We’re very excited to announce our new bot and agent detection product: Telltale Bot! Now offering a 14-day, 500k pageviews free trial.

What is Telltale Bot?

It’s a JavaScript tag that tells you whether a visitor is human, bot, or agentic — including naming the agent. It returns that information (we call it a “verdict”) back to the page via an event push that can be used however you’d like. For example you can bring the bot verdicts back into GA4 and see how much of your traffic is bots and agents! We have a demo with synthetic data here.

Why did we build it?

Quantable has a long history of working on bot detection. All the way back in 2015 we launched our Google Analytics Referral Spam Filter service, used by thousands to keep bot spam out of their GA reports. For years after that we maintained a segment called “bot-ish” in the old Universal Analytics solutions gallery. More recently we’ve run a couple of tag-based solutions to filter and identify bots within GTM as well as a server-side plugin.

None of these solutions have been anywhere near ideal. The problem is that we’ve been stuck working within Google Analytics. GA has limited data collection, poor abilities to filter data, and no way to have a data view dedicated to just bots.

Actually, let’s go back a step. To be clear, Google Analytics does filter bots, but like most analytics platforms it doesn’t do a very good job at it. Its bot filtering is based largely upon the IAB’s spider & bots list, which is a paid subscription list built around user-agent detection. This fails to detect most of the smart bots out there, which know that they need to lie about who they are to get past blocking. GA is not alone in being mediocre at detecting bots — in fact it typically shows in the middle of our pack in our testing of how bots show in analytics.

After trying so many different bot solutions and work-arounds, we decided it was finally time to make our own platform. A few of the important things we wanted to do with our tool:

Make it easy.
We’ve used a lot of enterprise bot detection platforms. In fact we have a pretty comprehensive comparison page outlining over a dozen tools with their use cases and prices. Those platforms are 100% what you need if you want to stop bots before they ever hit your site. This level of integration means they tend to be complicated to set up, and complicated to use. We wanted all that accuracy, but without the heavy lifting of changing your infrastructure or doing a bunch of tweaking.

Make it affordable.
With the explosion of bot traffic in the last couple years, bot detection is something that many more sites need. But most sites aren’t going to be willing or able to pay for enterprise-level contracts for something that is less about cybersecurity and more about analytics. Additionally many ad click fraud tools have been sold based upon a percentage of spend or number of ad clicks, which is an unattractive pricing model for most sites doing PPC-based purchasing.

Separate it from analytics.
Simply put, bot detection tech is invasive. It’s got to get all up in the web browser’s business to be able to accurately differentiate between a human and a disguised bot. This kind of network inspection and fingerprinting-like technology should never be used to target ads or track what people do on your site, but it’s necessary to identify bots and stop fraud. This means that there should be a separation between the data collected by your bot detection layer and your analytics layer. Telltale Bot provides that.

How does it work?

Telltale is a purpose-built bot detection system, not a hack on top of an existing analytics platform. It looks at browser details and consistency, user behavior, and network details.

If you’re stuck with the data that GA shows you, it’s simply not possible to do a good job reporting on bots. There are certain signals you can see within GA that are very indicative of bots, like:

1. Spikes in direct traffic
2. Traffic from cities with lots of datacenters (most famously Ashburn, VA)
3. Traffic with “bot-ish” screen resolutions (800×600)

These are all highly correlated with bot traffic, but contain many false positives. For example, while it is home to hundreds of data centers, Loudoun County in Virginia also has 400k+ real live humans. Plus many humans use VPNs that have exit points from data centers. Blanket exclusion can make your reports look cleaner, but you’re flushing a lot of useful information as well.

Bot detection is probabilistic. There are bots that declare who they are and can be verified by IP address or (increasingly) Web Bot Auth, but when we’re talking about “detecting bots”… we’re talking mostly about uncovering those that aren’t declaring themselves.

This means to do a good job of detecting bots, you need to have a scoring system that takes into account a number of different factors and decides on balance if a visit is bot or not. Currently Telltale Bot uses 60+ different signals (we call them “tells”… get it??) to give a verdict, and we re-evaluate our all our rules on an ongoing basis. We also are cognizant that more tells does not always mean better accuracy. Here are some of the general rules we follow in our model:

• No single tell is definitive (aside from self-identification).
• Every tell should add some decision power. In other words, tells that are basically just variations on the same thing don’t help us.
• Tells can come in and out of usage pretty quickly as browsers and bots change. For example a single Chrome update can ship and wipe out a previously useful bot tell at any time.
• Careful technical evaluation of individual tells beats black box machine learning.
•  False positives (humans we ID as bot) are bad, but unavoidable. Treating false positives as worse than false negatives (missed bots) makes sense in a cybersecurity perspective but not as much for analytics.

What about AI?

We describe Telltale Bot as “bot + agent detection”. Let’s talk about the “agent” part… what is an agent anyways? When we say “agentic traffic”, we’re talking about traffic coming from browsers (headless and real) run by an AI at the direct behest of a person. We list all the agents we detect here, and most of the traffic we’ve seen is from the bigger agents you’d expect, though probably not the order you’d guess: Meta Muse, Claude, ChatGPT, Grok. We only see agents that load the page in a browser and run JavaScript. A web fetch that just grabs the HTML never shows up.

Agentic traffic is automated traffic. It’s a variation of bot traffic where there’s a human directing it, doing a human-like task on behalf of a person. This means that a lot of bot filtering and blocking will affect agentic traffic. As the line between bot and human blurs, it matters more and more to know what’s automated and what isn’t, and that’s where we come in.

The Pitch

Look, we know it’s crowded in your tag manager. We know there are a million and one new analytics products launched every day. But we’re proud of what we’ve built with Telltale Bot and we hope you’ll give it a try.

Share this post: on Twitter on Facebook on LinkedIn