際際滷

際際滷Share a Scribd company logo
https://commons.wikimedia.org/wiki/File:Thief.png, By JamesDrury creative commons  share alike
Catch your Advertising Money Thieves
 Is someone stealing your advertising money?
 Who or what is producing invalid traffic at your cost?
 You want to get alerted when suspicious traffic kicks in (Fraud)?
 You want a clean and accurate basis for your Marketing Analytics
without fraud traffic?
Best possible Source for DATA = Logs
Best possible Analytics Engine =
Before we start  some good to know
 The data we are talking about does not live long (GDPR compliance).
 IP Address processing is necessary for the purposes of the legitimate interests pursued by the
controller - Security and Fraud detection are two legitimate interests.
 You need to understand what can appear as direct campaign traffic means.
Learn about it here: https://www.youtube.com/watch?v=8oGlkqq_0Ao
 Be very careful with your analysis and ask a security specialist for a second
opinion before you report your findings.
 Expect Fraud everywhere but also be aware that some users show strange click
flows.
 Read this: https://www.wfanet.org/adfraud
Prerequiste: Get the Logs into New Relic
 Define New Relic the endpoint of your Logs in your CDN or from your servers (in case no CDN is
used)
 Check if logs arrive
(Example for Fastly) (Logs arrived in New Relic)
Make sense of the of the data
Focus for this use case only on traffic coming from your paid campaigns (Paid Search,
Paid Social etc.)
Most thieves hide themselves by using sophisticated scripts run on a variety of servers. Expect to see
one thieve use multiple IP addresses.
A good starting point is to count the calls of UTM Campaign traffic and separate it by IP address.
Select count(client_ip) as 'Requests'
from Log
where request_user_agent not like '%bot%'
and request_query_string like '%utm_campaign%'
and request_referer not like '%yourdomain.%'
facet client_ip
limit 50 since 1 day ago
xxx.xx.xx.xx
xxx.xx.xx.xx
xxx.xx.xx.xx
xxx.xx.xx.xx
Narrow down to get more intelligence
 Ask Questions
What campaigns are affected?
Is this real fraud?
xxx.xx.xx.xx
xxx.xx.xx.xx
xxx.xx.xx.xx
xxx.xx.xx.xx
Click to
filter
Campaigns
Called
Red Flag Cost
per Click
Campaign
Is the specific IP address known as Fraud?
 Various platforms provide databases of known fraud traffic Ips
 Example: https://scamalytics.com/
 Confirms my assumption: Most likely fraud !
Further Analysis
 Check the log entry further for
 Is a referral present?
 Is a gclid present? (you might need it for reporting it to google)
 Is anything else looking suspicious?
A starred as request
languagesuspicious
Export gclid
directly from New
Relic
Create an outlier alert to get notified!
Automate Fraud detection
 Implement a script using the NR APIs to get the list of possible fraud
Ips
 Query the https://scamalytics.com/ API and send the results (as
custom events) into New Relic using the ingestion API.
 Now you can query the data easily and get alerted on high fraud
traffic based on public available data
Fraud Scoring in New Relic
Report identified Thieves
 https://support.google.com/googleads/troubleshooter/2557048?rd=1
 Make sure the ALL the data requested by Google. The better you report the faster
Google can react and probably refund you. All requested data should be available
in your logs.

More Related Content

Similar to The thieves (20)

StubHub's Field Guide To Preventing Competitor Price Scraping, Unwanted Trans...
StubHub's Field Guide To Preventing Competitor Price Scraping, Unwanted Trans...StubHub's Field Guide To Preventing Competitor Price Scraping, Unwanted Trans...
StubHub's Field Guide To Preventing Competitor Price Scraping, Unwanted Trans...
G3 Communications
Digital marketing tools online
Digital marketing tools onlineDigital marketing tools online
Digital marketing tools online
In棚s Gomes Pinto
Mystery Shopping Inside the Ad-Verification Bubble
Mystery Shopping Inside the Ad-Verification BubbleMystery Shopping Inside the Ad-Verification Bubble
Mystery Shopping Inside the Ad-Verification Bubble
Shailin Dhar
Field Guide To Preventing Competitor Price Scraping, Unwanted Transactions, B...
Field Guide To Preventing Competitor Price Scraping, Unwanted Transactions, B...Field Guide To Preventing Competitor Price Scraping, Unwanted Transactions, B...
Field Guide To Preventing Competitor Price Scraping, Unwanted Transactions, B...
