Detecting Fake Traffic

Check if the traffic is hitting one page on the site only, or a narrow subset of pages. Additionally, some of these tools send traffic from one geolocation only, and you might even notice all at a particular time of day.

Hope that helps.

If it's all coming from 1 IP that's a good indicator. If you could make the software use multiple IPs, visit different time lengths for a few minutes in multiple threads though... we'd all be fooled until we noticed no purchases or ad clicks... could it click on ads too?

Nothing ridiculous... 3% of the time?


justathought

As the site owner, if you keep an eye on your stats (especially with something that shows real-time activity per user, rather than just aggregated info), you can probably spot fake traffic. There are lots of signs to look for:

(a) Look for spikes in traffic to the site or to specific entry pages

(b) Check the IP addresses of the visitors during the spike; unless someone is expending considerable resources renting botnets, it's probably all coming from IP space of commercial data centers (i.e. server/hosting companies) rather than residential modems.

(c) Check the user agents of the visitors; are they your site's usual demographic? Going from mostly bleeding-edge Chrome/Firefox to getting hundreds of visits from agents claiming to be IE7 would be suspicious.

(d) Do the visits show up in all your trackers? Just the access log based ones or the JavaScript based ones too?

(e) Do the visits consist of single page hits or are they viewing multiple pages? All the same pages with the same time between views?

...etc. But if you're not the site owner, you probably can't see any of this. If you're interested in buying a site, get a written contract, deal with someone in the same country as you, and check out their reputation/history, because you're really just going to have to take their word for it -- they can cheat you and you can't really prove it until you get the site.

If you're interested in advertising on a specific website, make the minimum spend you can negotiate for a test run and evaluate the ROI. All that matters to you as an advertiser is whether you earn more than you spent on the ad. If they want to claim they are showing your banner twice as often as they really are, it doesn't really matter -- either that many views produced a positive ROI or it didn't.

PPC is the only place where you have to worry about fraud as an advertiser. Luckily Google is damned good at identifying fraud -- even from botnets of real browsers -- perpetrated against its advertisers. It takes quite a few clicks to bring up the "dimensions" report for "invalid clicks", but most advertisers would be surprised to see how many ad clicks they received but were charged $0 for by Google. The rest of the search engines... not quite so good, so 3rd party auditing is your best bet. Identify repeat clicks and other suspicious patterns, ban the IPs from seeing your ads in the future, and request refunds for those clicks.

What are the tools you use to detect fake traffic?

Always get historical data.

If they're up to no good, chances are they've only been doing it just before the sale in an effort to inflate statistical data.

Always insist on analytics and ask for a login, not just screenshots. Alexa rating can be spoofed, but even that is helpful together with analytics. Alexa would give you some idea about the referers, keywords used in search etc and check it with analytics.

While checking analytics, verify the ip addresses as well as traffic sources. For the major sources of traffic, verify that the referer / search keyword given actually links to the site and link is present.

Does fake traffic get good SEM Rush rank? If not then you can detect fake traffic by checking the SEM Rush rank.

Check geo data and IP address data. Unique traffic is key... although with access to a bot net, different IPs is possible.

Secondly, check for java-script. This is most likely what the scammer was referring to (either intentionally or not) when he said "show up in Analytics.

I can run wget/lynx thousands of times on VPS machines but it wont execute the javascript. You need a browser that will actively view the page and execute the javascript (hence counting the data on Analytics).

fake traffic will only hit one page, thats one of the way to tell if traffic is fake.