Seatext library / BotRefund evidence
Can I Identify Which Competitor Is Clicking My Ads?
You cannot directly see a competitor's name in your ad platform logs, but you can infer the source by analyzing IP addresses, device fingerprints, click timing, and behavioral patterns. Cross-referencing this data with known...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Platforms like Google Ads and Meta do not expose the identity of who clicked your ads. They show aggregated data — clicks, impressions, cost — but not the organization behind a specific IP address. What you can do is collect forensic evidence: IP addresses, user agents, GCLIDs or FBCLIDs, mouse movements, scroll depth, and session timing. When you see repeated clicks from the same corporate IP block, a known VPN exit node, or a data center range, and those clicks match a competitor's geographic footprint or bidding schedule, the inference becomes strong. Third-party tools such as ClickCease and Hitprobe claim to automate this correlation, but they rely on the same underlying signals you can access yourself.
Why identifying the clicker matters
Click fraud drains budget and poisons conversion data. When bots or competitors click your ads, you pay for traffic that never converts. Worse, those fake interactions feed the ad platform's optimization algorithms, teaching them to find more similar — non-human — traffic. The result is a downward spiral: higher costs, lower ROAS, and a pixel trained on garbage. Identifying the source lets you block IP ranges, submit refund requests with evidence, and adjust targeting to exclude the offending networks. It also helps you decide whether to invest in a detection tool, build internal monitoring, or escalate to the ad platform's support team.
What signals you can actually collect
Every click that reaches your landing page carries technical metadata. The most useful fields are:
- IP address — reveals ISP, organization (sometimes), geographic region, and whether it's a data center, residential, or mobile connection.
- GCLID / FBCLID — the click ID Google or Meta appends to the URL. You can tie this to a specific campaign, keyword, ad, and timestamp in the platform's reports.
- User agent and client hints — browser version, OS, device type. Bots often use outdated or mismatched strings.
- Behavioral telemetry — mouse movement, scroll depth, time on page, click sequences. Human sessions show tremor, hesitation, and varied pacing; bot sessions often show linear paths, superhuman speed (<1ms interactions), or zero engagement.
- Referrer and UTM parameters — tells you which placement, network, or partner site delivered the click.
Google's own automated filters catch less than 50% of invalid traffic, leaving the rest classified as sophisticated invalid traffic (SIVT) that requires manual evidence submission. BotRefund's aggregated audit data shows an 11% to 14% average invalid click rate across all Google Ads campaigns.
Methods to infer the competitor behind the clicks
1. IP intelligence and reverse lookup
Run the offending IPs through an ASN (Autonomous System Number) lookup. Many companies register their office IP blocks under their corporate name. If clicks come from an ASN owned by a known rival, that's a strong signal. Tools like ipinfo.io, MaxMind, or even a simple whois can reveal the organization field. Note: sophisticated actors use residential proxy networks or VPNs that mask the true origin.
2. Geographic and temporal correlation
Map click timestamps to your competitor's business hours, time zone, or known campaign schedules. If invalid spikes align with their product launches, sales pushes, or bid adjustments, the pattern is suggestive. Combine with geo-data: clicks from the city where their headquarters or a known satellite office sits.
3. VPN and proxy detection
Competitors often hide behind VPN exit nodes or data center proxies. Maintain a blocklist of known VPN ranges (commercial lists exist) and flag clicks from those IPs. BotRefund's detection includes VPN identification as a standard signal. If a high-value keyword suddenly sees a surge from VPN IPs, it's worth investigating.
4. Behavioral fingerprinting
Advanced bots mimic human behavior, but most still fail at micro-patterns: absence of mouse tremor, grid-aligned movement, superhuman input speed, or unnatural session durations. Client-side scripts (like BotRefund's) capture these signals and tie them to the GCLID. When you see the same behavioral fingerprint across multiple clicks from different IPs but the same campaign, you're likely looking at a coordinated operation — possibly a click farm hired by a competitor.
5. Third-party correlation services
Services like ClickCease and Hitprobe aggregate IP reputation databases and claim to match clicks to competitor domains. Their marketing suggests they can "spot and block competitor clicks." Treat these as third-party claims; the underlying data is still IP reputation and behavioral heuristics. They may save you engineering time, but they don't have access to a secret competitor registry.
