You are using an outdated browser. Please upgrade your browser to improve your experience and security.

Clickbombing And Click Fraud

Justin Cooke Updated on February 29, 2020

Clickbombing And Click Fraud

We see changes made to the earnings in our AdSense account on a regular basis.  Sometimes it comes in the form of an adjustment while they’re trying to finalize our earnings for the previous month, but it also happens much more frequently than that.

There have been days where I’ve refreshed the page only to see that our earnings have actually gone down in the last hour and not up.  Sometimes I’ll see that a site had 10 clicks averaging $0.45 per click only to get discounted to $0.20 per click a few minutes later.  We’ve even seen sites with 2 pageviews and 9 clicks, only to see later in the day that those clicks mysteriously vanished.

So…what gives?

Google has a responsibility to protect their advertisers from clicks that aren’t likely to convert.  While this may cause some AdSense publishers to moan and groan, it actually helps us to maintain a positive, profitable relationship with the advertisers…which is good for everyone.

Reasons For Discounted Or Removed Clicks

  1. Potential Customer Backs Out Quickly – If they click through the advertisement and back out before the page has even loaded, that’s probably not the best potential customer for an advertiser and they probably shouldn’t be charged for that lead.
  2. Unusual Amount Of Clicks From Potential Customers – You may have a visitor looking to get off the site that ends up clicking here there and everywhere to exit the site.  If this person has an extraordinarily high amount of clicks for that visit, you may find the earnings discounted or the clicks removed completely.
  3. Automated Clicks – It could be some sketchy traffic play the publisher is using or it could be (innocently) some automated crawl bot that’s clicking on the ads.  Either way, you’ll want Google to discount these clicks as they’re not really valuable to anyone.
  4. Clickbombing – A manual or automated process that will go to your site and click through your advertisements at an extremely high rate.  This can be through the use of software, proxies, etc. or manually from a group of others looking to cause you harm.

#1 and #2 above happen on a regular basis and is usually the cause for fluctuation in our earnings, but it’s #3 and #4 that you should be concerned about as publishers.  While there are some AdSense alternatives, protecting your account should be a priority for AdSense publishers and recognizing a clickbomb attack as it’s happening is one of the ways to do that.

Checking For Clickbombing

The other day, Joe and I both noticed an extraordinary amount of traffic heading towards one of our sites. The first thing we did was take a quick look inside Analytics:

clickbombed niche site analytics 1

Wow!  Here’s a look at the AdSense earnings that day:

clickbombed niche site adsense 1

Not bad, right?  The problem is this…that kind of traffic and earnings is extraordinary for this site…well outside the range of what we would consider normal.  We’ve had something happen like this to some friends of ours.  Here’s what their Analytics looked like:

MJ overall analytics

Uh-oh…not good, right?  Next step is to do some deep diving on our traffic sources.  Here’s a side-by-side comparison between their site that was truly clickbombed (left) and ours (right):

Our clickbombed site traffic sourcesMJ clickbombed site traffic sources







Well that’s a good sign for us…most of our traffic is organic and came through search while the other site had 99% of their traffic hit the site directly.  The next step is to take a look at the search terms that are bringing in the traffic:

Clickbombed site keywords

Great.  So it appears that a huge majority of our traffic to this niche site came from the primary keyword, with some variations and secondaries as well.  That’s a good sign, but is it reasonable I ended up checking the rankings for this site for the primary keyword and it appears it made it to the #1 position on Google Awesome!  As a final check, though, I wanted to see exactly where the traffic to this site is coming from in Google Analytics.  Let’s again compare a site that was truly clickbombed (left) to ours (right):

MJ country analyticsCountry analytics







The site that was clickbombed had a ton of traffic from Russia, Brazil, Columbia, etc.  That’s a sign that the system doing the clickbombing was using proxies and varying their IP’s to come from different countries.  As a final check, I wanted to see what states our traffic was coming from:

State Analytics

The traffic to our site looks pretty typical…sweet!  Ultimately, we determined our site was not dealing with a clickbomb attack.  Our CTR was high for the site, but in line with some of our better performing sites.  Our best guess was that there was some sort of advertising campaign on Labor Day that might have drawn a ton of people to search for that particular item and find our site in the #1 position.  We’re not entirely sure, but that seems like a fairly plausible answer.

