How Much of Purchased Web Traffic Is Really Bot Traffic? The Truth About Traffic Fraud, Fake Visitors and Ad Networks

Buying website traffic sounds simple.

You pay an advertising network, choose a GEO, select a traffic format, set a budget, and visitors start arriving at your website.

But then something strange happens.

Google Analytics shows thousands of visitors. The advertising network reports millions of impressions. Your affiliate dashboard shows some clicks — but very few sales.

You start asking the obvious question:

Are these visitors real people, or are they bots?

The answer is not as simple as “10% are bots” or “50% are fake.”

There is no universal percentage of bot traffic across all advertising networks. In fact, Google explicitly states that there is no industry-standard “normal” invalid traffic rate. Invalid traffic varies considerably depending on the advertising ecosystem, traffic source, device, GEO, publisher inventory and other factors.

And this is where things become interesting.

A traffic campaign can contain:

• real humans,

• automated bots,

• sophisticated bots,

• accidental clicks,

• low-intent users,

• incentivized users,

• fraudulent clicks,

• compromised-device traffic,

• data-center traffic,

• traffic resellers,

• arbitrage traffic,

• and perfectly legitimate visitors who simply have no interest in your offer.

All of these can produce terrible affiliate results, even though only some of them are technically bots.

So, How Many Bots Are Actually in Purchased Traffic?

The honest answer is:

Nobody can give you one universal percentage.

Anyone claiming that “all cheap traffic is 80% bots” or “this network has exactly 5% bots” without showing independent measurement data should be treated cautiously.

However, industry research demonstrates that invalid traffic is not a theoretical problem.

For example, Pixalate's Q1 2025 research measured global programmatic advertising traffic and reported an 18% invalid traffic rate on web traffic, 31% on mobile apps and 18% on CTV. Its research covered more than 100 billion programmatic advertising impressions.

Those numbers should not be interpreted as:

“18% of every traffic-buying campaign consists of bots.”

They don't mean that.

They describe measured invalid traffic within a particular programmatic advertising dataset.

The distinction is extremely important.

Invalid Traffic Is Not the Same Thing as Bot Traffic

This is probably the biggest misunderstanding in the traffic-buying business.

Bot traffic is only one category of invalid traffic.

Google defines invalid traffic broadly. It includes automated traffic and robots, but also repeated clicks, accidental clicks, deceptive advertising implementations and other activity that doesn't represent genuine user interest.

Imagine that you buy 10,000 visitors.

You might theoretically receive:

Traffic type	What happens
Real interested users	They browse and potentially convert
Real uninterested users	They are human but don't care about your offer
Accidental clicks	They clicked without intending to visit
Incentivized users	They visit because they receive a reward
Bots	Automated software generates visits
Sophisticated bots	Bots behave more like humans
Fraudulent clicks	Traffic is generated to create advertising revenue
Data-center traffic	Traffic originates from hosting/cloud infrastructure
Cookie manipulation	Tracking is manipulated
Resold traffic	Your “direct” traffic passes through several intermediaries

From an affiliate marketer's perspective, several of these categories can look almost identical.

That is why saying:

“My campaign isn't profitable, therefore the traffic is bots.”

is not necessarily correct.

The traffic could be 100% human and still be worthless.

The Most Dangerous Traffic Isn't Always Obviously Fake

This is where the discussion becomes much more interesting.

A sophisticated bot can generate:

• a normal-looking user agent,

• JavaScript execution,

• cookies,

• multiple pageviews,

• scrolling,

• mouse movements,

• random delays,

• mobile browser characteristics,

• different IP addresses,

• different sessions.

Some automated systems are specifically designed to imitate human browsing behavior.

Google itself acknowledges that botnets can be programmed to generate large volumes of invalid impressions and clicks and can be made to behave like real users, making detection more difficult.

So a simple test such as:

“It has JavaScript enabled, therefore it's a real person.”

is not enough.

Neither is:

“The IP address isn't on my bot list.”

Modern traffic analysis is considerably more complicated.

The Three Different Traffic Problems

When buying traffic, I would divide the problem into three completely different categories.

1. Fake Traffic

This is the classic scenario people imagine.

Automated software generates:

• impressions,

• clicks,

• sessions,

• pageviews,

• interactions,

• or conversions.

The purpose may be to generate advertising revenue or manipulate performance metrics.

This is the obvious form of traffic fraud.

2. Real But Worthless Traffic

This is much more common than many beginners realize.

Imagine you buy 100,000 visitors from a cheap advertising network.

They are real humans.

They are using real smartphones.

They are located in your target country.

