# US 11,115,380 B1 · Determining and utilizing one or more attributes of IP addresses

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,115,380 B1
- Document ID: US11115380B1
- Status: Granted
- Kind: B1
- Application number: 17/092,700
- Filed: 2020-11-09
- Granted: 2021-09-07
- Earliest claimed: 2013-11-19
- Assignees: El Toro.Com, LLC
- Applicants: El Toro.Com, LLC
- Inventors: Stacy B. Griggs; David T. Stadler, III; Benjamin Charles Woolley
- Web page: https://patentgrep.com/patent/US11115380B1

## CPC

- H04L 61/2503: Translation of Internet protocol [IP] addresses
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 2101/668: Internet protocol [IP] address subnets
- H04L 2101/69: using geographic information, e.g. room number
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods related to determining and utilizing one or more attributes to associate with an IP addresses. Attributes are determined based on request data provided with requests from an IP address and one or more available secondary information sources. Attributes may include physical locations and/or category designations for the IP address. One or more attributes may be assigned a likelihood value indicative of likelihood that the attribute is associated with the IP address. Some implementations are directed to utilizing the attributes and likelihood values to identify likely fraudulent information provided with requests. Some implementations are directed to utilizing the attributes and likelihood values to provide advertisements in response to requests from IP addresses.

## Claims

### Claim 1

A method implemented by one or more processors, the method comprising:
identifying an IP address;
identifying a group of electronic requests that originate from the IP address;
generating, based on the group of the electronic requests that originate from the IP address, a fraud value for the IP address that indicates a likelihood that electronic requests that originate from the IP address are fraudulent;
applying a netmask to the IP address to determine that the IP address has a particular masked address;
assigning a masked fraud value to the particular masked address in one or more databases, wherein the masked fraud value is based on the fraud value, and is based on the fraud value responsive to the fraud value being for the IP address and based on the IP address having the particular masked address;
subsequent to the assigning:
identifying an additional electronic request that originates from an additional IP address;
applying the netmask to the additional IP address to determine that the additional IP address has the particular masked address; and
responsive to the additional IP address having the particular masked address, using the masked fraud value, assigned to the particular masked address, in determining whether to transmit content responsive to the additional electronic request.

### Claim 2 (depends on 1)

The method of claim 1, wherein generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address comprises:
generating the fraud value based on a quantity of selections indicated by the group of electronic requests.

### Claim 3 (depends on 2)

The method of claim 2, wherein generating the fraud value based on the quantity of selections indicated by the group of electronic requests comprises:
generating the fraud value based on the quantity that occurred over a given time period.

### Claim 4 (depends on 1)

The method of claim 1, wherein generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address comprises:
generating the fraud value based on a click through rate for ads, as indicated by the group of electronic requests.

### Claim 5 (depends on 1)

The method of claim 1, wherein generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address comprises:
generating the fraud value based on whether a charge-back is indicated by the group of electronic requests.

### Claim 6 (depends on 1)

The method of claim 1, wherein generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address comprises:
generating the fraud value based on whether location information, indicated by the group of electronic requests, is inconsistent with anticipated location information determined based on secondary data.

### Claim 7 (depends on 1)

The method of claim 1, wherein generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address comprises:
generating the fraud value based on how many different computing devices originated the electronic requests of the group.

### Claim 8 (depends on 1)

The method of claim 1, wherein generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address comprises:
generating the fraud value based on how many different types of computing devices originated the electronic requests of the group.

### Claim 9 (depends on 1)

The method of claim 1, further comprising, in response to determining to transmit content responsive to the additional electronic request:
causing the content to be transmitted to the additional IP address.

### Claim 10

A system, comprising:
a database storing an IP address and data related to a group of electronic requests that originate from the IP address;
memory storing instructions; and
one or more processors operable to execute the instructions stored in the memory to:
identify an IP address;
identify a group of electronic requests that originate from the IP address;
generate, based on the group of the electronic requests that originate from the IP address, a fraud value for the IP address that indicates a likelihood that electronic requests that originate from the IP address are fraudulent;
apply a netmask to the IP address to determine that the IP address has a particular masked address;
assign, in the database or in an additional database, a masked fraud value to the particular masked address, wherein the masked fraud value is based on the fraud value, and is based on the fraud value responsive to the fraud value being for the IP address and based on the IP address having the particular masked address;
subsequent to the assigning:
identify an additional electronic request that originates from an additional IP address;
apply the netmask to the additional IP address to determine that the additional IP address has the particular masked address; and
responsive to the additional IP address having the particular masked address, use the masked fraud value, assigned to the particular masked address, in determining whether to transmit content responsive to the additional electronic request.

### Claim 11 (depends on 10)

The system of claim 10, wherein in generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address, one or more of the processors are to:
generate the fraud value based on a quantity of selections indicated by the group of electronic requests.

### Claim 12 (depends on 11)

The system of claim 11, wherein in generating the fraud value based on the quantity of selections indicated by the group of electronic request, one or more of the processors are to:
generate the fraud value based on the quantity that occurred over a given time period.

### Claim 13 (depends on 10)

The system of claim 10, wherein in generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address, one or more of the processors are to:
generate the fraud value based on a click through rate for ads, as indicated by the group of electronic requests.

### Claim 14 (depends on 10)

The system of claim 10, wherein in generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address, one or more of the processors are to:
generate the fraud value based on whether a charge-back is indicated by the group of electronic requests.

### Claim 15 (depends on 10)

The system of claim 10, wherein in generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address, one or more of the processors are to:
generate the fraud value based on whether location information, indicated by the group of electronic requests, is inconsistent with anticipated location information determined based on secondary data.

### Claim 16 (depends on 10)

The system of claim 10, wherein in generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address, one or more of the processors are to:
generate the fraud value based on how many different computing devices originated the electronic requests of the group.

### Claim 17 (depends on 10)

The system of claim 10, wherein in generating, based on the group of the electronic requests that originate from the IP address, the fraud value for the IP address, one or more of the processors are to:
generate the fraud value based on how many different types of computing devices originated the electronic requests of the group.

### Claim 18 (depends on 10)

The system of claim 10, wherein in executing the instructions one or more of the processors are further to, in response to determining to transmit content responsive to the additional electronic request:
cause the content to be transmitted to the additional IP address.