How to Tell if Paid Traffic is Real or Fake Bot Visitors
ContentPowered.com
Any time you buy traffic from any source, you want to know whether or not it’s real traffic. This holds true whether you’re buying bundles of viewers from Fiverr, buying from a reputable third party source, or buying from an ad network. Even Google and Facebook will serve you some fake traffic, since it’s impossible to weed out completely. You just need to know if the majority is real or fake.
The key to identifying bot traffic is monitoring patterns. Bots are robots, they’re software, so they have a hard time mimicking human behavior. Oh, sophisticated bots are perfectly capable of fooling the average scanner, but the vast majority of bots you’re getting when you buy traffic are much, much more simple.
Bots will generally come in three varieties when you’re buying traffic.
- Simple hit bots. These are pieces of software that spoof a user agent and load a page, and that’s it.
- Complex hit bots. These are the same as the above, except they have some more sophisticated mechanics like waiting random amounts of time, clicking links, scrolling around, and generally acting a little more human.
- Screen recording playbacks. These are bots where a human performs a sequence of actions and the software plays them back, often hundreds of times with variations of IP address and user agent.
Thankfully, you can generally detect all of these based on patterns. They’ll operate in identical ways, or in mostly-identical ways within set parameters, so it won’t be too difficult to identify them. Here are a bunch of ways you can find them.
Heatmap Monitoring
Most of the methods below are going to use your basic Google Analytics to give you an idea of what’s going on with your site traffic. This one, however, will require that you obtain an additional piece of software. Specifically, you’re looking for a heatmap. Heatmaps are pretty useful for marketing in general, and for user experience optimization, because they tell you what your visitors are doing when they’re on your site. They can show you if the user scrolls and how much time they spend viewing portions of your site, they can track the position of the mouse and the location of clicks, and they can identify both holes in your site design and missed opportunities. We wrote a guide to heatmaps over here.
With a heatmap, you can monitor the stretch of time where any visitors you buy are supposed to be arriving. You can see specifically what sort of actions those visitors are taking. Normal users will scroll up and down your page, they will move their mouse around over UI elements and across text as they read, and they will click buttons. They will click everything from your images to your text to your ads and more. The patterns they make will show you a shape based on the design of your site, like the blog-reader F or the graphic design V. Bots, however, won’t have typical browsing or interaction patterns. They don’t have a cursor as such, so when they click it will be a single precise click on an element, if they click at all.
If you get a thousand visitors and the heatmap only shows the interactions of a few dozen, you know that the majority of the traffic you got was not organic. If the heatmap is showing extremely concentrated interactions in one specific place, you can guess that the bots were using screen recording to follow one human’s actions. If you don’t get any interaction at all, you can bet that the visitors weren’t real.
Source Categorization
This next one you will need to dig into your Google Analytics for. You’re looking for the sources of the traffic coming in to your site. Some patterns might be indicative of some variety of viewer fraud, though different patterns can indicate different things.
For example, if you buy a package of a thousand views and they all come from, say, Bangladesh, you can be pretty certain that the person you paid for those views just went to a click farm in Bangladesh and paid people to visit your site. These click farms are most prevalent with Facebook ads, and they generally result in fake followers as well as fake views. They’re also real people, so they’ll have less regular habits, but they don’t take much care to disguise themselves beyond cloaking their profiles.
Any other tight geographic location can indicate using localized proxies or a small proxy list for view botting. If you’re expecting to buy traffic from anywhere in the USA, and you find that all of your traffic is coming from Georgia, it’s probably a list of rotating proxies in Georgia being utilized by someone elsewhere. Of course, it could just be the person you bought views from lives in Georgia and has a local botnet or access to a computer network nearby.
You can view this kind of information by looking into IP address and geographic location information of the users visiting your site. You’ll be able to compare the new surge of traffic with older traffic patterns to determine how out of the norm the traffic is, and figure out if it’s all coming from an unusually tight area.
Browsing Behavior
Bots generally don’t do anything more than the absolute minimum. The less they have to do, they more times they can do it, and the more they can cycle without being interrupted. This allows sellers to sell more views in a shorter amount of time, thus earning them more money. You know, for a certain weak definition of “earn.”
One of the key indicators will actually be bounce rate. The absolute cheapest traffic you can buy is generally going to be bots with one single hit to your site. They load the page, they leave, they change their user information in some way so as to be recorded as unique view, then they repeat the process. They’ll load your homepage or your landing page or your blog post, whatever page it was you’re buying traffic for, and that’s it. They won’t refresh, they won’t check out another page, they won’t scroll down, they won’t do anything.
