We Studied Bot Traffic Across Three Websites. The Click Fraud Story Wasn't What We Expected.
Five research articles examine what IP reputation, browser fingerprints, location and visitor behavior can—and cannot—tell advertisers about the quality of their traffic.
Most ad fraud protection products begin with a straightforward promise: identify suspicious visitors and protect your advertising budget.
But there's a question worth asking before you decide which visitors to exclude.
Are the bots you're detecting actually costing you advertising money?
At Button Solutions, we've been researching that distinction using real website traffic, browser signals and observed advertising click identifiers.
We recently published five related studies. Some findings challenge common assumptions about click fraud protection. Others show why bot traffic detection is useful even when no advertising clicks are involved.
Here's what we learned—and why it could matter to your business.
| Research | What we observed | Potential business implication |
|---|---|---|
| Residential proxy flags | 3 of 7 IPs reaching a payment-success page were flagged as residential proxies in one store. | Broad IP-based click fraud protection could misclassify potential buyers; a page visit is not a reconciled order. |
| Paid clicks from abroad | One UK campaign received 9 observed clicks, all from outside the UK, across four days. | Review market targeting and app placements if overseas demand was not intended; campaign settings were unavailable. |
| Browser clock vs. IP country | 39% of visitors with both readings had a zone mismatch, but only 3% of identified paid-click visitors did. | A high bot-traffic anomaly rate may describe datacenter visitors rather than paid ad fraud. |
| Browser consistency / userAgentData | 882 desktop-Chromium visitor IPs failed a browser consistency check; none had an observed ad-click identifier. | This bot-detection signal flagged a cohort with no observed ad-click identifier. It does not establish paid-click loss or independently verify automation. |
| Device language and time zone | Visitors with both language and time zone outside the expected market reached goal pages less often across three stores. | Combining signals may aid traffic-quality research; differing locale alone does not justify blocking customers. |
Study windows and definitions differ, and some analyses reuse the same sites and traffic. “Visitor” often means an IP address, not a uniquely identified person. Goal pages are not necessarily verified purchases. These observational findings do not establish amounts of billed ad fraud or proven financial savings. Read each study for methodology and limitations.
Ok, let's dive right in!
1. A suspicious IP address might belong to your next customer
Keyword focus: click fraud protection, bot protection
IP reputation is one of the most familiar tools in bot detection.
An address may be identified as a residential proxy, datacenter, VPN or another potentially suspicious network.
But does that make the visitor less valuable?
In our study of a small Israeli ecommerce store, residential-proxy-flagged addresses reached product and checkout pages at roughly comparable rates to unflagged ones.
Of the seven IPs that reached the payment-success page, three were flagged as residential proxies.
That's a very small sample, and a success-page visit isn't independently verified revenue. But it illustrates a significant risk.
If your bot protection rules are too broad, you may exclude visitors who are genuinely trying to buy.
We also examined the practical limitations of IP exclusions. In one 46-hour sample, only about 5% of observed Google ad clicks came from IPs that had clicked at least an hour earlier.
An exclusion list updated hourly could, at most, have affected those later repeats—not the original clicks.
That isn't proof that IP exclusion never works. It does suggest its potential should be measured against how actual visitors return.
Read the residential-proxy and IP-exclusion study
2. Some advertising problems are hiding in plain sight
Keyword focus: ad fraud detection, click fraud
On a UK commercial-property website, one Google Ads campaign produced nine observed clicks during our study period.
All nine came from outside the UK, including Egypt, Sudan, Algeria and Bangladesh.
Seven opened in mobile apps.
Does that make them fraudulent?
Not necessarily. Overseas investors could be legitimate prospects, and we didn't have the campaign's targeting configuration.
But it does provide an excellent reason to investigate.
If the campaign was intended exclusively for people in the UK, the location and placement settings deserve attention.
The potential business impact is straightforward: before investing in increasingly sophisticated fraud prevention solutions, an advertiser may benefit from understanding where each campaign actually finds its visitors.
