Technical forensic specification explaining how BotRefund analyzes browser environments and network invariants to distinguish novel retail browsers from server-side automation.
Legitimate consumer sessions originate directly from residential, cellular (LTE/5G), or corporate office ISPs. Network packets exhibit standard unfragmented Maximum Transmission Units (MTU 1500, TCP MSS >= 1460 bytes) without tunnel encapsulation headers, and domain lookups resolve via local ISP nameservers.
Automated scraping rings route clicks through commercial datacenter servers or residential proxy tunnels. Tunnel encapsulation (WireGuard/SOCKS5) clamps TCP SYN MSS to <= 1420 bytes, leaks residential IPs via WebRTC, or routes DNS queries through discordant overseas resolvers.
P2P Residential Proxy TCP MSS Clamping & Tunnel Egress Detected: Low-level TCP SYN packet inspection (Netprobe Port 8443) revealed abnormal Maximum Segment Size (MSS) clamping (MSS <= 1420 bytes, typical of WireGuard/SOCKS5 tunnel overhead, whereas genuine broadband Ethernet connections enforce MSS >= 1460 bytes). While the IP address belongs to a consumer residential ISP (Comcast, AT&T, Deutsche Telekom), the clamped MSS confirms traffic is being tunneled through a peer-to-peer backconnect proxy node (e.g. NodeMaven, Bright Data, Oxylabs, Geonode) to masquerade automated scraping as authentic residential visitors.
Ad Platform Fraud Classification: Under Google Ads Invalid Traffic guidelines (Automated Click Activity) and Meta Advertising Integrity standards, sessions exhibiting Residential Proxy Clamping violate fundamental consumer hardware invariants. They fail deterministic silicon rasterization, protocol compliance, or neuromuscular biometrics.
Why This Proves Non-Human Origin: Genuine consumer browsers on retail operating systems execute this API natively with verified hardware backing. Server software (headless cloud containers, unpatched automation harnesses, and proxy tunnels) cannot replicate this execution environment without incurring prohibitive server hardware costs.
Evidence Dossier Invariants: Each disputed click in our export packet matches an immutable server-side timestamp, landing URL, GCLID/fbclid, and observed IP address with zero client-side tamperability.
Human Baseline & Exception Scenario: Cellular / mobile data networks naturally operate at clamped MTUs (e.g. 1360-1420 bytes); mobile User-Agents and mobile cellular connections are excluded.
BotRefund operates a multi-vector ensemble model. This signal adds objective forensic weight to the session dossier but never acts in isolation. Positive verdicts require corroboration across network routing, hardware silicon, and cursor kinematics to guarantee 99% precision.
This signal registers an objective, mathematically verifiable anomaly on the session ledger.
BotRefund correlates L4 packet timing, GPU silicon, and cursor jerk before finalizing risk.
Compiled directly into Google Ads and Meta refund packets with verified click IDs and server logs.