How BotRefund Handles Corporate Networks and VPNs: Multi-Signal Detection Explained

BotRefund handles corporate networks and VPNs by refusing to make a verdict from a single network signal. When a visitor arrives from a corporate proxy, a VPN exit node, or any shared IP space, the system records that context but does not treat it as proof of automation. Instead, it runs 106 independent checks across browser fingerprinting, device characteristics, network behavior, and biometric interaction patterns. Each check produces a piece of evidence. The prediction AI then weighs the full pattern to decide whether the session is human or bot. This approach keeps legitimate users on corporate networks or privacy tools from being misclassified while still catching bots that hide behind the same infrastructure.

How BotRefund's Multi-Signal Approach Works with Corporate Networks

Corporate networks and VPNs create a common detection challenge: many real people share a small set of IP addresses, and those IPs often appear on threat-intelligence lists because bad actors also use them. Traditional IP-reputation filters either block the whole range (hurting real customers) or allow it (letting bots through). BotRefund sidesteps this by decoupling network identity from the bot decision.

When a request hits a page protected by BotRefund, the JavaScript sensor collects browser, device, and interaction data in the visitor's browser. The network layer (IP, ASN, proxy/VPN indicators) is recorded as one signal among many. If the IP belongs to a known corporate proxy or VPN provider, that fact is noted. It does not trigger a block. The system then evaluates whether the browser fingerprint matches the claimed device, whether mouse movements show human tremor, whether click timing fits human reaction speeds, whether tab-switching behavior looks natural, and roughly 100 other independent checks. Only the aggregate pattern drives the final classification.

This design reflects a principle stated across BotRefund's detection documentation: "Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps this signal as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data." The same language appears on the CPU Concurrency Lie, Impossible Tab Speed, and window.open Tamper signal pages, confirming it is a system-wide rule rather than a per-signal exception.

The 106 Independent Checks: What They Actually Measure

BotRefund groups its 106 checks into four evidence categories. Each category contributes multiple signals that are difficult for automation to spoof simultaneously.

Browser and Device Fingerprinting

• Hardware and GPU fingerprinting (including the CPU Concurrency Lie check)
• Font enumeration and canvas rendering consistency
• Audio context and WebGL parameter validation
• Navigator property integrity (userAgent, platform, hardwareConcurrency, deviceMemory)

These checks verify that the browser's self-reported environment is internally consistent. A bot running in a virtual machine or headless container often leaks mismatches between claimed CPU cores, GPU renderer, and actual timing behavior.

Network and Connection Signals

• IP reputation and ASN classification (corporate, hosting, residential, VPN)
• TLS fingerprint (JA3/JA3S) consistency with the claimed browser
• HTTP/2 and HTTP/3 frame ordering anomalies
• Connection timing and retry patterns

Network signals include the corporate/VPN indicator. They are weighted lightly on their own because legitimate users frequently appear on shared or flagged infrastructure.

Biometric and Behavioral Interactions

• Mouse movement curvature, tremor, and velocity profiles
• Click timing distributions (superhuman speed <1ms detection)
• Scroll behavior: momentum, pauses, and reading patterns
• Tab and window focus/blur sequences (Impossible Tab Speed, window.open Tamper)
• Form interaction: field focus order, correction events, dwell time

These are the hardest signals for bots to fake at scale. AI-driven bot telemetry can approximate some curves, but reproducing the full distribution of human micro-behaviors across a session remains expensive and error-prone.

Session and Engagement Patterns

• Session duration distributions (too short, too long, too uniform)
• Page view sequences and navigation graph entropy
• Conversion pixel firing consistency with prior engagement
• Honeypot and trap element interactions

Session-level signals catch automation that passes momentary checks but fails to sustain a coherent visit.

Why Single-Signal Detection Fails on VPNs and Corporate IPs

IP reputation lists are useful for broad filtering but unreliable for per-visit decisions. A corporate office with 500 employees may generate thousands of legitimate ad clicks per month from one IP. A residential VPN service may have thousands of privacy-conscious users sharing a few exit nodes. Blocking or flagging based on IP alone creates false positives that waste ad budget and degrade user experience.

BotRefund's documentation explicitly warns against single-anomaly verdicts: "A single anomaly is not a bot verdict." The system architecture reflects this. Each of the 106 checks produces an independent evidence flag. The prediction AI evaluates the joint probability that the observed pattern comes from a human versus an automated script. A corporate IP raises the prior probability of automation slightly, but strong human behavioral evidence (natural mouse tremor, realistic click intervals, consistent fingerprint) overwhelms that prior.

This is also why BotRefund can detect bots that use residential proxy botnets. The Ad Fraud Trends guide notes that "malicious actors route clicks through networks of hijacked smart devices (IoT) in target local areas. This presents the ad platform with legitimate residential IP addresses, making location-based exclusions ineffective." Because BotRefund does not rely on IP reputation as a primary signal, it can still flag those sessions when behavioral and fingerprint evidence diverges from human norms.

Step-by-Step: How a Visit from a Corporate Network Gets Evaluated

1. Sensor loads. The BotRefund JavaScript snippet executes in the visitor's browser and begins collecting fingerprint and interaction data.
2. Network context recorded. The backend resolves the visitor's IP to ASN, organization, and known proxy/VPN tags. If the IP matches a corporate range or VPN provider, that tag is attached to the session record.
3. 106 checks run in parallel. Each check returns a binary or continuous evidence value (e.g., CPU concurrency matches expected range: true/false; mouse tremor entropy: 0.87).
4. Evidence vector assembled. All 106 values form a feature vector for the session. No single value determines the outcome.
5. AI prediction. The trained model scores the vector. The model has learned the joint distribution of signals for human and bot traffic across millions of labeled sessions.
6. Classification threshold. If the bot probability exceeds the operating threshold, the session is flagged as invalid. The threshold is tuned for 99% accuracy per BotRefund's published claim.
7. Audit trail stored. Every signal value, the model score, and the final decision are logged. This trail supports refund claims submitted to Google and Meta.

