Abstract: Various embodiments pertain to techniques for automatically classifying an IP address using information received as part of a request for an advertisement. In some embodiments, the information received can include an IP address associated with the request, a client identifier, and a unique request identifier, such as a request global user identifier (RGUID). In various embodiments, the information is analyzed and used to classify the IP address. For example, the IP address can be classified as belonging to a unique or real end user, belonging to a proxy, or belonging to a potential exploit. Advertisements can be served, or not served at all, according to the classification of the IP address. In various embodiments, some classifications of IP addresses can be further analyzed to determine a geo-location associated with the IP address or to enable processes to mitigate malicious or fraudulent request risks.