In cases where a user is is browsing via a proxy (like a sophisticated botnet tunneling traffic through multiple devices), proxy piercing techniques can analyze the ad request IP and the end user IP to tease out unacceptable mismatches, in part by recognizing correlations between IP mismatches and other types of fraud.