Last updated: 21 May 2025
Many advertisers believe blocking suspicious IP addresses will protect their ad spend from click fraud. While the logic seems sound, this approach doesn’t hold up against modern fraud tactics. Here’s why IP blocking fails — and what works instead.
What is click fraud?
Click fraud occurs when website and app publishers generate fake clicks on ads to boost revenue. A typical scam might look like this:
- A fraudster creates a website and signs up as a publisher on ad networks such as Google Ads, Microsoft Ads, and Meta Ads. Once approved, they can display legitimate ads on their fraudulent website.
- Instead of waiting for genuine visitors to click on the ads, they use bots to simulate human behaviour and generate fake clicks.
- Advertisers are charged for each click, leading to wasted spend, fake leads, and bogus add-to-carts.
You can read more in our full article: What is click fraud?
Why don’t ad networks stop this?
Despite having the tools to detect fraud, most ad networks fail to act decisively.
Why? Because they earn money from every click—whether it comes from a real user or a bot. With little financial incentive to address the problem, many ad networks do the bare minimum.
Why IP address blocking doesn’t work
Modern bots are sophisticated. They rotate through residential and mobile IP addresses to disguise their true origins, which are often servers linked to spam activity.
- Over 80% of fraudulent IP addresses are only used once, making them impossible to block effectively.
- Google Ads’ 500-IP address block limit barely makes a dent in the billions of possible IPs—like trying to guess lottery numbers.
- Blocking IPs could result in entire subnets being blocked.
- Overall, IP address blocking catches less than 1% of click fraud, offering false security and leaving the vast majority undetected.
A better approach
Polygraph’s system goes beyond basic IP address blocking with a layered defence strategy:
- Bot Detection: Identifies advanced bots missed by ad networks, even those mimicking human users.
- Bot Disabling: Instantly blocks these bots to prevent fake leads, spam sign-ups, and fraudulent add-to-carts.
- Ad Network Retraining: Helps your ad platforms learn to prioritise real human traffic over bots.
- Negative Audiences: Automatically compiles device lists that prevent bots from seeing your ads.
- Refund Support: Provides evidence to help you reclaim ad spend lost to fraud.
In summary
IP blocking fails to stop 99% of click fraud. To properly defend your campaigns, you need:
- Accurate bot detection
- Real-time bot blocking
- Retraining of ad networks to improve traffic quality
- Audience exclusions to block bots from seeing ads
- Detailed fraud data for refund claims
A multi-layered system is the only reliable way to protect your advertising from modern click fraud.