Affiliate fraud detection: bots, datacenters, VPN and suspicious conversions

Fraud in affiliate marketing ranges from bots inflating clicks to fake leads and conversions from the same device. Rastro checks every click as it arrives, looks for suspicious patterns every few minutes, and puts everything on the Fraud page for your team to review.

Checks on every click

When a click arrives, Rastro checks:

• Bots and tools: user agents of crawlers, scripts and automation tools, outdated browsers and malformed user agents.
• Datacenters: IPs of servers and hosting (bots, scripts, proxies).
• VPN: IPs of known VPN providers.
• Blocklisted IPs: IPs and ranges you add to your network's list.

The datacenter and VPN lists are updated automatically every day. For each one you decide what happens in Fraud → Rules:

• off: ignore;
• flag: the click counts, but is marked for review;
• block: the visitor goes to the "offer unavailable" page and the click doesn't count.

Real people also use VPNs, so blocking them may cut good traffic. Flagging is the safer default.

Patterns found by the detectors

Every 5 minutes, Rastro looks for patterns that a single click doesn't show. All limits can be adjusted in Fraud → Rules:

Signal	When it's raised (default)
Repeated clicks	The same IP clicks more than 5 times a day on the same offer
Click flood	More than 30 clicks from one IP in 10 minutes
Affiliate spike	An affiliate's clicks jump to 4× their usual rate (with at least 200 clicks)
Conversions from the same IP	More than 3 conversions a day from clicks with the same IP
Conversions from the same device	More than 3 conversions a day for one affiliate from the same device and subnet
Too-fast conversion	Conversion less than 10 seconds after the click
Abnormal conversion rate	An affiliate converts at 3× the offer's average (with enough clicks)
Country mismatch	The country of the conversion differs from the click's, or isn't allowed on the offer

The country mismatch check needs the conversion's country: the advertiser sends it in the postback with country=XX (see Set up the advertiser postback). For pixel conversions, it comes from the visitor's IP.

The same device check combines the browser's exact user agent with the IP subnet. User agents alone would be a poor signal, because many identical phones share them.

Reviewing alerts

Each signal becomes an alert with a severity (high, medium or low) and the details: IPs (only as hashes), the affiliate, the offer, the conversions involved. On each alert you can:

• Confirm fraud: the linked conversions are rejected and the affiliate's balance is adjusted;
• Dismiss: a false positive, for example a company network where many people share an IP;
• Keep watching.

Nothing is blocked without a decision from your team, except the blocklisted IPs (if you turn blocking on) and datacenter or VPN traffic set to block.

Act automatically

For repeated cases, an automation rule can act on its own, for example: when an affiliate's suspicious clicks exceed 30% in 24 hours, with at least 200 clicks, block the affiliate. Rules are simulated before you activate them, so you see what they would catch.