Q: I suspect bot traffic in my campaign. How do I confirm it step by step?

Q: I suspect bot traffic in my campaign. How do I confirm it step by step?

A: Confirm before you accuse a source. Work down this ladder:

— Time-on-page: pull session durations. A wall of sub-1-second sessions is automation, full stop.
— Mouse and scroll events: real users move and scroll. Zero interaction events at scale is a bot tell.
— User-agent spread: too uniform (all the same browser build) or full of known data-center agents is suspect.
— IP type: run a sample through an IP intelligence lookup. Data-center and hosting ranges shouldn't dominate consumer traffic.
— Conversion shape: instant conversions with no funnel steps in between are scripted.
— Repeat fingerprints: the same device fingerprint hitting many times is one bot, not many users.

Two or more red flags on the same sub-source? That's your culprit.

Short version: time, interaction, user-agent, IP, funnel shape, fingerprint.

Still stuck? Drop your case in the comments.