Why IP Blocking Alone Doesn't Stop Click Fraud

How Google Ads IP exclusions work

Google Ads lets advertisers exclude addresses from ad delivery. This is different from rejecting a request after a visitor has clicked and reached your website. A website control cannot retrospectively cancel an ad interaction or establish that Google will credit it. Decide which stage of the journey the intended rule addresses.

Account-level vs campaign-level exclusions

As checked on 7 October 2026, Google's documentation includes Performance Max in account-level IP exclusions. Campaign-level IP exclusions are not available for PMax and several other campaign types. Account and campaign lists are combined where both apply. Manage the rule at its actual level rather than assuming one campaign's setting covers the whole account.

Review IP exclusions in the wider PMax lead-quality investigation

Where IP blocking is genuinely useful

A stable address associated with internal tests or a documented repeated abuse pattern may justify an exclusion. State why the address is relevant, which campaigns or endpoints it affects and when it should expire. Compare downstream outcomes and genuine-user complaints before treating a fall in traffic as success.

Shared IP addresses

A single public IP can serve several unrelated users. A broad exclusion can remove prospects alongside unwanted traffic. Network ownership and address reputation provide context but do not identify the individual visitor. Review the scope of a block and avoid expanding from one session to a whole range without supporting evidence.

Mobile networks and NAT

Carrier and organisational address sharing can make several sessions appear to originate at one exit. A customer's exit address can also change. These network arrangements weaken one-IP-one-person assumptions in both positive identification and blocking. Use session continuity and outcome evidence to assess what the address can actually tell you.

Rotating proxies

Some proxy services change exit addresses between requests or sessions. A per-IP rule can miss a pattern spread across several exits. It can also group unrelated activity too aggressively if the exit is reused. Correlate repeated routes, timing and client observations, while keeping uncertainty about common control explicit.

Residential proxies

An exit associated with an ISP or mobile network can resemble an ordinary customer connection. That network classification does not establish human identity or fraud. Privacy services, testing and legitimate access can also use intermediaries. An IP label should start a contextual review, not become an automatic rejection rule.

Combine network observations with browser, behaviour and outcome signals

IPv4 and IPv6 considerations

Check which address versions appear in the relevant logs and which the exclusion interface accepts. Excluding one recorded address does not establish that all later requests from the same client will use it. Normalise addresses consistently in analysis and verify any wildcard or range syntax against the current platform documentation.

False-positive risk

Track accepted enquiries and customer access failures as well as rejected requests. Define an owner, review date and rollback condition for each rule. A decline in submissions can be the intended reduction in abuse or the unintended loss of demand; lead-quality follow-up helps distinguish those outcomes.

Measure the customer cost of a mistaken block

Multi-signal alternatives

Assess the campaign context, request sequence, client consistency and later business outcome together. Independent signals can make a decision more defensible, but still do not guarantee identification of the actor. Report which data were unavailable and which cases remain inconclusive.

Observe → rate-limit → challenge → block

This ladder describes possible website responses, not a menu of Google Ads exclusion features or a mandatory progression. Observe first where risk permits; stronger measures should match the evidence and operational cost. AdFraud.pl does not automatically maintain IP exclusions, alter campaigns or guarantee that rotating proxy traffic is stopped.

Review the evidence and false-positive risk before selecting a control