← How We Detect Bots (All 180+ Signals) REVERSE-ENGINEERED DATADOME & PERIMETERX VECTORS • TIER 1 (WEIGHT: 80)

Pointer/Hover Media Desync

Technical forensic specification explaining how BotRefund analyzes browser environments and network invariants to distinguish novel retail browsers from server-side automation.

Authentic Consumer Baseline

Normal Consumer Browser

Authentic consumer browsers maintain strict internal coherence across operating system APIs, physical hardware constraints, and userland execution environments.

Automated Server Fingerprint

Automated Bot & Novel Browser

Automated scraping rings route clicks through commercial datacenter servers or residential proxy tunnels. Tunnel encapsulation (WireGuard/SOCKS5) clamps TCP SYN MSS to <= 1420 bytes, leaks residential IPs via WebRTC, or routes DNS queries through discordant overseas resolvers.

CHROMIUM & NETWORK PROTOCOL BLUEPRINT

Technical Forensic Specification

CSS Pointer & Hover Capabilities Contradiction: The client environment claims to be a mobile handheld device (iPhone / Android), but CSS matchMedia reports `(any-pointer: fine)` and `(any-hover: hover)`. Physical mobile smartphones and touch tablets evaluate to `(any-pointer: coarse)` and `(any-hover: none)`. This internal inconsistency is definitive proof of headless desktop Chromium emulating a mobile User-Agent within an automated cloud server.

FORENSIC SIGNATURE: `media_pointer_hover_desync` / `Pointer/Hover Media Queries Desync`
ENGINE DISCREPANCY: Signature mismatch detected on invariant check: `media_pointer_hover_desync` / `Pointer/Hover Media Queries Desync`
CORROBORATION RULE: Multi-layer voting engine evaluates alongside hardware entropy & L4 netprobe

DISPUTE DOSSIER VERIFICATION // AD PLATFORM REVIEWERS

For Google Ads & Meta Click Quality Reviewers

Ad Platform Fraud Classification: Under Google Ads Invalid Traffic guidelines (Automated Click Activity) and Meta Advertising Integrity standards, sessions exhibiting Pointer/Hover Media Desync violate fundamental consumer hardware invariants. They fail deterministic silicon rasterization, protocol compliance, or neuromuscular biometrics.

Why This Proves Non-Human Origin: Genuine consumer browsers on retail operating systems execute this API natively with verified hardware backing. Server software (headless cloud containers, unpatched automation harnesses, and proxy tunnels) cannot replicate this execution environment without incurring prohibitive server hardware costs.

Evidence Dossier Invariants: Each disputed click in our export packet matches an immutable server-side timestamp, landing URL, GCLID/fbclid, and observed IP address with zero client-side tamperability.

FALSE-POSITIVE MITIGATION

Multi-Dimensional Corroboration Engine

Human Baseline & Exception Scenario: Very rare on genuine devices: Android tablets with physical mouse attached. Excluded when device claims desktop or hybrid tablet.

BotRefund operates a multi-vector ensemble model. This signal adds objective forensic weight to the session dossier but never acts in isolation. Positive verdicts require corroboration across network routing, hardware silicon, and cursor kinematics to guarantee 99% precision.

Independent Evidence

This signal registers an objective, mathematically verifiable anomaly on the session ledger.

Cross-Checked Context

BotRefund correlates L4 packet timing, GPU silicon, and cursor jerk before finalizing risk.

Carrier-Ready Dossier

Compiled directly into Google Ads and Meta refund packets with verified click IDs and server logs.