What is a datacenter IP, and why does it matter for ads?

Almost every conversation about ad fraud ends up at datacenter IPs, usually without anyone defining the term. It is worth getting right, because a single rule based on it removes more junk traffic than anything else you can configure in an afternoon — and because applied carelessly it will block customers.

The three kinds of address

Residential

Assigned by a consumer ISP to a home connection. Almost all of your genuine desktop traffic arrives this way. Expensive to acquire at scale, which is exactly why fraud operations prefer not to.

Mobile

Assigned by a carrier to a phone network. These are shared aggressively — thousands of real people can appear behind one address in a day — which is why rate-limiting by IP alone misfires badly on mobile traffic.

Datacenter

Assigned to a hosting provider: AWS, Google Cloud, Azure, DigitalOcean, OVH, Hetzner and hundreds of smaller ones. Nobody browses from a server rack for fun. Legitimate traffic from these ranges is overwhelmingly machine traffic.

How an address is identified

Every IP belongs to an Autonomous System, identified by an ASN, and the ASN is registered to an organisation. The registry is public. Hosting providers register their ranges as hosting, so the classification is a lookup rather than a guess — which is why datacenter detection is reliable in a way that behavioural detection is not.

What legitimately comes from a datacenter

Blocking all of it blindly is a mistake. The following are machine traffic you want to arrive:

• Search engine crawlers — Googlebot, Bingbot. Block these and you lose organic rankings.
• Ad platform review crawlers, which check that your landing page matches your ad. Block these and your ads get disapproved.
• Uptime monitors and your own health checks.
• Link preview fetchers from Slack, WhatsApp, Discord, LinkedIn and others.
• Corporate VPN exits, which can be registered to hosting ranges — real employees, real buyers.

The last one is the reason a blanket block is risky, and the first two are the reason it can quietly cost you far more than the fraud it prevented. Verified search and ad-review crawlers must be served exactly what a human is served; identifying them is for reporting, never for showing them something different.

A sane first rule

The rule that catches the most junk with the least collateral damage is: block datacenter and hosting traffic on paid landing pages only, with verified crawlers allowed through, and watch it for a week before extending it anywhere else.

1. 1Apply it to paid traffic only at first — your organic and direct traffic is not the problem you are solving.
2. 2Keep verified search and ad-review crawlers on the allow path, always.
3. 3Watch your conversion rate for a week. If it falls, you are blocking buyers, probably behind a corporate VPN.
4. 4Only then consider extending it to the rest of the site.

Why the IP alone is not enough

Serious operations buy residential proxy access, which puts their traffic on ordinary consumer addresses. At that point the IP tells you nothing and you need a signal that does not depend on it — the TLS handshake, for instance, which is determined by the client software rather than the network it sits on. That is the gap JA3 and JA4 fingerprinting is for, and it is a longer subject than this post.