"Anonymous” IP filtering
Adjust’s “anonymous” IP filter protects your dataset from all fraudulent install activity coming from VPNs, Tor exit nodes, or data centers. Once the filter has been activated, Adjust will automatically cross-check all of your app installs (and reattributions) with MaxMind’s “anonymous” IP database. Any user affiliated with an “anonymizing” service will not be attributed within Adjust but will be flagged as an untrusted device. By excluding this type of activity from your attribution set, you maintain the integrity of your app’s Adjust-tracked data.

Activate "anonymous" IP filtering

The “anonymous” IP filter is an exclusive feature of the Adjust Fraud Prevention Suite. To sign up for our fraud prevention services, please contact your Adjust sales representative or reach out to support@adjust.com.


In the Adjust dashboard
  1. Navigate to your app and select your app options caret (^)
  2. Select All Settings > Fraud Prevention
  3. Slide the ANONYMOUS IP FILTERING toggle to ON

View your "anonymous" IP filtering statistics

In the Adjust dashboard
  1. Navigate to your app and select your app options caret (^)
  2. Select Statistics
  3. Select the Fraud Prevention tab
Any installs rejected by Adjust's "anonymous" IP filtering—and associated KPIs—are assigned to the Anonymous IPs tracker, a subtracker of the network-level tracker Untrusted Devices.

Understand your “anonymous” IP filtering statistics

For information on the KPIs, filters, and features of the fraud prevention statistics view, see our fraud prevention reporting pages.

"Anonymous" IP filtering FAQs

How does “anonymous” IP filtering work?

Adjust compares the IP address of every install and reattribution against MaxMind’s list of “anonymous” IPs. If the IP is “anonymous,” MaxMind tells us whether the IP address is from a VPN, Tor exit node or data center, and we flag any device MaxMind matches as an untrusted device in the Fraud Prevention tab of your Adjust Statistics.

What are VPNs, Tor exit nodes, and data centers?

VPN stands for virtual private network. A VPN’s basic function is to allow a user to connect to the internet through an IP address that is not their own. VPNs allow users to circumvent geo-restricted websites and services, as the IP address can come from anywhere in the world, and browse the internet more privately. However, fraudulent publishers use them to make it seem as though installs are coming from more lucrative countries.
Tor exit nodes
Tor is software that can pass traffic through a network of servers to hide users’ identities. Each server is called a node, and Tor bounces traffic through a series of nodes before having it emerge through a Tor exit node. Any Tor traffic will thus have the IP address of the Tor exit node through which it left.

As with VPNs, Tor provides more “anonymous” access to the internet, and fraudsters take advantage of this to make it seem as though their fake installs are coming from disparate countries, as Tor exit nodes are spread throughout the world.
Data centers
The data centers on MaxMind’s list are not affiliated with an internet service provider (ISP). This means that any user activity originating from these data centers is either artificial or has been rerouted. Typically, fraudsters that run a large number of simulators rely on these data centers to provide the computational resources for their illegal activities.

What is a simulated device?

A simulated device is any smartphone operating system run not off a smartphone but a server. This emulated software can run apps and generate ad views and clicks through an automated process. The crucial point, however, is that there is no real user behind these engagements and installs; simulated devices are often run in order to commit ad fraud.

On this topic