Method & error bars
Overclaiming is this category's culture. Ours is the opposite: every number on a Botfall statement carries its epistemics — how we know it, how sure we are, and what could make it wrong. This page is the whole method, in public.
Three tiers, never blended
| Tier | Meaning | Example |
|---|---|---|
| TIER A · OBSERVED | Measured directly, server-side. | ClaudeBot fetched 214 product pages; identity IP-verified. |
| TIER B · CORROBORATED | Inferred from ≥2 independent markers, with published per-site precision. | An assistant fetch followed by a corroborated-human visit to the same product. |
| TIER C · MODELED | A range, labeled as a range. Never quietly mixed into A or B. | Estimated AI influence hidden inside referrer-stripped "Direct" traffic. |
"Human" is a claim, not a fact
Traffic claiming to be human gets sessionized and judged at the report layer — the raw telemetry is never rewritten. Verdicts are legible: a session is suspected automation only when a named tell fires (missing-client-hints · no-accept-language · fast-cadence · path-hammering · distributed-burst), and corroborated only with positive evidence — real browser fingerprints, human cadence, on-site behavior. Everything in between is reported as what it is: inconclusive.
The signal that survives perfect disguise
Modern evasive agents present flawless per-request browser costumes from residential IPs. Any single request looks human; the population doesn't. Botfall runs cross-session burst correlation: many unrelated networks fetching in impossible coordination — one URL hedged across many exits, or a catalog scraped one-URL-per-exit in seconds. Only visible with whole-stream server access, which is exactly where Botfall sits. Detector thresholds and components are exposed, and precision is measured against our own instrumented canary pages before any claim ships.
Identity is verified, not trusted
A user-agent string is a claim. Where operators publish IP ranges, every claiming request is checked: verified (inside published ranges), impersonator (claims an operator whose ranges exclude it), or unverifiable (no authoritative list exists — reported as such, not upgraded).
Retention: we measure machines, not people
Allowlisted request metadata only — cookies and authorization never leave the merchant's process. Raw IP addresses exist only for the identity-verification window and are destroyed at classification (with a 7-day hard backstop); what survives is organizational network attribution (ASN) — the machine-vs-person discriminator, not a person.
Self-calibration
The referrer-intact minority of AI-referred traffic calibrates the referrer-stripped majority, per site — which is how Tier-B claims ship with a published precision instead of a vibe. Our own canary experiments (instrumented pages fetched by assistants on request) provide ground truth for detector precision, and their findings are published.