Bot Detection for Media Buyers: A Technical Primer

IP intelligence, TLS fingerprints and behaviour: how bot filtering works, and how to keep fake clicks out of your numbers.

What bots cost you

Every bot click costs money twice: once when you pay for it, and again when it skews the numbers you optimise on. A placement that looks like it converts at 0.5% may really convert at 1% on human traffic, and you cut it for the wrong reason.

The kinds of bot traffic

Simple scripts fetch the tracking URL with an HTTP library. Easy to catch.
Headless browsers such as Puppeteer or Playwright run a real browser engine and execute JavaScript.
Datacenter and proxy traffic comes from cloud servers, VPNs or Tor rather than home or mobile connections.
Residential proxies route bots through real home IPs, which defeats IP checks on their own.
Reviewers and crawlers from ad networks and search engines, which are not fraud but should not see everything.

The signals that give them away

IP intelligence

Datacenter ranges (AWS, Google Cloud, Oracle, DigitalOcean and others), known VPN and proxy networks and Tor exit nodes. Real buyers on mobile or home connections rarely come from these.

TLS fingerprints

Before any HTTP is exchanged, the client's TLS handshake reveals what software it really is. JA3 and JA4 fingerprints let a tracker see when something claiming to be Chrome on an iPhone is actually a Python script.

Behaviour

Time on the landing page, whether the visitor clicked through to the offer, and how fast clicks arrive from the same source. Humans are slower and less regular than automation.

Crawler verification

A user agent that says Googlebot proves nothing. A reverse and forward DNS lookup on the IP does.

How XPNSR Tracker uses them

Every click is scored against IP intelligence, the user agent, JA3/JA4 fingerprints and behaviour, and you decide whether flagged clicks are blocked or redirected.
Datacenter lists and Tor exit nodes refresh automatically every 6 hours; you can add your own IP blacklists and bot lists.
Cloaking splits verified crawlers, reviewers and bots to a safe page while live visitors see the offer, with the reason logged on each click.
The Clicks Log shows the verdict, ISP, proxy flag, and time on lander for every click, so you can audit any source.

What you can do today

Filter the Clicks Log by traffic source and look at how many clicks are flagged as bots, proxies or datacenter traffic per placement.
Blacklist placements that send mostly datacenter or flagged traffic, and ask the network for a refund with the click log as evidence.
Compare conversion rates on human-only traffic before cutting a placement.