5 Signs You May Have Been Clickbombed

  1. Extraordinary Amount Of Traffic – If your site has jumped from 20 visitors per day to 2,000 in one day that might be a sign you’re getting clickbombed.  The best thing to do is to dig into your analytics and try to find a reasonable answer as to why you’re getting the traffic.  (Did a high-traffic site just link to you?  Was your site mentioned in the press?  Did your site just significantly improve in the rankings?)
  2. Extremely High CTR – If an extraordinary amount of your traffic is clicking on your ads that may be a sign you’re under attack.  Not every visitor to your site is going to be interested in the advertisements on the page…did that just change dramatically?
  3. Traffic From Random Countries – If most of your traffic is coming from the US and then, all of the sudden, you see a huge spike in traffic overall and traffic from other countries, that’s a likely sign that an automated program is using proxies to access your site.
  4. Extremely Short Visit Duration – Niche sites don’t usually have a very long visit duration, but did that just drop to under 10 seconds with thousands of visitors?  Are most of those visitors clicking on your advertisements?  That’s not a good sign…
  5. More Clicks Than Pageviews – Google usually detects this and discounts it automatically.  You may find this if you have an upset competitor looking to get you in trouble.

Download your free report

How To Respond To A Clickbombing Attack

I wouldn’t recommend taking these steps for every little odd click you get in your account, but if you find yourself the victim of a major clickbombing attack, here’s what we would recommend:

  • Block Ads On The Site – AdSense has a feature that lets you choose which sites are allowed to display your AdSense advertisements.  By changing this to NOT allow the site under attack to display advertisements this will protect the site.  (We’d recommend this over trying to block IP’s…if they’re using proxies they can simply overwhelm you with new IP’s over and over again)  You can find this under Account Settings > Access and Authorization in your AdSense account.
  • Report Attack To Google – Google’s pretty good at catching a few mistaken clicks here and there, but a larger attack should be reported.  You can use the contact form found here.
  • Check And Report On The AdSense Forum – You can read about the experiences of others or post your own question and ask for help from some of the Top Contributors.

There’s no guarantee going through this process will save your account, but it will show that you were pro-active about protecting your advertisers from fraudulent clicks.

Thanks goes out to our friends John Paul and Matt from for allowing us to highlight their data from the clickbombing attack in this post.

Have you been a victim of clickbombing?  What would you do if this were to happen to you?  Let us know in the comments below!

Make a living buying and selling websites

Sign up now to get our best tips, strategies, and case studies


  • hammed says:

    seems like sometimes, despite the number of pageviews, I dont get paid at all ($0.00).
    It use to be like there was payment for impressions before but doesnt apple as such anymore.
    .I dont know if there is a plugin or something to prevent that on blogspot..thanks

  • Darren Boland says:

    Hey guys, I was click bombed about 4 weeks ago just on one site. Now It seem to be happening on another 3 sites. I ran Statpress analysed the IP address, and found the same IP appearing across the 3 sites. I reported them to Google, and I just pulled the Adsense of the sites completely and replaced them with banner ads.
    What a pain in the butt…

    • Justin Cooke says:

      Sucks, Darren…sorry to hear that.

      Have you shared/released those sites publicly anywhere? Anyone you know that might be trying to sabotage you? Generally, there’s no reason for someone to randomly target you for clickbombing. They either think they’re trying to help you (By having you earn more money) or hurt you (Knowing it could hurt your AdSense account)

      • Darren Boland says:

        Hey Justin,

        No, I am super careful now with sharing websites with friends or family. I am guessing its the second option someone out to do bad things. I used your advice from above and reported it to Google straight away, and although I lost what ever money the clicks had earned, it saved my account. so that’s great. I think I will also start to make my sites domains private,and change host providers.. so nobody can target me.

  • Nizam Khan says:

    Excellent and useful clickboming resource. You have made it very clear and also easy by listing out 5 signs of climbombing and by linking to invalid click contact form. Thanks Justin for sharing info and tweeted 🙂

    • Justin Cooke says:

      Thanks, Nizam!

