Rule click_velocity, from the product code
50 clicks an hour from one IP
A script hammers a referral link to manufacture last-touch attribution, or to bury a rival's click trail. Either way, one IP producing a click every 72 seconds is not a person.
Rule 5th of 12Holds, never deletesEvidence in your queue
The fraud queue, running on demo data.
How the rule works
The exact mechanics, from the engine. No black box, no tuning required.
- 01Per-IP rolling hour
Clicks are counted per IP hash in a rolling 60-minute window. Fifty is the line: above it, the source is a bot or a very confused NAT.
- 02The burst's money too
Commissions from the burst's clicks are held alongside it, so a manufactured click trail can't cash out through later conversions.
- 03Hashes, never raw IPs
IPs are compared as salted hashes. The rule sees equality; nobody, including us, can read the address back out.
The signals
- 50+ clicks / hour / IP hash
- Burst commissions held
What lands in your queue
When click velocity fires, this is what you see. Release or uphold is your call, not the engine's.
| Affiliate | What tripped | Commission | Status |
|---|---|---|---|
| Affiliate 31 | 63 clicks from one IP hash in the last hour | $87.20 | Held |
heldWaits for youThe commission stays out of payouts until you decide.releasedPaid normallyReal pattern after all. It returns to the pipeline.upheldNot paidFraud confirmed. The clawback is journaled.In the wild
Methbot: 200 million scripted clicks a day
- Case: Methbot and 3ve, tracked by White Ops from 2015: roughly 570,000 bots generating an estimated 200 to 300 million clicks a day. Operator Aleksandr Zhukov was sentenced to 10 years in Nov 2021. Source
- Stat: The operation revenue was estimated at $3M to $5M a day. Total loss estimates from $180M to $1B were contested by trade press.
- Context: Automated traffic passed almost half of all internet traffic in 2023 and kept growing, per Imperva Bad Bot Reports.
Cases and figures verified against court records and named reports, . Vendor estimates are labelled as such.
How attackers try to beat it
The cheap attack is volume from one address. IPv6 gives each click its own address, which is why the engine also scores velocity per identity, not just per exact IP.
Every rule is one layer. The twelve overlap on purpose: beating one cleanly usually means walking into another.
Related rules
Rule thresholds checked against the code . Windows are rolling.
Click velocity questions
Can I change the threshold?
The thresholds ship fixed, tuned from the rule code and tested together. Tightening one in isolation breaks the overlap the twelve rules build as a set.
What does a hold cost me?
Nothing but time. A held commission is frozen, not deleted. If you release it, it flows to the next payout exactly as if the hold never happened.
Does this rule fire on my best affiliate?
Every rule is scoped to the commissions linked to what tripped it, weighted by conversions, and rate-limited on the click side. A rival can't aim it at your top earner.
This rule, on every sale,
before the payout.
Self-host for $99 once, or run it in the cloud free for 14 days.