Seatext library / BotRefund evidence
How BotRefund Handles Advanced Bots with Multiple Checks
BotRefund runs 106 independent checks on every visit. Each check contributes one piece of evidence — browser API consistency, mouse movement quality, click timing, session duration patterns, and more. No single anomaly triggers a...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
How the 106-check architecture works
BotRefund does not rely on a single fingerprint or challenge. It runs 106 independent checks during a visit. Each check is designed to surface one objective fact: does the browser's console behave like a standard build? Does the window.open call match a real user's timing? Is the tab-switching speed physically possible for a human? The checks fall into four evidence categories — browser, network, device, and behavior — and each one produces a signal that is stored, not judged, in isolation.
This design mirrors a diagnostic sequence. A doctor does not diagnose from one symptom; they collect labs, history, and imaging, then look for a pattern that fits. BotRefund's engine collects 106 "labs" per session. The Console Debug Evaluator (one check) looks for mismatches in browser APIs that automation tools often leave when they patch or hide functions. The window.open Tamper check watches for timing and movement inconsistencies when a new tab opens. The Impossible Tab Speed check flags tab switches that happen faster than a person can click. Each check adds a single data point.
| Criterion | BotRefund (106-check multi-layer) | CAPTCHA (challenge-based) | WAF (rule-based) | Basic Fingerprinting (single-signal) |
|---|---|---|---|---|
| Detection approach | 106 passive checks across browser, network, device, behavior layers; AI weighs full pattern | Interactive challenge at perimeter (image, puzzle, checkbox) | Static rules on IP, headers, request patterns | One fingerprint hash or JS property test |
| False positive handling | Cross-layer corroboration required; single anomaly not a verdict | Human fails challenge = blocked; no appeal in-session | Rule match = block/flag; limited context | Single mismatch = flag; high false positive risk |
| Advanced bot coverage | Counters headless browsers, CAPTCHA solvers, residential proxies, spoofed data pools | Solvers bypass routinely; human-in-the-loop services cheap | Easily evaded by rotating IPs, header spoofing | Spoofed easily; headless browsers mimic fingerprints |
| Setup complexity | ~1 minute script add; no credit card for audit | Form integration; UX friction | DNS/edge config; rule tuning needed | Script add; but limited value alone |
| Maintenance burden | Vendor adds checks; AI re-weights signals automatically | Challenge updates; accessibility compliance | Constant rule writing; false positive tuning | Fingerprint updates; cat-and-mouse |
| User experience impact | Zero interruption; passive observation | Interrupts every user; accessibility barriers | Invisible until block; then hard failure | Invisible; but weak protection |
Practical takeaway: If you need to stop sophisticated bots without frustrating real users, BotRefund's multi-layer corroboration fits. CAPTCHA and WAF suit perimeter filtering where some friction is acceptable. Basic fingerprinting alone is insufficient for advanced threats. Check with the vendor for current CAPTCHA/WAF feature parity.
Types of checks: browser, network, device, behavior
The 106 checks map to four layers. Browser-layer checks examine API integrity, permissions, rendering contexts, and console behavior. Network-layer checks analyze IP reputation, proxy signatures, connection timing, and TLS fingerprints. Device-layer checks read screen resolution, battery status, hardware concurrency, and sensor availability. Behavior-layer checks measure mouse tremor, click path curvature, scroll depth, form completion speed, session duration variance, and interaction sequences.
Examples from the behavior layer include ghost click detection (clicks without human intent sequence), honeypot trap interactions (responses to hidden elements), robotic linear mouse movements (unnaturally straight paths), absence of humanlike mouse tremor (missing micro-jitter), superhuman input speed under 1 millisecond, grid-aligned movement patterns (snapping to precise lines), absence of clicks or scrolling, and unnatural session durations (too short, too long, or too uniform). These are not rules that block; they are signals that accumulate.
How cross-checking prevents false positives
A single anomaly is not a bot verdict. Privacy tools, corporate networks, travel, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps each signal as evidence and cross-checks it against independent signals from the other three layers. If the Console Debug Evaluator flags a browser API mismatch but the network, device, and behavior layers all look human, the system does not label the visit as a bot. It requires corroboration — multiple independent signals pointing to the same conclusion — before the AI model weighs the pattern.
This matters because advanced bots increasingly mimic individual signals. A headless browser running Puppeteer or Playwright can spoof a user agent, fake a screen resolution, and route through a residential proxy. But reproducing the full constellation — natural mouse tremor, realistic click-path curves, human-paced form typing, consistent tab-switch timing, and unpatched browser APIs — simultaneously across 106 checks is far harder. The cross-check design forces the bot to be perfect everywhere, not just in one dimension.
AI prediction layer: weighing the complete pattern
After the 106 checks fire and cross-referencing completes, BotRefund sends the full signal set into a prediction model. The model does not apply a hard threshold on any single check. It evaluates how all signals fit together across browser, network, device, and behavior evidence. The output is a probability that the visit is automated. BotRefund states this approach yields 99% accuracy. The key distinction is that accuracy comes from corroboration, not from any one browser tell.
The model also adapts. As new bot frameworks emerge — new headless builds, new proxy networks, new CAPTCHA-solving APIs — the signal patterns shift. The prediction layer re-weights based on the evolving joint distribution of signals, so a check that was highly predictive last quarter may contribute less if bots learn to spoof it, while a previously weak check gains weight if bots still fail it consistently.
