ClickSambo uses IP addresses as a core element for click fraud detection, analyzing them in multiple ways:
Geographical Location: Checks if the IP's origin matches targeting or comes from high-fraud regions.
Suspicious Networks: Identifies if the IP belongs to known VPNs, proxies, or Tor networks.
Click Patterns: Monitors unusual click frequency and rapid clicks from a single IP.
Device Linking: Links multiple IPs to the same device using device signatures.
List Comparisons: Compares IPs against Manual Exclusion List, Trusted IP Whitelist, and suspicious lists.
IP Range Analysis: Detects coordinated fraud across entire IP ranges.
Basis for Blocking: The IP address is the primary identifier for applying blocking actions.
This comprehensive approach combines IP checks with other user behavior signals to determine traffic legitimacy.