Why a Yandex Direct IP block stops at 25 addresses
Contents
Share
In one Yandex Direct campaign, an IP impression block stops at 25 addresses. That is what both the campaign settings and the disable-impressions page say. The help still does not recommend the block itself, even when activity looks suspicious: a dynamic address changes for the same person, and a provider or company proxy gives one address to many people.
How to turn the block on in advanced settings is covered in How to block impressions by IP. Where to read addresses in reports is in Traffic by IP. Here is the list's limit, and why the help talks you out of it.
Where those 25 addresses go
The block is named "Disable impressions by IP address". The help places it among ad experiments and says that excluding addresses can make the campaign work less effectively. 25 is the size of the list in this campaign, not a blacklist for the whole account. A neighboring campaign does not inherit the list on its own: the cap is 25 again, per campaign.
Private subnets cannot be blocked. The help's examples are 10.x.x.x and 192.168.x.x. An address from such a network will not enter the list, even when some of the 25 rows are still free.
Why the help advises against a list even shorter than 25
The block is turned on in the campaign's advanced settings. A dynamic address can change for the same person, and yesterday's block no longer catches them. A provider or company proxy gives one address to many people: blocking that one IP hits everyone who simply exits through the same proxy.
That is why the help does not recommend an IP block even when activity looks suspicious, and points you to the platform's own fraud protection. It suggests reading addresses in the server logs, and marking Direct clicks with your own link parameter. A list of 25 rows does not cancel that advice. It only limits how many addresses you can enter before the address has already changed.
| What you wanted | What the campaign field does | Where it breaks |
|---|---|---|
| Block one suspicious address | Up to 25 addresses in the campaign | A dynamic address changes |
| Block an office network 10.x or 192.168.x | It does not enter the list | Private subnets cannot be blocked |
| Cut off everyone behind a shared proxy | One address stands for many people | The block hits more than the suspicious visit |
| One list for the whole account | The cap is set on the campaign | 25 is counted again in each campaign |
What to do instead of a long list
Open the server logs and write down addresses that repeat. The help looks there, not in an endless Direct field.
Mark clicks from Direct with your own link parameter, as the same help asks. A visit from ads is then visible without relying on one IP.
If you do enter an address, remember the 25 per campaign and the ban on private subnets. A 26th address will not fit in this field.
Do not expect the list to replace the platform's protection. When activity looks suspicious, the help sends you to its own fraud protection, not to a longer list.
A teaching example, not account statistics. The logs for a day show 40 different addresses with repeat visits. The campaign will take the first 25. The field will not take the other 15, even if each of them looks like the first ones. The next day, part of the first twenty may already have changed, if the address is dynamic. The field is still 25 rows.
One address in the log and one address in the field are not the same entry
The server log shows the address at the moment of the request. The campaign field stores the string you typed until you delete it yourself. Between those moments a dynamic address has time to change: the person you saw in the morning comes back in the evening on a different IP, and the morning address may belong to someone else. The block keeps cutting the morning string.
A shared proxy makes the same fork sharper. One address in the log belongs to many people, and a row in the list of 25 closes everyone who exits through that proxy, beyond the visit that looked odd. That is why the help reads addresses in the logs, so you can see them, and does not recommend copying them into a block as a way to protect the account.
Your own link parameter on a click from Direct separates an ad visit from the question "whose IP is this". The parameter arrives with the click. The list of 25 addresses is not tied to the click: it stops an impression on an address, whatever campaign caused the visit. If the job is to see which visits came from an ad, the link parameter answers it. The IP field answers a different job: do not show the ad on these addresses, and on no more than 25 of them in one campaign.
So the order is this. Logs and the link parameter first. Then, if an ad experiment really does need an address excluded, no more than 25 rows, without the private subnets 10.x.x.x and 192.168.x.x, knowing that the next day some rows no longer match the same people. The field will not take a 26th row. A second campaign has to be filled again: the list belongs to the campaign.
What 25 addresses do not prove
A full list does not mean the suspicious visits are over. It means the campaign field is full. Empty rows do not mean the traffic is clean: the help says the block is a poor catch for a dynamic address and a shared proxy.
Exclusion can make the campaign less effective. That warning sits on the settings page next to the block itself. Short ad experiments are the frame the help puts this block in, not a permanent contour for the whole account.
If you need addresses to see where traffic came from, read them in the logs and in the report the IP-traffic article points to. A field of 25 rows is tight for that reading, and the help does not assign it to that job.