How BotRefund Separates Humans from Bots in Real Time: The 106-Signal Detection Process

BotRefund tells humans apart from bots by running 106 independent checks in real time and combining the results with an AI prediction model that evaluates the complete evidence pattern. No single signal — whether a WebGL texture mismatch, a linear mouse path, or a superhuman click speed — acts as a verdict on its own. Instead, each check contributes one objective fact, and the model weighs how all signals fit together across browser, network, device, and behavior data to reach a 99% accuracy rate.

What the detection process actually covers

The system groups its 106 checks into four evidence layers: browser and device fingerprints, network and connection traits, biometric and behavioral interactions, and session-level patterns. Browser and device checks include hardware and GPU fingerprinting, WebGL texture constraints, and canvas rendering consistency. Network checks examine IP reputation, proxy and VPN indicators, and connection timing anomalies. Behavioral checks capture click sequences, mouse tremor, pointer curvature, scroll depth, form completion speed, and tab-switch timing. Session checks measure visit duration, page-view sequences, and engagement consistency.

Each layer produces independent evidence. For example, the WebGL Texture Constraint check looks for a mismatch between the graphics stack a browser claims and the textures it actually renders — a gap that virtual machines and spoofed profiles often create. The window.open Tamper check watches for scripts that trigger navigation without the hesitation and timing variation real users show. The Impossible Tab Speed check flags tab switches that occur faster than a person can physically react. None of these alone decides the outcome; they enter the model as corroborating facts.

Step-by-step: how a visit gets scored in real time

1. Script loads on page arrival. A lightweight JavaScript snippet starts collecting browser, device, and network signals before the user interacts.
2. Fingerprint checks run immediately. Hardware, GPU, WebGL, canvas, audio, and font data are captured and compared against expected profiles for the claimed device.
3. Behavioral listeners attach. Mouse movement, click timing, scroll events, keyboard input, focus/blur, and tab visibility changes are recorded with microsecond timestamps.
4. Interaction checks fire on each event. Ghost-click detection, honeypot traps, linear-path flags, tremor analysis, speed thresholds, grid-alignment tests, and tab-switch latency are evaluated as the session unfolds.
5. Session context accumulates. Visit length, page sequence, idle periods, and conversion events are added to the evidence pool.
6. AI model scores the complete pattern. The prediction engine weighs all 106 signals together, cross-checking anomalies against legitimate explanations like privacy tools, corporate proxies, or unusual hardware.
7. Verdict returned to your dashboard and ad platforms. The session is labeled human or bot, and the click ID (GCLID/FBCLID) is logged for refund claims.

Prerequisites for accurate detection

• Install the BotRefund snippet on every landing page that receives paid traffic. The script adds roughly one minute of setup time and requires no credit card to start.
• Allow the script to run in the page head so it captures pre-interaction fingerprints.
• Ensure your ad accounts use auto-tagging (GCLID for Google, FBCLID for Meta) so click IDs are available for dispute reports.
• Keep the snippet active during the entire audit period; removing it mid-campaign breaks the evidence chain.

Verification step: confirm the system is working

After installation, open the BotRefund dashboard and run the free bot audit. The audit shows a live breakdown of bot vs. human traffic by campaign, placement, and device. Check that click IDs are being captured and that the bot rate aligns with any suspicious patterns you’ve seen in your ad platform (e.g., sudden CPC spikes, lead-quality drops, or conversion-pixel poisoning). If the audit shows zero data after 24 hours, verify the snippet is firing in the browser dev tools network tab.

Key facts

Fact	Detail	Source
Total independent checks	106	S1, S6, S7
Detection accuracy claim	99%	S1, S6, S7
Core evidence layers	Browser/device, network, behavioral, session	S1, S2, S5, S6, S7
Behavioral categories tracked	Click, trap, pointer, motion, speed, path, engagement, session	S2, S5
Single-anomaly policy	Evidence only, not a verdict; cross-checked against context	S1, S6, S7
AI model role	Weighs complete pattern across all signals	S1, S6, S7
Setup time	About one minute, no credit card	S2, S5
Refund lookback window	Google Ads spend back to 2017	S2, S5
Case-study recovery	FinTrust recovered $140,000	S4

Limitations and when the advice does not apply

• Privacy tools and corporate networks can produce anomalies that look like bots (e.g., masked WebGL, shared IPs). The model treats these as evidence, not verdicts, but false positives may still occur in highly locked-down environments.
• Sophisticated residential proxy botnets that rotate real device fingerprints and mimic human tremor can reduce detection confidence. The system counters this with cross-layer corroboration, but no solution guarantees 100% catch rates.
• Non-JavaScript environments (e.g., some AMP pages, strict CSP policies) may block the snippet, leaving those sessions unscored.
• Refund approval depends on Google and Meta dispute processes; BotRefund supplies audit-ready reports, but final approval rates are set by the ad platforms.

Terminology

• WebGL Texture Constraint: A fingerprint check that compares the graphics textures a browser renders against the hardware profile it claims. Mismatches suggest virtualization or spoofing.
• window.open Tamper: A behavioral check that detects scripted navigation events lacking human-like hesitation and timing variation.
• Impossible Tab Speed: A check that flags tab switches or focus changes occurring faster than human reaction time allows.
• Ghost click: A click event fired without the preceding mouse-down, move, and up sequence typical of a real user.
• Honeypot trap: A hidden page element that only bots interact with; interaction signals automation.
• Pixel poisoning: When bot conversions train ad-platform algorithms on fake outcomes, degrading targeting for real users.
• GCLID / FBCLID: Click identifiers appended by Google Ads and Meta Ads that link a visit to a specific paid click for refund claims.

FAQ

How long does it take to see bot traffic data after installing the snippet?

The dashboard populates in real time. The free bot audit typically shows meaningful breakdowns within a few hours of live traffic, and a full picture emerges after 24–48 hours.

Does BotRefund block bots or just detect them?

Detection is the core product. The dashboard lets you suppress conversion pixels for bot sessions, which stops pixel poisoning. Full blocking requires integrating the verdict with your WAF or CDN rules.

Can I use BotRefund on Meta lead campaigns as well as Google search?

Yes. The snippet works on any landing page receiving paid traffic from Google, Meta, or other platforms that provide click IDs. The Meta invalid-traffic guide outlines the same signal categories for lead-quality audits.

What happens if a legitimate user gets flagged as a bot?

Because the model requires corroboration across multiple independent signals, false positives are rare. If one occurs, the session evidence is visible in the dashboard for review, and you can whitelist the IP or device fingerprint.

How far back can I claim refunds for bot clicks?

Google Ads refund disputes can reach back to 2017. Meta’s lookback window is shorter; check current platform policy for the exact limit.

Is there a minimum ad spend to use BotRefund?

No. The free audit and protection tier start at any spend level. Enterprise pricing tiers begin at $10,000/mo ad spend and scale up to over $5M/mo.

What makes the 99% accuracy claim credible?

Accuracy comes from the AI model weighing 106 cross-checked signals rather than trusting any single rule. The claim is based on internal validation across client traffic; independent third-party benchmarks are not published in the source pack.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• Bot Detection Guide 2025: How to Identify & Block Bots
• Bot Detection 101: How to Detect (and Beat) Bot Traffic - Stytch
• Bot Protection - Detect & Stop Bad Bots | HUMAN Security

Learn more

Visit the website for more information.