IP Address
What is IP Address?
An IP address is a unique numerical label assigned to every device connected to a network that uses the Internet Protocol for communication. It serves two core functions: identifying the host or network interface, and providing the location of that device within the network. IP addresses come in two versions, IPv4 and IPv6, which differ in format, address space, and technical capabilities.
How it works
An IP address consists of two components: a network identifier and a host identifier. The network identifier specifies which network a device belongs to, while the host identifier pinpoints the specific device within that network. For example, four devices sharing one internet connection may all carry the same network portion of their IP address, with only the host portion differing between them.
IPv4 vs. IPv6
IPv4 addresses are 32 bits long and written in decimal format as four numbers separated by dots, for example 192.168.1.1. This format supports approximately 4.3 billion unique addresses, a pool that has been exhausted by the growth of connected devices. IPv6 addresses are 128 bits long and written in hexadecimal groups separated by colons, for example 2001:0db8:85a3:0000:0000:8a2e:0370:7334. IPv6 supports a vastly larger address space, effectively eliminating scarcity.
Public vs. Private IP Addresses
Public IP addresses are routable on the open internet and make devices accessible globally. Private IP addresses are used within local networks and are not directly reachable from the internet. Network Address Translation (NAT) allows multiple devices on a private network to share a single public IPv4 address, which is why many users in the same household or office appear to share an IP address. IPv6 eliminates the need for NAT by giving each device its own unique public address.
Static vs. Dynamic IP Addresses
Static IP addresses remain fixed and are typically assigned to servers or services that require a permanent, consistent address. Dynamic IP addresses are assigned temporarily by a DHCP server and can change each time a device connects to a network. Most consumer devices receive dynamic IP addresses from their internet service provider.
Role in Mobile Attribution
In mobile measurement, IP addresses serve as a key signal for probabilistic attribution. When a deterministic identifier such as an advertising ID is unavailable, for instance after a user opts out of tracking, MMPs can use IP address combined with device type, operating system, and timestamp to probabilistically match ad clicks to installs. IP address also enables geolocation, allowing marketers to target or analyze users by country, region, or city.
Why it matters
IP addresses have direct implications for attribution accuracy, fraud detection, and campaign targeting. In privacy-restricted environments where advertising IDs are withheld, IP-based probabilistic matching provides a fallback signal that keeps attribution functional. This is increasingly important as opt-out rates rise following iOS ATT enforcement and evolving privacy regulations.
For fraud detection, IP addresses expose patterns associated with invalid traffic. A high volume of installs or clicks originating from a single IP address or a narrow IP range is a strong indicator of click farms, device emulators, or bot activity. Platforms that monitor IP-level traffic concentration can flag and filter these events before they distort campaign data.
Geotargeting depends on IP address to serve location-relevant ads and to verify that campaign delivery matches the intended geography. Mismatches between the IP-indicated location and other device signals can indicate VPN usage or proxy traffic, both of which affect the reliability of location-based targeting and measurement.
Airbridge uses IP address as one of several signals in its probabilistic attribution engine, combining it with additional device and behavioral signals to improve match accuracy while respecting user privacy.
How to implement IP address signals in mobile attribution
To use IP address data effectively in a mobile measurement strategy, follow these steps.
1. Enable probabilistic attribution as a fallback. Configure your MMP to apply probabilistic matching when deterministic identifiers such as IDFA or GAID are unavailable. Ensure IP address is included as a matching signal alongside user agent and timestamp.
2. Set appropriate attribution windows. IP addresses assigned via DHCP can change frequently. Use a tight lookback window, typically 24 to 48 hours, when relying on IP-based matching to reduce false positives from address reassignment.
3. Monitor for IP-level anomalies. Review attribution reports for clusters of installs or clicks from identical or closely grouped IP addresses. A disproportionate volume from a single IP is a fraud signal that warrants investigation. Use blocklists to exclude known problematic IP ranges.
4. Combine IP with other signals. IP address alone is a weak identifier because of NAT, VPNs, and dynamic assignment. Pair it with device type, screen resolution, operating system version, and click timestamp to strengthen probabilistic matching confidence.
5. Account for privacy regulations. IP addresses are classified as personal data under GDPR and similar regulations in some jurisdictions. Confirm that your data processing agreements and privacy policy cover IP address collection and that your MMP handles data retention in compliance with applicable laws.
6. Validate geolocation accuracy. Cross-check IP-derived location data against other signals. If a device's IP resolves to a geography that conflicts with other behavioral or device signals, flag the event for review rather than accepting the IP location at face value.
Related concepts
| Term | Relationship | Description |
|---|---|---|
| Device ID | See also | A deterministic device identifier used alongside IP address for attribution matching |
| Probabilistic Modeling | See also | Attribution method that uses IP address and other signals when deterministic IDs are unavailable |
| Duplicate IP | Child | A fraud signal where abnormal install or click volumes originate from the same IP address |
| Click Farms | Detection | Fraud operations whose concentrated IP activity is a key detection signal |
| Cross-Device Tracking | See also | IP address is used as a shared signal to link multiple devices belonging to the same user |
Put these concepts into practice
See how Airbridge helps teams implement mobile attribution strategies at scale.