Distil Networks
DEFCON 23 - Mark Ryan Talabis - The Bieber Project
DEFCON 23 - Mark Ryan Talabis - The Bieber ProjectDEFCON 23 - Mark Ryan Talabis - The Bieber Project
DEFCON 23 - Mark Ryan Talabis - The Bieber Project
Felipe Prado
Are Bot Operators Eating Your Lunch?
Are Bot Operators Eating Your Lunch?Are Bot Operators Eating Your Lunch?
Are Bot Operators Eating Your Lunch?
Distil Networks
Preventing click fraud
Preventing click fraudPreventing click fraud
Preventing click fraud
BenHamminton
Phishing: Analysis and Countermeasures
Phishing: Analysis and CountermeasuresPhishing: Analysis and Countermeasures
Phishing: Analysis and Countermeasures
IRJET Journal
ComplianceBrief
ComplianceBriefComplianceBrief
ComplianceBrief
Daryl McNutt
Phishing: Swiming with the sharks
Phishing: Swiming with the sharksPhishing: Swiming with the sharks
Phishing: Swiming with the sharks
Nalneesh Gaur
Rtp rsp16-distil networks-final-deck
Rtp rsp16-distil networks-final-deckRtp rsp16-distil networks-final-deck
Rtp rsp16-distil networks-final-deck
G3 Communications
The State of Credential Stuffing and the Future of Account Takeovers.
The State of Credential Stuffing and the Future of Account Takeovers.The State of Credential Stuffing and the Future of Account Takeovers.
The State of Credential Stuffing and the Future of Account Takeovers.
Jarrod Overson
Digital ad fraud superheroes the good guys by augustine fou
Digital ad fraud superheroes the good guys by augustine fouDigital ad fraud superheroes the good guys by augustine fou
Digital ad fraud superheroes the good guys by augustine fou
Dr. Augustine Fou - Independent Ad Fraud Researcher
Detecting fraud through traffic analytics
Detecting fraud through traffic analyticsDetecting fraud through traffic analytics
Detecting fraud through traffic analytics
Sven Hezel
Amazon & E Bay
Amazon & E BayAmazon & E Bay
Amazon & E Bay
Sabyasachi Dasgupta
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseSANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
John Bambenek
How to detect affiliate fraud
How to detect affiliate fraudHow to detect affiliate fraud
How to detect affiliate fraud
Sven Hezel
10 ways to protect your e commerce site from hacking & fraud
10 ways to protect your e commerce site from hacking & fraud10 ways to protect your e commerce site from hacking & fraud
10 ways to protect your e commerce site from hacking & fraud
WebSitePulse
Iab bots how to_find_them_webinar_2014_03_27
Iab bots how to_find_them_webinar_2014_03_27Iab bots how to_find_them_webinar_2014_03_27
Iab bots how to_find_them_webinar_2014_03_27
IABmembership
Distil Network Sponsor Presentation at the Property Portal Watch Conference -...
Distil Network Sponsor Presentation at the Property Portal Watch Conference -...Distil Network Sponsor Presentation at the Property Portal Watch Conference -...
Distil Network Sponsor Presentation at the Property Portal Watch Conference -...
Property Portal Watch
StubHub's Field Guide To Preventing Competitor Price Scraping, Unwanted Trans...
StubHub's Field Guide To Preventing Competitor Price Scraping, Unwanted Trans...StubHub's Field Guide To Preventing Competitor Price Scraping, Unwanted Trans...
StubHub's Field Guide To Preventing Competitor Price Scraping, Unwanted Trans...
G3 Communications
Digital marketing tools online
Digital marketing tools onlineDigital marketing tools online
Digital marketing tools online
In棚s Gomes Pinto
Mystery Shopping Inside the Ad-Verification Bubble
Mystery Shopping Inside the Ad-Verification BubbleMystery Shopping Inside the Ad-Verification Bubble
Mystery Shopping Inside the Ad-Verification Bubble
Shailin Dhar
Field Guide To Preventing Competitor Price Scraping, Unwanted Transactions, B...
Field Guide To Preventing Competitor Price Scraping, Unwanted Transactions, B...Field Guide To Preventing Competitor Price Scraping, Unwanted Transactions, B...
Field Guide To Preventing Competitor Price Scraping, Unwanted Transactions, B...
