How ranking works

Every claim on this page is testable. If you find a way to move a rank that is not listed here, tell us and we will publish the fix and reset the affected scores.

The formula

score = Σ (d = 0..6) verified_uniques[today − d] × 0.85^d

Ties break on all-time verified uniques, then on listing age (older wins). A visit six days old is worth 38% of a visit today, so a quiet week drops you. Incumbency does not compound.

What counts as a verified unique

JS beacon with a signed nonce. The listing page renders an HMAC nonce valid for 60 seconds and usable exactly once. A curl or a no-JS fetch gets the page fine but can never count.
External only. The hit counts only when the referrer is off-site or the share parameter is present. Browsing this board never adds to anyone's score, including ours.
Daily-salted dedupe. One count per visitor per listing per day, keyed on SHA-256(daily_salt + IP + user-agent + listing_id). The salt rotates every UTC day and is never stored, so yesterday's hashes cannot be recomputed. We do not keep IP addresses.
Datacenter ASNs dropped. Traffic from known cloud and hosting networks never becomes rank fuel. Consumer VPN networks are deliberately not on that list.
Burst defense. Per-listing ten-minute buckets with z-score anomaly detection. A statistically impossible spike puts the listing in shadow-hold: visits keep being recorded, rank stops moving, and an invisible captcha is injected into that listing's beacon until the pattern is clean again.

Country boards

A country board ranks by verified visitors originating in that country, using Cloudflare's edge geolocation of the visitor. Winning Germany means bringing German traffic. Your declared target country changes nothing about your score.

What we store

Your listing: URL, domain, name, tagline, category, target country, and the email you submitted.
Daily aggregate counters per listing, day and country. No per-visit rows, ever.
A SHA-256 of your claim token. We cannot recover the token itself.
No cookies for visitors, no third-party analytics, no ad tech, no fingerprinting scripts.

What we cannot promise

A determined attacker with a residential proxy pool and a real browser farm can eventually manufacture visits. Nobody at any price solves that completely. What we commit to instead: publish the method, watch the anomaly signal, hold suspicious listings, and reset scores publicly when we get it wrong. Manual resets are announced, not silent.

Report a listing

Every listing page has a report button. Reports land in a moderation queue. Banned domains stop resolving through our redirect even for people holding an old link.

Season 0

Listing is free during Season 0. Rank is earned by visitors and cannot be bought — if a paid layer ever appears it buys visibility and status, never position on the organic board.