Tracking · AdsIn productionNDA
Finding the paid clicks that were never human.
The client was spending heavily on Google Ads and watching traffic rise while conversions stayed flat. A large share of the paid clicks were bots, competitors and click farms — and nothing in the ad platform could tell them apart from real customers.
- Category
- Tracking · Ads · Security
- Result
- −40% ad waste
- Scoring
- Real time
- Status
- In production
The problem
Rising traffic, flat conversions.
Paid traffic was climbing month over month, but conversions were not moving with it. The money was going somewhere, and it was not going to customers.
The ad platform's own invalid-click filtering caught the obvious cases and missed the sophisticated ones — the traffic that looked human enough to bill for.
Without independent measurement, there was no way to argue for a refund or to move budget away from the sources that were being drained.
The hard parts
Why detection is hard.
- Sophisticated bots run real browsers and are indistinguishable from users on any single signal
- Decisions have to be made in real time, before the click is paid for or acted on
- Fingerprints have to survive cleared cookies, rotated IPs and private browsing
- False positives block real customers, so the scoring has to be conservative and explainable
- The scale of clicks makes storing and querying every signal a problem in itself
Architecture
Signals to decision.
- 01collectA lightweight script gathers browser, device and behavioural signals on each click
- 02fingerprintSignals are combined into a stable fingerprint that survives cookie clearing
- 03enrichNetwork and IP reputation data is added to the raw client signals
- 04scoreA scoring model rates each click's likelihood of being genuine in real time
- 05actHigh-risk clicks are flagged, blocked or fed back to the ad platform
- 06storeEvery click and its signals are stored for auditing and dispute evidence
- 07reportDashboards show flagged traffic, patterns and recovered spend over time
Stack
- Laravel
- JavaScript
- MongoDB
- Fingerprinting
- Google Ads API
- Redis
What shipped
What it does.
- Fingerprints every paid click across browser, device and network signals
- Scores each click for fraud risk in real time, before budget is wasted
- Feeds high-risk IPs and patterns back to Google Ads to exclude them
- Keeps a full audit trail of flagged traffic as evidence for refund disputes
- Surfaces fraud patterns and recovered spend in a reporting dashboard
- Runs conservatively so genuine customers are never blocked from converting
Result
−40%
Average reduction in wasted ad spend
Budget moved to traffic that could convert.
Wasted ad spend dropped by around 40% on average, as fraudulent sources were identified and excluded from campaigns.
The same budget started reaching more real people, so conversions improved without the client spending an extra rupee.
The audit trail turned invalid-traffic disputes from guesswork into evidence, and gave the team a clear view of where their money had actually been going.
Next step