turnley.dev

PHP and MySQL code for faucet operators

Tools & Calculators

FRD-013

Spot a referral ring by the browser it was made from

A referral you can reach from the referrer's own browser is self-referral. One query separates a farm from a community.

Referral fraud is mostly one person signing up their own accounts. All the usual signals — same address, same device — apply, but the specific question for referrals is whether the referral and the referrer have ever shared a browser.

A genuine promoter's referrals arrive from devices they have never touched. A farm's do not, because one person made all of them.

Shape matters too. Real referrals arrive irregularly from varied devices over weeks; farmed ones arrive in a burst from a handful of fingerprints and then stop earning.

PHP 
/** Referrals brought in by this user, flagged where a device is shared. */
function referrals_with_device_overlap(PDO $pdo, int $referrerId): array
{
    $sql = 'SELECT r.id, r.username, r.created_at,
                   (SELECT COUNT(*) FROM claims c WHERE c.user_id = r.id) AS claims,
                   (SELECT COUNT(DISTINCT DATE(c.created_at)) FROM claims c WHERE c.user_id = r.id) AS active_days,
                   EXISTS (
                       SELECT 1 FROM user_devices a
                       JOIN user_devices b
                         ON (a.fingerprint = b.fingerprint AND a.fingerprint <> "")
                         OR (a.client_fp  = b.client_fp  AND a.client_fp  <> "")
                       WHERE a.user_id = r.id AND b.user_id = ?
                   ) AS shares_device
            FROM users r
            WHERE r.referrer_id = ?
            ORDER BY r.created_at';

    $st = $pdo->prepare($sql);
    $st->execute([$referrerId, $referrerId]);
    $rows = $st->fetchAll(PDO::FETCH_ASSOC);

    $shared = 0;
    foreach ($rows as $r) {
        $shared += (int) $r['shares_device'];
    }

    return [
        'referrals'   => $rows,
        'shared'      => $shared,
        'total'       => count($rows),
        // A ring is mostly shared; a community is mostly not.
        'looks_like_ring' => count($rows) >= 4 && $shared / max(1, count($rows)) > 0.5,
    ];
}

Using it

Void the commission rather than the account when the overlap is clear. The referral may be a real person in the same household.

Pay referral commission only after the referral has done real work across several days. That alone removes most of the incentive.

Keep the check in the investigation panel, not in an automatic ban. False positives here are families.

What bites people

Household sharing is common and legitimate, particularly on a site aimed at people without a computer each. Weigh the ratio, not a single match.

Clearing cookies defeats the browser signature; the server-side fingerprint is the one that survives. Match both.

Do not reverse commissions already paid out unless the fraud is unambiguous. Clawing back an honest promoter costs more than the fraud did.

This one touches real money. Point it at a throwaway wallet and watch a full cycle before you trust it with a live balance.

Also in Anti-Bot and Fraud