Distil Networks
DEFCON 23 - Mark Ryan Talabis - The Bieber Project
DEFCON 23 - Mark Ryan Talabis - The Bieber ProjectDEFCON 23 - Mark Ryan Talabis - The Bieber Project
DEFCON 23 - Mark Ryan Talabis - The Bieber Project
Felipe Prado
Are Bot Operators Eating Your Lunch?
Are Bot Operators Eating Your Lunch?Are Bot Operators Eating Your Lunch?
Are Bot Operators Eating Your Lunch?
Distil Networks
Preventing click fraud
Preventing click fraudPreventing click fraud
Preventing click fraud
BenHamminton
Phishing: Analysis and Countermeasures
Phishing: Analysis and CountermeasuresPhishing: Analysis and Countermeasures
Phishing: Analysis and Countermeasures
IRJET Journal
ComplianceBrief
ComplianceBriefComplianceBrief
ComplianceBrief
Daryl McNutt
Phishing: Swiming with the sharks
Phishing: Swiming with the sharksPhishing: Swiming with the sharks
Phishing: Swiming with the sharks
Nalneesh Gaur
Rtp rsp16-distil networks-final-deck
Rtp rsp16-distil networks-final-deckRtp rsp16-distil networks-final-deck
Rtp rsp16-distil networks-final-deck
G3 Communications
The State of Credential Stuffing and the Future of Account Takeovers.
The State of Credential Stuffing and the Future of Account Takeovers.The State of Credential Stuffing and the Future of Account Takeovers.
The State of Credential Stuffing and the Future of Account Takeovers.
Jarrod Overson
Detecting fraud through traffic analytics
Detecting fraud through traffic analyticsDetecting fraud through traffic analytics
Detecting fraud through traffic analytics
Sven Hezel
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseSANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
John Bambenek
How to detect affiliate fraud
How to detect affiliate fraudHow to detect affiliate fraud
How to detect affiliate fraud
Sven Hezel
10 ways to protect your e commerce site from hacking & fraud
10 ways to protect your e commerce site from hacking & fraud10 ways to protect your e commerce site from hacking & fraud
10 ways to protect your e commerce site from hacking & fraud
WebSitePulse
Iab bots how to_find_them_webinar_2014_03_27
Iab bots how to_find_them_webinar_2014_03_27Iab bots how to_find_them_webinar_2014_03_27
Iab bots how to_find_them_webinar_2014_03_27
IABmembership
Distil Network Sponsor Presentation at the Property Portal Watch Conference -...
Distil Network Sponsor Presentation at the Property Portal Watch Conference -...Distil Network Sponsor Presentation at the Property Portal Watch Conference -...
Distil Network Sponsor Presentation at the Property Portal Watch Conference -...
Property Portal Watch

Recently uploaded (20)

Buy Followers on Instagram in viewtifulday
Buy Followers on Instagram in viewtifuldayBuy Followers on Instagram in viewtifulday
Buy Followers on Instagram in viewtifulday
vairam13
Anatomy of a Brand, a framework for branding projects by BRINK
Anatomy of a Brand, a framework for branding projects by BRINKAnatomy of a Brand, a framework for branding projects by BRINK
Anatomy of a Brand, a framework for branding projects by BRINK
Joshua Belhumeur
Tapitag The Future of Smart Networking with Digital & Review NFC Cards!
Tapitag  The Future of Smart Networking with Digital & Review NFC Cards!Tapitag  The Future of Smart Networking with Digital & Review NFC Cards!
Tapitag The Future of Smart Networking with Digital & Review NFC Cards!
Tapitag
Top Electronic and Electrical Components Manufacturers and Suppliers in India
Top Electronic and Electrical Components Manufacturers and Suppliers in IndiaTop Electronic and Electrical Components Manufacturers and Suppliers in India
Top Electronic and Electrical Components Manufacturers and Suppliers in India
workmintmedia
From Feed to Stories to Reels How Instagram Drives Event Success
From Feed to Stories to Reels How Instagram Drives Event SuccessFrom Feed to Stories to Reels How Instagram Drives Event Success
From Feed to Stories to Reels How Instagram Drives Event Success
LuanWise
How to Increase Online Sales with a Well-Designed E-commerce Site: A Strategi...
How to Increase Online Sales with a Well-Designed E-commerce Site: A Strategi...How to Increase Online Sales with a Well-Designed E-commerce Site: A Strategi...
How to Increase Online Sales with a Well-Designed E-commerce Site: A Strategi...
