The Same Actions IP report helps you identify actions for a given event type that have been driven from the same IP address over a period of time. Multiple actions from the same IP address can indicate a user or partner looking to game your payout model, either through questionable practices or fraudulent activities. Seeing the same IP address usually indicates the same person or household.
Multiple actions from the same IP address could indicate:
Partners looking to cash in on fake or low-quality leads
Partners looking to resell your product and take advantage of discounts/payouts
Users looking to cash in on rewards programs only to return items for a refund
Limitations: This report is based on the referrer's IP address and doesn’t account for child actions in chained relationships. The report also doesn’t work for brands that have anonymized or removed IP addresses.
Access and view the report
This feature is only accessible to specific impact.com editions or add-ons. Contact us to upgrade your account and get access!Follow these steps to find the report and view data based on specific filters.
From the left navigation bar, select Reports → More Reports.
Use the search box to search for Same IP Actions.
Below the report's title, set a Date Range and a threshold of Actions per IP threshold. Select
![[Search]](https://paligoapp-cdn-eu1.s3.eu-west-1.amazonaws.com/impact/attachments/f01cdffa431a4d75ff09c130b66974d4-d9034475259004cc4d724957e37096f4.svg)
[Search] when you have the filters in place.View the Filter reference below for more information on additional filters.
Filter
Description
Date Range
Select start and end dates for the report to filter data by when it was created. You can specify up to a maximum of 366 days of data.
Network
Select the network from which the data came.
Actions per Ip Threshold
Set a limit on the number of actions that can be performed from a single IP address within a specific timeframe. If more than the selected number of actions came from the same IP address for a given event type, they will appear in this report.
Depending on your event types and use case, the expected number of actions that could reasonably come from the same IP address may differ. You should set the threshold based on what you think is reasonable.
Customer Id
Filter by the unique customer identification value.
Set the Same Actions IP threshold to 1 to see all actions from this value.
Hashed Ip
Filter by the IP address. The IP address is hashed to protect personally identifiable information.
Set the Same Actions IP threshold to 1 to see all actions from this value
Partner
Search for partners you'd like to add to the report or select All.
Action Status
Select the action statuses that you'd like to include in the report.
Event Type
Select a specific event type to view, or select All.
For certain event types, you could expect a maximum of 4 or 5 events from the same IP address as reasonable human behavior. E.g., it may be normal for the same user to make multiple purchases from your store in a week, so your threshold might be 5 for an online sale event type.
Once your filters are in place, you can review the data in the table.
Refer to the Column reference for more information.
Column
Description
Partner Id
Unique ID for the partner.
Partner Name
The name of the partner that drove the action.
Shared Id
Shows the Shared ID for this action.
Action Tracker Id
The specific ID of the event type.
Action Tracker Name
The specific name of the event type.
Action Type
The type of action (e.g., Sale). These action types are tied to your event type and are described in your contract with a partner.
Hashed IP
The IP address. The IP address is hashed to protect personally identifiable information.
Click Id
The unique identifier of the click.
Action Date
The date and time when the action was recorded.
Action Id
Unique impact.com ID for the action.
Order Id
Unique OID (Order ID) for the action.
Customer Id
The ID of the customer driving the action.
Revenue
Amount of revenue generated by this action.
Payout
The commission payable to the partner.
Total Actions for Ip Address*
The total number of actions that came from the same IP Address.
The higher number you see, the more suspicious.
Unique Customer Ids*
The number of unique customer IDs sent to impact.com from actions with the same IP address.
A high number could indicate a bad actor trying to obscure their actions behind multiple fake/low-value accounts.
Unique Partner-User Identifiers*
Some partners use a SubId field to indicate unique users/clicks. A high number could indicate multiple users.
A single value here with multiple customer IDs could suggest that a single user of the partner account is responsible for multiple user accounts on your website.
Click User Profiles*
If the unique click count is
> 1, this field indicates whether those clicks came in on the same device or not.Unique Clicks*
How many clicks were involved in the multiple actions. If the number is 1, it supports the theory that a single user is creating multiple actions, whereas multiple clicks could indicate a user trying to disguise their actions.
Original Payouts
If the action was reversed, the original payable amount.
Action Status
Status of the action: Approved, Pending, N/A, or Reversed.
* Key data points
To get the most value, use the following recommendations when setting up and viewing your report:
From the filter menu, select a date range, event type, and an action threshold that you consider reasonable for that event type and save it as a view.
If you want to set different thresholds, configure and save different views.
Set up a scheduled report to run daily or weekly.
Review the data by referring to the possible false positives and additional findings from your own data.
Multiple users using VPNs
One sign of VPN use is the same IP address appearing across multiple different partners with a high unique click number. This scenario increases the likelihood that a single user is trying to take advantage of multiple partners’ reward schemes. The exception to this rule may be if the multiple partners are all rewards-type partners.
Shared spaces like office buildings, libraries, or schools
While multiple users can share an IP Address in these shared spaces, the likelihood of this occurring may depend on your target audience.
Contact your partners and ask them to explain the behavior you’ve seen.
For Rewards partners, if they can confirm bad actions of their individual users they may be able to remove bad users from their platform.
If the partner is not able or willing to provide an acceptable explanation, consider taking further action.
Consider reversing actions where you suspect fraud or behavior misaligned with your policies.