They click your advertisement.

They visit your website.

They may even stay for several seconds.

But they have absolutely no interest in your product.

Your affiliate conversion rate becomes terrible.

Technically, this isn't necessarily bot traffic.

Economically, however, the result can be almost identical.

You paid for traffic that doesn't produce revenue.

3. Manipulated or Low-Quality Inventory

This is the grey area between legitimate advertising and outright fraud.

For example, traffic can pass through multiple resellers before reaching you.

The advertising network might buy inventory from another network.

That network might buy it from another intermediary.

Eventually nobody has perfect visibility into the original source.

The more intermediaries involved, the more difficult it becomes to understand exactly what you're buying.

Pixalate's 2025 supply-path research illustrates how significant this problem can become. In Q1 2025, it estimated that 13% of global open programmatic web ad impressions with SupplyChain Object data failed its verification because of unauthorized sellers. Pixalate also reported substantially higher IVT rates in traffic involving unauthorized direct sellers.

Again, this does not mean that 13% of all Internet traffic is fraudulent.

It means that the programmatic supply chain itself can be surprisingly complicated.

How Much Traffic Fraud Exists on the Internet?

A huge amount — but there is no single number that accurately describes the entire Internet.

Different researchers measure different things.

They may measure:

• impressions,

• clicks,

• sessions,

• advertising transactions,

• mobile apps,

• desktop web,

• mobile web,

• CTV,

• search advertising,

• display advertising,

• programmatic advertising,

• or specific countries.

Consequently, percentages can vary dramatically.

For example, Pixalate's Q2 2025 research found substantial differences in click fraud depending on environment. In North American programmatic advertising, it reported invalid click rates of 19% on desktop web, 17% on mobile web and 35% on mobile in-app traffic.

Those numbers are eye-opening.

But they also demonstrate why a single “bot percentage” is misleading.

The environment matters.

The device matters.

The traffic source matters.

The advertising format matters.

The GEO matters.

And the definition of invalid traffic matters.

Are Cheap Traffic Networks Mostly Bots?

Not necessarily.

This is another important distinction.

A cheap traffic network can contain legitimate human traffic.

The problem is that cheap traffic often has low commercial intent.

Suppose a network sells traffic at $0.20 CPM.

That means you can potentially buy a huge number of impressions very cheaply.

But the users may be:

• browsing entertainment websites,

• consuming free content,

• clicking accidentally,

• using low-value inventory,

• coming from aggressive advertising environments,

• exposed to dozens of advertisements,

• or simply having no reason to buy anything.

You could receive 100,000 genuine human visitors and still generate almost no affiliate revenue.

That doesn't automatically make the network a scam.

It may simply mean that the traffic doesn't match your business model.

The Difference Between Traffic Volume and Traffic Value

This is probably the most important lesson for affiliate marketers.

Consider two campaigns.

Campaign A

100,000 visitors

Affiliate CTR: 0.5%

Conversion rate: 2%

Commission: $20

Expected revenue:

100,000 × 0.005 × 0.02 × $20

= $200

Now imagine the traffic costs $100.

You made $100.

That traffic could theoretically be completely human.

Campaign B

10,000 visitors

Affiliate CTR: 5%

Conversion rate: 5%

Commission: $30

Expected revenue:

10,000 × 0.05 × 0.05 × $30

= $750

The second campaign produces much less traffic but dramatically more revenue.

This is why:

10,000 qualified visitors can be worth more than 1,000,000 cheap visitors.

Why Affiliate Marketers Are Particularly Vulnerable

Affiliate marketers have a difficult problem.

The advertising network controls the traffic.

The affiliate network controls the offer.

You control the landing page.

And there can be several tracking systems between them.

For example:

Ad network → tracking platform → landing page → affiliate link → affiliate network → merchant → sale

Every step introduces potential measurement differences.

A visitor may:

1. see your advertisement,

2. click it,

3. arrive at your landing page,

4. click the affiliate link,

5. reach the merchant,

6. abandon the purchase.

Was the traffic fake?

Not necessarily.

The user simply didn't buy.

This is why conversion data must be analyzed together with traffic-quality data.

What Does a Bot Pattern Look Like?

There isn't one universal bot signature.

However, suspicious campaigns can display combinations of unusual characteristics.

For example:

Extremely high traffic with almost zero engagement

You receive 50,000 visitors.

But:

• almost nobody scrolls,

• nobody clicks internal links,

• nobody returns,

• almost nobody reaches the second page,

• affiliate clicks are almost nonexistent.

That deserves investigation.

Abnormally consistent behavior

Humans are messy.

