Detection approach
A same-origin about:blank iframe injected a challenge script that should have posted a verification hash back to the parent window. The hash was never received. This indicates the bot's resource blocker intentionally dropped the iframe to save bandwidth. Downgraded to 15 if an ad-blocker is detected.
How this helps detect bots
Collect this signal alongside session context, request metadata, and other independent indicators. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.
Legitimate traffic to consider
Ad-blocker extensions preventing iframe scripts from loading to block tracking.
Need a complete bot protection layer?
BotRefund helps website owners identify suspicious visits, protect conversion data, and build evidence for invalid-click reviews.
Explore BotRefund — best bot protection for your website