      Definitely not the most fun subject, but glad I could share some helpful information.

  • Trouble is too much of the coverage of this topic istoo simplistic, and standard due diligence buying cannot find the problem.. These guys are clever. Clever clickbomb attacks are done by proxies that simulate search from US using randomized keywords so – checking for what is “search” trafficis not sufficient to find it.
    And fraudulent adsense sites ensure that enough simulated traffic is generated so that the adsense earnings look in proportion. There are sites out there for sale which are like this! Statcounter interestingly can see the difference, where google analytics cannot. So use both..

    • JustinWCooke says:

      I don’t think our approach was too simplistic…we used and relayed actual examples above.

      I think it’s MUCH more difficult to randomize an attack that will find a set of sites using actual, legitimate search terms…and to do this “automatically”. Not impossible by any means…just less likely, meaning you’re more likely to find them hitting your site(s) directly.

      That being said, I know someone here in the Philippines that was offered a job as a “click fraudster”. It was a work from home position…they were to manually search out for a list of sites using a US proxy, check out a few pages, and click on and visit one of the AdSense advertisements. They would receive a % of the profits after 60 days and once they’d hit a certain threshold. It’s clever…but a HORRIBLE idea for those thinking they can use this to boost their AdSense earnings…ugh.

      In our opinion, Google Analytics is a much better tool for tracking traffic than Statcounter…

  • Hey guys, great post. I’m glad you guys weren’t attacked. It must have been pretty scary when you first saw it though. I think I’m going to need to invest in an anti-clickbombing plugin.

    So did that site settle down a bit, or do you have a new super earner on your hands?

    • While it’s still doing well, it’s no where near as good as it did that one day. Still it’s earning $4 a day excluding those two large days and still ranking #1 for it’s primary keyword, so I can’t complain.

  • DaveNL72 says:

    Is there not a way to protect your adsense ads, like blocking adsense ads for none English countries? That should not be so difficult to code i guess (i have no coding skills so forgive me my ignorance)

  • Bob says:

    How do you see what states your clicks come from?

    • JustinWCooke says:

      Hey Bob,

      In Analytics, click on Demographics > Location. When the list of countries come up, click on the United States and you can dig into the particular states from there.

  • Jude Austin says:

    I can’t see Google immediately banning your account for this happening, unless of course you were causing the click fraud or bombing. They have got to have a way to monitor this type of thing to provide security for both publishers and advertisers.

    • JustinWCooke says:

      Hey Jude,

      I think that’s true a majority of the time. Google will catch these types of things and simply refund the advertiser and you’ll see a deduction in your earnings…a good thing all the way around.

      Still…it wouldn’t/shouldn’t surprise us that some truly innocents take this type of hit.

  • Hey Justin thanks for the shout out 🙂

    Im glad the same thing that happened to us didn’t happened to you guys. We where banned with no second chance and then could not get an account approved in another name even though we tried to alert Google and took Adsense off all the sites. Luckily we where in the early stages of making these sites when it all happened so we had only blown a couple of grand. We ended up selling 6 of the top micro niche sites we made which helped though. I must say when we got click bombed and banned by Google Adsense it was a massive low it seemed like everything was going wrong at that stage… but i really think its for the best we have other things we are working on now that are working pretty good for us so we just battled our way through. I sure hope this does not happen to anyone else here and wish I knew exactly why it happened to us so we could share some insight but we will never know 😉

    • JustinWCooke says:

      Yeah…sucks, Matt.

      On a positive note, it forced you to explore your current niche sites and monetization methods which, I’m thinking, may turn out quite nicely for you guys!

  • Great post, will share it!
    I had some experiences with reporting unusual CTR and earnings via their form and all the time the answer was “it’s okay” btw. Better be safe than sorry!

  • Great article!

    What happened to the traffic the next day? Did it keep up like that?

    • JustinWCooke says:

      Hey Kris!

      The traffic (and earnings) are settling back down the last couple of days. It’s still higher than we’d expect usually, but much lower it was on that particularly crazy, high-traffic day.

