I found over 500 IPs that might be part of click bombing network

Forum Moderators: martinibuster

Message Too Old, No Replies

I found over 500 IPs that might be part of click bombing network

were you hit by same IPs?

adrianTNT

9:28 pm on Feb 2, 2020 (gmt 0)

I noticed my sites being hit by many strange bots, even 100-200 at the same time on site, I am 90% these are bots that do click bombing, it matches the time when my AdSense account is going nuts (low cpc, earnings rollback, etc).
And by their behaviors and parameters, I am 100% sure all ~500 IPS are part of the same group.

I was able to identify them by certain parameters but if I post the list publicly, I am afraid that they will notice and they might make some changes so they cannot be identified in the future.

If anyone is interested, please send me a private message so I would reply with the list of IPs,I am curious if others can find same IPs in their logs and if your adsense account acts strangely (low CPC and so).

not2easy

9:57 pm on Feb 2, 2020 (gmt 0)

Those 500 IPs may all be coming from one CIDR. Do a whois lookup and then check our Search Engine Spider and User Agent Identification Forum: [webmasterworld.com...]

That is where bots and blocking are discussed.

adrianTNT

10:09 pm on Feb 2, 2020 (gmt 0)

They are not from same network, they are all spread across small hosting providers / data centers. I am sure they are not VPNs eider.
I posted here because I am almost certain it is related to AdSense click bombing.

tangor

6:03 am on Feb 3, 2020 (gmt 0)

One still needs to address the bots, either by ua or ip ... doing nothing is not a way to success. :)

Meanwhile, do a little research on the spider forum ... likely these have been previously identified.

Reactive is better than nothing. Proactive is better than Reactive.

lucy24

5:05 pm on Feb 3, 2020 (gmt 0)

I am sometimes obliged to block individual aa.bb.cc.dd IP addresses when some human has been hacked, resulting in robotic visits from something that is indistinguishable from a human. But check back every month or so to see if the IP is still active. Not only so you don't inadvertently block a well-meaning human (like that nice guy who just moved in across the street, little suspecting his address was previously a notorious crack house), but because everything you do makes work for the server.

But first check whether they have some other feature in common. Current robots seem to home in on some exact humanoid UA and use it for months on end.

adrianTNT

5:19 pm on Feb 3, 2020 (gmt 0)

I found many similarities in order to identify them, but I am curious if others get hit by same IPs, if anyone else wants to check, send me a PM please.

// I always knew humans will end up fighting robots, but this is NOT what I had in mind :)

not2easy

6:07 pm on Feb 3, 2020 (gmt 0)

If you do not wish to share your list in the Search Engine Spider and User Agent Identification Forum, you could go there and check to see what others have found that may be on your own list. That's the point of forums: sharing helpful information.

This is list of bots blocked by AdSense users in the past - many are still server farms:
[webmasterworld.com...]

BUT you should never use a list shared anywhere without checking to be certain of what/whom you may be blocking. Especially if your access logs show human-like behavior because they may be coming from unsuspecting residential users whose machines can be compromised without their knowledge. The bot-nets move around and may use any given IP for only a few days. Blocking ISP IPs can make a lot of people unhappy with your site. This is another reason not to keep a list private. Input helps.