AdWords
5.2K members online now
For issues or questions regarding logging in, account access, or account security
Guide Me
star_border
Reply

server hacked? ghost visitors

Visitor ✭ ✭ ✭
# 1
Visitor ✭ ✭ ✭

Hi

 

We run a business where Google display network traffic is crucial to survive, but recently when starting a campaign all the traffic seem to be ghost traffic (that does not active JAVA). When we start a new campaign, the first couple of hours everything is cool, but soon 90% af all banner clicks become ghost traffic, with no activity at all other than the landing page. We still get 10% ordinary traffic from our banners, but 90% are ghosts.

 

Does anybody know if a hacker can redirect traffic without us finding out?. We really need to solve this soon, as we will go out of business if we do not solve this puzzle very soon. The Ip addresses are not from bots, so we are very confused. Does anybody have an idea of what might be going on? We have had some strange traffic from Russia on our site (which is far from our market), but I do not know if that is related.

 

Thanks Jonas

1 Expert replyverified_user

Re: server hacked? ghost visitors

Top Contributor
# 2
Top Contributor

Hi @Kasper N sorry to hear you're having problems.

 

Are these new Campaigns targeting new areas/demographics, or are you seeing a change in your existing Campaigns?

 

Is it possible these are legitimate clicks but the visitors are finding your site not relevant to their needs and simply leaving the site after viewing the home page?

 

Jon

AdWords Top Contributor Google+ Profile | Partner Profile | AdWords Audits

Re: server hacked? ghost visitors

Visitor ✭ ✭ ✭
# 3
Visitor ✭ ✭ ✭
Hello Jon

Thanks for commenting.

As for the possibility of these visits being legitimate clicks, it is quite clear that they are not. The adwords representant looked at the numbers, and agreed that something is totally wrong. Around 96% leave the entrance page with out doing anything, but the most important proof is that these ghost visitors does not activate java or any other script, which all real visitor will.

We have made a lot o research, and are now pretty convinced that we are under botnet attack, where a competitor wants to drain our budget, and have bought the service of hackers who uses mallware to make infected computers click on our banners.

Has anyone had any experience with this?

Re: server hacked? ghost visitors

Explorer ✭ ✭ ☆
# 4
Explorer ✭ ✭ ☆
Do you have access to your server logs ? And if yes, do you see any abnormalities over there?

Re: server hacked? ghost visitors

Visitor ✭ ✭ ✭
# 5
Visitor ✭ ✭ ✭
Hi Marketsharer

We have access to our server logs, and it shows the typical botnet fingerprints. Around 90-95%% af the clicks from our display ads spend less than 0.1 second at our site.

Our ads are being targeted specifically, which indicates competitor click fraud.

In a banner campaign unrelated to the display network, we now see an unusual quantity of non bot bouncing clicks coming in from areas that we do not advertise in (Asia), which indicates that the hacker is also using real people to click on our ads. Pretty expensive to our competitor, as these kind of attacks are not cheap.