Seatext library / BotRefund evidence
How Many Anomalies Are Needed to Flag a Bot? The Real Threshold Explained
There is no fixed number of anomalies that flags a bot. Detection systems weigh severity, frequency, and how signals correlate. A single odd behavior can be a false positive, so modern systems look at...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
There is no fixed number of anomalies that flags a bot. Detection systems weigh the severity, frequency, and correlation of signals. A single odd behavior – like an unusually fast form fill – might be explained by a power user or a device quirk. In practice, bot detection depends on the whole pattern, not a count.
Many marketers and site owners ask for a simple threshold. They want a rule like “three anomalies equals a bot.” That rule does not exist in serious detection systems. The reason is that every anomaly has a context. A VPN user may look odd on one check but normal on others. A real human with a disability may produce unusual mouse curves. A bot can be designed to mimic human behavior. The only sound way is to combine multiple independent signals and assess confidence.
Why one anomaly is never enough
A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. For example, a user on a corporate VPN might show a mismatched IP and device location. A privacy browser might block certain scripts. So a lone signal can be a false positive.
Detection systems must cross-check each signal with independent data. That is why BotRefund, for instance, treats each signal as evidence and looks for corroboration before making a judgment. A sub-millisecond form fill alone does not mean a bot. But if that same form fill also has no mouse movement and a grid-aligned path, the evidence stacks.
Consider a real-world scenario. A marketing analyst logs in from a hotel network during a business trip. Their IP geolocation might match the hotel city, but their device fingerprint could show a home-time-zone setting. That is one anomaly. A rule-based system might flag it. A modern system sees that the user has consistent mouse movement, typed slowly, and scrolled naturally. The single anomaly is ignored. This is why count-based thresholds fail.
How modern bot detection weighs signals
Modern systems use dozens of independent checks. BotRefund uses 106, each adding one objective fact about the visit. The system then tests whether other signals support the same story. The AI model weighs the complete pattern instead of trusting a raw rule.
According to BotRefund, accuracy comes from corroboration, not one browser tell. By seeing how all signals fit together, the model identifies a visit as bot or human with 99% accuracy, as claimed by the company. That is a strong argument against simple anomaly counting.
The mechanics work like this. Each check produces a score. The scores are not summed equally. Some checks are more telling than others. For example, a true sub-millisecond input is nearly impossible for a human. A mismatched CPU concurrency report is also strong. But a missing font or a slightly unusual screen resolution is weak. The AI model learns weights from labeled data. It understands which combinations are suspicious and which are benign.
BotRefund’s public materials highlight the CPU Concurrency Lie check. It looks for a mismatch between reported hardware and actual behavior. A virtual machine might claim a certain GPU but behave differently. This is a strong signal because it is hard to fake convincingly. Yet even a strong signal is not used alone. The system always seeks corroboration from browser, network, and behavior data.
Key signals that commonly indicate bot behavior
Detection tools look for behaviors that rarely appear in real human sessions. The following are typical signals from BotRefund’s public materials:
- Ghost click detection – click activity without the natural sequence of human intent.
- Honeypot trap interactions – bots responding to hidden or deceptive page elements.
- Robotic linear mouse movements – unnaturally straight pointer paths.
- Absence of humanlike mouse tremor – missing the tiny jitter of real movement.
- Superhuman input speed (<1ms) – interactions faster than any person.
- Grid-aligned movement patterns – movement snapping to lines or blocks.
- Absence of clicks or scrolling – sessions that stay too static.
- Unnatural session durations – too short, too long, or too uniform to be human.
- CPU concurrency mismatches – hardware claims that do not match behavior.
- Inconsistent device fingerprints – fonts, audio, or OS details that contradict each other.
These signals are rarely present in isolation. Bots often show several at once, but each one alone can sometimes appear in legitimate sessions. For example, an autofill extension can produce superhuman input speed. A person using a tablet might produce grid-like movements. The key is how the signals combine.
A decision framework: how to evaluate anomalies
When you see an anomaly, do not jump to a bot verdict. Instead, evaluate it across four dimensions:
- Severity – How far is the signal from a human baseline? A sub-millisecond input is severe; a slightly fast form fill is not.
- Frequency – Does it happen once or repeatedly? One glitch is not a pattern; ten identical bursts are.
- Correlation – Do independent signals agree? A fast form fill plus a straight-line mouse path plus a honeypot hit is far more convincing than any one alone.
- Consistency across sessions – Does the same pattern repeat from the same IP, device, or campaign? Repeated patterns point to automation.
Use a weighted model, not a raw counter. The more correlated evidence you have, the higher the confidence. A single strong signal might trigger investigation, but only a convergent set should trigger action.
Practical decision criteria depend on your tolerance for risk. If you are protecting a high-value checkout page, you might block at a lower confidence threshold than a blog you want to keep accessible. Even then, you should rarely block on a single signal. Instead, you can challenge the user with a CAPTCHA or require additional verification.
Step-by-step: what to do when you see anomalies
Here is a practical workflow for handling suspicious traffic:
- Collect independent signals – Use behavioral metrics, network data, device fingerprints, and honeypots. Do not rely on one source.
- Look for corroboration – Check if the signal is supported by another unrelated check.
- Rule out legitimate causes – VPNs, privacy browsers, corporate proxies, and unusual devices can create false anomalies.