Since this shows up as a bounce in your analytics, it’s easy to identify them as bots. As such, the next tier of bots will often pick a semi-random link on your page to click next. Some may do it instantly, while others will do it after a predetermined pause. You will generally see a spike in activity after a fixed amount of time, generally a couple of seconds, as opposed to the usual distribution you’d get from organic visitors. They will also disappear after clicking that link, effectively bouncing one page later. The only reason they do this is to avoid actually showing up as a bounce, which makes it slightly harder to detect them.
Is it Possible to Make Money by Buying Traffic? Follow this chain of thought for a…
Again, you’re generally going to be looking for unusual spikes in your behaviors, and a change from before and after you purchased your views. There’s always going to be some difference between your organic traffic and your paid traffic, since they come from different sources, but there’s always going to be a natural distribution of actions amongst real users, as opposed to what you get from bots.
Numerical Regularity
Early on in the days of bot traffic generation, the hits you purchased would be delivered as quickly as possible. Essentially, it was the fire-and-forget method of traffic delivery. The bot seller would just dump views on you to finish the contract and move on to another. They hoped the spike in traffic would entice you to keep buying so they could keep delivering, or else the drop after would do it. In either case, the bots would arrive very quickly and would be easily identified as bots because of it. After all, humans have schedules and there’s no way to guarantee a massive short-lived delivery of traffic like that.
Eventually this was caught as a bot signal and so the arms race began. Obviously, sellers don’t want to be labeled as botters even if they are, it limits their ability to sell. They started breaking up the traffic they deliver into smaller segments. However, they’re still generally lazy about it, so you’ll do something like buy 10,000 views and get exactly 1,000 per hour for 10 hours. The extreme regularity – with the slight variation added by your organic traffic – is another sign that the traffic comes from bots.
Essentially, you will be able to see the chart of your organic traffic and add a specific number to it at all times of day to get what you see. Bots aren’t generally smart enough to follow typical traffic distribution patterns, so it becomes quite obvious to see.
You will also notice immediate start and stop times, with little or no spooling up. This is indicative of any paid traffic source, except with most paid sources it takes a bit of time to start up. You’ll see steep starts and stops when a bot presses a button.
Site Engagement
One of the most interesting ways of detecting bots has come about in recent years, and involves the various meta-elements and site extensions commonly seen on most sites these days. I’m talking about things like live chat and, especially, timed pop-overs.
Bots in general aren’t going to interact with any of these kinds of scripts. Many bots, in fact, simply have scripts disabled or are not running in an environment where they’ll even load. A browser with NoScript turned on high or with JavaScript disabled would show you an idea of what they see. Real people, by contrast, will interact with them. If you have a little live chat widget pop up, people are going to click on it. Some will click to hide it, others will click to chat, and either way it records some engagement. Bots in general are going to completely ignore it. So if you buy 10,000 views and get 0 more clicks on your live chat than normal, you can assume the traffic was fake.
Delayed pop-overs are excellent for this as well. They’ll generally still load on most sites, but bots won’t recognize it when it happens. They pause for a moment to look more realistic, then click on an element on your site… but they can’t, because there’s a pop-over on top of it they would need to close first.
Some bots won’t load the pop-over and again you have the complete lack of interaction with it to identify the bots as bots. It depends on how much content the bot loads, really.
Bot Traps
Have you ever visited Forbes? If so, you probably know all about their welcome screen. The welcome screen is a multi-function page that loads on the first visit each day, and is a way for Forbes to recommend some content, show some ads, filter out people using ad blockers, and also trap bots.
The way this page traps bots is because it loads and requires an interaction in order to proceed. If scripts are blocked, that interaction either doesn’t trigger or doesn’t appear, so bots that don’t load scripts are trapped. Bots that only load the first page and don’t interact beyond that are also trapped; they never see the content. Bots that follow a user’s actions will have to proceed, but will have very regular actions and won’t always work properly, and will be easy to filter.
The end result is that Forbes doesn’t have to worry about bot traffic flooding their pages because it’s all trapped by the welcome page.
You can consider setting up the same kind of “welcome page” to your site to trap bots, but you’ll want to be careful. Interstitials like that can cause issues with actual customer retention. Make sure to test on a small scale to make sure that it both successfully traps bots, and that it doesn’t drive away your real customers.
Written by James Parsons
