Hacker News Reader

Comment by JeffL | Hacker News Reader

I tried Adwords for search again recently after several years. There was a decent number of clicks, and the cost per "action" seemed very reasonable, where for me, the action is clicking on the download link from the landing page to download the installer for our game. The only problem is that tracking the IP's, 90% of the traffic from Adwords that downloaded the installer never actually ran the installer. Organic traffic usually has much more than 50% of the people who download it, run it. Is it a bunch of robots driving clicks and then clicking randomly on links on the landing page? Seems really suspicious.

View on HN

I run Google Ads for a mobile app I own.

If I try to optimize for download volume, that's all I get - bots after bots. Can rack up thousands of downloads for <10 cents per download without any impact on how many users actually use or rate the app.

I found that getting a good ROI required setting higher price targets and optimizing for in-app actions. That's really hard to do well and not very reliable, but it helped.

Excuse my ignorance, I know nothing about running these ads.

How does a bot know whether you've optimized for download volume or in-app actions? I don't understand how a bot would know to download the app to fulfill your requirement?

Furthermore, what is the incentive to write and operate these bots? Genuinely curious. The only party with an incentive to do this would be Google, no?

App owners who make money off serving ads are incentivized to do this (and have frequently been caught doing this).

If anyone's interested, the term is called click fraud - https://en.wikipedia.org/wiki/Click_fraud

A FTP game can do a TON to encourage people to download apps that'll never be opened without committing clickfraud.

Gosh I'm old. Spent a while there trying to figure out how File Transfer Protocol could be relevant to clickfraud.

Ah, me too. For those still confused, "Free To Play"

Well, don't feel bad. I did the exact same thing, except I had the benefit of your post and its anscestor replies, so I wasted less time.

You don't have to be old -- we still use FTP all the time at my job. Of course, whenever we have a say we use some secure variant, but you don't always have a say (no matter how much you yell, grumble, sermonize about the dangers of insecure tech, etc).

Of course, you probably meant you feel old because "FTP" didn't immediately register to you as "Free To Play". Well, I can't help you there, because by that standard I guess I'm pretty old too.

:-D

I usually see it written F2P for free to play, which cuts down on ambiguity.

I thought the same. An FTP game? What have I been missing.

The correct acronym is F2P, not FTP for „free to play“

Please, let's bring back sharewares instead of this mess. Unplausible, I guess. Impossible, I'll hear. Whatever.

The bot doesn't know, but the ad platform is optimizing for similar traffic.

So if bots are more likely to click download, and bots have similarities, bots see more ads.

I was thinking the same thing, only google has an incentive to do this and it would be too risky for them, legally and to their reputation. Either this isn't happening as much as people think it is, or some third party has an unknown reason to be operating bots like this.

Another guess at a third party reason: bots adding noise to their behaviour. "If I go clicking on everything, it'll be harder to know what my actual target was."

Competitors have a strong incentive to click each other's ads.

Google has a strong incentive to let them.

That's false. The one area where I'm sure google doesn't mess around is with their ads division. They spend a proportionately large amount of money combating fraud to prevent erosion of confidence and most importantly accuracy in their main money maker.

If you've ever taken a look at the number of conversions fb ads provides vs google ads, you'd know this.

Agreed, especially where most of these clicks can be carefully audited and reconciled by the advertiser, it would make no sense for Google to threaten its reputation and primary money maker.

Edit: that being said, this does not seem to hold for Facebook, and I don't have a good reason why.

Google has a stronger incentive to not let them.

Google's advertising business is built on trust. The moment there are a few scandals involving fake/robot ad clicks, big advertisers will remove their ad campaigns.

Google is the only organization with the data to show this happening at scale and they don’t have incentive to connect all the one-off anecdotes.

So while it is risky, not sure how they could be caught. I don’t think they are running click fraud bots, but it’s hard to quantify how hard they work to stop them.

A friend of mine estimated that 1/3 of ad spend is click fraud but it’s just in the wash because it’s hard to stop.

> Can rack up thousands of downloads for <10 cents per download without any impact on how many users actually use or rate

I'm assuming you use display for this pricing? If so build a white list of acceptable sites or avoid display. Running open network is always waste of cash in y experience, especially mobile devices.

Only time I’ve ever used AdWords we got a lot of sign ups, but all from very random Gmail accounts. They were all bots. I either don’t get how AdWords works or it’s entirely useless for SaaS businesses.

