Concise, citation-ready definitions for the terms used across Ciaro's product, methodology, and solution pages. Each entry links back to the deeper reference on the relevant page.
Term
Click fraud
Invalid clicks on paid ads from bots, competitors, click farms, or accidental sources that drain ad budget without producing real customers.
Click fraud is any paid-ad click that is not a genuine purchase-intent action by a real user. Sources include automated bots, competitor sabotage, coordinated click farms, accidental rage-clicks, and incentivized click rings. It directly inflates CPC, distorts conversion data, and trains bidding algorithms on noise.
Term
Invalid traffic
Industry term (IAB) for any ad traffic that does not represent a real, intentional human user — covers bots, click farms, hijacked devices, and incentivized clicks.
Invalid traffic (IVT) is the IAB-standardized umbrella term spanning General Invalid Traffic (GIVT) and Sophisticated Invalid Traffic (SIVT). Networks like Google Ads filter a portion natively, but residual IVT regularly reaches advertisers and is the primary class of activity Ciaro detects.
Term
IVT (GIVT and SIVT)
GIVT = General Invalid Traffic (declared bots, datacenter IPs). SIVT = Sophisticated Invalid Traffic (residential proxies, humanized bots, click farms).
GIVT is easily identifiable non-human traffic that public lists and basic filters can flag. SIVT is the harder class — humanized browser automation, residential-proxy bots, hijacked devices, and coordinated click farms. SIVT is what survives Google's native filtering and is what dedicated detection platforms target.
Term
Smart Bidding
Google Ads' machine-learning bid strategies (tCPA, tROAS, Maximize Conversions) that set bids per auction based on conversion-likelihood signals.
Smart Bidding adjusts bids in real time using predicted conversion probability and value. Because it learns from conversion data, contaminated traffic (fake leads, bot-driven add-to-carts) directly trains the model on the wrong signal. Cleaning invalid clicks improves training quality. Aggressive IP exclusion during the 7–14 day re-learning window can briefly perturb bidding.
Term
Performance Max
Google Ads campaign type that runs across all Google inventory (Search, Display, YouTube, Discover, Shopping, Maps, Gmail) using a single goal and asset set.
Performance Max (PMax) consolidates inventory and relies heavily on Smart Bidding. Because PMax exposes minimal placement-level reporting, invalid traffic is harder to spot and harder to exclude. PMax campaigns are particularly sensitive to attribution contamination because the algorithm cannot distinguish a fake conversion from a real one.
Term
Click farm
Coordinated network of low-cost human or hybrid actors generating invalid clicks at scale on behalf of an attacker or competitor.
Click farms combine real device fingerprints, real residential IPs, and human-driven taps, which defeats most fingerprinting and IP-reputation filters. Detection relies on cross-account collision in a shared graph, behavioral entropy patterns, and conversion-eligibility checks rather than any single signal.
Term
VPN traffic
Ad clicks originating from a Virtual Private Network endpoint. Not inherently fraudulent — many legitimate users browse via VPN.
VPN traffic obscures the user's real IP behind a service-provider endpoint. Treating VPN as automatic fraud generates large volumes of false positives because corporate, privacy-conscious, and roaming users routinely use VPNs. Ciaro never blocks on VPN signal alone; corroborating behavioral and device signals are required.
Term
Shared IP
A single public IP address used by many distinct users — common with corporate networks, public Wi-Fi, and mobile carriers.
A shared IP can serve hundreds or thousands of legitimate users simultaneously. Aggressive blocking on shared IPs causes mass false positives. Detection systems must combine IP-level signal with device, behavioral, and session evidence before excluding a shared IP.
Term
Carrier-grade NAT (CGNAT)
Mobile-carrier infrastructure that maps thousands of subscribers to a small pool of public IPv4 addresses.
CGNAT means a single public IP can represent a moving population of legitimate mobile users. Ciaro identifies CGNAT ranges and applies elevated tolerance — blocks on CGNAT IPs require very strong, multi-signal evidence and are intentionally rare.
Term
Bot traffic
Automated, non-human traffic ranging from declared scrapers to humanized browser automation built to mimic real users.
Bot traffic spans a quality spectrum. Cheap bots are flagged by user-agent, automation markers (CDP, WebDriver), and TLS fingerprint. Sophisticated bots run real Chromium, simulate mouse curves, and route via residential proxies. Detection at the high end requires cross-session graph analysis and conversion-eligibility checks.
Term
Session replay
Reconstruction of a user's on-page interactions (mouse path, scroll, clicks, form input) from event data captured by a tracking script.
Session replay supplies the ground truth used to validate fraud-detection decisions and to investigate disputed blocks. Ciaro records minimum-necessary event data with sensitive fields hashed or excluded; replays are scoped to the operator's own account.
Term
Fingerprinting
Building a stable identifier for a device or browser from a combination of attributes (TLS, GPU, canvas, fonts, client hints, time zone).
Fingerprinting lets a detection system recognize the same actor across sessions even when cookies are cleared and IPs rotate. It is one signal among many — fingerprinting alone is not sufficient for blocking, because legitimate users can share fingerprints (corporate-image laptops, identical mobile devices).
Term
Behavioral analysis
Scoring how human a session looks based on mouse-movement entropy, scroll depth, dwell time, and event sequencing.
Behavioral analysis catches bots that pass network and fingerprint checks. It measures the naturalness of interaction patterns relative to a baseline of verified humans. It is the primary signal that distinguishes humanized residential-proxy bots from real users on the same IP and device class.
Term
Confidence threshold
The minimum fraud-score above which a click is blocked. Ciaro exposes thresholds in three tiers: 78–84, 85–94, and 95–100.
Lowering the threshold increases catch rate but increases false positives. Ciaro caps configurability and warns in the UI to prevent operators from setting unsafe thresholds. Each block records its score so disputed decisions can be reviewed and reversed.
Term
False positive
A click that was blocked by the fraud system but actually came from a real, purchase-intent human user.
False positives are the most expensive failure mode in click-fraud detection because they silently block real customers. Ciaro measures false positives as the share of blocked IPs that subsequently produced a verified human conversion within 30 days. Target rate: under 0.3% (Mar–Apr 2026 audit window).
Term
Attribution contamination
When invalid traffic produces fake conversions (form fills, add-to-carts) that get attributed to ad campaigns and pollute reporting and bidding.
Contaminated attribution causes Smart Bidding and Advantage+ to optimize toward the wrong audiences, inflates downstream CRM lead counts, and distorts CAC and ROAS reporting. Filtering invalid traffic before it reaches the conversion event is the only durable fix.
Term
PPC fraud
Click fraud occurring specifically on pay-per-click ad networks (Google Ads, Microsoft Ads, Meta Ads). A common synonym for click fraud in a PPC context.
PPC fraud is the cost-per-click subset of ad fraud. Because the advertiser is charged per click, every invalid click is a direct cash loss. Detection focuses on click-time signals plus post-click behavioral validation.
Term
Ad fraud
Umbrella category covering click fraud, impression fraud, conversion fraud, affiliate fraud, and inventory laundering across the digital ad ecosystem.
Ad fraud is broader than click fraud — it includes impression-stuffing, domain spoofing, hidden-ad stacking, fake conversions, affiliate-cookie stuffing, and laundered ad inventory. Ciaro's scope is the click-fraud and conversion-fraud subset for performance advertisers, not programmatic supply-side fraud.
