What is suspicious behavior?

In the ClickPatrol dashboard, suspicious behavior means any pattern in a click or session that diverges strongly from how real users in your target market typically browse, in a way that suggests automation, misrepresentation, or abuse. We use the term for modeled risk, not for moral judgment: the goal is to spot traffic that is unlikely to be a genuine prospect before it burns budget.

What we analyze beyond the IP address

Legacy fraud tools often overweight simple IP blocklists. We still use network signals, but we combine them with a much wider feature set (on the order of hundreds of factors) covering device honesty, environment stability, timing, and consistency between claimed and observed data. That combined view reduces both missed fraud and blunt false positives.

Examples of patterns we watch

• Device misrepresentation: A session presents as a desktop while hardware and rendering signals look like mobile, or attributes contradict each other in ways rare for authentic users.
• VPN and proxy usage: Traffic from a VPN or proxy is not automatically bad, but certain combinations (for example, mobile device claims with datacenter tunneling) are uncommon for normal consumers and show up more often in scripted or masked traffic.
• Geographic mismatch: Your geo targets say one country, but network and device signals cluster elsewhere without a plausible explanation (stale device, emulator farm, or deliberate location spoofing).
• Velocity and repetition: Bursts of clicks, duplicated paths, or timing that looks mechanical rather than exploratory.

None of these alone proves fraud. We weight them together and against baselines for your industry and account history.

How suspicious behavior ties to scores and actions

Patterns feed into AI Score and the suspicious clicks buckets you see in reporting. When confidence is high that no human value exists, we block or exclude; when the case is ambiguous, we may flag for monitoring or leave traffic live to protect conversions. You can adjust how aggressive that boundary is in settings.

If something looks wrong to you even when automation is cautious, you can request review so our team can validate odd OS or device spikes against ground truth in your campaigns.