I had exactly the same experience the handful of times I've used AdWords.

I also just released my app on the Play Store a couple of weeks ago, and had exactly the same thing within the first 48 hours - a bunch of suspiciously similar Gmail accounts, none of which had actually used the app (I know this because no backing accounts were made in the database).

The only conclusion I can make is that there's huge amounts of fraud, but the average advertiser either doesn't know about it, or their advertising ROI is high enough that they can simply eat fraudulent clicks as the cost of doing business.

I've said it before, though - gut feeling is that internet advertising is long overdue for a reckoning.

Sure it was bots or just people signing up with throwaway accounts to get something for free? When I don't trust a page but have to provide details I always use fake data, doesn't mean a bot has filled it out.

Me too. I had same experience. A lot of fake sign ups from random email.

I've had issues with ads on Adwords, where 99% of the clicks where from bots. However, 50% engagement after a signup or download is normal! For some reason users signup or download stuff without thinking, like an web reflex of some sort. Sadly 50% of people will have no idea what to do after signing up or downloading. You can however get this number up to 90% if you have a simple, clear and easy instructions what to do after downloading it!

I would not be surprised if > 10% of people are unable to figure out where they downloaded it.

The Downloads folder is a scourge that never should have been allowed to exist.

Where should something be after I request it be moved to my machine? On the default view! (Aka Desktop)

Why? Because I literally just interacted with it!

Seriously. I have yet to find a non-techie user whose Downloads folder is not a complete mess, and why would they even know to organize it, it's so hidden from regular view. Many would just re-download things they might have already downloaded.

Why would you need to organize your downloads folder? I just leave everything I download there until I have a reason to clear it (like low disk space, reinstalling the OS, upgrading the drive, etc.) Unless I'm down loading a file that I want to move somewhere else of course. But installers and things that get downloaded to print and all kinds of things like that just stay in the DL folder because why not.

Just imagine the complete mess their Desktop would be if the OS sent downloads there, lol.

That's the point. A mess in plain sight is a mess that gets resolved.

Microsoft seemed to think shoving everything into a junk drawer was a better solution.

Download discoverability is a harder problem than it seems to solve. People may go a long time without seeing their desktop, because it is covered by windows they are interacting with. If they're not familiar with what is on their desktop, they would not easily recognize a new icon that shows up there.

I've tried AdWords for a couple of projects and have had very similar experiences. It has always been a total waste of money for me and I'm having a hard time believing that it's actual people, i.e. potential customers clicking on these things. The behavior of the people coming from AdWords is always completely different from those coming through other sources, as if they just clicked on it by accident or as if they're just bots.

thats entirely dependant on the volume, when you expend 6 million, you problably are going to loose a lot of money to bots, but you are going to recup the looses from other clients. When you expend very little money, the bots can easily get all the budget.

Maybe I don't understand how ads work, but this sounds like "lose money on each sale but we make it up with volume"...

more like lose money on most but make up for it later. bots are just an unfortunate fact you have to amortize into your costs.

Let's say you see 75% bot traffic. You make $10 per actual user. If youre spending $2 per action with 4 actions, you burn $6(75%) on bots, $2(25%) on a real user($8 total), and get $10 - netting $2. So you're making money, but wasting more.

So, let's say you set your targeting to completely exclude the bots. Great, you spent $2 and made $10, netting $8. The problem though is you ruled out 90% of your traffic - you have false positives on whether its a bot so you exclude legit users(all of this targeting is fuzzy rule based). You can 10x the traffic with bots, making $20, but you cant 10x the perfect targeting, so youre stuck with $8.

Few questions;

- When you say Adwords for search, you mean google.com and not display right? I see a bunch of what you describe across the display network any would only recommend running white-listed sites if doing the latter as there is much encouragement of fat finger and kids who press anything etc here.

- Are you allowing search partners? Id going google search I would strongly recommend sticking to google only as there is often more dodgy around partners but this is auto included in setup.

- What kind of KW and variance: Again assuming search, who big are your KW lists and negatives? Apologies if asking the obvious but is this consistent via KW?

- Geographic restriction: Have you broken the effect down geographically? This can lead to huge variance, and to a letter extent times your running.

- Are the ads pushy? Google and some people will put a bunch of effort towards you getting higher click through but fight that. You need to stay withing bands but too many ads are for an off the cuff example; 'Amazing game that will blow you away" gets clicks whereas you'll perform better by setting expectation with the boring 'Download and install this game' as your headline type thing... naturally if bots it wont help.

