Find campaigns that need investigation by comparing identifiable paid visits, collection coverage, traffic evidence and meaningful outcomes within comparable cohorts. Then inspect the journeys behind the difference. A campaign's suspicious share can help prioritise work; it does not explain the cause or measure wasted spend.
A small published Button study shows why the campaign breakdown matters—and why the next step depends on business context.
What an account average concealed
On a UK commercial-property lettings site, 15 of 241 ad-click IPs were outside the UK: 6.2%. The observations covered 9 October 2026 at 11:31 through 13 October at 20:48 UTC.
The published campaign breakdown was much more concentrated:
| Group | Ad-click IPs | Outside the UK | Share |
|---|---|---|---|
| Google campaign A | 9 | 9 | 100% |
| Google campaign B | 33 | 4 | 12.1% |
| Remaining Google and Microsoft ad-click IPs | 199 | 2 | 1.0% |
| Site total | 241 | 15 | 6.2% |
The unit is an IP address with an observed advertising click identifier, not a billed click, person or independently identified device. An IP can be shared, and campaign membership can overlap; the table should not be interpreted as a financial allocation. The displayed percentages are the fractions in each row, rounded for readability.
Campaign A's nine observations justified a focused review. They did not establish bots or fraud. We did not have the campaign settings or verified lead outcomes. A property business might intentionally seek overseas buyers; if it did not, the first question would be why that campaign reached them.
The original study's in-app detail relies on an unpublished indicator. This guide uses the reproducible IP-country and campaign counts rather than treating that private indicator as independently reproducible evidence.
Build a comparison that answers your question
Start with one site and a declared period. Link landing visits to available click identifiers and verified campaign metadata. Keep unknown attribution as its own group. A URL hint or an unexplained parameter is not enough to establish campaign type; our gad_source research explains that limitation.
For each campaign, record:
- The number of eligible paid clicks or ad-click IPs, with the unit named consistently.
- How many have usable classification and journey evidence, and how many remain unresolved.
- Counts and shares for the specific concern: an automation finding, an unexpected location or an unusual journey pattern.
- Progress to relevant pages, labelled as page reach, and verified orders or qualified leads separately where available.
- Its intended audience, landing page and recent changes that could explain the result.
To measure a suspicious share, divide flagged units by eligible units of the same kind. State how unresolved observations are handled. Compare collection coverage too: a campaign with fewer completed checks can appear cleaner simply because less was observed.
Compare like with like
A brand-search visitor, a returning customer and someone encountering a display ad for the first time may behave differently. Compare a campaign with its own compatible baseline, then account for landing page, geography, device, network and purpose before interpreting cross-campaign differences.
For sales or lead rates, allow the same follow-up horizon. If one cohort is recent, some outcomes are still pending. If the landing page or collection method changed, preserve that date in the comparison.
The same caution applies to location. Google offers different location-targeting options. Review actual settings and intended markets before attributing an overseas pattern to a mistake. Browser time zone and IP location can provide context; neither establishes physical location or humanity with certainty.
Open the journeys behind the difference
Inspect representative visits from the group that attracted attention, including counterexamples. Ask what evidence supports the concern, whether it is independent of the grouping variable, and whether the visitor reached meaningful pages.
For a proxy-heavy campaign, avoid using the same proxy label as both the reason to select the group and the proof that it is automated. Our residential-proxy study contains outcome-page counterexamples that a broad reputation rule would have included.
Keep same-site linkage clear. Pages visited by another person sharing an IP must not become a confident account of this click's journey. Missing or ambiguous linkage belongs in the report as a limitation.
Turn the finding into a decision record
A useful client or founder report can be brief:
- Observation: name the campaign, period, counts and coverage.
- Evidence: link the supporting visits and the comparison cohort.
- Alternatives: state what targeting, instrumentation or customer behaviour might also explain it.
- Next check: identify the information or bounded test that would distinguish those explanations.
- Review: record the responsible owner, date and what would justify keeping or reversing a change.
For the published geography example, that next check is the campaign's intended market and location settings. It is not a demonstrated recommendation to pause the campaign or block every foreign address.
Questions advertisers ask
Should I rank campaigns by suspicious percentage?
Use it alongside the count, coverage, baseline and evidence strength. A small group with a high percentage can be worth inspecting without establishing a stable rate. Missing spend and verified outcomes mean you cannot rank financial loss reliably.
Does this establish that Performance Max sends bad traffic?
No. The example does not establish the campaign type. A Performance Max comparison needs verified metadata and compatible cohorts; an unexplained URL parameter cannot supply that proof.
Sources and method
The example is from Button's October 2026 geography study and its public dataset and reproduction scripts, particularly reproduce_geo.py. It excludes crawlers and observations without the required IP-location data. Short windows, missing click attribution and page-based goals limit the interpretation. This article introduces no new dataset, fraud-rate estimate or measured intervention result.
For the wider diagnosis, read clicks but no sales and evidence of bots clicking ads. To apply the method, install Button and learn to read its traffic evidence.
AI disclosure: Written by ChatGPT (AI), using Button's published geography and proxy studies, originally analysed by Claude (Anthropic). Research signals and data: Nathan Pankowsky. Editor: Nathan Pankowsky.