What this attack actually looks like
The current wave of click fraud uses automated clicking software that routes every single click through a different residential IP, so no two clicks ever share an address. One advertiser on r/PPC, running high-ticket campaigns, described it precisely: "Standard IP blocking is completely useless against this because the bot constantly rotates through clean residential proxies (primarily across NL, DE, CH, and FR) to change its IP address on every single click." On the front end, the traffic mimics real users. The tool they caught in the act was TrafficBotPro, a commercial product, not a custom build.
That advertiser is not unlucky. This is a product category. Another r/PPC thread was literally a job posting: someone openly looking for an "expert" to click a competitor's ads using bots and proxies. People shop for this in public forums, under their own accounts. If a click in your market costs 20, 50, or 200 euros, assume someone has at least priced out doing this to you.
Why a proxy company is writing this
BirdProxies sells residential, ISP and mobile proxies, our terms prohibit ad fraud, and the reason we can explain exactly why your IP blocklist fails is that rotation is the thing we build. That is the whole disclosure. Everything below is defense. We will not describe how to make bot clicks look more real, because the people doing this already know, and you gain nothing from it.
Why IP exclusion lists lose to rotation
IP blocking fails against residential rotation because your blocklist can only contain addresses that were already used, while the attacker never uses one twice. A mid-size residential pool in Western Europe holds hundreds of thousands of exit IPs, and those addresses belong to real households on real consumer ISPs. Block one and you block a family in Rotterdam who was never going to click your ad again anyway. The IP is disposable. Your list entry is permanent.
Google Ads makes this worse structurally. IP exclusions live at the campaign level, there is no account-wide block, and the number of exclusions is capped per campaign. One r/PPC advertiser who dug into it called the whole facility "extremely rudimentary," and that is a fair summary. Even if the cap were ten times higher, a per-click rotator would exhaust it in an afternoon and keep going.
Why third-party click fraud tools did not fix it either
Click fraud tools underperform against residential rotation because their detection layer leans on the same two things the attack is built to defeat: IP reputation and easy fingerprints. An advertiser on r/PPC being hit by a competitor "via VPS and VPN" reported trying click-blocking software, manual IP exclusion, narrower targeting, and reporting to Google. Their summary: "no luck."
This is not because the tools are scams. They catch the dumb layer well: datacenter ASNs, known abusive ranges, headless browsers that announce themselves, the same IP hammering you daily. But when the exit IP is a clean home connection that has never been seen before and will never be seen again, IP reputation says nothing. And the enforcement action most of these tools take is writing IPs back into the same capped Google Ads exclusion list you already know is too small. The detection can be honest and the remedy still useless.
The signals that survive per-click rotation
The signals worth watching are the ones the attacker cannot cheaply rotate: behavior on your site, device configuration, and what happens after the click. Burning a fresh IP per click is easy. Rebuilding a convincing human session per click is not, so everything except the address tends to stay suspiciously consistent.
Dwell time near zero
A visit that lands and leaves in the same second is the single most reliable tell in this pattern. One r/PPC advertiser spotted their attack exactly this way: repeat paid visits, every one showing 00:00:00 time on page. In GA4, segment paid landing sessions by engagement time and compare the sub-one-second share against your organic baseline. Real users fumble. Bots do not linger.
Device and viewport clusters
When the IP changes every click but the screen resolution never does, the screen is the fingerprint. The same advertiser noticed all the junk visits reported one odd size, 800x600, which happens to be a default viewport in common automation setups. Look for any tight cluster: identical resolution, identical browser build, a language or timezone that contradicts the IP's country (a Swiss residential IP presenting a browser with US English and no matching timezone is a real household almost never).
Conversion-path shape
Fraud clicks are identical at the exact point where real buyers diverge. Humans scroll, hesitate, open a second page, start a form and abandon it. A segment of traffic with strong CTR, zero scroll depth, zero form starts, and a geography that does not match your customer base (heavy NL, DE, CH and FR clicks on a service you only sell elsewhere) is not a demand signal. It is a signature.
What to change inside Google Ads
The productive moves in Google Ads are claiming credits, filing evidence, and cutting the fraud out of your bidding data, in that order.
First, add the invalid clicks columns (Columns, then Modify columns, then Performance: "Invalid clicks" and "Invalid click rate") to see what Google is already filtering and crediting. Many advertisers have never looked. Google's automatic filtering catches a real share of this, and those clicks are not billed.
Second, when clicks get through, file with the click quality team through Google's invalid clicks contact form, and file with data, not suspicion. "I think a competitor is clicking my ads" goes nowhere, which is why so many r/PPC threads end in frustration. A dated list of click timestamps, the shared screen-size cluster, the zero-second sessions, and the affected campaigns is a case an investigator can act on.
Third, and this is the quiet big one: import offline conversions from your CRM so Smart Bidding optimizes toward closed deals instead of clicks and form fills. This does not stop the spend bleed by itself. What it stops is worse damage, the fraud steering your bidding toward the times, regions and audiences the bot lives in. Bots can click. They cannot buy. Feed the algorithm the thing bots cannot fake and the attack loses its second-order effect.
Fourth, use the exclusions that do scale: geography and schedule. If the fraud clusters in countries where you have no buyers, exclude them entirely rather than chasing IPs inside them.
When it is bad enough for lawyers
For a sustained attack you can tie to a competitor, the paper trail is worth more than any blocklist. Keep raw server logs, gclid exports, your invalid-click case numbers from Google, and a clean before-and-after of spend and conversion rates. Competitor click fraud has supported unfair-competition and tortious-interference claims in multiple jurisdictions, and the fact that people hire for this openly on public forums means a money trail sometimes exists for discovery to find. You may never sue. Build the file as if you will.
The honest limit
There is no clean fix for per-click residential rotation, and anyone selling you one is describing the dumb layer of the problem. What actually works is narrower: read the behavioral and device clusters, claim every invalid-click credit, file evidence instead of complaints, point your bidding at revenue the bots cannot generate, and document everything in case it becomes a legal matter. That will not make the clicks stop. It makes them stop working.