The Traffic Generator

Traffic Generator & Click Fraud Detection Strategy

I thought I was the test subject of a new search engine. But now I believe that this is fraud. The traffic generator which hit my site had clear variations from my normal traffic but it could easily be modified to be less detectable -

• Too many simultaneous operating systems per IP. My traffic rarely has two systems from a single IP, much less simultaneously.
• The traffic is too dense and the changeover too abrupt. When I get traffic like this, it always references the same blog entry. The engine may have tried to mimic my apparent traffic (which is far higher than my real traffic).
• Too many 2-page hits. 90% of my traffic is a 1-page hit, 5% is 3+.
• The page hits don't follow a human click flow. The pages have no relationship to each other.
• All hits are bookmarks, no entry points into the site.
• Most bookmarks are older and rarely referenced by real traffic.

It might not be illegal.
Immoral, yes.

I believe the engine is generating the browser and OS signatures.
The traffic generator looks remarkably like a search engine spider except for:

• many IP addresses which read a few pages each (versus few IP addresses which read many pages)


• multiple OS and browser signatures per IP


• doesn't identify itself as a search engine spider

Detailed documentation -

The strangest part is that the suspected site gave me new insights into Internet evolution and structure. The rework of my mining methodology succeeded in identifying anomalous traffic. My postings about their website traffic anomalies may have spooked a few people.

I've been troubleshooting stuff since 1978. First electro-mechanical stuff, then electronics, software for the past fifteen years but I'm surprised the fraud was so transparent. My percentage bet is that it's about the advertising money. I suspect that the engine is generating income in the millions of dollars.