What is data-centre traffic?
Data-centre traffic is clicks, installs or in-app events that come from IP addresses belonging to cloud and hosting providers instead of consumer mobile or broadband networks. It is also written data center traffic or server traffic. In mobile advertising, a high share of it from one source almost always means automated activity.
Why it matters for ad fraud
- Real users rarely come from servers: people tap ads on phones on mobile data or home Wi-Fi.
- Scripts and bots do: bot traffic and click farms are cheap to run on cloud servers, so their clicks carry cloud IPs.
- It feeds click spamming: large volumes of server clicks can land inside real installs' attribution windows and steal credit. See click spamming.
How it is detected
- IP reputation: match each IP against known data-centre ranges, proxies and previously flagged addresses.
- Volume per IP: hundreds of clicks from one address, or several clicks a second, are beyond what one person can do.
- Cross-app patterns: the same small group of IPs appearing across unrelated apps or campaigns.
- Outcome gap: huge click volume with a tiny click-to-install rate.
Where it causes false positives
- VPNs and privacy relays: some genuine users browse through cloud IPs.
- Corporate networks: office traffic can route through hosted gateways.
- Link scanners: security tools and messaging apps preview links from servers, inflating clicks without fraud intent.
Tag matches and review them by source before suppressing anything.
How Linkrunner does this
Fraud Control includes click flooding templates by IP and by device, and rules can be previewed on past traffic and run as Tag only first. In one case in Linkrunner data, a few hundred thousand clicks across two apps came from a small group of cloud server IPs, at about 0.5% click-to-install, and an IP reputation rule tagged them. Linkrunner also filters bots that identify themselves. See how mobile install fraud is detected.