They behave differently.

If thousands of sessions display strangely similar:

• session durations,

• page sequences,

• timestamps,

• device characteristics,

• interaction patterns,

the traffic deserves closer examination.

Large amounts of data-center traffic

Traffic originating disproportionately from cloud and hosting infrastructure can be suspicious depending on the campaign.

It is not automatically fraudulent — legitimate users and corporate networks can also use cloud infrastructure — but unusual concentrations can be a signal.

Massive geographic anomalies

Suppose you target Germany.

You receive 100,000 German visitors.

But your server logs reveal unusual infrastructure patterns, highly concentrated IP ranges or other characteristics inconsistent with your expected audience.

That doesn't prove fraud.

It does justify investigation.

Why Analytics Tools Alone Cannot Tell You Everything

Another common mistake is trusting one analytics platform as an absolute source of truth.

Google Analytics may show:

25,000 users

Your ad network may show:

31,000 clicks

Your server may show:

28,000 requests

Your affiliate network may show:

18,000 outbound clicks

These numbers can all be different.

Why?

Because different systems measure different events.

There can be:

• ad-blockers,

• browser privacy protections,

• JavaScript failures,

• redirects,

• tracking protection,

• duplicate requests,

• bots,

• prefetching,

• delayed loading,

• attribution differences,

• cookie restrictions.

Google itself notes that third-party tools can flag traffic as invalid even when Google has already filtered the corresponding invalid interactions from its own advertising reporting.

So analytics discrepancies do not automatically prove fraud.

How Traffic Scammers Make Money

There are several business models behind fraudulent traffic.

One is relatively simple:

Buy cheap traffic → resell it at a higher price.

Imagine:

Traffic source A sells traffic for $0.20 CPM.

Network B buys it and sells it for $0.50 CPM.

Network C resells it for $1 CPM.

You purchase it for $1.50 CPM.

You believe you're buying premium inventory.

But underneath the chain, the original traffic may be extremely cheap.

This is one reason supply-chain transparency matters.

Another model involves fraudulent generation itself.

A bad actor may attempt to generate:

• fake impressions,

• fake clicks,

• fake leads,

• fake conversions,

• fake installs,

• or other measurable actions.

The more valuable the action, the more attractive the fraud becomes.

The Most Dangerous Phrase in Traffic Marketing

Be very careful when somebody tells you:

“Guaranteed conversions.”

Or:

“Guaranteed ROI.”

Or:

“100% human traffic.”

Or:

“Zero bots.”

Or:

“Guaranteed sales.”

Nobody can honestly guarantee that every visitor will behave like a potential customer.

Even a legitimate advertising network cannot control what every human visitor does.

A person can:

• change their mind,

• close the browser,

• reject cookies,

• abandon the purchase,

• click accidentally,

• browse without buying,

• or simply decide your product isn't interesting.

Traffic quality is probabilistic, not guaranteed.

Is Buying Traffic Therefore a Scam?

No.

Buying traffic itself is absolutely not a scam.

The Internet advertising ecosystem is enormous and contains legitimate advertising businesses.

Google, for example, operates extensive systems specifically designed to detect and filter invalid traffic. Google says it uses automated filters, machine learning and manual investigations to identify invalid activity.

The problem is that the broader ecosystem contains both legitimate and problematic participants.

Therefore the correct question isn't:

“Is paid traffic a scam?”

It is:

“Can I independently verify that this particular traffic source produces economically valuable visitors?”

That's a much better question.

The Biggest Scam Is Sometimes Not Bot Traffic

This sounds strange, but it is worth emphasizing.

Imagine somebody sells you:

100,000 real human visitors for $50.

The traffic is genuine.

There are no bots.

There is no malware.

There is no fake browser automation.

But the visitors have:

• no commercial intent,

• no interest in your niche,

• no purchasing motivation,

• extremely low engagement.

You make $12 in affiliate revenue.

Technically, you didn't buy fake traffic.

But commercially, you bought something almost useless.

This is why traffic quality is broader than bot detection.

A Better Way to Measure Traffic

Instead of asking only:

“Are they bots?”

ask:

1. Do they behave like humans?

Look at:

• engagement,

• navigation,

• scroll behavior,

• session patterns,

• returning users,

• device distribution.

2. Do they behave like your target audience?

Look at:

• GEO,

• device,

• language,

• referral source,

• time of day,

• demographic indicators where lawfully and appropriately available.

3. Do they interact with your funnel?

Measure:

Ad → Landing Page → CTA → Affiliate Click → Merchant → Conversion

You want to know exactly where the funnel breaks.

