Methods, systems and apparatus for identifying illegitimate selections of content items. In some implementations, one or more servers can receive display data specifying a display state of a web page in a viewport. The web page includes a content item. Display instances are identified. A display instance is a display of at least a portion of the content item in the viewport. Selection instances of the content item are identified. A selection instance is a selection of the content item. The server(s) determines whether a selection of the content item occurred during a display of at least a portion of the content item in the viewport based on the display instances and the selection instances. A selection of the content is defined as an illegitimate selection if the selection did not occur during a display of at least a portion of the content item in the viewport.