Gate withdrawals on verified ad revenue
Let users earn freely and withdraw only what their verified ad activity actually paid for. Entitlement is spent at request time so pending requests cannot double-spend it.
Tagged “fraud”
21 entries
Spot a referral ring by the browser it was made from
A referral you can reach from the referrer's own browser is self-referral. One query separates a farm from a community.
Flags that reopen forever
A scan that reruns hourly will reopen the flag you just closed, because the lifetime total it measures is still over the line. Record the magnitude at close and only reopen on something materially worse.
Every warning needs a matching data stream
A risk flag that says 'device shared with 5 accounts' and offers nowhere to look is worse than no flag. And if the scorer and the panel key on different fingerprints, they will contradict each other.
What shortlink verification cannot prove
Token, ownership, dwell and caps are the honest limit. None of them prove the provider's page was ever seen — the daily cap is what bounds the loss.
Verify a shortlink completion with a signed return token
Providers do not postback, so the round trip is the only evidence. Single use, account bound, expiring, minimum dwell, and starting a new run kills the old one.
Filter out referrals that were never real
Count active referrals, not registered ones. Four queries that separate a genuine promoter from someone with a script.
Three referral commission models, and what each one costs
Percentage of earnings, one-off signup bonus, or a share of what you earn from the referral. The arithmetic that decides which one bankrupts you.
Attribute a referral with a cookie and a window
First touch or last touch, a window that expires, and the check that stops a user referring themselves.
Guard against a negative balance, and claw back correctly
Make the column unsigned, check inside the transaction, and let a clawback take a balance to zero rather than below it.
Gate earning by referer without blocking the page
Check that the request came from the site the slot belongs to. Refuse the credit, never the content — the same rule that keeps you out of trouble everywhere else.
A PTC offer runner that pays only on a real view
Open the target, run the timer, verify server-side, credit once. The four steps and the checks that belong to each.
An admin view that shows you who is farming you
Four queries — earnings concentration, shared visitor keys, signup velocity, payout-to-activity ratio — that surface abuse without a fraud engine.
Enforce a minimum dwell that a script cannot skip
The countdown belongs to the client, so the client will lie. Bind the timing to a signed server token and check it when the claim arrives.
Detect bots without breaking the page for them
Withhold earnings from obvious automation, never content. Blocking search crawlers is a self-inflicted wound that takes months to notice.
A cookieless visitor key you can count on
One rotating hash that identifies a visitor for limits and counting, without a cookie to clear and without storing anything that identifies a person.
Cap what one visitor can earn you in a day
Pay each creative at most once per visitor per day. The ceiling becomes the number of creatives in rotation, which is a number you control.
Only count an impression a real browser actually rendered
Crediting on the ad request pays anything that can run curl. A signed nonce plus a beacon that only fires in a visible browser closes it.
Verify that someone owns the site they registered
Fetch the page, look for your token in a meta tag, and only let verified sites earn. The empty-needle bug in this check is worth knowing about before it bites you.
A sliding-window rate limiter in MySQL
No Redis, no extension, no cron. One table and one function that caps any action per key within any window, and fails open so an outage never locks the site.
Get the real client IP without trusting a spoofable header
Every per-IP limit you have is only as good as this function. Reading X-Forwarded-For unconditionally hands attackers a free reset on all of them.