Modern bot networks have evolved from simple scripts to sophisticated systems using anti-detect browsers and physical mobile device farms. These setups allow operators to simulate human behavior, including scrolling, form filling, and complex navigation, by managing isolated browser profiles or controlling real Android devices via API.
The use of physical Android devices is a key factor in bot operations, as it allows for genuine touch events that bypass traditional detection. The author notes that in their research, all bot conversions originated from Android devices, suggesting that iOS security protocols and hardware restrictions make mass automation on iPhones technically and economically impractical.
Human intervention remains a critical component of these networks. When bots encounter complex challenges like custom captchas, they pause and hand control to human operators. The author observed that these captchas were solved nearly instantaneously, indicating that the operator was actively monitoring the session, rather than using automated third-party services.
The author argues that solving a captcha should not be considered definitive proof of a human visitor. Bots often resume automated tasks immediately after a human solves the challenge, ignoring site elements like pop-ups. Consequently, the author suggests that only verified financial transactions should be used to validate traffic quality and justify advertising spend.
