botrefund.com
DETECTION ARCHITECTURE • 180+ SIGNALS

Why BotRefund is 99% accurate at detecting bots.

One signal can be misleading. BotRefund’s prediction AI evaluates how 180+ browser, network, hardware, and behavioral signals fit together before determining whether a click is human or automated.

Add Free Bot Protection → Explore Detection Signals ↓
CUSTOMER RESULTS

Trusted by businesses fighting bot traffic

Global Payments Network Fintech Recovery
$1.2M refunded

High-CPC emulator surges blocked

Submitted forensic GCLID session proof to Google Ads reviewers to reclaim search ad budget.

PMax Recovery
$32.4K refunded

Performance Max fake leads

Exposed automated form-fill bots that polluted smart bidding algorithms and wasted spend.

Search Defense
$45.0K recovered

Competitor $40 CPC click fraud

Identified rival scraping rings burning daily B2B search budgets by noon with residential proxies.

SaaS Audit
$18.2K recovered

CRM lead score protection

Cleaned HubSpot pipeline data and stopped headless crawlers submitting fake enterprise trials.

Meta Advantage+
+34% ROAS lift

Meta pixel signal cleansing

Real-time pixel suppression stopped non-human events from corrupting campaign lookalike models.

Healthcare
-18% CPA reduction

Overseas proxy disguise

Uncovered foreign automated visits routed through US datacenters charged at top domestic rates.

Travel & Hospitality
$24.5K refunded

Retargeting scraper shield

Eliminated competitive fare scrapers from triggering expensive dynamic retargeting ads.

SIGNAL FAMILY

Network, Transport, Proxy, & Geolocation Evading Vectors

01
WebRTC Network Leak Checks whether browser network paths reveal conflicting locations.
02
DNS Tunnel Leak Checks whether DNS and web traffic follow the same route.
03
Timezone Evasion Checks whether location and language settings agree.
04
Latency Mismatch Checks whether connection and browser request details stay consistent.
05
Suspicious Ports Checks whether the visitor’s network identity is coherent.
06
Public Proxy Listener Checks whether the visitor’s network identity is coherent.
07
ProxyCheck.io Reputation Checks whether the visitor’s network identity is coherent.
08
UTC Timezone Bias Checks whether location and language settings agree.
09
Languages Mismatch Checks whether location and language settings agree.
10
Netprobe Telemetry Missing Checks whether the visitor’s network identity is coherent.
11
IP Address Inconsistency Checks whether the visitor’s network identity is coherent.
12
OS / TCP TTL Mismatch Checks whether the visitor’s network identity is coherent.
13
HTTP User-Agent Mismatch Checks whether connection and browser request details stay consistent.
14
Transport Browser Mismatch Checks whether the visitor’s network identity is coherent.
15
Residential Proxy TCP Clamping Checks whether the visitor’s network identity is coherent.
16
Direct API Attack Checks whether the visitor’s network identity is coherent.
17
Privacy Relay Network Checks whether the visitor’s network identity is coherent.
18
Datacenter ASN Fallback Checks whether the visitor’s network identity is coherent.
SIGNAL FAMILY

Edge Intelligence, WAF & Impostor Detection

19
AWS WAF Threat Intel Block Checks whether the browser profile behaves like a real device.
20
Oracle WAF Threat Intel Block Checks whether the browser profile behaves like a real device.
21
Edge Risk Score (Fastly Strict) Checks whether the browser profile behaves like a real device.
22
Impostor Googlebot Checks whether the browser profile behaves like a real device.
23
Impostor Bingbot (Fake Bing) Checks whether the browser profile behaves like a real device.
24
Known Crawler on Paid Ad Click Checks for natural human movement, timing, and reading behavior.
25
Zero-JS Scraper (Edge Canary) Checks whether the browser profile behaves like a real device.
26
CSS-Only Headless (Edge Canary) Checks whether the browser profile behaves like a real device.
27
Search Endpoint Scraper (Edge Canary) Checks whether reported device hardware matches execution behavior.
28
Hyperlink Scraper (Edge Canary) Checks whether the browser profile behaves like a real device.
29
Edge JA3 / UA Mismatch Checks whether the browser profile behaves like a real device.
SIGNAL FAMILY

