We spent years building a product meant to catch fraudulent clicks on Google Ads campaigns, and one rule stands out as the kind we would design in on day one rather than rediscover later: when does one bad IP address become a whole blocked range?
Here is the short version. Google Ads caps each campaign at 500 excluded IP addresses. Near that cap, an asterisk for the last three digits excludes a whole block at once. We only use that shortcut inside confirmed data center or cloud ranges, never residential ones.
Before you touch the list
- Pull the addresses that clicked more than once with no conversion or real engagement after.
- Confirm the network before collapsing anything into a range: data center or cloud host only, never residential.
- Prune entries that stopped mattering so the list stays worth reading.
An exclusion list near its cap
Example- An exclusion list fills up fast if you only ever block one address at a time.
- That is the whole test before a range gets touched.
Cap: 500 excluded IP addresses per campaign
Data center or cloud range
One range
- Blank card
- Blank card
Only where a lookup proves the network
Residential range
- Blank card
- Blank card
Block one address at a time
Why one bad address is rarely the real signal
A single IP address showing up twice in a campaign's click log feels like an easy call. It is not, by itself. Home networks reassign addresses, and an office sits behind one shared address for every employee. A mobile carrier can route a wave of ordinary phones through the same gateway on a given afternoon. Treat any one of those as a verdict and the exclusion list starts blocking real customers instead of bad ones. That is the cost of moving too fast on a single data point. And "no conversion" only counts as a signal if conversion tracking records in the first place, so check that the tracking works before you trust any zero.
-
Home network What it looks like Addresses get reassigned
Home network Why it is not a verdict Each one is a reason to look closer -
Office What it looks like One address for every employee
Office Why it is not a verdict The block comes after a few of those line up -
Mobile carrier What it looks like Many phones, one gateway
Mobile carrier Why it is not a verdict No single signal earns a block on its own -
No conversion What it looks like No conversion recorded
No conversion Why it is not a verdict A zero needs working tracking behind it
An example. Tap a card.
The product we built years ago was designed around that problem. It never leaned on one signal to call a click fraudulent. It combined public network data with plain common sense, looking at several angles at once rather than trusting any one alone. No single answer settled it. Only the pattern across several did.
No single number ever got a click labeled fraudulent. It took several signals pointing the same direction before we trusted the call.
Where we draw the line on collapsing ranges
The rule we settled on for the Google Ads accounts we manage is narrow on purpose. Collapse a run of addresses into one range only when a lookup confirms the whole range belongs to a data center or a cloud host, with no residential customers anywhere in it. A range like that carries little collateral cost: no household connection sits in it, though a few real people do browse through virtual private networks, privacy relays or office gateways hosted on those networks. That is the whole test before a range gets touched.
Residential ranges do not get the same treatment, even when a few addresses inside one have already misbehaved. An internet provider hands residential addresses out and takes them back constantly, so a range that looks bad this month can belong to an entirely different household next month. Collapse it anyway and the exclusion stops being about fraud. It becomes about blocking whoever gets that address next.
-
Who sits behind it
Residential range
Households and offices, often many people behind one address.
Data center or cloud range
Servers and hosted services, with no household connections in the range.
-
What we block
Residential range
One address at a time, and only when the case is strong.
Data center or cloud range
The whole range, once a lookup confirms the network.
-
Cost of a mistake
Residential range
A household that was never the problem stops seeing your ads.
Data center or cloud range
Small: a few people on private networks, privacy relays or office gateways may be caught.
How we review an exclusion list before adding to it
-
Pull the repeat offenders
Anything that clicked more than once with no conversion and no real engagement afterward.
-
Check what kind of network it sits on
A public lookup at a regional internet registry shows whether the address or range sits on a data center, a cloud host, or a residential provider.
-
Collapse only the confirmed non-residential ranges
Write the range down with the reason, so the next person reviewing the list does not have to rediscover it.
-
Leave residential addresses individual
Block a single address if the case is strong; never assume its neighbors in the range are guilty too.
-
Prune entries that stopped mattering
An address or range with no recent activity is not helping the account; remove it and keep the list readable.
The feature we planned to turn refunds into verdicts
That caution came from a habit we built into the product: collect every data point available, even the ones with no obvious use yet, because a later audit sometimes finds a use for data nobody understood the point of when it was captured. Pattern matching only works if there is enough of a pattern to match against.
One feature was on the roadmap from the start for exactly that reason. The plan was to point people toward the right place to ask Google for a refund on fraudulent clicks, backed by a report specific enough to be hard to argue with. On paper that looked like a plain customer benefit. The deeper design reason: a refund Google approves is about as close to a confirmed verdict on a click as we are ever going to get, and the feature was meant to feed that verdict straight back into how the next borderline click gets judged. Google already filters invalid traffic with automated filters and manual reviews, and credits some invalid clicks it only catches later, per its help page on invalid traffic, so an approved refund is Google's own verdict on that click.
We carry that same habit into how we think about paid search work now: build the exclusion list carefully, and reserve range collapsing for data centers and cloud hosts.
Google Ads Paid search for the local service businesses we run ads for.The rule we still follow, and the kind we keep writing up on the blog: block by range only where a lookup proves the network, and write the reason down next to every entry. It is the same patience we ask for when a relaunched campaign will not serve: check every layer before you change anything.
Before your next exclusion
Talk to Offer before you decide anything.
You'll talk with Offer, not a sales rep. A short call, no pitch deck.
Talk to OfferThis post was drafted with AI tools from our own project records, anonymized, and checked by us before it published. Read our editorial standards.
