How do you detect data-centre traffic?

Visitor IP addresses registered to hosting and cloud companies. Paid visits recorded by the traffic source that produce no feed impressions at all. No variation in device type, with outdated or generic browser versions. Traffic that continues at a constant rate through the night.

How do you prevent data-centre traffic?

Block known hosting and cloud address ranges before the feed page loads. Compare visits you paid for with visits the feed counted; a large gap points to filtered traffic. Ask sources for a refund policy on invalid traffic and enforce it.

Data-centre traffic: how it works, warning signs and defences

Data-centre traffic

Visits come from rented servers in data centres, where programs run but people do not browse.

The short answer, from The Arbitrage Desk fraud map

How it works

Ordinary people reach the web through home broadband, mobile networks, offices and cafes. Servers in commercial data centres are where websites and software live. When "visitors" to a feed page come from server addresses, they are almost always programs.

Data-centre traffic is the cheapest fake traffic to make and the easiest to catch, because lists of data-centre address ranges are widely shared. Industry measurement rules class it as general invalid traffic (GIVT), the kind routine filters remove. It is still a problem when it is mixed thinly into good traffic or passes through VPN services real people also use.

Who pays for it

Advertisers, if it reaches the ads unfiltered. More often the arbitrageur pays: they bought the visits from a traffic source, the search engine filtered them and paid nothing.

Who does it, and why

Low-end traffic sellers and bot operators. Renting servers costs very little, so even a small share of unfiltered clicks is profitable.

Warning signs

Visitor IP addresses registered to hosting and cloud companies.
Paid visits recorded by the traffic source that produce no feed impressions at all.
No variation in device type, with outdated or generic browser versions.
Traffic that continues at a constant rate through the night.

Defences

Block known hosting and cloud address ranges before the feed page loads.
Compare visits you paid for with visits the feed counted; a large gap points to filtered traffic.
Ask sources for a refund policy on invalid traffic and enforce it.

An example

Illustrative: a buyer pays $50 for 10,000 "tier-1" visits at half a cent each. The feed records only 2,000 valid ad requests because 8,000 visits came from server addresses and were filtered. The real cost per valid visit is $50 ÷ 2,000 = 2.5 cents, five times the headline price, before counting the damage to the account's quality standing.

Documented cases

3ve ("Eve") (2018): Ad fraud run through malware-infected home computers and hijacked IP addresses