Device-to-IP ratio refers to the number of unique IP addresses associated with a single device and it is one of many signals Fraud Blocker uses for it overall fraud detection system.
Fraudulent devices often use many IP addresses in a single session or over multiple sessions, while legitimate users typically use very few.
Fraud Blocker tracks both a visitor's IP address and device fingerprint (aka device ID) to monitor this ratio in real-time. By analyzing this ratio, Fraud Blocker can help identify patterns and anomalies indicative of fraudulent activity.
Device-to-IP ratio is an important part of Fraud Blocker's overall fraud detection system.
What is the average Device-to-IP ratio?
Fraud Blocker analyzes ~60 million IP addresses and ~20 million unique devices per month.
Our system starts flagging devices for fraud once they cross 6 IPs in any single hour of time. The fraud score increases incrementally for each additional IP it accesses as the device becomes more poisoned. Some other indicators, such as Googlebot IPs, are excluded from this calculation.
Below is the average of Device-to-IPs based on Fraud Blocker's data from March to April 2025:
IPs accessed in 1 hour | Unique devices | percentage |
1 | 31,351,466 | 89.72% |
2 | 2,124,208 | 6.08% |
3 | 634,496 | 1.82% |
4 | 285,908 | 0.82% |
5 | 155,907 | 0.45% |
6 | 95,228 | 0.27% |
7 | 62,636 | 0.18% |
8 | 43,523 | 0.12% |
9 | 31,200 | 0.09% |
10 | 23,672 | 0.07% |
11 | 17,970 | 0.05% |
12 | 14,372 | 0.04% |
13 | 11,784 | 0.03% |
14 | 9,673 | 0.03% |
15 | 7,834 | 0.02% |
16 | 6,815 | 0.02% |
17 | 5,729 | 0.02% |
18 | 4,903 | 0.01% |
19 | 4,252 | 0.01% |
20 | 3,755 | 0.01% |
21 | 3,350 | 0.01% |
22 | 2,896 | 0.01% |
23 | 2,646 | 0.01% |
24 | 2,502 | 0.01% |
25 | 2,127 | 0.01% |
26 | 2,042 | 0.01% |
27 | 1,752 | 0.01% |
28 | 1,587 | 0.00% |
29 | 1,394 | 0.00% |
30+ | 27,720 | 0.07% |
How can Device-to-IP ratio help with ad fraud detection?
Identifying potential bots and click farms:
Fraudulent devices, like bots or click farms, may generate ad bid requests using multiple IP addresses to simulate traffic from multiple users.
IP masking and VPN usage:
Fraudsters often use VPNs or IP masking to hide their true IP addresses, making it appear as if the clicks are coming from different locations.
Analyzing user behavior:
A high device-to-IP ratio can indicate unusual user behavior, such as a single user making ad requests from multiple locations within a short period.
Related: