How We Found Out OpenAI Ads Sells Bot Clicks, Not Real Customers (58.1% Datacenter Bot Traffic Dispute)

When OpenAI launched its advertising platform, growth teams and digital marketers rushed to capture what was hyped as the highest-intent commercial ad placement on the internet: search answers and conversational prompts within ChatGPT and the OpenAI ecosystem.

At BotRefund (by SeaText Systems), our entire engineering infrastructure is dedicated to digital advertising forensics, invalid traffic (IVT) auditing, and automated bot mitigation. We monitor millions of daily ad visits across Google Ads, Meta, and Reddit. Naturally, we deployed test advertising campaigns on OpenAI Ads to acquire digital advertisers and B2B marketers who need click fraud protection.

Over a 48-hour audit window between October 13, 2026, and October 14, 2026, OpenAI Ads billed our account (Ad Account ID: adacct_6abafcc026b08195a785b29805051f3f) for 923 clicks totaling $933.09 USD.

Because every visitor to BotRefund passes through our edge behavioral telemetry, hardware entropy profiling, kinetic mouse tremor analysis, and DOM recording engine, we did what any forensics lab does: we audited every single incoming session.

The results were staggering: 58.1% of the arrivals billed by OpenAI Ads were confirmed automated bots and cloud scrapers—with 665 clicks originating directly from commercial Microsoft Azure datacenter servers rather than genuine human end-users.

1. Summary of Forensic Findings: The Reconciliation Audit

Between October 13, 2026, 00:00:00 UTC and October 14, 2026, 21:00:00 UTC, we compared the billing invoice and reporting dashboard provided by OpenAI Ads against our production database table (analytics_db.analytics_sessions).

Here is the side-by-side reconciliation of what OpenAI Ads reported versus what our biometric and network edge telemetry verified:

Note on Session vs. Click Counts: The 1,356 arrivals recorded by our edge servers represent total landing-page initializations bearing OpenAI's unique query markers (utm_source=openai and encrypted oppref tokens). This confirms our edge tracking was active, receiving requests, and logging every incoming HTTP socket. However, over half of these arrivals never exhibited human characteristics.

2. Technical Evidence of Invalid Traffic (IVT)

In digital advertising, traffic quality is regulated under the Media Rating Council (MRC) guidelines, divided into General Invalid Traffic (GIVT) and Sophisticated Invalid Traffic (SIVT).

Our detection engine evaluated every incoming arrival from OpenAI Ads against over 110 client-side and network signals. The evidence fell into four conclusive categories:

A. Commercial Datacenter Hosting (Microsoft Azure ASN 8075)

Out of 1,356 recorded sessions, 665 arrivals originated directly from Microsoft Corporation commercial hosting blocks (Autonomous System Number: ASN 8075).

Commercial cloud datacenters do not browse web pages to buy software. They run containerized workloads, CI/CD runners, and headless web scrapers. Under MRC GIVT definitions, known datacenter IP addresses must be filtered prior to auction clearing or automatically credited back to advertisers.

Yet OpenAI Ads allowed hundreds of clicks from its corporate partner's datacenter (Microsoft Azure) to participate in ad auctions, charge commercial Cost-Per-Click (CPC) fees, and bill an unsuspecting advertiser.

B. Sub-1.5 Second Synthetic Lifespans

A genuine business owner or performance marketer evaluating an ad fraud mitigation platform spends an average of 35 to 90 seconds reading landing page headlines, viewing architecture diagrams, and evaluating pricing tiers.

Among the 788 flagged OpenAI sessions, over 85% terminated within 1,500 milliseconds (1.5 seconds) from DOM load to socket disconnection. The visitor script initialized the page, fired tracking pixels, and vanished before any human retina could process a single sentence.

C. Total Absence of Human Kinetic Tremor

Human hands cannot move a physical mouse or touch a screen with mathematical perfection. Due to neuromuscular physiology, every human exhibits microscopic motor tremor (8–12 Hz micro-oscillations) and non-linear acceleration curves.

