Paid clicks and the evidence behind each one

What counts as a paid click#

On Fraud Protection (/integrity), the Clicks tab is the ledger AdPix keeps for your paid traffic: one row per paid landing. A paid landing is a page view that meets at least one of these conditions:

• its URL carries an ad click ID with a value — gclid, gbraid, wbraid, msclkid, ttclid and the like;
• its utm_source or its referrer is a paid ad network on the AdPix network list. Yektanet and Tapsell publish no click ID and are recognised this way;
• its utm_medium is explicitly paid: cpc, ppc, display, cpm, banner, cpa, native_ad, or anything starting with paid.

Two things are not a new click: reloading the same landing page in the same session, and reopening the same ad link on the same device and the same network — a tab the browser restored, for example. Only page views sent by the browser tag enter the ledger; server-to-server events are never paid clicks.

When the selected range has paid clicks, the numbers on the Overview tab are counted in paid clicks too, and the Unit: paid clicks badge says so; otherwise the unit is the session. The details are in Overview and severity tiers.

The Paid clicks table#

The table follows the range selected at the top of the page, newest clicks first. AdPix loads at most the 500 newest clicks that match the filters and shows 25 per page. If you are after an older click, shorten the range or add a filter.

Above the table are two filters, Verdict and Reason. The Reason list holds every reason and shield except those produced by approved detection rules.

The real-time verdict#

AdPix judges every paid click the moment it lands, in a fraction of a second. The judgement never holds up the page and never stops the visit; the page view is recorded as usual.

Counters are kept per IPv4 address, and per /64 range for IPv6, because IPv6 privacy addresses keep changing inside that range. Thresholds are allowances: a reason is raised only when the count, including this click, exceeds the threshold. The numbers below are the General preset's; picking another preset in Protection settings changes them.

The number and kind of reasons decide the tier:

A datacenter address alone is not enough for Confirmed, because real users of services such as iCloud Private Relay or WARP also egress from datacenter ranges. Not assessed deliberately does not guess: if AdPix cannot read its counters, it records the click without a verdict and leaves the visit alone.

In the Overview numbers, "invalid" means Confirmed plus Potential. Review sits in the denominator only, because nobody has decided on it yet.

Shields: what is never flagged#

Shields decide before any counter does, and their green label appears in the Reasons column:

• Converted (trusted) — an address or device that converted on this website in the last 30 days: a purchase, or one of the website's key events. Its clicks stay Clean, however many there are.
• Allowlisted — an address, range or device you allowlisted yourself. Always Clean, never blocked.

Mobile-carrier and carrier-NAT addresses are not a full shield, but they get special protection: many real people share one address, so IP rotation and Click burst are never raised from a shared address, and such an address is never blocked. The evidence drawer says the same under the verdict.

After the landing#

The landing verdict is not the last word. Under the verdict in the evidence drawer, one of three labels says where the current verdict came from:

Browser signals#

After the tag's first beacon, a separate module loads lazily — and only when the visitor granted consent for the Marketing category. It sends two things.

Automation probes. The evidence drawer lists them by these technical names:

Either of the first two is enough on its own. The rest are weak — a privacy extension or a virtual machine can trip one — and need at least two together. The result is the Automated browser reason and the Confirmed tier, provided the session's paid click was recorded in the last 30 minutes. A click that earned a shield stays Clean.

Activity in the first 5 seconds. One summary about 5 seconds after load: how many pointer moves, scrolls, touches and key presses. Counts only — no coordinates, no elements, no which-key.

The absence of these signals is never held against a visit: without marketing consent they are never sent. No human activity is raised only for a desktop visit that did send the activity summary, with zero activity in it.

The nightly analysis#

Every night AdPix re-reads the click ledger together with the browser signals. It adds to individual clicks the reasons that need history — Automated browser, No human activity and Duplicate clicks (one network, one user agent and one campaign clicking several times inside a minute) — and recomputes the tier with the same table as above. It never changes a click that earned a shield.

The same pass also scores each campaign slice (source · medium · campaign · ad content · device) with the same precision-first logic: a campaign that converts is not flagged on weak signals, and a slice with fewer than 3 clicks never goes above Review.

These are the signals the nightly analysis reads at campaign level. The first two are strong; the rest are weak and need company:

A strong reason makes the campaign Confirmed from 5 clicks (Potential from 3); two weak reasons make it Potential from 10 clicks; a single weak reason stays at Review.

The Click evidence drawer#

Select the time on any row. The drawer has four sections:

The counters are the very numbers the real-time verdict was taken on. If Clicks from this address in 10 min shows 4 and the threshold is 3, that is exactly where Repeat clicks (10 min) came from.

Three actions on a click#

The buttons sit at the top of the drawer, and a click shows only the ones that make sense for it:

The new block appears on the Blocks tab with Created by set to Manual; its lifecycle is covered in Blocks and exclusion pushes. All three buttons need the Editor role or higher on the website.

IP retention#

A click's raw address is kept for 90 days. After that the drawer shows IP removed (90-day retention) instead of the address, and the table shows only the network prefix. The click row itself, with its prefix and ASN, stays for 13 months.

That has two practical consequences. First, Not fraud: allowlist this IP no longer appears for clicks older than 90 days. Second, if you intend to build a click-quality case for Google, do it while the addresses still exist; the Click quality report file carries an address only for clicks inside those 90 days. The procedure is in Blocking networks and refund evidence.

Frequently asked questions#

Related#