Click to install time (CTIT)

What is Click to install time (CTIT)?

Click to install time (CTIT) is a metric that measures the elapsed time between a user clicking on a mobile ad and completing an app install (defined as the first app open). CTIT distributions across campaigns and publishers reveal patterns that help marketers identify fraudulent activity, including click spamming and click injection. Anomalies in CTIT, either unusually long or unusually short intervals, are primary signals that ad fraud has distorted attribution data.

How it works

CTIT is calculated by recording the timestamp of a tracked ad click and the timestamp of the resulting app install, then computing the difference. Because genuine user behavior follows recognizable patterns, the distribution of CTIT values across a campaign tends to cluster within a predictable range. Deviations from this distribution serve as fraud detection signals.

What Counts as an Install

In mobile marketing, an install is recorded when a user opens an app for the first time, not when they download it. A downloaded but unopened app does not generate an install event. This means CTIT reflects the full journey from ad click to first meaningful engagement with the app.

Detecting Click Spamming (Click Flooding)

Click spamming, also called click flooding, involves sending large volumes of fraudulent clicks in the hope that some will be attributed to legitimate installs that occur much later. This produces an abnormally long CTIT distribution, where a disproportionate number of attributed installs show very large gaps between click and install. A high rate of long CTIT values across a publisher or sub-publisher is a strong indicator that click spamming is inflating their attributed install counts. Marketers end up paying for installs that were organic or driven by other sources.

Detecting Click Injection

Click injection is a more targeted fraud technique where malware on a device detects an app download in progress and fires a fraudulent click moments before the install completes. This produces an abnormally short CTIT, often just seconds. Because legitimate users almost never install an app within seconds of clicking an ad, a cluster of very short CTIT values signals that click injection is occurring. Fraudsters exploit last-click attribution models to steal credit from legitimate ad sources. Detecting these short-CTIT outliers allows marketers to block fraudulent sub-publishers and correct attribution data.

Why it matters

CTIT analysis is one of the most practical and accessible tools for identifying mobile ad fraud without requiring additional data inputs beyond what attribution systems already collect. By establishing a baseline CTIT distribution for a given app and campaign type, marketers can set thresholds that automatically flag or reject installs that fall outside normal ranges. This protects ad budgets from being paid out to fraudulent publishers, preserves the integrity of attribution data, and ensures that optimization decisions are based on genuine user behavior. Mobile measurement partners (MMPs) typically surface CTIT distributions in their reporting dashboards, making it straightforward to monitor for anomalies at the campaign, publisher, and sub-publisher level. Airbridge provides CTIT data as part of its fraud detection reporting, enabling marketers to identify suspicious install patterns and take action against fraudulent traffic sources.

How to detect fraud using Click to Install Time (CTIT)

1. Establish a baseline. Run CTIT analysis across your historical campaign data to understand the normal distribution for your app and category. Most legitimate installs occur within a window of minutes to a few hours after a click.

2. Flag abnormally long CTIT values. Set a threshold, typically several hours or more depending on your app category, beyond which attributed installs are flagged for review. A high concentration of long-CTIT installs from a specific publisher or sub-publisher is a strong signal of click spamming.

3. Flag abnormally short CTIT values. Installs attributed within seconds of a click are statistically improbable for genuine users. A cluster of very short CTIT values from a traffic source is a primary indicator of click injection. Set a minimum CTIT threshold, such as 10 to 30 seconds, and reject or quarantine installs that fall below it.

4. Segment by publisher and sub-publisher. CTIT anomalies are most informative when broken down by traffic source. A publisher with a normal aggregate CTIT may contain sub-publishers with extreme distributions. Drill into sub-publisher data to isolate the source of fraud.

5. Use your MMP's fraud reporting tools. Platforms like Airbridge surface CTIT distributions and flag suspicious install patterns automatically. Review these reports regularly and add confirmed fraudulent sources to your blocklist to prevent future payouts.

6. Combine CTIT with other signals. CTIT is most powerful when used alongside other fraud indicators such as duplicate IPs, device ID reset patterns, and abnormal conversion rates. A single anomalous CTIT value may be a statistical outlier, but consistent deviations combined with other signals confirm fraudulent activity.

Related concepts