Why manual click-fraud protection does not scale
Contents
Share
Manual click-fraud protection in Yandex Direct runs into how the help itself says to work with placements, addresses, and geography. The help calls it irrational to review placements by hand and turn off the ineffective ones. It offers the “Maximum conversions” strategy or key goals instead: the bid is lower where the conversion forecast is worse. On one or two conversions, the price can differ sharply from a stable one.
That is a recommendation for judging effectiveness, not a ban on excluding a placement. Below is why the same manual loop handles IP and geography poorly, and what the limits of those settings actually are.
Placements: one or two conversions do not hold a price
A placements report shows spend, clicks, and conversions, and the temptation to switch off a “bad” row is large. The help looks at it differently. It calls manual review and switching off ineffective placements irrational, and it offers to let the conversion forecast lower the bid: the “Maximum conversions” strategy or key goals.
The caveat about one or two conversions is direct. A price on that volume can differ sharply from a stable one. A placement that produced one expensive conversion in the period, or none, is not described by this fact as click fraud. The fact is about a shaky price, not about a ban on ever excluding a placement. “Turn it off forever after one conversion” is exactly the kind of blanket manual review the help argues against.
Scale breaks on the number of rows. Each placement needs its own decision, and a stable price does not exist yet at one or two conversions. While there are more decisions than conversions, the manual list grows faster than the grounds for changing it.
The help does not recommend an IP ban
Banning impressions by IP is turned on in the extra settings of a Direct campaign. Private subnets cannot be banned. The help’s examples are 10.x.x.x and 192.168.x.x.
The help then explains why an address list is a poor way to separate a person. A dynamic address can change for the same person. A provider or company proxy gives one address to many people. That is why the help does not recommend an IP ban even when activity looks suspicious, and it points to Direct’s own fraud protection.
It suggests looking at addresses in the server logs and marking visits from Direct with your own link parameter. Looking at an address and banning impressions by an address are different actions. The first remains a way to read a log. The second is not advised as protection, including when the activity already looks suspicious.
In the campaign parameters, turning off impressions by IP allows up to 25 addresses. The help warns that excluding addresses can make the campaign work ineffectively. Twenty-five is the size of the list in the campaign, not a “normal number of bots.” Why an IP ban is not advised at all is above: the address changes for the same person and is shared by many people on a proxy. The limit of 25 only adds a ceiling. Even if the list were longer, the help would still not recommend the method.
| Limit | What the help says |
|---|---|
| Private subnets 10.x.x.x and 192.168.x.x | Cannot be banned |
| A dynamic address | Can change for the same person |
| A provider or company proxy | One address for many people |
| The list in a campaign | Up to 25 addresses |
| Suspicious activity | An IP ban is still not recommended |
A manual list of 25 addresses does not scale to address changes or to a shared proxy. The same person drops out of the ban when the address changes. Many different people fall under the ban when they sit behind one company or provider address. Because of that, the help points to its own fraud protection rather than to extending the list.
Geography looks wider than the current point
Direct’s help defines geotargeting as managing the geography of impressions. In a selected region, the ad can be seen by people who live there, people who are there now, and people who are interested in the product or service. The system looks at location, query context, how geolocation changes, and the regions where the person buys more often, all at once.
The people this can reach include those who turned off location sharing or who change the device’s geolocation. The page does not use the word VPN. The text does not imply that a change of device geolocation marks the visit as a bot. Manual “protection” through a narrow region is therefore not the same as cutting off automatic clicks. It changes who can be shown the ad at all, including people who change geolocation.
A region on the map is set with a radius from 0.5 to 10 km. A group can have at most 100 addresses. The help says that choosing regions on the map can narrow impressions sharply. Those are limits of the map setting, not a fraud threshold. A 0.5 km radius and a hundred addresses do not describe a “suspicious visit.” They describe how tightly a zone can be drawn and how many points fit in it.
Narrowing the map hits impressions harder than any single address on an IP list. A campaign squeezed by hand to a radius and a hundred points loses the audience geotargeting is built to reach: people who live in the region, people who are there now, and people interested in the service, including those who do not share location.
The manual loop of three methods — reviewing placements, banning 25 IPs, and a tight map — hits different ceilings. The help suggests not reviewing placements one by one, because a price on one or two conversions is shaky. It does not recommend banning IPs even when activity looks suspicious. The map can narrow impressions sharply and still does not mark a geolocation change as a bot. None of the three methods grows longer because there are more visits: the limits stay the campaign’s limits.