Seatext library / BotRefund evidence
When to Use Multiple Bot Detection Signals: A Readiness Checklist
You should use multiple bot detection signals whenever a single signal can be spoofed, when false positives are costly, or when you need high confidence before blocking or refunding a session. Single checks like...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
You should use multiple bot detection signals whenever a single signal can be spoofed, when false positives are costly, or when you need high confidence before blocking or refunding a session. A single anomaly — whether it's a WebGL texture mismatch, a suspicious port, or a monitor sync irregularity — is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps each signal as evidence and cross-checks it against independent browser, network, device, and behavior data before its prediction AI weighs the complete pattern.
Why single signals fail on their own
Modern bots run on anti-detect automation frameworks, residential proxies, and CAPTCHA farms. They can spoof user-agent strings, canvas fingerprints, and even WebGL renderer strings. A single check catches only the bots that fail to spoof that specific attribute. Legitimate visitors also trigger anomalies: privacy-hardened browsers, corporate VPNs, virtual desktops, and rare hardware configurations all look suspicious in isolation. If you block on one signal, you lose real customers. If you ignore it, you waste ad budget on bot clicks that can steal up to 20% of Google and Meta spend.
The source pack makes this explicit: "A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps this signal as evidence — not a verdict — and cross-checks it against independent browser, network, device, and behavior data." (S1)
Readiness checklist: signs you need corroborated detection
Use this checklist to decide whether your current setup should move from single-signal rules to a corroborated approach. Check each item that applies to your situation.
- You block or challenge visitors based on one fingerprint check. If your WAF or CDN drops traffic because WebGL renderer doesn't match the claimed device, you are turning evidence into a verdict.
- False positives cost you revenue or trust. E-commerce checkout blocks, lead-form rejections, or support tickets from real users flagged as bots mean your threshold is too aggressive for a single signal.
- You run paid campaigns on Google or Meta. Ad platforms require evidence before approving refunds. Video proof and a pattern of corroborated signals — not one odd header — are what get money back.
- Your traffic includes corporate, VPN, or privacy-tool users. These segments routinely produce mismatches in hardware, graphics, fonts, audio, or processor behavior that look like bots on any single check.
- You see sophisticated bot patterns in logs. Residential proxy rotation, headless Chrome with stealth plugins, and behavioral mimicry (mouse tremor, scroll timing) defeat single-vector detection.
- You need to suppress conversion events for platform AI training. Feeding Google and Meta only verified human conversions improves CAC; that requires high-confidence classification, not a rule on one signal.
- Your team cannot manually review every flagged session. An AI model that weighs 106 signals reduces the review queue to the genuinely ambiguous cases.
If you checked three or more items, a corroborated approach is the next step. If you checked one or two, you may still benefit from adding a second independent signal before committing to a full multi-signal pipeline.
How corroborated detection works
BotRefund runs 106 independent checks across five categories: hardware and GPU fingerprinting, network/VPN/geolocation evasion vectors, biometric and behavioral interactions, click and pointer behavior, and session-level patterns. Each check produces an independent piece of evidence. The system then cross-checks whether other signals support the same story. Finally, a prediction AI evaluates the complete pattern across browser, network, device, and behavior evidence to identify a visit as bot or human with 99% accuracy.
As the WebGL Texture Constraint page explains: "BotRefund sends this signal into our prediction AI, which evaluates the complete picture across browser, network, device, and behavior evidence. By seeing how all signals fit together, it identifies a visit as bot or human with 99% accuracy. Accuracy comes from corroboration, not one browser tell." (S1)
The same three-step logic applies to every signal: independent evidence, cross-checked context, AI prediction. The Suspicious Ports check follows the identical pattern: "This signal adds one objective fact about the visit. BotRefund tests whether other signals support the same story. Our model weighs the complete pattern instead of trusting a raw rule." (S5)
Key signal categories and what they catch
Understanding the categories helps you see why no single check covers the full threat surface. Each category addresses a different spoofing surface.
| Category | Example checks | What it catches | Why it needs corroboration |
|---|---|---|---|
| Hardware & GPU fingerprinting | WebGL Texture Constraint, JS Engine Mismatch, Canvas Fingerprint | Virtual machines, spoofed device profiles, headless browsers | Privacy browsers and rare hardware produce false mismatches |
| Network, VPN & geolocation | Suspicious Ports, Proxy Detection, Timezone/language consistency | Proxy rotation, location masking, browser spoofing | Corporate proxies, travel, and legitimate VPNs trigger alerts |
| Biometric & behavioral | Monitor Sync Anomaly, Mouse Tremor, Scroll Dynamics | Automation frameworks that lack human micro-movements | Accessibility tools, motor impairments, and mobile input differ |
| Click & pointer behavior | Ghost Click Detection, Honeypot Traps, Linear Mouse Movements, Grid-aligned Paths | Click farms, coordinate-based automation, replay attacks | Legitimate fast users, keyboard navigation, and assistive tech |
| Session-level patterns | Unnatural Durations, Absence of Clicks/Scrolling, Superhuman Input Speed (<1ms) | Hit-and-run bots, scraper loops, form-spam scripts | Bounce-heavy landing pages, single-page apps, speed readers |
The homepage lists these behaviors explicitly: ghost click detection, honeypot trap interactions, robotic linear mouse movements, absence of humanlike mouse tremor, superhuman input speed (<1ms), grid-aligned movement patterns, absence of clicks or scrolling, and unnatural session durations. (S2)
Practical scenarios: when to escalate from single to multiple signals
Scenario 1: E-commerce checkout protection
You block checkouts that fail a WebGL check. Legitimate customers on corporate VDI or privacy browsers complain. Add a second signal — mouse tremor or scroll behavior — and only challenge when both disagree with the claimed device. The AI model then weighs the pair against the full 106-signal baseline.
