botfall
SAMPLE REPORT

The Botfall Report

Statement № 0001 · Account a live DTC storefront (anonymized)
Reporting period 2026-08-02 (03:29–15:25 UTC — first 12 h of telemetry)
Reconciliation — what your analytics saw vs. what your server saw
Your analytics reported†
214
visitors†
Captured server-side
409
requests · every one classified
Corroborated humans
7
pageviews · 7 sources
Machine or suspect
379
requests · 92.7% of capture
1 in 58 requests this period came from a corroborated human. Everything else was a machine, a costume, or unprovable — itemized below.
EXHIBIT 1

Where the traffic actually came from

Corroborated humans — 7 requests (1.7%) AI agents — 80 requests (19.6%): training 73, agentic browsers 7 Search, SEO & ads — 44 requests (10.8%) Suspected automation — 207 requests (50.6%): stealth crawlers 175, exploit scanners 32 Unattributed — 71 requests (17.4%)
Corroborated humans 7 1.7% AI agents 80 19.6% Search, SEO & ads 44 10.8% Suspected automation 207 50.6% Unattributed 71 17.4%

Half of all captured traffic was automation wearing a human costume — convicted by named, inspectable tells (missing client hints, impossible cadence, path hammering, distributed bursts), never by a black-box score. Your JavaScript analytics is structurally unable to see most of this: agents don't run JavaScript.

EXHIBIT 2

The ledger

ClassRequestsShareEvidenceBasis
Corroborated humans
Client hints + full fingerprint, human cadence, internal referers; 4 of 7 read local landing pages
71.7% 7 distinct sources, all passing every tell TIER A · OBSERVED
AI agents
Training 73: meta-externalagent 47 · Bytespider 15 · Amazonbot 9 · ClaudeBot 2 ✓ — agentic browsers 7 · live answer fetches 0
8019.6% Self-declared UAs; ClaudeBot IP-verified against operator feed TIER A · OBSERVED
Search, SEO & ads
PetalBot 25 · Bingbot 6 ✓ · Applebot 2 · OAI-SearchBot 1 ✓ · AdsBot-Google-Mobile 2 ✓ · DuckDuckBot, Baiduspider, Sogou +
4410.8% 9 rows IP-verified (✓) against published operator ranges TIER A · OBSERVED
Suspected automation
Stealth crawlers 175 (incl. two distributed proxy swarms, 44 exits — Exhibit 3) · exploit scanners 32
20750.6% Every conviction lists its tells; sample: missing-client-hints · fast-cadence · distributed-burst TIER B · CORROB.
Unattributed
Named-but-minor bots 48 · human-claimed with insufficient evidence 23
7117.4% We say "don't know" out loud rather than guess UNRESOLVED
EXHIBIT 3

Activity notes

Distributed catalog scrape, 08:40 UTC. 37 fetches in 3.06 seconds — 37 distinct product pages, one per exit, from 37 IPs across ~36 residential ISPs (Brazil, Colombia, Ecuador, Argentina, Poland, Greece), identical browser fingerprint with full client hints. Flawless per request; impossible as a population. A second wave (7 exits, category pages) followed at 09:36.
flagged: distributed-burst · 12.1 fetches/s · 1.00 fetches per exit · excluded from human counts
First sighting: OAI-SearchBot (OpenAI), IP-verified. ChatGPT's search index found this store during the period. Also first visits from DuckDuckBot, Applebot, Baiduspider and Sogou.
Live answer fetches: 0 observed. No assistant fetched a page to answer a shopper in real time this period — the baseline this statement will measure lift against.
EXHIBIT 4

Agent-channel P&L

ChannelRequestsEst. serve cost†Orders touched†Attributed revenue†
Corroborated humans7$0.011$86.00
AI agents80$0.370$0.00
Search, SEO & ads44$0.200$0.00
Suspected automation207$0.96
Unattributed71$0.33

The statement's destination: every machine class carried to cost, every human class carried to revenue, with the attribution tier printed on every join. AI-attributed orders arrive via the order-webhook join (Tier A/B) — never inferred from analytics.

† Illustrative values, for design only. The analytics comparison number arrives via a one-field reconciliation input (or read-only connector); serve costs, orders and revenue arrive with the order-webhook join. All traffic figures on this page are real captured telemetry — a live store on the meter (anonymized), 2026-08-02 03:29–15:25 UTC.

"Corroborated humans" is a floor, not a visitor count — it counts only sessions with positive behavioural evidence (JavaScript execution, or a multi-page visit at human pacing). A single tidy request is what a competent scraper produces, so it is reported as unattributed rather than human. Figures on this page were classified before the evidence bar was tightened (2026-08-02) and will be regenerated.

Attribution basis — TIER A observed server-side · TIER B corroborated by ≥2 independent markers, error bars published · TIER C modeled range, always labeled. Tiers never blend. ✓ = operator IP-verified against published ranges. Humanness verdicts carry named tells and are issued at the report layer; raw telemetry is never rewritten. Components may not sum to 100.0% due to rounding.

Raw IP addresses are destroyed at classification; only organizational network attribution (ASN) is retained.

This page: 23.9 KB · zero JavaScript · zero third-party requests botfall.ai — Your analytics counts humans. Botfall counts everything else.