BotRefund measures client-side kinetic dynamics: mouse trajectory curvature, acceleration variance, and micro-tremor entropy. Across the flagged cohort of OpenAI clicks:

• Mouse linearity: 1.00 (perfect straight synthetic vectors) or null.
• Micro-tremor score: 0.00 across all 788 flagged sessions.
• Touch surface area: 0.00 (indicative of headless Chromium running inside Docker containers via Puppeteer or Playwright).

D. Encrypted OpenAI Click Reference Tokens Captured

To prove beyond legal and technical doubt that these datacenter sessions were directly served, routed, and billed by OpenAI Ads, our edge servers captured OpenAI's proprietary encrypted URL tracking parameters (oppref and olref).

Here is an actual forensic log entry extracted directly from our database:

3. The Auction Economics: Paying $2.40+ for Headless Scrapers

What makes this incident particularly concerning for any advertiser testing OpenAI Ads is the auction clearing mechanism.

In mature ad platforms like Google Ads or Bing Ads, advertisers have access to account-level budget limits, negative keyword lists, search partner exclusions, and historical automated invalid traffic credits. While Google and Meta still suffer from 15% to 23% bot rates, they have basic filters that catch blatant datacenter IP hits.

In OpenAI Ads, our account was billed at rates upwards of $2.40 per click on traffic that had zero chance of ever converting into paying customers. Without real-time pre-bid filtering, our ad spend was consumed by cloud server requests in less than 48 hours.

4. The Formal Dispute Letter Sent to OpenAI Ads

On October 14, 2026, BotRefund submitted a formal legal and billing dispute to the OpenAI Ads Support and Trust & Safety teams. Below is the unabridged record of our formal communication:

5. What Advertisers Running OpenAI Ads Must Do Right Now

If your business is currently testing or scaling OpenAI Ads, do not assume that an emerging AI platform has solved click fraud. In fact, because AI interfaces are heavily scraped by third-party research bots, automated scrapers, and competitive monitoring tools, the risk of invalid traffic is even higher than on legacy search engines.

Here is the 4-step protocol every advertiser should follow immediately:

1. Log full URL query strings: Ensure your analytics servers capture OpenAI's unique oppref and olref parameters. Do not allow your frontend routing framework to strip these query parameters before logging.
2. Screen visitor ASNs at your CDN tier: Look at the Autonomous System Numbers visiting your landing pages from OpenAI campaigns. If you see significant traffic from Microsoft Azure (ASN 8075), Amazon AWS (ASN 16509), Google Cloud (ASN 15169), or DigitalOcean, you are paying for datacenter scrapers.
3. Suppress your conversion pixels on invalid traffic: When a bot clicks your OpenAI ad, do not let your Google, Meta, or OpenAI conversion tags fire. If you fire conversion tags on bot traffic, Smart Bidding algorithms will double down on targeting more bot networks.
4. Audit your traffic and file formal billing disputes: Save timestamped click logs and dispute the charges. Ad platforms are legally required under commercial advertising contracts to provide clean, human inventory.

Frequently Asked Questions

Why are bots clicking ads on OpenAI?

Automated scrapers, competitive intelligence crawlers, and AI agent test scripts constantly query search interfaces and conversational prompts. When ads are injected into conversational or search answers, headless bots executing automated queries click on sponsored links either intentionally (link scrapers) or programmatically via automated link-traversal routines.

What is Microsoft Azure ASN 8075?

ASN 8075 is the primary autonomous system network registered to Microsoft Corporation for hosting Microsoft Azure cloud servers, virtual machines, and cloud functions. Genuine consumers browsing the web do not browse from datacenter IP addresses.

Can advertisers get refunds for invalid bot clicks?

Yes. Under digital advertising industry standards (including MRC accreditation and platform terms), advertisers cannot be billed for invalid traffic (IVT), including automated scrapers, datacenter IP requests, and click fraud. However, ad networks require concrete forensic proof—such as timestamped logs, captured click tokens, and behavioral telemetry—to approve credit adjustments.

How does BotRefund detect bot clicks in real time?

BotRefund inspects over 110 client-side and network signals at the edge, including WebGL canvas entropy, mouse micro-tremor mechanics, headless browser leaks, and IP/ASN datacenter registries. It blocks conversion pixels from firing on bots and exports compliance-ready dispute dossiers to recover your wasted ad spend.