Key takeaways
- Fraud/junk is caught in a chain: server-side isBot → (optionally) Smart Traffic SDK → visit statuses → conversion_score.
- Server signals: empty UA, WhichBrowser/DeviceDetector bot, headless patterns, no Accept/Accept-Language, datacenter IP, >30 clicks/60 s from an IP.
- safe = log would_block only; soft (ip:/rate:) with Smart Traffic may go further (soft_pass).
- AI Selena sets the score profile and sf_mode; HVT thresholds themselves do not ban clicks — see the articles on thresholds and «does not».
Three layers of protection
- Сервер — before the page/redirect is served: isBot, prefetch skip, bot_server write.
- Client SDK — with Smart Traffic: delay, events, fingerprint, behavior, PoW/challenge, confirm.
- Quality analytics — statuses, Audience, conversion_score; optionally FraudDataCollector → exclusions.
In the normal scenario, pixels should fire for confirmed visits (and with consent), not for a hard-bot redirect without tracking.
Server-side isBot
RedirectController::isBot returns a reason code or null. Typical reasons:
| Code / group | Условие |
|---|---|
| ua:empty | Empty User-Agent |
| ua:whichbrowser | WhichBrowser: device.type = bot |
| ua:dd:… | DeviceDetector.isBot() |
| ua:pattern:… | HeadlessChrome, curl, Scrapy, Puppeteer, Selenium, playwright, wget, python-requests, … |
| header:no-accept-language | No Accept-Language |
| header:no-accept | No Accept |
| ip:datacenter | IP from config/datacenter_ips ranges |
| rate:limit | >30 clicks in 60 seconds from one IP |
Prefetch/prerender (Sec-Purpose) — a visit is not created. This is not «fraud», but a technical browser prefetch request.
Hard vs soft vs safe
- Hard-bot — most ua:/header: reasons → in non-safe mode: blocked, redirect without tracking/pixels, visit bot_server, stats bot.
- Soft-bot — reason starts with ip: or rate:. With smart_traffic on and non-safe, soft_pass is possible: they go on to SDK/fingerprint, not cut immediately.
- safe — sf_mode=safe: action would_block, the decision is logged, there is no hard block (convenient for calibration).
Start with safe on a live campaign if you fear cutting legitimate datacenter/VPN traffic, then move to normal.
Smart Traffic and SDK
If the link has smart_traffic=1: a _cb_token is issued, the visit is pending, pixels are deferred until client confirm via the Smart Filter API. Default delay ≈ 5 s (1–60). Events on the link: click, scroll, form_submit, custom; AND/OR logic.
- Without confirm, pixels should not be counted as successfully fired.
- pending older than ~1 hour may go to bot_filter (AudienceController).
- A custom domain or Smart Traffic is required — otherwise the pixel scenario is not used.
Diagnosing «the pixel is silent»: troubleshooting.
Visit statuses
| status | Когда |
|---|---|
| bot_server | Server hard-block |
| pending | Waiting for SDK / Smart Traffic |
| confirmed | SDK confirm OK (or a scenario without ST and not a bot) |
| bot_filter | Long pending without confirm |
In the client report, separate «clicks in Ads» from confirmed in ClikBy — otherwise a fraud dispute becomes a dispute about different metrics.
Behavior and conversion_score
After confirm, conversion_score is calculated 0–100:
- Events — 35% (link events vs those that fired)
- Frequency — 20%
- Time on site — 15% (bell curve around sf_ideal_time)
- Scroll — 10% (around sf_ideal_scroll)
- Behavior — 10% (mouse/scroll/timings/touch)
- Fingerprint — 10% (incl. the «too poor» hash heuristic)
This is a quality score of a confirmed visit, not a separate «competitor click-farm» detector. Suspicious fingerprint/behavior lowers the score; a server-side bot is already cut off earlier.
Sync to ad accounts
A separate FraudDataCollector loop collects IPs from bot_decisions (blocked) and visits with statuses bot_server|bot_filter, plus fbclid bots. The ad:sync-fraud command can push signals into exclusions/negatives when auto_sync is on.
This is not a manual «report to Meta» button in the Selena UI. Check with support/your plan whether sync is enabled on your account.
Where AI Selena fits
- Sets sf_mode and ideals for the score.
- Shows Learning Status / the analysis cabinet.
- Retention AISelenaDaysLong takes part in PII cleanup.
- HVT/MVT/LVT thresholds and interests are UI; they do not replace the signal table above.
Verification checklist
- Is there a custom domain or Smart Traffic on the link with the pixel?
- What sf_mode does the user/link have? Are you stuck in safe on prod for no reason?
- What share of bot_server / bot_filter / confirmed over the period?
- Does geo/device match the media plan?
- Is rate:limit cutting your own load tests?
- For retargeting: have confirm + pixel_notification consent been passed?