Some People Will Click On Anything

Didier Stevens, who works for European IT services firm Contraste Group, conducted a six-month AdWords experiment to see if people would click on an ad with the text "Get infected here!"

And people did, 409 of them to be exact, excluding the bots.

On his blog, Stevens remarked on the inexpensive ease of which an ad can be set up on Google. Sinister minds require the crime fighters to have sinister minds as well. Stevens’ first thought was that AdWords could easily be used to push malicious content to the first page of the search results.

One of the more interesting facets of the experiment is that Stevens wasn’t the least bit sneaky in setting it up. He bought the domain drive-by-download.info (.info is a notorious hub for malware). Google approved the ad.

The website itself has a simple message: Thank you for your visit.

(Though, honestly, it would have been much funnier if Stevens had employed the famous Douglas Adams message from God: Sorry for the inconvenience.)

Over a six-month period, the ad was displayed over 259,000 times, clicked 409 times (click-through rate of 0.16%), and cost Stevens about $23 (6 cents per click). Only seven clicks were suspected to come from bots, which Google successfully filtered out before billing.

Malware crooks are definitely targeting the right browser; 98% of the clicks came via Internet Explorer.

Stevens’ experiment echoes findings of other studies conducted by industry experts. At the Search Engine Strategies Conference in New York, a panel on searcher behavior noted: "You could run an ad that said ‘bad prices, bad products’ and people would keep clicking."

The results also seem to echo his own previous, more intensive study following AOL’s Data Valdez data leak. Upon examining that data, Stevens found that for every 2800 click-throughs, one landed on a "spamdexing" site.

Though the need, effectiveness, and benefits of cost-per-action models have been hotly debated, proponents of CPA billing will no doubt cite information like this, adding to click-fraud numbers for justification.

Indeed, the bottom line seems to be that the lowest common denominator (i.e., unskilled or unaware searchers) will be as present in the CPC world as the ever-hated clickbot. Chalk up the click-happy searcher as a cost of doing business, then, just as grocery stores put up with grape-grazers and hotels write off towel thefts.