Hacker News Reader

Comment by picodguyo | Hacker News Reader

I observed the same with Google's "Smart" display ads. I ran a campaign for a couple of weeks and watched all of the traffic with HotJar. The first fishy thing was 99.9% of the traffic came from foreign countries despite the target being US/Canada. When I saw the targeting wasn't effective, I even set up specific geographic exclusions for every country != US/Canada and still the traffic was from mostly underdeveloped countries. Then there was the behavior of the "users" when they visited the site. A large percentage of them went straight to the search box (which literally no humans do on the site) and typed in something topical but completely unrelated to the site's topic, e.g. "covid". Another large percentage just scrolled up and down randomly. It was interesting to see the size and relative sophistication of the fraud going on but not exactly $500 well spent.

View on HN

Wow, I had the same issue. I'm an ad-noob in the fullest sense of the word, but I tried the Google "Smart Ad". It turned out the same way you mentioned. I looked at where my clicks were coming from, and they were all pretty much from Hindi oriented Youtube channels. I was baffled at how that happened as I targeted US/Canada as you did.

It seems like pay-per-click and similar models should just be discontinued, they don't work since they can be exploited. An independently verifiable metric needs to be used (if the price for the ad should be traffic or interaction based) - or something completely different. Fixed prices?

There's a large circular economy with ad buyers, marketing/PR firms, ad-tech, and ad networks going on where a large amount of fraud is overlooked/ignored because everyone's jobs and ad budgets depend on ignoring it.

Sounds a bit like the "systemic failures" that brought down the housing market in 2008.

It's always been a surprise to me how much money is flowing from ads and how any business can be so reliant on it, since this makes it sound like it's fundamentally flawed. One would think the jig would eventually be up.

It'll be interesting to see what happens when the jig is finally up, since there's so much stuff we're used to getting for free that is currently financed by all of this: email, maps and GPS navigation, staying in contact with college friends, ...

FOSS and paid services will rise and shine.

For navigation to a known address, OSMAnd works great. Google Maps is better at search, particularly for commercial destinations, and has a slicker interface. For everything else, particularly navigation off road (on trails or otherwise) OSM excels. OSM has much more detail than Google Maps for things like parks and trails, frequently even having the locations of water fountains (this has saved my ass a few times.)

I guess my point is the alternatives to Google Maps aren't perfect but they have a lot more to offer than many people assume. When I drove across Canada, from Ottawa to Anchorage, OSM never let me down. It's a viable alternative.

Honestly I think we'll be fine. If the services are worth something then people will be willing to pay for them. Newspapers, magazines, email, satellite radio, navigation systems etc. all existed (and were very profitable) well before online advertising became what it is now. We might even be better off that way.

Sometimes it's just priced in. If partner A has a 10% fraud rate and partner B has a 5% rate but partner A is 10% cheaper than partner B, while you'll probably complain to partner A it's still the sensible choice.

It's hard to get the numbers, though. I mean, I guess we could ask....

Well, at my last employer we had our own systems analyzing traffic, we had integrations with third parties (DoubleVerify being the biggest) to detect fraud, our clients often had their own third party integrations to detect fraud and would complain if we hadn't found it but they did at too high a rate, etc.

Honestly after the ad images/video, all the fraud detection javascript from the advertiser, the publisher, the advertiser's system of choice, the publisher's system of choice all doing "trust but verify" with each other is the largest contributor to how big ads are.

Every been to a big break and motor store and they asked for your zip code? That is because they have someone in the back office to wants to see if the ads - dead tree paper - they spent to your zip code worked. It isn't hard to work the numbers from there, but it is tedious and requires some statistics.

Heh, I always find it funny when I buy a non-recurring thing, but keep seeing ads for it.

Best was when I kept seeing ads for a thing I was selling. I visited some big box sites about it to copy the specs on it.

The vacuum problem... the issue is that it's kinda hit or miss to come up with items that are related to the vacuum and to do it over a time period.

I think if ads were smarter, you'd get ads for your vacuum's filter a few months after buying it and maybe replacement pieces just after warranty, but what do I know?

Maybe some Toyota ads after owning a Mercedes for >5 years?

And that strategy still doesn't account for word of mouth.

actually it does. That is why you need a full time statistician on staff (likely a department), they spend a lot of effort finding and accounting for confounding factors.

ZIP code is also used for credit card verification.

Only at gas pumps.

No actually. Post codes are a recent thing here, and are mostly not hierachical. Also the standard reaction would be wondering why they need any info to process an instore purchase.

Amazing that we have an industry whose biggest component is keeping out fraud in the industry. Imagine pitching that to a VC.

It's not just clickfraud. Attribution is a hard problem that leaves a lot of space to bullshit people. A/B tests require degree-level understanding of statistics to conduct properly, which isn't common in companies, particularly when correctness doesn't matter if the test is just used to confirm preconceptions or justify budgets. Etc.

