Every hour a cloud job pulls the latest ad-click traffic and scores every IP — datacenter/VPN geography, JA4 TLS fingerprint, click behaviour — then files it as block (looks fraudulent), watch (suspicious) or allow (looks human).

Proposed = IPs the scan would block. They only become blocked (pushed to the Vercel firewall) when auto-block is armed. Max 50 actions per scan.

Wasted spend = paid ad clicks from suspicious IPs × £2.78 blended CPC — an estimate of ad money burned by non-human clicks.

Arm switches real blocking ON from the next hourly scan; Disarm returns to detection-only. Either way the change lands within the hour.

Tap a run row to see its top findings: IP, score, and the reasons it was flagged.