You ordered traffic, received a beautiful report with CTR and conversions — but no sales. This is a familiar situation for marketers and buyers who pay contractors for clicks or installs. The problem is that fraudulent traffic visually differs little from real traffic when looking only at the numbers in the dashboard. Below are 6 practical measurements that will help catch bots before the budget is drained.
Why Contractors Deliver Bots and Why It's Dangerous
Fraud in traffic is not always malicious intent from the contractor. Sometimes they purchase traffic from subcontractors and are unaware that part of the volume consists of bots. However, the outcome for the client is the same: money spent, but no business results. This is particularly acute in arbitrage, where clicks are paid for in Facebook Ads or TikTok Ads, and in e-commerce, when traffic is paid for product cards on Wildberries or Ozon.
The main motives for inflating traffic: the contractor is paid for volume (clicks, installs, visits), not for real results, so it is beneficial for them to drive cheap traffic through data centers, emulators, or device farms. Often, such traffic simulates the required geo through ordinary cheap proxies, but upon detailed inspection, discrepancies arise: IP from one country, browser timezone from another, system language from a third.
The consequences for the client: drained budget, distorted analytics (decisions are made based on fake metrics), and in arbitrage — the risk of account suspension due to abnormal activity. Therefore, checking traffic by geo is not a formality, but a direct protection of the budget.
Measurement 1: Checking IP and Geo Match with the Terms of Reference
The first and simplest measurement is to extract the IP addresses of visitors from the website logs or tracker (Keitaro, Binom, RedTrack) and run them through geolocation databases (MaxMind, IP2Location, ipinfo.io). The task is to compare the declared geo in the Terms of Reference with the actual geo of the IP addresses.
What to specifically look for:
- The share of IPs identified as "datacenter" or "hosting" in the databases — for real traffic, this is usually no more than 3-5%; if above 15% — a clear sign of inflation through server proxies;
- Clustering of IPs — if hundreds of visits come from neighboring subnets of one provider within a short window, this resembles a farm;
- Country matches the Terms of Reference, but region/city does not — often bots are driven through cheap proxies that provide the correct country but an arbitrary city.
An important nuance: quality residential traffic can also concentrate in large cities — this is normal. Suspicion should arise from the combination of signs, not just one indicator.
Measurement 2: Analyzing Devices and User-Agent
The second measurement involves analyzing User-Agent strings and device parameters from analytics (Google Analytics, Yandex.Metrica, internal app analytics). Bots often use outdated versions of browsers, identical screen resolutions, or even headless browsers without JS rendering.
Signs to pay attention to:
| Parameter | Real Traffic | Bot Indicator |
|---|---|---|
| Device Variety | 10-20 different models per 1000 visits | 90% of traffic from 1-2 device models |
| Screen Resolution | Variety of values | Same resolution for most visits |
| Browser/OS Version | Mostly current versions | Massively outdated versions (2-3 years) |
| JS/Canvas Support | Full support, rendering occurs | Lack of fingerprint data, rendering errors |
SMM specialists and arbitrageurs who test creatives through anti-detect browsers (Dolphin Anty, AdsPower, Multilogin) know: even when emulating a device, the profile should appear diverse. If the contractor sends traffic with homogeneous fingerprint parameters — this is a signal to manually check the source.
Measurement 3: Behavioral Metrics on the Site
The third measurement involves behavioral analytics: time on page, depth of view, bounce rate, path through the site. Bots either enter and exit immediately (bounce rate close to 100%, session time less than 2-3 seconds), or conversely — demonstrate unnaturally perfect behavior: the same time on each page, the same click path without variability.
A practical method: export a segment of traffic from Google Analytics or Yandex.Metrica for a specific contractor (via UTM tags) for 7-14 days and compare it with a control group — traffic from other sources to the same page. If benchmarks differ significantly (e.g., average session time 3 seconds versus 45 seconds for organic), this is a reason for detailed analysis.
It is also important to look at conversions for the target action — adding to cart, subscription, app installation. A high CTR with almost zero conversion for the target action is a classic pattern of bot traffic, especially in Google Ads and Yandex.Direct campaigns, where payment is made per click.
Measurement 4: Cross-Referencing Advertising Platform Data with Analytics
The fourth measurement is cross-referencing numbers. The contractor shows a report from their advertising cabinet (Facebook Ads Manager, TikTok Ads Manager), and you compare these numbers with independent analytics on your side — Google Analytics, your own tracker, or server logs.
