Seatext library / BotRefund evidence
Which Metrics Should You Focus On to Identify Bot-Like Behavior?
Focus on movement speed, acceleration variance, and path complexity. These three behavioral metrics catch the most bot-like actions because bots move in ways humans never do—too fast, too straight, or too uniform. Also watch...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Why behavioral metrics beat static signals
Static signals like IP address, user-agent string, or geolocation look useful, but advanced bots easily fake them. Residential proxies, headless browsers, and automation tools rotate IPs and spoof headers. Behavioral metrics—how a visitor actually moves, clicks, and interacts—are much harder to mimic because they require human-like randomness.
BotRefund’s detection system evaluates 106 signals together, but the most reliable ones are behavioral. One signal can be misleading, but a pattern of movement, speed, and path anomalies is a strong indicator of non-human traffic.
The three movement metrics that matter most
1. Movement speed
Bots often interact faster than any human can. Superhuman input speed—clicks or keystrokes under 1 millisecond—is a clear red flag. Real users take at least 50–100 milliseconds for a simple click, and longer for complex actions. If your analytics show interactions under 1ms, that’s bot-like behavior.
2. Acceleration variance
Human mouse movement has tiny imperfections called tremor and jitter. Bots move in unnaturally smooth, straight lines or with perfect acceleration curves. Acceleration variance measures the inconsistency in speed changes. Humans vary speed naturally; bots often maintain constant acceleration or snap to grid points. The absence of humanlike mouse tremor is a strong signal.
3. Path complexity
Real users move the cursor in curved, organic paths. Bots, especially automated scripts, produce grid-aligned movement patterns—straight lines that snap to precise coordinates. Path complexity detects whether the movement follows natural curves or artificial straight lines. Grid-aligned patterns are almost always bot-generated.
Engagement and session metrics: the backup check
Not all bots move the cursor. Some load a page and stay static. That’s where engagement metrics help:
- Absence of clicks or scrolling – A session that shows no scroll, no click, and no hover is suspicious. Real users at least move the mouse or scroll.
- Unnatural session durations – Extremely short visits (under 2 seconds) or extremely long visits with no activity often indicate automated page loading.
- Pointer behavior – Bots that do move often use linear pointer paths. Flags for unnaturally straight pointer paths catch these.
Combine these with the three movement metrics for a more complete picture.
Metrics that look useful but often mislead
Some commonly cited metrics are unreliable on their own:
- IP address and geolocation – Bots use residential proxies from real homes. A mismatched location or VPN can be a clue, but it’s not proof. Many legitimate users use VPNs.
- User-Agent string – Headless browsers and automation tools can spoof any user-agent. A mismatched user-agent (e.g., Chrome on Linux but Windows OS) is suspicious, but not definitive.
- Browser properties – WebRTC leaks or DNS mismatches indicate evasion, but alone they don’t confirm bot behavior. They need to be paired with behavioral signals.
A decision rule: combine, don’t isolate
No single metric is enough to call a visit bot-like. The rule is: look for a pattern across multiple behavioral metrics. If you see superhuman speed and grid-aligned path and no scrolling, you have a high-confidence bot. If only one metric flags, treat it as suspicious but not conclusive.
BotRefund’s approach is to evaluate the full pattern across 106 signals—not just one suspicious browser property. This reduces false positives and gives you a reliable classification.
Practical scenarios for applying these metrics
Consider a landing page for a high-ticket B2B product. A visitor arrives, moves the mouse in a straight line to the CTA, clicks in under 1ms, and leaves. That’s three flags: low path complexity, superhuman speed, and short session. This is almost certainly a bot.
Now imagine a visitor who scrolls slowly, hovers over text, and clicks after 200ms. Even if the IP is flagged as a proxy, the behavioral pattern is human. Trust the behavior over the static signal.
Another scenario: a mobile app user. Swipe movements differ from mouse movements. Acceleration variance is less useful because touch gestures are naturally smoother. In that case, rely more on session duration and engagement signals like tap timing.
Limitations and edge cases
Behavioral metrics work best on desktop and web-based interactions. Mobile apps, in-app browsers, and touch devices have different movement patterns. For example, swiping versus mouse movement. Also, some advanced bots mimic human behavior using recorded sessions or AI-generated movements. In those cases, you need deeper analysis of browser automation artifacts (like CDP debugger leaks) or network-level checks. BotRefund’s system includes both behavioral and evasion signals to catch even sophisticated bots.
False positives can happen. A user with a very fast mouse or a touchpad might generate near-linear paths. That’s why you combine metrics. A single flag is not enough. Also, users with motor disabilities may have unusual movement patterns. Always consider accessibility and use a threshold that avoids penalizing real users.
Key facts about bot detection metrics
| Detection Vector | What It Checks | Why It Matters |
|---|---|---|
| WebRTC Network Leak | Conflicting network paths | Indicates proxy/VPN use |
| DNS Tunnel Leak | DNS vs web traffic route | Indicates traffic tunneling |
| Timezone Evasion | Location and language agreement | Bots often mismatch timezone and language |
| Superhuman Input Speed | Clicks under 1ms | Faster than human possible |
| Grid-Aligned Movement | Straight-line pointer paths | Bots snap to grid; humans curve |
| Absence of Humanlike Tremor | Mouse jitter | Bots lack natural imperfections |
| Unnatural Session Duration | Too short or too uniform | Bots load pages without browsing |
FAQ: Your next questions about bot detection metrics
How do I capture these metrics?
You need client-side JavaScript that tracks mouse events, scroll events, and timing. Tools like BotRefund install a snippet that automatically records movement speed, path, and engagement data.
What if I have no movement data (e.g., server-side logs)?
Server logs only show IP, user-agent, and timestamps. You won’t see movement metrics. You need client-side tracking to capture behavioral data. Without it, you rely on less reliable static signals.
Can these metrics have false positives?
Yes. A user with a very fast mouse or a touchpad might generate near-linear paths. That’s why you combine metrics. A single flag is not enough.
How many metrics should I check before calling a visitor a bot?
At least three behavioral metrics. The more signals that agree, the higher the confidence. BotRefund uses a decision model that weighs all 106 signals together.
Are these metrics enough to get a refund from Google or Meta?
Platforms require evidence of invalid clicks. Behavioral metrics, combined with click IDs and session logs, form a strong refund case. Most high-volume advertisers see an 83% refund approval rate with proper evidence.
What about bots that don’t move the mouse?
Those are caught by engagement metrics—absence of clicks, scrolling, or hover. If a page loads and stays completely static, that’s also abnormal.
Can bots mimic human movement?
Some advanced bots use recorded mouse paths or AI to generate human-like curves. But they still miss natural tremor and randomness. Behavioral metrics combined with browser automation detection (like CDP leaks) catch these.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.