Xoxo, everyone — it’s Reznik, and today I’ll tell you about AlterCPA One
AlterCPA One is a cloud-based traffic filtering service. We use smart analysis algorithms to figure out whether your site actually needs a given visit, or whether it should be sent off somewhere far away instead. We clean your traffic of junk visits, search engine bots, social media content scrapers, and other unwelcome characters.
Where to Begin?
To start working with AlterCPA One, you need to register and pay for access. Head over to https://www.altercpa.one/register and enter your name, email, and password. Right after you register, you’ll be prompted to pay for access to the service.
To purchase access, go to the “Payments” section and pick whichever plan interests you. If you’re not too lazy to fire up Google, you can easily dig up a discount promo code, enter it in the field above the plan list, and hit “Apply”.
There’s no free trial here. But nothing’s stopping you from reaching out to the developer directly and just asking, right? You might get asked for something in return — a review or a write-up — but it’s worth it: there’s a referral program too.
Domain Parking
You’ll need your own domain for pretty much any filtering task. Sure, you can use the system domain instead, but we don’t recommend it — it’s almost certainly already on various blacklists, and it’s only good for testing.
Domain parking happens in the “Script Parking” subsection of the “Domains” section. In the “Domain” field, enter your domain’s full name. No need to include www, and no need for http:// either.
Go to the DNS zone editor in your registrar’s control panel (don’t confuse it with DNS server settings — what you need here is specifically the DNS zone settings).
- Delete every existing A, AAAA, and CNAME record pointing at the domain you need. For a root domain, its name will be @ or the domain name itself; for a subdomain, it’ll be the subdomain’s name.
- Add a new A record with that same name and the value 95.216.29.72
- If you need IPv6 support, add a new AAAA record with that same name and the value 2a01:4f9:2a:1d9b:0:0:0:13
Depending on various conditions — including the phase of the moon and the intensity of torsion fields — binding the domain can take anywhere from a few minutes to three days. You can check whether the domain has bound yet with the “Check” button. Clicking that button once every 15 minutes will speed up the checking and binding process.
The domain parking process is described in more detail in the manual.
Adding a Site
Start by adding a site. “Sites” are your filtering settings for ad campaigns. You work with sites in the “My Campaigns” section.
To create a site, enter its domain in this field and click “Add”. Your filter will end up hosted on this domain going forward. Enter the domain without a leading www.
After adding a site, you need to configure the basic traffic filtering parameters:
- Domain. Your traffic filtering file will be hosted on this domain.
- Work mode. Use “Automated” for real tasks and “Pause” for testing.
- Country list. We recommend listing the countries you expect visitors from.
- Target site and decoy site. Specify the files or URLs for the respective sites and their mode of operation. Read more about them here.
Click “Save and download file”, then put the downloaded file on your hosting for the selected domain.
Site Settings
You can specify additional site settings, in case they don’t match our vision of perfectly simple filtering.
Main Parameters
- Domain — used to install the traffic filter itself, via whichever method is convenient. Note that this isn’t your target site’s domain, because the filter will most likely be installed on a completely different domain. Fun fact: the “domain” field can actually be anything. In reality, it’s only used to check the headers (host or referrer) of incoming traffic. But you can check the “Ignore domain” box in the site settings and enter any text you like.
- Work mode determines whether filtering is turned on. Automatic mode switches the filter on. Pause always shows the decoy site. A disabled filter always shows the target site.
- Countries — you can restrict the list of countries whose visits are allowed through to the target site. If no country is selected, traffic will come through regardless of geography. We strongly recommend specifying a limited list of countries, to filter out visits from bots sitting on remote servers.
- Target site and decoy site — in these fields, specify the URL or file name (only relevant when working with a file include). Read more.
- Site working method — choose how the target site and decoy get displayed. Depending on the methods you choose, we’ll generate the finished filtering file for you. Read more.
Additional Parameters
- Trash visits — the filter will discard the number of visits specified in this field and show them the decoy site. Useful when testing the filter. The number in this field goes down with every visit.
- Traffic — you can restrict the list of devices traffic is allowed to come from. You can choose desktop traffic and mobile traffic (any, iOS, or non-iOS)
- Parked domain — if you’ve parked domains, you can pick one for the JS integration and redirects to run on.
- IP protocol version — you can restrict your site to only visitors connecting over IPv4 or IPv6. Useful for setting up an IPv6 honeypot.
- Ignore request domain — can come in handy if you’re using the same site for multiple domains, or working through the API without regard to the real domain.
- Check primary IP address only — the filter will analyze only the main IP address, so it won’t accidentally block your front-end server or CloudFlare.
- Check visitor language — the filter will check the user’s language header and cross-reference it against the languages of the allowed countries list. Lets you weed out most bad actors.
- Filters — you can restrict the list of filters used to sort traffic. If no filter is specified, filtering runs against every blacklist available to you. That’s the best option for most situations.
- Whitelist — requests from the listed addresses won’t be checked. Enter one address per line. You can specify either a single address (12.34.56.78) or a subnet with a numeric mask (12.34.56.0/24).
How the Filters Work
The simplest and most convenient way to install a filter on a site is to download the ready-made filtering file. It’ll be generated for you automatically, based on your chosen settings.
Site Working Methods
You can choose your own working method for the target site and the decoy. The service will automatically generate the optimal file for you based on the method you choose.
Redirect by Link
The visitor will be sent to the link you specified. For this method to work, you need to enter the full URL in the site field. You can change links on the fly, with no need to download a new file.
Open the File With This Name
The script will open a file located on the server using the PHP include method. In the site field, specify the file name if it’s in the same folder as the script, or the full path to the file. You can change this name on the fly, with no need to download a new file.
Don’t use standard file names like target.php, dummy.php, black.php, white.php, bl.php, wh.php, w.php, or b.php — that way an attacker can’t get at your site through simple brute-forcing. If no file name is specified, black-index.php and white-index.php are used for the target site and decoy, respectively.
Show the Link in a Frame
The visitor will see an iframe, with your target site opening inside it. For this method to work, you need to enter the full URL in the site field. You can change links on the fly, with no need to download a new file.
Make sure your site doesn’t contain elements that get blocked when running inside an iframe — for example, location requests or access to peripheral devices.
Show the Content at a Link
The script will make a CURL request to the specified link and show its content to the visitor. For this method to work, you need to enter the full URL in the site field. You can change links on the fly, with no need to download a new file.
Make sure every resource used in the server’s response (images, scripts, styles, forms) uses an absolute path with the domain and protocol included. The script won’t process requests to third-party paths — for that, you need a proxy.
The request can be sent using either GET or POST. Both displaying the content and 301/302 redirection are supported. The request goes to the URL specified in the settings, and any additional GET and POST parameters are passed along to that same address.
Embed in WordPress
You can embed your filter directly into a WordPress site. To install it, disable WordPress updates and upload the index.php file to the server in place of WordPress’s own file of the same name.
Important! You can’t run WordPress on both the target site and the decoy at the same time — only one of the two sites will actually open. Use different working methods for the target site and the decoy.
A WordPress site is the perfect way to build a honeypot for your decoy site. From an attacker’s point of view, it’s a fully legitimate site — one that’s also vulnerable to classic hacking techniques. Don’t forget to leave realistic contact info and content on the decoy site, so attackers don’t try digging deeper and just settle for landing on this one.
What Next?
Check out the service documentation, especially the “Embedding” section. It covers the filter implementation methods available to you. Better yet, just search the web for AlterCPA One use cases from trusted affiliates.
That’s it from Reznik — xoxo, everyone!