Why IP exclusion lists alone cannot stop modern click fraud
Static IP lists still matter — and they decay. Pair them with risk scoring and fresh IP exclusion exports so rotated networks stop teaching Smart Bidding the wrong lesson.
Topics
What IP lists still do well
Known bad ranges, obvious data centers, and repeat abusers should land on an exclusion list quickly. That is table stakes for any Google Ads protection workflow.
The failure mode is rotation. Farms and scripts change addresses faster than teams update spreadsheets — especially across agencies with shared ownership of the list.
IP exclusion also has a soft ceiling: Google Ads caps how many IPs you can exclude per campaign or account. Filling that quota with stale addresses leaves no room for today’s junk.
Treat the list as a living product with an owner, a review cadence, and a quarantine path — not as a spreadsheet that grows forever.
Keep a “known good” exception path for offices, agencies, and partners who test ads. Blocking your own team is an avoidable own goal.
Export and paste exclusions into Google Ads on a schedule you can explain. Ad-hoc one-off pastes drift from the source of truth within days.
Layers that survive rotation
Risk scoring catches behavior even when the IP is new. Fresh exclusion exports stop clear junk addresses from receiving more impressions after a bad click.
Referrer screening removes another class of waste: technically real traffic from domains that never produce customers.
Network and ASN rules catch clusters that individual addresses miss. When a whole residential proxy pool starts hammering brand terms, one ASN rule beats fifty reactive IP adds.
Engagement gates keep gray traffic on a watchlist until you know whether it converts. That patience prevents over-blocking traveling buyers and corporate VPN egress.
Think in failure modes: new IP, same behavior; new behavior, same ASN; clean IP, bad referrer. Each layer covers a different miss.
When two layers disagree, prefer watch over block until engagement clarifies the visit.
- IP and network blocks for clear junk
- Audience exclusion for repeat identities
- Risk bands for triage during spikes
- Referrer rules for low-quality sources
- Engagement gates before Google Ads exclusions
Operating the list like a product
Name owners, review cadence, and a quarantine path for gray IPs. Untouched lists become security theater within a quarter.
When you release an IP back to eligible traffic, note why. Those reversals teach the team which signals are noisy in your vertical.
Agency setups need a single source of truth. If three buyers maintain three lists, you will double-block, miss quotas, and argue about who “owns” a range that should have been released.
Promote from watch to exclusion when the same fingerprint repeats with zero engagement, then export on a fixed cadence. Purely ad-hoc pastes lag behind actors who rotate nightly.
Set a maximum age for untouched IPs. If nobody has reviewed a range in ninety days, quarantine it for re-evaluation.
Publish the owner’s name in the team wiki. Orphaned lists are how quotas fill with ghosts.
What to measure after you layer defenses
Track three numbers weekly: size of the IP list, size of the exclusion export list, and junk share among paid sessions.
If the IP list grows but junk share does not fall, you are collecting addresses instead of stopping waste.
Compare CPA on a fourteen-day window before and after a major layer change. Single-day noise misleads; multi-week windows tell whether Smart Bidding got cleaner signals.
Share a one-chart standup view: paid sessions by risk band. When the high-risk band shrinks, the whole team sees progress without reading a twenty-page export.
Add a fourth number if you can: false-positive releases per month. A healthy program reverses mistakes quickly.
Common failure modes to avoid
Dumping thousands of historical IPs into Google Ads without a review creates quota pressure and hides which ranges still matter.
Blocking entire cities because a rival sits there also removes real customers. Prefer fingerprints and risk over crude geo hammers.
Ignoring weekly IP exclusion refreshes while obsessing over a stale static list leaves the same unwanted visitor free to see more ads from a new address tomorrow.
Skipping documentation turns every CPA swing into a mystery. A dated note next to each rule change is cheaper than a three-hour post-mortem.
Copying another advertiser’s blocklist wholesale imports their false positives and their outdated ranges.
A practical stack for most Google Ads accounts
Week one: turn on default risk rules and watch. Week two: promote clear junk to the high-risk queue. Week three: expand Google Ads IP exclusions for repeat zero-engagement addresses.
Keep referrer rules for domains that never convert. Revisit the whole stack after your first full billing cycle — not after the first scary day.
If you only have bandwidth for one upgrade this quarter, add risk scoring and weekly exclusion exports on top of your existing IP list. That single layer closes the rotation gap most teams feel first.
Write the stack on one slide for leadership. Funding continues when protection sounds like an operating system, not a mystery tool.
A thirty-day upgrade plan
Days 1–7: inventory your current IP list, remove anything untouched for ninety days, and name an owner. Days 8–14: turn on risk scoring defaults and a watch view without changing bids.
Days 15–21: promote clear junk to the exclusion list and export fresh IPs for Google Ads. Days 22–30: compare junk share and CPA to the prior month and present one slide to finance.
Resist importing a giant third-party list mid-plan. Quotas fill fast, and you will not know which ranges earned their place.
End the month with three artifacts: a cleaned IP exclusion export, a short Risk review note, and a weekly ops slot on the calendar. That triad survives rotation better than any static spreadsheet.
If leadership asks what changed, point to junk share — not to how many addresses you collected. Collection without impact is busywork.
Quota math most teams ignore
Google Ads IP exclusion caps are finite. Filling them with stale ranges leaves no room for tonight’s farm.
Audit the oldest twenty percent of your list every month. If a range has not earned a hit in ninety days, quarantine it.
Measure list size next to junk share. Growth without impact means you are collecting addresses, not stopping waste.
Keep the change log short enough that a buyer will actually read it on Monday morning.
Revisit the rule after one full billing cycle — not after the first scary day.
When in doubt, watch for seventy-two hours before promoting a gray case to Google Ads exclusion.
If you only upgrade one layer this quarter, add risk scoring and weekly exclusion exports on top of the IP list — that closes the rotation gap most teams feel first.
