How can we help?

How do you analyze IP addresses to detect click fraud?

We analyze IP addresses from multiple angles as a core component of our multi-layered fraud detection strategy.

An IP isn't just checked once; it's assessed based on its reputation, behavior, and connections to other data points. Our key checks include:

Reputation & Origin

Suspicious Networks: We identify if an IP belongs to a known data center, VPN, proxy, or Tor network, which are commonly used to hide a user's true identity.

Geographic Location: We verify if the IP's origin aligns with your campaign's geographic targeting and flag IPs from regions known for high levels of fraudulent activity.

Behavioral Analysis

Click Patterns & Velocity: We monitor for unnatural click frequency, such as an IP clicking the same ad repeatedly in a short period.

IP Range Analysis: We look for coordinated, non-human activity across entire blocks of related IP addresses, which can indicate a botnet attack.

Cross-Referencing

List Comparisons: Every IP is checked against our global threat database, as well as your own custom "Manual Exclusion List" and "Trusted IP Whitelist."

Device Linking: We use device fingerprinting to associate multiple IPs with a single device, catching fraudsters who try to switch networks to evade detection.

This comprehensive IP analysis, combined with dozens of other behavioral signals, allows us to accurately determine the legitimacy of traffic before using the IP address as the primary identifier for a block.