Token-protected postbacks
- Every S2S postback needs the workspace token or the token of the offer's advertiser.
- Advertiser tokens only work for that advertiser's offers.
- A
payout=override is only honoured with the workspace token.
Fraud signals
Spot questionable traffic before you pay for it
Every click is checked as it is recorded and carries a set of flags — bot, data-centre network, repeat visitor, unexpanded macros and more. Every rejected conversion carries the reason it was rejected.
TrackCrown gives you clear, explainable signals and the controls to act on them. It is not a third-party fraud-scoring service, and flags never change where a visitor is sent.
Click flags
Checked on every click
Signals are computed at the tracking domain from the request itself and stored with the click. Your team sees them in the clicks explorer and the click detail; partners and advertisers never do.
- Recorded, not acted on. Flags never change the redirect, so a flagged click is answered exactly like any other.
- Explainable. Each flag has one documented rule — no opaque score to argue about with a partner.
- Open data. Country and network come from the DB-IP Lite databases; the data-centre list is maintained in the product.
- bot
- The user agent belongs to a known crawler, HTTP library or automation tool — including Google's own ad and landing-page crawlers — or a headless browser.
- headless
- A headless or automation browser such as Headless Chrome or PhantomJS. Always also flagged as bot.
- datacenter
- The source network (ASN) belongs to a hosting or cloud provider — AWS, Google Cloud, Azure, DigitalOcean, OVH, Hetzner and others, about 50 networks in all. CDN and privacy-relay networks that real people browse through are deliberately not listed.
- duplicate_ip
- Not the first click from this IP address and user agent on the same offer through the same partner within 24 hours — the click is not unique.
- rate_limited
- More than 60 clicks from one IP address within a single clock minute.
- proxy
- Proxy headers (Via, Forwarded, X-Forwarded-For) arrived from a network hop we do not operate.
- missing_ua
- The request had no User-Agent header.
- missing_language
- The request had no Accept-Language header, which browsers send.
- prefetch
- A speculative or prefetch request rather than a click (Purpose, Sec-Purpose or X-Moz headers).
- embedded_request
- The browser loaded the link as a hidden image, iframe, embed or object (Sec-Fetch-Dest) instead of following a click — the signature of cookie stuffing. Such requests never receive the conversion cookie.
- invalid_params
- A tracking parameter still holds an unexpanded placeholder such as
{gclid},%7Bkeyword%7Dor__CAMPAIGN_ID__— usually a broken template rather than fraud.
Unique clicks & privacy
Repeat clicks counted, addresses kept out of the cache
Uniqueness and click rate are counted in a fast cache at the moment of the click. The cache only ever holds keyed hashes, and they expire on their own.
- The IP address is hashed with HMAC-SHA-256 and a secret per installation before it is used in any key.
- A click is unique when its offer, partner, IP hash and user agent have not been seen in the last 24 hours.
- The per-address rate counter lives for two minutes.
- The click log keeps the IP address for 13 months for attribution and review — visible to your team only.
Conversion checks
A reason for every rejected conversion
Rejected conversions are kept, not dropped. They are never paid and never posted back to partners, and each one records why it was rejected — so the same rule can be explained to the advertiser and the partner.
- duplicate
- The same click already converted for this event (unless the event allows several), or the advertiser's transaction ID was already used on this offer.
- outside_window
- The conversion arrived after the offer's attribution window (1 to 365 days) had closed.
- click_blocked
- The click was refused — for example, its destination was not allowed — so it cannot produce a conversion.
- cap_exceeded
- The offer's or the partner's conversion or payout cap for the period was already reached.
- postback
- The advertiser reported the conversion as rejected (status=rejected).
- manual · import
- Rejected by your team, with a free-text reason such as “chargeback”, or by a CSV import.
Refused at the door
Requests that never become conversions
Some requests are answered with an error and nothing is stored, because there is nothing legitimate to record.
- Postbacks without a valid workspace or advertiser token — HTTP 401.
- An advertiser token used for another advertiser's offer.
- Unknown click IDs, unknown offers and unknown events.
