Didier Stevens, a security analyst for Contraste, recently ran a six-month ad campaign via Google Adwords in which Stevens tested the notion that some surfers will click virtually anything they come across, regardless of what the ad link promises to deliver.
The text of Stevens' ad asks the viewer “Is your PC virus-free?” followed by a line that reads, “Get it infected here!”
According to Stevens, the ad was displayed 259,723 times during the six month period, and was clicked on 409 times, for a click-through rate of 0.16 percent. The campaign cost Didier a total of $23, at a rate of $.06 per click — and per potentially exploited machine.
“I’m sure I could get much more traffic with a higher Google Adwords budget and a better designed ad,” Stevens wrote on his blog hosted by WordPress.com.
To execute his experimental keyword campaign, Stevens first registered the domain drive-by-download.info, reasoning that .info domains are “notorious for malware hosting.”
For the Adwords campaign, Stevens bid on several combinations of the words “drive by download,” and pointed the links at his .info domain, logging visits to a page that simply displayed the message “Thank your for your visit!!”
“I designed my ad to make it suspect, but even then it was accepted by Google without problem and I [have] no complaints to date,” Stevens said.
According to Stevens' log of user agent strings, 98 percent of those who clicked the ad were running Microsoft Windows, with 69.9 percent browsing via Internet Explorer 6.
Stevens said that while it might be tempting to conclude that the people who clicked the ad “were all stupid Windows users,” it’s not clear to him why anyone would click such a listing.
“[T]here is no way to know what motivated them to click on my ad,” Didier wrote. “I did not submit them to an IQ test.”