. The
same wordpress
template)
• No content or
plagiarized content
• Stuffed with
keywords ands ads
• Uses keyword
domains or domains
with lots of numbers
in them
• Sends large
quantities of ad
impressions and
search clicks

7. May 2015 / Page 6marketing.scienceconsulting group, inc.
CONFIDENTIAL
2. Bad guys choose expensive keywords
homemadesimple.comolay.com
“cosmetic face lift”
$10.84 CPC
“residential home cleaning”
$9.95 CPC
> 100,000 monthly searches
avg position 1 – 10
sort by highest avg CPC
Source: iSpionage

8. May 2015 / Page 7marketing.scienceconsulting group, inc.
CONFIDENTIAL
3. Their bots type keywords on sites they control
buy eye cream online
healthsiteproduc tionalways.com

9. May 2015 / Page 8marketing.scienceconsulting group, inc.
CONFIDENTIAL
4. Bots click on search ad to create CPC revenue
Olay.com ad
in #1 position

10. May 2015 / Page 9marketing.scienceconsulting group, inc.
CONFIDENTIAL
5. Pass fake URL trackers to hide the origin of the clicks
Click thru URL
passing fake source
“utm_source=msn”
http://www.olay.com/skin-care-
products/OlayPro-
X?utm_source=msn&utm_medium=
cpc&utm_campaign=Olay_Search_D
esktop_Category+Interest+Product.P
hrase&utm_term=eye%20cream&ut
m_content=TZsrSzFz_eye%20cream_
p_2990456911

11. May 2015 / Page 10marketing.scienceconsulting group, inc.
CONFIDENTIAL
Examples of search fraud domains observed
http://analyzecanceradvice .com
http://analyzecancerhelp .com
http://bestcanceropinion .com
http://bestcancerproducts .com
http://bestcancerresults .com
http://besthealthopinion .com
http://bettercanceradvice .com
http://bettercancerhelp .com
http://betterhealthopinion .com
http://findcanceropinion .com
http://findcancerresource .com
http://findcancertopics .com
http://findhealthopinion .com
http://finestcanceradvice .com
http://finestcancerhelp .com
http://finestcancerresults .com
http://getcancerproducts .com
36,000+ more
sites like these,
designed to show
search ads and
self-click on them
to siphon CPC
revenue

12. May 2015 / Page 11marketing.scienceconsulting group, inc.
CONFIDENTIAL
Sites can be grouped into three “strata”
Sites, networks and exchanges
that cheat or look the other way
• Stacked ads, auto-refresh
• High ad-load, low viewability
• Purchased traffic, audience expansion
Sites created solely for ad fraud
• Created by template/algo
• Enormous quantity of ads
• All traffic/impressions from bots
Mainstream publishers with human + bot traffic
• Legitimate publishers with real content that humans
engage with, interact, read and watch
• An unknown percentage of malicious bot traffic designed to
enrich their cookie-profiles for later high-value re-targeting
FRAUDSITE
bot
bot
bot
bot
bot
bot
PUBLISHERuser
bot
user
crawler
user
bot
2/3 1/3

13. May 2015 / Page 12marketing.scienceconsulting group, inc.
CONFIDENTIAL
Different kinds of bots generate fake impressions/clicks
Malware (on PCs)Botnets (from datacenters)
Toolbars (in-browser)Javascript (on webpages)

14. May 2015 / Page 13marketing.scienceconsulting group, inc.
CONFIDENTIAL
Humans vs “honest” bots vs fraudulent bots
Confirmed humans
• found page via search
• observed events (mouse click
with coordinates)
“Honest” (declared) bots
• search engine crawlers
• declare user agent honestly
• observed to be 1 – 5% of
websites’ traffic
Fraud bots
• come from data centers
• malware compromised PCs
• deliberately disguise user
agent as human users

15. May 2015 / Page 14marketing.scienceconsulting group, inc.
CONFIDENTIAL
Bad guys’ bots are not in ANY official bot list
10,000
bots observed
in the wild
user-agents.org
bad guys’ bots
3%
Dstillery, Oct 9, 2014_
“findings from two independent third parties,
Integral Ad Science and White Ops”
3.7%
Rocket Fuel, Sep 22, 2014
“Forensiq results confirmed that ... only 3.72% of
impressions categorized as high risk.”
2 - 3%
comScore, Sep 26, 2014
“most campaigns have far less; more in the
2% to 3% range.”
industry bot list “not on any list”
disguised as normal browsers –
Internet Explorer; constantly
adapting to avoid detection”

16. May 2015 / Page 15marketing.scienceconsulting group, inc.
CONFIDENTIAL
Click fraud data
Bad guys’ sites
show 100%
click through
rates
Sophisticated
bad guys’ sites
had click
through rates
tuned to cover
their tracks

17. May 2015 / Page 16marketing.scienceconsulting group, inc.
CONFIDENTIAL
Click fraud case study: allocating away from fraud sites
18% of spend shifted from fraudulent websites to “top 5” good guys
BEFORE
Top 2 “good guys” = 76%
AFTER
Top 5 “good guys” = 94%

18. May 2015 / Page 17marketing.scienceconsulting group, inc.
CONFIDENTIAL
Dr. Augustine Fou – Independent Ad Fraud Researcher
“I advise advertisers and their agencies on
the technical aspects of fighting digital ad
fraud. Using forensic technologies and
techniques I help to assess the threat and
the current countermeasures in order to
recommend additional steps that can be
taken to combat fraud and improve ROI.”
FORMER CHIEF DIGITAL OFFICER, HCG (OMNICOM)
MCKINSEY CONSULTANT
CLIENT SIDE / AGENCY SIDE EXPERIENCE
PROFESSOR AND COLUMNIST
ENTREPRENEUR / SMALL BUSINESS OWNER
PHD MATERIALS SCIENCE (MIT '95) AT AGE 23
Articles: https://www.linkedin.com/today/author/84444-augustinefou
Slideshares: http://bit.ly/augustine-fou-slideshares
Bio: http://linkd.in/augustinefou acfou@mktsci.com | 212.203.7239