> Sometimes it's just priced in.

Agreed. The real losers are the genuine content creators, as the adcash isn’t flowing to them. They can’t just average it out.

Yep. Got banned from Google ad mob because the ads I bought using other Google services gave me traffic that was deemed to be fraud.

Of course there’s no way to contact and tell Google that Google gave me fraud traffic and got me banned from Google.

Don't worry. Some rando at Google is bound to see this message or the next one!

Are they all like this, in that they're easy to exploit and there are high occurrences of fraud?

I wonder what would be reliable ways to spend money for advertising, then? I'm new to this, but I was thinking about spending some money for some online marketing until reading this.

All the metrics for advertisement sales have been gamed for as long as I know of (at least 20 years); this goes for paper, online, television, and radio. Smart advertisers know what's going on, and they take the 'gaming' into account.

I've been waiting so long for it to be a bubble that pops, web ads just can't be worth that much when they are so bad.

I see some "captive" ads now, and I can imagine those are worth so much more - for example instagram play-between ads. No wonder the open web is dying.

Conversion tracking is the much loathed "spying/stalking" of ads.

the default setting on Google location targeting is/was "user in [geo] OR user 'interested' in [geo]." which is insane! but could explain the location weirdness

I know this isn't tech support, but is there somewhere I can read about changing this? And you are damn right, it's extremely astonishing seeing as how "target geo" != "interested in" at least on it's face.

From their FAQ: https://support.google.com/google-ads/answer/2453995?hl=en

> If the Google Ads system detects geographic areas that someone is interested in, we may show appropriate ads targeted to that area or surrounding areas (known as "location of interest").

> The default advanced location option in Google Ads will use both physical location and / or location of interest to determine where ads can appear. You can update your advanced location options at any time.

Looks like "interest" is still the default!

Wow I figured Google quietly changed this in shame when it was publicized years back. How are they still running this scam?

I work at Hotjar and love it that you're getting value out of the product! We do try to not record bots that advertise known user agents, like Google, Bing and other common ones. Reasoning being that recording non-humans will usually not tell you much about how your UX is optimized for humans.

It's really interesting that somehow the fact that we recorded these less known user agent bots actually made the product more useful for you and you were able to detect fraud going on.

I promise I'm not a shill, but yes I do indeed love HotJar and find it essential for getting new sites off the ground. I've uncovered countless UX improvements by watching HotJar recordings. And thanks for your generous free tier!

I wonder what your users would think of the fact that their every click was being recorded. I suspect the reason most people are not worried about this kind of stuff is that they're not aware how creepy it actually is.

I can respect that some people find it creepy, and I personally use AdBlock, which blocks HotJar as others mentioned. That said, I find a tool that records anonymous sessions detached from any sort of PII or even IP address much less offensive than something like Google Analytics, social login, or literally any advertising pixel.

What matters is consent.

Sounds creepy af. It's stuff like this that makes me keep javascript disabled whenever possible.

On the one hand, I agree that the capability is concerning, but if it only records the behavior within a single visit and doesn't correlate it with an account, or across multiple visits, or across websites at all, I think that that probably wouldn't be much of an issue, for me at least.

However, I don't see a way to allow that without also making the aforementioned unwanted connections also possible.

Here's the documentation for passing a user identifier to Hotjar:

https://help.hotjar.com/hc/en-us/articles/360033640653-Ident...

This is a bit better than it used to be. At one point the documentation had a field for User Email Address, and only a footnote in some documentation suggested it be hashed. Still, for a company that chooses to use the feature, the session recording can be tied back to the user account and any data already associated with it.

thanks

Hashing email addresses doesn't really work. Most people don't use unique addresses per service and its easy to get a large list of email addresses that you can hash and do lookups in.

Funny you should say that, I just blacklisted hotjar this morning in noscript!

It's also blocked by default by uBlock Origin, fortunately.

Naah, just install adnauseum [1] and thank advertisers for forcing you to use adblocker. Let them pay for all the manace they couse to you and help ad networks to build completely wrong profile on you.

[1] https://adnauseam.io/

Hehe yes since i installed adnauseum i love ad's...and i love that they have to pay for it, atm at 5732$ ;)

Make sure you keep all your software up to date. Malvertising is pretty common, and adnauseum does a great job at firing payloads on your machine.

It is the equivalent of installing an app that silently opens every attachment that is emailed to you.

They deny this, but I have no idea how accurate the denial is.

https://github.com/dhowe/AdNauseam/wiki/FAQ#does-adnauseams-...

Had the same idea, but my OS is so uncommon that malware probably does not exist (if it's not a targeted attack).

