Seatext library / BotRefund evidence
How BotRefund Combines 106 Detection Signals to Identify Bot Traffic
BotRefund layers browser integrity checks, network anomaly detection, and behavioral biometrics into a single AI model. Each visit passes through 106 independent signals — such as console debug evaluation, window.open tampering, suspicious port usage,...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
BotRefund does not rely on a single technique. Instead, it runs 106 independent checks across three broad categories — browser and API integrity, network and geolocation consistency, and behavioral biometrics — then feeds every signal into a prediction model that weighs the full pattern. A single anomaly is never treated as a verdict; it becomes one piece of evidence that is corroborated or contradicted by the other signals.
Browser and API integrity checks
Automation tools often patch or hide browser APIs to avoid detection. BotRefund probes for the mismatches these patches create. The Console Debug Evaluator looks for inconsistencies in built-in properties, permissions, and rendering contexts that a normal browser session would not produce. Automation tools often patch or hide browser APIs, but those changes can break when the browser is checked from another angle. The window.open Tamper check detects scripts that attempt to spoof or suppress the native window.open behavior. A real visitor produces imperfect, varied behavior: pauses, hesitation, natural movement, and interactions shaped by reading and decision-making. Scripts can send clicks and scrolls, but they struggle to reproduce the varied timing, movement, and hesitation of real people. These checks add objective facts about whether the browser environment matches a genuine user agent.
Additional browser-level signals include checks for JavaScript engine mismatches, headless browser artifacts, and automation framework fingerprints. Each signal is designed to be difficult to spoof without introducing new inconsistencies elsewhere. The system evaluates whether the browser's reported capabilities align with its actual behavior under test conditions.
Network, VPN, and geolocation evasion vectors
A real visitor's connection, language, timezone, and IP reputation usually form a coherent picture. The Suspicious Ports check flags proxy rotation, location masking, or browser spoofing that causes separate network facts to disagree. When a session claims a residential IP but communicates through ports commonly used by data-center proxies, that discrepancy becomes a signal — not a block — that the model weighs alongside behavioral data. A real visitor's connection, location, language, and timing normally agree with one another. A browser on a home or mobile network may vary, but its signals still form a coherent picture. Proxy rotation, location masking, or browser spoofing can make separate network facts disagree.
Beyond port analysis, the system examines TLS fingerprint consistency, DNS resolution patterns, and IP reputation scores. It checks whether the declared timezone matches the IP geolocation, whether the language headers align with the geographic region, and whether connection latency patterns fit the claimed network type. These network signals are particularly valuable because they are difficult for bot operators to falsify completely without access to genuine residential infrastructure.
Behavioral biometrics: movement, timing, and interaction patterns
Human input is imperfect. BotRefund measures dozens of micro-behaviors that scripts struggle to replicate consistently:
- Pointer behavior — robotic linear mouse movements and grid-aligned paths that snap to precise lines instead of natural curves. Flags unnaturally straight pointer paths that rarely appear in real user sessions.
- Motion behavior — absence of the tiny tremor and jitter present in human hand movement. Looks for the tiny imperfections and jitter typical of human movement.
- Speed behavior — superhuman input speeds under one millisecond. Identifies interactions that happen faster than a person could realistically perform.
- Path behavior — grid-aligned movement patterns that snap to precise lines or blocks instead of natural curves. Detects movement that snaps to precise lines or blocks instead of natural curves.
- Click behavior — ghost clicks that fire without the natural sequence of human intent, and honeypot trap interactions with hidden page elements. Catches click activity that happens without the natural sequence of human intent. Watches for bots that respond to hidden or intentionally deceptive page elements.
- Engagement behavior — sessions with no scrolling, no field corrections, and no meaningful time on page. Highlights sessions that stay too static to match a real browsing journey.
- Session behavior — visit lengths that are too short, too long, or too uniform to be human. Catches visit lengths that are too short, too long, or too uniform to be human.
- Tab navigation — impossible tab-switching speeds that exceed human reaction time. Scripts can send clicks and scrolls, but they struggle to reproduce the varied timing, movement, and hesitation of real people.
Each behavioral signal captures a dimension of human-computer interaction that is computationally expensive to simulate convincingly. The system records not just whether an action occurred, but the precise timing, trajectory, and context of that action. This granularity allows the model to distinguish between a fast human user and an automated script even when both complete the same sequence of steps.
From independent evidence to AI prediction
Each of the 106 checks produces an independent evidence signal. BotRefund then cross-checks every signal against the others: does the browser fingerprint agree with the network data? Do the mouse movements match the session duration? The prediction model evaluates the complete pattern rather than applying a raw rule. This corroboration approach is what the company cites for its stated 99% accuracy — accuracy comes from the convergence of many weak signals, not from any single strong tell. BotRefund sends this signal into our prediction AI, which evaluates the complete picture across browser, network, device, and behavior evidence. By seeing how all signals fit together, it identifies a visit as bot or human with 99% accuracy.
The AI model is trained on labeled datasets of confirmed human and bot traffic. It learns the conditional dependencies between signals — for example, how a specific browser anomaly correlates with certain behavioral patterns in automated traffic versus legitimate privacy-tool usage. The model outputs a probability score rather than a binary decision, allowing downstream systems to apply different thresholds for different use cases such as ad suppression versus refund claim generation.