Read the geographic traffic study
3. A bot traffic report doesn't automatically reveal wasted ad spend
Keyword focus: bot traffic, bot traffic detection, ad fraud
This was one of the clearest lessons from our research.
We compared visitors' browser time zones with their IP addresses.
Across three websites, 39% of visitors with both readings had a mismatch by our country-zone method.
That sounds alarming.
But the mismatches were concentrated in datacenter traffic.
Among identified paid-click visitors, only about 3% had a country-zone mismatch, and approximately 0.4% had an incompatible UTC offset.
The distinction matters.
A website can receive substantial automated scraping traffic without that activity appearing in its identified paid-click population.
A high bot traffic percentage is not the same as a high click fraud percentage.
Before interpreting a bot report as wasted advertising spend, you need to know which population the percentage describes.
Read the clock and IP investigation
4. Good bot detection doesn't always mean good ad fraud detection
Keyword focus: bot detection, bot identification, advanced bot detection
Modern browsers expose information about their operating environment.
Automation tools sometimes claim to be one type of browser while revealing characteristics of another.
We tested a consistency signal involving the browser's navigator.userAgentData interface.
Of 1,409 desktop Chromium visitors in our sample, 882 failed the check.
None of those failing visitors had an identified ad click, reached the observed goal pages, or returned another day.
Their traffic strongly resembled automated browsing, although we did not independently establish the identity of every visitor.
For a website operator, identifying this population could improve the interpretation of analytics, visitor counts and browsing behavior.
For an advertiser, however, the finding is more limited.
In these samples, the signal identified suspicious traffic but did not identify paid-click losses.
That's useful to know.
Not every successful bot detection technique is equally useful for click fraud prevention.
Read the browser consistency study
5. Combining signals can be more informative than trusting one
Keyword focus: bot detection solutions, bot identification
Our earlier research revisited a browser-fingerprinting observation from 2018: the relationship between visitors' language, time zone and the market a website serves.
We tested the idea across three small stores.
Visitors whose browser language and time zone both differed from local expectations reached observed goal pages less often than visitors whose settings matched.
The result appeared across all three samples, although their goal definitions and traffic populations differed.
But using either language or time zone alone was less reliable.
This raises an important question for anyone evaluating bot detection companies.
Are their classifications based on isolated suspicious attributes—or on combinations of evidence that have been tested against meaningful outcomes?
Even a statistically interesting signal shouldn't automatically become a rule that excludes visitors.
A legitimate customer can travel, use a foreign-language device or browse through a privacy service.
Read the original locale study
What does this mean for a business paying for advertising?
Across these studies, four practical risks emerge:
- False positives: suspicious technical attributes can occur among visitors who progress toward a purchase.
- Poor targeting: some campaigns may attract visitors outside the intended audience.
- Misleading analytics: automated visitors can distort general traffic metrics without necessarily affecting paid advertising.
- Overconfident decisions: a convincing detection signal may still be insufficient evidence to exclude traffic or change conversion feedback.
These risks don't translate directly into a dollar figure.
Our studies are observational, involve small sites and short sampling windows, and do not establish the amount of money lost to invalid advertising clicks.
That limitation is central to the research.
From bot detection to traffic intelligence
There's an important difference between identifying a suspicious browser and establishing what that browser means for an advertiser.
Was the visit associated with a paid click?
Did it show meaningful commercial intent?
Did it reach a conversion event?
Could the detection rule mistakenly classify legitimate customers?
And what additional evidence would justify taking action?
Those are the questions we're investigating at Button Solutions.
We believe traffic-quality research should start with observable evidence, include counterexamples, and acknowledge when the right decision is to leave a campaign alone.
Because detecting a bot is one thing.
Understanding whether it actually matters to your business is another.
This research series uses anonymized website observations and reproducible analyses. Results describe the sampled populations, not universal fraud rates or proven financial savings.