Game install can be tricky, from what I've seen it's competitive and low margin which is a challenging start point.

Back in 2004-ish when I was having a lot of success with Google ads, it was display ads across their partner network as well as search ads. Recently only text ads on Google.com for search, PC desktop only.

It's the same big giant list of keywords I used to use, something like 200 long, which I optimized a lot at the time. Not a lot of negatives, though.

USA and UK only this go around.

I don't think they are pushy. Yes, I noticed in the past that honest, informative ads seem to work the best, especially since I used to do CPC, so no reason to trick people into clicking who really aren't interested.

I'm sort of in a weird position where some of my metrics seem really good, monthly ARPU of $9.86 and churn 1.5%, I just can't figure out how to get people in the front door any more.

Try adding more good friction to your user acquisition funnel. If someone really wants to try your game, have them sign up with a valid email.

It seems counter-intuitive 'Why would I add more work for people who want to use my product?' - but the truth is you're just creating more work and wasting resources qualifying poor leads (in your case bots).

Agreed. It's should be about the quality of leads not the quantity. I've seen it happen with Facebook Lead Ads where those are almost worthless because of the ease to sign up.

There's always invisible recaptcha, which does nothing unless it has a high suspicion of being a bit.

Invisible recaptcha silently and randomly breaks your page for prudent users who run umatrix to cut down on tracking/spyware/malware garbage.

But I would think they would not have seen the ad in the first place?

Yeah, it's something that would only need to be put on the landing page for the ad, not elsewhere (until you're worried about bots creating accounts on your platform for other reasons)

Is it possible to track the action inside the installer itself?

e.g. each install contains a unique slug, when the installer is opened you use the unique slug to know where it is coming from?

We temporarily track with IP addresses. When someone goes to the landing page, we temporarily record the IP address and where the traffic came from, and then if they actually run the installer within a few days, we link up the install with the source of the traffic.

Edit: The installer checks our server to make sure it has the most recent version, and that's where we compare IP's.

If you can store the AdWords click ID on the server with the IP, you might be able to use your matcher to record the install as a conversion. AdWords should start optimising for installs vs downloads. But if you can carry over to some kind of in app purchase, I’d do that too, using avg value of an install as the install value and then any of the in app purchase values as the conversion values.

Think we filed a patent but it's possible to do this server side to inject a string into a payload area without affecting the integrity of the binary (can't recall how we did it but search patent search for my name at Google)

Is it required to communicate to users their IPs are used to track them?

If you ask GDPR, then yes[1].

[1] https://gdpr.eu/eu-gdpr-personal-data/

Regarding GDPR, shouldn't it be opt-in without forcing them to agree, clearly presented to the user and not hidden behind checking for updates to be compliant?

You can probably fingerprint the machine and send it back ?

How many steps are there between clicking the ad and downloading?

Don’t underestimate fat-fingering

The only prominent thing to click on from the landing page is the download link, and the ads are only showing to desktop users.

Maybe people don't know how to open it? Some websites exactly show users where to find the download afterwards. With Firefox, downloads pretty much disappear. In Chrome they're a bit more visible but easy to overlook. You could also trigger false positives with antivirus software preventing users to open it. There are a lot of reasons why users might click download but don't install or run the software in the end.

Webscrapers maybe?

Do people still download "setup.exe" files from random sites on the Internet and run them on their PCs?

Maybe a link to some sort of "app store" (or whatever its called on Windows) would be more convincing?

Yes, the Windows store is pretty awful and I feel like most Windows users have been installing software this way for a while (myself included).

I believe all of my current software besides games were installed this way.

To answer your first question, yes, quite a bit.

Yes, because there's no real choice. Only installing from an app store adds a little protection, but not much. The fundamental issue is the design of desktop OS' security models, which are focused around protecting local users from other local users, not around protecting local users from untrusted software.

(More than happy to hear suggestions for easy-to-use sandboxing for desktop software. The whole situation makes me quite uncomfortable.)

Not throwing away 30% of your revenue is a pretty good reason to still allow people to download your product from a website.

...yes.

(I should probably change my ways.)

(Microsoft could allow the store to be less terrible)

What's terrible about the store?

You can digitally sign your executables to increase trust.

