The "Anchor Intelligence Traffic Quality Report: 2009 Year in Review" provided the Anchor network’s perspective on traffic quality as well as trends observed throughout 2009. The purpose of the Traffic Quality Report was to provide the online advertising industry with insight into the magnitude of traffic quality issues observed by Anchor Intelligence, while providing clear and accurate definitions for the statistics provided.

1. ANCHOR INTELLIGENCE
TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
January 19, 2010

2. ANCHOR INTELLIGENCE TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
HIGHLIGHTS
• In 2009, the attempted click fraud rate hovered between a low of 18.6% in Q3 and a high
of 25.7% in Q4; in other words, 1 out of every 4 clicks in Q4 was an attempt at click fraud
• The increase in attempted click fraud in Q4 was due to:
• active click fraud rings among new Anchor customers
• a swell of activity by fraudsters taking advantage of holiday ad spend
• a surge in the size and scope of active botnets, the primary tool for automating
click fraud attempts, during the second and third weeks of December
• In 2009, the 5 countries in which attempted click fraud rates were highest were Vietnam,
the U.S., Egypt, Canada, and Australia
• Anchor Intelligence saved advertisers more than $35M in potentially wasted ad spend by
identifying and removing click fraud from customers’ networks
INTRODUCTION
The Anchor Intelligence Traffic Quality Report: 2009 Year In Review provides the Anchor Intelligence
network’s perspective on traffic quality as well as trends observed throughout 2009. All traffic
quality statistics are based on data from Anchor’s search engine, ad network, and advertiser
customers. This report breaks down traffic into two major categories: valid and invalid. Invalid
traffic is further broken down into two subcategories: attempted click fraud and innocuous invalid.
The purpose of the Traffic Quality Report is to provide the online advertising industry with
insight into the magnitude of traffic quality issues observed by Anchor Intelligence, while
providing clear and accurate definitions for the statistics provided.
2009 NETWORK RESULTS
2009 was an active year for online advertising related crimes. Malware attacks, fraudulent insertion
orders on behalf of fake ad agencies, and click fraud are just a few examples of the types of
malicious activities that adversely impacted advertisers, ad sellers, and consumers this past year.
The attempted click fraud rate may serve as a barometer by which the online advertising industry
can assess the level of threats to online advertising. (See Appendix A for definitions.)
In 2009, the invalid rate fluctuated quite a bit from quarter to quarter, hovering anywhere between
23.2% (Q3) and 32.1% (Q4). The attempted click fraud rate also varied with a low of 18.6% in Q3
and a high of 25.7% in Q4. Attempted click fraud declined in Q3, which can be attributed to three
major factors: increased vigilance and enforcement of traffic quality standards by current Anchor
2

3. ANCHOR INTELLIGENCE TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
customers; the identification and elimination of several organized click fraud rings by Anchor
Intelligence; and slightly lower attempted click fraud rates among new Anchor network custom-
ers. Meanwhile, attempted click fraud starkly increased in Q4 as a result of holiday fraud and
the addition of new customers to the Anchor network with much higher-than-average
attempted click fraud rates (additional details in “Q4 Results” below). As a result, at least 1 out
of every 4 ad clicks in the final quarter of 2009 was considered to be invalid and therefore, not
billable to advertisers.
Traffic Quality Rates
Q1 Q2 Q3 Q4
Valid 72.1% 72.9% 76.8% 67.9%
Invalid 27.9% 27.1% 23.2% 32.1%
Attempted Click Fraud 21.7% 22.9% 18.6% 25.7%
Innocuous Invalid 6.2% 4.2% 4.6% 6.4%
Total 100.0% 100.0% 100.0% 100.0%
Figure 1. Table of traffic quality rates for customers in each quarter of 2009.
ATTEMPTED CLICK FRAUD RATES IN 2009
30%
25%
20% 25.7%
22.9%
RATE
15% 21.7%
18.6%
10%
5%
0%
Q1 Q2 Q3 Q4
Figure 2. Graph of attempted click fraud rates for the Anchor Intelligence network in each quarter of 2009.
Attempted click fraud increased overall during 2009 for a number of reasons. First, malware
volumes grew over the course of the year; according to the Shadowserver Foundation, the
number of unique binaries swelled by more than 150% during 2009. The increased availability of
user-friendly kits, such as Zeus, has enabled fraudsters to create malware with unprecedented
ease. Malware — malicious code, which is downloaded onto a user’s computer without
conforming to standard authentication procedures — is commonly used to create zombie
machines, which comprise botnets. These machines are at the beck and call of a botnet master
and can be used to engage in any number of criminal activities, including click fraud. According to
Shadowserver, the number of active command-and-control servers, which are used to instruct
botnet armies, increased by roughly 65% over the course of the year. This growth in malware
and botnets helped drive a surge in velocity-based click fraud and click fraud rings as witnessed
across the Anchor network last year.
3

