The Average risk score feature helps you understand if the traffic coming from a publisher looks suspicious or not. The system shows how often risky patterns were detected, how serious they are, and gives you a clear overview of each publisher’s traffic quality.
This tool is used to:
-
Decide how many risk points are enough to flag or stop conversions
-
Turn on conversion hold if needed
-
Block specific publishers or subsources if their traffic doesn’t perform well on certain offers
Here’s what each column means:
-
Publisher – the name of the partner sending traffic
-
Count – number of conversions
-
Triggered – how often risk patterns were triggered, shown in %
-
Avg – average risk score for their conversions
Risk signals you’ll see in the report:
-
OS mismatch – device OS doesn’t match expected (likely emulator)
-
Connection type mismatch – traffic comes from unexpected network types (can be a fraud sign)
-
Language mismatch – device language doesn’t fit the geo (risk of fake users)
-
Autonomous system mismatch – likely traffic from data centers or bots
-
Same IP – too many conversions from the same IP
-
Duplicate fingerprint – same device fingerprint reused
-
Touch support – if there’s no touch support, could mean emulator
-
Motivated – traffic looks like it came from users who were incentivized
-
Timezone mismatch – time zone doesn’t match geo (common for spoofing)
-
Windows conversions – using tech like WinSock, which can be a red flagEvery incoming click is analyzed using the fraud detection system’s templates. When certain characteristics match known fraud indicators, the click is assigned a risk score. These characteristics can include things like IP address matches, device fingerprinting, and behavior that suggests fraudulent activity (e.g., VPN usage or emulation).
The system assigns risk points based on how many of these indicators match. The more matches a click has with fraud patterns, the higher the risk score assigned to it. Publishers also accumulate risk points, which help determine the overall risk level of their traffic.
Taking Action Based on Risk Scoring Data
Once you've analyzed the publisher risk profile, you can take appropriate action based on the risk level:
Blocking Publishers
If a publisher consistently triggers fraud patterns and has a high average risk score, you may decide to block them from working with certain offers or from the platform entirely. This is done by reviewing their risk score and identifying any recurring fraud indicators.
Blocking Sub-Sources
For affiliate publishers, you may choose to block specific sub-sources that are generating poor-quality traffic or triggering frequent fraud patterns. This helps maintain the integrity of your campaigns without needing to block the entire publisher.
Conversion Retention Mode
If a publisher's traffic shows signs of potential fraud, you can enable Conversion Retention Mode, which temporarily holds conversions for review before they are processed. This helps prevent fraudulent conversions from being paid out.