Click farms

How Click farms Works

+----------------+      +---------------------+      +-----------------+
|   Advertiser   |----->|   Ad Network/Site   |----->|   User's Device |
+----------------+      +---------------------+      +-----------------+
                           |           ^
                           |           | Legitimate Traffic
                           v           |
+----------------------+   +-----------------------------+   +----------------------+
| Fraud Detection System|<- | Malicious Publisher/Network |<--|      Click Farm      |
| (Blocks & Reports)   |   +-----------------------------+   | (Humans or Bots)     |
+----------------------+      |           |                +----------------------+
                           └-----------└------> Illegitimate Clicks

🧠 Core Detection Logic

Example 1: IP Velocity and Reputation

This logic tracks the number of clicks originating from a single IP address or a range of related IPs over a short period. A sudden, high volume of clicks from one source is a strong indicator of a click farm or botnet. This fits into the network analysis layer of traffic protection.

FUNCTION checkIpVelocity(ip_address, time_window, threshold):
  click_count = count_clicks_from_ip(ip_address, time_window)
  ip_reputation = get_ip_reputation(ip_address) // e.g., known proxy, data center

  IF click_count > threshold OR ip_reputation == 'suspicious':
    RETURN 'FRAUDULENT'
  ELSE:
    RETURN 'VALID'

Example 2: Behavioral Analysis

This logic analyzes on-page user behavior to determine if it’s human-like. It measures metrics like mouse movement patterns, time spent on the page before clicking, and scroll depth. Bots often exhibit robotic, predictable movements, while click farm workers may click too quickly with no other interaction.

FUNCTION analyzeSessionBehavior(session_data):
  time_on_page = session_data.time_end - session_data.time_start
  has_mouse_moved = session_data.mouse_events > 5
  has_scrolled = session_data.scroll_depth > 0

  IF time_on_page < 2_SECONDS AND NOT has_mouse_moved:
    RETURN 'FRAUDULENT'
  
  IF click_event_happened AND time_on_page < 5_SECONDS AND NOT has_scrolled:
    RETURN 'HIGH_RISK'
  
  RETURN 'VALID'

Example 3: Geo and Device Mismatch

This logic cross-references the geographic location of the IP address with the user's device settings, such as language and timezone. A significant mismatch, like a click from a Vietnamese IP on a device set to US English and a US timezone, suggests the use of a VPN or proxy to hide the user's true origin.

FUNCTION checkGeoMismatch(ip_geo, device_language, device_timezone):
  // Assumes ip_geo is an object with country, timezone, etc.
  
  IF ip_geo.country != get_country_from_language(device_language):
    // Strong indicator if language and IP country don't align
    RETURN 'SUSPICIOUS'

  IF ip_geo.timezone != device_timezone:
    // Weaker indicator, but adds to the risk score
    RETURN 'SUSPICIOUS'
  
  RETURN 'VALID'

📈 Practical Use Cases for Businesses

• Campaign Shielding – Businesses use click farm detection to automatically block fraudulent IPs and devices from seeing their ads, preventing budget waste before a click even occurs and protecting PPC campaigns.
• Analytics Purification – By filtering out fake traffic, companies ensure their analytics platforms reflect true user engagement, leading to more accurate data for strategic decision-making and performance measurement.
• Conversion Funnel Protection – Detection logic is applied to lead-generation forms and checkout pages to prevent bots and fraudulent users from creating fake accounts or submitting spam, ensuring the sales team engages with genuine leads.
• Return on Ad Spend (ROAS) Optimization – By eliminating wasteful spending on fraudulent clicks, businesses can reallocate their budget to channels and campaigns that reach real customers, directly improving their overall return on ad spend.

Example 1: Geofencing Rule

A business targeting customers only in the UK can use geofencing to automatically flag any click originating from outside its target area, a common tactic for click farms in different countries.

RULE Geofence_UK:
  WHEN click.ip_geolocation.country NOT IN ('GB')
  THEN 
    FLAG 'fraud'
    ACTION block_ip

Example 2: Session Engagement Scoring

An e-commerce site can score sessions based on engagement. Clicks from sessions with zero scroll activity and a sub-three-second page view time are flagged as fraudulent, typical of automated scripts.

RULE Engagement_Score:
  DEFINE
    low_engagement = session.scroll_depth == 0 AND session.time_on_page < 3
  WHEN low_engagement IS TRUE
  THEN
    SCORE session.fraud_score + 50
    IF session.fraud_score > 75 THEN
      ACTION flag_and_review

🐍 Python Code Examples

This code identifies high-frequency clicking from a single IP address within a specific time frame, a common sign of a click farm. It helps block IPs that exhibit bot-like, repetitive behavior.

# Example 1: Detect Abnormal Click Frequency
from collections import defaultdict
import time

clicks = defaultdict(list)
FRAUD_THRESHOLD = 10  # Clicks
TIME_WINDOW = 60  # Seconds

def is_fraudulent_ip(ip_address):
    current_time = time.time()
    # Remove clicks older than the time window
    clicks[ip_address] = [t for t in clicks[ip_address] if current_time - t < TIME_WINDOW]
    
    clicks[ip_address].append(current_time)
    
    if len(clicks[ip_address]) > FRAUD_THRESHOLD:
        print(f"Fraudulent activity detected from IP: {ip_address}")
        return True
    return False

# Simulation
is_fraudulent_ip("192.168.1.101") # Returns False
for _ in range(15):
    is_fraudulent_ip("192.168.1.102") # Will eventually return True

This script analyzes user-agent strings to filter out known bot signatures or suspicious patterns. A real user's browser provides a standard user-agent, while bots may use outdated, strange, or generic ones.

# Example 2: Filter Suspicious User Agents
def is_suspicious_user_agent(user_agent):
    suspicious_keywords = ["bot", "spider", "headless", "scraping"]
    user_agent_lower = user_agent.lower()
    
    if not user_agent:
        return True # Empty user agent is highly suspicious
        
    for keyword in suspicious_keywords:
        if keyword in user_agent_lower:
            print(f"Suspicious user agent detected: {user_agent}")
            return True
    return False

# Simulation
is_suspicious_user_agent("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36") # False
is_suspicious_user_agent("GoogleBot/2.1") # True
is_suspicious_user_agent("") # True

Types of Click farms

• Manual Click Farms – These operations employ large groups of low-paid human workers who manually click on ads, follow accounts, or post comments. Because a human is performing the action, this type can be harder to detect than purely automated bots.
• Bot-Powered Click Farms – These use automated scripts and botnets (networks of infected computers) to generate clicks and other engagement at a massive scale. They are faster and cheaper to operate than manual farms but can be easier to identify through behavioral analysis.
• Mobile Device Farms – These are physical locations containing hundreds or thousands of real mobile phones arranged on racks, used to generate fraudulent app installs and mobile ad clicks. They use real devices to better mimic legitimate user profiles and bypass emulators detectors.
• Hybrid Click Farms – This model combines automation with human intervention. For instance, bots might perform the initial browsing and clicking, while human workers are used to solve CAPTCHAs or complete complex sign-up forms that bots cannot handle, making them highly evasive.