Hard Automation Globals & Instant-Kill Flags

30
Active Webdriver Flag Checks for traces left by browser automation or masking tools.
31
Webdriver Descriptor Tampering Checks for traces left by browser automation or masking tools.
32
Playwright Binding Artifacts Checks for traces left by browser automation or masking tools.
33
Clean Context Iframe Leak Checks whether reported device hardware matches execution behavior.
34
Web Worker Platform Mismatch Checks for natural human movement, timing, and reading behavior.
35
Software GPU Emulation Checks whether rendering and device fingerprints fit together.
36
Rebrowser CDP Leak Checks for traces left by browser automation or masking tools.
37
Chrome For Testing Brand Checks whether the browser profile behaves like a real device.
38
Playwright ExposeFunction Leak Checks for traces left by browser automation or masking tools.
39
Default Puppeteer Viewport Checks whether the browser profile behaves like a real device.
40
Automation CSP Bypass Checks for traces left by browser automation or masking tools.
41
Main World Extension Leak Checks whether the browser profile behaves like a real device.
SIGNAL FAMILY

DOM Tampering, Honeypots & Stealth Traps

42
window.open API Override Checks whether the browser profile behaves like a real device.
43
Target _blank Removal Mutation Checks whether the browser profile behaves like a real device.
44
Target _blank Blur Absence Checks whether the browser profile behaves like a real device.
45
Impossible Post-Blank Event Timing Checks whether the browser profile behaves like a real device.
46
Hidden Iframe Challenge Blocked Checks whether reported device hardware matches execution behavior.
47
Reverse Honeypot Popup Opened Checks whether the browser profile behaves like a real device.
48
Function.toString Shadowing Checks whether the browser profile behaves like a real device.
49
Permissions Query Proxy Lie Checks whether the browser profile behaves like a real device.
50
Kasada Cross-Context Iframe Desync Checks whether reported device hardware matches execution behavior.
51
Arkose StructuredClone Canary Checks whether the browser profile behaves like a real device.
52
Obscure Automation Bindings Checks for traces left by browser automation or masking tools.
53
Navigation Timing Stubbing Checks whether the browser profile behaves like a real device.
54
Color Depth Inconsistency Checks whether rendering and device fingerprints fit together.
55
window.chrome Object Stub Checks whether the browser profile behaves like a real device.
SIGNAL FAMILY

Execution Integrity & Function Shadowing

56
Console Debug CDP Evaluator Checks for traces left by browser automation or masking tools.
57
CDP prepareStackTrace Trap Checks for traces left by browser automation or masking tools.
58
ChromeDriver Variable Leak Checks whether the browser profile behaves like a real device.
59
Puppeteer-Stealth Signatures Checks for traces left by browser automation or masking tools.
60
Core API Prototype Shadowing Checks whether the browser profile behaves like a real device.
61
Navigator.webdriver Getter Leak Checks for traces left by browser automation or masking tools.
62
Web Worker Execution Context Mismatch Checks whether the browser profile behaves like a real device.
63
JS Engine Eval Length Mismatch Checks whether the browser profile behaves like a real device.
64
Error Stack Trace Engine Mismatch Checks whether the browser profile behaves like a real device.
65
Native Prototype Descriptors Patched Checks whether the browser profile behaves like a real device.
66
Engine Error Prototype Formatting Checks for natural human movement, timing, and reading behavior.
67
Call Stack Overflow Depth Anomaly Checks whether the browser profile behaves like a real device.
68
Notification Permission Inconsistency Checks whether the browser profile behaves like a real device.
69
Docker / Container Fingerprint Checks whether the browser profile behaves like a real device.
70
FlareSolverr / Undetected-CDP Signature Checks for traces left by browser automation or masking tools.
71
Media Codec Platform Contradiction Checks for natural human movement, timing, and reading behavior.
72
Prototype Canary Traps Checks whether the browser profile behaves like a real device.
73
OS String & Line-Ending Contradiction Checks whether the browser profile behaves like a real device.
SIGNAL FAMILY

