Seatext library / BotRefund evidence
How to Test If Your Corporate Network Is Triggering Bot Detection
Test your corporate network by comparing site access from the corporate egress IP against a residential connection, checking for challenge frequency, response headers, and JavaScript challenge outcomes. Use a controlled browser session on each...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Quick test: corporate vs. residential
Open the same target site from a machine on your corporate network and from a home or mobile connection. Use the browser's developer tools to capture the network tab, console, and response headers for each visit. Look for differences in HTTP status codes (403, 429, 503), challenge cookies, CAPTCHA injections, or JavaScript errors that only appear on the corporate IP. A single side-by-side session is often enough to confirm whether the corporate egress is being treated differently.
Why corporate networks trip bot detectors
Corporate egress IPs are shared by dozens or hundreds of employees. Security appliances (proxies, firewalls, SSL inspection) often strip or rewrite browser headers, reorder TLS fingerprints, and block or modify JavaScript APIs that detection scripts rely on. BotRefund notes that "privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people" and treats each anomaly as evidence rather than a verdict [S1]. The same shared IP may also carry a reputation score from previous abusive traffic, causing downstream WAFs and CDN rules to challenge or block requests preemptively.
Step-by-step testing methodology
- Pick a stable test URL. Choose a page that loads detection scripts (e.g., a landing page with BotRefund, Cloudflare, or similar). Avoid pages that require login or have dynamic A/B tests.
- Prepare two clean browser profiles. Use incognito/private windows with no extensions. Disable VPNs, ad blockers, and privacy shields on both machines.
- Record a baseline on residential. Load the test URL from a home or mobile connection. Save the HAR file, console log, and a screenshot of the network waterfall. Note any challenge cookies (e.g.,
cf_clearance,_cf_chl) and the time to interactive. - Repeat from corporate. Use the same browser version and OS if possible. Capture the same artifacts. Pay attention to additional redirects, extra challenge scripts, or console errors like "Playwright init script mismatch" that indicate automation-framework fingerprints [S1].
- Compare the artifacts. Diff the HAR files. Count challenge responses, measure latency differences, and check for missing or altered headers (e.g.,
User-Agent,Sec-CH-UA,Accept-Language). - Run an IP reputation check. Paste the corporate egress IP into a public reputation API (IPQualityScore, AbuseIPDB, or similar) to see if it appears on blocklists or has a high fraud score.
- Document and escalate. If the corporate session shows challenges the residential session does not, share the HAR diff and reputation report with your network team or the site's support.
Tools that make the comparison easier
- Browser dev tools (HAR export) — built-in, no install.
- curl / httpie with --verbose — quick header inspection from CLI on each network.
- WebPageTest (public instances) — run a test from a residential location and from a corporate location if you have a private agent.
- BotRefund free bot audit — adds 110+ browser, network, device, and behavioral signals and returns a session-by-session explanation [S2].
Interpreting the results
| Observation | Likely cause | Next step |
|---|---|---|
| Extra 302/403/429 only on corporate | WAF/CDN rule triggered by IP reputation or header anomaly | Share HAR with site owner; ask for allowlist or rule tuning |
| CAPTCHA or JS challenge only on corporate | Behavioral score below threshold due to shared IP or stripped signals | Test with a dedicated egress IP or request a bypass |
| Console shows "Playwright init script mismatch" | Corporate proxy rewrites or blocks the init script used by detection | Check proxy SSL-inspection exclusions for the detection domain |
| Identical responses on both networks | Corporate IP not flagged; issue may be browser/device specific | Test with different browser profiles or devices |
Common corporate-network scenarios
Scenario A: SSL inspection breaks browser fingerprinting
A corporate forward proxy terminates TLS and re-encrypts with its own certificate. The re-encryption changes the JA3/JA3S fingerprint and can reorder HTTP/2 settings, making the client look like an automated tool. The fix is to add the detection vendor's domain to the proxy's bypass list so the original client fingerprint reaches the edge.
Scenario B: Shared egress IP on a blocklist
Your office NAT IP appears on a public blocklist because a compromised device in another tenant's network (shared coworking space) sent spam. The reputation check in step 6 will surface this. Request a dedicated IP from your ISP or use a business VPN with a clean exit node for critical marketing traffic.
Scenario C: Header stripping by DLP
Data-loss-prevention appliances remove Referer, Sec-CH-UA, or custom headers that bot detectors expect. The detector then sees an incomplete fingerprint and raises the risk score. Work with your security team to allowlist required headers for the domains you advertise on.
Limitations of a two-network test
- It captures a point-in-time snapshot; reputation scores change daily.
- It does not reveal server-side scoring logic (e.g., how BotRefund's AI weighs 110+ signals [S2]).
- False negatives occur if the residential IP also has a poor reputation.
- Some challenges are probabilistic; a single run may miss intermittent blocks.
Key facts
| Fact | Detail | Source |
|---|---|---|
| Independent detection signals | 110+ browser, hardware, network, and behavioral signals | S2 |
| Bot detection confidence | 99% confidence in flagged bot traffic | S2 |
| Playwright Init Scripts check | One of 106 independent checks; looks for automation-framework API mismatches | S1 |
| Corporate network impact | Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people | S1 |
| Cross-check methodology | Each signal is evidence; AI prediction weighs the complete pattern across browser, network, device, and behavior | S1 |
| Refund recovery rate | 83% of 2,500+ audited brands recover funds from Google and Meta | S2 |
| Report format | Refund-ready reports with click IDs, campaign details, timestamps, session recordings, and signal-by-signal reasoning | S2 |
FAQ
How often should I re-test my corporate egress IP?
Re-test after any network change (new proxy, ISP switch, office move) and at least quarterly. Reputation lists update daily; a clean IP today can be listed tomorrow.
Can I automate this test in CI/CD?
Yes. Script a headless browser (Playwright, Puppeteer) to load the test URL from a runner on the corporate network and from a cloud runner on a residential IP. Compare the HAR files programmatically and fail the pipeline if challenge rates diverge beyond a threshold.
What if the site owner refuses to allowlist our IP?
Ask for the specific signal that triggered the block (e.g., missing Sec-CH-UA, JA3 mismatch). Fix the root cause on your proxy/DLP rather than requesting a blanket allowlist. If the vendor uses BotRefund, they can share the session-by-session explanation showing which of the 110+ signals raised the score [S2].
Does a dedicated business VPN solve the problem?
Often, yes — if the VPN exit IP has a clean reputation and the VPN client does not strip browser signals. Test the VPN exit the same way you tested the corporate IP. Some VPNs are themselves flagged because their shared exits are abused.
How do I know if the problem is our network or the site's detector?
Test a third, neutral network (e.g., a coffee-shop Wi-Fi or a cloud shell). If the neutral network passes but corporate fails, the issue is your egress. If all three fail, the detector may be misconfigured or the site is under active attack.
What headers should I preserve through the corporate proxy?
At minimum: User-Agent, Accept-Language, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Referer, and any custom headers the detection vendor documents. Work with your proxy vendor to configure header passthrough rules.
Can BotRefund tell me exactly which signal flagged my corporate IP?
Yes. BotRefund's audit returns a session-by-session explanation with signal-by-signal reasoning, showing which of the 110+ checks contributed to the bot score [S2]. This turns a generic block into a specific fix list for your network team.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.