Decision criteria: choose your approach
Not every advertiser needs the same solution. Use the table below to match your situation to a practical path.
| Criterion | DIY log analysis | Detection script (e.g., BotRefund) | Managed click-fraud service (e.g., ClickCease) | Enterprise forensic audit |
|---|---|---|---|---|
| Setup effort | High — requires GA4/BigQuery, IP enrichment, alerting | Low — one-line JS install, auto-captures GCLID + behavior | Low — DNS or tag-manager integration | Very high — custom engagement, legal review |
| Evidence quality for refunds | Manual, inconsistent | Audit-ready reports with behavioral proof | Platform-specific blocklists, limited raw evidence | Court-grade, chain-of-custody logs |
| Competitor identification depth | IP org lookup only | IP org + behavioral fingerprint + VPN detection | IP reputation DB + claimed competitor mapping | Full attribution: legal entity, proxy chain, intent |
| Ongoing maintenance | You own it | Vendor maintains detection models | Vendor manages rules | Project-based, not continuous |
| Cost model | Engineering time | Tiered by ad spend (free under $10k/mo) | Monthly SaaS fee | Per-audit fee ($10k+) |
| Best fit | Technical teams with low spend, high curiosity | Advertisers spending $10k–$1M+/mo who want refunds | Teams wanting hands-off blocking, less evidence control | Legal disputes, M&A due diligence, high-stakes fraud |
Choose DIY if...
You have engineering bandwidth, spend under $10k/month, and mainly want to understand the problem before buying. Start with Google Ads' invalid-click report, enable auto-tagging, and export GCLIDs to BigQuery. Enrich with MaxMind GeoIP2-ISP. Build alerts for: >5 clicks from same /24 subnet in 1 hour, >30% bounce rate from single ISP, clicks from data-center ASNs.
Choose a detection script if...
You spend $10k–$1M+/month on Google or Meta, want refund-ready evidence without building infrastructure, and need behavioral proof (mouse tremor, scroll, speed) that platform filters miss. BotRefund installs in about one minute, captures GCLIDs with behavioral evidence, and generates audit-ready dispute reports. It also protects conversion pixels from poisoning in real time.
Choose a managed service if...
You prefer a hands-off blocklist approach, don't need raw evidence for disputes, and are comfortable with the vendor's opacity on how they map IPs to competitors. ClickCease and similar tools auto-block suspicious IPs in Google Ads via API. They're faster to deploy but give you less visibility into why an IP was blocked.
Choose enterprise forensic audit if...
You're preparing a legal case, suspect a sophisticated proxy chain, or need attribution that holds up in court. This is overkill for routine budget protection.
Step-by-step: from suspicion to action
- Pull the invalid-click report in Google Ads (Tools → Invalid clicks). Note the date ranges and campaigns flagged.
- Export click-level data with GCLID, timestamp, campaign, keyword. Use auto-tagging + BigQuery link or the Ads API.
- Enrich with IP intelligence. Join your web server logs (or CDN logs) on GCLID to get client IP. Run each IP through ASN/ISP lookup.
- Cluster by organization. Group clicks by ASN name. Flag any ASN matching a known competitor, data-center provider, or VPN service.
- Add behavioral layer. If you have client-side tracking, pull mouse-move, scroll, and timing metrics per GCLID. Flag sessions with: zero scroll, <2s dwell, linear mouse path, or input speed <1ms.
- Build the evidence packet. For each suspicious cluster: campaign, date range, click count, spend wasted, IP list, ASN names, behavioral anomalies, screenshots of session replays.
- Submit refund request via Google Ads support (or Meta's equivalent). Attach the packet. Reference Google's policy on sophisticated invalid traffic.
- Block and monitor. Add confirmed bad IP ranges to campaign exclusions. Deploy ongoing detection (script or service) to catch new waves.
Practical scenarios
Scenario A: Sudden CPC spike on a branded keyword
Your branded term CPC jumps 40% overnight. Invalid-click report shows 22% invalid rate. IP enrichment reveals 60% of those clicks come from a single ASN registered to a competitor's parent company. Behavioral data shows zero scroll, superhuman click speed. Action: submit refund with IP + behavioral evidence; add competitor's ASN to exclusion list; enable detection script for ongoing protection.
