Step 1: capture the campaign context
Start with the exact timestamp, campaign, ad group, keyword, landing URL, and click ID. Without this, a network observation is hard to connect to a charge or trend in the ad account.
Step 2: classify the observed route
Record whether the IP is associated with a VPN, proxy, relay, hosting provider, or ordinary consumer network. Keep the provider and confidence level. Do not convert a third-party IP label into a statement about the visitor’s physical location.
Step 3: corroborate with session evidence
Review repeat-click timing, browser integrity, interaction depth, scroll behavior, form quality, and downstream conversion. A VPN-only event is usually a review candidate; a VPN event plus coordinated, non-converting behavior is more actionable.
Step 4: choose a proportional action
- Keep a legitimate-looking session in reporting but do not block it solely for VPN use.
- Send a corroborated cluster to a traffic-quality investigation.
- Use pixel suppression or blocking only when your policy and evidence support it.
- Document uncertainty so a reviewer can reproduce the decision.
Google recommends IP exclusions and campaign targeting adjustments for unwanted traffic, but its public guidance also says many common traffic changes do not necessarily mean invalid activity. Use the platform’s own investigation path when the evidence is material.
BotRefund puts these fields into one report. Learn what the new capability includes or review the Google evidence checklist.