Average risk score

Average Risk Score

The Average Risk Score feature helps you evaluate whether traffic from a given publisher looks suspicious or clean. The system shows how often risky patterns were detected, how serious they are, and gives you a clear overview of each publisher's traffic quality.

Why it matters: A high average risk score on a publisher's traffic means that click and conversion data from that source contain multiple fraud indicators. Low scores indicate clean, reliable traffic.

This tool is used to:

• Decide how many risk points are enough to flag or stop conversions

• Turn on conversion hold if needed

• Block specific publishers or sub-sources if their traffic doesn't perform well on certain offers

Column Definitions

The Average Risk Score report displays the following columns:

• Publisher  - The name of the partner sending traffic

• Count - Total number of conversions

• Triggered - How often risk patterns were triggered, shown as a percentage

• Avg - Average risk score for their conversions

• Risk Signals - Each incoming click is analyzed against known fraud templates. When certain characteristics match fraud indicators, the click is assigned a risk score. The more matches a click has, the higher the risk score.

Risk Signals

Risk signals you'll see in the report:

• OS mismatch — device OS doesn't match expected (likely emulator)

• Connection type mismatch — traffic comes from unexpected network types (can be a fraud sign)

• Language mismatch — device language doesn't fit the geo (risk of fake users)

• Autonomous system mismatch — likely traffic from data centers or bots

• Same IP — too many conversions from the same IP

• Duplicate fingerprint — same device fingerprint reused

• Touch support — if there's no touch support, could mean emulator

• Motivated — traffic looks like it came from users who were incentivized

• Time zone mismatch — time zone doesn't match geo (common for spoofing)

• Windows conversions — using tech like WinSock, which can be a red flag

Every incoming click is analyzed using the regularly revised templates from the. When certain characteristics match known fraud indicators, the click is assigned a risk score. These characteristics can include things like IP address matches, device fingerprinting, and behavior that suggests fraudulent activity (e.g., VPN usage or emulation).

The system assigns risk points based on how many of these indicators match. The more matches a click has with fraud patterns, the higher the risk score assigned to it. Publishers also accumulate risk points, which help determine the overall risk level of their traffic.

Each risk signal corresponds to a specific template in the risk scoring engine:

• Same IP - Too many conversions from the same IP address, +1 per existing click over 30 days

• Duplicate fingerprint - Same device fingerprint reused, +1 per matching fingerprint over 30 days

• Autonomous system mismatch - Traffic likely from data centers or bots +2

• Connection type mismatch - Unexpected network types (possible fraud) +1

• Timezone mismatch - Timezone doesn't match geo (common for spoofing) +1

• OS mismatch - Device OS doesn't match expected (likely emulator) +2

• Touch support - No touch support could mean emulator +2

• Language mismatch - Device language doesn't fit the geo (fake users) +0.5

• Motivated - Traffic looks incentivized +0.5

• Windows conversions - Using tech like WinSock (red flag) +1

Taking Action Based on Risk Scoring Data

Once you've analyzed the publisher risk profile, you can take appropriate action based on the risk level.

Blocking Publishers

If a publisher consistently triggers fraud patterns and has a high average risk score, you may decide to block them from working with certain offers or from the platform entirely.

How to block a publisher:

1. Open the Average Risk Score report.

2. Identify publishers with high average risk scores and high triggered percentages.

3. Review the specific risk signals to confirm the nature of the fraud.

4. Block the publisher through the Publishers section of the admin panel.

Blocking Sub-Sources

For affiliate publishers, you may choose to block specific sub-sources that are generating poor-quality traffic or triggering frequent fraud patterns. This helps maintain the integrity of your campaigns without needing to block the entire publisher.

How to block a sub-source:

1. Navigate to the publisher's page.

2. Locate the under-performing sub-source in the report.

3. Block that specific sub-source to preserve the rest of the publisher's traffic.

Conversion Retention Mode

If a publisher's traffic shows signs of potential fraud, you can enable Conversion Retention Mode, which temporarily holds conversions for review before they are processed. This helps prevent fraudulent conversions from being paid out.

How to enable Conversion Retention Mode:

1. Go to Analytics > Conversions in the admin panel.

2. Filter by the publisher in question.

3. Use the retention status filter to view conversions under review.

4. Manually Confirm legitimate conversions or Cancel suspicious ones.