Buy Internet Traffic: Where the Visits Actually Come From

Bought traffic is somebody else's supply, resold to you. Strip away the adjectives on the sales page and it comes from one of five sources, or a blend of them:

Two columns in that table matter most: the network and the device. The network tells you where the connection started. The device column tells you what the visit said it was. When they agree, you have a fair idea of the supply. When they disagree, the network is the one to trust, for the reason in the next section.

Most of what a bought visit carries is typed in. The referrer, the language and the device profile are values a seller picks per campaign, and our own Website Traffic takes all three as settings. The network is different. It's the address at the other end of the connection, so a seller controls where connections start, not what a lookup of that address returns.

That makes the network the best single clue to supply, and it's the one thing your analytics can't show you. Google says that in Google Analytics 4 "IP addresses are not logged or stored" (Analytics Help), and GA4's dimension reference lists Device category, Browser, Operating system, Screen resolution, City and Country, but no dimension for the internet provider or network a session came from. So the network check happens in your server or CDN log, where every request still carries its address.

How to look an address up is laid out in what a website traffic generator sends to your site. This post starts from the answer: which of the five supplies a holder name points to, and what the device column should look like beside it.

A lookup gives you a holder name, and you sort it into a type by reading it. Hosting companies usually say what they are, and consumer providers and carriers are household names in their own countries. Some large telecom groups run all three kinds of network under one name, so keep a "can't tell" bucket rather than forcing a guess.

Where it comes from. Servers rented from hosting and cloud companies. This is the cheapest way to produce visits at volume, because the machines, the bandwidth and the addresses are bought wholesale. Every automated traffic product that doesn't say otherwise should be assumed to run here, and ours says so outright: our delivery policy states that Website Traffic and Realistic Traffic are "delivered using Data Centre IPs only."

What it does to the device mix. Nothing on its own. A server has no screen size or touch input, so the device column on data center traffic is whatever the campaign asked for. Our Website Traffic offers desktop, mobile, tablet or mixed per campaign, and GA4 will file those visits under whichever Device category the setting produces. A data center order set to mobile fills your mobile rows with visits that never touched a phone.

How the time of day behaves. Servers don't sleep. Unless the seller paces delivery to match a country's day, data center traffic can arrive at much the same rate at 4 a.m. as at 4 p.m. in the target country. Pacing is a setting, so an even spread proves nothing alone, but it's worth noticing beside a hosting network.

How to tell you got it. The network lookup returns a hosting or cloud company, whatever the device column says. Data center traffic isn't a problem when it's sold as that. It's a problem when it's sold as something else.

Where it comes from. Addresses that belong to consumer internet providers and mobile carriers, the networks real households and phones use. Sellers who lead with "residential" or "mobile" traffic are claiming this row, because those networks carry more weight with anyone reading a log than a hosting company does.

A visit can only reach your site from someone's home or phone connection in one of two ways. Either a person on that connection made it, or software made it while running on somebody else's connection. The second is only legitimate if the connection's owner agreed to it, and nothing in your log can show whether they did. So a "residential" claim gives you two questions for the seller, in writing: who or what performs the visit, and how did it get onto those connections? A seller that can't answer the second one plainly is asking you to trust a supply chain you can't see.

What mobile carriers do to your address counts. Mobile networks often put many subscribers behind one public address. The address block reserved for this is described in RFC 6598 as "Shared Address Space to accommodate the needs of Carrier-Grade NAT (CGN) devices." In practice, dozens of real people on the same carrier can reach your site from a single address. That means the usual rule of thumb, many sessions from one address looks automated, misfires on genuine mobile traffic. On a carrier network, judge addresses by the behavior of the sessions, not the count per address.

What it does to the device mix. If a person is at the device, the mix follows what they use: carrier addresses are what phones use on mobile data, and home broadband carries laptops, desktops, tablets and phones on Wi-Fi alike. If software is at the device, the device column is a setting again, exactly as it is on a data center. So a mobile carrier network with a desktop device column deserves a second look (a laptop tethered to a phone is the innocent explanation), and a home network with any device is consistent with either.

How to tell you got it. The lookup returns consumer providers and carriers, spread across the country you targeted. It can't tell you whether a person was there; your engagement data has to answer that.

Where it comes from. Advertising space on other people's websites and apps. You pay an ad network, it shows your link or loads your page for visitors on its publishers' pages, and some of them arrive. A pop-under is the extreme version: your page opens in a new window behind the one the person is using, so the visit starts without a click on anything that mentioned you.

This is the only supply on the list where the visitor is an ordinary internet user doing something of their own. That's its strength and its catch. Nobody was paid to be there, but on pop-under inventory nobody chose to be there either, and your page may load while the person is looking at a different window.

What it does to the device and network mix. Both follow the inventory. The devices in your report are the ones the publishers' visitors happened to use, filtered by any device targeting the network lets you set, so two campaigns on one network can split very differently. The networks look like the internet at large: home broadband, mobile carriers, offices. An ad campaign that looks up as mostly hosting companies is a question for the ad network.

How to tell you got it. Tag the destination URL with UTM parameters before the campaign starts, so GA4 files the sessions under your own campaign name instead of guessing from the referrer. Without tags, visits land in Referral when the publisher's page or the network's click domain is passed as the referrer, and in Direct when no referrer arrives. Then compare engagement for the tagged sessions with your normal visitors, by device.

