Protecting ads when the leads arrive as calls
How to read Metrica’s four call goals, how a dynamic number differs from a static one, and why a call with no visit never becomes a goal. The linking window is 21 days.
13 min read
Blog
Articles about protecting ads from bots and click fraud
Leads and inquiries
How to judge an ad contractor when the traffic is dirty
How to check a contractor against Yandex Metrica and Yandex Direct: CRM order matching, lead quality, representative access, and goals without opening the counter.
6 min readInflated calls: how to notice fraud in phone calls
Thirty seconds in Metrica is the threshold of a goal call, not a sign of inflation. How a dynamic call differs from a static one, and why a tap on a number is not a conversation.
5 min readHow to check the phone and email on a lead
The browser checks email shape and does not check a phone number. What confirms a mailbox, why a tap on a number is not a call, and why Direct states two different rules for a bad contact.
6 min readFake leads: where they come from and how to tell them apart
A repeated form, a failed submit, and a wrong contact are not the same thing. What Yandex Direct does not treat as an invalid conversion, and how a spam-order status reaches Metrica.
6 min read
Analytics and solutions
How to choose and roll out click-fraud protection
What to check before you turn protection on: one request per visit, three decisions, an observation mode, and what the docs do not promise about page speed or spend before and after.
12 min read
Metrics and calculations
How much you lose to click fraud: a calculation for your own campaign
Why someone else's fraud rate cannot be multiplied by Direct spend, and how not to count twice the money already returned to the shared balance.
11 min read
Detecting click fraud
Bots in Yandex Metrica: from robot reports to Webvisor
How to separate self-identified robots, behaviour-based robots, bounces and a Webvisor recording, and which Direct report already counts clicks that passed antifraud.
12 min readA one-day audit of ad traffic: a step-by-step checklist
One day in Yandex Direct and Metrica: a suspicious Webvisor, what counts as a visit, and how to block a placement from the Placements report. A checklist without extra accounts.
10 min read
Website bot protection
How bots affect SEO and on-site behavior metrics
How Google and Yandex crawling relates to the index, why robots.txt does not drop a page from search, and when a foreign User-Agent is not yet a search robot.
6 min readHow to stop spam signups and fake accounts
New accounts are not stolen-password checks. Confirm email before the account is live, do not ban on the first weak signal, and do not trust a browser email check.
7 min readrobots.txt: what it can and cannot do against bots
robots.txt asks compliant robots to stay off certain URLs. It does not lock a page, does not prove a User-Agent name, and does not replace noindex.
6 min readCredential stuffing: bots replaying stolen passwords
This is a check of stolen login-password pairs, not guessing. How stuffing differs from cracking and spraying, and why OWASP puts a second factor first.
6 min readWhat website scraping is and how it hurts a business
What OWASP means by scraping, why robots.txt does not hide a page, and how Google’s spam policy hits the site that republishes someone else’s content.
6 min read
Bots and technology
VPN and ads: how it affects geo and filtering
What Yandex Direct and Google Ads say about geo delivery when the point changes, and why a VPN does not stop linking visits by a browser fingerprint.
6 min readGood bots: crawlers, monitoring, and link previews
Who identifies themselves in Metrica, how to verify Google and Yandex by DNS, how Google-Extended differs from Search, and why a failed check is not proof of a spoof.
7 min readIP reputation and block lists
What an autonomous system number says about routing, how a shared IPv4 under CGN differs from a person, and how a DNS address list is built.
7 min readWhat rate limiting is
Status 429 means too many requests and does not define who the user is. How a rate limit differs from a captcha, an IP block, and a single weak signal.
7 min readWhat a TLS fingerprint is (JA3/JA4)
How JA4 folds a ClientHello into a string, how that differs from a browser fingerprint, and why the string alone does not prove an automated visit.
7 min readWhat an antidetect browser is
How a site recognizes a browser without a form. What the User-Agent header carries, what a fingerprint means, and how passive collection differs from active collection.
8 min read