Bot traffic, detected.

Bot traffic is traffic produced by software instead of a person. Part of it is legitimate and declared. Search crawlers announce themselves, respect exclusion rules, and index content in the open; monitoring agents check uptime. Declared bots almost never touch paid placements — they crawl organic pages, and ad platforms filter most of them before a click is billed.

The bot traffic that costs money is the undeclared kind: software dressed as a customer, built to reach an advertiser’s landing page and register as a real visitor. The line between the two categories is not code quality. It is the transparency and intent of the operator.

Undeclared bots reach paid campaigns because the economics invite them. An ad network sells your clicks through a supply chain — publishers, exchanges, resellers, sub-sources. Most of that chain sends people. Some sub-sources are paid per click, and automated volume is the cheapest click there is. A fraction of paid-search noise is simpler still: competitors draining a rival’s daily budget.

The resulting visit looks plausible on paper. It carries a real-looking click identifier, a mainstream browser label, and a geography inside your targeting. The platform’s own reporting counts it alongside your customers. That is the problem this chapter is about: the traffic arrives pre-mixed, and nothing in a campaign dashboard separates it back out.

The ad-measurement industry splits invalid traffic into two tiers, and the split maps directly onto bots.

General invalid traffic is the crude tier. Declared crawlers, obvious automation labels, scripted clients that fetch your HTML and leave, visits arriving from known server ranges. It identifies itself, or fails the most basic plausibility. List-matching handles it, and platform-side filters remove most of it before billing.

Sophisticated invalid traffic is everything engineered to survive that filter. The inventory:

• Automated browsers — real browser engines driven by software, with no one at the keyboard, imitating users at scale.
• Scripted clients tuned to present a full, plausible surface while running none of the substance of a real session.
• Hijacked consumer devices — phones, laptops, smart TVs recruited into botnets. The device is real. The connection is a genuine home line. The owner has no idea.
• Residential relays — code inside free apps and browser extensions that quietly carries a stranger’s traffic through the host’s home connection.
• Spoofed device profiles built to match the audience a campaign is targeting.

The common trait is a genuine surface. Real hardware, real home connections, real browser engines. Any filter that stops at the address layer clears all of it, because the address is the one thing that is authentically clean. The full taxonomy — and why the industry draws the line where it does — is covered in what invalid traffic is. The short version: crude bots are a hygiene problem. Sophisticated invalid traffic is an adversary.

Fake traffic announces itself in your own numbers before any tool sees it. The recurring symptoms:

• Click volume rises and conversions do not move. Real demand shifts both.
• Sessions end before they begin. Landing, no scroll, no second page, gone in seconds.
• Volume concentrates. A handful of placements or sub-sources carry an implausible share of clicks.
• Geography drifts. Clicks pool at the edge of your targeting, in regions with no conversion history.
• Click-through rate and cost per acquisition rise together. Genuine interest usually moves them in opposite directions.
• Returning visitors vanish. Doubtful sources deliver near-total first-time traffic that never comes back.
• Conversion events fire faster than a page can be read.

None of these is proof by itself. Legitimate campaigns spike. Good publishers sometimes concentrate volume. A weak landing page produces bounce patterns that mimic bots. What the symptom list buys you is a shortlist of where to look — not a verdict.

The quieter damage is what fake traffic does to optimization. Automated bidding learns from whatever the data says. When a meaningful share of volume never converts because it never could, the algorithm draws conclusions anyway — penalizing placements that work, rewarding volume that looks healthy, reallocating budget on fiction. The spend on the fake click is the visible loss. The steering error is the compounding one.

Every attribute a bot presents can be faked in isolation. The address can be rented from a residential pool. The browser label is a string the client sets. Screen size, language, geography — each is a value under the operator’s control. Any tool built as a checklist of single tests therefore has a shelf life: the operator learns the test, sets the value, and passes.

Address lists age fastest. Operations rotate through fresh ranges, and residential relays make the address layer actively misleading — the cleanest-looking addresses in your logs can be the rented ones. A tool whose core claim is a big list is describing yesterday’s traffic.

