Ecosystem and money flow
Who is who in pay-per-lead marketing, using Mark's example of an auto insurance offer at $10 per lead.
sub1–sub10 for their own tracking.A click today, with no pre-click protection
Fraud is found only after the traffic has reached the advertiser, when the money has already moved.
A click with Sift Shield
Sift Shield sits between the publisher's click and the Everflow tracking link, and decides in real time.
How a network uses it today
The Base44 prototype. It works for a demo, but setup is per offer, so it doesn't scale.
How a network will use it as a SaaS
Sign up, connect once, and every offer is protected. Value is visible and billing runs on usage.
Market notes
Context for product and architecture decisions. Vendor prices come from third-party listings and should be confirmed with each vendor.
Payment models
| Model | Meaning | Why it matters |
|---|---|---|
| CPL | Paid per valid lead (form fill) | Cannaball's core model; lead stuffing is the main risk |
| CPA | Paid per action: sale, install, signup | Same structure, different event |
| CPC | Paid per click | Most exposed to click bots |
| Pay per call | Paid per qualified inbound call | Mark's other business (Ringba, CallGrid); possible next vertical |
| Rev share | Publisher earns a % of revenue | Less common in lead gen |
Competitors and data providers
| Vendor | Focus | Price signal |
|---|---|---|
| Anura | Fraud detection for affiliate and lead gen | Usage-based, by quote |
| TrafficGuard | Click fraud, affiliate payout protection | From ~$49/mo; affiliate by quote |
| Fraudlogix | IP and traffic quality data | From ~$2,500/mo |
| 24metrics | Real-time affiliate fraud blocking | By quote |
| CHEQ, ClickCease | Paid search and social click fraud | SMB monthly plans |
| IPQS | IP reputation and risk scores | About 2× IPinfo, per Mark |
| IPinfo | Privacy detection, ASN, residential proxy | ~$655 per 1M lookups (quoted to Mark) |
Fraud types to cover
| Type | What it is | How to spot it |
|---|---|---|
| VPN, proxy, Tor | Traffic hidden behind anonymizers | IP intelligence privacy flags |
| Datacenter IPs | Bots running on cloud servers | ASN and ISP type, like the "Amazon" ISPs Mark showed |
| Residential proxies | Bots routed through rented home connections | Same fingerprint on rotating IPs, click velocity, honeypots |
| Lead stuffing | Automated fake or stolen-data form fills | Fill speed, duplicates, disposable emails |
| Blending | Real traffic mixed with junk to hide it | Publisher-level patterns over time (Scorecard) |
| In-app, incentivized | Clicks from app webviews or paid-to-click users | User agent, referrer, conversion quality |
| Advertiser-side fraud | Advertiser claims fraud to get free traffic | Quality Proof is the network's evidence |
Glossary
Terms as they're used in the call and in Everflow.
| Term | Meaning |
|---|---|
| Advertiser | Owns the offer and pays for leads or conversions |
| Network | Broker between advertisers and publishers that keeps the margin, like Cannaball Ads |
| Publisher, partner, affiliate | Sends the traffic: media buyers, email, SMS, social |
| Offer | An advertiser's campaign, with payout, landing page and rules |
| Payout | What the network pays the publisher per conversion |
| Revenue | What the advertiser pays the network per conversion |
| Tracking link | Unique link per partner per offer, generated by Everflow |
| Tracking domain | The network's domain in tracking links; it can get flagged |
| transaction_id | Everflow's click ID, passed to the landing page and returned on conversion |
| sub1–sub10 | Free parameters publishers use for their own tracking |
| Postback | Server-to-server call that reports a conversion |
| Pre-domain | Sift Shield's domain placed in front of the tracking link |
| Clawback | Taking back payouts for leads later found invalid |
| Scrub | Leads the advertiser or buyer rejects as invalid |
| IVT | Invalid traffic. General IVT is easy to catch (known bots, datacenters); sophisticated IVT is not (residential proxies, hijacked devices) |
| ASN | Number that identifies the network or ISP that owns an IP |
| Fingerprint | Device or browser signature (canvas, WebGL, fonts) used to link sessions |
| Protection Value | Blocked conversions × payout: the money Sift Shield saved |
| Quality Proof | Report showing why traffic was real, for sharing with advertisers |
Open questions for the assessment
To be settled in weeks 1–2 and presented in the readout.