4. ANCHOR INTELLIGENCE TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
2009 COUNTRY RESULTS
Anchor Intelligence also measured the traffic quality rates by country. As in our last report,
analysis by country focused on the top 30 countries by volume. In 2009, the top three countries
with the highest volume of ad clicks in the Anchor network included the U.S., Canada, and U.K.,
with the US accounting for the vast majority of traffic within the Anchor network.
Top 10 Countries by Volume
Invalid
Country Valid Attempted Innocuous Total Invalid
Click Fraud Invalid
United States * 72.1% 25.8% 2.1% 27.9%
Canada 73.6% 24.8% 1.6% 26.4%
United Kingdom 81.8% 15.6% 2.6% 18.2%
Germany 84.2% 14.2% 1.6% 15.8%
India 79.3% 18.4% 2.3% 20.7%
Australia 73.9% 24.4% 1.7% 26.1%
China 80.7% 14.5% 4.9% 19.3%
Vietnam 53.9% 44.1% 1.9% 46.1%
Egypt 73.9% 24.9% 1.2% 26.1%
France 87.5% 10.0% 2.5% 12.5%
* Highest indexed value. Not drawn to scale.
Figure 3. Table ranking the countries with the highest volumes of traffic by indexed volume in 2009.
In 2009, the 5 countries in which attempted click fraud rates were highest were Vietnam, the
U.S., Egypt, Canada, and Australia. Contrary to popular belief, the attempted click fraud rate
originating from the U.S. far exceeded those of countries frequently suspected of malicious web
activity, such as China (14.5%) and Russia (12.9%).
Top 10 Countries by Attempted Click Fraud Rate
Invalid
Country Indexed Volume Valid Innocuous Total Invalid
Invalid
Vietnam 53.9% 44.1% 1.9% 46.1%
United States * 72.1% 25.8% 2.1% 27.9%
Egypt 73.9% 24.9% 1.2% 26.1%
Canada 73.6% 24.8% 1.6% 26.4%
Australia 73.9% 24.4% 1.7% 26.1%
Saudi Arabia 77.0% 21.6% 1.4% 23.0%
Indonesia 78.0% 19.2% 2.8% 22.0%
India 79.3% 18.4% 2.3% 20.7%
United Kingdom 81.8% 15.6% 2.6% 18.2%
Malaysia 82.4% 15.0% 2.6% 17.6%
* Highest indexed value. Not drawn to scale.
Figure 4. Table ranking the top 10 countries by attempted click fraud in 2009.
4

5. ANCHOR INTELLIGENCE TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
Q4 RESULTS
According to our analysis, the average invalid rate for the Anchor network was 32.1% in Q4,
representing a 38.3% increase from 23.2% in Q3. The attempted click fraud rate drove the
increase in the invalid rate as it rose from 18.6% in Q3 to 25.7% in Q4. The innocuous invalid
rate also increased from 4.6% in Q3 to 6.4% in Q4.
Traffic Quality Rates
Q3 Q4 Delta
Valid 76.8% 67.9% -11.6%
Invalid 23.2% 32.1% +38.3%
Attempted Click Fraud 18.6% 25.7% +39.2%
Innocuous Invalid 4.6% 6.4% +38.1%
Total 100.0% 100.0%
Figure 5. Table of traffic quality rates for the Anchor Intelligence network in the last two quarters of 2009.
The increase in attempted click fraud was due to a number of factors. Most new customers who
entered the Anchor network had much higher attempted click fraud rates than we typically see of
new customers, largely due to the considerable presence of traffic from large-scale click fraud rings
within their networks. These customers licensed ClearMark as part of a concerted effort to
protect advertisers from click fraud during the holiday season and beyond. Additionally, several
pre-existing Anchor customers experienced slight increases in attempted click fraud rates due to a
general swell of activity by fraudsters as they sought to consume holiday ad spend online. Accord-
ing to the Shadowserver Foundation, the size and scope of active botnets — the primary tool for
automating high velocity traffic and coordinating click fraud rings — surged in the second and third
weeks of December in a probable effort to capitalize on last-minute holiday activity online.
We also measured the traffic quality rates by country. As mentioned above, analysis by country
focused on the top 30 countries by volume. In the Anchor network, the top three countries
represented include the U.S., Canada, and U.K., with the U.S. accounting for the greatest volume
of traffic.
5