- Apply a weighted model – Score each signal and combine them, giving more weight to severe and consistent signals.
- Verify against known human sessions – Compare to a baseline of confirmed real users to calibrate your thresholds.
- Escalate only when the pattern is strong – Block, flag, or refund only when the evidence is clear and repeated.
A common mistake is to block a user after a single anomaly. That can exclude real customers and hurt your campaign performance. For example, a legitimate user with a privacy extension might fail a few checks. If you block them, you lose a sale. Over time, this increases your cost per acquisition and lowers conversion rates.
Key facts from BotRefund’s detection system
| Fact | Detail |
|---|---|
| Number of checks | 106 independent checks per visit |
| Accuracy claim | 99% accuracy from corroboration, not one browser tell |
| Key signal types | Ghost clicks, honeypots, pointer paths, input speed, session timing, CPU concurrency |
| Budget impact | Bot clicks steal up to 20% of Google and Meta ad budget |
| Setup time | About one minute, no credit card required |
| Refund recovery | Recovers ad spend dating back to 2017 for Google Ads |
These facts come from BotRefund’s public materials and show how a commercial detection system avoids a single-anomaly threshold. The system also provides audit trails that meet ad platform requirements.
Limitations: when anomaly counts mislead
No universal number works for every site. A login page may see more automation than a blog. A corporate network can create false positives. And sophisticated bots are designed to mimic human behavior, so even multiple signals may not be enough.
Over-flagging can block real users and damage conversion rates. Under-flagging leaves ad budgets vulnerable. The right approach is to calibrate thresholds against your own traffic and to use a model that weighs evidence contextually.
Also, a single anomaly from a trusted IP might be ignored, while the same anomaly from a proxy IP could be a strong sign. Context matters as much as the anomaly itself.
One major limitation is the bot’s ability to evolve. Modern fraud networks use AI to simulate human mouse curvature, click intervals, and scrolling. They cycle through residential proxies. They spoof device fingerprints. A static list of anomalies becomes outdated quickly. That is why detection systems must continuously update their models. A threshold that works today may fail tomorrow.
How to calibrate your own anomaly thresholds
If you want to set your own rules, start with a baseline. Collect data from sessions you know are human. Measure the distribution of each signal. For example, typical input speed, mouse curvature, and session length. Then identify where your legitimate users fall.
Next, choose a confidence score rather than a count. Assign weights to each signal based on how discriminating it is. The more rare a signal is among humans, the higher its weight. Combine the weights into a single score. Set a threshold that balances precision and recall. Test it against a labeled set of known bots and humans.
Calibration is iterative. Review your logs regularly. Look for cases where you blocked a user who later complained. Also look for bots that slipped through and made a fake conversion. Adjust your weights and threshold accordingly. The goal is not to hit a specific number of anomalies but to reach an acceptable false-positive rate and false-negative rate.
A worked example: evaluating a suspicious session
Imagine a visitor lands on your product page. The system records these signals:
- Form field is filled in 0.7 milliseconds.
- Mouse movement is a perfectly straight line between two points.
- No scrolling occurred.
- Session duration is 4 seconds.
- CPU concurrency data mismatches the reported browser.
That is five anomalies. A naive rule might say “five anomalies equals bot.” But look closer. The visitor is using an old device with a known bug that triggers a false CPU concurrency report. The form fill might be due to a password manager. The straight line could be a trackpad quirk.
A well-designed system will check for corroboration. It will see that the mouse movement lacks the natural jitter of even a trackpad. The form fill has no initial focus delay. The session has no scroll events. The CPU concurrency mismatch is consistent with a headless browser. The combination across independent domains gives high confidence. Still, the system might require three or more such corroborating signals before blocking. In this case, the evidence is strong enough to challenge the visitor with a CAPTCHA.
Now consider a different session. The visitor has a VPN IP, a privacy blocker that disables scripts, and a slightly odd screen resolution. Those are two or three anomalies, but they all come from the same cause: privacy tools. The user scrolls, clicks, and reads normally. A good system will not flag this as a bot.
Frequently asked questions
How many anomalies does a bot typically show?
There is no fixed count. Bots often generate several correlated signals, but the number is less important than the strength and consistency of the pattern.
Can one strong anomaly be enough?
It can trigger investigation, but strong systems avoid verdicts from a single signal. A sub-millisecond input is severe, but a user with a fast autofill could produce it. Corroboration is safer.
What makes an anomaly “strong”?
Strong anomalies are far outside human range, like sub-millisecond input or exact grid movement. They are also hard to explain with normal tools.
How do I avoid false positives?
Use multiple independent checks, rule out VPNs and privacy tools, and require several signals to agree before making a decision.
What should I do if I see a few anomalies?
Do not block immediately. Investigate the full session, check for a repeated pattern, and only act when the evidence is convergent and consistent.
How does BotRefund handle this?
BotRefund uses 106 checks and an AI model that weighs the complete pattern, not a raw rule. It also provides audit trails for refund disputes with Google and Meta.
Is a single anomaly from a proxy IP enough to block?
No. Even a proxy IP can be a legitimate user, such as a traveler or a remote worker. Context is key. A proxy IP combined with other suspicious behavior is more convincing.
How often should I update my detection rules?
Continuously. Bots adapt fast. Review your logs weekly and update your model when you see new patterns.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.