Home
ClikBy
ClikBy Knowledge Base
Antifraud

How fraud is detected

From server-side isBot to SDK confirm and conversion_score — what ClikBy actually looks at on every click.

12–15 min Updated: July 2026
isBotсигналы
soft/safeрежимы
confirmedстатус

Key takeaways

  • Fraud/junk is caught in a chain: server-side isBot → (optionally) Smart Traffic SDK → visit statuses → conversion_score.
  • Server signals: empty UA, WhichBrowser/DeviceDetector bot, headless patterns, no Accept/Accept-Language, datacenter IP, >30 clicks/60 s from an IP.
  • safe = log would_block only; soft (ip:/rate:) with Smart Traffic may go further (soft_pass).
  • AI Selena sets the score profile and sf_mode; HVT thresholds themselves do not ban clicks — see the articles on thresholds and «does not».

Three layers of protection

  1. Сервер — before the page/redirect is served: isBot, prefetch skip, bot_server write.
  2. Client SDK — with Smart Traffic: delay, events, fingerprint, behavior, PoW/challenge, confirm.
  3. Quality analytics — statuses, Audience, conversion_score; optionally FraudDataCollector → exclusions.

In the normal scenario, pixels should fire for confirmed visits (and with consent), not for a hard-bot redirect without tracking.

Server-side isBot

RedirectController::isBot returns a reason code or null. Typical reasons:

Code / groupУсловие
ua:emptyEmpty User-Agent
ua:whichbrowserWhichBrowser: device.type = bot
ua:dd:…DeviceDetector.isBot()
ua:pattern:…HeadlessChrome, curl, Scrapy, Puppeteer, Selenium, playwright, wget, python-requests, …
header:no-accept-languageNo Accept-Language
header:no-acceptNo Accept
ip:datacenterIP from config/datacenter_ips ranges
rate:limit>30 clicks in 60 seconds from one IP

Prefetch/prerender (Sec-Purpose) — a visit is not created. This is not «fraud», but a technical browser prefetch request.

Hard vs soft vs safe

  • Hard-bot — most ua:/header: reasons → in non-safe mode: blocked, redirect without tracking/pixels, visit bot_server, stats bot.
  • Soft-bot — reason starts with ip: or rate:. With smart_traffic on and non-safe, soft_pass is possible: they go on to SDK/fingerprint, not cut immediately.
  • safe — sf_mode=safe: action would_block, the decision is logged, there is no hard block (convenient for calibration).

Start with safe on a live campaign if you fear cutting legitimate datacenter/VPN traffic, then move to normal.

Smart Traffic and SDK

If the link has smart_traffic=1: a _cb_token is issued, the visit is pending, pixels are deferred until client confirm via the Smart Filter API. Default delay ≈ 5 s (1–60). Events on the link: click, scroll, form_submit, custom; AND/OR logic.

  • Without confirm, pixels should not be counted as successfully fired.
  • pending older than ~1 hour may go to bot_filter (AudienceController).
  • A custom domain or Smart Traffic is required — otherwise the pixel scenario is not used.

Diagnosing «the pixel is silent»: troubleshooting.

Visit statuses

statusКогда
bot_serverServer hard-block
pendingWaiting for SDK / Smart Traffic
confirmedSDK confirm OK (or a scenario without ST and not a bot)
bot_filterLong pending without confirm

In the client report, separate «clicks in Ads» from confirmed in ClikBy — otherwise a fraud dispute becomes a dispute about different metrics.

Behavior and conversion_score

After confirm, conversion_score is calculated 0–100:

  • Events — 35% (link events vs those that fired)
  • Frequency — 20%
  • Time on site — 15% (bell curve around sf_ideal_time)
  • Scroll — 10% (around sf_ideal_scroll)
  • Behavior — 10% (mouse/scroll/timings/touch)
  • Fingerprint — 10% (incl. the «too poor» hash heuristic)

This is a quality score of a confirmed visit, not a separate «competitor click-farm» detector. Suspicious fingerprint/behavior lowers the score; a server-side bot is already cut off earlier.

Sync to ad accounts

A separate FraudDataCollector loop collects IPs from bot_decisions (blocked) and visits with statuses bot_server|bot_filter, plus fbclid bots. The ad:sync-fraud command can push signals into exclusions/negatives when auto_sync is on.

This is not a manual «report to Meta» button in the Selena UI. Check with support/your plan whether sync is enabled on your account.

Where AI Selena fits

  • Sets sf_mode and ideals for the score.
  • Shows Learning Status / the analysis cabinet.
  • Retention AISelenaDaysLong takes part in PII cleanup.
  • HVT/MVT/LVT thresholds and interests are UI; they do not replace the signal table above.

Verification checklist

  1. Is there a custom domain or Smart Traffic on the link with the pixel?
  2. What sf_mode does the user/link have? Are you stuck in safe on prod for no reason?
  3. What share of bot_server / bot_filter / confirmed over the period?
  4. Does geo/device match the media plan?
  5. Is rate:limit cutting your own load tests?
  6. For retargeting: have confirm + pixel_notification consent been passed?

What’s next?

Check statuses for the week

Open Audience for the key link and compare bot_* with confirmed before talking to the client.