Hardware, Silicon & Sensor Entropy

74
Canvas 2D Data Poisoning (Farbling) Checks whether rendering and device fingerprints fit together.
75
Canvas Silicon Rendering Anomaly Checks whether rendering and device fingerprints fit together.
76
Float64 Endianness x86/ARM Mismatch Checks whether the device profile is internally consistent.
77
V8 Heap Size Limit Cluster Checks whether the device profile is internally consistent.
78
Heap Limit Power-of-Two VM Tell Checks whether the device profile is internally consistent.
79
Permission Matrix Uniform Denial Checks for natural human movement, timing, and reading behavior.
80
Micro-Timing Clamping Checks whether the device profile is internally consistent.
81
Client Hints vs User-Agent Mismatch Checks whether connection and browser request details stay consistent.
82
Brave Browser Verification Checks whether the device profile is internally consistent.
83
Math Precision Instruction Contradiction Checks whether the device profile is internally consistent.
84
AudioContext Latency Zero Checks whether connection and browser request details stay consistent.
85
Media Devices Enumeration Stub Checks whether the device profile is internally consistent.
86
Battery API Platform Impossibility Checks for natural human movement, timing, and reading behavior.
87
Hardware Polling Rate Trap Checks whether reported device hardware matches execution behavior.
88
Scrollbar Geometry Anomaly Checks for natural human movement, timing, and reading behavior.
89
Blind Rendering Trap Checks whether the device profile is internally consistent.
SIGNAL FAMILY

Font, Display & Locale Consistency

90
Font-to-OS Cross-Check Contradiction Checks whether rendering and device fingerprints fit together.
91
Font Rasterizer Glyph Sub-Pixel Hash Checks whether rendering and device fingerprints fit together.
92
Intl Locale Options OS Contradiction Checks whether location and language settings agree.
93
CSS ActiveText Rendering Anomaly Checks whether the browser profile behaves like a real device.
94
Zero Taskbar Height on Desktop Checks whether the browser profile behaves like a real device.
95
Negative Avail Coordinates Anomaly Checks whether the browser profile behaves like a real device.
96
Color Depth Under 24-bit Checks whether rendering and device fingerprints fit together.
97
Evasive History Length Checks for natural mobile use and real browsing behavior.
98
Visited Link Cache Timing Probe Checks whether the browser profile behaves like a real device.
99
Network Information API Contradiction Checks for natural human movement, timing, and reading behavior.
100
Empty Navigator Plugins Array Checks whether the browser profile behaves like a real device.
101
Speech Synthesis Empty Voices Checks whether rendering and device fingerprints fit together.
SIGNAL FAMILY

CreepJS & Advanced Engine Precision Leaks

102
CreepJS Math Precision Rounding Checks whether the browser profile behaves like a real device.
103
CreepJS Error Stack Syntax Checks whether the browser profile behaves like a real device.
104
CreepJS BiquadFilter Audio Dynamics Checks whether rendering and device fingerprints fit together.
105
CreepJS Media Query Contradiction Checks whether the browser profile behaves like a real device.
106
CreepJS Emoji Bounding Box Width Checks whether rendering and device fingerprints fit together.
107
CreepJS Speech Voices OS Contradiction Checks whether rendering and device fingerprints fit together.
108
Permanent Background Tab Load Checks for natural mobile use and real browsing behavior.
109
Early Mouse Silence (First 5s) Checks for natural human movement, timing, and reading behavior.
110
AudioContext Unprompted Execution Checks whether rendering and device fingerprints fit together.
111
Window Chrome Geometry Delta Zero Checks whether the browser profile behaves like a real device.
112
CPU High-Resolution Timer Drift Checks whether reported device hardware matches execution behavior.
113
Virtual Audio Loopback Interface Checks whether rendering and device fingerprints fit together.
114
GPU Render Benchmark Timeout Checks whether rendering and device fingerprints fit together.
115
CPU Benchmark VM Mismatch Checks whether reported device hardware matches execution behavior.
SIGNAL FAMILY

