If you’re wondering what IP quality is, chances are you come from either India, USA or the UK, as these are the regions that rank highest on the search term “IP Quality” according to Google Trends (see image below). It is not just Google that illustrated the popularity of this topic; IP quality is one of the most popular pages on our mobile ad fraud online glossary. As a clear subject of interest of our readers and customers, we decided to deep dive into exactly what is IP quality and how it contributes to mobile ad fraud prevention.
In case you’re wondering about the above image, it is what somebody probably sees if they have prosopagnosia or ‘facial blindness.’ This is when you can see everything perfectly, except for human faces. Prosopagnosia is a great metaphor for IP quality, as the IPs location, which is a vital piece of information, much like the human face, is a mystery.
According to Google Trends, these are the countries with the highest interest in the search term: IP Quality.
IP quality is a term used to refer to the credibility/standard of an IP or group of IPs. The two most common terms of evaluation will be ‘high IP quality’ and low ‘IP quality.’
In the context of mobile ad fraud, IP quality is a term that can be used to describe individual clicks or installs from one IP or a group of clicks and installs from an ad network of sub-publisher.
Usually, an IP is determined to have a low IP quality if it is an anonymous IP. Anonymous IPs can be created via the use of Hosting Provider Servers, VPNs and Tor Exit Nodes, etc. VPN usage is generally worrisome and indicative of ad fraud; however, not always in certain cases, whereas usage of hosting server providers and Tor Exit Nodes are always worrisome and indicative of ad fraud. Most fraudsters attempt to disguise their footprints via the use of anonymous IPs. Fortunately, this kind of ad fraud can be easily detected on click level. Thus, this data-points contribute to our mobile ad fraud prevention capabilities.
So, what exactly does this mean? Getting a lot of clicks or installs from a sub-publisher or ad network that may have a certain percentage of anonymous IP or more IP ratio points to that ad network or sub-publisher having low IP quality.
Does Low IP Quality Translate to Mobile Ad Fraud?
In a word, no. Is the use of anonymous IP criminal or illegal? No. Is using an anonymous IP correlated to ad fraud? Yes. However, this act alone is not an indication of ad fraud, criminality or illegal activity. This is merely a technique that can be used for a variety of illegal and legal purposes. For example, many people surf the internet using VPNs to protect their security or privacy. Companies and corporations often use their own intranet or VPN to keep sensitive data encrypted or secure.
There are also many reasons why an anonymous IP would be used for illegal purposes, such as disguising the footprints of illegal online activity, such as illegal purchases, mobile ad fraud, scams or any other kind of illegal activity. However, there is a positive correlation between mobile ad fraud and low IP quality or anonymous IPs, as many fraudsters use anonymous IPs to disguise their fraudulent activity. For this reason, IP quality is relevant to whether a click or install is blocked or allowed by our mobile ad fraud prevention tool.
Just like money, IP quality is not inherently bad or illegal; however, it can be used for either positive or negative purposes.
How IP Quality is Related to Your Ad Campaigns
IP quality is one of the data-points we use to detect potential mobile ad fraud. Thus, IP quality is related to the performance of your advertising campaigns, your KPIs and budget spent. We have a deterministic approach to IP quality and have the deterministic IP quality rule (more on that below). We block at the click level, and IP quality can also have a bearing on whether sub-publishers are blacklisted. What does this mean, and how is this done?
Interceptd Uses IP Quality to Prevent Mobile Ad Fraud
Anonymous IPs are Blocked on Click Level
Any anonymous IP clicks that come from Tor Exit Nodes or Hosting Provider Servers are automatically clickers before the install. That is because these types of anonymous IPs are mostly used by fraudsters and are very rare. As a default setting, VPN anonymous IPs are automatically blocked. However, this can be turned off and is recommended for some apps that have a high level of VPN usage among their users. Examples with high VPN usage are betting content and VPN based apps.
Summary/
Tor Exit Node + Hosting Provider Server anonymous clicks = BLOCKED
VPN anonymous click = by default BLOCKED
Low IP Quality Sub-Publishers are Blacklisted
A sub-publisher will also automatically be blacklisted if it has a high anonymous IP ratio, above a certain threshold. Once blacklisted, all clicks from that sub-publisher will be blocked, and all previous installs will be “flagged.” Flagged installs are those that are potentially fraudulent, however, already paid for/occurred. The customer can then ask for a refund for those installs from the ad network.
What are flagged installs? These are installs that occurred; however, we account them as fraudulent. Thus, those installs should be reported to your ad network, and a refund should be requested. Why don’t we block instead of flag? Sometimes, enough data and information are not present. Thus, our algorithms and machine learning technology must wait for further information before concluding that a sub-publisher, click or install is fraudulent. If our algorithms are programmed to make early decisions, this will result in over-blocking and will inhibit our customer’s ability to reach their UA KPIs.
Summary/ sub-publishers with a high anonymous IP ratio = blacklisted
What are Probabilistic vs. Deterministic Rules
Probabilistic rules are rules that once triggered, suggest fraud. However, they do not automatically block. Basically, they suggest “hmmm, maybe fraud, let’s watch this further” until it becomes “this can’t be real.” rather than, “YES, this is fraud, block now!”
Deterministic rules are those that have set rules, that once triggered either result in a blocked click, or blacklisted sub-publisher. These rules are reserved for well-known incidences of ad fraud. An example is Tor Exit Nodes, which are always indicative of ad fraud, and thus, are blocked.
Not all Anonymous IP Use is Bad
However, not all use of anonymous IPs is an indication of ad fraud or illegal activity. For example, a VPN app would expect to see higher downloads from anonymous VPN IPs. Thus, it is important to be wary of IP quality; however, not treat it as an absolute indicator of ad fraud.
As ad fraud is a complex web of technology, patterns, and methods, there is no “one size fits all” approach to catching fraud. Therefore, it is not recommended only to use deterministic rules to detect and prevent ad fraud. That would result in over-blocking. It is a common complaint in the industry, as many third-party ad fraud prevention tools either under or over block.
Instead, Interceptd uses a combination of probabilistic and deterministic rules to detect and prevent numerous kinds and methods of mobile ad fraud, live, in the redirection path.
Conclusion
Mobile ad fraud prevention is a complex topic. We hope we enlightened you as to what is IP quality. It is imperative to understand the role of IP quality when dealing with mobile ad fraud. We can expect to see some IP quality use. However, when the rate of IP quality use exceeds our expected levels, it will trigger our probabilistic IP quality alarm and potentially block that click or sub-publisher. IP quality is just one of the many data-points we analyze, in a matter of milliseconds, before determining if we block, or allow that click or install.
