IP Address Query

Mark Hamill

(If this is the wrong forum, please feel free to move it)

I've been using clicky to monitor a small adwords campaign for the past few weeks and I've noticed a few repeating clicks from IPs that match in all but the last three digits. eg they are all of the form: 123.456.789.xxx. Clicky gives the location only as Dublin and only 2 different platforms (either Chrome 50 on android or Safari 9 on iPhone). Searching the IP with Whois and other online tools indicates that the IPs are all part of a range of IPs owned by Vodafone and are coming from the same suburb or Dublin.

What is the likelihood that these IPs are coming from the same people? If someone links to the same Vodafone broadband network with different phones/PCs how similar can their IPs be?

ishotjr2

This is incorrect 123.456.789.xxx

No dotted decimal integer can exceed 255. That is 456 & 789 are incorrect.

Assuming the above is just a simple mistake based on you wanting to mask the origin.

> What is the likelihood that these IPs are coming from the same people?
Not knowing how popular your site is, assuming it is not extremely popular I would think this is likely.

> If someone links to the same Vodafone broadband network with different phones/PCs how similar can their IPs be?
They will be similar typically.

Alun

Vodafone uses CGN (Carrier Grade NAT) on it's mobile networks, so it's possible these are the range of addresses they use on the public side.

mightyreds

I'd hazard a guess he made it up completely as an example, since it goes 123456789

Alun

ishotjr2 wrote:

This is incorrect 123.456.789.xxx

No dotted decimal integer can exceed 255. That is 456 & 789 are incorrect.

Hollister11 wrote: »

I don't know the asnwer to your query but your IP address is wrong.

There are 4 classes - A,B,C,D and each section can't go above the value 255. So if your getting 456 in your IP address, it's not a real IP address.

It should be painfully obvious to anyone that he was just using those numbers as placeholders so as not to reveal the actual address. Some people would have used AAA.BBB.CCC.xxx instead, same principle.

The clue is in the use of the phrase " ... of the form:".

TheChizler

In fairness he did say "of the form". I don't think we were meant to take it literally.

They're all probably from the same rough area if they're on the same subnet but there's nothing technically stopping Vodafone from spreading them all around the country.

Mark Hamill

mightyreds wrote: »

I'd hazard a guess he made it up completely as an example, since it goes 123456789

Alun wrote: »

It should be painfully obvious to anyone that he was just using those numbers as placeholders so as not to reveal the actual address. Some people would have used AAA.BBB.CCC.xxx instead, same principle.

The clue is in the use of the phrase " ... of the form:".

TheChizler wrote: »

In fairness he did say "of the form". I don't think we were meant to take it literally.

Phew, ishotjr2's post made me worry I went over peoples heads or something :pac:.
Yes, I just made up an address to my point across that it was only last set of 3 digits that varied.

Mark Hamill

Alun wrote: »

Vodafone uses CGN (Carrier Grade NAT) on it's mobile networks, so it's possible these are the range of addresses they use on the public side.

TheChizler wrote: »

They're all probably from the same rough area if they're on the same subnet but there's nothing technically stopping Vodafone from spreading them all around the country.

So, these IPs could be public and from different people, but they could be from the same person? If someone connects to a router with both a PC and a phone, how different can their IP get? Is there a way to tell if two different devices looking at your site are coming from the same source (connected to the same router) if they have different IPs?

The industry I'm in (and I'm sure many others) has had a problem with competitors clicking on each others ads to cost them money and waste clicks. I want to make sure nobody is doing that to my site, but I obviously don't want to blacklist any IP or IP ranges if they are just random people.

Is there an alternative to clicky that might offer more information to me?

Alun

If someone connects to your website through the same home router, with multiple devices whether WiFi or hard-wired, PC, laptop, phone or tablet, they will all appear in any traffic summary to have the same public IP, the one that the WAN interface of the router has allocated to it. There's nothing you can really do about that, and you can't distinguish them from each other, except by device type as reported by the browser which can easily be fudged if required.

I don't know if all the mobile carriers do it, but certainly Vodafone use Carrier Grade NAT, so your phone will get a private IP, just the same as if it was connected to a home router, but in Vodafone's network this will get NAT'ed to an external public IP, along with loads (possibly several hundred) of other connected phones. It's quite likely also that Vodafone will use multiple public facing IP's to spread the load rather than just using one like in a home router, so they could be using an entire Class C subnet just for that purpose. In effect, you can view CGN as just a giant version of a home router except with multiple public IP's.

Scotty #

Mark Hamill wrote: »

The industry I'm in (and I'm sure many others) has had a problem with competitors clicking on each others ads to cost them money and waste clicks.

Adwords has a system in place to stop prevent this. You'll get a refund each month for what they deem to be 'invalid activity'.

Vodafone use dynamic IP's and (annoyingly!) refresh users IP's every night, so in theory you could have the same IP address register a click 3 days in a row and it actually be a different user each day.

Geo-locating IP's is terribly inaccurate. A geo search showing as Dublin, could actually be pretty much anywhere in Leinster.

ED E

^ Just to corroborate this, Eir have about 7 POPs around the country that everyone used to pull from, nowadays that might be about half(eFibre/NGA is decentralized). Even at that thats most of D1 to Dundalk locating as one POP and D2 to Wicklow locating as another. Pretty useless.

With Three/Vodafone/Meteor you could well have 100 handsets per IP making address truly useless as a "device identifier". Or take Universities who may have 15,000+ students and staff emerging from a handful of border gateways.

Mark Hamill

So what's the best way to combat this problem? Just trust in Adwords own systems to weed it out?

Scotty #

I let Adwords look after it, there's not much else I can do but I don't find malicious clicks a problem to be honest.

The costs are getting higher and higher though. I spend €500 per month with them for my UK site and every month I'm getting less clicks for that as competitors bid higher and higher. Some keywords cost me over €1.00 per click these days for a top 3 slot as more and more competitors join. Make sure you spend time learning about Ad Extensions, Dynamic Keywords, and how to find the actual search terms used so you can add irrelevant ones (that may be costing you a lot of money) to your negative keyword list.

Also, if you haven't done so already, set up Google Analytics on your site and link it to your Adwords account. This will give a much better insight into how your Adwords visitors are behaving.