Technical forensic specification explaining how BotRefund analyzes browser environments and network invariants to distinguish novel retail browsers from server-side automation.
Standard production browser installations on macOS, Windows, iOS, and Android bundle proprietary, licensed media codecs (H.264, AAC, MP3) and Google Widevine Content Decryption Modules (com.widevine.alpha) for encrypted digital media playback.
Stripped headless Chromium binaries running in Linux server containers omit proprietary Widevine CDM binaries and licensed codecs due to licensing costs, causing hardware decryption to fail immediately upon initialization.
DRM Hardware Decryption Failure: The client environment claims to be a retail desktop browser (Google Chrome or Microsoft Edge) with MediaKeySystemAccess supported, but hardware Widevine Content Decryption Module ('com.widevine.alpha') initialization failed. Production distributions of Google Chrome and Microsoft Edge on desktop OS always bundle proprietary Widevine CDM binaries for protected media playback. The absence of Widevine CDM is an incontrovertible physical proof of stripped headless Chromium, open-source Chromium in a Docker container or cloud sandbox, or an automated test environment.
Ad Platform Fraud Classification: Under Google Ads Invalid Traffic guidelines (Automated Click Activity) and Meta Advertising Integrity standards, sessions exhibiting DRM Capabilities Missing violate fundamental consumer hardware invariants. They fail deterministic silicon rasterization, protocol compliance, or neuromuscular biometrics.
Why This Proves Non-Human Origin: Genuine consumer browsers on retail operating systems execute this API natively with verified hardware backing. Server software (headless cloud containers, unpatched automation harnesses, and proxy tunnels) cannot replicate this execution environment without incurring prohibitive server hardware costs.
Evidence Dossier Invariants: Each disputed click in our export packet matches an immutable server-side timestamp, landing URL, GCLID/fbclid, and observed IP address with zero client-side tamperability.
Human Baseline & Exception Scenario: None on standard retail Chrome/Edge desktop installations. Rare on unbundled open-source Chromium on developer Linux setups without widevine package.
BotRefund operates a multi-vector ensemble model. This signal adds objective forensic weight to the session dossier but never acts in isolation. Positive verdicts require corroboration across network routing, hardware silicon, and cursor kinematics to guarantee 99% precision.
This signal registers an objective, mathematically verifiable anomaly on the session ledger.
BotRefund correlates L4 packet timing, GPU silicon, and cursor jerk before finalizing risk.
Compiled directly into Google Ads and Meta refund packets with verified click IDs and server logs.