Why a single anomaly is not a verdict
Privacy tools, corporate networks, unusual devices, and travel can all produce unexpected browser or network behavior for genuine users. If BotRefund treated any one signal as decisive, false positives would rise sharply. By keeping each check as evidence and requiring the AI to weigh the full context, the system tolerates legitimate edge cases while still catching automated traffic that fails across multiple dimensions simultaneously. A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps this signal as evidence — not a verdict — and cross-checks it against independent browser, network, device, and behavior data.
This design philosophy reflects a fundamental trade-off in bot detection: aggressive blocking catches more bots but also blocks real users. BotRefund chooses classification over blocking, accepting that some sophisticated bots may initially pass but will be caught when their cumulative signal pattern diverges from human norms. The evidence-based approach also creates an audit trail — each classification can be traced back to the specific signals that contributed to it, which is essential for refund negotiations with ad platforms.
How the combined output is used
The final bot-or-human classification feeds two downstream workflows. First, it suppresses conversion events for automated sessions so that Google and Meta ad algorithms train only on verified human interactions. Second, it generates video proof and audit trails for each bot click, which the BotRefund team uses to negotiate refunds from ad platforms. The detection layer itself does not block traffic; it classifies it so that downstream actions — suppression, refund claims, audience exclusion — rest on documented evidence. Bot clicks steal up to 20% of your Google and Meta ad budget. BotRefund proves bot clicks, negotiates with Google and Meta, and gets your money back.
In practice, the suppression workflow integrates with ad platform APIs to prevent bot conversions from feeding into optimization algorithms. This protects the advertiser's bidding strategy from being corrupted by fake conversions. The refund workflow packages video recordings, signal breakdowns, and session timelines into evidence packages that meet the documentation requirements of Google Ads and Meta advertising policies. The FinTrust case study demonstrates this: the neobank recovered $140,000 in ad spend with a 14% average bot click rate and saw an 18% conversion rate increase after suppression.
Key facts
| Category | Example checks | Signal type |
|---|---|---|
| Browser/API integrity | Console Debug Evaluator, window.open Tamper | Environment consistency |
| Network/geolocation | Suspicious Ports | Connection coherence |
| Behavioral biometrics | Pointer, Motion, Speed, Click, Engagement, Session, Tab Speed | Human micro-behavior |
| Aggregation | 106 independent signals → AI prediction model | Corroborated verdict |
Limitations and when this approach does not apply
The 106-check model is designed for web traffic that executes JavaScript in a browser context. It does not analyze server-to-server API calls, native mobile app traffic, or non-browser clients. Organizations whose ad spend flows primarily through app-install campaigns or API-driven conversions would need a complementary solution. Additionally, the system classifies but does not block; enforcement (suppression, exclusion, refund filing) happens in the ad platforms or via the BotRefund dashboard.
Another limitation is that the system requires JavaScript execution on the landing page. Users with JavaScript disabled or heavily restricted browser configurations may not generate sufficient signals for reliable classification. The system also assumes the traffic reaches the website — it cannot detect bots that click ads but never load the destination page. For such scenarios, ad platform click-quality reports and server-side log analysis remain necessary complements.
Terminology
- Independent evidence — a single check's output, treated as a fact rather than a decision.
- Cross-checked context — the process of testing whether multiple signals support the same conclusion.
- AI prediction — the model that weighs the full pattern of signals to issue a bot-or-human classification.
- Ghost click — a click event that fires without the preceding human intent sequence (hover, movement, dwell).
- Honeypot trap — a hidden page element that only automated scripts interact with.
FAQ
How many checks does BotRefund run per visit?
106 independent checks across browser, network, and behavioral categories.
Does a single failed check mean the visitor is a bot?
No. Each check contributes evidence. The AI model requires corroboration across multiple signals before classifying a session as automated.
Can privacy tools or corporate VPNs cause false positives?
They can produce anomalous signals, but because the model cross-checks all 106 inputs, legitimate users on unusual networks typically still pass the overall pattern test.
What happens after a session is classified as a bot?
BotRefund suppresses the conversion event so ad platforms don't optimize for it, and it captures video proof for refund claims against Google and Meta.
Does BotRefund block bot traffic in real time?
No. It classifies traffic and provides evidence for suppression and refund workflows. Blocking is handled by the ad platforms or your own firewall rules.
Is the 99% accuracy claim independently verified?
The source pack states the figure as a company claim based on corroboration logic. Independent third-party verification is not referenced in the provided materials.
What ad platforms does the refund process cover?
Google Ads and Meta (Facebook/Instagram) are the platforms named in the source pack for refund negotiation and recovery.
How long does it take to set up BotRefund on a website?
The source pack indicates typical setup time is about one minute with no credit card required for the free bot audit.
Can BotRefund detect bots on mobile apps?
The current model is designed for web traffic executing JavaScript in a browser context. Native mobile app traffic and server-to-server API calls are not analyzed by this system.
What is the typical bot click rate found in ad campaigns?
The FinTrust case study reported a 14% average bot click rate. The homepage states bot clicks can steal up to 20% of Google and Meta ad budgets.
How far back can refund claims go?
The source pack mentions recovery of bot-click refunds from Google Ads spend dating back to 2017.
What evidence does BotRefund provide for refund claims?
Video proof and audit trails for each bot click, including signal breakdowns and session timelines that meet ad platform documentation requirements.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.