Rule conversion_time_anomaly, from the product code

Sales that never sleep

Scripts don't have time zones. Farms run at the operator's working hours, not the audience's. Either way, conversions pile up in the dead of night UTC.

Rule 10th of 12Holds, never deletesEvidence in your queue

Fraud queue on demo data: conversion_time_anomaly sits with its verdict, subject, reason and action, above the held commissions with amounts.

The fraud queue, running on demo data.

How the rule works

The exact mechanics, from the engine. No black box, no tuning required.

  1. 01Night share vs program baseline

    The rule computes the affiliate's 00:00 to 05:59 UTC share over 7 days and requires at least 20 conversions, then asks whether it's far above the program's own night share using a z-score above 3.

  2. 02Statistical, not absolute

    A program whose audience genuinely converts at night raises the baseline for everyone. Only outliers against your own normal fire.

  3. 03Hold for review

    Night-shift audiences exist. The hold shows the hour histogram so you can release real ones fast.

The signals

  • 50%+ night share
  • z > 3 vs program baseline
  • 20-conversion floor
Holds, never deletesA hold freezes the commission before payout. Nothing is lost while you decide.
Evidence attachedThe queue shows exactly what tripped, side by side with the sale.

What lands in your queue

When odd conversion hours fires, this is what you see. Release or uphold is your call, not the engine's.

Fraud queue · conversion_time_anomaly · demo dataMade-up numbers
Example held commissions after odd conversion hours fired, on demo data
AffiliateWhat trippedCommissionStatus
Affiliate 922 of 31 conversions between 00:00 and 05:59 UTC, z = 4.1$287.30Held
heldWaits for youThe commission stays out of payouts until you decide.
releasedPaid normallyReal pattern after all. It returns to the pipeline.
upheldNot paidFraud confirmed. The clawback is journaled.

In the wild

Bots don't sleep. Farms run on one time zone.

  • Case: Thailand, June 2017: the 400-iPhone click farm ran around the clock; three operators arrested, equipment seized.
  • Stat: Imperva 2024: bad bots about one third of internet traffic in 2023. Source

Cases and figures verified against court records and named reports, . Vendor estimates are labelled as such.

How attackers try to beat it

The farm schedules its scripts for business hours in the target market. Now the attack costs scheduling discipline, and the other conversion rules catch the volume it still needs.

Every rule is one layer. The twelve overlap on purpose: beating one cleanly usually means walking into another.

Related rules

Rule thresholds checked against the code . Windows are rolling.

Odd conversion hours questions

Can I change the threshold?

The thresholds ship fixed, tuned from the rule code and tested together. Tightening one in isolation breaks the overlap the twelve rules build as a set.

What does a hold cost me?

Nothing but time. A held commission is frozen, not deleted. If you release it, it flows to the next payout exactly as if the hold never happened.

Does this rule fire on my best affiliate?

Every rule is scoped to the commissions linked to what tripped it, weighted by conversions, and rate-limited on the click side. A rival can't aim it at your top earner.

This rule, on every sale,
before the payout.

Self-host for $99 once, or run it in the cloud free for 14 days.