Rule ip_fallback_anomaly, from the product code
The weakest credit, overused
When a sale can't be tied to a click, the engine can still credit it by visitor IP: the last-resort step. Some fraud styles live entirely on that fallback. Overuse is the tell.
Rule 12th of 12Holds, never deletesEvidence in your queue
The fraud queue, running on demo data.
How the rule works
The exact mechanics, from the engine. No black box, no tuning required.
- 01Attribution method, tracked per conversion
Every credit records how it was attributed: token, cookie, coupon or IP fallback. The rule watches the fallback share.
- 025% of 10+
More than one in twenty conversions over 7 days landing on fallback fires the hold. Healthy programs sit near zero.
- 03Targets a specific attack
Cookie-stuffing and token-harvest styles that skip the click trail entirely show up here as fallback-heavy affiliates.
The signals
- 5%+ fallback share
- 10+ conversions
- 7-day window
What lands in your queue
When ip fallback anomalies fires, this is what you see. Release or uphold is your call, not the engine's.
| Affiliate | What tripped | Commission | Status |
|---|---|---|---|
| Affiliate 33 | 7 of 37 conversions in 7 days credited by IP fallback | $98.00 | Held |
heldWaits for youThe commission stays out of payouts until you decide.releasedPaid normallyReal pattern after all. It returns to the pipeline.upheldNot paidFraud confirmed. The clawback is journaled.In the wild
A third of publishers stuff cookies
- Stat: WEIS 2015, Snyder & Kanich, peer-reviewed: over a third of affiliate publishers cookie-stuff. Attribution workarounds are common enough to measure. Source
- Case: Shawn Hogan: $28M+ from eBay's program via cookie stuffing; 5 months prison, $25k fine (2014). Source
Cases and figures verified against court records and named reports, . Vendor estimates are labelled as such.
How attackers try to beat it
The attacker forces fallback attribution by stripping cookies and tokens. The rule turns the workaround into the signal: the only way down is real click-trail conversions.
Every rule is one layer. The twelve overlap on purpose: beating one cleanly usually means walking into another.
Related rules
Rule thresholds checked against the code . Windows are rolling.
IP fallback anomalies questions
Can I change the threshold?
The thresholds ship fixed, tuned from the rule code and tested together. Tightening one in isolation breaks the overlap the twelve rules build as a set.
What does a hold cost me?
Nothing but time. A held commission is frozen, not deleted. If you release it, it flows to the next payout exactly as if the hold never happened.
Does this rule fire on my best affiliate?
Every rule is scoped to the commissions linked to what tripped it, weighted by conversions, and rate-limited on the click side. A rival can't aim it at your top earner.
This rule, on every sale,
before the payout.
Self-host for $99 once, or run it in the cloud free for 14 days.