What arrives with the request

A redirect endpoint has no script on the visitor's device and sets nothing on it. Everything it knows comes from the HTTP request itself, which means the list is short and fixed.

  • The IP address. The single most informative field. It gives approximate location, and more importantly the network the request came from: a residential provider, a mobile carrier, a corporate range, or a datacenter.
  • The user agent. A string the client volunteers describing its browser and operating system. Trivially forged, which is precisely why it is useful in combination with everything else.
  • The referrer. Where the click came from, when the source sends it. Often absent or trimmed to just the domain by modern browsers.
  • The rest of the headers. Accepted languages, encodings, and the order the headers arrive in. Individually dull; collectively a decent signature.
  • The URL itself. The identifier of the link and every campaign parameter attached to it.
  • The timestamp. Trivial on its own. Revealing across a few thousand clicks.

What it does not see

No name, no email, no account. Nothing about what the visitor did before the click or after it. No screen size, no fonts, no canvas signature, none of the things a script running on the page could collect, because there is no script.

This is a real limitation and also the reason a redirect can operate cleanly: it collects the metadata of a connection it is party to, and nothing else.

Why the network matters more than the location

Most people look at the country first. The network is the more useful field by some distance.

Consumer traffic arrives from consumer networks. A click that reaches your redirect from a hosting provider's address range was not made by a person browsing on their phone, whatever the user agent claims. That single check, applied consistently, separates more invalid traffic than any amount of geographic filtering.

The location field still earns its place, just for a different job: catching traffic from places your campaign never targeted, which usually means the link is being hit directly rather than through the ad.

The fields only become useful together

Any single field is weak. A datacenter IP might be a corporate VPN. An unusual user agent might be an accessibility tool. A missing referrer is ordinary.

What is not ordinary is a datacenter address, presenting a browser version two years out of date, with no referrer, arriving fourteen times in ninety seconds, at four in the morning, from a country the campaign excludes. No individual field there proves anything. Together they are not ambiguous at all.

This is why scoring beats blocking rules. A rule on one field produces false positives you never see. Weighing several weak signals into one score per visit lets you set the threshold where it belongs for your traffic, and lets you review what sat just under it.

Keep the raw record

Whatever scoring you apply, store the fields as they arrived alongside the verdict. Scoring logic improves; a click you already discarded cannot be re-examined under the improved logic.

The log is also the only artefact that settles a dispute. When a partner questions an invoice or a client questions a report, a stored record of what actually arrived is worth more than any dashboard summarising it.