- Pixels without a click ID, and conversions for offers that do not accept that method.
- Conversions sent to a tracking domain that does not serve the offer's workspace.
Controls
Guardrails that limit exposure
Signals tell you where to look. These controls decide what can be paid — before anyone reviews anything.
Pixel rules
- Pixels need a click ID and an offer that accepts pixels; they cannot set the payout.
- The pixel cookie is off by default and set only on partner-link redirects, never on transparent links.
Duplicate protection
- One conversion per click per event, unless the event allows several.
- One conversion per advertiser transaction ID per offer, enforced by the database as well as the engine.
Attribution window
- Set per offer, from 1 to 365 days.
- Late conversions are kept as rejected with reason outside_window, never silently paid.
Caps as guardrails
- Click caps send excess partner traffic to the fallback.
- Conversion and payout caps — per offer and per partner — reject what is over the limit, so a misbehaving source cannot run up a bill.
Allowed destinations
- Transparent links only redirect to hostnames on your allowlist; anything else gets a 403 page.
- Nobody can reuse your tracking domain to send visitors to a site you did not approve.
Access is a control too
Partners need an approved account and, for approval-only offers, approved access. Blocking a partner — or their access to one offer — sends their clicks to the fallback instead of the offer, and per-click payouts only ever count unique, non-bot clicks.Review workflow
From signal to decision
A typical review starts in a report, narrows down in the clicks explorer and ends with a decision on the conversions — and every decision is written to the audit log.
Spot
Group a report by partner, sub ID or campaign with unique clicks, bot clicks and CVR.Inspect
Filter the clicks explorer to that source; open clicks to read their flags, network and user agent.Decide
Keep the offer's conversions pending, then approve or reject in bulk with a reason.Act
Add a partner cap, block access to the offer, or block the partner.
Honest limits
What fraud signals do not do
We would rather you know the boundaries than discover them. Fraud signals are a transparent first line of review, not a verification service.
What you get
- Eleven documented flags on every click, from the request itself.
- Unique-click and per-minute rate counting with hashed addresses.
- A stored reason on every rejected conversion.
- Tokens, pixel rules, duplicate checks, attribution windows and caps that limit what can be paid.
- Bot-click counts in reports and bot filters in the clicks explorer.
What it does not do
- No third-party fraud scoring, IP-reputation feeds or device fingerprinting.
- No automatic rejection of conversions from flagged clicks — your team decides.
- No different destination for bots, reviewers, countries or devices: that would be cloaking.
- No scripts in the visitor's browser on tracking links, and no cookies unless you enable the pixel cookie.
- No guarantee against sophisticated fraud. If your traffic needs a verification vendor, run it alongside and pass its IDs through sub IDs.
Are flagged clicks still redirected?
Yes. Every click goes where its link says it goes, whatever its flags. Sending bots, reviewers or certain countries somewhere else would be cloaking; flags are recorded for reporting and review only.
Do bot clicks count in reports?
They are counted in clicks and shown separately as bot clicks, so you can see the share per partner, sub ID or campaign. They are never paid as clicks: per-click payouts and revenue only count unique clicks that are not flagged as bots and were redirected normally.
Are conversions from flagged clicks rejected automatically?
No. A flag is a reason to look, not proof. For offers you want to check, set the default conversion status to pending; then approve or reject in bulk after reviewing the clicks, with a reason that is kept on every conversion.
Why are Google's crawlers flagged as bots?
Google's ad and landing-page crawlers request tracking links to check destinations. They are flagged so they do not distort click counts — and, like every visitor, they are sent to exactly the same destination as people.
Do you fingerprint visitors or run scripts in their browser?
No. Signals come only from the request itself: user agent, request headers, IP address and its network. Tracking links run no script, set no cookie by default and do not build device fingerprints.
Can partners or advertisers see the flags?
No. Fraud flags, visitors' IP addresses and bot-click counts are visible to your own team only — never in the partner or advertiser portals, their exports or their API keys.
Pay for real traffic
See your own partners' click quality with flags, bot counts and conversion review in one workspace.