Click Fraud Prevention: Keep Analytics Clean

Every link you share publicly is also shared with every crawler, preview bot, security scanner, and competitive intelligence tool on the internet. The numbers from independent industry research are consistent: 15-25% of clicks on any publicly shared short link are automated traffic. For programmatic display advertising, the figure is closer to 20-35%. Paid social typically sits cleaner at 3-8%, but only because the platforms themselves do some pre-filtering before clicks reach your destination.

For most teams, this isn't a "is fraud happening" question, it's a "how much, where, and what do we do about it" question. Treat your raw click counts as directional and your filtered counts as decision-grade.

Why this matters for marketing decisions

Inflated click counts distort every downstream metric. Conversion rates look artificially low (denominator inflated by bot clicks that never convert). Cost-per-click looks artificially good (you "earned" clicks from bots you didn't pay for). Geographic data shifts toward whatever regions the bot infrastructure happens to live in (often Virginia, Iowa, Frankfurt, Singapore, datacenter hotspots). Cohort analysis fragments because bots don't return as users.

The teams that consistently make good marketing decisions don't have better tools, they have a working filter between raw and clean data, and they know which number to look at for which question.

"Bot traffic" is shorthand for a spectrum of distinct sources, each with different detection signals and different appropriate responses.

1. Search engine and preview crawlers

Googlebot, Bingbot, the LinkedIn preview crawler, Twitter card scraper, Slack unfurl bot, WhatsApp preview generator, Telegram preview bot. These all hit short links to fetch the destination's metadata. They identify themselves honestly in the User-Agent string, which makes them easy to filter, but they're still 5-10% of typical link click volume.

2. Security and uptime scanners

Email providers (Gmail, Outlook, Microsoft Defender) pre-fetch every URL in inbound messages to check for phishing and malware. Corporate security tools (Mimecast, Proofpoint, Barracuda) do the same at the gateway. Each scan creates a click. The result: B2B email campaigns often show 20-30% inflated click rates from security scanners alone, with the scanner clicks happening before the recipient sees the email.

3. Datacenter and VPN traffic

Cloud-hosted bots, scrapers, and automated browser tools (Selenium, Puppeteer, Playwright running headless) route through datacenter IPs. The User-Agent might be spoofed to look like a real browser, but the IP address belongs to AWS, GCP, DigitalOcean, OVH, or Hetzner. Concentration of clicks from these ASNs is a strong bot signal.

4. Click farms and coordinated manipulation

Human-driven click fraud, usually for competitive harm (inflating an opponent's ad spend) or for vanity-metric manipulation (boosting a click count to claim performance). Lower volume than bot traffic but harder to detect because the clicks come from real consumer devices on consumer networks.

5. Accidental and pre-fetch clicks

Mobile browsers and email clients pre-fetch some URLs to speed up perceived load times. Pinterest and other platforms pre-render link previews. These produce a "click" that the user never knowingly took, and they never convert. Apple's link previews on iOS are a major source of this on consumer-facing campaigns.

Flyn applies multi-layer filtering at the redirect server, before any click data lands in your dashboard. The default view shows filtered counts; raw counts are one click away for verification.

Layer 1, User-Agent identification

Known bot User-Agents are matched against a continuously-updated list. The big ones (Googlebot, Slackbot, WhatsApp, Twitterbot, LinkedInBot, Discordbot, Facebot, GoogleImageProxy, GmailImageProxy) are caught with near-100% recall. New entrants are added within 24 hours of identification.

Layer 2, IP and ASN heuristics

Clicks from known datacenter IP ranges (AWS, GCP, Azure, DigitalOcean, OVH, Hetzner, Linode) are flagged. Clicks from anonymising VPN providers and Tor exit nodes are flagged. The flagging is conservative, these clicks still count by default unless the volume signature suggests bot traffic, but they're tagged in the analytics so you can filter them on demand.

Layer 3, Behavioural pattern analysis

Bots leave statistical fingerprints. Identical interval timing between clicks (50ms apart, repeated), browser fingerprints repeated across hundreds of "different" sessions, sequential clicking through every link in a published list, mouse-event traces that don't exist (because headless browsers don't generate them). Flyn's pattern matcher catches these and segregates the traffic.

