You open the report and see 4,000 clicks, a decent CTR and almost no conversions. Before you blame the offer or the creative, check who actually clicked. Part of any paid or free traffic is automated, and the only way to know how much is to read the click log.
This post lists nine signs of bot traffic you can spot with a click log and a spreadsheet. Each one comes with what it looks like in the data and how to check it. At the end there is a worked example of what bots cost you and a sensible way to start filtering them.
No single sign proves a click is a bot. A cluster of them does: lots of clicks and zero conversions from one network, many clicks from one IP, empty country or referrer, odd timing. Group the click log by ISP, country, browser and hour, look for groups that behave differently from the rest, then filter those groups gently and watch what changes.
Why bots end up in your stats
Bots arrive from several directions. Some are scrapers and monitoring tools that follow any link they find. Some are security scanners that open links to check them. Some are click farms or scripts that exist to burn your budget or fake an audience. Some are real people on VPNs and corporate proxies who look odd but are fine.
Whatever the source, the effect on you is the same. You pay for the click, it lands in your stats as a visitor, and your conversion rate, EPC and ROI all get worse than they really are. If you make decisions on these numbers, you may cut a good source because bots dragged its numbers down.
The nine signs below are ordered roughly from the easiest to check to the hardest. Open your click log in a tracker (or export it to a sheet) and go through them one by one.
Nine signs of bot traffic
1. Clicks with zero conversions from one ISP, ASN or data center
What it looks like in the click log. You sort clicks by provider and see one name with hundreds of clicks and not a single conversion, while other providers convert at a normal rate. Residential providers (the ones real people use at home) look different from hosting companies and cloud networks.
How to check. Group clicks by ISP or ASN, count clicks and conversions per group. A big group with no conversions is suspicious only if it is big enough: ten clicks with zero conversions say nothing, three hundred do. If the provider is a hosting or cloud company, real visitors are very unlikely.
2. Spikes in VPN or proxy share
What it looks like. The share of clicks flagged as VPN, proxy or Tor is stable most days, then jumps on one day or one campaign. Real audiences have a fairly steady share of VPN users. A sudden jump usually means a script routing through proxies.
How to check. Plot the VPN/proxy share per day and per traffic source. Compare the spike day with the days before it. If the jump comes from a single source or placement, look at the conversions from that slice. Keep in mind that some countries and some audiences use VPNs a lot, so compare a source with its own history, not with another audience.
3. Identical user agents or unknown browsers
What it looks like. Thousands of clicks share exactly the same user agent string, down to the minor version number. Or the log shows "unknown browser" and "unknown platform" for a visible chunk of clicks. Real traffic is a mix of devices and versions.
How to check. Group by user agent and by browser/platform. Sort by count. A single string with an unusually large share, or an old version nobody uses any more, deserves a closer look. Scripts often forget to look like a current browser.
4. Empty referrer where you'd expect one
What it looks like. If you buy traffic from a source that normally passes a referrer, and a large part of clicks arrives with none, something is off. Direct typed visits and some privacy settings also give an empty referrer, so the sign matters only against what is normal for your source.
How to check. Split clicks by "referrer present / empty" per source. Compare conversion rates of the two groups. If the empty group is large and never converts, it is worth separating.
5. Empty country or city
What it looks like. Rows where the country or city field is blank. Geo databases know almost every address used by real consumers, and gaps are more common for unusual or reserved ranges.
How to check. Filter the log by empty country, then by empty city. Count the clicks and look at what the same IPs do elsewhere in the log. A small share is normal noise. A visible share with zero activity afterwards is not.
6. Bursts of IPv6 addresses
What it looks like. Real mobile networks do send IPv6 traffic, so IPv6 on its own proves nothing. What stands out is a burst: many clicks in a short window from IPv6 addresses in the same range, in a country where your audience usually comes over IPv4.
How to check. Chart the IPv4/IPv6 share per hour. Check whether IPv6 clicks convert at a similar rate to IPv4 clicks from the same country and device type. If they do, leave them alone. If they behave very differently, treat the burst as a signal to combine with others.
7. Clicks at odd intervals or night spikes
What it looks like. Clicks that arrive at perfectly even intervals, or a wave of traffic at 3 a.m. local time for the audience you targeted. Humans click unevenly and follow daily rhythms.
How to check. Look at clicks per minute or per hour against the local time of the targeted country. Remember to read the time in the same time zone as your stats. A flat line at a strange hour, or a rigid pattern such as one click every few seconds, is worth investigating.
8. Many clicks from one IP
What it looks like. A single IP address appears dozens of times in a short period, on the same link, with no change in behaviour. Some real cases exist, such as an office or a mobile carrier sharing addresses, so look at how the clicks are spread over time.
