BotRefund Architecture, Detection Pipeline & Security Posture

Legacy anti-bot tools run monolithic client scripts that query dozens of high-entropy browser APIs synchronously during page load. This approach is flagged by privacy-conscious browsers (Safari, Firefox, Brave) and delays the browser main thread, harming Core Web Vitals (INP and LCP).

BotRefund implements a Decoupled Asynchronous Anti-Blocking Architecture. Forensic inspection is fragmented into asynchronous sub-modules, executed during browser idle cycles, and correlated out-of-band with edge compute nodes, our L4 Netprobe engine, and a dual-homed DNS challenge system.

Option 1: Direct Script Tag & Fastly Adblocker Cloaking

Clients can include the loader script directly. To guarantee 100% script delivery and prevent adblockers from cataloging static script URLs, our system provisions dynamic Fastly edge clusters (e.g. https://*.edgecompute.app subdomains) paired with universal CDN fallbacks.

<!-- Scenario A: BotRefund.js Standalone (Ad Fraud & Bot Defense Only) -->
<!-- 1. Dynamic Fastly Edge Sensor (Cloaked against Adblockers) -->
<script src="https://fthhkh7iahqirmy6lu9vvp.edgecompute.app/botrefund.js" async></script>

<!-- 2. Universal CDN Direct Fallback (Hosted on cdn.seatext.com) -->
<script src="https://cdn.seatext.com/botrefund.js?id=YOUR_PROJECT_ID" async></script>

<!-- Scenario B: SeaText.js Full Suite (Bot Defense + AI SEO, GEO, CRO & Chat) -->
<!-- 1. Fastly 4-Service Edge Cluster with Canaries and Honeypots -->
<script src="https://fthhkh7iahqirmy6lu9vvp.edgecompute.app" async></script>
<link rel="stylesheet" href="https://fthhkh7iahqirmy6lu9vvp.edgecompute.app/theme.css">
<link rel="search" type="application/opensearchdescription+xml" title="Search" href="https://fthhkh7iahqirmy6lu9vvp.edgecompute.app/opensearch.xml">
<noscript>
  <img src="https://fthhkh7iahqirmy6lu9vvp.edgecompute.app/badge.gif" alt="Site">
</noscript>

<!-- 2. Universal CDN Full-Suite Fallback -->
<script src="https://cdn.seatext.com/seatext.js?id=YOUR_PROJECT_ID" async></script>

Option 2: Custom Cloudflare Worker (Developed by BotRefund for the Client)

For enterprise clients running on Cloudflare, the most robust architectural pattern is a dedicated Cloudflare Worker executing directly on your zone.

Here is how the custom Cloudflare Worker operates on your edge, tailored to your chosen scope:

• For BotRefund Only (botrefund.js): The worker intercepts only fraud telemetry pathways and delivers the lightweight sensor via first-party routes. It executes zero DOM mutations and alters no page content.
• For Full SeaText Suite (seatext.js): The worker handles both fraud telemetry and edge routing for dynamic SEO content variants, instant edge translations, and localized copy.
• 100% Adblocker Immunity (First-Party Cloaking): Because all traffic travels through your own first-party domain, adblockers (uBlock Origin, Brave Shields, Pi-hole) cannot distinguish BotRefund requests from your native application APIs.
• Zero-Latency Origin Pass-Through: The worker adds 0ms degradation to non-telemetry application traffic.
• Bypassing Safari ITP 7-Day Storage Caps: Because session cookies and tokens are written under your first-party domain at the edge, Safari does not cap them after 7 days, maintaining persistent returning visitor recognition.
• Authentic Client IP Preservation: The worker reads the visitor's authentic IP directly from request.headers.get('cf-connecting-ip') and forwards TLS handshake metadata securely to our Go backend.

How onboarding works: Our engineers provide your DevOps team with the tailored worker code, assist with Cloudflare Route triggers, or deploy directly via your Cloudflare API service token upon authorization.

Option 3: Fastly VCL First-Party Proxy

Clients utilizing Fastly CDN can route telemetry through their primary domain by adding this snippet to their default.vcl file:

# Define BotRefund Ingress Backend
backend botrefund_ingress {
  .host = "ingress.botrefund.com";
  .port = "443";
  .ssl = true;
  .ssl_cert_hostname = "ingress.botrefund.com";
  .between_bytes_timeout = 10s;
  .first_byte_timeout = 10s;
  .max_connections = 200;
}

sub vcl_recv {
  # Fast-path proxy for BotRefund telemetry
  if (req.url ~ "^/btr/(.*)") {
    set req.backend = botrefund_ingress;
    set req.http.host = "ingress.botrefund.com";

    # Forward client IP & country
    set req.http.x-forwarded-for = client.ip;
    set req.http.cf-connecting-ip = client.ip;