DataDome & PerimeterX Reverse-Engineered Signals

116
DataDome Pointer Hover Media Mismatch Checks for natural human movement, timing, and reading behavior.
117
PerimeterX Worker Offscreen WebGL Desync Checks whether rendering and device fingerprints fit together.
118
Stack Trace Line Syntax Audit Checks whether the browser profile behaves like a real device.
119
Kinematic Jerk Zero (Robotic Path) Checks whether the browser profile behaves like a real device.
120
Window Position Boundary Violations Checks whether the browser profile behaves like a real device.
121
Widevine DRM Hardware Attestation Failure Checks whether reported device hardware matches execution behavior.
122
WebGPU Software Adapter Leak Checks whether rendering and device fingerprints fit together.
123
DataDome Worker Permission Desync Checks whether the browser profile behaves like a real device.
124
WebAuthn Platform Authenticator Missing Checks for natural human movement, timing, and reading behavior.
125
Anti-Detect Browser Global Keys Checks whether the browser profile behaves like a real device.
126
Float Endianness Architecture Mismatch Checks whether reported device hardware matches execution behavior.
127
PerimeterX Canvas Noise Variance Checks whether rendering and device fingerprints fit together.
SIGNAL FAMILY

Akamai BMP & Cloudflare Turnstile Reverse-Engineered Signals

128
Akamai Synthetic Pointer (isTrusted=false) Checks whether the browser profile behaves like a real device.
129
Turnstile Background Console Inspection Checks whether the browser profile behaves like a real device.
130
Keystroke Zero-Dwell Time Injection Checks whether the browser profile behaves like a real device.
131
WebAssembly Sandbox Feature Mismatch Checks whether the browser profile behaves like a real device.
132
Akamai BMP Function.prototype Interrogation Checks whether the browser profile behaves like a real device.
133
Video Playback Hardware Matrix Mismatch Checks whether reported device hardware matches execution behavior.
134
Resource Scheduler Serialized Waves Checks whether the browser profile behaves like a real device.
135
Resource Matrix Selective Suppression Checks whether the browser profile behaves like a real device.
136
HTTP Cache Disabled on First Load Checks whether connection and browser request details stay consistent.
137
Keyboard Layout Map Empty Checks whether reported device hardware matches execution behavior.
138
Akamai BMP Trajectory SimHash Match Checks whether the browser profile behaves like a real device.
139
Cross-Session Trajectory Duplication Checks whether the browser profile behaves like a real device.
SIGNAL FAMILY

Kasada & Arkose Labs Reverse-Engineered Signals

140
Kasada Cross-Window Prototype Inheritance Desync Checks whether the browser profile behaves like a real device.
141
Arkose Host Object Serialization Trap Checks whether the browser profile behaves like a real device.
142
Puppeteer Evaluation Script Artifact Checks whether the browser profile behaves like a real device.
143
Selenium WebDriver Driver Bindings Checks for traces left by browser automation or masking tools.
144
Nightmare.js Framework Global Checks whether reported device hardware matches execution behavior.
145
CefSharp Embedded Framework Checks whether reported device hardware matches execution behavior.
146
Android WebView Desktop Context Mismatch Checks whether the browser profile behaves like a real device.
147
Apple Silicon HEVC / ProRes Codec Absence Checks whether the browser profile behaves like a real device.
148
Autonomous AI Agent DOM Artifacts Checks whether the browser profile behaves like a real device.
149
Stagehand / Browserbase Agent Markers Checks whether the browser profile behaves like a real device.
150
Crawl4AI Execution Global Leak Checks whether the browser profile behaves like a real device.
151
Browser-Use Agent CDP Markers Checks for traces left by browser automation or masking tools.
152
LLM Agent Cognitive Latency Clumping Checks whether connection and browser request details stay consistent.
153
Blink AXTree Forced Instantiation Probe Checks whether the browser profile behaves like a real device.
SIGNAL FAMILY

