# Blocks and exclusion pushes

The Blocks tab is the list of addresses and devices AdPix keeps out of your paid campaigns, each with its own expiry. From here you block by hand, release a block, and send the list to a webhook or to Google Ads.

Blocking is on the Pro and AdPix 360 plans. On Starter this tab shows the upgrade screen, and detection carries on without blocks.

## What a block is in AdPix

Every block is one **value** — an address, a range, an IPv6 range or a device — together with a severity, reasons and an expiry date. On **Fraud Protection** (`/integrity`), the **Blocks** tab shows them all.

A block never touches your site and never stops a visit. It is a row on the exclusion list AdPix keeps for your ad platforms; it takes effect once that list reaches the platform through a push destination or an exported file.

Above the table is one line: "… active blocks · Google allows 500 per campaign". That count covers address-type blocks only; device blocks never go to Google, because Google excludes IP addresses only.

## Lifecycle

The filter above the table has four states:

| State | Means |
| --- | --- |
| Active | in force and included in every push. Each new Confirmed verdict on the same value moves its expiry later |
| Expired | its lifetime ran out. If the website is in Block mode and the same value earns a Confirmed verdict again, it becomes active again |
| Released | someone lifted it. Automatic verdicts never bring it back; only a manual block reactivates it |
| Allowlisted | like Released, a human decision that automatic verdicts never reactivate |

Every hour AdPix moves blocks whose date has passed to Expired. The lifetime of each new block comes from **Block expiry (days)** in [Protection settings](analytics/fraud/protection-settings).

## The table's columns

| Column | What it shows |
| --- | --- |
| Value | the address, range or device ID itself |
| Type | one of the four types in the next section |
| Severity | the tier of the verdict that created the block |
| Reasons | up to two reason labels; a manual block carries no detection reason |
| Hits | how many times automatic verdicts hit this value. Approximate: each value is counted at most once a minute |
| Last seen | the last day a verdict hit this value |
| Expires | "… days left" for an active block, a date for the rest |
| Created by | Real-time, Nightly or Manual |

The **Release** button appears on Active rows only.

## Who creates a block

| Created by | When |
| --- | --- |
| Real-time | a Confirmed verdict at landing, or an update from browser signals — in Block mode only |
| Nightly | a Confirmed verdict in the nightly analysis — in Block mode only |
| Manual | you, from the form on this tab or the **Block this address** button in a click's evidence drawer |

And four types of value:

| Type | What it excludes |
| --- | --- |
| IP address | one address |
| IP range (a.b.c.*) | one `/24` range, which is 256 addresses. Only you create this type |
| IPv6 /64 | one subscriber's IPv6 range; IPv6 privacy addresses rotate inside it |
| Device | one device fingerprint. It never goes to Google; only to webhooks |

Automatic blocks record an IPv4 address as IP address and an IPv6 address as IPv6 /64, and block the device only when the verdict is about the device itself. Shared mobile and carrier addresses are never blocked automatically.

## Manual blocks

The **Block an address or device** card has three fields:

1. Pick the **Type**.
2. Enter the **Value**: an address such as `203.0.113.9`, a range such as `203.0.113.*`, an IPv6 prefix such as `2001:db8:1:2::`, or a device ID.
3. Write why in **Reason**, and press **Add block**.

A manual block always gets Confirmed severity, and its lifetime comes from your settings. It works in every protection mode, Monitor included, and it reactivates a value that was released before. Creating and releasing blocks needs the Editor role or higher on the website.

> **The form does not recognise carrier addresses**
>
> The **Block this address** button in a click's evidence drawer is not shown at all for mobile-carrier and shared addresses. The manual form has no such protection and accepts any valid address. Before blocking an address or a `/24` range by hand, open one of its clicks in the evidence drawer and check the network type; behind a carrier address sit many real customers.

## Releasing a block

**Release** moves a block to Released. From that moment:

- it is left out of every later push, and the next push puts it on the `remove` list so a Google Ads destination deletes the matching exclusion;
- automatic verdicts never bring it back, even if the same address earns a Confirmed verdict again;
- the only way back is a manual block.

If you release a block because the verdict was wrong, add the same address or device to the allowlist as well, so its future clicks are recorded as Clean too.

## Google's 500 cap and the ranking

Google Ads accepts at most 500 IP exclusions per campaign. AdPix ranks the list like this: most severe first, then most recent Last seen, then most Hits. When the addresses go past 500, a line such as "… over Google's limit: the exports keep the most severe and most recent." appears. The overflow is never dropped silently; its size is reported.

The pushed list is built from three sources:

- the Active blocks in this table;
- the addresses of Confirmed paid clicks from the last 30 days — never a carrier address;
- the `/24` ranges that traffic from Confirmed networks came from, only when the network is a datacenter, VPN, proxy or Tor network or on the known-fraud list — never a residential or mobile network.

Left out of it: any Released or Allowlisted value, and anything on the allowlist. That is why the pushed list carries Confirmed addresses even in Monitor mode; the mode only decides whether AdPix creates blocks and pushes on its own.

A webhook has no cap and receives every address. In Google Ads, the exclusions you added by hand also take a share of each campaign's 500 slots; when a campaign is full, lower-ranked addresses wait until a slot frees up.

## Push destinations

The **Push destinations** card is where Push now and auto-push send the list. At the top of the card is the table of current destinations, with **Name** and **Type** columns and a **Remove** button; below it, the form to add one.

