Anonymous IP filtering

Adjust’s anonymous IP filter maintains the integrity of your app’s tracked data by protecting it from fraudulent install activity coming from VPNs, Tor exit nodes, and data centers. This targets fraudsters using emulation software to fake installs and place the conversions in high-value markets.

The filter cross-checks all of your app installs and reattributions with MaxMind’s anonymous IP database. Any user affiliated with an anonymizing service is attributed to an isolated tracker called “Untrusted Devices”. This helps prevent the majority of fraud associated with simulators before it begins, and reduces the impact of data center manipulation tactics significantly.

Set up Anonymous IP filtering

To set up the anonymous IP filter, follow these steps in the Adjust dashboard. 

  1. Find your app and select your app options caret (^)
  2. Select All Settings > Fraud Prevention
  3. Switch the ANONYMOUS IP FILTERING toggle ON

View your statistics

Installs rejected by the anonymous IP filter are assigned to the “Anonymous IP” tracker - a subtracker of the network-level tracker Untrusted Devices. You can also use the following KPIs to view rejected installs and reattributions by traffic source.

Rejection statisticKPI
Rejected install: anonymous IP (RI AIP)rejected_installs_anon_ip
Rejected reattribution: anonymous IP (RR AIP)rejected_reattributions_anon_ip

To view your statistics, follow these steps in the dashboard. 

  1. Find your app and select your app options caret (^)
  2. Select Statistics
  3. Select the Fraud Prevention tab

For information on the fraud prevention KPIs and how to read your Statistics, see our fraud prevention reporting article.


How does anonymous IP filtering work?

Adjust examines the IP address metadata of every install and reattribution and compares it against MaxMind’s list of anonymous IPs. If there is a match, MaxMind tells us whether the IP address is from a VPN, Tor exit node or data center. The device is then flagged as untrusted in the Fraud Prevention tab of your Statistics.

What are VPNs, Tor exit nodes, and data centers?


VPN stands for virtual private network. One function of a VPN is to allow a user to connect to the internet through an IP address that is not their own. VPNs allow users to circumvent geo-restricted websites and services, as the IP address can come from anywhere in the world. Fraudulent publishers use VPNs to make it seem as though installs are coming from more lucrative countries.

Tor exit nodes

Tor is a service that directs traffic through a global network of servers to anonymize users’ identities. Each server is called a node, and Tor encrypts traffic as it bounces it through the nodes. Encrypted traffic reaches the internet through a Tor exit node. Tor traffic has the IP address of the Tor exit node it left through.

As with VPNs, Tor provides more anonymous access to the internet. Fraudsters take advantage of this to make it seem as though their fake installs are coming from disparate locations.

Data centers

The data centers on MaxMind’s list are not affiliated with an internet service provider (ISP). This means that any user activity originating from these data centers is either artificial or has been rerouted. Typically, fraudsters that run large numbers of simulators rely on these data centers to provide the computing resources for their illegal activities.

What is a simulated device?

A simulated device is any smartphone operating system run on a server and not a smartphone. This emulated software can run apps and generate ad views and clicks through an automated process. The crucial point, however, is that there is no real user behind these engagements and installs. Simulated devices are often run in order to commit ad fraud.