Every view goes through a multi-step validation chain. Zero bots, zero fraud, 100% verified human traffic.
(31 visible controls + 5 invisible server-side protections: bcrypt, HaveIBeenPwned, HSTS, CSP, Permissions-Policy)
4 steps to block fake accounts
Block temporary emails
We maintain a list of over 25 known temporary email domains (tempmail.com, guerrillamail.com, 10minutemail.com, etc.). If anyone attempts to register with these email addresses, their registration is automatically rejected.
Why it is needed: A scammer could create endless emails for multiple accounts. This would block them.
Max 3 registrations per IP
For each registration, we save the IP address. If more than three accounts are created from the same IP address, the fourth is automatically blocked.
Why it is needed: Prevents someone from creating 100 accounts from the same WiFi connection.
Unique device identification
When you register, we create a unique fingerprint of your browser/device. This is a combination of your browser, operating system, screen resolution, installed plugins, and other parameters. If the same device attempts to register a new account, it will be blocked.
Why it is needed: Even if you change your email address, the same computer cannot create multiple accounts.
Invisible anti-bot captcha
We use Cloudflare Turnstile, a next-generation captcha that analyzes mouse and keyboard behavior invisibly. It doesn't require clicking on images. If it detects a bot, registration is blocked.
Why it is needed: Block automated programs that create accounts en masse.
4 controls to protect your login
6-digit code from your phone
During registration, you set up an app like Google Authenticator or Authy. Each time you log in, you'll need to enter your email address, password, and a 6-digit code that changes every 30 seconds.
Why it is needed: Even if someone steals your password, they can't get in without your phone.
Account locked for 15 minutes
Each incorrect password increments a counter. After 5 consecutive errors, the account is temporarily locked for 15 minutes. After this time, it is automatically unlocked.
Why it is needed: It prevents password guessing by trying millions of combinations (brute-force).
Token not accessible to scripts
The authentication token is stored in a cookie with the "httpOnly" flag, meaning it cannot be read by JavaScript. This protects your token even if a malicious site tries to steal it.
Why it is needed: Prevents malicious scripts from stealing your session.
Secure temporary session
For each login, we generate a signed JWT token containing your user ID, user type, and expiration date. After 7 days, the token expires and you must log in again.
Why it is needed: Limit the damage if a token is stolen: it will still expire after 7 days.
14 controls to ensure real views
Block VPN connections
Before each video, we check the IP address using vpnapi.io. If a VPN is detected, a message appears, "Disable VPN to watch videos." The results are cached for 24 hours for efficiency.
Why it is needed: Scammers use VPNs to mask their identities and create multiple accounts.
Datacenter IP Block
If the IP address is from a data center rather than a residential connection, "Use a residential connection" appears. We also block Tor connections.
Why it is needed: Bots run on servers in data centers. Real people use home internet connections.
Human verification before every video
Before starting each video, you must complete an invisible Cloudflare Turnstile captcha that analyzes your behavior in real time. If you fail, you can't watch the video.
Why it is needed: Block bots that automatically watch videos.
Unique ID for each view
For each video, we create a unique session with ID, start time, IP address, device, and requested video duration. This allows us to verify that the video has actually been watched.
Why it is needed: It allows you to reconstruct exactly what happened during viewing.
Continuous ping while watching
During the video, your browser sends a signal to the server every 10 seconds. If the signals stop, the video is considered abandoned. If they arrive too quickly, it's suspicious and the video is invalidated.
Why it is needed: It prevents you from playing the video and leaving. You have to stay in front of the screen.
Unable to speed up videos
We compare the actual time elapsed with the video duration. If 60 seconds of video are "watched" in 10 real seconds, it's fraud. We tolerate a maximum 30% discrepancy.
Why it is needed: Block those who use tools to speed up videos or manipulate time.
Questions about the content viewed
At the end of the video, you must answer 1 to 4 questions (Base on length: SHORT, MEDIUM, LONG, EXTENDED). You have 3 attempts for each question. If you get the same question wrong 3 times, the video will not be paid.