Autonomous AI Agent, AXTree & Form Injection Signals

154
Simultaneous Form Input Injection Checks for natural human movement, timing, and reading behavior.
155
Unfocused Form Submission Checks for natural human movement, timing, and reading behavior.
156
Sub-400ms Form Completion Checks for natural human movement, timing, and reading behavior.
157
AXTree Computed Role Probe Ratio Checks whether the browser profile behaves like a real device.
158
Cognitive Thought Action Bursts Checks whether the browser profile behaves like a real device.
159
Dynamic Canvas Temporal Instability Checks whether rendering and device fingerprints fit together.
160
document.execCommand InsertText Injection Checks whether the browser profile behaves like a real device.
161
Playwright addInitScript Ordering Anomaly Checks for traces left by browser automation or masking tools.
SIGNAL FAMILY

Behavioral Biometrics, Human Factors & Super-Human Vetoes

162
Incremental Reading Scroll Checks for natural human movement, timing, and reading behavior.
163
Reading Rewind Checks for natural human movement, timing, and reading behavior.
164
Chaotic Mouse Micro-Tremor Checks for natural human movement, timing, and reading behavior.
165
Exit Intent Trajectory Checks for behavior that resembles a real visitor.
166
Trusted Mobile Touch Tap Checks for natural mobile use and real browsing behavior.
167
Touch Hold Hesitation Checks for natural mobile use and real browsing behavior.
168
Text Highlighting Selection Checks for behavior that resembles a real visitor.
169
Keystroke Digraph Variance Checks for behavior that resembles a real visitor.
170
Multi-Touch Gesture Checks for natural mobile use and real browsing behavior.
171
Cursor Target Overshoot Checks for natural human movement, timing, and reading behavior.
172
HTML5 Drag and Drop Checks for behavior that resembles a real visitor.
173
Clipboard Interaction Checks for behavior that resembles a real visitor.
174
Context Menu Trigger Checks for behavior that resembles a real visitor.
175
Super-Human Veto Multi-Signal Checks for behavior that resembles a real visitor.
176
Mouse Movement Baseline Checks for natural human movement, timing, and reading behavior.
SIGNAL FAMILY

Click Farm Clustering & ML Dual-Opinion Guard

177
Click Farm Temporal Clustering Checks for natural human movement, timing, and reading behavior.
178
Click Farm Subnet Clustering Checks for natural human movement, timing, and reading behavior.
179
Hardware Profile Duplication Checks whether reported device hardware matches execution behavior.
180
Zero-Interaction Short Bounce Guard (<6s) Checks whether the browser profile behaves like a real device.
181
ONNX ML Bot Probability ($P \ge 85\%$) Checks whether the browser profile behaves like a real device.
182
Device Motion Gravity Magnitude Anomaly Checks whether the browser profile behaves like a real device.
183
Gyroscope Torque Uncoupled from Gravity Checks for natural mobile use and real browsing behavior.
SIGNAL FAMILY

Resource Scheduler & Network Consistency Vectors

184
HTTP/2 SETTINGS Frame Fingerprint Mismatch Checks whether connection and browser request details stay consistent.
185
Resource Scheduler Repeated Serialized Waves Checks whether the visitor’s network identity is coherent.
186
Selective Probe Resource Missing Checks whether the visitor’s network identity is coherent.
187
HTTP Cache Disabled on Initial Load Checks whether connection and browser request details stay consistent.
188
Crowd Hardware Consensus Mismatch Checks whether reported device hardware matches execution behavior.
189
Multi-Dimensional Anomaly Cluster Checks whether the visitor’s network identity is coherent.
INSTANT EDGE DEPLOYMENT

See the bots clicking your ads in real time.

Add BotRefund to your website in under 60 seconds. Continuous behavioral analysis and refund-ready click evidence across every campaign.

Get My Free Bot Audit →