Before TrafficShield was a product, it was the in-house defense stack protecting a fleet of local-service delivery businesses running paid search every day in Canada. This is what attacked us, what actually worked, and the numbers behind it.
We run local delivery businesses that live and die on Google Ads. Over five years we watched invalid traffic evolve from crude repeat-clickers into something far more organized. The breaking point: one campaign burned nearly a third of a month’s budget at 0% real conversions while a concurrent search campaign for the same business, same city, same budget converted at 16.5%. Same product, same geography — the only difference was which campaign the bots had latched onto.
Rotating residential botnets. On one account we tracked a single device fingerprint across 125 unique residential IPs in 15 days — every click paid. To an IP-blocking tool, that’s 125 different new visitors. IP exclusions were useless; hardware fingerprinting caught it in one day of data.
IPv6 rotation inside a /64. Fresh address on literally every click. We stopped blocking addresses and started aggregating to the network. One rule, entire attack class dead.
Slow-burn warming. Two or three clicks a day, every day, from the same fingerprints — under every frequency cap ever written. Only multi-week behavioral tracking catches it.
Shared ad-URL replays. One paid click’s URL forwarded around a group chat, replayed across dozens of devices, poisoning audiences and conversion data for weeks.
In one 30-day window on a single account, the system identified 2,714 paid clicks from blocked hardware — clicks that would otherwise have been billed as legitimate. Across the documented attack clusters on that account we calculated roughly $9,600 CAD in estimated damage, packaged the timestamped evidence, and filed invalid-click refund claims with Google — a process we’ve now productized as TrafficShield’s refund-evidence export.
Across the fleet today: 143 production sites protected, 243 residential botnet clusters tracked and neutralized, $158K+ in ad spend protected. Every detection rule in TrafficShield exists because something on this list attacked a real campaign with real money behind it.
The 30-Day Audit runs the full detection engine on your real traffic for $29.99 one-time — no subscription, no auto-renewal — and emails you the report. If your traffic is clean, you’ll know. If it isn’t, you’ll have the evidence.
Install in five minutes and watch the fraud show up in your first hour. 14-day money-back guarantee.
Protect My Ads Book a Demo