Nick Abe runs a small Android puzzle app called Dayzle. Two weeks of Google Ads on a CA$40-a-day budget produced 56 billed installs. When he went into the raw analytics, 33 of them did something no person does: opened the app once, spent zero seconds on any screen, and never came back — across 28 phone models in 19 states. The 13 installs that were actual people finished 92 puzzles between them. The 270-comment thread on Hacker News is where the practical detail lives: countermeasures, near-identical experiences at other budget sizes, and one question nobody could answer.

What the receipts show

  • The campaign goal was set to installs, with a CA$1.50 target cost per install. Google couldn’t find installs at that price, so Abe removed the target as a test — it immediately spent CA$80, double his daily budget, and reported 21 installs for the day. His own admin panel said 1.
  • The discrepancy had a mechanical cause: older app versions don’t report an install date. Raw analytics showed 21 new Android devices that day, 20 of them running a version the Play Store had stopped serving days earlier. You can’t download an old version from Play — yet every one of those phones reported Google Play as the installer.
  • Across the full two weeks: 56 installs billed, 33 matching that pattern, 7 from countries the campaign never targeted, and 13 real people.
  • The farm’s method, from Abe’s export: watch the shortest video in the ad group without clicking it, then install from a saved copy of the app file rather than from the store — faster, and less likely to be noticed.
  • That creates a self-reinforcing loop. Google counts a view followed by an install as a conversion, so the more the farm “installed,” the better the campaign looked to Google’s optimizer, which routed more of the budget to the farm.
  • What changed: the goal is now “won a puzzle” instead of “opened the app.” Getting a script to open an app and tap around is cheap; getting one to solve a Sudoku is not. Make yourself more expensive to farm than the next app. Google’s answer on the invalid-traffic form is still pending.

What the thread adds

  • phenomen — the concrete countermeasure. Google Ads → Admin → Account Settings → IP Exclusions, and block the whole network/datacenter range: “in 99% of cases, these bot networks are not run from residential providers.” They say their own exclusion list has grown past 4,000 networks in the US alone.
  • walrus01 — why that is only a partial fix: fraud actors now buy residential proxies in bulk, which is where all those trojan-infected home routers and smart TVs come in.
  • neom — twenty years in go-to-market. About $10,000 spent across Meta, Google, LinkedIn and X over three weeks: sub-one-second bounces around 0.7% on three of the four platforms, and Hotjar recording zero activity on 99% of the inbound traffic. LinkedIn still worked, it has just become expensive. They also cite more than 55% of Americans running ad blockers, roughly 40% globally.
  • kimi — the same experience on Reddit: $500 spent, every click inert, and two successive account reps vanishing when it was raised. Their summary: the AI “did target effectively — our wallet.”
  • yalok — ten years of small campaigns and a steadily rising bot share, with the escalation ladder spelled out: bots went from clicking ads, to installing, to opening the app once, to tapping through the first screens. The structural point is worse than the fraud: there is no process to report suspected bot traffic at scale, and fixing it runs against Google’s incentives unless competition forces it.
  • dangero — replying with the inversion of the story. Their AdMob account was banned for invalid traffic after they paid Google for ads, and the second appeal was only granted after a rep advised them to “take full responsibility for the IVT.”
  • yunusabd — the same story compressed into a joke that has been making the rounds: dev ships an app with AdMob integration, buys Google Ads for it, gets banned by AdMob for invalid traffic.
  • jwr and XCSme — two more advertisers who simply stopped: one wrote their own conversion tracking because they didn’t trust the platform’s numbers; the other reports 15 years without a positive return on any online platform.
  • blitzar — the line that lands the incentive: to a VC, all of this is just “installs.”

The question the thread kept asking

Abe’s subtitle promises to explain “how a bot farm gets paid.” The piece explains what the bots did and what he changed — it never explains the payoff, and the thread noticed. Three separate top-level comments ask it in three different ways: legonigel (“what is the incentive for the bot owners?”), kabes (“what’s in it for these bot networks, how do they get paid?”) and sspiff (“what’s the play for the farm operator?”). The answers offered are explicitly guesses — Sayrus reasons that the farm operator is also the party paid by Google to display the ad, and MyMemoryfails and superjan propose the same shape of theory. Across 270 comments, nobody demonstrated it.

That gap is the honest version of the story. A fraud market that pays its participants is assumed by everyone in the thread and explained by no one in it, which is the same hole Bob Hoffman poked at from the other direction in 2021: he argued that if state-sponsored hackers could get inside the NSA undetected, the software auditing a $300 billion ad marketplace could be fooled too — and that the numbers advertisers are handed are not auditable from outside. A commenter in this thread links that essay, and it is the five-year-old version of Abe’s complaint, argued from logic rather than a receipt.

Where the thread pushes back

  • Not everyone accepts the bleak reading. dave_sid (“Google ads are a con. Meta ads are a con.”) drew singingtoday’s counterexample of a customer making roughly $30,000 a month from Meta ads with a consultant running them, and G3nD asking whether every ecommerce brand is really just burning money.
  • rao-v asks the question aimed at Google rather than the farmers: “Isn’t this the sort of thing Google is supposed to be doing for us?”
  • Several commenters point out the post never shows the app it is about — pseudonymidy installed it after reading and played ten puzzles, and nickabe (Abe, the submitter) replies in the thread himself, thanking them and noting the upside of having no VC to spin the numbers for.

A note on reading comments as evidence: HN handles are pseudonymous and the site publishes no per-comment scores, so the ordering here is HN’s own ranking, not a vote. This is a slice of the thread, and the two theories about who gets paid are quoted as theories — not as findings.