Screen every click before anyone pays for it

Sift Shield sits between a publisher's click and the advertiser's offer and blocks junk traffic in real time. This board maps who does what in the market, how a click moves today and with Sift Shield, and how a network uses the product now and once it's a SaaS. Built from the Cannaball Ads kickoff on Nov 10, 2026.

Publisher sends
Offer receives
Blended traffic: about 30% real, the rest bots, proxies and VPNs (Mark's estimate). Sift Shield lets only the real part through.

Ecosystem and money flow

Who is who in pay-per-lead marketing, using Mark's example of an auto insurance offer at $10 per lead.

Market player Where money changes hands
flowchart LR
  ADV["Advertiser
owns the offer
e.g. insurance carrier"] NET["Network
Cannaball Ads
runs Everflow"] PUB["Publisher
a.k.a. partner, affiliate
buys media"] USR(["User sees ad
Facebook, Google, SMS, email"]) LP["Offer landing page
quote form"] LEAD["Lead"] BUY["Backend lead buyer
agency, call center"] M["Network margin
$2 per lead"] ADV -- "offer + terms
pays $10 per lead" --> NET NET -- "tracking link
pays $8 per lead" --> PUB PUB -- "runs the ad" --> USR USR -- "click" --> LP LP --> LEAD --> BUY NET -.- M classDef actor fill:#14213d,stroke:#14213d,color:#ffffff; classDef cur fill:#f4f6f9,stroke:#a3adbd,color:#1e2a44; classDef money fill:#e8f7ec,stroke:#16a34a,color:#14532d; class ADV,NET,PUB actor; class USR,LP,LEAD,BUY cur; class M money; linkStyle 0,1,6 stroke:#16a34a,stroke-width:2px;
Drawing diagram…
Who buys Sift ShieldNetworks like Cannaball (brokers) and advertisers (offer owners). Publishers are screened by it but never log in.
Everflow vocabularyEverflow calls publishers partners. Each partner gets a Partner Tracking Link per offer, with sub1–sub10 for their own tracking.
Where fraud gets inBetween the publisher and the click. The network is paid per lead, but takes the hit when the advertiser rejects leads later.

A click today, with no pre-click protection

Fraud is found only after the traffic has reached the advertiser, when the money has already moved.

Normal step Risk
flowchart TB
  subgraph R1["The click turns into a lead"]
    direction LR
    A(["User or bot
clicks publisher ad"]) --> B["Everflow tracking link
network tracking domain"] B --> C["Click recorded
transaction_id created"] C --> D["302 redirect
to offer landing page"] D --> E["Form fill
= lead"] end subgraph R2["Fraud is found after payment"] direction LR F["Advertiser postback
to Everflow"] --> G["Conversion credited
publisher paid"] G --> H["Advertiser reviews
click and lead report"] H --> I{"Dirty
traffic?"} I -- "no" --> J["Network keeps
its margin"] I -- "yes" --> K["Refunds, clawback
scrubbed leads"] K --> L(["Trust lost
advertiser may leave"]) end R1 --> R2 classDef cur fill:#f4f6f9,stroke:#a3adbd,color:#1e2a44; classDef risk fill:#fde8ea,stroke:#d7263d,color:#6b0f1c; class A,B,C,D,E,F,G,H,J cur; class I,K,L risk;
Drawing diagram…
BlendingBad publishers mix about 30% real traffic from Google or Facebook with bots, lead stuffing and VPN or proxy traffic, so the totals look healthy.
Post-click tools are too lateMost fraud tools report after the fact. By then the advertiser has already seen the dirty click report.
ClawbackWhen an advertiser rejects leads after payment, the network has to recover payouts from the publisher. That's hard to collect and strains the relationship.

A click with Sift Shield

Sift Shield sits between the publisher's click and the Everflow tracking link, and decides in real time.

