Seatext library / BotRefund evidence
How BotRefund Uses Machine Learning to Cross-Check Browser Signals
BotRefund collects 106 independent browser signals — each a single objective fact — then feeds them into a prediction model that weighs the full pattern across browser, network, device, and behavior data. The model...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
How the signal collection works
BotRefund runs 106 client-side checks on every visit. Each check targets a specific browser, network, device, or behavior attribute — for example, whether console.debug behaves normally, whether window.open has been tampered with, or whether tab-switching speed exceeds human limits. The checks are designed to be independent: a single signal adds one objective fact about the visit without assuming the final classification.
Source S1 describes the Console Debug Evaluator as "one of 106 independent checks BotRefund uses to build a reliable picture of whether a visit is human or automated." Other checks include Impossible Tab Speed, window.open Tamper, ghost click detection, honeypot trap interactions, robotic linear mouse movements, absence of humanlike mouse tremor, superhuman input speed under 1 ms, grid-aligned movement patterns, absence of clicks or scrolling, and unnatural session durations (S3, S6, S7).
The three-step cross-checking framework
Every signal passes through the same pipeline before the model sees it:
- Independent evidence — the check records one observable fact (e.g., "console.debug returned an unexpected value").
- Cross-checked context — the system asks whether other signals tell the same story. If the console signal suggests automation but mouse movement, scroll behavior, and network latency all look human, the console anomaly is downgraded.
- AI prediction — the model weighs the complete pattern instead of trusting a raw rule.
S1 states this explicitly: "01 z8y Independent evidence z8y This signal adds one objective fact about the visit. 02 z8y Cross-checked context z8y BotRefund tests whether other signals support the same story. 03 z8y AI prediction z8y Our model weighs the complete pattern instead of trusting a raw rule." The same three-step structure appears in the window.open Tamper (S6) and Impossible Tab Speed (S7) pages.
What the machine learning model actually does
The prediction model is a probabilistic classifier trained on millions of labeled visits. Its job is to estimate the probability that a session is automated given the full vector of 106 signals. Unlike a rule engine that says "if signal X > threshold then bot," the model learns how signals interact: a missing mouse tremor matters more when combined with superhuman input speed and a residential proxy IP than when it appears alone on a corporate laptop with privacy extensions.
S1 explains the outcome: "BotRefund sends this signal into our prediction AI, which evaluates the complete picture across browser, network, device, and behavior evidence. By seeing how all signals fit together, it identifies a visit as bot or human with z8y 99% accuracy." The 99% figure reflects corroboration across categories, not any single tell.
Categories of browser signals the model consumes
The 106 checks fall into four evidence families. The model treats each family as a partially independent view of the session.
- Browser integrity signals — API consistency, property descriptors, permission states, rendering context quirks. Examples: Console Debug Evaluator, window.open Tamper, navigator.webdriver exposure, canvas fingerprint consistency.
- Behavioral biometrics — mouse tremor, click latency, scroll velocity, focus/blur patterns, form interaction rhythm. Examples: absence of humanlike mouse tremor, superhuman input speed, robotic linear movements, grid-aligned paths.
- Navigation and timing signals — tab switch speed, page load sequence, resource timing anomalies, session duration distribution. Example: Impossible Tab Speed.
- Network and device context — IP reputation, proxy/VPN indicators, TLS fingerprint, hardware concurrency, battery API, screen resolution vs. viewport mismatch.
S3 lists the behavior families explicitly: click behavior, trap behavior, pointer behavior, motion behavior, speed behavior, path behavior, engagement behavior, and session behavior.
Why a single anomaly never equals a verdict
Privacy tools, corporate proxies, unusual hardware, travel, and accessibility software routinely produce signals that look automated in isolation. A user on a locked-down enterprise laptop may have a patched console.debug, no battery API, and a non-standard TLS fingerprint — yet be completely human. The cross-checking step exists to prevent these false positives.
S1 puts it plainly: "A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps this signal as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data."
Limitations and edge cases
- New automation frameworks — the model must be retrained when tools like Puppeteer Stealth, Playwright Extra, or undetected-chromedriver release versions that close known signal gaps.
- Sophisticated human-in-the-loop operations — click farms where real people operate browsers on residential IPs can pass behavioral checks while still being fraudulent.
- Client-side only — BotRefund's 106 checks run in the browser. Server-side signals (e.g., request timing, header order, TCP fingerprint) are not part of this model unless paired with a reverse-proxy integration.
- Label noise in training data — the 99% accuracy claim depends on clean ground truth. Mislabelled sessions (e.g., a human flagged as bot because they used a password manager that autofills at superhuman speed) degrade the model.
Key facts
| Fact | Detail | Source |
|---|---|---|
| Number of independent checks | 106 | S1, S6, S7 |
| Cross-checking steps | Independent evidence → Cross-checked context → AI prediction | S1, S6, S7 |
| Model input scope | Browser, network, device, and behavior evidence | S1 |
| Reported accuracy | 99% (corroboration-based, not single-signal) | S1, S6, S7 |
| Single-anomaly policy | Evidence only, never a verdict | S1 |
| Behavior families covered | Click, trap, pointer, motion, speed, path, engagement, session | S3 |
| Deployment | Client-side JavaScript, ~1 minute install | S3, S4 |
Terminology
- Signal — one measurable browser, network, device, or behavior observation (e.g., "mouse tremor absent").
- Independent evidence — a signal recorded without reference to other signals.
- Cross-checked context — the process of testing whether multiple signals converge on the same classification.
- Prediction AI — the probabilistic model that outputs a bot/human probability from the full signal vector.
- Corroboration — the principle that accuracy comes from multiple independent signals agreeing, not from any single tell.
FAQ
Does BotRefund use supervised or unsupervised learning?
The source pack describes a "prediction AI" trained on labeled visits (bot vs. human), which implies supervised learning. The model "weighs the complete pattern instead of trusting a raw rule" (S1), consistent with a supervised classifier that learns signal interactions from ground-truth data.
How often is the model retrained?
The source pack does not specify a retraining cadence. In practice, bot detection models require continuous retraining as automation tools evolve. Ask BotRefund about their model refresh cycle during a demo.
Can the model explain why it flagged a specific visit?
The three-step framework (independent evidence → cross-checked context → AI prediction) produces an audit trail: each of the 106 signals is recorded, and the cross-check step shows which signals agreed or disagreed. This evidence package is what ad platforms accept for refund disputes (S5).
What happens when a privacy tool triggers multiple signals at once?
Privacy tools often affect several browser integrity signals simultaneously (e.g., canvas fingerprint, navigator properties, permissions). Because those signals belong to the same evidence family, the model learns their correlation and down-weights the cluster rather than treating each as independent confirmation of automation.
Does the model incorporate server-side signals like IP reputation?
Yes. The prediction AI evaluates "the complete picture across browser, network, device, and behavior evidence" (S1). Network evidence includes IP reputation, proxy/VPN detection, and TLS fingerprinting.
How does BotRefund handle new automation frameworks that mimic human behavior perfectly?
When a new framework closes known signal gaps, the 106-check suite may initially miss it. The model's probabilistic nature helps — if 105 signals look human but one subtle timing anomaly persists, the cross-check step can still surface it. However, sustained evasion requires adding new checks and retraining the model on fresh labeled data.
What is the false positive rate for legitimate users on corporate networks?
The source pack does not publish a false positive rate. The "single anomaly is not a verdict" design (S1) and the cross-checking across four evidence families are explicitly intended to keep false positives low for enterprise, privacy, and accessibility scenarios.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.