Bot Traffic on Your Offerwall: Signs of Click Spam

How do you spot bot traffic and click spam on your offerwall?

Bot traffic and click spam on an earn page show up as patterns real users do not make: many offer clicks with almost no conversions, one country or traffic source that suddenly takes over, activity at hours when your audience is asleep, and a rise in reversals once advertisers check the results. In Sharklio you find them in Reports, Performance grouped by Sub IDs, Countries, Offers or Devices, and in the Conversions and Chargebacks lists. Then you close the source on your own property: sign-in before the wall, rate limits, removing the source, and checking where visitors came from.

This guide starts after sign-up. Fake accounts at the sign-up form are covered in How to stop fake signups on a rewards site, and the advertiser view is in Ad fraud and bot traffic.

What counts as invalid traffic

The ad industry calls this invalid traffic. Google’s AdSense help page on invalid traffic defines it as clicks or impressions that may artificially inflate an advertiser’s costs or a publisher’s earnings, intentional or accidental. Its examples include repeated clicks by one or more users, publishers encouraging clicks, and automated clicking tools, robots or other deceptive software.

The Media Rating Council’s Invalid Traffic Detection and Filtration Standards Addendum (June 2020) splits it into two groups:

• General invalid traffic (GIVT), found with lists and routine checks: known invalid data center traffic, bots and crawlers on known lists, and non-browser user agents.
• Sophisticated invalid traffic (SIVT), which needs deeper analysis or human review: emulators, custom automation tools, hijacked devices, click farms, falsified clicks and referrers, and invalid proxy traffic.

Google’s Campaign Manager 360 page on filtering invalid traffic uses the same split, with incentivized behavior and manipulated behavior among the sophisticated kinds (checked on October 29, 2026).

One line in the MRC addendum matters to every rewards site: its footnote on click farms excludes disclosed reward programs that do not aim to manipulate measurement. A user who opens your wall and installs a game for coins is not invalid traffic. A script that clicks offers, or people paid elsewhere to click your links, is. Incentivized traffic explained covers the difference.

The warning signs, and where they show in Sharklio

A click in Sharklio means a user started an offer. Visits to your earn page that never start an offer are not clicks, so the earliest signs often sit in your own server logs. Users on VPNs, proxies, Tor and data center networks are blocked from the wall, so much simple bot traffic never becomes a click. What gets through looks like this:

Reports use the time zone set under Time zone on your Account page. Set it to where most of your users live, or “3 a.m.” means nothing. How to read your dashboard and reports explains each screen.

Clicks with no conversions

Conv. rate is the share of clicks that led to at least one credited conversion, and EPC is earnings per click. Real users drop some offers, so a low rate alone is normal. The sign is a change: one source whose clicks climb while its conversion rate falls far below your others, or clicks that double with no promotion to explain it. Some offers take days to confirm, so compare periods long enough to settle.

One country or one sub ID spiking

Group Performance by Countries, then by Sub IDs, and sort by Clicks. A country that is normally small and is now your largest, or a sub ID value you do not recognize, deserves a look. Click a row with results to open its conversions. If Performance says none of your clicks had a sub ID, add sub1 to sub5 to your wall link first; Click IDs and sub IDs explains how.

Odd hours

Reports group by day, not by hour. Use the time on each conversion, or click Export CSV: the file has the date and time, status, user ID, country, IP address and all five sub IDs. This Python counts results per hour, per IP address, and per Sub ID 1 and status:

import csv
from collections import Counter

hours, ips, sources = Counter(), Counter(), Counter()
with open("sharklio-conversions.csv", newline="", encoding="utf-8") as f:
    for row in csv.DictReader(f):
        hours[row["Date"][11:13]] += 1
        ips[row["IP address"]] += 1
        sources[(row["Sub ID 1"] or "(none)", row["Status"])] += 1

for hour in sorted(hours):
    print(hour + ":00", hours[hour])
print("Top IPs:", ips.most_common(5))
print("By Sub ID 1 and status:", sources.most_common(10))

Rename the file to match your download. Real audiences rise and fall with the day; a flat line through the night points to a script. For clicks per hour, use your own earn page logs.

A jump in reversals

Bad traffic often looks fine for a while, then comes back as reversals. Each one reaches your server as a status 2 postback with the same transaction ID, shows as Reversed in Conversions, and is listed in Reports, Chargebacks with when it was reversed and when it was credited. The Chargebacks totals include distinct Users, so 40 chargebacks from 3 users is a different problem from 40 from 40 users. What is a reversal rate? shows how to track the trend.

