Traffic quality

Scoring events for bot and click-fraud signals before they reach an ad platform.

Not every conversion is a person. Bots, datacenter traffic, headless browsers and click farms all produce events that look real — and feeding them to an ad platform is worse than useless, because the platform optimizes toward finding more of them.

Every event is scored during enrichment, and the score can withhold delivery.

Scoring

Scoring is additive: each detected signal adds its weight, and the total is capped at 100. Several weak signals together can reach the same band as one strong signal, which is the intent — a datacenter IP alone is suspicious, a datacenter IP plus a header anomaly is not a coincidence.

ScoreBand
≥ 70Flagged
≥ 35Suspicious
below 35Clean

Weights

WeightSignals
60headless
50tor, ip_reputation, known_bot, no_click, bogon
40datacenter, geo_velocity
35proxy_vpn, proxy, header_anomaly
30click_velocity, duplicate_clickid
25fast_click, time_to_convert

A headless browser is the single strongest signal at 60 — real customers don’t run Puppeteer. Note that no single signal reaches the flagged band alone; flagging always takes corroboration.

Thresholds

Several detectors need a threshold, and these are the ones worth knowing because they explain false positives:

  • Duplicate click ID — the same click ID appearing across 3 or more persons. Two is plausible (a shared device, a forwarded link); three is a pattern.
  • Time to convert — a conversion less than 10 seconds after the click.
  • Geo velocity — location changes within a 1 hour window that no physical travel explains.
  • Fast click — a click under 800 ms after page load, faster than a human can read and decide.

Actions

A detection category maps to one of three actions:

  • ignore — score it, do nothing.
  • flag — deliver normally, but mark the event so it’s visible in reports.
  • suppresswithhold delivery entirely. The event is never offered to the platform and records a suppressed delivery status.

The default preset:

CategoryDefault action
Datacenter, proxy, reputation, bot, abusesuppress
Headless, velocity, behaviorflag

The split reflects confidence. Infrastructure signals — an IP that belongs to AWS, a known bot, a bad-reputation range — are close to unambiguous, so they’re withheld. Behavioral signals are inference about a human, so they’re surfaced for you to judge rather than acted on.

Strongest action wins. When several categories fire on one event, the harshest applies: any suppress makes the event suppressed, regardless of how many categories only wanted to flag.

Categories in the dashboard

Datacenter IPs · Proxy/VPN/Tor · Bad IP reputation · Known bots · Headless/header anomalies · Click velocity/fast clicks · Behavioral fraud · Click-ID abuse

Disabling detection does not stop scoring. It sets every action to ignore, so nothing is suppressed or flagged — but events are still scored and labelled, and the reports still populate.

That’s deliberate, and it makes turning detection off a safe diagnostic step. If you suspect legitimate conversions are being suppressed, disable it, confirm delivery recovers, and then read the scores that would have applied to see which category was responsible — instead of flying blind.

Suppressed conversions are never delivered and are not retried. If a misconfigured rule suppresses real traffic, those conversions do not reach your ad platforms and cannot be replayed later. Check the suppressed counts after changing any action.