Multi-Factor Authentication

How MultiFactor Authentication Works

Incoming Click/Impression
          │
          ▼
+─────────┴─────────+
│ Initial Analysis  │
│ (IP, User Agent)  │
+─────────┬─────────+
          │
          ▼
+─────────┴─────────+
│  Device & Geo     │
│  Validation       │
│ (Fingerprint, TZ) │
+─────────┬─────────+
          │
          ▼
+─────────┴─────────+
│ Behavioral Check  │
│ (Mouse, Clicks)   │
+─────────┬─────────+
          │
          ▼
+─────────┴─────────+
│  Scoring Engine   │
│ (Combine Factors) │
+─────────┬─────────+
          │
          ├───────────┐
          ▼           ▼
      [Valid]     [Fraudulent]
     (Allow)        (Block)

🧠 Core Detection Logic

Example 1: Geographic and Language Mismatch

This logic checks for inconsistencies between a user’s IP-based location and their browser’s language settings. A high-value click from a US IP address but with a browser language set to Vietnamese or Russian is suspicious. It often indicates the use of a proxy or a botnet operating from a different country, a common tactic in organized click fraud.

FUNCTION checkGeoLanguageMismatch(clickData):
  ipLocation = getLocation(clickData.ipAddress)
  browserLanguage = clickData.browser.language

  IF ipLocation is "United States" AND browserLanguage is NOT "en-US":
    RETURN {isSuspicious: TRUE, reason: "Geo-language mismatch"}
  ELSE:
    RETURN {isSuspicious: FALSE}
  ENDIF
END FUNCTION

Example 2: Session Click Frequency Anomaly

This rule analyzes the timing and frequency of clicks within a single user session. A legitimate user might click an ad once, but a bot might be programmed to click multiple ads in rapid, uniform succession. This logic flags users who exceed a reasonable click threshold within a short timeframe, which is a strong indicator of non-human behavior designed to deplete ad budgets.

FUNCTION checkClickFrequency(sessionData, clickTimestamp):
  // sessionData stores timestamps of recent clicks from the same user
  relevantClicks = findClicksInLastMinute(sessionData.clicks, clickTimestamp)

  IF count(relevantClicks) > 3:
    RETURN {isSuspicious: TRUE, reason: "High click frequency"}
  ELSE:
    // Add current click to session data
    addClick(sessionData, clickTimestamp)
    RETURN {isSuspicious: FALSE}
  ENDIF
END FUNCTION

Example 3: Device Fingerprint Consistency

This logic checks if a user’s device fingerprint (a combination of browser, OS, screen resolution, etc.) remains consistent across multiple visits. Fraudsters often use systems that randomize these attributes to appear as different users. If a returning user (identified by a cookie or IP) suddenly presents a completely different device fingerprint, the system flags it as a potential attempt to spoof identity.

FUNCTION checkFingerprintConsistency(userData, currentFingerprint):
  // userData stores historical fingerprints for a user
  previousFingerprint = getLatestFingerprint(userData)

  IF previousFingerprint is NOT NULL AND previousFingerprint != currentFingerprint:
    // Allow for minor changes like browser updates, but flag major changes
    IF calculateSimilarity(previousFingerprint, currentFingerprint) < 0.7:
      RETURN {isSuspicious: TRUE, reason: "Device fingerprint changed"}
    ENDIF
  ENDIF
  RETURN {isSuspicious: FALSE}
END FUNCTION

📈 Practical Use Cases for Businesses

• Campaign Shielding – Actively block bots and fraudulent IPs in real-time to prevent them from clicking on PPC ads. This directly protects the advertising budget from being wasted on traffic that has no chance of converting, ensuring spend is allocated to genuine potential customers.
• Analytics Purification – Filter out invalid traffic from analytics platforms. This provides a cleaner, more accurate view of campaign performance, user behavior, and conversion metrics, leading to better-informed marketing decisions and strategy adjustments.
• Return on Ad Spend (ROAS) Improvement – By eliminating wasteful clicks and ensuring ads are shown to real humans, MultiFactor Authentication improves the overall efficiency of ad spend. This leads to a lower cost per acquisition (CPA) and a higher return on every dollar spent on advertising.
• Lead Generation Integrity – Prevent bots from filling out lead or contact forms. This ensures that the sales team receives leads from genuinely interested humans, saving them time and resources by not having to chase down fake or low-quality submissions.

