Skip to content

Click Flooding

What it detects

Section titled “What it detects”

Click flooding occurs when bots or compromised apps generate massive click volumes from a single source. The goal is to flood the attribution window so that a fraudulent click is the last recorded before a legitimate conversion — hijacking credit for organic installs.

How it works

Section titled “How it works”

Integr8 monitors click velocity per source over a sliding time window. When the click volume from a single IP, sub ID, or publisher exceeds the configured threshold within the time window, subsequent clicks from that source are blocked in real time.

The filter also evaluates Click-To-Install Time (CTIT). Abnormally high volumes combined with long CTIT distributions are a strong signal of flooding rather than legitimate user behavior.

Configuration

Section titled “Configuration”

Navigate to Offers > Fraud Detection Groups > select a filter group > Click Flooding.

Parameter Default Description
max_duplicate_ip 4 Maximum clicks allowed from the same IP within the lookback window before blocking
expires_in_seconds 3,600 (1 h) Rolling lookback window in seconds for counting duplicate IPs
extra_expires_in_seconds_when_rejected 43,200 (12 h) How long a blocked IP stays blocked after the threshold is exceeded
properties.has_offer false Include the offer ID in the deduplication key
properties.has_publisher true Include the publisher ID in the deduplication key
properties.has_sub_id false Include the sub ID in the deduplication key
properties.has_user_agent true Include the user agent in the deduplication key

These settings are managed by administrators. Contact your account admin to review or update the configuration.

What happens when triggered

Section titled “What happens when triggered”

When the click threshold is exceeded:

  • Block mode: Integr8 rejects the click with HTTP 403. No attribution is recorded.
  • Flag mode: The click is recorded with a fraud_reason: click_flooding tag. Conversions from flagged clicks are still tracked but marked as suspect.

You can review blocked clicks in Reports > Click Reports using the fraud_reason filter.

Section titled “Related filters”