Layer 4, Geographic and temporal anomalies

A campaign targeted at the US that suddenly receives 60% of clicks from one Romanian ASN within 4 hours is anomalous. The dashboard flags clicks where the geographic distribution diverges sharply from the historical baseline for that link, surfacing them for review.

What you see in the dashboard

By default, the analytics view shows filtered counts. A toggle reveals raw counts, with the delta broken out by filter type so you can see exactly what was excluded. Most teams report on filtered counts internally and raw counts when comparing to partners (paid ad reports, syndication partners) that haven't applied filtering on their end.

Platform-level filtering catches the obvious cases. Operational hygiene catches the rest, and the discipline matters more than any single tool.

1. Use password-protected links for sensitive campaigns

For pre-launch announcements, exclusive offers, or limited-access content, gate the redirect with a password. Bots don't enter passwords; legitimate recipients do. The dashboard analytics filter automatically to authenticated clicks only. Pro plans include password protection on every link.

2. Apply click limits on time-sensitive promos

Cap a limited-availability link at a maximum click count so it redirects to an "offer ended" page once it is spent. Because Flyn counts human clicks, bot traffic cannot drain the allowance before real buyers arrive. The full playbook, including how to pick a fallback, is in our guide to links that expire after a number of clicks.

3. Use the safety checker as a defensive habit

For any incoming short link from an unknown source (sales prospect, partner outreach, customer support inquiry), run it through the short link safety checker before clicking. It expands the redirect chain, checks the destination against threat-intel feeds, and flags suspicious patterns. Five seconds of safety check saves hours of incident response if the link was malicious.

4. Bulk-audit your own link portfolio quarterly

Export your active link list and run it through the bulk health checker. It catches dead destinations (404s), compromised links (destinations changed without your knowledge), and outlier traffic patterns that may indicate fraud. Quarterly cadence catches problems before they affect a full reporting cycle.

5. Cross-reference with downstream analytics

If Flyn shows 10,000 clicks and GA4 shows 2,000 sessions on the destination, either GA4 is underreporting (likely, ITP, ETP, adblockers all suppress GA4) or Flyn is over-reporting. Apple's tracking prevention and Firefox's ETP cost GA4 20-40% of mobile sessions, so a 5:1 ratio is suspicious but not damning. A 50:1 ratio is.

The teams with the cleanest attribution don't have smarter analytics. They have one number they trust for top-of-funnel (link clicks, captured at the redirect server before any tracking-prevention kicks in) and one number they trust for conversion (downstream events, even if undercounted), and they never confuse them.

Most click-fraud incidents announce themselves in the data if you know what to look for. These are the warning signs that justify dropping other work and investigating.

1. Sudden spikes without campaign activity

A dormant link from a six-month-old campaign suddenly does 5,000 clicks in 2 hours. There's no email send, no paid budget, no social repost that explains it. Almost always invalid traffic, usually a scraper hitting a published list of short links, or a competitor running a click-injection attack.

2. Geographic distribution that doesn't match your market

Your campaign targets the US and Canada, but 40% of clicks come from one city in Eastern Europe in a 4-hour window. The audience profile doesn't match. The traffic isn't real.

3. Extremely low time-on-page after redirect

If your destination page records average sessions of 90 seconds normally but the latest spike shows 0.3 second average sessions, those clicks aren't humans. Headless bots load, capture the page, leave instantly.

4. Identical device fingerprints across many clicks

Flyn surfaces the device breakdown in analytics. If a single device fingerprint (combination of browser, OS, screen resolution, language) accounts for 30% of clicks across what should be a diverse audience, that's a coordinated source.

5. Click velocity exceeding plausible human rates

2,000 clicks per minute on a link that historically peaks at 50 per minute, even during your biggest campaigns, isn't load-balanced enthusiasm, it's a script.

What to do when you spot one

1. Don't immediately delete or rotate the link, preserve the data for investigation.
2. Pull the IP-level breakdown by ASN. Most coordinated traffic clusters on 1-3 ASNs.
3. If the source is identifiable (a specific datacenter ASN), add it to your IP block list via Pro features, future clicks from that range get excluded from counts.
4. For ongoing paid campaigns affected, file an invalid-traffic refund request with the ad platform, most major platforms (Google Ads, LinkedIn, Meta) honour these when you can provide IP-level evidence.
5. Document the incident in your team's analytics runbook so the pattern is recognised faster next time.

