Seatext library / BotRefund evidence
How to Implement a Reliable Bot Detection System: A Practical Framework
Reliable bot detection requires layering multiple independent signals — browser, network, device, and behavior — and cross-checking them with an AI model instead of relying on any single rule. BotRefund uses 106 independent checks...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Start by instrumenting your site to collect browser fingerprint data, network connection details, device characteristics, and behavioral signals like mouse movement, click timing, and scroll patterns. Feed every signal into a scoring engine that weighs the full pattern rather than triggering on one anomaly. Cross-check each signal against the others — a mismatched timezone and language, or a headless browser signature paired with superhuman click speed, carries more weight than either alone. Finally, verify the system by running a controlled test with known bots and real users, then tune thresholds to keep false positives below your tolerance.
What reliable bot detection actually means
Reliable detection is not a single script that blocks "bad" user agents. It is a pipeline that gathers dozens of independent observations, checks them for internal consistency, and scores the overall likelihood of automation. A single signal — like a missing navigator.webdriver flag — can be spoofed or appear on a privacy-hardened browser. When you combine 100-plus signals across browser APIs, network routing, device sensors, and interaction patterns, the probability of a false positive drops sharply. BotRefund's approach treats every signal as evidence, not a verdict, and lets an AI model weigh the complete picture.
Core detection layers that work together
Four evidence layers feed the decision engine. Each layer contains multiple checks that can be implemented independently.
- Browser layer: Checks for automation framework artifacts (Playwright, Puppeteer, Selenium), inconsistent API implementations, JavaScript engine mismatches, and canvas/WebGL fingerprint anomalies.
- Network layer: Validates IP reputation, proxy/VPN exit nodes, suspicious port usage, TLS fingerprint consistency, and geolocation-to-timezone alignment.
- Device layer: Collects screen resolution, color depth, battery status, hardware concurrency, touch support, and sensor data (gyroscope, accelerometer) where available.
- Behavior layer: Records mouse trajectories, click intervals, scroll velocity, form completion speed, focus/blur sequences, and session duration distributions.
Each layer produces independent signals. The browser layer might flag a Playwright init script artifact. The network layer might detect a data-center IP on a residential ISP range. The behavior layer might see sub-millisecond form fills. Alone, each is noisy. Together, they form a coherent story.
Step-by-step implementation framework
- Instrument the client side. Deploy a lightweight script that runs on every page load and captures the four evidence layers. Use
requestIdleCallbackor a web worker to avoid blocking the main thread. - Normalize and hash signals. Convert raw observations into stable feature vectors. Hash canvas fingerprints, serialize navigator properties, encode mouse paths as compressed coordinate arrays.
- Send to a scoring service. Post the feature vector to your backend or a third-party API. Include a session ID and timestamp for replay and audit.
- Cross-check signals server-side. Compare the client-reported IP geolocation against the timezone offset. Verify the user agent string matches the observed browser APIs. Check that touch events align with reported touch support.
- Apply a weighted model. Use a gradient-boosted tree or neural net trained on labeled bot/human traffic. Weight features by their historical predictive power. Output a probability score, not a binary block/allow.
- Enforce with graduated response. Low scores: log and monitor. Medium scores: challenge with a lightweight proof-of-work or behavioral CAPTCHA. High scores: block and feed the session into a retraining loop.
- Close the feedback loop. Track downstream outcomes — chargebacks, spam complaints, conversion quality — and relabel sessions. Retrain monthly.
Common signal categories and what they catch
| Category | Example signals | Typical automation tell |
|---|---|---|
| Automation framework artifacts | Playwright init scripts, navigator.webdriver, Selenium IDE selectors | Headless browsers often patch or hide APIs inconsistently |
| Input timing anomalies | Sub-millisecond keystrokes, instant form submits, zero-delay clicks | Scripts fill fields faster than human motor limits |
| Pointer movement patterns | Linear trajectories, grid-aligned paths, absent micro-tremor | Bot mice move in straight lines; humans jitter |
| Interaction gaps | No scroll, no focus changes, no mouse movement before click | Automation jumps straight to target element |
| Session structure | Uniform duration, missing referrer chain, single-page visits | Crawlers and click bots follow predictable scripts |
| Network inconsistencies | Data-center IP on residential ASN, port 8080/3128 open, TLS fingerprint mismatch | Proxy rotation breaks signal coherence |
Key facts from BotRefund's detection architecture
| Fact | Detail | Source |
|---|---|---|
| Independent checks | 106 distinct signals across browser, network, device, behavior | S1, S5 |
| Accuracy claim | 99% bot/human classification via AI corroboration model | S1, S5 |
| Cross-check method | Each signal tested against independent browser, network, device, behavior data | S1, S5 |
| AI prediction | Model weighs complete pattern instead of trusting raw rules | S1, S5 |
| Setup time | ~1 minute to add script and start free bot audit | S2, S6, S7 |
| Ad spend recovery | Refunds from Google/Meta billing disputes back to 2017 | S2, S6, S7 |
| Bot click impact | Up to 20% of Google and Meta ad budget lost to bot clicks | S2, S6, S7 |
| Evidence capture | Video proof recorded for each detected bot click | S2, S6, S7 |
Trade-offs: build vs. buy vs. hybrid
| Approach | Best fit | Setup effort | Control | Ongoing cost | Main limitation |
|---|---|---|---|---|---|
| Custom build | Unique threat model, in-house ML team, strict data residency | High (months) | Full | Engineering time | Hard to maintain signal coverage against evolving bots |
| Managed service (e.g., BotRefund) | Ad fraud focus, fast deployment, refund recovery needed | Low (minutes) | Configurable rules, limited model access | Per-seat or volume pricing | Dependent on vendor's signal updates |
| Open-source stack (FingerprintJS, CrowdSec) | Budget constraints, technical team, self-hosted | Medium (weeks) | Full code access | Hosting + maintenance | Signal library lags commercial feeds |
| Hybrid: vendor signals + custom model | Mature security team, specific false-positive tolerance | Medium (weeks) | Model control, vendor signal feed | Vendor fee + engineering | Integration complexity |
Choose custom build if you have a dedicated ML team and face novel automation techniques not covered by commercial feeds. Choose managed service if your primary pain is ad spend waste and you need refund-grade evidence quickly. Choose open-source if you need on-premise deployment and can invest in signal curation. Choose hybrid if you already have a scoring pipeline and want to augment it with a maintained signal feed.