The structural answer is to check evidence in classes rather than items:

1. Provenance — what kind of path the visit arrived through. Ordinary home and mobile connections read differently from server farms, cloud hosts, and anonymizing services, however the visit is dressed.
2. Device — whether a real browser on real hardware is on the other end, or automation that admits what it is.
3. Behavior — how the session moved. Recorded and shown, but never enough on its own: real people act fast and leave early too.
4. Substance — whether the page genuinely loaded and ran, or the visit is a shell that touched the server and left none of the depth a real session produces.

Faking one class is cheap. Passing every check at once, consistently, at scale, is expensive — and expense, not cleverness, is what actually deters fraud operations.

The second structural answer is silence. Publish the checklist and the checklist stops working; every documented test becomes a to-do item for the other side. That is why the specific measurements behind a serious detection product stay sealed by design, and why this chapter describes architecture rather than tests. Evaluate tools by evidence classes and by how verdicts hold up — not by a published list of tells.

Bot traffic detection is a measurement problem before it is anything else, and the unit of measurement matters. ValidVisit checks every visit that lands from a paid campaign against 100+ data points across those four evidence classes. One thing a real visitor cannot produce makes it Invalid; otherwise it is Valid, with its evidence either way. Everything else follows from that grain.

Independence. The verdict is produced on your landing page, from your traffic, by a party with no stake in the click being billed. Platform-side filtering is real but opaque — the platform grades its own homework and publishes the result as one aggregate line.

Per-visit verdicts. A verdict attaches to a specific visit, with a plain-language account of the evidence that drove it. Aggregate suspicion — this campaign feels off — becomes an inspectable record.

Attribution. Each judged visit is pinned to its campaign, source, publisher, placement, and sub-ID through the network’s own tracking tokens. That converts the useless sentence we have bots into the actionable one: this placement sends them.

Nothing in the click path. Judging happens after arrival. No hop is added between the ad and the landing page, nothing is slowed, and no real customer is at risk of being dropped.

Equally important is what a per-visit verdict does not do. ValidVisit detects, judges, attributes, and reports. The verdict blocks no one, and ValidVisit never auto-excludes anything inside ad platforms; the only visitors it acts on are the countries and connection types you name in traffic rules. The exclusion decision stays with you, made in the network’s own dashboard, on evidence you can audit. The full mechanics are in how it works; for how this approach compares with blocking-first tools, see the comparison.

Invalid share is not uniform across channels. Networks that monetize through large, open publisher ecosystems — native, push, pop — expose more surface area for bad sub-sources than the tighter loops of search and social. That is not an accusation against the networks. A supply chain with thousands of third-party placements has an uneven quality floor by construction, and platform-side filtering removes the crude tier reliably and the sophisticated tier only partially.

The practical consequence: identical creative and identical targeting can produce wildly different traffic quality depending on which sub-sources fill the volume. A campaign is not clean or dirty. Its placements are.

Per-network breakdowns live in the tracking tokens reference, with network-specific pages such as Google Ads and Taboola covering each platform’s tokens, exclusion tools, and quality patterns. Before concluding anything from your own numbers, calibrate against the invalid-traffic benchmarks — knowing what a normal share looks like is half the diagnosis.

Detection is the first half. The rest is routine.

1. Tag for attribution before anything else. A verdict you cannot pin to a placement is trivia. Put the network’s publisher and placement tokens in your campaign URLs — the tracking-token directory has the exact macros per network.
2. Let evidence accumulate. Single-day reads on thin volume mislead. Judge sub-sources on a body of judged visits, against the benchmarks, not on one bad afternoon.
3. Exclude at the sub-source. Rank placements by invalid share and act on the floor — placement exclusions, zone bid-downs, sub-ID blocks — inside the network’s own dashboard. The point is surgical: cut the sub-sources sending automated volume, keep the publishers sending people.
4. Take the evidence upstream. Where a platform runs a credit process, judged per-visit records are stronger material than raw address lists. The Google Ads refunds chapter covers what to gather and where to file it.
5. Re-measure. Exclusion lists decay. Sub-sources rotate, new placements appear, quality drifts. Treat traffic quality as a loop, not an audit.

Be equally clear about what is not on the list. You cannot make a platform publish its filters. You cannot stop the first bad click from billing — nothing that sits outside the click path can, and tools that sit inside it introduce risks of their own. What you can do is stop the same sub-source from billing you twice, and stop fake traffic from steering the optimization that spends the rest of your budget.