Where bot clicks and click spam come from

OWASP lists this automated threat as OAT-003 Ad Fraud: false clicks and fraudulent display of ads. On an earn page the source is usually one of these:

• Scripts and automation. Headless browsers, auto-clickers and click-simulating extensions start offers in a loop. On apps, see Click injection and SDK spoofing explained for emulators and fake clicks.
• Click farms. Groups of people or racks of devices complete offers by hand on many accounts, often from one country and on the same offers.
• Incentivized traffic exchanges. Paid-to-click, autosurf and task sites pay people a few cents to visit a link. Visitors from there came for the other site’s payment, not for your property.
• Referral abuse. One person runs many accounts under their own referral link to collect commission. See How to prevent referral fraud.
• A partner you trusted. A traffic partner, ad buyer or contractor who fills a quota with cheap traffic. Unknown sub IDs usually come from here.

How to investigate a suspicious source

1. Confirm the change on the Dashboard against the period before, and note when it started.
2. Find the source in Performance: group by Sub IDs, then Countries, Offers and Devices.
3. Read the raw rows. Open the conversions for that row, or search Conversions for the user or sub ID, and look at times, IP addresses and countries.
4. Export and count with the script above.
5. Match it to your own data: sign-up date, referrer and devices of each user ID, and whether they use anything on your site besides the wall.
6. Write it down: source, dates, user IDs and what you changed.

The Reporting API quick start shows how to pull the same data by sub ID or country, plus the conversion list with timestamps.

How to stop bots and click spam on your earn page

Require sign-in before the wall

The wall link needs a user_id and, with link security on (the default), a hash your server builds with your link hash salt. Build it only for a signed-in user with a verified email, when they open your earn page. Never publish a ready-made wall link, and never put the salt in browser or app code (How to keep your app secrets safe). Sub IDs are not part of the hash, so users can change them: use them to track sources, never to credit anyone.

Rate-limit what an account can do

Count earn page opens and wall link requests per account and per IP address, and slow down or challenge anything far above your normal range. Cap how many new accounts can earn per day from one network. Sharklio has its own rate limits, but yours stop the traffic before it becomes a reversal. Duplicate accounts are covered in Stop multi-accounting and VPN abuse.

Remove bad sources

• Stop buying from any source whose sub ID shows clicks without conversions or rising reversals.
• Take your links off paid-to-click and traffic exchange sites.
• Freeze earning on the accounts involved until reviewed, and take back rewards on every status 2 postback.
• Hold new earnings before cashout so reversals land first; Reward hold periods shows how long.

Check referrers

Log the Referer header on your sign-up and earn pages, store the first one with each account, and group sign-ups by referring domain. A burst from a paid-to-click site explains many spikes. Treat it as a clue, not proof: MDN’s Referrer-Policy reference says browsers default to strict-origin-when-cross-origin, which sends only the origin to other HTTPS sites, so you see the domain, not the page. Apps often send none, and a script can send any value.

Per the Sharklio docs, the wall loads in frames and pop-ups only on the website registered for the app and its subdomains, on https pages, so another site cannot frame your wall. A direct link opens anywhere, which is why you build it only for signed-in users.

What bot traffic means for your Sharklio account

A summary of the Sharklio Terms of Service as they read on October 29, 2026. The Terms themselves are what apply.

• The rule. Section 7 requires genuine, human traffic and prohibits proxy traffic, bot traffic, incentivised clicking outside the offerwall, purchased installs and misleading promotion. Section 9 bans bots, scripts, auto-clickers, click-simulating extensions and emulators, and artificially generated installs, sign-ups, clicks or leads.
• You answer for your sources. Sub-publishers, partners, contractors and staff who send traffic through your account count as you.
• Reversals are deducted from your balance or next settlement, even after they were reported. If they exceed your earnings, the balance can go negative and is offset against future earnings.
• Wider action. Where checks indicate a material risk of fraud, Sharklio may reject or reverse completions, block devices or end users, hold or reverse publisher earnings, pause offers, request verification, restrict the service or close the account (section 10). Amounts from fraudulent or prohibited activity are not payable.
• Suspension. An integration presenting a fraud risk may be suspended immediately, with the reason given. An account closed for a breach may not be replaced (section 15).
• Records. Keep records of your traffic sources, campaigns, placements and user IDs for at least 12 months, and send them within 7 days when asked. Earnings under review may be held; no reply within 14 days can suspend your integrations, and after 30 days the earnings under review are forfeited.
• Review by a person. Write to support@sharklio.com if a decision looks wrong. Closing a business account or withholding a settlement is reviewed by a person.

See How Sharklio checks traffic quality, the full traffic quality rules, and Promoting your offerwall. If you find a bad source yourself, cut it and tell support with the dates and sub IDs.

Frequently asked questions