1. A computer-implemented method, comprising: receiving, from a content item provider, a set of declared network locations for a content item provided by the content item provider, the set of declared network locations specifying one or more network locations that the content item provider specifies and being requested by a user device in response to user interaction with the content item; simulating, at a server, a user interaction with the content item including: rendering the content item; and initiating, through interaction with the content item by one or more data processing apparatus, a request for a resource that is referenced by the content item; logging, as requested network locations for the content item and by the one or more data processing apparatus, each network location that is requested in response to the interaction with the content item; removing, by the one or more data processing apparatus and from the requested network locations, one or more of the requested network locations that match a service location, from a set of known service locations that have been identified as approved service providers for the content item provider to create a set of filtered network locations that are requested by a user device in response to user interaction with the content item; generating, for the content item and by one or more data processing apparatus, a composite set of network locations that includes the set of filtered network locations and the set of declared network locations specified by the content item provider; comparing the composite set of network locations to a set of blacklisted network locations provided by a publisher that differs from the content item provider; and preventing the content item from being presented with a web document provided by the publisher when a network location in the composite set of network locations matches a network location in the set of blacklisted network locations.