# Same IP Actions Report The *Same Actions IP* report helps you identify actions for a given event type that have been driven from the same IP address over a period of time. Multiple actions from the same IP address can indicate a user or partner looking to game your payout model, either through questionable practices or fraudulent activities. Seeing the same IP address usually indicates the same person or household. Multiple actions from the same IP address could indicate: * Partners looking to cash in on fake or low-quality leads * Partners looking to resell your product and take advantage of discounts/payouts * Users looking to cash in on rewards programs only to return items for a refund {% hint style="warning" %} **Limitations:** This report is based on the referrer's IP address and doesn’t account for child actions in chained relationships. The report also doesn’t work for brands that have anonymized or removed IP addresses. {% endhint %} #### Access and view the report ![](https://4048883401-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwMLlMoFBtKJa8ptd3zaw%2Fuploads%2Fgit-blob-ce68cfb317a0bdf2b9e82f3df63b400f7764cbf2%2F6b9ec025210c2878ab8e126697a41af04cef94403a452d5dee89cf87e9f2cf2d.svg?alt=media) This feature is only accessible to specific impact.com editions or add-ons. [Contact us](https://app.impact.com/support/portal.ihtml?createTicket=true) to upgrade your account and get access! Follow these steps to find the report and view data based on specific filters. 1. From the left navigation bar, select ![](https://4048883401-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwMLlMoFBtKJa8ptd3zaw%2Fuploads%2Fgit-blob-230534471fef5f40808e921e41ee44e4a06ded03%2Fe6cb9548999afdc1ed3ce4942e4cb5b45b5cecbd323267aac2a7cd1915fccc09.svg?alt=media) **\[Engage]** → **Reports** → **More Reports**. 2. Use the search box to search for **Same IP Actions**. 3. Below the report's title, set a *Date Range* and a threshold of *Actions per IP threshold*. Select ![](https://4048883401-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwMLlMoFBtKJa8ptd3zaw%2Fuploads%2Fgit-blob-3c5971fb7b03a98375488e97a4317afd60621298%2Fd0fbb4c2c189cdc83bc0eb8e906fa3cb66818d0a9daa1491ea48042160714ed2.svg?alt=media) **\[Search]** when you have the filters in place. * View the *Filter reference* below for more information on additional filters.
Filter reference | Filter | Description | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Date Range | Select start and end dates for the report to filter data by when it was created. You can specify up to a maximum of 366 days of data. | | Network | Select the network from which the data came. | | Actions per Ip Threshold |

Set a limit on the number of actions that can be performed from a single IP address within a specific timeframe. If more than the selected number of actions came from the same IP address for a given event type, they will appear in this report.

Depending on your event types and use case, the expected number of actions that could reasonably come from the same IP address may differ. You should set the threshold based on what you think is reasonable.

| | Customer Id |

Filter by the unique customer identification value.

Set the Same Actions IP threshold to 1 to see all actions from this value.

| | Hashed Ip |

Filter by the IP address. The IP address is hashed to protect personally identifiable information.

Set the Same Actions IP threshold to 1 to see all actions from this value

| | Partner | Search for partners you'd like to add to the report or select **All**. | | Action Status | Select the action statuses that you'd like to include in the report. | | Event Type |

Select a specific event type to view, or select All.

For certain event types, you could expect a maximum of 4 or 5 events from the same IP address as reasonable human behavior. E.g., it may be normal for the same user to make multiple purchases from your store in a week, so your threshold might be 5 for an online sale event type.

|
4. Once your filters are in place, you can review the data in the table. * Refer to the *Column reference* for more information.
Column reference | Column | Description | | --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Partner Id | Unique ID for the partner. | | Partner Name | The name of the partner that drove the action. | | Shared Id | Shows the Shared ID for this action. | | Action Tracker Id | The specific ID of the event type. | | Action Tracker Name | The specific name of the event type. | | Action Type | The type of action (e.g., Sale). These action types are tied to your event type and are described in your contract with a partner. | | Hashed IP | The IP address. The IP address is hashed to protect personally identifiable information. | | Click Id | The unique identifier of the click. | | Action Date | The date and time when the action was recorded. | | Action Id | Unique impact.com ID for the action. | | Order Id | Unique OID (Order ID) for the action. | | Customer Id | The ID of the customer driving the action. | | Revenue | Amount of revenue generated by this action. | | Payout | The commission payable to the partner. | | Total Actions for Ip Address\* |

The total number of actions that came from the same IP Address.

The higher number you see, the more suspicious.

| | Unique Customer Ids\* |

The number of unique customer IDs sent to impact.com from actions with the same IP address.

A high number could indicate a bad actor trying to obscure their actions behind multiple fake/low-value accounts.

| | Unique Partner-User Identifiers\* |

Some partners use a SubId field to indicate unique users/clicks. A high number could indicate multiple users.

A single value here with multiple customer IDs could suggest that a single user of the partner account is responsible for multiple user accounts on your website.

| | Click User Profiles\* | If the unique click count is `> 1`, this field indicates whether those clicks came in on the same device or not. | | Unique Clicks\* | How many clicks were involved in the multiple actions. If the number is 1, it supports the theory that a single user is creating multiple actions, whereas multiple clicks could indicate a user trying to disguise their actions. | | Original Payouts | If the action was reversed, the original payable amount. | | Action Status | Status of the action: *Approved*, *Pending*, *N/A,* or *Reversed*. | **\* Key data points**
#### Recommendations when viewing the report To get the most value, use the following recommendations when setting up and viewing your report: 1. From the filter menu, select a date range, event type, and an action threshold that you consider reasonable for that event type and [save it as a view](https://help.impact.com/brand/what-would-you-like-to-learn-about/platform-features/multi-program-reports/report-management/save-reports). * If you want to set different thresholds, configure and save different views.
2. Set up a [scheduled report](https://help.impact.com/brand/what-would-you-like-to-learn-about/platform-features/multi-program-reports/report-management/schedule-reports) to run daily or weekly. 3. Review the data by referring to the possible false positives and additional findings from your own data.
Possible False Positives 1. Multiple users using VPNs * One sign of VPN use is the same IP address appearing across multiple different partners with a high unique click number. This scenario increases the likelihood that a single user is trying to take advantage of multiple partners’ reward schemes. The exception to this rule may be if the multiple partners are all rewards-type partners. 2. Shared spaces like office buildings, libraries, or schools * While multiple users can share an IP Address in these shared spaces, the likelihood of this occurring may depend on your target audience.
Additional findings 1. Do these users behave in a typical way beyond what is tracked on impact.com? 2. Are these users returning items? 3. Do they display behavior that could be associated with reselling?
4. [Contact your partners](https://help.impact.com/brand/what-would-you-like-to-learn-about/platform-features/reach-out-to-partners/messaging/send-a-message-to-a-partner) and ask them to explain the behavior you’ve seen. * For *Rewards* partners, if they can confirm bad actions of their individual users they may be able to remove bad users from their platform. * If the partner is not able or willing to provide an acceptable explanation, consider taking further action. 5. Consider [reversing actions](https://help.impact.com/brand/what-would-you-like-to-learn-about/platform-features/actions-and-payouts/payouts/approve-reverse-and-modify-pending-payouts-for-actions) where you suspect fraud or behavior misaligned with your policies. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://help.impact.com/brand/what-would-you-like-to-learn-about/platform-features/protect-and-monitor-your-performance-program/event-risk/same-ip-actions-report.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.