Over the last year Microsoft's Internet Safety Enforcement team has been involved in a comprehensive investigation regarding a click fraud scheme affecting online advertisements related to auto insurance and the online role-playing game, World of Warcraft. Earlier today we publicly filed a civil suit in the Western District Court of Washington against the three believed perpetrators - Eric Lam, his brother Gordon Lam and their mother Melanie Suen. More information on the investigation and filing can be found here on the Microsoft on the Issues blog. We think it's important to be open and transparent in sharing the information about this filing, because it is a great example of how we as an industry can work together to tackle these issues to better protect advertisers and consumers and an opportunity to send a clear message that we won't tolerate fraud on our networks.

In cases like this, we sometimes get questions about how ad networks like Microsoft can distinguish legitimate click traffic from fraud.  We can't disclose all of the ways we do this of course - we don't want to go giving fraudsters a roadmap for how to evade detection - but here is a visual that helps provide an example of one of the many ways our Traffic Quality team can look at click traffic behavior to distinguish legitimate clicks from automated clicks.

Origin of automated clicks: this graph is a visual representation of the IP source patterns of the click traffic observed in this case. Note the clusters of sources, which indicates automated traffic behavior. "Normal" IP traffic would be more randomly distributed across the Internet.

Updated 6/22/09 to add:

Below is a typical graphic representation of normal non-clickfraud activity. Genuine traffic will generally lump together into a single sphere as the IP addresses themselves are randomized and lack commonality amongst themselves. The only association these IP addresses have with one another is the search term entered into the search engine (which is depicted in the middle).

Thank you,

Brian Boland