Practical scenarios where detection succeeds or fails
Scenario: Click farm draining search ad budget
Bots click search ads, land on a landing page, and bounce instantly. Behavior layer catches zero scroll, zero mouse movement, sub-second dwell. Network layer shows data-center IPs. Browser layer reveals headless Chrome signatures. Score hits 0.98. Block and submit refund claim with session replay video.
Scenario: Sophisticated credential stuffing
Attackers use residential proxies, real Chrome via Puppeteer with stealth plugins, human-like mouse curves, and randomized delays. Individual signals look clean. Cross-check reveals timezone offset mismatches IP geolocation in 12% of requests. TLS fingerprint matches a known automation library. Combined score reaches 0.73 — challenge with proof-of-work, log for review.
Scenario: Privacy-conscious real user flagged
User runs hardened Firefox with privacy.resistFingerprinting, Tor exit node, no mouse movement (keyboard-only navigation). Browser layer shows anomalies. Network layer shows Tor. Behavior layer shows no mouse. Without cross-check context, score hits 0.85. With context: known privacy tool fingerprint, consistent keyboard navigation pattern, no automation framework artifacts. Score drops to 0.12. Allow.
Limitations and when this advice does not apply
- Client-side only: If you cannot run JavaScript (AMP pages, email clients, API endpoints), browser and behavior layers are unavailable. Rely on network and server-side heuristics only.
- Encrypted traffic inspection: TLS 1.3 with encrypted ClientHello hides JA3 fingerprints. Network layer loses a strong signal.
- Mobile apps: No mouse, different sensor stack, app attestation APIs replace browser fingerprinting. Requires separate SDK integration.
- Regulatory constraints: GDPR, CCPA, or sector rules may limit fingerprinting, IP storage, or behavioral profiling. Build consent and anonymization into the pipeline.
- Low-traffic sites: Training a custom model needs labeled volume. Below ~10k sessions/month, a managed service with pre-trained models is more practical.
FAQ
How many signals do I actually need?
Start with 15-20 high-signal checks across all four layers. Add more as you measure false-positive rates. BotRefund uses 106; most teams see diminishing returns after 30 well-chosen signals.
Can I detect bots without JavaScript?
Partially. Server-side headers, TLS fingerprints, IP reputation, and request timing give a baseline. But you lose browser fingerprinting, behavior, and device signals — the layers that catch sophisticated automation.
What false-positive rate should I target?
Under 0.1% for blocking actions. Higher is acceptable for challenge or log-only modes. Measure by sampling challenged sessions and manually verifying humanity.
How often do detection signals rot?
Browser automation frameworks update weekly. Browser APIs change quarterly. Plan to refresh at least 20% of your signal library every 90 days, or use a vendor that does this for you.
Does bot detection hurt Core Web Vitals?
A well-written script adds <5ms to main-thread time and <2KB gzipped. Load asynchronously, defer initialization, and use requestIdleCallback. Test with Lighthouse before and after.
Can I use the same system for ad fraud and account takeover?
Yes, but the signal weights differ. Ad fraud prioritizes click behavior and landing-page engagement. Account takeover prioritizes login velocity, credential stuffing patterns, and device continuity. Share the signal pipeline; run separate scoring models.
What evidence do ad platforms accept for refunds?
Google and Meta require timestamped session replays, IP logs, browser fingerprints, and a clear automation narrative. BotRefund packages these into dispute-ready reports. Self-built systems must produce equivalent documentation.
Terminology quick reference
- Headless browser: Browser running without a visible UI, typically controlled by automation scripts.
- Fingerprinting: Collecting browser/device attributes to create a stable identifier.
- JA3/JA3S: TLS client/server fingerprint hashes used to identify software stacks.
- Residential proxy: Proxy exit node on a consumer ISP IP range, harder to block than data-center IPs.
- Proof-of-work challenge: Computational puzzle that slows automated requests but is trivial for humans.
- Stealth plugin: Browser extension or script that masks automation artifacts (e.g.,
puppeteer-extra-plugin-stealth).
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.