Checklist: Pre-router fraud filter — block junk before it picks an offer

Checklist: Pre-router fraud filter — block junk before it picks an offer
Filtering after routing burns advertiser caps on garbage. Filter at the door.

☐ Block datacenter IPs (non-residential ASN ranges) unless an offer allows them
☐ Block known proxy/VPN ranges where offers forbid them
☐ Block empty or bot user-agents (curl, headless, no-UA)
☐ Block geo-IP that contradicts the click's claimed parameters
☐ Rate-limit clicks per IP (e.g., >10/min = suspicious)
☐ Block repeated identical fingerprints inside the dedup window
☐ Route filtered traffic to a logging endpoint, not your offers

Don't hard-drop filtered clicks blindly — log them so you can prove traffic quality to advertisers later.

A filtered click that never touched an offer can't trigger a scrub or a ban.

Review filter hit rates weekly; a sudden spike means a source went bad.