Rule asn_reputation, read from the engine code
Datacenter click fraud, flagged by IP range
Datacenter click fraud is affiliate traffic sent from cloud and hosting servers instead of homes and phones. When at least 80% of an affiliate's clicks in 7 days come from those ranges, and they have 3 sales, the engine holds the sale.
By the AffiliateTracking teamUpdated 5 min read
The fraud queue in the product, running on demo data.
The short answer
The rule needs 20 or more clicks in 7 days, 80% or more of them from a datacenter range. It also needs 3 or more sales in the same 7 days. Then it holds the commission being screened.
How the rule works
Read from internal/fraud/rules2.go. The code fixes the thresholds. No setting changes them.
- 01Checked at the click
Each click's IP is checked against a built-in table of cloud and hosting ranges as it arrives. Only a yes or no is stored, never the address.
- 0280% of at least 20
The engine adds up 7 days of clicks for the affiliate. Under 20 clicks it says nothing, so small affiliates can't trip it.
- 033 sales first
Clicks cost an attacker nothing. Without 3 sales in the window, junk traffic aimed at your links can't put you on hold.
The exact logic
// internal/fraud/rules2.go, ASNReputation (condensed)
dc, total := sum of dc_click_daily for the affiliate, last 7 days
if total < 20 { return }
if dc/total < 0.80 { return }
if sales in the last 7 days < 3 { return }
hold(commission)
Condensed from the Go source in v0.5.0 (main 4f87f77). Comments are ours.
The signals
- 80% or more datacenter clicks
- 20-click minimum in 7 days
- 3 or more sales in the window
Our data
We ran the rule at its threshold
We ran 3 fixtures through the real engine on 3 Oct 2026: 2 below the line, 1 at or past it. These are the results and the engine's own words.
| Fixture | Result | The engine's reason |
|---|---|---|
| 15 of 20 clicks from datacenter ranges, 3 sales | Silent | No verdict |
| 16 of 20 clicks from datacenter ranges, 2 sales | Silent | No verdict |
| 16 of 20 clicks from datacenter ranges, 3 sales | Fired | 16 of 20 clicks in the last 7 days came from data centers, not homes or phones |
Method: one Go test against engine v0.5.0 (main 4f87f77), a new SQLite database per fixture, dry run so nothing was held. Re-run with go test ./internal/fraud/ plus the fixture list above.
What lands in your queue
When datacenter traffic fires, the verdict shows the rule, who it's about and what it saw. Release or uphold is your call, not the engine's.
| Partner | What it saw | Commission | Result |
|---|---|---|---|
| Affiliate 8 | 46 of 50 clicks in the last 7 days came from data centers, not homes or phones | $130.00 | Commission held |
heldWaits for youThe commission stays out of payouts until you decide.releasedPaid normallyIt goes into the next payout.upheldNot paidThe engine cancels it and takes the money back. Already paid? Use a refund.In the wild
Almost half of web traffic is not people.
- Stat: Bots made up 49.6% of internet traffic in 2023, and bad bots 32%. Source: Imperva 2024 Bad Bot Report.
- Cost: For US retail and ecommerce merchants, each $1 of direct fraud loss costs $5.13 in total. Source: LexisNexis True Cost of Fraud, 24 Jun 2026.
Each item re-read against its linked source on . Items we couldn't verify were cut.
Limits, and how attackers try to beat it
- The table is small. It holds 15 IPv4 blocks from AWS, Google Cloud, Azure, DigitalOcean, Hetzner and OVH. Other hosts pass.
- IPv6 clicks are never counted as datacenter traffic.
Residential proxies dodge the range table, at a price per click. Bought traffic still has to look human, and clicks missing normal browser headers is the next check. Fast bursts from one proxy meet the per-IP click speed limit.
Related rules
Thresholds checked against the code on . Windows roll with each sale.
Datacenter traffic questions
Is my visitors' traffic sent anywhere to classify it?
No. The ranges ship inside the engine. Classification happens on your server as the click arrives.
What about my customers on a VPN?
A few VPN clicks change little. The rule needs 80% of 20 or more clicks, plus 3 sales, before it holds anything.
When does the rule run?
On every credited sale, in the same database transaction as the credit. A sweep every 5 minutes also re-checks affiliates active in the last hour.
What does a hold cost me?
Nothing but time. A held commission stays out of payouts. Release it and it pays in the next payout. Uphold it and the engine cancels it and takes the money back.
Can I test it without holding anything?
Yes. Set AE_FRAUD_DRYRUN=1. The engine records each verdict and holds nothing.
