find-ip-addresses-fraudulent-clicks

Long enough to cover the gap between when the spend goes wrong and when you notice, which is usually weeks rather than days. Many hosting setups rotate logs on a short cycle, so the relevant period is already gone by the time anyone investigates. Extending retention is cheap and there is no way to recover a window you did not keep. Check the schedule now, not later.

The gclid is a unique identifier Google appends to your landing page URL on every paid ad click. It matters because it is the only field that separates visitors you paid for from organic traffic, bookmarks and crawlers in your server logs. If your hosting discards query strings from logs, the gclid goes with them and any address analysis you build afterwards is guesswork.

There is no threshold that settles it, and anyone quoting one is guessing. Offices, universities and mobile carrier gateways put many genuine people behind a single address, so volume alone proves nothing. What matters is the combination: repeated paid clicks, sessions ending almost immediately, no page depth, no conversions over a long window, and an address that resolves to hosting rather than a consumer ISP.

Not by default. Analytics does not expose visitor IP addresses in its standard reports. The workaround is capturing the address on your own server at page load and passing it into Analytics as a custom dimension alongside the click identifier. That puts both fields in one place, but it only collects data from the day you implement it. It cannot recover past traffic.

Not from Google Ads. The platform holds no IP data you can access through reports, the interface or the API. You recover it from your own side by matching server log entries against the click identifier Google appends to your landing page URL on every paid click. That parameter is the only reliable link between a logged visit and a click you paid for.