Google gets a voice check on PPC fraud and Bodis virus

Another 40,000 Fake Google search sites  on top of the other 100,000 fake Google sites but this time from Bodis LLC and not only does Google help these people to cyber squat domain names in Google domain park but also creates fake traffic to force up the value of these domains.

Google also provide these sites with all the AdSense leads the could ever need to run these fake search sites and Google is not too concerned about the fake pay-per-view click from the viruses on these sites and seem to be actively encouraging this fraudulent activity since they make much more than anyone else in the world from virus clicks as middle men and are able to launder the clicks via double-click and Google certainly seems like they are in no mood to listen to customers who complain about this activity, Googles I guess is just too big for that.

Here are some of the viruses controlled by Bodis LLC that I have managed to find today and they are also linked in to the legendary krvkr.com Tengia.a Virus and yet Google still turns a death ear and blind eye.

WARNING View at own risk but all will redirect to fake seach sites full of Google Adsense

hxxp://down.49558.cn/soft/TheWe1718.exe
hxxp://netsharingsite.com/downloads/IPFilter.exe
hxxp://down.49558.cn/soft/TheWe1718.exe hxxp://down.49558.cn/soft/Funshion2754.exe
hxxp://t.33358.net/a.exe
hxxp://klounada.com/olehelp.exe
hxxp://www.mp3codec.info/files/bl.exe
hxxp://install.007guard.com/up100.exe
hxxp://install.007guard.com/up100.exe
hxxp://www.hotlinkfiles.com/files/1449770_qobrx/wr-1-1749.exe
hxxp://www.hotlinkfiles.com/files/1480835_tcx55/wr-1-1749b.exe
hxxp://winm8.com/downloads/install_imagem8.exe
hxxp://www.securegamers.com/shadowfrench/W3XCDKeyGrabber11800.exe
hxxp://www.pmvq.com/jihuo.exe
hxxp://urodinam.net/dogma.exe
hxxp://t.33358.net/ie8.exe hxxp://cha.91mt.com/exe/key/key1021.exe
hxxp://winm8.com/downloads/freeclip.exe
hxxp://www.easyscreensaver.com/download/ssm_setup.exe

Click Here and Here for a bigger list of viruses

In an effort to avoid detection the IP-Address associated with these domains are moved around but the current top addresses used are 199.59.241.235 and 199.59.241.238 and I have included a small sample listed of domains below.

The Google client ID used for these sites is “ca-dp-bodis26_3ph_js” and the WHOIS DNS record shows:

   Registrar: godaddy.com, inc.
   Whois Server: whois.godaddy.com
   Referral URL: http://registrar.godaddy.com
   Name Server: NS1.BODIS.COM
   Name Server: NS2.BODIS.COM

Hosting address 199.59.241.235 and 199.59.241.233 are again owned by Bodis.com and show:

  OrgName: Bodis, LLC
  OrgId: BODIS-1
  Address: Suite 502A-18825, Block A
  Address: Shekou Technology Building 2
  City: Shenzhen
  StateProv: Nanshan District

OrgAbuseEmail: but its a waste of time contacting them because the staff keep taking long holidays and thinks everyone are fools.

Indeed Google must be hearing a little voice inside its ear and its quite ironic that Google Safe Browsing calls home hundreds of time a day just to make sure us poor virus victims can be protected and this is a bit like the fox guarding the chicken house as I see it.

How can I detect Adsense/Adwords Click Fraud?

Click Fraud can be detected through advanced click statistics. If your target location is US, UK, and you are receiving certain clicks (even 20-50%) from countries such as Syria and Botswana, then it is a sure indication of click fraud.

There is a huge pool of marketing techies who have mastered this art of click fraud. Normally they create a network of users who make profits by clicking on ads. There might be hundreds or even thousands of people who do just nothing, but click on sites. Google and Yahoo have been trying hard to cut-down click fraud, but it is virtually impossible for them to nullify click fraud. It is estimated that 10% to 15% of all clicks are fake, and 300-500 million dollars of advertising budget gets exhausted each year into click fraud.

However, there are various benchmark tests which you can follow to detect fake clicks. These are as given below:-

1) If you observe a unusual click trend or CTR (Click Through Rate) in your adwords account, then it could be an indication of click fraud. You should manually monitor your adwords account to detect click fraud.

In case you observe a sudden increase in no. of clicks within a short timeframe of 15-30 minutes during a day, then it could an indication of unusual click trend. Moreover if none of those clicks actually convert into lead, then it could be an indication of click fraud.

2) You are receiving 5000-15000 clicks from adsense, but none of those clicks actually get converted into lead. Moreover, if you observe sudden drop in conversion rates, then it could be an indication of click fraud.

3) If you observe your Google analytic section, you will clearly come to know how many pages were visited by a particular user. Moreover you will get to see how many minutes that particular user stayed on your website. If you observe 1 page visit/ 0 minutes stay, then it could be an indication of click fraud.

4) Normally fake clicks originate from 1 or 2 particular locations (depending upon your competitors/industry). If you observe a regular pattern of several clicks from one geo location, but none of those actually converting into lead,

then it could be an indication of click fraud. You should keep tabs on clicks from suspicious or untraceable I.P addresses.

There are business sectors like online gaming, seo marketing, website development where click fraud is really high. Click Fraud is also evident in other business fields.

5) Use advance tracking codes to keep tabs on your online visitors. Google analytic coding is fine, but you can also use some other effective and efficient track codes. You can also use conversion tracking codes to detect clicks which

are converting into leads/sales. This conversion tracking is available within Google adwords account.

6) Click Fraud detection should be a part of your PPC Marketing policy. You should keep close watch on issues like click fraud. Read More

Just a quick look at the HTTP trafic and JSON between google and a virus URL shows that Google is well aware of what is going on but Googles profit must always comes first I guess.

http://googleads.g.doubleclick.net/apps/domainpark/domainpark.cgi?callback=
_google_json_callback..cutout..&ref=http%3A%2F%2Ft.33358.net%2Fa.exe HTTP/1.1
Host: googleads.g.doubleclick.net

_google_json_callback(
  {
    “tm”: 0.195676,
    “session_token”: “AG06ipD-gjtN………”,
    “output”: “js”,
    “domain_name”: “http://33358.net/“,
    “dt”: “1328820740300″,
    “channel”: “010103″,
    “num_radlinks”: “10″,
    “u_h”: “1440″,
    “client”: “ca-dp-bodis26_3ph_js”,
    “num_ads”: “5″,
    “kw”: “Fram Oil Filters”,
    “s”: “33358.net”,
    “frm”: “0″,
    “u_w”: “2560″,
    “u_tz”: “0″,
    “ref”: “http://t.33358.net/a.exe“, << YES GOOGLE DOT.EXE DOES MEAN EXECUATABLE VIRUS
    “callback”: “_google_json_callback”,
    “u_his”: “8″,
    “hl”: “en”,