Campaign Tracking

How Campaign Tracking Works

  User Click on Ad      Tracking Link         Data Collection &       Fraud Detection          Action
+-------------------+   +----------------+    +-------------------+   +--------------------+   +------------+
|                   |   |                |    |                   |   |                    |   |            |
|  Campaign Ad      ├─→ │  Redirects with  ├─→  │   Aggregates      ├─→ │  Analyzes Data for ├─→ │  Allow or  │
| (e.g., Google Ad) │   │  Parameters    │    │   Click Data      │   │  Anomalies         │   │  Block Click │
|                   │   |  (UTMs, etc.)  │    │ (IP, UA, Timestamp) │   │  (Bots, Patterns)  │   |            |
+-------------------+   +----------------+    +-------------------+   +--------------------+   +------------+
                                                    │
                                                    └──────────────────→ Log for Reporting

🧠 Core Detection Logic

Example 1: Click Velocity Analysis

This logic detects rapid-fire clicks from a single source targeting the same campaign. It’s a frontline defense against basic bots and click farms that aim to deplete ad budgets quickly. By setting a threshold for the number of clicks allowed from one IP address within a specific timeframe, it identifies and blocks this automated, non-human behavior.

FUNCTION check_click_velocity(click_event):
  ip_address = click_event.ip
  campaign_id = click_event.campaign_id
  timestamp = click_event.timestamp

  // Get recent clicks for this IP and Campaign
  recent_clicks = get_clicks_from_db(ip_address, campaign_id, last_60_seconds)

  // Define the threshold
  IF count(recent_clicks) > 5:
    // Flag as fraudulent
    block_request(ip_address)
    log_event("Fraud Detected: High Click Velocity", click_event)
    RETURN FRAUDULENT
  ELSE:
    // Store this click and allow
    store_click_event(click_event)
    RETURN LEGITIMATE
  END IF

Example 2: Geographic Mismatch Detection

This rule verifies that a click’s origin matches the geographic targeting of an ad campaign. For instance, if a campaign is targeted exclusively to users in Germany, a click originating from an IP address in Vietnam would be flagged as suspicious. This helps prevent fraud from offshore click farms and bots operating outside the intended market.

FUNCTION check_geo_mismatch(click_event, campaign_rules):
  ip_address = click_event.ip
  campaign_target_geo = campaign_rules.target_countries

  // Get the location of the IP address
  click_geo = geo_lookup(ip_address).country

  // Check if the click's country is in the allowed list
  IF click_geo NOT IN campaign_target_geo:
    // Flag as fraudulent
    block_request(ip_address)
    log_event("Fraud Detected: Geographic Mismatch", click_event)
    RETURN FRAUDULENT
  ELSE:
    RETURN LEGITIMATE
  END IF

Example 3: Parameter Tampering Validation

This logic ensures that the tracking parameters (e.g., UTM codes) in the URL have not been altered or removed. Bots sometimes attempt to bypass tracking by manipulating these parameters. This check validates the integrity of the tracking URL, ensuring that all required campaign data is present and correctly formatted, which is often a sign of a legitimate, unaltered click.

FUNCTION validate_campaign_parameters(request_url):
  required_params = ["utm_source", "utm_campaign"]
  
  // Extract parameters from the URL
  url_params = get_query_parameters(request_url)

  // Check if all required parameters are present
  FOR param IN required_params:
    IF param NOT IN url_params OR url_params[param] IS EMPTY:
      // A required parameter is missing or empty
      log_event("Fraud Warning: Parameter Tampering", request_url)
      RETURN SUSPICIOUS
    END IF
  END FOR

  RETURN LEGITIMATE

📈 Practical Use Cases for Businesses

• Campaign Shielding – Prevents bots and competitors from clicking on ads, directly protecting Pay-Per-Click (PPC) budgets from being wasted on fraudulent traffic and ensuring that spending is allocated toward reaching genuine potential customers.
• Data Integrity for Analytics – By filtering out invalid clicks before they are recorded, campaign tracking ensures that marketing analytics platforms (like Google Analytics) reflect real user engagement. This leads to more accurate performance metrics and better-informed strategic decisions.
• Lead Quality Improvement – Blocks traffic from sources known for generating fake leads or low-quality form submissions. This helps sales teams focus on genuinely interested prospects, improving conversion rates and overall return on ad spend (ROAS).
• Competitor Click-Fraud Mitigation – Identifies and blocks patterns of behavior consistent with competitors attempting to exhaust a company’s advertising budget. This helps maintain a level playing field and ensures ad visibility for real customers.

Example 1: Data Center Traffic Blocking

This pseudocode rule automatically blocks traffic originating from known data centers, which are a common source of non-human bot traffic and proxy servers used to mask fraudulent activity.