      Even though we’re ranked #1, my guess is there was an advertising blitz or sale on Labor day for this particular item, causing the surge…

    • Hey Kris yeah same with us. Our site went back to the average traffic and Adsense earnings before the spike. Was a shame because we earned $500 in Google Adsense that day….. if only they let us keep it eh lol. I still wish I new why it happened but we have well moved on 🙂

  • Jon Haver says:

    Its surprising Google doesn’t have this functionality automatically built into their adsense system….I am sure they could automatically check similar to what you did manually and then temporarily display blank ads. That would protect both the advertiser and publisher.

    The part of the story I am most interested in is the XXXX% increase in traffic…did you do anything differently with this site in the weeks/months ahead that you can attribute to the huge increase in traffic?

    • Agreed Jon, Google really needs to provide this sort of protection to publishers. As it it stand it’s simply too easy to attack a competitor, especially if they have a small account with only a few sites.

  • Mark Sojka says:

    I think that just disabling ads for some time should be enough. A good post with some useful informations 🙂 Waiting for your new income report to see how well you did last month guys.

  • MB says:

    Great post Justin, I have been using Click Bomb Defense after I had some suspicious activity on one of my sites. (Spencer made note of it in a recent post)

    Good to know once an ad has displayed a specific amount of times to one IP that the ads gets switched out to Amazon or CPA etc.

  • Barry says:

    If we report click bombing, do u think Google will listen or just ban our account for potential clicks in the future that could lead to this again?

    • I would hope not, but I guess it’s always a possibility. Use the reporting feature with caution.

    • Hey Barry agree with Joe here……. only use it if you really have to. But the sad thing is I don’t think you would get a response. We tried a few times after we got clicked bombed and then 2 weeks later when we where eventually banned still we could get no response from Google at all…. aside from a auto response. Id love to have a business where it was so massive/profitable i could treat customers like that 😉

  • Makes me wonder if one of the reasons my account was banned was due to being clickbombed. Unfortunately, once you’re banned you can’t view your earnings so it’s harder to tell. Definitely something I’m going to keep an eye on if I get another AdSense account.


  • HI

    I saw something very strange in early august. The two sites i sent you the spreadsheet on. They got massive spikes of pageviews in adsense. one on the 4th august the other on the 10th about 8000 times the normal daily level.

    But just the normal number of of course the CTR for that day plummeted. so i though i’d been click boomed and google had not counted or reversed out the clicks.

    But when checking analytics there was no traffic spike at all. nor in webmaster tools..

    Strange hey..

  • Tyler Herman says:

    I’ve been noticing some automated bots or something clicking my image ads only, on a few sites so i removed the ads. i’m moving away from adsense all together but I figured I don’t want to lose the account completely.

    I’m guessing it is pretty easy for someone to set up a bot to do something like that.

    • JustinWCooke says:

      Hey Tyler,

      It’s odd that it’s sporadic and not that often…how did you figure out it was an automated bot…what led yo to that conclusion?

      I think it’s beyond your average, every-day internet visitor’s capability, but I’m sure there are some blackhat programs you can use for this. (shudders)

      • Tyler Herman says:

        It was ignoring text ads on the same page, so it probably wasn’t a person. It also clicked almost the exact number of ads each day. Not hundreds but like 60 a day for about 3 days before I noticed it.

        Removed the image ads, left the text ones and it stopped completely.

        I haven’t added the image ones back to test it yet but I might do that just to see if it happens again.

  • P.K.ARUN says:

    Some of the tips you have mentioned here are really useful tips. One idea I received from one senior blogger is, remove your site which is dealing with clickbombing from “Allowed sites” feature in adsense. But don’t remove adsense code from your site. Thus who is click your ads have no idea that those clicks are not counting and after some day he will stop clicking ads.

    • JustinWCooke says:

      Thanks for the comment!

      Yeah, requiring “allowed sites” and then not adding that site to the list is an effective solution to avoid those clicks…

Leave a Reply

Your email address will not be published. Required fields are marked *

Have a Business to Sell?

Click here to get the process started today.