Rule ip_overlap, from the product code
Many affiliates behind one address
Twelve affiliates, one VPN exit. The farm's mistake is infrastructure: every member clicks through the same few addresses.
Rule 8th of 12Holds, never deletesEvidence in your queue
The fraud queue, running on demo data.
How the rule works
The exact mechanics, from the engine. No black box, no tuning required.
- 01Cross-affiliate, 30 days
Visitor IP hashes are compared across affiliates over a month. Two or more shared with other affiliates is the bar.
- 02Farm topology
The pattern the rule finds is structural: not one bad click, but a cluster of accounts whose traffic funnels through the same exits.
- 03Hold plus trace
Commissions tied to overlapping clicks are held too, so the farm can't launder its attribution through a clean-looking account.
The signals
- 2+ IPs shared with other affiliates
- 30-day window
What lands in your queue
When ip overlap fires, this is what you see. Release or uphold is your call, not the engine's.
| Affiliate | What tripped | Commission | Status |
|---|---|---|---|
| Affiliate 15 | 2 visitor IPs also clicked links of Affiliates 22 and 9 | $149.00 | Held |
heldWaits for youThe commission stays out of payouts until you decide.releasedPaid normallyReal pattern after all. It returns to the pipeline.upheldNot paidFraud confirmed. The clawback is journaled.In the wild
911 S5: 19 million borrowed home IPs
- Case: The 911 S5 botnet, dismantled by the DOJ in May 2024: a residential proxy pool of about 19 million infected devices, rented so fraud traffic looked like unique home users. Its administrator was arrested; the Treasury sanctioned the operators the same day.
- Stat: WEIS 2015, peer-reviewed: over a third of affiliate publishers cookie-stuff. Shared infrastructure is how farms scale. Source
Cases and figures verified against court records and named reports, . Vendor estimates are labelled as such.
How attackers try to beat it
The farm can buy unique residential proxies per member, at cost. Shared infrastructure is the cheap default, and this rule makes it expensive.
Every rule is one layer. The twelve overlap on purpose: beating one cleanly usually means walking into another.
Related rules
Rule thresholds checked against the code . Windows are rolling.
IP overlap questions
Can I change the threshold?
The thresholds ship fixed, tuned from the rule code and tested together. Tightening one in isolation breaks the overlap the twelve rules build as a set.
What does a hold cost me?
Nothing but time. A held commission is frozen, not deleted. If you release it, it flows to the next payout exactly as if the hold never happened.
Does this rule fire on my best affiliate?
Every rule is scoped to the commissions linked to what tripped it, weighted by conversions, and rate-limited on the click side. A rival can't aim it at your top earner.
This rule, on every sale,
before the payout.
Self-host for $99 once, or run it in the cloud free for 14 days.