Case: a click-filter rule cut a fraud source's spend and lifted account ROI 14%

Case: a click-filter rule cut a fraud source's spend and lifted account ROI 14%

The data: one pop source delivered 30% of an account's volume but converted at a third of the rate of every other source. Suspicious, but not obviously fraud.

The forensic steps:
1. Pulled the source's clicks and broke them down by ISP/connection type in the tracker
2. 41% came from datacenter ranges (Voluum's IP/UA enrichment flags these)
3. Datacenter clicks converted at 0.2%; residential from the same source at 3.1%
4. User-agent distribution was unnaturally narrow — one UA string held 60% of clicks

The distribution rule we built:
— Added a pre-lander filter: datacenter connection type → route to a blank page, not the offer
— Kept the residential traffic flowing to the offer
— Logged the filtered clicks separately so we could bill-dispute them

Outcome:
— Wasted spend on the offer dropped immediately
— The source's effective CR rose to match the others once garbage was filtered
— Account-wide ROI rose 14% in two weeks, and the click logs supported a partial refund claim

Don't blacklist a whole source on a hunch. Segment by connection type and user-agent, then filter the bad slice.

Save this SOP. Run this before every launch.