I had the same experience with both Adwords and Facebook ads, all clicks were from bots: https://www.reddit.com/r/marketing/comments/4smisl/facebook_...

Same here. Found Adwords totally useless ROI-wise

Same here. Legend says your clicks become cheaper after spending $6M.

They don't. I spent around $2M from 2003 to 2015 and clicks became steadily more expensive and useless. The advice from their "experts" usually resulted in more spending with lower ROI. Eventually we stopped using Adwords. Google obviously didn't even notice or they just didn't give a shit, as they never contacted us to ask why we stopped using AdWords.

You cannot imagine how great AdWords was in 2004. It was much more transparent and easier to use, and the ROI was just incredible. Their success at that time was more than justified. Not so sure about today, though.

Yeah, in 2004, I could get a new paying user from Adwords for $35. Since about 2007+, the cost seems roughly infinite no matter how I try to tweak it.

is that an indictment of adwords or the state of the browser ecosystem (where potential customers are running ad blockers or otherwise avoiding ads)?

It could very well be that real users are disregarding ads (either with technical solutions such as blockers or by just ignoring them) and fraud has picked up the slack so that overall the number of clicks hasn't changed but the ratio of real user to fraudulent user has changed significantly.

Never trusting Google, I always used prepaid credit cards to fund my adwords purchasing. When Google finally caught wind of this, and could not just run wild with a "real" credit card like other horror stories I read - - they sent me a notice saying no more prepaid cards. So I said, see ya later Google Adwords, and guess what, even without any ads I have the same gross revenue, but without the expense of Adwords.

But excellent for affiliate link abuse. :]

If you still have the (anonymised) IP addresses I can tell you if the downloads was coming from bots or not.

How will IPs help you? Nobody is running those bots using datacenter IPs.

How can you anonymise an IP address? Given that (as I understand it) an IP address is considered personally identifying information under GDPR.

Google Analytics can do this by setting the last octet of IPv4 addresses and the last 80 bits of IPv6 addresses to zeros.

Reference: https://support.google.com/analytics/answer/2763052?hl=en

I thought this wasn’t true unless you had other data to aid in linking the IP address directly to the person (in http://curia.europa.eu/juris/document/document.jsf?text=&doc...).

So unless you have additional identifiers, an IP address by itself isn’t enough.

That’s not how I interpreted the ruling from the case you linked, although I’m not a lawyer:

Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

Additionally, from a cursory read, it appears like they are only talking about dynamic IP addresses anyway, but you, as a service operator, have no way of knowing if an IP is dynamic or static.

This is the key: ...where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person

Imagine you walk into a grocery store and pick up a rewards card to save N%. To get it, you have to give a phone number. If you write down your phone number, you've handed over some PII. If you write down a fake number, it's still legally PII, but has been anonymized, so the store won't be able to find you.

The original comments was about detecting if a given IP is a bot or not - I assume they probably can't do that given 32 random bits!

You can simply truncate the IP address and remove the last block (byte).

Just curious if you can contact me or, better, put contact information in your profile.

Did you use an advertorial or a webinar to properly whet their appetite so that any task even beyond installing would have been begged for by them?

Sorry for my ignorance, but wouldn't that be an indication of, you know, fraud? And if it were, would it even matter if it were Google's bots or someone else's?

I never really understood how Google could ever guarantee that ad clicks are real and not fake, as any sufficiently sophisticated robot will have click patterns that are indistinguishable from humans. I bet designing such sophisticated robots is an industry on its own.

I suspect this would be easily gamed by careful experimenters.

For example, could you build a page that bots could navigate to, but would be really obscure for a person? Would that generate a substantial amount of clicks? Sure, the bots could adapt (i.e. not click on obscure pages), but that would take time to learn, and until then, they would screw up and fall into the honeypot.

If that has ever happened in the history of Google, you'd think someone would have publicized it.

Thinking the same is true for Facebook ads.

Got a bunch of phone numbers that wanted our service. Only 1 person was interested, but didn't sign up.

For a nonprofit entity that I am affiliated with, we had a very high engagement (free) Facebook presence that eroded over time as organic posts get crowded out.

So you end up boosting or wasting money on ads. In my (limited) experience, ads weren't effective for us as they were too local and the audience was limited. Boosts were effective but expensive.

The funny thing was the our highest conversion paid event advertising was the old fashioned newspaper.

Reply on news.ycombinator.com