What is click to install time (CTIT)?

Why the distribution matters

Any individual CTIT value tells you almost nothing. A user might install immediately or download over a poor connection and open the app an hour later; both are normal.

The distribution across a source is what carries information. Genuine traffic produces a characteristic shape: very few installs in the first few seconds, a peak in the first several minutes, and a declining tail over hours as people return to a download they started earlier.

Fraud distorts that shape in ways that are difficult to disguise, because the fraudster does not control when the real user actually opens the app.

What the anomalies mean

• A spike under ten seconds. Strongly indicative of click injection — the click was fired during the install, not before it.
• A long flat tail with no peak. Characteristic of click spam, because the clicks are unrelated to the installs and arrive at random intervals.
• Implausibly uniform values. Real human behaviour has variance; a source producing identical intervals is generating them.
• A distribution that differs sharply from your organic baseline, which is the comparison that matters more than any absolute threshold.

Using it properly

Compare each source against your own organic distribution rather than against a published benchmark. Connection speed, app size and market all shift the shape legitimately, so a threshold that is correct for one app will produce false positives for another.

And treat it as a screening tool rather than a verdict. A distorted distribution identifies a source worth investigating; the confirmation is downstream behaviour and, where the stakes justify it, a holdout.