Scenario 2: Lead-gen refund requests to Meta
Meta rejects your invalid-traffic claim because you only showed a port anomaly. You add session-duration distribution, click-path uniformity, and form-completion timing. The corroborated pattern — fast fills, no scroll, suspicious port, residential proxy IP — meets the evidence bar. The blog notes: "Start with a structured audit that compares ad-platform data, website sessions, and CRM outcomes before changing targeting or making a refund request." (S3)
Scenario 3: Training platform conversion AI
You suppress conversions for any session flagged by a honeypot trap. You lose 5% of real conversions. Switch to a corroborated threshold: suppress only when honeypot + superhuman speed + no scroll all align. The FinTrust case study shows the impact: "Suppressed conversion events for automated browser emulation signals, ensuring Facebook & Google AI trained only on verified bank accounts" — resulting in $140,000 refunded, 14% bot click rate, and 18% conversion rate increase. (S6)
Limitations and when this advice does not apply
- Ultra-low-traffic sites. If you receive fewer than 1,000 sessions per month, the AI model has less pattern data; a well-tuned two-signal rule may outperform a data-hungry model.
- Strict regulatory environments. Some jurisdictions require explainable, rule-based decisions. A 106-signal AI score may not satisfy audit requirements without a rules fallback.
- Real-time blocking at the edge. If you must decide in <5 ms at a CDN edge node, you may only run 3-5 lightweight checks. Corroboration still helps, but you cannot run the full suite.
- Non-advertising use cases. Content scraping, account takeover, and API abuse have different signal priorities; the 106-check mix is optimized for ad-click and lead-form protection.
Key facts
| Fact | Detail | Source |
|---|---|---|
| Total independent checks | 106 | S1, S5, S9 |
| Reported accuracy | 99% when full corroboration pipeline is used | S1, S5 |
| Core principle | Single anomaly = evidence, not verdict | S1, S5 |
| Cross-check domains | Browser, network, device, behavior | S1, S5 |
| AI role | Weighs complete pattern instead of trusting a raw rule | S1, S5 |
| Ad budget at risk | Up to 20% of Google and Meta spend lost to bot clicks | S2, S4, S7, S8 |
| Refund lookback | Google Ads spend dating back to 2017 | S2, S4, S7, S8 |
| Setup time | About one minute to add to website | S2, S4, S7, S8 |
| Case study result | FinTrust: $140k refunded, 14% bot click rate, 18% conversion lift | S6 |
Terminology
- Signal / check: One independent test (e.g., WebGL Texture Constraint) that produces a binary or scalar anomaly score.
- Evidence: The output of a signal, kept as a fact without immediate action.
- Corroboration: The process of testing whether multiple independent signals support the same conclusion.
- Prediction AI: The model that ingests all evidence and outputs a bot/human probability.
- Suppression: Preventing a conversion event from being sent to ad platforms so their optimization algorithms train only on verified humans.
- False positive: A legitimate visitor classified as a bot, resulting in blocked access, lost sale, or polluted analytics.
FAQ
How many signals do I need before the AI becomes reliable?
The system runs all 106 checks on every session. You don't choose a subset; the AI learns which signals matter for your traffic. Even with 20-30 active signals on a given session, the model outperforms any single rule.
Can I run corroborated detection only on paid traffic?
Yes. You can scope the script to landing pages with UTM parameters or referrer headers. Organic and direct traffic still gets the free bot audit view, but suppression and refund evidence focus on paid sessions.
What happens if a privacy tool triggers three signals at once?
The AI sees the combination — e.g., WebGL mismatch + timezone offset + canvas noise — and compares it to the learned pattern for that privacy tool. If the cluster matches a known legitimate tool profile, the session scores human. Unknown clusters go to review.
Does this replace my WAF or CDN bot rules?
It complements them. Keep your WAF for volumetric attacks and known-bad IPs. Use corroborated detection for the sophisticated, low-volume bots that mimic human headers and residential IPs — the ones WAFs miss.
How long before I see refund-ready evidence?
Evidence accumulates from the first session. Refund claims typically need 30-90 days of corroborated data to show a pattern ad platforms accept. The free bot audit starts immediately and shows the signal breakdown per session.
What if my ad spend is under $10,000/month?
The same detection runs. The pricing tiers start at under $10,000/mo. The readiness checklist still applies: if you check three or more items, corroborated detection pays for itself by stopping waste and enabling refunds.
Can I export the signal data to my own data warehouse?
Yes. The platform provides session-level signal exports via API and webhook so you can join with CRM outcomes and run your own attribution models.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.