    # Rewrite /btr/v1/telemetry to /v1/telemetry
    set req.url = "/" + re.group.1;
    return(pass);
  }
}

sub vcl_fetch {
  if (req.url ~ "^/btr/") {
    # Ensure zero edge caching for live verification tokens
    set beresp.ttl = 0s;
    set beresp.grace = 0s;
    return(deliver);
  }
}

Option 4: Next.js App Router & Serverless Edge Functions

If your site runs on modern full-stack frameworks (Next.js, Remix, SvelteKit, or Nuxt) hosted on Vercel, AWS Amplify, or Node.js Docker containers, deploy this simple route handler at app/api/btr/[...path]/route.ts:

import { NextRequest, NextResponse } from 'next/server';

export async function POST(
  request: NextRequest,
  { params }: { params: { path: string[] } }
) {
  const subpath = params.path.join('/');
  const searchParams = request.nextUrl.search;
  const targetUrl = `https://ingress.botrefund.com/${subpath}${searchParams}`;

  const body = await request.text();
  const headers = new Headers(request.headers);
  headers.set('host', 'ingress.botrefund.com');
  headers.set('x-forwarded-for', request.headers.get('x-forwarded-for') || request.ip || '');

  const response = await fetch(targetUrl, {
    method: 'POST',
    headers,
    body,
  });

  const responseData = await response.text();
  return new NextResponse(responseData, {
    status: response.status,
    headers: {
      'Content-Type': response.headers.get('Content-Type') || 'application/json',
      'Cache-Control': 'no-store, max-age=0',
    },
  });
}

export async function OPTIONS() {
  return new NextResponse(null, {
    status: 204,
    headers: {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'POST, OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type, Authorization, x-botrefund-pk',
    },
  });
}

For enterprise teams requiring real-time server-side block gates — such as denying free trial credits to duplicate accounts, stopping automated credential stuffing at login, or filtering lead submissions before CRM webhook dispatch — BotRefund supports a two-leg verification workflow:

• On-Page API Token Creation: The client script generates an encrypted ephemeral verification token (request_id) tied to the visitor's hardware session. This token is attached to your form submission payload.
• Dedicated Server Verification Endpoint (POST /v1/verify): Your backend forwards the request_id to BotRefund's hardened API endpoint using your secret Bearer token. BotRefund returns an authoritative JSON payload containing the visitor device ID, returning status, bot probability, and triggered forensic flags in under 15ms.

// 1. Your Backend Request
POST /v1/verify HTTP/1.1
Host: api.botrefund.com
Authorization: Bearer sec_live_948f2b1a80c94d...
Content-Type: application/json

{
  "request_id": "req_8f31b209c417e2"
}

// 2. Authoritative BotRefund Response (Latency: < 15ms)
{
  "status": "success",
  "visitor_id": "v_8f90a2b918cc7",
  "is_bot": true,
  "bot_score": 0.94,
  "bot_type": "cdp_automation",
  "is_returning": true,
  "first_seen": "2026-10-14T08:12:00Z",
  "confidence": 0.998,
  "reasons": [
    "cdp_debugger_leak",
    "webdriver_getter_tampered",
    "headless_software_gpu_render",
    "robotic_euclidean_mouse_trajectory"
  ],
  "signals": {
    "headless_browser": true,
    "cdp_active": true,
    "mouse_entropy": 0.04,
    "software_renderer": true
  }
}

Sophisticated click farms and automated scrapers easily bypass IP blacklists and user-agent checks using rotating residential proxies and stealth browser forks (Undetected Chromedriver, Puppeteer Stealth, Playwright). BotRefund inspects 180+ physical device invariants and behavioral entropy vectors grouped into four distinct forensic layers:

Machine Learning Model Architecture (High-Level Overview)

Rather than relying solely on brittle static thresholds that attackers can reverse-engineer, BotRefund utilizes a calibrated ONNX Machine Learning Inference Engine running locally within our Go backend:

• 25-Dimensional Normalized Feature Vector: Telemetry is condensed into a 25-feature tensor spanning mouse curvature variance, GPU vendor indices, audio buffer hashes, TCP window scales, and timing deltas.
• Synergistic Ensemble Decision: The system operates a dual-engine architecture:
  1. Deterministic Heuristic Veto: Catches blatant automation markers (e.g. active CDP debuggers, SwiftShader renderers) with 100% precision.
  2. Trained Anomaly Classifier: Evaluates subtle, multi-variable correlation discrepancies across residential proxy clusters.
• False-Positive Suppression (<0.01% Error Rate): The model is calibrated against hundreds of thousands of human sessions. Legitimate users on corporate VPNs or privacy browsers (e.g. Brave) produce natural biomechanical micro-tremors and consistent hardware tables, preventing false rejections.

We encourage enterprise teams to adopt a four-stage zero-risk evaluation process: