Rule bot_class_gating, from the product code
Bot traffic beyond the known-bot filter
Googlebot is filtered before counting starts. This rule catches the rest: scrapers, headless browsers and click farms that mimic people well enough to count.
Rule 7th of 12Holds, never deletesEvidence in your queue
The fraud queue, running on demo data.
How the rule works
The exact mechanics, from the engine. No black box, no tuning required.
- 01After the known filter
Verified crawlers are excluded up front. What's left gets scored on behaviour signals in the user agent and click pattern.
- 0250% share, 20-click floor
Half of a meaningful sample must look automated. Small affiliates with odd traffic never trip it.
- 03Money follows the clicks
Commissions traced to the flagged clicks are held with the account, so bought traffic can't convert its way to a payout.
The signals
- 50%+ suspected-bot share
- 20+ counted clicks in 7 days
What lands in your queue
When bot traffic fires, this is what you see. Release or uphold is your call, not the engine's.
| Affiliate | What tripped | Commission | Status |
|---|---|---|---|
| Affiliate 27 | 31 of 51 counted clicks scored as bots | $76.50 | Held |
heldWaits for youThe commission stays out of payouts until you decide.releasedPaid normallyReal pattern after all. It returns to the pipeline.upheldNot paidFraud confirmed. The clawback is journaled.In the wild
Bots are a third of everything
- Stat: Imperva 2024: bad bots were about one third of all internet traffic in 2023. Source
- Case: United States v. Michael Smith (pled guilty Mar 2026): a botnet streamed AI-made songs billions of times for ~$10M in royalties. First streaming-fraud conviction.
Cases and figures verified against court records and named reports, . Vendor estimates are labelled as such.
How attackers try to beat it
Headless Chrome sends a perfectly normal user agent. The classification also weighs patterns a script can't easily fake consistently across thousands of clicks.
Every rule is one layer. The twelve overlap on purpose: beating one cleanly usually means walking into another.
Related rules
Rule thresholds checked against the code . Windows are rolling.
Bot traffic questions
Can I change the threshold?
The thresholds ship fixed, tuned from the rule code and tested together. Tightening one in isolation breaks the overlap the twelve rules build as a set.
What does a hold cost me?
Nothing but time. A held commission is frozen, not deleted. If you release it, it flows to the next payout exactly as if the hold never happened.
Does this rule fire on my best affiliate?
Every rule is scoped to the commissions linked to what tripped it, weighted by conversions, and rate-limited on the click side. A rival can't aim it at your top earner.
This rule, on every sale,
before the payout.
Self-host for $99 once, or run it in the cloud free for 14 days.