6. ANCHOR INTELLIGENCE TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
Top 10 Countries by Volume
Invalid
Country Valid Attempted Innocuous Total Invalid
Click Fraud Invalid
United States * 67.3% 29.8% 2.9% 32.7%
Canada 73.7% 23.8% 2.5% 26.3%
United Kingdom 78.2% 18.0% 3.8% 21.8%
Australia 59.5% 38.4% 2.1% 40.5%
India 76.5% 21.8% 1.8% 23.5%
Germany 84.3% 12.3% 3.4% 15.7%
France 87.2% 7.4% 5.4% 12.8%
Egypt 60.2% 38.7% 1.1% 39.8%
Spain 88.7% 8.8% 2.5% 11.3%
China 81.7% 13.7% 4.6% 18.3%
* Highest indexed value. Not drawn to scale.
Figure 6. Table ranking the countries with the highest volumes of traffic by indexed volume in Q4 2009.
Of the top 30 countries by volume, the country with the highest attempted click fraud rate was
Egypt at 38.7%, which denoted a significant increase from last quarter’s 29.6% rate. This upsurge
was due to an escalation of traffic from machines engaging in a wide range of suspicious activity
online, such as DDOS attacks, spam, and IRC abuse, in addition to the emergence of several new
click fraud rings.
In Q4, Australia and the U.S. replaced Vietnam and Indonesia as the countries with the 2nd and
3rd highest attempted click fraud rates, respectively. Australia’s attempted click fraud rate
quadrupled from 6.5% in Q3 to 25.5% in Q4, while America’s attempted click fraud rate
increased less dramatically from 21.1% to 29.8%. Attempted click fraud from these two countries
resulted primarily from automated, high velocity traffic by a distinct number of IP addresses as
well as traffic from click fraud rings.
Although Vietnam and Indonesia fell in rank, their attempted click fraud rates stayed relatively
constant: Vietnam’s attempted click fraud rate fell 1 percentage point from 30.2% in Q3 to 29.1%
in Q4, while Indonesia’s actually increased from 25.5% to 27.4%.
6

7. ANCHOR INTELLIGENCE TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
Top 10 Countries by Attempted Click Fraud Rate
Invalid
Country Indexed Volume Valid Innocuous Total Invalid
Invalid
Egypt 60.2% 38.7% 1.1% 39.8%
Australia 59.5% 38.4% 2.1% 40.5%
United States * 67.3% 29.8% 2.9% 32.7%
Vietnam 64.0% 29.1% 6.9% 36.0%
Indonesia 70.0% 27.4% 2.6% 30.0%
Saudi Arabia 72.8% 25.8% 1.4% 27.2%
Canada 73.7% 23.8% 2.5% 26.3%
India 76.5% 21.8% 1.8% 23.5%
Pakistan 76.6% 21.5% 1.9% 23.4%
Norway 77.6% 20.3% 2.1% 22.4%
* Highest indexed value. Not drawn to scale.
Figure 7. Table ranking the top 10 countries by attempted click fraud rate in Q4 2009.
Traffic Quality and Indexed Volume for the Top 30 Countries by Volume
*
Legend
Valid Rate
Not in top 30 Indexed Traffic Volume
100% 50% * Highest indexed value. Not drawn to scale.
Figure 8. Heat map depicting traffic quality rates and indexed traffic volume around the world.
It is important to note that the ClearMark for Traffic model dynamically evolves to address the
changing nature of fraud. Although quarterly comparisons reflect the current makeup of the
Anchor Intelligence network, they may not be projectable to the industry as a whole.
7

8. ANCHOR INTELLIGENCE TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
CONCLUSION
During 2009, click fraud reemerged as a tremendous concern for the online advertising
industry: Microsoft filed multiple lawsuits against click fraud perpetrators and malvertisers;
Facebook became the subject of multiple click fraud lawsuits; and Anchor Intelligence
announced that it uncovered a massive click fraud ring operating primarily out of China.
Anchor Intelligence observed a general increase in the average attempted click fraud rate
during 2009 with a peak of 25.7% in Q4. Tried-and-true perpetration mechanisms grew in
popularity. Click fraud rings continued to exploit vulnerable networks by leveraging a growing
army of botnets. Botnets have become the fundamental means by which click fraudsters
automate invalid traffic, and their numbers show no signs of weakening. Furthermore, fraud-
sters sought to capitalize on the holiday ad spend by ramping up their activities. Finally, major
ad markets such as the U.S. and Canada continued to generate high rates of attempted click
fraud, even though the majority of concern over online security has historically centered on
Asia and Eastern Europe.
Over the course of 2009, Anchor saved advertisers approximately $35 million in potentially
wasted ad spend by identifying and removing click fraud from customers’ networks. Moreover,
by eliminating payouts to fraudulent perpetrators, Anchor reduced click fraud attempts for
customers as perpetrators sought more vulnerable networks to exploit.
8

