How to Detect Proxy-Driven Ad Fraud in Campaign Traffic

Detecting proxy traffic in ad campaigns means joining impression and click logs against a current dataset of known proxy IPs, then looking for concentrations — by placement, publisher, and geography — that ordinary audiences don't produce. The per-IP mechanics live in our proxy detection guide; this post is the campaign-level audit built on top of them.

Why does ad fraud run on proxies?

Because invalid traffic has to impersonate the audience the advertiser paid for, and proxies are how coordinated infrastructure buys that impersonation. A fraud operation generating traffic from a handful of servers would fail every targeting check at once: wrong geographies, absurd frequency per address, an ISP mix no real campaign delivers. Routed through rotating proxy exits, the same operation presents a believable spread of countries, consumer ISPs, and connection types — passing geo-targeting because the exits genuinely are where they claim, defeating frequency caps because addresses rotate, and diluting IP blocklists because no single address repeats enough to matter. The published framing is worth stating plainly: proxy use in invalid traffic is about plausibility, not just anonymity. The operation is not hiding — it is wearing a costume assembled from real consumer address space. Detection therefore hunts for the coordination artifacts underneath a plausible-looking surface, which is exactly what the audit below is structured to surface.

Which proxy types show up in ad traffic?

The full breakdown of how the three types differ — and why response policy should differ with them — is in residential vs datacenter vs mobile proxies.

How do you audit campaign traffic for proxy activity?

1. Export impression and click logs with IP, timestamp, placement, publisher, and declared geography.
2. Join against a recurring proxy dataset — weekly CSV/JSONL delivery is a realistic shape; each record carries ip, first_seen, last_seen, network_type, and confidence (field reference on the dataset schema page).
3. Segment the proxy-flagged share by confidence level, network type, and geography — a raw "percent flagged" number hides everything that matters.
4. Compare across placements, publishers, and supply paths — the structure of the comparison is the detector.
5. Investigate concentrations: placements whose proxy share stands far above the campaign's own baseline, especially where high-confidence and datacenter flags cluster.

What does a proxy concentration actually tell you?

Read concentrations against your own baselines, not against absolute thresholds. Every campaign carries some legitimate proxy traffic — corporate egress, privacy VPN users, mobile CGNAT — so the meaningful question is never "is the share above X percent?" but "why does this placement run several times the campaign's own baseline, and what kind of flags make up the difference?" Weight by evidence: low-confidence observations warrant scrutiny and continued measurement, while clusters of high-confidence, recently observed exits justify exclusion — the same graduated logic as low-confidence step-up and high-confidence blocking, translated into media buying. Check recency, because last_seen separates an active exit from historical noise that should have decayed. And keep the unit of decision at the placement and supply-path level, where patterns are statistical, rather than adjudicating single impressions. The output of reading concentrations this way is a decision you can explain — which placement, which addresses, what evidence, observed when — instead of a score someone has to take on faith.

How do you act on proxy findings before and after spend?

Pre-spend, findings steer the buying:

• Downrank or avoid proxy-heavy inventory before budget reaches it.
• Tighten supply paths where flags concentrate — fewer hops, known resellers.
• Feed placement-level findings into private-marketplace curation and allowlists.

Post-spend, findings become documentation:

• Attach proxy evidence per placement — specific addresses, network types, observation dates — to make-good conversations and dispute processes.
• Keep the evidence explainable; a claim backed by dated observations survives pushback that a black-box score does not.
• Track the same placements across deliveries to show persistence versus one-off noise.

How traffic-quality teams run this beside their existing measurement stack is on the ad-tech traffic quality workflows page.

Where does proxy detection fit among other IVT signals?

As one plane of evidence. Proxy status explains network origin — whether traffic reaches you through relaying infrastructure — but not intent: a human privacy enthusiast and a bot farm can share the same exit classification. Device fingerprinting, behavioral analysis, and viewability measurement answer the questions network data cannot, and the intent question specifically belongs to the bot-detection layer — the division of labor is mapped in bot detection vs proxy detection. And if your problem is click-level PPC fraud rather than programmatic IVT, the per-click enrichment workflow is the subject of click fraud detection with IP data.

Hunt coordination, not anonymity

Proxy-driven ad fraud succeeds by looking plausible, so the audit that catches it compares structure — placement against baseline, flags by confidence and network type, evidence by observation date. That is a weekly job with a joinable dataset, not a product mystery: the changelog documents how the underlying data is maintained, and a sample delivery lets you run the audit against your own campaign logs.