Impact — impact.com — is the network behind a large share of SaaS and VPN affiliate programs (NordVPN and ExpressVPN both run on it), which makes it one of the most important networks to understand if you protect a brand in those categories. It's also the trickiest of the big three to read, for one reason: Impact cloaks. Where Awin and CJ hand you a readable redirect URL, Impact routes through a short link that's built to resist casual inspection.
The enforcement unit is the same idea as everywhere else — one number that names the affiliate account, which Impact calls the partner ID. But Impact buries it in the path of that short link, surrounds it with a per-click token most brands grab by mistake, and — uniquely among the big networks — also gives you a built-in tool to catch brand bidding, one that's genuinely useful and has a blind spot you need to know about. Here's the whole picture.
I run AdCrime, which resolves these at scale. Reading Impact by hand is harder than Awin or CJ because of the cloak — but the number you're after is simple once you know where it lives.
The Impact tell: the short-link domains
Impact doesn't redirect through an obviously branded URL. It uses short links on a small set of dedicated domains — most commonly a branded subdomain on sjv.io or pxf.io (both Google-certified Impact tracking domains), like:
yourbrand.sjv.io/c/... expressvpn.sjv.io/c/... nordvpn.sjv.io/c/...If a hop in your chain runs through sjv.io, pxf.io, or impact.com itself, you're looking at an Impact link. The branded subdomain (expressvpn.sjv.io) is a nice confirmation you've got the right brand's program.
The one number that matters: the partner ID (irpid)
Impact calls affiliates partners, and the account identifier is the partner ID. Per Impact's own documentation, the parameter that carries it is irpid — "the partner ID, [which] should be used instead of partner names to ensure accurate data." That's the value that names the account you report, reverse, and remove.
The number that fools people is irclickid. Impact appends it to your landing-page URL on every redirect, so it's the most visible value — but it's a click/user token: per Impact, it tracks "a single person… across different pages." It identifies a click journey, not the partner account, and it's regenerated per click. (It's so clearly a tracker that browsers like Brave strip it from URLs.) File the irpid or the partner ID from the path; never the irclickid.
| Identifier | What it is | Use it to enforce? |
|---|---|---|
irpid / partner ID in the path | The partner (affiliate) account on Impact | ✅ This is the one. |
irclickid | Per-click / per-user tracking token | ❌ A click journey, not an account |
subId | A custom sub-tag that appears only in partner reporting | ❌ Sub-tag noise |
Where Impact hides the partner ID: the /c/ path
Impact's tracking links put the partner ID in the path, not a query string. The standard format looks like this:
yourbrand.sjv.io/c/111111/222222/33344
└──┬───┘
/c/{partnerID}/{campaignID}/{adID}The first number after /c/ is the partner ID. So in sjv.io/c/111111/222222/33344, the partner you're enforcing against is 111111 — the first one. (The numbers after it identify the campaign and the specific ad.) Spot the sjv.io/pxf.io domain, find the /c/ path, take the first number. That's your partner — if you can read the link, which brings us to the catch.
The catch: Impact links are cloaked
Here's why Impact is harder than Awin or CJ. Those sjv.io short links are cloaked — built to serve a real shopper one thing and to give anything that looks like an automated check something else, or nothing at all. Point a casual script or a one-off SERP tool at the link and it can dead-end before it resolves the path; the partner stays hidden. (This is the same cloaking that makes single-region, business-hours brand-bidding checks structurally blind — see the VPN playbook and how to read a redirect chain.)
When that happens, you are not out of evidence. The short link itself — yourbrand.sjv.io/c/111111/... — is a filable handle: hand it to Impact's compliance team and they can map the link to the partner account on their side. A cloaked link that dead-ends is a different kind of evidence, not a missing one. And if you can read the path, the partner ID (111111) is right there as the first segment.
Impact's secret weapon (and its blind spot)
Here's the thing Awin and CJ don't give you: Impact has a native Paid Search Monitoring tool. You specify the trademarks, search engines, locations, and languages you care about, and Impact crawls for partners bidding on those terms and aggregates the violations in your dashboard for you to review. For partners inside your Impact program, it's a real head start — use it, and set a Paid Search Monitoring policy.
But know its limit, because it's a big one. Impact's monitoring only covers partners contracted to your program — by Impact's own design, it "will not generate violations for non-contracted partners." So it's blind to:
- External fraudsters who aren't in your Impact program at all (and bid clean),
- **Affiliates running the same brand bid through a different network** (Awin, CJ),
- anything outside the trademarks/regions you remembered to configure.
In other words, Impact's tool tells you when one of your own contracted partners misbehaves on the queries you specified. It's necessary, not sufficient — the SERP has bidders Impact's program-bound monitoring can't see. (Catching those is the cross-network, every-region problem AdCrime exists for.)
Step 0, then the clock
As with every network: your Impact program terms and Paid Search Monitoring policy have to prohibit the bid before a violation is actionable. Configure the trademarks and the policy first.
Then act fast, because Impact's commissions lock. Per Impact's docs, every action has an action-locking period — the window between when it's tracked and when it locks. During that window you can modify or reverse the action; once it locks, "no modification can be made to it anymore." So when you confirm a partner was brand bidding, you review the violation's severity and, if it's bad enough, reverse the payout and remove the partner (repeat offenders especially) — but you have to do it inside the locking window. (The full per-network clock is in why your network won't claw back the money.)
The Impact loop, end to end: set the trademarks + policy → catch it (Impact's monitoring for your partners, a SERP scan for everyone else) → read the partner ID from the /c/ path or hand over the cloaked short link → reverse inside the action-locking window → remove the partner.
Mario Vaher is the founder of AdCrime, which scans Google Ads across multiple regions for affiliates bidding on brands they aren't authorized to touch, resolves the redirect chain and publisher ID behind each one, and packages it as the evidence you'd file with the network — across every network and region, not just the partners already in one program. If you want to see what's bidding on your brand right now, the first scan is free — or read the full, ungated Affiliate Brand-Bidding Fraud Playbook.