FUNCTION check_data_center_traffic(click_event):
  ip_address = click_event.ip
  
  // Check IP against a known list of data center IP ranges
  IS_DATA_CENTER_IP = is_in_datacenter_database(ip_address)

  IF IS_DATA_CENTER_IP:
    block_request(ip_address)
    log_event("Blocked: Data Center IP", ip_address)
    RETURN BLOCKED
  ELSE:
    RETURN ALLOWED
  END IF

Example 2: Session Engagement Scoring

This pseudocode demonstrates a more advanced use case where a user’s session is scored based on behavior. A click from a specific campaign might be initially allowed, but if the user shows no meaningful engagement (like scrolling or mouse movement) within a few seconds, the source is flagged for future blocking.

FUNCTION score_session_engagement(session_data, campaign_id):
  // Collect engagement metrics after a short delay
  time_on_page = session_data.time_on_page_seconds
  scrolled_pixels = session_data.pixels_scrolled
  mouse_movements = session_data.mouse_events_count
  
  // Define minimum engagement thresholds
  MIN_TIME = 5 
  MIN_SCROLL = 100

  // Score the session
  IF time_on_page < MIN_TIME AND scrolled_pixels < MIN_SCROLL AND mouse_movements < 2:
    source_ip = session_data.ip
    // Add IP to a low-quality traffic watchlist for the campaign
    add_to_watchlist(source_ip, campaign_id)
    log_event("Low Engagement Score", source_ip, campaign_id)
    RETURN LOW_QUALITY
  ELSE:
    RETURN HIGH_QUALITY
  END IF

🐍 Python Code Examples

This code simulates detecting abnormal click frequency from a single IP address on a specific campaign. It helps block basic automated bots by tracking click timestamps and flagging sources that exceed a defined rate limit.

# Dictionary to store click timestamps for each IP/campaign pair
click_logs = {}
from collections import deque
import time

# Rate limiting settings: 5 clicks within 10 seconds
MAX_CLICKS = 5
TIME_WINDOW_SECONDS = 10

def is_click_fraudulent(ip_address, campaign_id):
    """Checks if a click from an IP for a campaign is fraudulent based on frequency."""
    current_time = time.time()
    key = (ip_address, campaign_id)

    if key not in click_logs:
        click_logs[key] = deque()

    # Remove timestamps outside the time window
    while click_logs[key] and click_logs[key] <= current_time - TIME_WINDOW_SECONDS:
        click_logs[key].popleft()

    # Check if the number of clicks exceeds the max limit
    if len(click_logs[key]) >= MAX_CLICKS:
        print(f"Fraudulent activity detected from {ip_address} for campaign {campaign_id}")
        return True

    click_logs[key].append(current_time)
    print(f"Legitimate click recorded from {ip_address}")
    return False

This example provides a function to filter traffic based on suspicious user-agent strings. It checks if a user agent matches any patterns commonly associated with bots, scrapers, or other automated tools, which is a key part of distinguishing human traffic from non-human traffic.

# A list of known bot signatures
BOT_SIGNATURES = [
    "bot", "spider", "crawler", "headless", "scraping"
]

def is_user_agent_suspicious(user_agent_string):
    """Checks if a user agent string contains known bot signatures."""
    if not user_agent_string:
        return True # Empty user agents are suspicious

    ua_lower = user_agent_string.lower()
    for signature in BOT_SIGNATURES:
        if signature in ua_lower:
            print(f"Suspicious user agent detected: {user_agent_string}")
            return True
            
    print(f"User agent appears clean: {user_agent_string}")
    return False

Types of Campaign Tracking

• Parameter-Based Tracking – This is the most common type, using URL parameters like UTMs (utm_source, utm_medium, utm_campaign) to append tracking data to a link. It is essential for attributing clicks to specific campaigns and analyzing traffic sources for clear signs of fraud, like a high number of clicks from an irrelevant source.
• Pixel-Based Tracking – Involves placing a small, invisible pixel on a webpage or in an ad. When the pixel loads, it fires a request to a server, logging an impression or a click. In fraud detection, it helps verify that an ad was actually rendered and can be used to track user behavior post-click.
• Server-to-Server Tracking – This method, also known as postback tracking, sends data directly from one server to another without relying on the user's browser. It is more secure and reliable for fraud prevention because it is not susceptible to client-side manipulation, providing a trusted source for conversion and click data.
• Device Fingerprinting – This technique collects a set of attributes from a user's device (e.g., OS, browser version, screen resolution) to create a unique identifier. In campaign tracking, it helps identify and block users who try to mask their identity by changing IPs or clearing cookies, exposing sophisticated fraud patterns.