In one embodiment, a method includes receiving a packet flow associated with a click-through from an end user node destined for an advertiser server; extracting information from the packet flow; analyzing the extracted information to determine one or more characteristics of the packet flow; and classifying the packet flow based on the determined one or more characteristics; modifying the packet flow to include classification information to provide classification information indicating a quality level of the click-through. The packet flow may include a hypertext transfer protocol GET request. Modifying the packet flow may include adding a tag with classification information that indicates a likelihood of fraudulent click behavior associated with the packet flow.