That traffic spike you celebrated was probably a scraper

For years I assumed bot filtering was a solved problem. Every analytics tool claims to do it. Then I started actually looking at the traffic hitting my own sites, and the claim fell apart fast.

The uncomfortable truth: the bots that matter don't look like bots anymore.

How bots beat your analytics

The old model of bot detection is a user-agent check. A crawler shows up, politely announces itself as Googlebot or AhrefsBot, and gets filtered out. That still works for the polite ones.

But the bots inflating your numbers today are not polite. Scrapers feeding AI training runs, headless browsers doing price monitoring, spam bots warming up accounts. They run real Chrome, execute your JavaScript, load your tracker like any visitor, and rotate through residential IPs so they don't even come from suspicious networks.

To a user-agent check, they're indistinguishable from customers. So they land in your dashboard as visitors. You see a spike, you get excited, you dig in, and there's nothing behind it. No conversions, odd pages, sessions at 3 AM. Once you notice the pattern you start distrusting every number you look at.

That distrust is expensive. You make content decisions, ad spend decisions, and "what's working" decisions on numbers that are partly fiction.

Filtering has to work in layers

No single check catches modern bots, so Kobbe runs several, and each layer catches what the previous one missed:

• User-agent checks still handle the honest crawlers. Cheap and instant.

• Verified-bot detection at the edge catches known bots by cryptographic verification rather than trusting what they claim to be.

• Datacenter network (ASN) checks catch traffic coming from cloud providers and hosting networks. Real customers browse from home and mobile networks, not from a rack in Virginia.

• Behavioral signals catch what's left: the headless browsers on residential IPs that pass every static check but don't behave like humans once they're on the page.

One line I refuse to cross: VPN users stay counted. Privacy tools are not bots, and an analytics product that punishes people for protecting themselves would be a strange thing for me to build.

The part nobody mentions: bots cost you money directly

Most analytics pricing, mine included, is event-based. Every bot pageview that slips through filtering isn't just polluting your stats, it's burning your quota. You're literally paying to be lied to.

So in Kobbe, filtered traffic never touches your stats or your event count. The filtering runs on every plan, because "clean numbers" as a premium feature never made sense to me.

What changed for me

The first time I looked at a site's dashboard with layered filtering on, the traffic was lower than the old tool showed. Noticeably lower. That stung for about a minute, and then it was liberating: every remaining visit was a person. Conversion rates suddenly made sense. Referrer numbers matched revenue. The data became something I could act on.

Real visitors deserve real numbers. If you want to see what your traffic looks like without the fiction, there's a live demo with realistic data, no signup: https://app.kobbe.io/demo/kobbe-studio

If you've fought scrapers or headless traffic on your own projects, I'd love to hear what you've seen. The behavioral layer in particular gets better with every weird pattern I learn about.

/Mike