Techniques for identifying fraudulent entities is provided. Tracking data is received for displayed content items and is associated with one or more entities. Using the tracking data and one or more rules, a determination is made whether the one or more entities are fraudulent. A new rule is received and the one or more rules are updated, while continuing to receive tracking data and determine whether one or more entities are fraudulent. The new rule is used to determine whether one or more entities are fraudulent. Fraud data about the one or more entities is stored in a central database, and, in response to a determination that a particular entity is fraudulent, an alert is sent to a content exchange. The content exchange may suspend, based on the alert, delivery of content items associated with the particular entity.