A normal difference between clicks in the advertising cabinet and visits in analytics is 5-15% (due to ad blockers, differences in click accounting, and technical delays). If the difference reaches 40-60% — this means that part of the "clicks" for which you are paying physically do not reach the site or do not initiate page loading, which is typical for click bots.
For arbitrageurs who purchase traffic themselves and resell it to clients, this measurement is especially important: it is at this stage that clients most often catch dishonest buyers. It is recommended to perform such cross-checks weekly, not just at the end of the reporting period.
Measurement 5: Test Purchase through Proxy of the Required Geo
The fifth measurement is the most indicative but requires preparation. The essence: you emulate an "ideal" user from the target geo through a proxy and go through the entire path — from clicking on the ad to the target action — and then compare the system's behavior (ad display, retargeting, pixels) with what the real audience sees.
For this, you need proxies from the exact region specified in the Terms of Reference to the contractor. If the campaign is targeted at the USA, and you are physically in another country, a regular VPN will not work — it is easily detected by advertising platforms. Here, residential proxies come to the rescue — they use real IPs from home providers in the required country, so they appear as ordinary users, not as bots or data centers.
Step-by-step, it looks like this:
- Set up a profile in an anti-detect browser (Dolphin Anty, AdsPower, or GoLogin) with timezone, language, and geolocation substitution for the target country;
- Connect the residential proxy of the required region in the profile settings — SOCKS5 or HTTP, depending on what the browser supports;
- Access the landing page through the ad or the direct link used by the contractor;
- Record loading time, pixel behavior, retargeting triggers, and compare with the metrics that the contractor sends for the same period.
If the contractor drives traffic from mobile devices (which is a common case for TikTok Ads and Instagram), for maximum test reliability, it is better to use mobile proxies — they correspond to the IP addresses of real cellular operators and allow you to see the campaign exactly as a live user with a phone sees it.
Measurement 6: Anti-Fraud Services and Manual Verification
The sixth measurement involves connecting specialized anti-fraud tools: Fraudlogix, Anura, TrafficGuard, Voluum with an anti-fraud module, or built-in solutions within trackers. These services automatically analyze clicks for signs of bots: click speed after display, pattern repetition, fingerprint matching with known fraud databases.
For e-commerce and marketplaces (Wildberries, Ozon, Avito), a similar role is played by manual verification through random calls/order checks — if paid traffic generates orders, but the refusal rate is abnormally high, this is also an indirect sign of traffic inflation on the product card for artificial ranking in search results.
The table below summarizes all 6 measurements and tools for each:
| No. | Measurement | Tool |
|---|---|---|
| 1 | IP and Geo | MaxMind, ipinfo.io, Keitaro |
| 2 | Devices and UA | Google Analytics, internal analytics |
| 3 | Behavior | Yandex.Metrica, GA4, webvisor |
| 4 | Cross-Referencing with Advertising Cabinet | Facebook Ads Manager, TikTok Ads, tracker |
| 5 | Test Purchase | Dolphin Anty + residential/mobile proxies |
| 6 | Anti-Fraud Services | Fraudlogix, Anura, Voluum anti-fraud |
Contractor Verification Checklist for 1 Day
If you need to make a quick decision — whether to continue working with the contractor or not — use this compact checklist:
- Extracted IPs for the last 3-7 days, checked the share of datacenter/hosting IPs (norm — up to 5-7%);
- Checked the variety of devices and OS versions — looking for any abnormal uniformity;
- Compared session time and bounce rate with a control group of traffic from other sources;
- Cross-referenced the number of clicks in the contractor's advertising cabinet with visits in your own analytics — the difference should be no more than 15%;
- Conducted a test visit through a residential or mobile proxy of the target geo and recorded pixel behavior;
- Ran a sample of clicks through an anti-fraud service and obtained the percentage of suspicious traffic.
If there are clear deviations from the norm in 3 or more points — this is sufficient grounds for pausing the campaign and having a direct conversation with the contractor with numbers in hand, rather than just a feeling that "something is wrong."
Conclusion
Checking traffic for bots is not a one-time action, but a regular practice, especially if budgets for contractors amount to hundreds of thousands of rubles per month. The six measurements — geo and IP, devices, behavior, cross-referencing with the advertising cabinet, test purchases, and anti-fraud services — cover the main patterns of traffic inflation and provide an objective picture instead of guesses.
For test purchases and testing advertising campaigns from different geos, we recommend using residential proxies — they provide the most realistic picture of how the campaign is seen by a live user. If you are testing mobile traffic and applications, consider mobile proxies, and for large-scale automated checks of a large number of links, fast data center proxies are suitable — they are cheaper per volume and handle technical checks well, where maximum masking is not critical.