Behavioral Analysis: The Detection Layer That Changes Everything

Browser fingerprinting catches 90% of automated reviewers. The remaining 10% — well-engineered headless setups, anti-detect browsers, sophisticated farms — have spoofed every static signal. They look exactly like a real Chrome on a real machine.

What they don't have: a real human moving the mouse.

What we measure

• Mouse path — humans move mouses in curves with acceleration. Bots move in straight lines or jump.
• Scroll velocity — humans scroll in bursts, pause to read, scroll again. Bots scroll at constant speed or jump-scroll.
• Dwell time — humans spend 2-5 seconds before clicking a CTA. Bots click at the moment the element appears.
• Click position — humans click roughly center of buttons. Bots click pixel-perfect to the upper-left coordinate from selectors.
• Tab focus / blur events — humans alt-tab, blur the window, come back. Bots focus once and never switch.
• Touch vs mouse — mobile reviewers running mobile-emulated Chrome don't fire touch events. Real iOS users do.

Implementation

We collect these signals client-side via a small (5KB) JS bundle on the compliance page (yes, the compliance page — we want signals from the reviewer, who is the one seeing it). Signals are sent back as a single beacon when the user navigates away or after 5 seconds. We classify in real-time.

The tradeoff: behavioral analysis takes time. We need at least 1-2 seconds of interaction to make a confident decision. So this layer is a 'post-decision' layer — used to update the global blacklist for that IP/fingerprint, not for the initial cloaking decision.

Why it works against advanced setups

Anti-detect browsers (Multilogin, Kameleo, GoLogin) spoof fingerprint signals beautifully. But the operators sitting behind them are running scripts — not actually moving mice. Even if a human is in the loop, they're inspecting 100 sites per hour, not actually reading. Their behavior pattern is distinct.