Scenario B: High bounce from residential ISPs in a foreign country
You target US only, but see clicks from residential IPs in Vietnam with 95% bounce. ASN lookup shows major Vietnamese ISPs — not a competitor's office. Likely a click farm using residential proxies. Action: exclude the country (if not targeted), block the specific ISP ranges, submit refund. Competitor identification unlikely; focus on blocking.
Scenario C: Lead forms filled with gibberish from corporate IPs
Meta lead forms receive submissions from IPs belonging to a rival's marketing department. Form fields show copy-paste patterns, zero dwell time. Action: capture FBCLID, tie to IP, submit to Meta with behavioral proof. Block the IP range. Consider whether the rival is testing your funnel or deliberately poisoning your pixel.
Limitations and when this advice doesn't apply
- No guaranteed identification. Sophisticated actors use rotating residential proxies, botnets, or compromised devices. The IP you see may be a victim's home connection, not the attacker.
- Platforms won't confirm. Google and Meta will not tell you "Company X clicked your ads." They only approve or deny refunds based on evidence you provide.
- Legal risk. Accusing a specific competitor publicly without court-grade proof can expose you to defamation claims. Keep accusations internal and evidence-based.
- Low-spend accounts. If you spend under $5k/month, the engineering cost of DIY analysis rarely pays off. A free detection script tier (BotRefund offers free under $10k/mo) is more practical.
- Brand protection vs. budget protection. Identifying the competitor satisfies curiosity; blocking the traffic protects budget. Prioritize the latter.
Key facts
| Metric | Value | Source |
|---|---|---|
| Average invalid click rate (Google Ads) | 11%–14% | S1 |
| Google's automated filter catch rate | <50% | S1 |
| Global digital ad fraud projection (2026) | >$100 billion | S1, S3 |
| Non-human internet traffic share | 43% | S3 |
| ROAS improvement after cleaning traffic | 40%–60% avg within 6–8 weeks | S5 |
| BotRefund refund success rate (high-volume) | 83% | S2 |
| BotRefund free tier threshold | Under $10,000/mo ad spend | S2 |
| Refund lookback window | Back to 2017 | S2 |
Terminology
- GCLID / FBCLID — Google Click ID / Facebook Click ID. Unique token appended to landing-page URL for each paid click.
- SIVT — Sophisticated Invalid Traffic. Fraud that mimics human behavior well enough to bypass automated filters.
- ASN — Autonomous System Number. Identifies the network operator (ISP, hosting provider, corporation) that owns an IP block.
- Pixel poisoning — When bot traffic triggers conversion pixels, corrupting the platform's optimization model.
- Residential proxy — A proxy network that routes traffic through real home internet connections, making bots appear as legitimate users.
FAQ
Can Google tell me which competitor clicked my ads?
No. Google's invalid-click reports show aggregated counts and rates, not identities. They do not disclose IP ownership or organizational details to advertisers.
Is it legal to track competitor IP addresses?
Collecting IPs that hit your own website is standard analytics. Using that data to block traffic or request refunds is legitimate. Publicly accusing a named company without verified proof carries legal risk.
How much budget can I realistically recover?
Refund approval depends on evidence quality. BotRefund reports an 83% success rate for high-volume advertisers with behavioral evidence. Average invalid click rates of 11–14% suggest a similar recovery ceiling if you document thoroughly.
Do I need a tool, or can I just use Google Analytics?
GA4 shows sessions, not click-level GCLIDs tied to behavioral micro-signals. You can build a pipeline (GA4 → BigQuery → IP enrichment), but it requires engineering. A detection script captures the same data automatically and formats it for refund disputes.
What if the competitor uses a click farm in another country?
You'll see residential IPs from that country, not the competitor's office. You can block the geographic region or ISP ranges, but identifying the hiring party is nearly impossible without legal discovery.
How often should I audit for competitor clicks?
Continuous monitoring beats periodic audits. Fraud patterns shift weekly. A detection script runs 24/7; a manual audit is a snapshot. If you audit manually, do it monthly at minimum, or after any sudden performance change.
Will blocking competitor IPs hurt my legitimate traffic?
If you block by ASN or /24 subnet, you may catch some real users from the same office park or ISP. Use behavioral evidence (zero engagement, bot signatures) to narrow the block to only the fraudulent sessions. Most detection tools apply blocks at the click-ID level, not the whole IP range.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.