At no step does the corporate/VPN tag alone cause a flag. It merely shifts the input distribution seen by the model.

Key Facts

Fact	Detail	Source
Total independent checks	106	S1, S6, S7
Evidence categories	Browser/device fingerprinting, network/connection, biometric/behavioral, session/engagement	S1, S6, S7, S2
Corporate network/VPN handling	Treated as evidence, not a verdict; cross-checked against other signals	S1, S6, S7
Single-anomaly policy	"A single anomaly is not a bot verdict"	S1, S6, S7
Prediction method	AI model weighs complete pattern across browser, network, device, behavior	S1, S6, S7
Published accuracy	99% (BotRefund claim)	S1, S6, S7
Refund coverage	Google Ads and Meta ad spend, claims back to 2017	S2, S4
Setup time	About one minute to add to website	S2, S4
Ad spend tiers served	Under $10K/mo to over $5M/mo	S2, S4

Limitations and When This Approach Doesn't Apply

• Sophisticated human-operated fraud. If a real person manually clicks ads in a coordinated scheme (click farms), behavioral signals will look human. BotRefund targets automated traffic, not human fraud rings.
• First-visit classification with minimal interaction. A session that bounces after one pageview with no mouse movement provides limited behavioral evidence. The system may defer a verdict or classify conservatively.
• Browser environments that strip fingerprinting surfaces. Hardened privacy browsers (Tor Browser, Brave with strict shields) may suppress canvas, WebGL, font, and audio signals, reducing the evidence available for cross-checking.
• Non-JavaScript environments. Bots that execute only HTTP requests without a browser engine will not trigger the client-side sensor. Server-side log analysis is a separate layer not covered by the 106 browser checks.
• Model drift over time. As bot operators adopt new evasion techniques, the AI model requires retraining. BotRefund updates its model continuously, but there is always a window between a new tactic's emergence and its incorporation into the classifier.

Terminology: Signals, Evidence, Verdicts, and Cross-Checking

• Signal: A single measurable observation (e.g., "CPU concurrency value equals 8").
• Check: A test that evaluates one or more signals against expected human ranges (e.g., CPU Concurrency Lie check).
• Evidence: The output of a check, recorded as a fact about the session. Evidence accumulates; it does not decide.
• Cross-checking: The process of testing whether multiple independent evidence items support the same conclusion (human or bot).
• Verdict: The final classification produced by the AI prediction model after weighing all evidence.
• Independent checks: Checks designed to fail for different reasons, so a bot that passes one (e.g., fingerprint) likely fails another (e.g., mouse tremor).

FAQ

Does BotRefund block traffic from known VPN IP ranges?

No. VPN and corporate IP tags are recorded as network evidence. The final decision depends on the full 106-signal pattern. Legitimate users on VPNs are not blocked solely because of the IP.

Can a bot evade detection by using a residential proxy?

Residential proxies hide the IP reputation signal, but they do not automatically replicate human mouse tremor, click timing, tab behavior, and fingerprint consistency. The Ad Fraud Trends guide notes that residential proxy botnets make "location-based exclusions ineffective," implying that IP-based defenses fail while multi-signal detection remains effective.

What happens if a corporate network uses a shared NAT with thousands of employees?

The shared IP appears as a single network context. Each employee's browser produces distinct fingerprint and behavioral evidence. The model evaluates each session independently. High volume from one IP does not trigger a collective flag.

How does BotRefund handle privacy-hardened browsers like Tor or Brave?

Hardened browsers suppress several fingerprinting surfaces (canvas, fonts, WebGL, audio). This reduces the number of available checks. The system relies more heavily on the remaining behavioral signals (mouse, scroll, timing) and network context. Classification confidence may be lower, and the session may receive a "defer" or conservative verdict.

Does the 99% accuracy claim apply specifically to corporate/VPN traffic?

The 99% figure is a system-wide claim ("identifies a visit as bot or human with 99% accuracy") appearing on multiple signal pages. The source pack does not break out accuracy by network type. Performance on corporate/VPN traffic specifically is not separately documented.

Can I see which signals flagged a specific session?

Yes. BotRefund stores the full evidence vector and model score for each session. The audit trail supports refund dispute reports submitted to Google and Meta.

What ad platforms does BotRefund support for refund claims?

Google Ads and Meta (Facebook/Instagram). The homepage and pricing pages reference recovery from both platforms, with claims dating back to 2017 for Google Ads spend.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• High-Quality Proxy Service for Any Use Case | CoProxy
• Most VPN Refund Policies Are Easy If You Can Meet These Criteria ...
• Inside a Modern Fraud Attack: From Bot Signups to Account Takeovers

How BotRefund can help

BotRefund's detection engine runs 106 independent checks across browser fingerprinting, device characteristics, network context, and biometric behavior. Corporate networks and VPNs appear as one network signal among many—never a standalone block reason. The AI model weighs the full evidence pattern, so legitimate users on shared infrastructure stay classified as human while bots hiding behind the same IPs get caught on behavioral and fingerprint mismatches.

The system produces an audit trail for every session: each signal value, the model score, and the final verdict. That trail is what Google and Meta accept when BotRefund submits refund claims on your behalf. Setup takes about one minute with a JavaScript snippet. No credit card is required to start the free bot audit.

Limitations to know: the 99% accuracy figure is a system-wide claim, not broken out by network type. Human-operated click farms and highly stripped-down privacy browsers (Tor, hardened Brave) reduce available signals and may lower confidence. Server-side bots that never execute JavaScript are outside the client-side sensor's scope.