Seatext library / BotRefund evidence
Common Mistakes When Interpreting a Single Anomaly in Bot Detection
Treating one odd signal as proof of bot traffic leads to false positives and wasted budget. Legitimate users on VPNs, corporate networks, or unusual devices often trigger isolated anomalies. Reliable detection requires corroborating evidence...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Why a single anomaly is not a verdict
BotRefund runs 106 independent checks on every visit. Each check produces a signal — a fact about the browser, hardware, or behavior. The CPU Concurrency Lie check, for example, looks for a mismatch between the processor a browser claims and the graphics, fonts, or audio stack it actually exposes. A virtual machine or spoofed profile often fails this test. But privacy tools, travel, corporate proxies, and rare device configurations can also create the same mismatch for a real person.
Because of that, BotRefund treats every signal as evidence, not a verdict. The system holds the signal, then cross-checks it against independent browser, network, device, and behavior data. Only when multiple independent signals tell the same story does the AI model classify the visit as bot or human. This corroboration-first approach is what drives the reported 99% accuracy.
Mistake 1: Acting on one check without context
Teams often block or flag a session the moment a single check fires — say, a missing mouse tremor or a superhuman input speed. That reaction ignores the legitimate reasons a real user might lack tremor (accessibility settings, touch screen) or appear fast (autofill, password manager). Without the surrounding context, you punish genuine visitors and skew your analytics.
Mistake 2: Ignoring the privacy and network layer
VPNs, Tor, corporate gateways, and carrier-grade NAT all rewrite IP reputation, timezone offsets, and TLS fingerprints. A visitor on a corporate laptop in a hotel lobby may show a data-center IP, a mismatched timezone, and a stripped-down font list — three anomalies that look like a bot farm. If you evaluate each anomaly in isolation, you miss the coherent explanation: a legitimate user on a managed network.
Mistake 3: Confusing anomaly density with bot probability
Some dashboards count how many checks fired and treat the count as a risk score. That assumes every check has equal weight and independence. In reality, several checks can stem from the same root cause — a headless browser, for instance, will simultaneously fail mouse tremor, linear movement, and superhuman speed checks. Counting them as separate strikes inflates the risk score without adding new information.
Mistake 4: Skipping the cross-check step
The source pack describes a three-step loop: independent evidence → cross-checked context → AI prediction. Teams that stop at step one — collecting raw signals — never reach the calibrated probability that comes from weighing the full pattern. They end up with a noisy rule set that requires constant manual tuning.
Mistake 5: Using anomalies to justify retroactive refunds without behavioral proof
Ad platforms (Google, Meta) require client-side behavioral evidence — GCLID/FBCLID logs, video replays, interaction timelines — to approve invalid-click refunds. A list of browser anomalies alone rarely meets that bar. BotRefund couples each anomaly with the behavioral session record so the refund package contains the forensic proof the platforms demand.
Mistake 6: Treating all anomalies as equal across device classes
Mobile Safari on iOS 16 behaves differently from Chrome on Android 13 or Firefox on a Linux desktop. A font-list anomaly that is rare on desktop may be common on a locked-down enterprise mobile device. Applying a single threshold across all device classes generates systematic false positives on the less-common platforms.
How BotRefund avoids these mistakes
BotRefund's pipeline is built around the principle that corroboration beats intensity. Each of the 106 checks — CPU Concurrency Lie, window.open Tamper, ghost click detection, honeypot traps, robotic linear mouse movements, absence of humanlike mouse tremor, superhuman input speed (<1ms), grid-aligned movement patterns, absence of clicks or scrolling, unnatural session durations — feeds an independent fact into the model. The model then evaluates the joint distribution of signals across browser, network, device, and behavior dimensions. Only visits where multiple independent dimensions align on the bot hypothesis receive a high-confidence classification.
This design also produces the artifacts refund teams need: per-visit signal logs, behavioral timelines, and exportable reports tied to GCLID and FBCLID identifiers. The free bot audit installs in about one minute with no credit card, and historical recovery reaches back to 2017 Google Ads spend.
Key facts
| Fact | Detail |
|---|---|
| Independent checks per visit | 106 |
| Core detection principle | Corroboration across browser, network, device, behavior — not single rules |
| Reported classification accuracy | 99% |
| Example anomaly checks | CPU Concurrency Lie, window.open Tamper, ghost clicks, honeypot traps, robotic mouse, missing tremor, superhuman speed, grid-aligned paths, static sessions, unnatural durations |
| Refund evidence | Client-side behavioral logs, GCLID/FBCLID capture, video proof, exportable dispute reports |
| Historical recovery window | Google Ads spend back to 2017 |
| Setup time | ~1 minute, no credit card |
| Ad budget loss estimate | Up to 20% of Google and Meta spend lost to bot clicks |
Limitations and when this advice does not apply
- If you run a pure server-side analytics stack with no client-side instrumentation, you cannot collect the behavioral signals (mouse tremor, click timing, scroll depth) that make cross-checking possible.
- High-security environments that block all third-party scripts will prevent the detection script from loading, so no anomalies — legitimate or malicious — are recorded.
- The 99% accuracy figure comes from BotRefund's internal evaluation; independent third-party benchmarks are not provided in the source pack.
- Refund approval rates depend on each ad platform's review process; BotRefund supplies evidence but does not guarantee credit issuance.
Terminology
- Anomaly (signal): A single measurable deviation from the expected browser/device/behavior baseline — e.g., CPU concurrency mismatch, missing mouse tremor.
- Corroboration: The process of requiring multiple independent signals from different dimensions (browser, network, device, behavior) to agree before classifying a visit.
- GCLID / FBCLID: Click identifiers appended by Google Ads and Meta Ads that link a visit to a specific paid click; required for refund disputes.
- Pixel poisoning: Corruption of conversion tracking pixels by bot traffic, causing optimization algorithms to optimize for bot-like behavior.
FAQ
What counts as a "single anomaly" in practice?
Any one of the 106 checks firing in isolation — for example, a visit that fails the CPU Concurrency Lie check but passes every other browser, network, device, and behavior check.
Why do legitimate users trigger anomalies?
Privacy tools (VPN, Tor, hardened browsers), corporate proxies, unusual hardware (rare GPU, external GPU docks), accessibility settings (reduced motion, no mouse), and travel (timezone/IP mismatch) all create real deviations that look suspicious in isolation.
How many corroborating signals are enough?
There is no fixed count. The AI model weighs the joint probability across dimensions. Two strong, independent signals (e.g., superhuman speed + missing tremor + honeypot trigger) can outweigh five weak, correlated signals from the same root cause.
Can I use anomaly data alone to file a Google Ads refund?
Google's Click Quality team expects client-side behavioral proof — GCLID logs, interaction timelines, video evidence. Anomaly lists support the case but rarely suffice on their own.
Does BotRefund block traffic automatically?
The source pack describes detection, evidence collection, and refund automation. Blocking decisions are left to the site owner; BotRefund provides the classification and proof.
What happens if I only have server-side logs?
You lose the client-side behavioral dimension (mouse, scroll, timing, fingerprint). Without it, corroboration across all four dimensions is impossible, and false-positive rates rise sharply.
How far back can I recover wasted spend?
BotRefund states recovery for Google Ads spend dating back to 2017, subject to platform dispute windows and evidence availability.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.