Same IP Actions Report

The Same Actions IP report helps you identify actions for a given event type that have been driven from the same IP address over a period of time. Multiple actions from the same IP address can indicate a user or partner looking to game your payout model, either through questionable practices or fraudulent activities. Seeing the same IP address usually indicates the same person or household.

Multiple actions from the same IP address could indicate:

• Partners looking to cash in on fake or low-quality leads

• Partners looking to resell your product and take advantage of discounts/payouts

• Users looking to cash in on rewards programs only to return items for a refund

Limitations: This report is based on the referrer's IP address and doesn’t account for child actions in chained relationships. The report also doesn’t work for brands that have anonymized or removed IP addresses.

Access and view the report

This feature is only accessible to specific impact.com editions or add-ons. Contact us to upgrade your account and get access!

Follow these steps to find the report and view data based on specific filters.

1. From the left navigation bar, select [Engage] → Reports → More Reports.

2. Use the search box to search for Same IP Actions.

3. Below the report's title, set a Date Range and a threshold of Actions per IP threshold. Select [Search] when you have the filters in place.

   • View the Filter reference below for more information on additional filters.

Filter reference

Filter	Description
Date Range	Select start and end dates for the report to filter data by when it was created. You can specify up to a maximum of 366 days of data.
Network	Select the network from which the data came.
Actions per Ip Threshold	Set a limit on the number of actions that can be performed from a single IP address within a specific timeframe. If more than the selected number of actions came from the same IP address for a given event type, they will appear in this report. Depending on your event types and use case, the expected number of actions that could reasonably come from the same IP address may differ. You should set the threshold based on what you think is reasonable.
Customer Id	Filter by the unique customer identification value. Set the Same Actions IP threshold to 1 to see all actions from this value.
Hashed Ip	Filter by the IP address. The IP address is hashed to protect personally identifiable information. Set the Same Actions IP threshold to 1 to see all actions from this value
Partner	Search for partners you'd like to add to the report or select All.
Action Status	Select the action statuses that you'd like to include in the report.
Event Type	Select a specific event type to view, or select All. For certain event types, you could expect a maximum of 4 or 5 events from the same IP address as reasonable human behavior. E.g., it may be normal for the same user to make multiple purchases from your store in a week, so your threshold might be 5 for an online sale event type.

1. Once your filters are in place, you can review the data in the table.

   • Refer to the Column reference for more information.

   

Column reference

Column	Description
Partner Id	Unique ID for the partner.
Partner Name	The name of the partner that drove the action.
Shared Id	Shows the Shared ID for this action.
Action Tracker Id	The specific ID of the event type.
Action Tracker Name	The specific name of the event type.
Action Type	The type of action (e.g., Sale). These action types are tied to your event type and are described in your contract with a partner.
Hashed IP	The IP address. The IP address is hashed to protect personally identifiable information.
Click Id	The unique identifier of the click.
Action Date	The date and time when the action was recorded.
Action Id	Unique impact.com ID for the action.
Order Id	Unique OID (Order ID) for the action.
Customer Id	The ID of the customer driving the action.
Revenue	Amount of revenue generated by this action.
Payout	The commission payable to the partner.
Total Actions for Ip Address*	The total number of actions that came from the same IP Address. The higher number you see, the more suspicious.
Unique Customer Ids*	The number of unique customer IDs sent to impact.com from actions with the same IP address. A high number could indicate a bad actor trying to obscure their actions behind multiple fake/low-value accounts.
Unique Partner-User Identifiers*	Some partners use a SubId field to indicate unique users/clicks. A high number could indicate multiple users. A single value here with multiple customer IDs could suggest that a single user of the partner account is responsible for multiple user accounts on your website.
Click User Profiles*	If the unique click count is > 1, this field indicates whether those clicks came in on the same device or not.
Unique Clicks*	How many clicks were involved in the multiple actions. If the number is 1, it supports the theory that a single user is creating multiple actions, whereas multiple clicks could indicate a user trying to disguise their actions.
Original Payouts	If the action was reversed, the original payable amount.
Action Status	Status of the action: Approved, Pending, N/A, or Reversed.

* Key data points

Recommendations when viewing the report

To get the most value, use the following recommendations when setting up and viewing your report:

1. From the filter menu, select a date range, event type, and an action threshold that you consider reasonable for that event type and save it as a view.

   • If you want to set different thresholds, configure and save different views.

   
2. Set up a scheduled report to run daily or weekly.

3. Review the data by referring to the possible false positives and additional findings from your own data.

Possible False Positives

1. Multiple users using VPNs

   • One sign of VPN use is the same IP address appearing across multiple different partners with a high unique click number. This scenario increases the likelihood that a single user is trying to take advantage of multiple partners’ reward schemes. The exception to this rule may be if the multiple partners are all rewards-type partners.

2. Shared spaces like office buildings, libraries, or schools

   • While multiple users can share an IP Address in these shared spaces, the likelihood of this occurring may depend on your target audience.

Additional findings

1. Do these users behave in a typical way beyond what is tracked on impact.com?

2. Are these users returning items?

3. Do they display behavior that could be associated with reselling?

1. Contact your partners and ask them to explain the behavior you’ve seen.

   • For Rewards partners, if they can confirm bad actions of their individual users they may be able to remove bad users from their platform.

   • If the partner is not able or willing to provide an acceptable explanation, consider taking further action.

2. Consider reversing actions where you suspect fraud or behavior misaligned with your policies.