Integrations and geo databases

#Connected accounts

Third-party accounts UTMCAP acts through, on two tabs: DNS and Ad accounts. Both work the same way. + Account adds one under a name you choose, and every screen that needs an account offers them by that name — so "Agency Cloudflare" and "Client — Acme" are told apart without anyone reading an API key or an email address.

Each row says whether it is connected, what it can reach, and when that was last true. The last of those is the useful one: a token revoked three weeks ago looks exactly like a working connection until something needs it.

#DNS accounts

Cloudflare and Namecheap, as many of each as you have. Adding one asks for the provider, a name, and the provider's API credentials; Save and test checks them by listing the domains the account holds.

It exists for a specific reason: adding a tracking domain is one DNS record, and it is the step people reliably get wrong — because it happens in somebody else's control panel, and it fails quietly when done wrong. With the account connected, Add domain lists its domains and writes the record itself, which removes the typo and the grey-cloud switch in one move.

Namecheap only answers API calls from addresses on the whitelist in its API Access screen. If a test says the request address is not allowed, ask support for the address to add.

#Ad accounts

Google Ads, Microsoft Advertising, Meta, TikTok and Snapchat. Adding one asks for the platform and a name, then sends you to the platform's own sign-in — UTMCAP stores the permission it grants, encrypted, and renews it on its own. Nothing is pasted: no token, no API key.

Google, Microsoft, Meta and Snapchat can each hold several logins — an agency login and a client's, say. Microsoft asks which login to use; Meta signs in as whoever is signed in to Facebook in that browser, so to add a second Facebook user, sign in to Facebook as them first. Signing in again with a login already connected refreshes it rather than adding it twice. TikTok holds one; signing in again refreshes it.

Snapchat syncs each day's spend once connected, so a Snapchat campaign has its true cost and ROI. To send conversions back, switch them on for the account and pick the Pixel from the list — it is one of three similar ids on Snapchat's own screen, and a conversion sent to the wrong one is accepted by Snapchat and matches nothing.

A Microsoft or Meta account connected before 13 September 2026 does not yet know which login it is. Press Reconnect on it once, before adding another, so the two are kept apart.

A traffic source's Integration tab then picks which of these accounts it uses, by name. From each row here you can rename an account, reconnect it when a login expires, or disconnect it; the count on the row says how many traffic sources would stop syncing if you did.

#Geo databases

Three views of one subject, and the split is worth understanding because people usually want the second or third and go looking in the first.

Databases — which are installed, and how current.

Fields — which database answers each field. Country, region, city, ISP, ASN and connection type do not all come from the same place, and when a country looks wrong this says what to update.

Signals — how the bot detector reads what they say, and what each signal has caught. This is the one that answers "why was this click called a bot", in aggregate rather than one row at a time.

#Using your own geo database

The databases on this page are shared by every account and kept up to date by the UTMCAP team, so only the team can change them. Your clicks use them unless you connect a paid lookup provider of your own.

On Growth, Pro and Scale, the bar at the top of Tools → Geo databases connects one: ipregistry, ipapi, ipdata, ipgeolocation, IPinfo or IP2Location.io, with your own API key.

The last two are the same vendors as the IPinfo and IP2Location files in the table below, over their web services instead. The files belong to this install and only its operator can change them; the APIs take your key on each request, so they answer your clicks and nobody else's. IPinfo's Privacy Detection is the strongest proxy, VPN and Tor data on this page, and connecting it is the only way to reach it from your own account. The key is tried with the provider before it is saved. From then on, that provider answers the fields it supports — country, region, city, ISP, ASN, and for some connection type, carrier and proxy/VPN — for your clicks only. Anything it does not answer still comes from the default.

• Clicks answered at the edge (most of them) wait for your provider, so it answers every one.
• Clicks answered by the server itself cannot wait without slowing the redirect: the first click from a new address uses the default, and your provider answers every later click from that address for a day.
• Your key spends at most 300 lookups a minute, and each address is looked up once a day, so a bot flood is not a surprise bill.
• If the provider refuses the key — expired, out of credit — clicks go back to the default and you are told in the bell and by email (the Security notification).

Disconnecting takes you back to the default straight away.

#When a country looks wrong

Geo lookup is an inference from an IP address, not a fact. It is right the large majority of the time and it is never right always.

Three ordinary causes, before assuming a bug: a mobile network egressing from a different country than the handset is in; a corporate VPN; and a stale database, which is what the Databases view is for.

A visitor whose IP cannot be placed gets an empty country, not a wrong one. That is why {country} can arrive blank in a token and why a routing rule on country in [...] will not match them — worth a default path that catches them rather than a flow that assumes everyone has a country.

#Why the connection type matters

Residential, mobile, corporate, datacentre. It is the strongest single bot signal there is: real buyers browse from residential and mobile networks, and traffic from a hosting provider is almost never a customer.

It is also usable in a routing rule, which is a cheaper thing to do than it sounds — sending datacentre traffic to a harmless page keeps your click-outs clean on the network's side.