Datacenter IPs vs Residential IPs in Ad Fraud

Datacenter IP ad fraud is the version you can actually see, and that is exactly why it is no longer the version costing you the most money. An address that belongs to a hosting provider is not pretending very hard. An address that belongs to a broadband customer in a town where you sell is a different problem, and the gap between those two things explains most of what goes wrong when advertisers try to fix fraud with a block list.

If you have not read our overview of bot traffic in Google Ads, that sets the context. This page is about where the traffic appears to come from.

What the two types actually are

A datacenter IP address belongs to a hosting company, a cloud provider or a server farm. It exists to run machines. Nobody's home broadband sits on one. These ranges are well documented, publicly attributed to their owners, and stable over time.

A residential IP address is assigned by a consumer internet provider to a household or a mobile connection. It is the address your actual customers browse from. Here is the part that matters most: these addresses get reassigned between customers over time as leases expire and subscribers change. The address that served a bot last month can belong to an ordinary household this month. Datacenter ranges generally do not move like that. This single difference drives everything else on this page.

Why datacenter IP ad fraud is the easy case

Traffic arriving from a known hosting range and claiming to be a person on a phone is making a claim that does not survive contact with reality. Nobody browses your plumbing website from a rack in a data hall. The attribution is public, the ranges are stable, and the mismatch between what the traffic says and where it sits is obvious.

This is why a lot of low-effort automation gets filtered before it ever costs anyone anything. It is also why the fraud economy moved on. When the cheap route stops working, the traffic buys a better disguise.

Residential addresses and why they break your block list

Proxy networks rent access to residential connections, sometimes with the householder's knowledge, often through apps that bundle the permission into terms nobody reads. Automated traffic routed through that infrastructure arrives from a genuine home connection in a plausible location. There is no hosting provider in the attribution, because there is no hosting provider involved.

Three things follow from that, and each one is a reason manual blocking underperforms.

• The address is rotated. The network has a large pool. By the time you have identified and blocked one address, the same operation is using another one. You are always blocking the last visit rather than the next one.
• The address can become innocent. Because residential addresses are reassigned between customers, a block you added six months ago may now be shutting out a genuine prospect. Your list ages badly and never tells you when it has gone wrong.
• The context looks right. A residential address in your service area does not raise any obvious question. Nothing about the location says fraud.

Mobile carrier addresses add a further wrinkle, since large numbers of unrelated users share the same address space. Block one and you may be blocking a neighbourhood.

What this means for IP exclusions in Google Ads

Google Ads lets you exclude IP addresses at campaign level, and it is a reasonable tool for a narrow job. It works for a fixed, known nuisance: your own office, a contractor, a single persistent source you have documented over weeks.

It does not work as a fraud defence, for reasons that follow directly from everything above. The exclusion list is capped in size, it is maintained by hand, and it acts on addresses that have already rotated. You are curating a list of places the traffic used to be. We go through the limits and the sensible uses in our guide to IP exclusions in Google Ads.

There is also a quieter cost. Every stale entry on a hand-built list is a potential real customer you are silently refusing to show ads to, and nothing in the interface will ever flag that. The list has no expiry and no feedback loop.

Where Google's own filtering lands on this

Google does filter invalid clicks and does issue automatic credits for those it identifies, which lands on the following month's bill. Obvious datacenter traffic is the kind of thing large-scale filtering handles well. Traffic from a residential address in your target market, behaving with moderate plausibility, is a much harder call for any platform-level system, and Google does not disclose where it draws the line. We cover what that means for you in what Google's invalid click refunds leave behind.

The honest summary: the easy half of this problem is largely handled, and the credit reflects that. The hard half is where your money is going, and a credit on your invoice tells you nothing about how much of it there was.

What to do instead of curating addresses

Stop treating the IP address as an identity and start treating it as one piece of context. On its own it answers the wrong question. A datacenter address is a useful signal because it contradicts the claim being made. A residential address is not a clean bill of health, it is just the absence of an obvious contradiction.

What works is a live view of behaviour across visits and time, applied automatically, so that a source is acted on while it is still active rather than weeks later. It also needs to release addresses again when they stop being a problem, which a static list never does. That is what click fraud protection is built to handle, and it is the part that manual maintenance cannot match at any reasonable effort.

One thing to keep in mind whichever route you take: legitimate crawlers such as Googlebot and AdsBot-Google operate from Google infrastructure, which means a blunt rule aimed at datacenter traffic can take them out. That breaks your indexing and your ad landing page checks. Our guide to the bots you must never block explains what needs to stay reachable.

Privacy Relays and VPNs Muddy the Picture

Not every address that looks wrong belongs to someone trying to cheat you. Privacy features built into browsers and phones, along with ordinary VPNs, route real people through shared exit addresses. The location attached to those addresses can be a city away from where the person actually is, and the network may belong to a provider you would otherwise associate with servers.

That matters because a rule like "block anything that is not a home connection" catches privacy-conscious customers along with bots. Treat relay and VPN traffic as uncertain rather than guilty. The deciding evidence is behaviour across visits: whether the source keeps clicking without reading, or arrives once, browses and gets in touch.

The short version

Datacenter fraud is loud and mostly handled. Residential fraud is quiet, rented by the hour, and rotates faster than any list you maintain by hand. If your current defence is a spreadsheet of addresses, you are defending against the version of this problem that stopped being the expensive one a while ago.

Frequently Asked Questions

Is a residential IP always a real person?

No. Residential proxy networks rent out home connections precisely so automated traffic looks like a household. The address type tells you how hard the source worked to look normal, not whether it is a customer.

Should I exclude every datacenter IP that clicks my ads?

No. Exclude the specific addresses that combine repeated paid clicks with no engagement. Blocking whole provider ranges can cut off monitoring tools you use, business networks and VPN users who are real prospects.

Why do VPN users show the wrong location?

The location attached to an address is the location of the exit point, not the person. A VPN or privacy relay can place a local customer in another city or country.

Can I block an IP range in Google Ads?

Yes. Google Ads lets you use an asterisk in place of the last digits to exclude a block of addresses, within the 500-entry limit per campaign. Start narrow, because a range covers everyone behind it.