Sift Shield Existing Blocked
flowchart TB
  subgraph R1["Screening, in milliseconds"]
    direction LR
    A(["User or bot
clicks publisher ad"]) --> B["Sift Shield pre-domain
client1.siftshield.com"] B --> C["Collect signals
IP, user agent, headers,
fingerprint, in-app browser"] C --> D["IP intelligence
IPinfo: VPN, proxy, Tor,
residential, datacenter"] D --> E["Client rules
aggressive or relaxed"] E --> F["Adaptive model
learns from history"] end subgraph R2["Decision and record"] direction LR G{"Decision"} G -- "pass" --> P["Redirect to Everflow
tracking link, then offer"] G -- "flag" --> Q["Let through
mark for review"] G -- "block" --> R["Generic page
'Risk score too high'
no reason given"] P --> S["Click Audit log"] Q --> S R --> S S --> T(["Dashboard
Protection Value,
Quality Proof"]) end R1 --> R2 classDef plan fill:#e3f5f1,stroke:#0e9f8e,color:#073b35; classDef cur fill:#f4f6f9,stroke:#a3adbd,color:#1e2a44; classDef risk fill:#fde8ea,stroke:#d7263d,color:#6b0f1c; class B,C,D,E,F,G,S,T plan; class A,P,Q cur; class R risk;
Drawing diagram…
Don't teach the fraudsterBlocked clicks get a generic message. Naming the reason (VPN, proxy…) would show bad publishers what to fix.
LatencyThe prototype holds a 1–3 second redirect while it checks. The goal is to cut that sharply, for example by running at the edge on Cloudflare Workers, because real users drop off with every second.
Residential proxiesDatacenter IPs are easy to block, so fraudsters rent home connections. Catching them takes IP intelligence plus behavior and fingerprint checks, such as one fingerprint showing up across rotating IPs.
Don't over-blockSome real users are on VPNs or work proxies. Flag thresholds and per-client settings keep false positives down.

How a network uses it today

The Base44 prototype. It works for a demo, but setup is per offer, so it doesn't scale.

Existing Pain point
flowchart TB
  subgraph SETUP["Setup, repeated for every offer"]
    direction LR
    A(["Log in
Google sign-in"]) --> B["Add publishers
by hand"] B --> C["Create campaign
for one offer"] C --> D["Paste Everflow
tracking link"] D --> E["Pick publisher
real mode, block rules"] E --> F["Copy
Sift Shield link"] F --> G["Paste it back
into the Everflow offer"] end subgraph MON["Traffic flows, then monitor on the dashboard"] direction LR I1["Click Audit
per-IP detail, export"] I2["IP Lookup"] I3["Traffic Insights
ISP, browser, in-app"] I4["Scorecard
Protection Value"] I5["Quality Proof
copy and paste"] I6["Cleaning and Enrichment
AI, optional"] I1 ~~~ I2 ~~~ I3 ~~~ I4 ~~~ I5 ~~~ I6 end subgraph PAIN["What breaks at scale"] direction LR P1["1,000 live offers
= a full day of setup"] P2["API integration
didn't work as intended"] P3["Shared domain
can get flagged at volume"] P1 ~~~ P2 ~~~ P3 end SETUP --> MON MON -.- PAIN classDef cur fill:#f4f6f9,stroke:#a3adbd,color:#1e2a44; classDef risk fill:#fde8ea,stroke:#d7263d,color:#6b0f1c; class A,B,C,D,E,F,G,I1,I2,I3,I4,I5,I6 cur; class P1,P2,P3 risk;
Drawing diagram…

How a network will use it as a SaaS

Sign up, connect once, and every offer is protected. Value is visible and billing runs on usage.

Planned
flowchart LR
  subgraph ON["Onboard"]
    A(["Sign up
Google login"]) --> B["Choose plan
monthly + per click"] B --> C["Guided setup
Instructions tab"] end subgraph CONNECT["Connect once"] D["Connect Everflow API
import partners and offers"] --> E["Own pre-domain
+ backup pool,
auto-rotation"] E --> F["Global rules
with per-campaign
overrides"] end G(["Every click screened
at the edge"]) subgraph VALUE["Show value"] H1["Protection Value banner
'You saved $X this month'"] H2["Quality Proof PDF
branded, shareable"] H3["AI assistant
'Who sent the most fraud
in 60 days?'"] H4["Click Audit, IP Lookup
Insights, Scorecard"] end subgraph BILL["Bill"] J["AI usage metered
free allowance + add-on"] I["Clicks metered"] K(["Monthly invoice
Stripe, card or ACH"]) I --> K J --> K end C --> D F --> G G --> H1 & H2 & H3 & H4 G --> I H3 --> J classDef plan fill:#e3f5f1,stroke:#0e9f8e,color:#073b35; classDef hero fill:#0e9f8e,stroke:#0b7f72,color:#ffffff; class A,B,C,D,E,F,H1,H2,H3,H4,I,J,K plan; class G hero;
Drawing diagram…
Scale per network, not per offerThis is the main technical problem Mark named. One setup has to cover thousands of offers, through a pre-domain per client, a snippet or API automation.
Quality Proof as a growth loopA branded PDF that networks send to advertisers defends against clawbacks and puts Sift Shield in front of new buyers.
Pricing modelA monthly fee plus a per-click charge, like Everflow and Ringba, so there's no scary upfront cost. Figures mentioned in the call: $300–500 per month plus about $0.004 per click.

Market notes

Context for product and architecture decisions. Vendor prices come from third-party listings and should be confirmed with each vendor.