Why it is needed: It's not enough to just play the video, you have to actually watch it and pay attention.
Wrong Quiz = Campaign blocked forever
If you fail a Quiz, the "failed" status is saved in the database. Any future attempts for that campaign are automatically rejected. You can never earn money from that campaign again.
Why it is needed: Discourage people from trying randomly. You only have one chance, so look carefully.
Hourly rate limiting
We count the videos completed in the last hour. If you reach 10, it says "You've reached the hourly limit. Try again in X minutes."
Why it is needed: It prevents automated abuse and distributes earnings among multiple users.
Daily rate limiting
We count videos from midnight. If you reach 50, it says "You've reached your daily limit. Come back tomorrow."
Why it is needed: Prevents aggressive farming and distributes opportunities to everyone.
One video at a time
When you start a video, we check if you already have active sessions. If you already have a video in progress, "Complete current video first" appears.
Why it is needed: You can't have 10 tabs open watching videos at the same time.
Never the same video twice
When you complete a video, we save the user + campaign pair. If you try to rewatch it, that campaign will no longer appear in your list.
Why it is needed: You can't watch the same video over and over again to earn more.
One WiFi account per campaign
If someone on your WiFi has already viewed that campaign, it won't appear for you. We check the IP associated with each completed view.
Why it is needed: Prevents a family from creating 5 accounts and all watching the same campaign.
Same PC = same account
The device fingerprint is saved with each view. If the same device tries to view a previously viewed campaign with a different account, it will be blocked.
Why it is needed: Even if you change your account, the same computer cannot be used for the campaign.
3 checks to protect your funds
No microtransactions
You cannot withdraw less than $10. This limit is necessary to cover blockchain fees and make the system sustainable.
Why it is needed: It reduces costly microtransactions and discourages disposable accounts.
Code required every time
Even if you're already logged in, you must enter the 2FA code from your phone to confirm each withdrawal. Without the correct code, the withdrawal will be rejected.
Why it is needed: Even if someone gains access to your account, they can't steal your funds without your phone.
Maximum 1 withdrawal per day
After a withdrawal, we save the timestamp. If you try to withdraw again within 24 hours, "Wait X hours" appears.
Why it is needed: Limit the damage if your account is compromised. A hacker can steal your data once per day.
3 Checks for Verified Advertiser
Guaranteed budget in stablecoins
Campaigns are paid in stablecoins (USDC / USDT) via crypto Wallet on the Base network. Payment is confirmed On-Chain before the campaign is activated, ensuring that the budget is real and immediately available for payments to Viewer.
Why it is needed: Eliminate the risk of insolvency and phantom campaigns. No chargebacks possible - budgets are verifiable On-Chain.
Users report abuse
Each campaign has a "Report" button. Users can indicate the reason for reporting. All reports are collected and analyzed.
Why it is needed: Inappropriate content is identified by the community itself.
Automatic preventive suspension
The system constantly monitors campaign quality. If an ad receives at least five reports and exceeds a 15% negativity rate in terms of views, it is immediately frozen (status: under_review) and notified to administrators for a thorough review.
Why it is needed: It allows you to promptly block inappropriate content based on collective user feedback, without waiting for human intervention.
3 infrastructure checks
Limit requests per IP
We limit requests to prevent abuse: Registration 3/day per IP, Login 5 every 15 minutes per IP, Videos 10/hour and 50/day per user, Email verification 3/hour.
Why it is needed: Block brute-force attacks and automated abuse.
Every page is protected
Every request to protected pages is verified. We check that the JWT token is valid and that the user has permissions for that page. If not authorized, a redirect to the login is issued.
Why it is needed: No one can access data that is not theirs or protected pages.
Encrypted communications
All communications are encrypted with SSL/TLS. Redirection from HTTP to HTTPS is automatic. Data in transit is unreadable by third parties.
Why it is needed: No one can intercept passwords or sensitive data.