Advanced bot techniques BotRefund counters
Modern bots combine several evasion methods. Headless browsers (Puppeteer, Selenium, Playwright) load pages and fill forms automatically. Human-in-the-loop CAPTCHA solving routes challenges to low-cost solving centers. Spoofed data pools scrape public listings to input real names, existing email domains, and formatted phone numbers. Residential proxy routing spreads submissions across consumer IP addresses to bypass geolocation filters. When these leads hit a CRM, they look authentic until a sales team follows up.
BotRefund's checks target the behavioral mechanics that these methods struggle to replicate. Superhuman input speeds — bots can copy-paste or autofill fields in sub-millisecond intervals, while humans take seconds. Lack of physical pointer movement — sessions where inputs populate without mouse movement, scrolls, or focus changes. Disposable email patterns — concentrations of signups from obscure domains or matching specific character lengths. The 106-check net catches the gaps between what automation tools can spoof and what human physiology produces.
Step-by-step: what happens when a visit arrives
- Script loads. BotRefund's client-side script initializes in the browser.
- 106 checks execute. Each check runs its specific test — console API integrity,
window.opentiming, tab-switch speed, mouse tremor, click path, scroll behavior, form timing, session duration, IP reputation, proxy signatures, device sensors, and more. - Signals stored. Each check writes one evidence record. No verdict yet.
- Cross-layer correlation. The engine groups signals by layer (browser, network, device, behavior) and checks whether multiple independent signals support the same story.
- AI prediction. The complete signal set feeds the prediction model, which outputs a bot probability based on the joint pattern.
- Action. If probability exceeds the threshold, the visit is flagged. The flag can suppress conversion pixels, block form submission, trigger a challenge, or feed a refund claim report for Google and Meta ad spend.
- Audit trail. Every flagged visit retains the full 106-check evidence set for dispute documentation.
Limitations and when this approach does not apply
The 106-check model assumes client-side execution. If a visitor blocks JavaScript entirely, the checks cannot run. BotRefund can still analyze server-side signals (IP, headers, request timing), but the behavioral and browser-layer evidence is unavailable. Sophisticated attackers who invest in custom browser builds that perfectly replicate all 106 signals — including micro-tremor, realistic click curves, and unpatched APIs — could evade detection, though the cost of building and maintaining such a browser rises with each check added.
The system also does not judge intent. A human using automation tools for accessibility, testing, or privacy may trigger signals that look bot-like. Cross-checking reduces false positives, but edge cases exist. BotRefund treats each signal as evidence, not a verdict, precisely to allow human review where the pattern is ambiguous.
Key facts
| Fact | Detail | Source |
|---|---|---|
| Total independent checks | 106 | S1, S6, S7 |
| Evidence categories | Browser, network, device, behavior | S1, S3, S6, S7 |
| Stated accuracy | 99% | S1, S6, S7 |
| Single-anomaly policy | Not a verdict; cross-checked across layers | S1, S6, S7 |
| Behavioral signals | Ghost clicks, honeypot traps, linear mouse paths, missing tremor, sub-ms input speed, grid-aligned movement, static sessions, unnatural durations | S3, S4 |
| Advanced bot methods countered | Headless browsers, CAPTCHA-solving services, spoofed data pools, residential proxies | S8 |
| Setup time | About one minute | S3, S4 |
| Refund coverage | Google and Meta ad spend back to 2017 | S3, S4 |
FAQ
Does BotRefund block bots in real time or only report them?
Both. The prediction output can suppress conversion pixels, block form submissions, or trigger challenges during the session. The same evidence set also generates audit-ready reports for refund disputes with Google and Meta.
What happens if a visitor uses a privacy browser or VPN?
Privacy tools and VPNs may trigger individual signals (e.g., altered browser APIs, proxy IP). Because BotRefund requires corroboration across multiple independent layers, a privacy-conscious human typically passes — their behavior, device, and network signals remain consistent and human-like.
Can bots evolve to pass all 106 checks?
In theory, yes — if an attacker builds a custom browser that perfectly replicates human micro-behavior across every dimension. In practice, the maintenance cost of such a browser rises with each check. BotRefund adds new checks as new automation tells are discovered, shifting the economics further against the attacker.
How does the free bot audit work?
You add the BotRefund script to your site (about one minute, no credit card). The system runs the 106 checks on live traffic and produces a report showing bot percentage, top signals, and estimated ad spend loss. A live audit call walks through the findings.
What ad platforms does refund recovery cover?
Google Ads and Meta (Facebook/Instagram). BotRefund captures video proof per bot click and submits dispute packages that ad platform reps accept.
Is there a minimum ad spend to use BotRefund?
Pricing tiers start under $10,000/month and scale through enterprise bands ($50K–$250K, $250K–$1M, $1M–$5M, over $5M). The free audit is available at any spend level.
How does BotRefund differ from a CAPTCHA or WAF?
CAPTCHAs and WAFs typically apply a single challenge or rule at the perimeter. BotRefund runs 106 continuous, passive checks throughout the session, builds an evidence set, and uses AI to weigh the full pattern. It does not interrupt humans with puzzles; it observes and correlates.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.