How to check. Group by IP and sort by count. Take the top ten and look at them individually: provider, device, referrer, time between clicks. One address clicking many times in a row, with an identical device string, is far more likely a script than a household.
9. CTR far above normal with no engagement
What it looks like. A placement with a click rate several times above anything else you run, while time on the landing page, scroll depth, form starts and conversions stay flat. Good creatives raise both clicks and results. Bots raise only clicks.
How to check. Put the click rate next to a downstream metric (lead, registration, deposit, any event you track) for each placement or sub-ID. Look for the placements where the first number goes up and the second does not.
Combine the signs before you act
Each sign has innocent explanations. VPN users exist, corporate networks share IPs, privacy settings strip referrers. What you are looking for is overlap: a slice of traffic that is, say, a hosting provider, with an empty referrer, an unusual user agent and no conversions. The more signals match, the safer it is to treat that slice as automated.
| Slice of traffic | Clicks | Conversions | Signs present | Verdict |
|---|---|---|---|---|
| Home ISPs, mixed devices | 2,600 | 52 | none | Keep |
| One hosting provider | 900 | 0 | data center, one user agent | Filter |
| Empty referrer, IPv6, night hours | 300 | 1 | three signs | Watch, then filter |
| VPN users from your top country | 200 | 6 | VPN only | Keep |
The numbers above are hypothetical, but the logic is the one to follow. Filter the slices with several signs and no results. Leave the slices that have one innocent sign and still convert.
What bot clicks cost you
Say you buy 10,000 clicks at $0.10, so you spend $1,000. Your offer pays $20 per conversion. On clean traffic you would expect 1% to convert, which is 100 conversions and $2,000 of revenue.
Now suppose 2,000 of those clicks are bots (again, a hypothetical number). The 8,000 real clicks still convert at 1%, so you get 80 conversions and $1,600. Your stats, though, show 10,000 clicks and 80 conversions, a 0.8% rate. You paid for 2,000 clicks that could never convert, which is $200 of wasted budget.
The bigger damage comes later. If you read 0.8% as the true rate, you may pause a source that actually performs at 1%, or bid too low for the placements that deliver real people. The direct cost is the $200. The cost of decisions made on bad data can be higher, and it is harder to see.
To estimate your own number, take the clicks from the slices you marked as suspicious, multiply by your cost per click, and compare with the revenue those slices produced. In the TDS.SO tracker (currently in beta) revenue counts approved conversions and cost counts all clicks, so bot clicks show up as cost with no revenue behind them.
What to do about it
- Read the log first. Go through the nine signs on one week of data and write down which slices look wrong.
- Start with a mild filter level. A standard level catches the obvious cases. A stricter level catches more but has a higher chance of stopping real visitors, so move up one step at a time.
- Watch the log after each change. Filtered clicks stay in the log with the reason (vpn, datacenter, suspicious headers and so on), so you can see exactly what was stopped and reverse the decision if you see real buyers in there.
- Send filtered clicks to a page you set. They do not reach your offer, and you do not pay the cost of showing it to a script.
- Re-check conversions. After a week compare conversion rate and EPC before and after. If they improved and conversions did not drop, the filter did its job.
TDS.SO has filter levels Off, Standard, High, JavaScript (a browser check) and Custom. In Custom you tick the signals you want: unknown platform, unknown browser, empty country, empty city, IPv6, data centers, VPN and empty referrer. There is also a setting that treats the first N clicks as bots, and a quarantine that applies for N minutes after the first bot is detected. Details are on the bot protection page and the traffic filtering page.
If you are deciding between checking the browser and blocking by address, read JS fingerprint vs IP blocking. And if your problem is clicks inside an email campaign, there is a separate case with its own signs in email scanner clicks.
FAQ
How do I know if a click is a bot or a real person?
You usually cannot know for one click. You can judge groups of clicks. Compare how a group behaves (conversions, time spent, timing) with the rest of your traffic and look for several signs at once.
What share of my traffic is bots?
It depends on the source, the geo and the format, and there is no honest universal figure. Measure your own: tag the suspicious slices in your click log and divide by total clicks.
Will filtering bots block real customers?
A strict filter can. That is why you start at a mild level, keep filtered clicks in the log with the reason, and check whether the stopped clicks ever turned into conversions elsewhere.
Is traffic from a VPN always bot traffic?
No. Plenty of real users run VPNs. Treat VPN as one signal and combine it with others, or filter it only where it clearly correlates with zero conversions.
Do I need a tracker to find bots?
You need a click log with ISP, country, device, referrer and time for each click. Any tracker or cloud TDS that records these fields will do.
If you want to apply this to your own traffic, the bot protection in TDS.SO lets you set a level, see every filtered click with its reason and send those clicks to a page you choose.
Guides and write-ups on routing, bot filtering and tracking from the TDS.SO team.
All articles by the author