How Moonetix Checks Traffic Quality

How does Moonetix check traffic quality?

Moonetix checks traffic in layers: every offer is reviewed before it goes live, the offerwall blocks VPN, proxy, Tor and data center connections before it opens, users are limited in how often they can complete an offer, advertisers confirm every result from their own server before it is paid, and our staff run manual checks. Results that look wrong are rejected or reversed, and serious problems can lead to held earnings, a paused app or a suspended integration.

This page explains those layers at the level our Terms of Service describe them, what each outcome means for you as a publisher, and how to read the Traffic quality report in your dashboard. It deliberately leaves out how the checks work in detail. Every detail we publish is a detail someone could use to get around the checks, and honest publishers are the ones who would pay for that.

The checks named in our Terms

Section 10 of the Terms lists how we protect advertisers, publishers and honest end users. Here is what each layer does and who runs it.

According to the Terms, these checks may consider activity history, completion patterns, the IP address and network of a visit, security challenges, and information from advertisers and offer partners. That is as far as we go in public. We do not publish thresholds, scores, the order in which checks run, or which tools we use.

Blocking data center traffic is not a Moonetix invention. The Media Rating Council, which sets measurement standards for digital advertising, lists known data center traffic as General Invalid Traffic in its February 2017 memo on invalid data-center traffic, because servers are a consistent source of non-human visits. Advertisers apply the same logic, which is why they would reverse those results anyway.

What a blocked user sees

When the offerwall stops a visit, the user sees a short message instead of the offers, so honest users know what to change. The exact wording depends on the reason:

• VPN, proxy or Tor detected: the user is told that offers cannot track progress through that connection, with a Try again button after they switch it off.
• Network not supported: for server or data center connections, and for addresses recently used by proxy services. Offers only work on a normal home or mobile connection.
• Location changed: a user who opened offers from another country in the last 24 hours waits a day before offers open again.
• Not available: offers are not available for that account, for example after a block.

Users who think the message is wrong can follow the steps on our connection help page or contact support from the message itself. If your users ask you about it, VPN or proxy detected on the offerwall explains the fixes in plain words you can pass on.

What the checks look for

The checks look for activity that breaks the Terms, in six broad groups: automation, a disguised location or device, repeated completions of the same offer, false information, artificially generated results, and publisher-side abuse such as completing offers on your own wall. The OWASP Automated Threats to Web Applications project describes many of the same patterns from the website owner’s side, for example bulk account creation for later misuse (OAT-019). The full rulebook, with what each rule means in practice, is in the traffic quality rules, and the rules for promoting the wall are in Promoting your offerwall.

What happens to a suspicious result

Every credited result on your wall reaches your server as a postback with a status, and if it is reversed later, a second postback arrives with the same transaction ID. A result that raises questions follows the same path as any other. It simply has more chances to be held for review, to be rejected before it is credited (no postback, no payout), or to be reversed later.

A reversal can come from our staff, from an advertiser who reverses an offer step, or from an offer partner. The Terms say plainly that when a result is rejected or reversed, for example for fraud, false information or unmet requirements, the amount is deducted from your balance or offset against your next settlement, including after it was reported to you. Reversed results appear under Reports, Chargebacks with the date, user, offer and amount.

When you receive a status 2 postback, take the matching reward back from your user. The Credits and reversals docs show an example sequence, Publisher earnings, settlement, and reversals explains the effect on your balance, and What is a reversal rate shows how to track it.

The Traffic quality report

Every approved publisher has a Traffic quality tab under Reports, next to Conversions, Chargebacks and Postbacks. It shows how many of your users the offerwall blocked, and why, so you can clean up the source instead of guessing.

For security, the report shows only full days, so today’s activity appears tomorrow, and percentages and the rating appear once a period has enough users. When quality is Needs attention or Poor, a How to improve your traffic box suggests fixes for your main reasons. If an app’s quality is Poor over the last 7 days, you also get a notification in your dashboard and, unless you turn off Traffic quality emails in your account settings, an email at most once a week per app.

When the problem is bigger than one result

Where a check indicates a material risk of fraud or a breach of the Terms, the Terms allow us to act at a wider level. Depending on what we find, we may:

• reject or reverse completions, or hold rewards for review;
• block a device or an end user from offers;
• hold or reverse publisher earnings;
• limit which offers your apps can show. The Terms say offer access takes into account how many of your users our fraud checks block and how often your results are reversed;
• pause an app whose traffic quality stays poor. A paused app’s offerwall link does not work, and the app page tells you our team paused it;
• request verification, or ask for your traffic records. The Terms ask you to keep records of your traffic sources, campaigns, placements and user IDs for at least 12 months and to send them within 7 days when we ask;
• suspend an integration immediately where it presents a security, legal or fraud risk, in which case we tell you why;
• close an account.

Amounts derived from fraudulent or prohibited activity are not payable. If an account is closed for a breach, its owner may not open another one.

Account review and how to challenge a decision

Not every flag means fraud, and we know that. Shared networks, family devices and honest mistakes happen, which is why the Terms build in a human step. Decisions that close a business account or withhold a publisher settlement are reviewed by a person. If you believe a decision was wrong, open Chat with us in your dashboard, or write to support@moonetix.com as the Terms say, with the app, the transaction IDs or user IDs involved, and what you know about the users behind them. Specific information helps far more than a general complaint. How to contact Moonetix support lists what to include.

Some questions are not ours to decide. The advertiser decides whether a completion met the offer’s requirements. When a user reports a missing reward, our team checks the click with the advertiser, but the advertiser’s records decide. Third-party offers are confirmed on the partner’s own schedule, and some only after a holding period.

How publishers keep quality high

The checks above catch problems after they reach the wall. The cheapest problem is the one that never reaches it, and four habits do most of the work:

1. Pass a stable user ID and keep Link security (the hash check on your app’s Integration tab) on, so repeated completions are visible and nobody can open the wall as someone else.
2. Enforce one account per person and no earning on a VPN on your own property. Stop multi-accounting and VPN abuse shows how to build those checks.
3. Act on every reversal, both by taking the reward back and by asking which users and sources it came from.
4. Check Reports, Traffic quality every week. A rising blocked share from one country or sub ID is the signal to look closer.

Google gives app developers similar advice for its own anti-abuse tool: its Play Integrity API overview says the API works best alongside other signals as part of an overall anti-abuse strategy, not as the only check. The same is true of any single layer, including ours.

Frequently asked questions