In August I reported a startling number of notorious spyware programs receiving payments, directly or indirectly, from Yahoo!'s pay-per-click (PPC) (Overture) search system. Yahoo pays numerous other companies to show these ads via syndication relationships. So when a spyware vendor can't find advertisers to buy its ad inventory directly, the spyware vendor can show Yahoo ads instead. Every time a user clicks on such an ad, the advertiser must pay Yahoo. Then Yahoo pays a revenue share to the spyware vendor that showed the ad. My August article documented relationships between Yahoo and 180solutions, Claria, Direct Revenue, eXact Advertising, IBIS, and SideFind.
My August article covered "just a few of the ... examples I have observed and recorded." Since then, my Yahoo-spyware collection has grown dramatically. I now have many dozens of different examples of Yahoo pay-per-click ads shown within spyware.
My August examples demonstrate what I call "syndication fraud" -- Yahoo placing advertisers' ads into spyware programs, and charging advertisers for resulting clicks. But Yahoo's spyware problems extend beyond improper syndication. In my August syndication fraud examples, an advertiser only pays Yahoo if a user clicks the advertiser's ad. Not so for three of today's examples. Here, spyware completely fakes a click -- causing Yahoo to charge an advertiser a "pay-per-click" fee, even though no user actually clicked on any pay-per-click link. This is "click fraud."
This document offer four fully-documented examples of improper ad displays (1, 2, 3, 4), including three separate examples showing click fraud. I then develop a taxonomy of the problem and suggest strategies for improvement.
The Pay-Per-Click Promise; The Click Fraud Threat
When advertisers buy pay-per-click advertising, they largely expect and intend to buy search engine advertising. If a user goes to Yahoo and types a search term, interested advertisers want their ads to be shown. Ads are supposed to be carefully targeted, i.e. to the specific keywords advertisers specify. And an advertiser is only supposed to pay Yahoo when a user actually clicks the advertiser's ad.
Click fraud attacks these promises. In canonical click fraud, one advertiser repeatedly clicks a competitor's ads -- or hires others to do so, or builds a robot to do so. Deplete a competitor's budget, and he'll leave the advertisement auction. Then the first advertiser can win the advertising auction with a lower bid.
Advertisement syndication also creates a risk of click fraud. Suppose Yahoo contracts with some site X to show Yahoo's ads. If a user clicks a Yahoo ad at X, Yahoo commits to pay X (say) half the advertiser's payment to Yahoo. Then X has an incentive to click the Yahoo ads on its site -- or to hire others to do so, or to build robots to do so.
Spyware syndication falls within the general problem of syndication-based click fraud. Suppose X, the Yahoo partner site, hires a spyware vendor to send users to its site and to make it appear as if those users clicked X's Yahoo ads. Then advertisers will pay Yahoo, and Yahoo will pay X, even though users never actually clicked the ads.
The following three examples show specific instances of spyware-syndicated PPC click fraud. In each example, I present video, screenshot, and packet log proof of how spyware vendors and advertisement syndicators defraud Yahoo's advertisers.