The ad risk, if your pages carry AdSense. AdSense's program policies say Google ads may not be "Displayed in pop-ups or pop-unders, including where a page containing Google ads, search boxes, or search results is loaded in a pop-up or pop-under." Buying pop-under traffic to a page with AdSense on it puts that page in exactly that position, and the penalty lands on your account, not the ad network's. Send it only to pages without ads.

Where it comes from. Members of an exchange view each other's sites to earn credits, and paid-to-surf sites do the same for small cash payments. When you buy exchange traffic you're buying those credits. How exchanges work, and why the attention they deliver is thin, is covered in where can I buy traffic, so this section sticks to what the supply does to your two columns.

What it does to the network mix. Members surf from their own connections, so an exchange's traffic looks up as home broadband and mobile carriers, not hosting companies. That's the point people miss: a clean network lookup doesn't rule out an exchange. It only rules out a data center.

What it does to the device mix. It follows whatever the members surf on. We haven't seen an exchange publish that split, so read it from your own device column rather than expecting a particular mix.

How to tell you got it. Three marks, and they're stronger together. Referral rows naming the exchange's own domain, when it passes a referrer. The same small set of addresses coming back day after day, because members surf repeatedly and see the same sites again. And a returning-visitor share far above your normal traffic from a campaign that should, if it were new visitors, be almost all first visits. If your pages carry AdSense, the same program policies bar "paid-to-click, paid-to-surf, autosurf and click-exchange programs" outright.

Where it comes from. A pool of people paid per task, working from their own homes on their own hardware. Crowd platforms, micro-task sites and click services sit here. The task might be visiting a page, or, on a search click service, searching a keyword and clicking a result.

What it does to the network mix. It looks like the workers' own lives: home broadband and mobile carriers in the countries they live in. A good crowd service restricts the connections workers may use. Ours does: our clicker terms for SERP Clicks say "Only residential IP addresses will be permitted," and bar data center connections, dedicated servers and remote connections.

What it does to the device mix. One of two things decides it. If the task requires a device, the mix is that device: SERP Clicks is desktop only, so its clicks land in desktop rows, in GA4 and in Search Console's Devices tab. If the task doesn't specify, the mix is whatever hardware the workers who took your task happen to own, and it can shift from one order to the next.

How the time of day behaves. People work while they're awake. A people-sourced order tends to follow the local day in the workers' countries, which is a pattern data center traffic only shows if it's paced to. Read it in GA4 by crossing Hour with Country, and remember that GA4's hours are in your property's time zone, not the visitor's.

How to tell you got it. Consumer networks in the lookup, a device column that matches the task, a daytime shape in the hour report, and, for search tasks, clicks in Search Console for the query you ordered. Search Console is the only report here that proves a search happened, because it counts clicks from Google's own results pages.

Put the two columns side by side and each pairing points toward a supply. None of these is proof. Every row has an innocent explanation, which is why the last column is a next step, not a verdict.

The row a buyer most often lands on is the first one. A "mobile traffic" order whose phone sessions look up as hosting companies has delivered a device setting. That may be exactly what you paid for, but it isn't a mobile audience, and our post on picking a device split explains when a setting is all you need.

Every number in this example is invented to show the method. None of it is SparkCliks data, a vendor's data or a study result.

A site owner buys 2,000 visits a day that the seller describes as "US residential and mobile visitors." The owner gives the seller a URL used nowhere else, https://www.sparkcliks.com/offer-test?src=vendor-a, so every request carrying that query string belongs to the order.

The general list is in questions to ask a traffic provider. These are the supply questions, each checkable with the method above:

1. Which of the five supplies is this order? If it's a blend, what share is each?
2. What will a network lookup of your addresses return? Hosting companies, consumer providers or carriers. A seller that knows its supply can answer in one line.
3. For residential or mobile claims: who or what performs each visit, and how does it reach those connections? Ask whether the connection owners agreed to it.
4. For ad inventory: can I see the placement or source report, and can I block placements? Ask whether any of it is pop-under inventory.
5. Is any of the traffic from an exchange, a paid-to-surf site or an autosurf program? Get the answer in writing if your pages carry ads.
6. What decides the device mix? A setting you choose, the inventory, or the workers' own hardware.

Whatever the answers, run a small order to a URL used nowhere else and sort it as in the worked example before buying at volume.

We sell traffic, so here is where each of our four products falls, from our own plan data and policies.

• Website Traffic and Realistic Traffic are Supply 1. Both are "delivered using Data Centre IPs only," per our delivery policy, and the device column is the campaign setting: desktop, mobile, tablet or mixed on Website Traffic, with Realistic Traffic taking its own device setting and tapping instead of clicking on a phone profile. A network lookup of these visits returns hosting networks whichever device you pick. Targeting is by country on paid plans; the other settings are laid out in the four targeting dials. Realistic Traffic costs exactly three times the Website Traffic price for the same volume.
• Sparky Traffic Bot is a tool, not a supply. You run the browsers, and the connections come from the included pool or from your own, so your own settings decide which network row its visits land in. Its device options are desktop, mobile, tablet or mixed.
• SERP Clicks is Supply 5. Paid people search your keyword and click your listing on their own desktop computers, from the connections our clicker terms allow, which are residential only. Targeting is by country, and there's no free tier: LITE is $47 a month for 120 credits, which buys 120 untargeted clicks or 60 geo-targeted ones, since a geo-targeted click costs 2 credits.

None of our four products is ad network inventory, pop-under inventory or an exchange. Our automated visits aren't undetectable, and a network lookup is the fastest way to confirm what they are, which is why we'd rather you ran one. Website Traffic's free NANO tier needs no card, so you can do that before paying anything.