How click bots that imitate behavior work

In the public descriptions, a click bot is a program that imitates an ordinary browse of a site in order to produce a click or an impression. Google Ads calls that traffic non-human traffic. The same documents also cover repeated clicks by people, a windowless browser used for tests, and a network of captured computers. The single word "bot" does not glue those cases together.

If clicks rose in a report without a matching goal, name first which of these mechanisms you can actually see from the outside. Imitating behavior is precisely the case where the visit looks ordinary.

What counts as imitating an ordinary browse

Google Ads describes non-human traffic as programs that imitate an ordinary browse of a site for a click or an impression. The definition is short: it names the aim (a click or an impression) and the method (looking like an ordinary browse). It does not list devices, scripts, or thresholds.

The MRC standard places similar cases in SIVT — situations that are harder to notice and that need advanced analysis, a comparison of several signals, or a clear human role. The examples include automation from a dedicated device and from an infected or captured device, incentivized human activity, forced clicks and accidental clicks caused by a spoofed interface, fabricated measurement events, bots that disguise themselves, and invalid proxy traffic. A footnote gives a click farm as a case where non-robot activity is organized and directed through many users or machines. The word IVT covers both the standard-list class and SIVT. Over time, some SIVT can move into the class that standard lists recognize.

This is a classification for ad measurement, not a description of how a farm is built and not a how-to. The standard asks that disclosed reward programs without an intent to substitute measurement stay outside this category. Imitating behavior is one example among several, and living organized activity sits in the same class.

Repeated people and auto-clicks at a publisher

Google AdSense help calls invalid traffic the clicks and impressions that can inflate an advertiser's spend or a publisher's earnings. The list includes both intentional fraud and accidental clicks. Among the examples are a publisher clicking its own live ads, repeated clicks or impressions by one or several users, calls to click, automatic click tools, robots, and other misleading software. A click on a Google ad is supposed to come from genuine interest. Someone else can inflate traffic without the publisher knowing.

This is an AdSense publisher policy, not farm statistics and not a Yandex Direct rule. The page gives no share and no threshold for "how many repeats already count as fraud." For an advertiser the distinction is already useful: repeated living people and an automatic click tool sit on one list of invalid traffic, and they are different sources.

A windowless browser is not the same as a click bot

Chrome's documentation describes Headless as running the browser unattended and without a visible interface. From Chrome 112 the mode works like this: platform windows are created but not shown, and the other features, current and future, are available. Earlier, Headless was a separate browser implementation inside the same binary and did not share ordinary Chrome's code. From Chrome 132.0.6793.0 the old mode remains only as a separate chrome-headless-shell binary. In the Puppeteer example, headless: true turns Headless on by default, and headless: false opens an ordinary window.

The Headless flags help distinguishes --dump-dom from downloading HTML the way curl does. To print the DOM, Chrome first parses the HTML, runs scripts that may change it, and only then serializes the result. That launch can execute the page's scripts, not only fetch the source. The documentation describes the mode for automation and tests. It does not call a windowless launch click fraud by itself. Masking flags are not part of the description, and a stock flag is not a list of signs by which a visit is judged automatic.

Botnet is a different word

The NIST CSRC glossary, as of 26 August 2026, gives one definition of botnet and marks the source: NIST SP 1800-15, citing a Kaspersky resource. The word is built from robot and network. In that text, attackers use Trojans to take control of users' computers and assemble them into a network they operate remotely. The glossary itself asks you to cite the original publication and says that definitions on the site are not a single official meaning of the term.

This is a vendor's data retold by NIST. The glossary page has no network size, no share of clicks, and no link to advertising. Article 273 of the Russian criminal code does not call this mechanism a botnet. A captured device in the SIVT examples overlaps that network description in meaning, but the glossary does not define an ad click.

What the check can miss

Binetro's current check does not use a TLS fingerprint or an HTTP/2 fingerprint. A replay of someone else's visit description is not recognized from the first copy. Some automatic browsers can be let through. These are known gaps, not a promise of complete protection. Tool names, replay thresholds, and the bypass method are not published. If a click bot imitates an ordinary browse and does not immediately replay someone else's visit description, a single allow does not disprove the check and does not prove the visit was human.