### Webhook

For n8n, a firewall or any other HTTP endpoint:

1. Set **Type** to Webhook (n8n, firewall, any HTTP endpoint).
2. Enter a **Name** and the **Webhook URL**, then press **Add destination**.
3. Copy the value shown after "Shared secret, shown once — the receiver checks it in the X-Sovereign-Secret header:" right away.

Each push is a `POST` request with a JSON body, and the secret travels with it in the `X-Sovereign-Secret` header. Your receiver should compare that header with the secret and reject every other request. The secret is never shown again; if you lose it, remove the destination and create it again to get a new one.

The request body looks like this:

```json
{
  "op": "sync_ip_exclusions",
  "add": ["203.0.113.9", "198.51.100.*", "2001:db8:1:2::/64"],
  "remove": ["192.0.2.44"],
  "property_id": "…",
  "blocks": [
    {
      "block_id": "…",
      "identifier_type": "ip",
      "value": "203.0.113.9",
      "severity": "confirmed",
      "reason_codes": ["ip_velocity_10m", "ip_datacenter"],
      "hits": 14,
      "first_seen": "…",
      "last_seen": "…",
      "expires_at": "…",
      "source": "realtime",
      "status": "active"
    }
  ]
}
```

| Field | Means |
| --- | --- |
| `add` | every address on the list, in priority order and without the 500 cap. A `/24` range as `a.b.c.*`, an IPv6 range with a `/64` suffix |
| `remove` | values sent to this same destination last time that are no longer on the list — expired, released or allowlisted |
| `blocks` | the full rows, including device blocks and reason codes; `source` is `ledger` or `network` for rows that came from clicks or networks |

The `reason_codes` are the same stable codes the Reasons labels are built from.

### Google Ads IP exclusions

Set **Type** to Google Ads IP exclusions and fill in these fields:

| Field | What goes in |
| --- | --- |
| Google Ads customer ID | the ad account ID, such as `123-456-7890` |
| Manager account ID (optional) | when access goes through a manager (MCC) account |
| OAuth refresh token | the token the account owner granted for access |
| Campaign IDs (comma-separated) | the campaigns whose IP exclusions AdPix maintains |

For every campaign you named, AdPix adds the list's new addresses and removes **only** the exclusions it added earlier that are no longer on the list. Exclusions you added by hand are never touched. Only addresses go to Google; devices do not.

Search, Display, Shopping and Demand Gen campaigns accept IP exclusions. Performance Max, Video and App campaigns, and any other type that cannot hold IP exclusions, are skipped without an error, and the destination's other campaigns are updated as usual.

> **Before the first push to Google**
>
> Pushing to Google Ads needs Google Ads API access, which has to be enabled on the AdPix platform. Until it is, pushes to this destination do not go through and the reason shows in the Last error column. In the meantime, take the Google Ads IP exclusions file from the **Evidence** tab and import it by hand — [Blocking networks and refund evidence](analytics/fraud/blocklist-and-refund-evidence).
>
> This destination is not available for Iranian websites: if the website's currency is rial or toman, or its time zone is Tehran, AdPix refuses it, because Google does not serve Iranian advertisers. Those websites use the webhook and the files on the Evidence tab.

## Push now and the Pushes table

The **Push now** button on the **Pushes** card queues the current list for every enabled destination of the website and shows "Push queued.". If the website has no push destination, you get an error saying so instead. Auto-push, its conditions and the fact that it works only in Block mode are covered in [Protection settings](analytics/fraud/protection-settings).

The table under the button shows the last 50 pushes, with **Time**, **Platform**, **Addresses sent**, **Status** and **Last error** columns. The status is read live from the delivery queue:

| Status | Means |
| --- | --- |
| Queued / Pending | recorded and waiting for its turn |
| Sending | being delivered right now |
| Delivered | the destination accepted it |
| Failed | the last attempt failed and will be retried; the reason is in Last error |
| Gave up | the retries ran out and this push will not be sent again. Fix the error and press Push now again |

## Frequently asked questions

### Why does Addresses sent differ from the number of blocks in the table?

Because the pushed list is more than the table's rows. It also carries the addresses of Confirmed paid clicks from the last 30 days and the `/24` ranges of Confirmed networks that are datacenter, VPN, proxy, Tor or known-fraud networks. In the other direction, device blocks never go to Google and Google takes at most 500 addresses.

### If I release a block, is it removed from Google Ads too?

Yes, on the next push. The value goes into the `remove` list and the Google Ads destination deletes the exclusion AdPix had added. Automatic verdicts will not bring it back either.

### Does AdPix remove the exclusions I added in Google Ads myself?

No. It only removes what it added itself. Your own exclusions do take a share of each campaign's 500 slots, though; when a campaign is full, lower-ranked addresses wait for a free slot.

### Why can't I add a Google Ads destination?

If the website's currency is rial or toman, or its time zone is Tehran, AdPix refuses this destination, because Google does not serve Iranian advertisers. Those websites use the webhook and the files on the Evidence tab.

## Related

- [Protection settings: mode, industry preset and thresholds](https://docs.adpix.io/en/analytics/fraud/protection-settings/)
- [Paid clicks and the evidence behind each one](https://docs.adpix.io/en/analytics/fraud/paid-click-log/)
- [Evidence, exclusion lists and refund claims](https://docs.adpix.io/en/analytics/fraud/blocklist-and-refund-evidence/)
- [Ad spend wasted — what the number actually is](https://docs.adpix.io/en/analytics/fraud/money-wasted/)

---

[Docs](https://docs.adpix.io/en/analytics/fraud/blocks-and-exclusions/) · AdPix