Example 1: Geofencing and Proxy Blocking

This logic is used to enforce geographic targeting rules and block traffic from known anonymous proxies, which are often used to circumvent location-based ad delivery. A business targeting customers only in Canada can use this to reject any clicks originating from other countries or from IPs known to be proxies.

FUNCTION enforceGeoFence(click):
  ip_info = getIpInfo(click.ipAddress)

  IF ip_info.country IS NOT "Canada":
    BLOCK(click, "Outside of Geofence")
    RETURN

  IF ip_info.isProxy IS TRUE:
    BLOCK(click, "Proxy Detected")
    RETURN

  ALLOW(click)
END FUNCTION

Example 2: Session Interaction Scoring

This example scores a user session based on multiple behavioral factors. A session with no mouse movement, unnaturally fast clicks, and immediate bounce would receive a high fraud score and be blocked. This is used to distinguish between engaged human users and low-quality bot traffic that only interacts with the ad itself.

FUNCTION scoreSession(session):
  score = 0
  
  IF session.mouseMovements < 5:
    score = score + 40 // High suspicion for no mouse activity

  IF session.timeOnPage < 2_seconds:
    score = score + 30 // High suspicion for immediate bounce

  IF session.clickInterval < 1_second:
    score = score + 30 // High suspicion for rapid-fire clicks
    
  IF score > 70:
    RETURN {isFraud: TRUE, score: score}
  ELSE:
    RETURN {isFraud: FALSE, score: score}
  ENDIF
END FUNCTION

🐍 Python Code Examples

This Python function simulates checking for abnormally frequent clicks from a single IP address within a given time window. It helps identify bots programmed to repeatedly click ads from the same source to deplete a campaign's budget.

# A simple in-memory store for tracking click timestamps per IP
CLICK_LOGS = {}
TIME_WINDOW_SECONDS = 60
CLICK_THRESHOLD = 5

def is_suspicious_ip(ip_address, current_time):
    """Checks if an IP has an unusually high click frequency."""
    if ip_address not in CLICK_LOGS:
        CLICK_LOGS[ip_address] = []

    # Filter out clicks older than the time window
    recent_clicks = [t for t in CLICK_LOGS[ip_address] if current_time - t <= TIME_WINDOW_SECONDS]
    
    # Add current click timestamp
    recent_clicks.append(current_time)
    CLICK_LOGS[ip_address] = recent_clicks
    
    # Check if click count exceeds the threshold
    if len(recent_clicks) > CLICK_THRESHOLD:
        return True
    return False

This code filters traffic based on a user agent string. It checks if the user agent belongs to a known list of bot or crawler signatures, providing a basic but effective first line of defense against non-human traffic.

KNOWN_BOT_AGENTS = [
    "Googlebot",
    "Bingbot",
    "AhrefsBot",
    "SemrushBot",
    "Python/3.9 aiohttp"
]

def is_known_bot(user_agent_string):
    """Identifies traffic from known web crawlers and bots."""
    if not user_agent_string:
        return True # Empty user agent is suspicious
    
    for bot_signature in KNOWN_BOT_AGENTS:
        if bot_signature.lower() in user_agent_string.lower():
            return True
            
    return False

Types of MultiFactor Authentication

• Network-Level Analysis – This type focuses on the origin of the traffic. It analyzes the IP address reputation, ISP, country of origin, and whether the connection comes from a known data center or proxy service. It is a fundamental first step in filtering out easily identifiable non-human traffic.
• Device-Level Fingerprinting – This method involves creating a unique identifier based on a visitor's device and browser attributes, such as operating system, browser version, screen resolution, and installed plugins. It helps detect bots that try to hide their identity by switching IP addresses but fail to alter their device signature.
• Behavioral Analysis – This is a more advanced type that monitors how a user interacts with a webpage, including mouse movements, click patterns, scrolling speed, and typing rhythm. Since bots struggle to perfectly mimic the natural, slightly random behavior of humans, this is highly effective at detecting sophisticated automation.
• Heuristic and Reputation Scoring – This type combines data from all other layers into a cohesive risk score. It uses rules and historical data (reputation) to evaluate the likelihood of fraud. For example, a new device from a low-reputation ISP exhibiting bot-like behavior will receive a very high fraud score.