How to find anomalous click spikes by hour
Contents
Share
The checked Yandex Direct guides do not describe an hourly click report. The finest grain the guide names outright is one day, detailed down to minutes, in the Direct group of reports. A sharp rise in clicks can also happen when there is no invalid traffic.
The signs among which a spike is only one trace are collected in signs of click fraud. The question here is different: which time grain is actually documented, and which spike does not belong to Direct clicks.
A spike is not invalid traffic
The Direct statistics guide says a sharp rise in clicks is possible even when there is no invalid traffic. The page does not set a threshold for “how sharp”. You cannot name an hour an attack from one jump, even if an hourly chart were in front of you.
What was removed sits in the Invalid traffic report, and that column is not a spike in spend. What it holds is covered in invalid clicks. Growth there is the filter working. A spike in the clicks that stayed in spend is a different row.
Minutes, not hours
If Webvisor looks suspicious, the same guide says to take the source Direct, compare it with the Direct group of reports, and look at the day with detail down to minutes. An hour is not in that instruction. A day and minutes are.
Say a recording shows a pack of sessions around 14:02. The guide asks you to open that day in the Direct group and go down to minutes, not to build a “by hour” chart that the text does not contain. What a pause and a hole in the frame mean in the recording itself is covered in how to look for bots in Webvisor. A session that is missing from the Direct group was not in spend: the group is built from clicks that passed antifraud.
The minute grain does not produce a name. It shows whether visits that passed the filter are packed into a few minutes or spread across the day. The guide does not give a threshold of “this many minutes in a row means fraud”, and this article does not set one.
If the site fell over, that is a different spike
When the site loads slowly or answers with HTTP 500, the Robots report guide says to open Site load first, then Robots for the period of the spike. That is a spike in the site’s responses, not a spike in Direct clicks. Mixing them means hunting a bot in an hour when the page was not opening.
The order of those two reports is covered in how to find bots in Yandex Metrica. For Direct clicks it is only a fork: first find out whether the site was up. Robot names are not carried into spend.
Checking minutes happens after the visit. A script on the site does not draw an hourly chart and does not count money. If there is no answer, the visit is let through. When there is a decision, it is to let the visitor through, set a computational task, or refuse entry. It does not sign a surname onto a minute-pack in Webvisor.
While the facts contain no hourly report, the working pass is this:
Do not call a jump invalid traffic until you have opened the report where that traffic is removed.
If a recording looks suspicious, open the day in the Direct group with detail down to minutes.
Do not write a session that is missing from that group into spend.
If the site answered 500 or opened slowly, open Site load first, then Robots. That is not a click chart.