Pre-traffic fraud filter — the gatekeeper checklist

Pre-traffic fraud filter — the gatekeeper checklist

Build these filters before the first click, not after the first chargeback. Order them as pre-landing rules.

— Block datacenter and hosting ASNs. Real users do not browse from AWS or OVH ranges. Maintain an ASN blocklist as a reusable rule.
— Block known proxy and VPN exit ranges for offers that disallow them. Route to a blank, log the hit for your records.
— Set a click-frequency cap per IP per hour. Twenty clicks from one IP in ten minutes is not twenty users.
— Filter on user-agent. Block headless and outdated UA strings that signal bots, not browsers.
— Add a GEO mismatch rule. Traffic claiming a target GEO but routing through a non-target exit IP is a flag, not a sale.
— Log every block to a separate report. A spike in blocks on one zone or placement tells you where to cut spend before it hits your numbers.

Validation:
— Send a clean test click. Confirm it passes all gates.
— Spoof a datacenter IP. Confirm it is blocked and logged.

Fraud filters built after the loss are a postmortem. Built before traffic, they are insurance.

Save this SOP. Run this before every launch.