Payment models

ModelMeaningWhy it matters
CPLPaid per valid lead (form fill)Cannaball's core model; lead stuffing is the main risk
CPAPaid per action: sale, install, signupSame structure, different event
CPCPaid per clickMost exposed to click bots
Pay per callPaid per qualified inbound callMark's other business (Ringba, CallGrid); possible next vertical
Rev sharePublisher earns a % of revenueLess common in lead gen

Competitors and data providers

VendorFocusPrice signal
AnuraFraud detection for affiliate and lead genUsage-based, by quote
TrafficGuardClick fraud, affiliate payout protectionFrom ~$49/mo; affiliate by quote
FraudlogixIP and traffic quality dataFrom ~$2,500/mo
24metricsReal-time affiliate fraud blockingBy quote
CHEQ, ClickCeasePaid search and social click fraudSMB monthly plans
IPQSIP reputation and risk scoresAbout 2× IPinfo, per Mark
IPinfoPrivacy detection, ASN, residential proxy~$655 per 1M lookups (quoted to Mark)

Fraud types to cover

TypeWhat it isHow to spot it
VPN, proxy, TorTraffic hidden behind anonymizersIP intelligence privacy flags
Datacenter IPsBots running on cloud serversASN and ISP type, like the "Amazon" ISPs Mark showed
Residential proxiesBots routed through rented home connectionsSame fingerprint on rotating IPs, click velocity, honeypots
Lead stuffingAutomated fake or stolen-data form fillsFill speed, duplicates, disposable emails
BlendingReal traffic mixed with junk to hide itPublisher-level patterns over time (Scorecard)
In-app, incentivizedClicks from app webviews or paid-to-click usersUser agent, referrer, conversion quality
Advertiser-side fraudAdvertiser claims fraud to get free trafficQuality Proof is the network's evidence
Where Sift Shield fitsMost tools are built for paid search or report after the fact. Sift Shield blocks before the click reaches the tracker, is sold to networks, and gives them proof to show advertisers.
Unit economicsAt about $0.00066 per IPinfo lookup, charging $0.004 per click leaves a wide margin before the monthly fee. Caching repeat IPs lowers cost further.
Domain reputationHigh-volume redirect domains get flagged by browsers and ad platforms. Everflow networks swap domains every 6–12 months, so Sift Shield needs a domain pool with health checks.
Compliance in insurance leadsLead buyers often require proof of consent (TCPA in the US, via TrustedForm or Jornaya certificates). That's a possible future integration.

Glossary

Terms as they're used in the call and in Everflow.

TermMeaning
AdvertiserOwns the offer and pays for leads or conversions
NetworkBroker between advertisers and publishers that keeps the margin, like Cannaball Ads
Publisher, partner, affiliateSends the traffic: media buyers, email, SMS, social
OfferAn advertiser's campaign, with payout, landing page and rules
PayoutWhat the network pays the publisher per conversion
RevenueWhat the advertiser pays the network per conversion
Tracking linkUnique link per partner per offer, generated by Everflow
Tracking domainThe network's domain in tracking links; it can get flagged
transaction_idEverflow's click ID, passed to the landing page and returned on conversion
sub1–sub10Free parameters publishers use for their own tracking
PostbackServer-to-server call that reports a conversion
Pre-domainSift Shield's domain placed in front of the tracking link
ClawbackTaking back payouts for leads later found invalid
ScrubLeads the advertiser or buyer rejects as invalid
IVTInvalid traffic. General IVT is easy to catch (known bots, datacenters); sophisticated IVT is not (residential proxies, hijacked devices)
ASNNumber that identifies the network or ISP that owns an IP
FingerprintDevice or browser signature (canvas, WebGL, fonts) used to link sessions
Protection ValueBlocked conversions × payout: the money Sift Shield saved
Quality ProofReport showing why traffic was real, for sharing with advertisers

Open questions for the assessment

To be settled in weeks 1–2 and presented in the readout.

Data providerIPinfo (Mark's pick, cheaper) or IPQS (risk scores, about twice the cost)? Decide with the pass-through test.
Domain strategyA subdomain per client or a dedicated domain per client? How do rotation and health checks work?
HostingCloudflare (preferred, edge latency) or AWS?
IntegrationHow much of the Everflow API: import partners and offers, update offer URLs automatically? Hitpath after that?
Definition of doneTargets for accuracy, false-positive rate and redirect latency.
AI assistantOpen-source model or Claude/OpenAI? Cost comparison pending.

Milestones

Weeks 1–2Assessment and readout
Early DecemberGo or no-go on the trade show booth
January 26–28Trade show with a presentable version