AceOneMaster
The Power of Digital Marketing: How to Grow Your Business Online
The Power of Digital Marketing: How to Grow Your Business OnlineThe Power of Digital Marketing: How to Grow Your Business Online
The Power of Digital Marketing: How to Grow Your Business Online
sreemanreddymallu07
Snapshot of Consumer Behaviors of January 2025-EOLiSurvey (EN).pdf
Snapshot of Consumer Behaviors of January 2025-EOLiSurvey (EN).pdfSnapshot of Consumer Behaviors of January 2025-EOLiSurvey (EN).pdf
Snapshot of Consumer Behaviors of January 2025-EOLiSurvey (EN).pdf
Eastern Online-iSURVEY
How Does a Digital Marketing & Advertising Agency Create Engaging Content.pdf
How Does a Digital Marketing & Advertising Agency Create Engaging Content.pdfHow Does a Digital Marketing & Advertising Agency Create Engaging Content.pdf
How Does a Digital Marketing & Advertising Agency Create Engaging Content.pdf
Whiz Marketers
THE GROWING TRENDS OF WEDDING PLANNERS IN KERALA.pdf
THE GROWING TRENDS OF WEDDING PLANNERS IN KERALA.pdfTHE GROWING TRENDS OF WEDDING PLANNERS IN KERALA.pdf
THE GROWING TRENDS OF WEDDING PLANNERS IN KERALA.pdf
rameesroshan789
Adventure 2025-Decor-Book - 2.10.25-1.pdf
Adventure 2025-Decor-Book - 2.10.25-1.pdfAdventure 2025-Decor-Book - 2.10.25-1.pdf
Adventure 2025-Decor-Book - 2.10.25-1.pdf
JimWilliams206540
LABUAN4D EXCLUSIVE SERVER STAR GAMING ASIA NO.1 TERPOPULER DI INDONESIA !!! R...
LABUAN4D EXCLUSIVE SERVER STAR GAMING ASIA NO.1 TERPOPULER DI INDONESIA !!! R...LABUAN4D EXCLUSIVE SERVER STAR GAMING ASIA NO.1 TERPOPULER DI INDONESIA !!! R...
LABUAN4D EXCLUSIVE SERVER STAR GAMING ASIA NO.1 TERPOPULER DI INDONESIA !!! R...
alexiskandar061
Find Top 7 Keyword Tricks to Improve SEO
Find Top 7 Keyword Tricks to Improve SEOFind Top 7 Keyword Tricks to Improve SEO
Find Top 7 Keyword Tricks to Improve SEO
Neuvo WebTech
Restaurant marketing ideas and strategies
Restaurant marketing ideas and strategiesRestaurant marketing ideas and strategies
Restaurant marketing ideas and strategies
Rohit Singh
Digital-Marketing-for-Pediatricians-A-Modern-Approach.pptx (3).pdf
Digital-Marketing-for-Pediatricians-A-Modern-Approach.pptx (3).pdfDigital-Marketing-for-Pediatricians-A-Modern-Approach.pptx (3).pdf
Digital-Marketing-for-Pediatricians-A-Modern-Approach.pptx (3).pdf
Med shouter
The Study of Consumer Perception and its intention towards Weekend Street
The Study of Consumer Perception and its intention towards Weekend StreetThe Study of Consumer Perception and its intention towards Weekend Street
The Study of Consumer Perception and its intention towards Weekend Street
ChampionPukhrambam
02.2025_Nordics MUG - Magnity x Grundfos (2).pptx
02.2025_Nordics MUG - Magnity x Grundfos (2).pptx02.2025_Nordics MUG - Magnity x Grundfos (2).pptx
02.2025_Nordics MUG - Magnity x Grundfos (2).pptx
MichaelKnudsen27
How to make engaging explainer videos by B2W
How to make engaging explainer videos by B2WHow to make engaging explainer videos by B2W
How to make engaging explainer videos by B2W
marketingb2wtv
Biography of David Kircus
Biography of David KircusBiography of David Kircus
Biography of David Kircus
David Kircus
Purchase an Old GitHub Account-100% Secure Guarantee
Purchase an Old GitHub Account-100% Secure GuaranteePurchase an Old GitHub Account-100% Secure Guarantee
Purchase an Old GitHub Account-100% Secure Guarantee
GitHub
Buy Followers on Instagram in viewtifulday
Buy Followers on Instagram in viewtifuldayBuy Followers on Instagram in viewtifulday
Buy Followers on Instagram in viewtifulday
vairam13
Anatomy of a Brand, a framework for branding projects by BRINK
Anatomy of a Brand, a framework for branding projects by BRINKAnatomy of a Brand, a framework for branding projects by BRINK
Anatomy of a Brand, a framework for branding projects by BRINK
Joshua Belhumeur
Tapitag The Future of Smart Networking with Digital & Review NFC Cards!
