We spent years building a product meant to catch fraudulent clicks on Google Ads campaigns, and one rule stands out as the kind we would design in on day one rather than rediscover later: when does one bad IP address become a whole blocked range?
Here is the short version. Google Ads caps each campaign at 500 excluded IP addresses. Near that cap, an asterisk for the last three digits excludes a whole block at once. We only use that shortcut inside confirmed data center or cloud ranges, never residential ones.
Before you touch the list
- Pull the addresses that clicked more than once with no conversion or real engagement after.
- Confirm the network before collapsing anything into a range: data center or cloud host only, never residential.
- Prune entries that stopped mattering so the list stays worth reading.
Why one bad address is rarely the real signal
A single IP address showing up twice in a campaign's click log feels like an easy call. It is not, by itself. Home networks reassign addresses, and an office sits behind one shared address for every employee. A mobile carrier can route a wave of ordinary phones through the same gateway on a given afternoon. Treat any one of those as a verdict and the exclusion list starts blocking real customers instead of bad ones. That is the cost of moving too fast on a single data point.
The product we built years ago was designed around that problem. It never leaned on one signal to call a click fraudulent. It combined public network data with plain common sense, looking at several angles at once rather than trusting any one alone. No single answer settled it. Only the pattern across several did.
No single number ever got a click labeled fraudulent. It took several signals pointing the same direction before we trusted the call.
Where we draw the line on collapsing ranges
The rule we settled on for the Google Ads accounts we manage is narrow on purpose. Collapse a run of addresses into one range only when a lookup confirms the whole range belongs to a data center or a cloud host, with no residential customers anywhere in it. A range like that has no collateral cost. Nobody's home internet gets caught in it. That is the whole test before a range gets touched.
Residential ranges do not get the same treatment, even when a few addresses inside one have already misbehaved. An internet provider hands residential addresses out and takes them back constantly, so a range that looks bad this month can belong to an entirely different household next month. Collapse it anyway and the exclusion stops being about fraud. It becomes about blocking whoever gets that address next.
How we review an exclusion list before adding to it
-
Pull the repeat offenders
Anything that clicked more than once with no conversion and no real engagement afterward.
-
Check what kind of network it sits on
A public lookup at a regional internet registry shows whether the address or range sits on a data center, a cloud host, or a residential provider.
-
Collapse only the confirmed non-residential ranges
Write the range down with the reason, so the next person reviewing the list does not have to rediscover it.
-
Leave residential addresses individual
Block a single address if the case is strong; never assume its neighbors in the range are guilty too.
-
Prune entries that stopped mattering
An address or range with no recent activity is not helping the account; remove it and keep the list readable.
The feature we planned to turn refunds into verdicts
That caution came from a habit we built into the product: collect every data point available, even the ones with no obvious use yet, because a later audit sometimes finds a use for data nobody understood the point of when it was captured. Pattern matching only works if there is enough of a pattern to match against.
One feature was on the roadmap from the start for exactly that reason. The plan was to point people toward the right place to ask Google for a refund on fraudulent clicks, backed by a report specific enough to be hard to argue with. On paper that looked like a plain customer benefit. The deeper design reason: a refund Google approves is about as close to a confirmed verdict on a click as we are ever going to get, and the feature was meant to feed that verdict straight back into how the next borderline click gets judged.
We carry that same habit into how we think about paid search work now: build the exclusion list carefully, and reserve range collapsing for data centers and cloud hosts.
Google Ads Paid search for the local service businesses we run ads for.The rule we still follow, and the kind we keep writing up on the blog: block by range only where a lookup proves the network, and write the reason down next to every entry.
Talk to Offer before you decide anything.
You'll talk with Offer, not a sales rep. A short call, no pitch deck.
Talk to OfferThis post was drafted with AI tools from our own project records, anonymized, and checked by us before it published. Read our editorial standards.
