Case study: 98% of risky accounts on a 270-publisher network had a clean IP
Four weeks after the first case study, the same offerwall network has sent CashoutGuard 25,040 conversions from 270 publisher sites, 69,311 accounts and 96 countries. This is what 28 days of production data showed, from 28 September to 26 October 2026.
Short answer
Over 28 days on an offerwall network with 270 publisher sites, CashoutGuard scored 25,040 conversions and flagged 5,525 of them (22 percent, $4,193 in payouts) from 10,537 risky accounts. 98 percent of those accounts had a clean IP, with no VPN, proxy, datacenter or Tor signal. Their devices gave them away.
- Scale
- 25,040 conversions worth $36,249 in payouts, 109,850 offer clicks, 69,311 accounts and 60,807 devices in 96 countries.
- Flagged
- 5,525 conversions (22%) from 10,537 accounts: 3,678 at block level and 1,847 for review.
- Clean IPs
- 98% of flagged accounts had no VPN, proxy, datacenter or Tor signal on their IP.
- Device rings
- 720 devices ran three or more accounts: 3,288 accounts in all, the largest 53 on one device.
- Chargebacks
- Advertisers reversed 38 of the 5,525 flagged conversions. 97% of all reversals came from 10 publishers.
The setup
The network sends offers from many advertisers to 270 publisher sites: GPT sites, reward apps and survey sites. Each publisher has its own users, so the network sees a user ID per publisher, never the person behind it. One person can sign up on several sites, and one phone can run accounts on all of them.
CashoutGuard runs inside the network's offer wall. The device check runs when the wall opens, offer clicks are scored when they happen, and each conversion postback is scored before it is credited. Accounts are kept per publisher, so the same user ID on two sites is two accounts, while one device behind both is still one device.
The network enforced decisions on conversions for about a week at the start, as told in the first case study. Since 9 October it has run in shadow mode: every event is scored and logged, and nothing is blocked. The thresholds are the defaults and no rule was written by hand. The network is not named here.
The headline: 22% of conversions came from risky accounts
| 28 days, 28 September to 26 October 2026 | Result |
|---|---|
| Publisher sites with traffic | 270 |
| Offer clicks scored | 109,850 |
| Conversions scored | 25,040 ($36,249 in payouts) |
| Accounts and devices | 69,311 accounts on 60,807 devices |
| Countries | 96 |
| Conversions at block level | 3,678 (14.7%) |
| Conversions sent to review | 1,847 (7.4%) |
| Payouts on flagged conversions | $4,193 (11.6% of payouts) |
| Accounts flagged | 10,537 |
Flagged conversions were cheaper than average: 22% of the conversions but 11.6% of the money. Most of the risk sat on short, low-paying offers, the kind that is easy to complete again and again from new accounts.
Why an IP check would have missed 98% of them
Of the 10,537 flagged accounts, only 208 had anything wrong with their IP: a known VPN, a proxy, a datacenter or Tor. The other 10,329, 98%, came from ordinary home and mobile connections. An IP reputation lookup would have passed them.
What gave them away was the device and the browser:
| Reason on the flagged conversions | Conversions |
|---|---|
| Same device as other accounts | 4,381 |
| Browser clock from another country than the IP | 727 |
| Real IP leaked by the browser, in another country | 705 |
| Browser language from another country than the IP | 657 |
| Spoofed phone model | 564 |
| Cloud phone | 499 |
| Storage wiped, same device back as a new user | 417 |
| Same offer already completed by another account on the device | 314 |
| Private browsing window | 313 |
| Default emulator profile | 283 |
A conversion can carry several reasons, so the column adds up to more than 5,525.
720 devices behind three or more accounts
The strongest single signal was one device behind several accounts. It was on 4,381 of the 5,525 flagged conversions, 79%. CashoutGuard found 720 devices that ran three or more accounts each, 3,288 accounts in all. Most rings were small, with a median of three accounts, but 40 devices ran ten or more, and the largest ran 53.
On a network this matters twice. Inside one publisher, a ring is one person collecting the same offers several times. Across publishers, it is the same person on several sites, which no single publisher can see. The network is the only party that sees the whole ring, so it is the natural place to stop it.
Cloud phones, emulators and spoofed models
- 1,451 accounts used a cloud phone: an Android phone in a data centre, rented by the hour and run from a PC. New "devices" can be cloned from it in seconds.
- 650 accounts used an emulator: an Android phone simulated on a computer, reporting a well-known default model.
- 564 conversions came from a spoofed phone model: the browser named one phone, but its graphics chip belonged to other hardware.
None of these is a person holding a phone. They are also hard to hide: changing the IP takes one click in a proxy dashboard, while changing what the graphics chip reports takes an anti-detect tool, and those tools leave their own traces.
What chargebacks catch, and what they miss
In the same 28 days, advertisers reversed 239 conversions, 0.95% of the total. 97% of those reversals came from just 10 publishers. Advertisers reverse from their own attribution and install checks, and those point at a few bad traffic sources.
They did not catch the abuse above. Of the 5,525 flagged conversions, advertisers reversed 38, worth $49. Chargebacks are not a safety net for multi-accounts, cloud phones and emulators: most of that traffic is never reversed. The place to stop it is before the money moves, at the postback or at the cashout.
Lessons for other networks
- Do not rely on IP checks. 98% of the risky accounts had a clean IP.
- Look at devices across publishers. A network sees rings that no single publisher can.
- Score the conversion before it pays. Advertiser chargebacks missed almost all of this traffic.
- Watch reversals per publisher. Ten publishers caused 97% of advertiser reversals.
- Start in shadow mode. Four weeks of data, default thresholds and no hand-written rules.
Run the same test on your network
Every new CashoutGuard site starts in shadow mode. Networks can connect through the postback relay without code, or call /v1/evaluate from their server, and read the results in the dashboard the same day. See CashoutGuard for offerwall networks, the docs or the pricing. For what happened when this network switched on blocking, read the first case study.