Scan for Click Fraud

Scans the ad-click traffic captured by your fraud tag for click fraud / invalid traffic and returns the most suspicious IP addresses, each scored 0-100 with reasons (repeat/velocity from one IP, datacenter/hosting, Tor exit, known-malicious list, bot user-agent, high volume with zero conversions). READ-ONLY — it does not block anything. Feed `recommended_block_ips` to block_ip_addresses (approval-gated) to exclude them. Needs the tag installed first (fraud_setup). CLICK LOOKUP (click log / click events / lead lookup): pass `gclid` (from a form lead or CRM), `ip`, or `at` (time of a suspicious lead, Europe/Istanbul, 'YYYY-MM-DD HH:MM', with ±window_minutes) to get the individual captured clicks — time (Istanbul + UTC), GCLID, IP, user-agent, referrer, landing page — plus that IP's fraud score, so a fake lead can be matched to its ad click and the IP excluded. Form contents are not captured by the tag.