Spot the fraud
Thirteen scenarios, each with the signals a traffic-quality analyst would see. Decide what is going on, including the cases where the traffic is perfectly fine. advanced · 13 questions
Question 1 of 13Score 0
A campaign's clicks spike at 3 a.m. local time. Almost all come from IP ranges owned by one hosting company, and every visit lasts under a second. What is the likeliest explanation?
All questions with answers
- A campaign's clicks spike at 3 a.m. local time. Almost all come from IP ranges owned by one hosting company, and every visit lasts under a second. What is the likeliest explanation?
Answer: Automated bot traffic running from a data centre. Hosting-company IPs, identical sub-second visits and an odd hour together point to data-center traffic from scripts. A slow page would raise bounce rates across all networks, not just one host's. - Traffic from a Meta campaign shows a mix of phones and models, time on page ranging from a few seconds to several minutes, about 45% of visitors clicking a related search, and advertisers reporting normal conversions. What is your reading?
Answer: Nothing here suggests invalid traffic: varied devices, varied behaviour and real downstream conversions look human. Variety is the mark of people, and the advertiser conversion data confirms it. A healthy Lander CTR alone is not a red flag. Seeing fraud in every good number is its own mistake: it leads to cutting the traffic that pays. - One sub ID shows 98% of visitors clicking a keyword, 95% of those clicking an ad, and every click happening within one second of page load. What does this suggest?
Answer: Scripted or automated clicking: humans are never that uniform or that fast. Near-100% rates with identical timing are a machine signature, a sign of bot traffic or click spam. Real audiences hesitate, scroll and mostly do not click. A great article raises rates by a few points, not to 98%. - Visits claim a referrer of a well-known social network, but none carries that network's click ID, and the browsers report themselves as headless desktop Linux. What is most likely happening?
Answer: The referrer is being faked to make automated visits look like social traffic. A missing Click ID plus a headless browser fingerprint means the claimed source does not match the evidence: Referrer spoofing. Private shares would still come from ordinary phones and browsers. - A platform reviewer opening an ad's link sees a harmless recipe article. Ordinary users clicking the same ad see a page shouting "Claim your $5,000 grant today". What is this?
Answer: Cloaking. Serving reviewers one page and the public another is cloaking. Honest A/B testing shows variants at random to everyone, it does not pick out reviewers for the clean version. - A traffic partner delivers good quality for two weeks, then raises volume fivefold. The overall averages dip only slightly, but splitting by sub ID shows 30% of visits with zero engagement. What is this pattern?
Answer: Traffic blending: poor traffic mixed into good so the average hides it. Traffic blending relies on you watching averages. The tell is a sudden volume jump from one partner and a dead slice visible only when broken down by Sub ID. - Users complain that after installing a free "PDF converter" extension, their homepage and default search engine changed, and their searches now pass through an unfamiliar results page with ads. What is this?
Answer: Search hijacking. Changing search settings without clear consent is search hijacking, often delivered by adware. A legitimate default search deal is disclosed and agreed to; here the users were surprised, which is the difference. - A rewards app gives users coins for a task: "search for a term and click three results". The visits come from real phones and real people. Is this traffic valid for a search feed?
Answer: No: it is incentivised traffic, which is invalid because the clicks are made for the reward and not from interest. Incentivised traffic is human but not genuine. Google's AFS policies forbid compensating users for searches or ad views. "Real people, so valid" is the trap that catches many buyers. - A publisher's staff click the sponsored results on their own pages several times a day "to make sure the feed is working". How will the search engine see these clicks?
Answer: As invalid self-clicks, whatever the intention. Self-clicking charges an advertiser for nothing, so intent does not matter. The AFS policies also bar publishers from running searches on their own site to generate ads. Testing should use the tools the provider supplies. - Thousands of visits arrive from different home broadband IP addresses, one visit each. But every one has the same screen size, fonts and graphics signature. What is the most likely cause?
Answer: One automated setup rotating through residential proxies. Different addresses with one identical device signature mean one machine wearing many masks: a residential proxy network. Device fingerprinting exists to catch exactly this, since the IP check alone would pass it. - On a mobile lander, the ad block loads late and slides into the spot where a "Next" button was a moment before. Ad click rate is high, yet visitors leave advertisers' sites within a second or two. What are these clicks?
Answer: Accidental clicks caused by the layout, which are invalid and will be discounted. An accidental click comes from a real person who meant to tap something else. Advertisers see instant exits, and the search engine responds with deductions or smart pricing. A layout that causes them is also a policy problem. - Estimated revenue looked healthy all month, but the finalised statement is 35% lower, and the provider says the deduction relates to traffic quality on one source. What happened, and what is the sensible response?
Answer: A clawback for invalid traffic; pause that source and examine it by sub ID before buying more. This is a clawback: the search engine removed clicks it judged invalid. The traffic bill has already been paid, so the only useful move is to stop the source and find the bad slice. Ignoring it risks the whole feed. - Whatever article or ad a visitor arrives from, the query sent to the feed is always "mesothelioma lawyer". What is going on?
Answer: Keyword forcing: an expensive query is being sent that the user never chose. A query that never varies and happens to be one of the priciest is keyword stuffing, a kind of query fraud. Google's rules require the search term to be exactly what the user indicated, and forbid choosing terms to target high-cost ads.