Tapitag  The Future of Smart Networking with Digital & Review NFC Cards!Tapitag  The Future of Smart Networking with Digital & Review NFC Cards!
Tapitag The Future of Smart Networking with Digital & Review NFC Cards!
Tapitag
Top Electronic and Electrical Components Manufacturers and Suppliers in India
Top Electronic and Electrical Components Manufacturers and Suppliers in IndiaTop Electronic and Electrical Components Manufacturers and Suppliers in India
Top Electronic and Electrical Components Manufacturers and Suppliers in India
workmintmedia
From Feed to Stories to Reels How Instagram Drives Event Success
From Feed to Stories to Reels How Instagram Drives Event SuccessFrom Feed to Stories to Reels How Instagram Drives Event Success
From Feed to Stories to Reels How Instagram Drives Event Success
LuanWise
How to Increase Online Sales with a Well-Designed E-commerce Site: A Strategi...
How to Increase Online Sales with a Well-Designed E-commerce Site: A Strategi...How to Increase Online Sales with a Well-Designed E-commerce Site: A Strategi...
How to Increase Online Sales with a Well-Designed E-commerce Site: A Strategi...
AceOneMaster
The Power of Digital Marketing: How to Grow Your Business Online
The Power of Digital Marketing: How to Grow Your Business OnlineThe Power of Digital Marketing: How to Grow Your Business Online
The Power of Digital Marketing: How to Grow Your Business Online
sreemanreddymallu07
Snapshot of Consumer Behaviors of January 2025-EOLiSurvey (EN).pdf
Snapshot of Consumer Behaviors of January 2025-EOLiSurvey (EN).pdfSnapshot of Consumer Behaviors of January 2025-EOLiSurvey (EN).pdf
Snapshot of Consumer Behaviors of January 2025-EOLiSurvey (EN).pdf
Eastern Online-iSURVEY
How Does a Digital Marketing & Advertising Agency Create Engaging Content.pdf
How Does a Digital Marketing & Advertising Agency Create Engaging Content.pdfHow Does a Digital Marketing & Advertising Agency Create Engaging Content.pdf
How Does a Digital Marketing & Advertising Agency Create Engaging Content.pdf
Whiz Marketers
THE GROWING TRENDS OF WEDDING PLANNERS IN KERALA.pdf
THE GROWING TRENDS OF WEDDING PLANNERS IN KERALA.pdfTHE GROWING TRENDS OF WEDDING PLANNERS IN KERALA.pdf
THE GROWING TRENDS OF WEDDING PLANNERS IN KERALA.pdf
rameesroshan789
Adventure 2025-Decor-Book - 2.10.25-1.pdf
Adventure 2025-Decor-Book - 2.10.25-1.pdfAdventure 2025-Decor-Book - 2.10.25-1.pdf
Adventure 2025-Decor-Book - 2.10.25-1.pdf
JimWilliams206540
LABUAN4D EXCLUSIVE SERVER STAR GAMING ASIA NO.1 TERPOPULER DI INDONESIA !!! R...
LABUAN4D EXCLUSIVE SERVER STAR GAMING ASIA NO.1 TERPOPULER DI INDONESIA !!! R...LABUAN4D EXCLUSIVE SERVER STAR GAMING ASIA NO.1 TERPOPULER DI INDONESIA !!! R...
LABUAN4D EXCLUSIVE SERVER STAR GAMING ASIA NO.1 TERPOPULER DI INDONESIA !!! R...
