Filter out referrals that were never real
Count active referrals, not registered ones. Four queries that separate a genuine promoter from someone with a script.
Tagged “fraud”
15 entries
Three referral commission models, and what each one costs
Percentage of earnings, one-off signup bonus, or a share of what you earn from the referral. The arithmetic that decides which one bankrupts you.
Attribute a referral with a cookie and a window
First touch or last touch, a window that expires, and the check that stops a user referring themselves.
Guard against a negative balance, and claw back correctly
Make the column unsigned, check inside the transaction, and let a clawback take a balance to zero rather than below it.
Gate earning by referer without blocking the page
Check that the request came from the site the slot belongs to. Refuse the credit, never the content — the same rule that keeps you out of trouble everywhere else.
A PTC offer runner that pays only on a real view
Open the target, run the timer, verify server-side, credit once. The four steps and the checks that belong to each.
An admin view that shows you who is farming you
Four queries — earnings concentration, shared visitor keys, signup velocity, payout-to-activity ratio — that surface abuse without a fraud engine.
Enforce a minimum dwell that a script cannot skip
The countdown belongs to the client, so the client will lie. Bind the timing to a signed server token and check it when the claim arrives.
Detect bots without breaking the page for them
Withhold earnings from obvious automation, never content. Blocking search crawlers is a self-inflicted wound that takes months to notice.
A cookieless visitor key you can count on
One rotating hash that identifies a visitor for limits and counting, without a cookie to clear and without storing anything that identifies a person.
Cap what one visitor can earn you in a day
Pay each creative at most once per visitor per day. The ceiling becomes the number of creatives in rotation, which is a number you control.
Only count an impression a real browser actually rendered
Crediting on the ad request pays anything that can run curl. A signed nonce plus a beacon that only fires in a visible browser closes it.
Verify that someone owns the site they registered
Fetch the page, look for your token in a meta tag, and only let verified sites earn. The empty-needle bug in this check is worth knowing about before it bites you.
A sliding-window rate limiter in MySQL
No Redis, no extension, no cron. One table and one function that caps any action per key within any window, and fails open so an outage never locks the site.
Get the real client IP without trusting a spoofable header
Every per-IP limit you have is only as good as this function. Reading X-Forwarded-For unconditionally hands attackers a free reset on all of them.