9. ANCHOR INTELLIGENCE TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
2010 FORECAST
If the past year’s fraudulent activity in online advertising is indicative of fraudsters’ deviousness
and industriousness, click fraud attempts should prove even more pervasive in 2010. Anchor
Intelligence foresees the following traffic quality and security trends in online advertising in the
year ahead:
1. Click fraud attempts will increase in 2010. Botnets will continue to grow in size and scope
via social engineering attack vectors. As cybercriminals exploit the growth and adoption of
social networks such as Facebook and tools such as Twitter, the rate of social engineering
infections will increase. The proliferation of malware through social networks will almost
certainly lead to more zombies and botnets. As a result, attempted click fraud volumes will
likely increase.
2. The rate of adaptation for click fraud perpetrators will increase as never seen before.
Botnet infrastructure will become more flexible and resilient. By shifting from a centralized
hosting model to rely instead upon peer-to-peer technologies, distributed command and
control, and proxy redirection, botnets will become increasingly difficult to locate. Click
fraud perpetrators are likely to follow suit, making detection even more challenging in the
coming year.
3. The increasing use of shortened URLs such as bit.ly and tinyURL will create a hotbed for
malware distribution. Because shortened URLs mask the actual destination of a link,
fraudsters are able to disguise links users might otherwise avoid. As such, fraudsters are
likely to use more of these URLs to distribute malware and create more zombies, contribut-
ing to the increase in attempted click fraud in 2010.
4. Click fraud will be increasingly perpetrated by Macs and mobile phones. The notable
popularity of iPhones has already attracted the notice of malware authors and fraudsters.
As the market share of these devices continues to grow in 2010, more fraudsters will likely
turn them into zombies used to perpetrate click fraud.
5. Fraudulent advertisements will become a popular infection vector as advertisers are given
more control to create dynamic ad content via APIs. As a result, ad agencies will need to
intensify security measures to ensure that fraudulent orders are not placed on their behalf.
6. Search engines and ad networks will increasingly turn to third parties, like Anchor
Intelligence, for traffic certification. Ad sellers will become increasingly vigilant in their
efforts to ensure that advertisers are not being victimized and turn to specialists to better
manage their traffic quality and deliver more value to advertisers.
9

10. ANCHOR INTELLIGENCE TRAFFIC QUALITY REPORT: 2009 YEAR IN REVIEW
APPENDIX A: TERMINOLOGY
ClearMark scores the quality of each ad traffic event on a scale of 0.00 to 1.00, where 0.00 is the
lowest quality and 1.00 is the highest quality traffic. Based on a fixed threshold that differentiates
between valid and invalid traffic, ClearMark labels any ad traffic event that receives a score above
the threshold as valid and any event that receives a score at or below that threshold as invalid.
Valid traffic is defined as traffic that is generated by users with a legitimate interest in the ad or
link; conversely invalid traffic is defined as traffic generated by sources with no valid interest in
the ad or link. Invalid traffic consists of traffic from two sub-categories: attempted click fraud and
innocuous invalid.
All Traffic
Invalid Valid
Attempted Click Fraud Innocuous Invalid
Figure 9. Types of traffic according to quality.
Anchor Intelligence defines click fraud as the act of producing clicks or impressions that have no
economic value to the advertiser due to malicious intent on the part of the clicker. All click fraud
rates presented in this report represent attempted click fraud rates. It is important to recognize
that not all attempted click fraud, if any, is billed to the advertiser. An ad network that experi-
ences a 10% attempted click fraud rate but does not charge advertisers for any of these clicks
essentially has a 0% billed click fraud rate from the perspective of the advertiser. We do not
attempt to make any assertions about billed click fraud rates in this report.
Innocuous invalid traffic is defined as clicks or impressions that have no economic value to the
advertiser but are not generated with malicious intentions. Innocuous invalid traffic can be
produced by entities like crawlers, spiders, and robots, or by users who double click on ads.
APPENDIX B: METHODOLOGY
Anchor Intelligence analyzed traffic scores from ClearMark for Traffic’s global customer base
from each quarter of 2009. We then added up the different categories of traffic from each
customer and divided by the total volume of traffic to determine the rates for each traffic
category. Our results, reported above, are rounded to the nearest tenth of a percent.
10

11. Anchor Intelligence Inc., headquartered in Mountain View, CA, is the traffic quality solutions provider of
choice among ad networks, search engines, and advertisers from across the globe. Using Anchor
Intelligence's ClearMark, the industry's first and only real-time traffic scoring system, industry players
obtain the necessary intelligence to fight click and impression fraud, efficiently manage traffic sources, and
capitalize on high quality clicks while maximizing advertiser ROI.
www.anchorintelligence.com
480 San Antonio Road, Suite 235
Mountain View, CA 94040 For more information, email sales@anchorintelligence.com, or visit www.anchorintelligence.com.
© 2010 Anchor Intelligence, Inc. All rights reserved.