alexiskandar061
Find Top 7 Keyword Tricks to Improve SEO
Find Top 7 Keyword Tricks to Improve SEOFind Top 7 Keyword Tricks to Improve SEO
Find Top 7 Keyword Tricks to Improve SEO
Neuvo WebTech
Restaurant marketing ideas and strategies
Restaurant marketing ideas and strategiesRestaurant marketing ideas and strategies
Restaurant marketing ideas and strategies
Rohit Singh
Digital-Marketing-for-Pediatricians-A-Modern-Approach.pptx (3).pdf
Digital-Marketing-for-Pediatricians-A-Modern-Approach.pptx (3).pdfDigital-Marketing-for-Pediatricians-A-Modern-Approach.pptx (3).pdf
Digital-Marketing-for-Pediatricians-A-Modern-Approach.pptx (3).pdf
Med shouter
The Study of Consumer Perception and its intention towards Weekend Street
The Study of Consumer Perception and its intention towards Weekend StreetThe Study of Consumer Perception and its intention towards Weekend Street
The Study of Consumer Perception and its intention towards Weekend Street
ChampionPukhrambam
02.2025_Nordics MUG - Magnity x Grundfos (2).pptx
02.2025_Nordics MUG - Magnity x Grundfos (2).pptx02.2025_Nordics MUG - Magnity x Grundfos (2).pptx
02.2025_Nordics MUG - Magnity x Grundfos (2).pptx
MichaelKnudsen27
How to make engaging explainer videos by B2W
How to make engaging explainer videos by B2WHow to make engaging explainer videos by B2W
How to make engaging explainer videos by B2W
marketingb2wtv
Biography of David Kircus
Biography of David KircusBiography of David Kircus
Biography of David Kircus
David Kircus
Purchase an Old GitHub Account-100% Secure Guarantee
Purchase an Old GitHub Account-100% Secure GuaranteePurchase an Old GitHub Account-100% Secure Guarantee
Purchase an Old GitHub Account-100% Secure Guarantee
GitHub

The thieves

  • 2. Catch your Advertising Money Thieves Is someone stealing your advertising money? Who or what is producing invalid traffic at your cost? You want to get alerted when suspicious traffic kicks in (Fraud)? You want a clean and accurate basis for your Marketing Analytics without fraud traffic?
  • 3. Best possible Source for DATA = Logs Best possible Analytics Engine =
  • 4. Before we start some good to know The data we are talking about does not live long (GDPR compliance). IP Address processing is necessary for the purposes of the legitimate interests pursued by the controller - Security and Fraud detection are two legitimate interests. You need to understand what can appear as direct campaign traffic means. Learn about it here: https://www.youtube.com/watch?v=8oGlkqq_0Ao Be very careful with your analysis and ask a security specialist for a second opinion before you report your findings. Expect Fraud everywhere but also be aware that some users show strange click flows. Read this: https://www.wfanet.org/adfraud
  • 5. Prerequiste: Get the Logs into New Relic Define New Relic the endpoint of your Logs in your CDN or from your servers (in case no CDN is used) Check if logs arrive (Example for Fastly) (Logs arrived in New Relic)
  • 6. Make sense of the of the data Focus for this use case only on traffic coming from your paid campaigns (Paid Search, Paid Social etc.) Most thieves hide themselves by using sophisticated scripts run on a variety of servers. Expect to see one thieve use multiple IP addresses. A good starting point is to count the calls of UTM Campaign traffic and separate it by IP address. Select count(client_ip) as 'Requests' from Log where request_user_agent not like '%bot%' and request_query_string like '%utm_campaign%' and request_referer not like '%yourdomain.%' facet client_ip limit 50 since 1 day ago xxx.xx.xx.xx xxx.xx.xx.xx xxx.xx.xx.xx xxx.xx.xx.xx
  • 7. Narrow down to get more intelligence Ask Questions What campaigns are affected? Is this real fraud? xxx.xx.xx.xx xxx.xx.xx.xx xxx.xx.xx.xx xxx.xx.xx.xx Click to filter Campaigns Called Red Flag Cost per Click Campaign
  • 8. Is the specific IP address known as Fraud? Various platforms provide databases of known fraud traffic Ips Example: https://scamalytics.com/ Confirms my assumption: Most likely fraud !
  • 9. Further Analysis Check the log entry further for Is a referral present? Is a gclid present? (you might need it for reporting it to google) Is anything else looking suspicious? A starred as request languagesuspicious Export gclid directly from New Relic
  • 10. Create an outlier alert to get notified!
  • 11. Automate Fraud detection Implement a script using the NR APIs to get the list of possible fraud Ips Query the https://scamalytics.com/ API and send the results (as custom events) into New Relic using the ingestion API. Now you can query the data easily and get alerted on high fraud traffic based on public available data
  • 12. Fraud Scoring in New Relic
  • 13. Report identified Thieves https://support.google.com/googleads/troubleshooter/2557048?rd=1 Make sure the ALL the data requested by Google. The better you report the faster Google can react and probably refund you. All requested data should be available in your logs.