They should make it so that it talks to a VM (with no persistent storage) and sends the links to be opened to it (with the current browser's context such as cookies, etc so attribution still works).

I think it goes so far as to be unethical, because it takes advantage of a gap in understanding[1] where most users aren't even aware of the possibility of this being possible.

[1] https://quinnkeast.com/writing/the-possibility-gap-its-time-...

Can I do the opposite and only record events from known bots to determine their level of interactivity?

I sometimes buy fraudulent ad traffic and point it ad landing pages that should drive away humans, trying to fingerprint anything that sticks around. I'd be very interested in tracking bots that actually send you events.

What would the goal of the “users” (bots?) have been in this case? Is there any monetary gain for them? Would a competitor do this to waste your ad spend?

I guess google pays a share of the money to owners of youtube channels/websites where the ads are displayed?

I hadn’t thought of that angle.

Seems that getting rid of this sort of problem is one of the reasons one would use an ad network.

Presumably the ad clicks are making money for the apps/sites that are displaying the ads.

I have a memory of doing that 20 years ago as a pre-teen to make my friend like 50 cents.

Many of the adult-oriented ads paid upwards of $0.50/click.

Your parents would definitely wonder why you were receiving checks in the mail from Xpics.

Once I left the Visual Basic scripted web control running overnight by mistake...

I used to do the same thing, but I don't think any of them were adult sites. It was all done through some kind of ads broker, and the cheques came directly from them.

Looking back, it was pretty shitty behaviour by me, but as a 14 year old boy, it just didn't even feel like a crime, even a victimsless one; it almost felt entrepreneurial.

Your 14 year old self learned the core lesson of business success.

Thats how i made my first 10k on the web, still have the check:)

In the location settings - did you choose "are in location" or "are in location or are searching for location"

Not defending google but the latter is on by default, switching to the former can massively help here.

I mean in most cases Google controls both the Ad Network and the analytics people use to monitor those ads. It's easy to imagine some artificial inflation happening.

Who would be paying the person or bot in this scenario. Surely LinkedIn wouldn’t be directly paying for that I wonder what is funding all this.

I ran ads with Google again recently after a long hiatus. Literally 0 conversions (free signup) but ads on FB/Reddit/Others performed fine. Just 100% worthless traffic. Google has gone very wrong.

There is also a more broad article about ad fraud I found interesting https://clearcode.cc/blog/rtb-online-advertising-fraud/

I can imagine that ad fraud prevention must be a hard task, probably requiring AI/ML nowadays. But I don't like that fact because it will probably force website owners to add more behavior tracking and analytics events on every web page. That will end up with more websockets, more memory and longer loading times and higher UI latencies and further worsenijg thr web browsing experience which is already pretty bad. :(

Display network has been like that for atleast 10 years that I have been using it.

Why continue to use it?

The fraud really just steals from legit publishers.

If you’re an advertiser and the display market becomes 90% fraud, you just end up paying 1/10th the rate for 10x the traffic.

Legit publishers get 1/10th the revenue though.

Can I ask then, why continue to use it for 10 years?

You can sell crappy products with above 90 percent margin. Though now we primarily use FB.

So would this then mean that Google's Adwords program for advertising your business based on keywords and target countries or regions is broken and unusable for business owners? (at least not profitably usable).

I've read very different from other commentators right here on HN who claim that Google ads work well for them and likewise I've heard plenty of anecdote from users of Facebook's and other ad platforms that they have delivered positive ROI for ad placement of their offers.

Any opinion?

I think it depends if you’re doing Direct Response Ads, or branding.

With DR if your sales / leads are not generating a Return on Adspend (ROAS), you will change or stop advertising.

With branding, you might not even notice that Google is sending traffic from the wrong country. And you might be happy with the great looking vanity metrics.

My experience with Google (YouTube) Ads is that they work extremely well. I use them to generate leads for solar panel installers.

I ran into the same thing. Until now I thought I was just a noob and couldn't figure out a way to exclude each country by painstakingly excluding each country manually. These exclusions did work for me though.

Note: I am not ruling out that I am just a noob.

you sure you setup your campaign correctly? from what it sounds like, you didn't limit your campaign to search. also it would be VERY interesting to see how you not only setup your ad group but also what keywords you used for each group. typically when we see people complain about ad fraud we see alot of basic mistakes that they made when setting up their campaign. i hate to say it, but 99% of the people out that claim they know how to setup and manage a google ads campaign are amateurs at best and don't know the basic foundations of the way google ads works.

You're right, we are amateurs. But the fact that I "target" US/Canada, and my ads are being shown to Hindi-folk is a case of bad ui and bad design.

As mentioned, this was Google's Smart (display) Ads not their traditional search ads. I've had good success with the latter but decided to try the former on their suggestion.

Reply on news.ycombinator.com