Manual review catches incidents after the fact. Webhook-based automated alerting catches them while they're happening, which matters most for paid ad spend, where every fraudulent click is direct budget loss.

The basic pattern

Flyn fires a webhook on every click. A simple consumer counts clicks per minute per link and triggers a Slack alert if the rate exceeds a configurable threshold (e.g., 50 clicks/minute on a link that averages 5). The implementation fits in 30 lines of code on any serverless platform (Cloudflare Workers, Vercel, AWS Lambda) or a no-code tool (Zapier, n8n, Make).

Threshold-setting per link type

One global threshold doesn't work. A homepage link sustains 200 clicks/minute during a launch; a niche product page averages 0.5. Set thresholds per link based on the historical p99 rate:

• Static threshold, alert if clicks/minute exceeds N (where N is 3-5× the link's historical p99 rate).
• Rolling threshold, alert if clicks/minute exceeds 5× the rolling 7-day average for that link.
• Geographic threshold, alert if >50% of clicks in any 15-minute window come from a country that has historically been <5% of traffic.

Alert channels that actually get acted on

Slack channels for the relevant team (#growth-alerts, #paid-ads) work better than email. Include the link, the current click rate, the geographic breakdown, and a link to the Flyn dashboard. A good alert should be actionable in 30 seconds, pause the campaign, block an IP range, escalate to ad ops.

For paid campaigns: tight thresholds, fast response

Paid social and search are where click fraud directly costs money. Set thresholds tighter than feels comfortable, false positives are cheap (a quick manual review), but missed fraud burns budget. Configure the alert to also notify the budget owner so they can pause spend if the alert turns out to be real fraud.

When you suspect coordinated invalid traffic, IP-level analysis is the most powerful diagnostic available. The analytics API exposes per-click ASN data, and a few minutes of analysis can localise the source.

Understanding ASN concentration

An ASN (Autonomous System Number) is the routing identifier for a network, usually a datacenter, ISP, or major hosting provider. Legitimate consumer traffic comes from thousands of ASNs (one per ISP per region). Bot traffic concentrates on tens of ASNs at most, the AWS, OVH, Hetzner, DigitalOcean ranges that bot infrastructure runs on.

Pull the click-by-ASN distribution for the suspected period. If 80% of clicks come from 3 ASNs and all three are datacenters, that's near-conclusive bot evidence.

Cross-referencing with IP-range databases

Several public databases (IPinfo, MaxMind, Spur, IPQualityScore) classify ASN ranges as residential, mobile, hosting, or business. Spur and IPQualityScore specifically maintain VPN and proxy lists. A 30-second lookup confirms whether an unfamiliar ASN is residential or bot-friendly hosting.

Using Flyn's IP blocking (Pro)

Once you've identified bot-source ASNs, Flyn Pro lets you add IP ranges or specific addresses to a block list. Future clicks from those ranges are excluded from analytics counts and from your downstream UTM-tagged sessions (because the redirect simply doesn't fire). This is the most effective long-term defence against repeated bot traffic from known infrastructure.

Common ASNs to investigate first

If you see these in your top-source ASN list and you're not running paid social through them, they're almost certainly bots:

• Amazon AWS (AS16509, AS14618)
• Google Cloud (AS15169)
• Microsoft Azure (AS8075)
• OVH (AS16276)
• Hetzner (AS24940)
• DigitalOcean (AS14061)
• Linode/Akamai (AS63949)
• Datacamp (AS60068)

Calibration matters. Set fraud-detection sensitivity too tight and you'll exclude legitimate traffic (especially security scanners on B2B campaigns); too loose and you'll report inflated numbers. These benchmarks come from independent industry research and our own aggregate platform data.

Invalid traffic by channel

What to do with the residual

Even after filtering, expect 5-10% residual non-human traffic on publicly accessible links. Treat click counts as directional signals rather than exact measurements. Focus on trends rather than absolute numbers, a link's month-over-month click growth is more reliable than its absolute click count, because the residual bot baseline is roughly constant.

When the residual matters most

For revenue attribution, the residual is usually noise. For paid ROAS calculations and campaign budget decisions, even a 5% inflation matters at scale. For audience analysis (where do my real users live, what devices do they use), filter aggressively and live with smaller absolute numbers in exchange for cleaner shape.