You blocked the IP. The bot moved on.

The most satisfying screen in any click-fraud tool is the exclusion list. Numbers going in, threats going out. It feels like progress.

It is also the part that ages fastest.

An IP exclusion is a snapshot of something that moves. Residential proxy pools rotate addresses constantly — the pool is the product, and it is designed to survive exactly this. Data centre ranges get recycled between customers, so today's blocked address can be tomorrow's legitimate visitor. A competitor clicking from their phone sits on a mobile carrier IP that may be different by lunchtime. And exclusion lists have limits: you cannot keep adding forever, so eventually every new block quietly costs you an old one.

Worse, the list goes stale in a direction you cannot see. Nothing tells you that the forty-seventh address on your list has belonged to a real customer's office for the last three months.

Behaviour does not rotate

The way out is not a better list. It is watching a different signal. A visit either rendered the page or it did not. A mouse either moved or it did not. A session either lasted longer than a second or it did not. A browser either reports a plausible combination of properties or it contradicts itself. A click ID either appears once or it turns up three times. Those signals travel with the visit rather than with the address, so a fresh IP buys the same visitor nothing.

This is also what makes the evidence readable later. "We blocked this IP" explains nothing on its own. "This click came from a data centre range, rendered nothing, and reused a click ID that had already been seen twice" is a description of what actually happened.

SaveMyBudget flags on behaviour first, from one tag on your own site, and attaches the reason to every flagged click. Blocking still has its place — it just works better from a list you can justify than one you inherited.