System and method for detecting fraudulent internet traffic

1. A method for detecting fraudulent Internet traffic, the method comprising:

providing a tracking script that generates a unique URL;

receiving a request for an IP address associated with the unique URL at a DNS resolver server from a DNS server upstream from a requesting client device;

correlating the requesting client device, the DNS server upstream from the requesting client device and the DNS resolver server in a database;

receiving a communication from the requesting client device; and

comparing an expected communication time based on the geographic location of the DNS resolver server and an actual communication time.

2. The method according to claim 1 , wherein the tracking script encodes a client IP address of the requesting client device into the unique URL, and the client IP address is correlated with the DNS resolver server in the database.

3. The method according to claim 1 , further comprising tracking a number of the received requests at the DNS resolver server from the requesting client device.

4. The method of claim 3 , further comprising determining that traffic from the requesting client device is fraudulent when the number of the received requests exceeds a predetermined amount in a predetermined time interval.

5. The method according to claim 1 , wherein the DNS resolver server is one of a plurality of DNS resolver servers with a same anycast destination address.

6. The method according to claim 5 , wherein information received at the plurality of DNS resolver servers is stored on a logging server.

7. The method according to claim 1 , wherein Internet traffic generated from the requesting client device is mapped based on a geographic location of the upstream DNS server and a geographic location of the DNS resolver server.

8. The method according to claim 1 , further comprising rating Internet traffic generated from the client device with a fraudulence likelihood.

9. A system for detecting fraudulent Internet traffic, the system comprising:

a DNS resolver server that is configured to receive a unique URL generated from a tracking script running on a website which is accessed by a client device requesting content;

the DNS resolver server receiving the unique URL in a request from an upstream DNS server for an IP address corresponding to the unique URL, the DNS resolver server correlating the client device to a geographic location of the upstream DNS server,

wherein the DNS resolver server receives a communication from the client device and compares an expected communication time based on a reported geographic location of the client device and an actual communication time.

10. The system of claim 9 , wherein the DNS resolver server tracks a number of the received requests at the DNS resolver server from the client device.

11. The system of claim 10 , wherein the DNS resolver server flags traffic from the client device as fraudulent when the number of the received requests exceeds a predetermined amount in a predetermined time interval.

12. The system of claim 9 , wherein the DNS resolver server is one of a plurality of DNS resolver servers with a same anycast destination address.

13. The system of claim 12 further comprising a logging server, wherein information received at the plurality of DNS resolver servers is stored on the logging server.

14. The system of claim 9 , wherein Internet traffic generated from the client device is mapped based on the geographic location of the upstream DNS server and a geographic location of the DNS resolver server.

15. The system of claim 9 , wherein the Internet traffic generated from the client device is rated with a fraudulence likelihood.