4. Does the traffic produce revenue?

Ultimately:

Revenue per visitor

is much more important than raw visitor count.

A Simple Traffic Quality Scorecard

For every traffic source, create a table like this:

Metric	Network A	Network B	Network C
Visitors	50,000	50,000	50,000
Cost	$100	$200	$400
Affiliate clicks	250	800	1,600
Conversions	5	32	80
Revenue	$100	$640	$1,600
Profit	$0	$440	$1,200
ROI	0%	220%	300%

Now imagine that Network A claims:

“Our traffic is 100% human.”

That doesn't make it attractive.

Network C may cost four times more but generate dramatically better economics.

This is the central lesson:

You are not buying visitors. You are buying the probability of profitable user behavior.

What Percentage of Your Campaign Should You Assume Is Bots?

I would not build a business model around an assumed bot percentage.

Don't say:

“I'll assume 20% are bots.”

That number may be completely wrong.

Instead, treat the campaign as an experiment.

Start with a controlled amount of money.

For example:

$50–$100 test budget

Then collect enough data to answer:

• How many visitors arrived?

• How many were filtered?

• How many engaged?

• How many clicked the CTA?

• How many clicked the affiliate link?

• How many converted?

• What was the revenue per visitor?

• What was the revenue per click?

• What was the CPA?

• Which GEO worked?

• Which device worked?

• Which placement worked?

• Which subzone worked?

Then eliminate the sources that fail.

Don't Try to Detect Every Bot Yourself

Another mistake is spending enormous amounts of time trying to become a traffic-forensics expert.

You don't necessarily need to identify every bot individually.

You need to determine:

Which traffic sources make money?

If a source produces 100,000 visitors and zero affiliate revenue, you don't necessarily need to prove that 73% were bots.

You can simply conclude:

This source isn't economically useful for my campaign.

That's enough to stop buying it.

The Real Enemy: Blind Scaling

A beginner might discover:

“I spent $20 and made $40!”

Then immediately increases the budget to:

$2,000.

That can be a disaster.

The first $20 may have purchased the best available traffic.

Scaling may introduce:

• weaker placements,

• lower-quality inventory,

• additional publishers,

• additional resellers,

• different GEOs,

• different devices,

• different subzones.

The economics can change dramatically.

Therefore, scaling should happen gradually.

What I Would Actually Do With a New Traffic Network

If I were testing an unfamiliar ad network for an affiliate blog, I would start extremely small.

For example:

One network

One GEO

One device category

One traffic format

One landing page

One affiliate offer

One tracking setup

Then I would run the campaign long enough to obtain meaningful data.

I would not simultaneously change:

• GEO,

• landing page,

• offer,

• ad format,

• traffic network,

• and budget.

Otherwise, you won't know what caused the result.

The Difference Between a Bad Network and a Bad Offer

This is another crucial point.

Suppose your campaign produces:

10,000 visitors → 3 affiliate conversions.

You might blame the traffic network.

But perhaps the real problem is:

• poor landing page,

• weak headline,

• bad affiliate offer,

• incorrect GEO,

• inappropriate pricing,

• poor mobile UX,

• slow website,

• weak trust signals.

Traffic is only one component of the system.

The entire funnel must be evaluated.

Why Adult Traffic Requires Even More Care

Adult websites can be particularly complicated because mainstream advertising platforms and publisher ecosystems have restrictions around sexually explicit content.

This means adult marketers often operate through specialized advertising networks and affiliate ecosystems.

The result is a fragmented marketplace.

Some sources can deliver enormous volumes very cheaply.

But cheap volume doesn't necessarily mean:

high-quality purchasing intent.

For adult affiliate sites, you should therefore track the complete funnel:

Impression → Click → Landing Page → Content Engagement → Affiliate Click → Registration → Purchase

For subscription-based offers, the final conversion may occur much later than the original advertising click.

This makes traffic quality even more important.

So, Are Most Cheap Traffic Visitors Bots?

No.

And this is probably the conclusion that surprises people.

Cheap traffic is not synonymous with bot traffic.

A cheap visitor can be:

• a real person,

• a low-intent person,

• an accidental click,

• an incentivized visitor,

• a poorly targeted visitor,

• a bot,

• or something in between.

The real problem is that the buyer often doesn't have enough transparency to distinguish them.

And that is exactly why independent tracking is so important.

The Bottom Line

There is definitely a huge amount of traffic fraud on the Internet.

Independent industry research regularly finds significant invalid traffic rates in programmatic advertising, and the percentages can reach double digits depending on the environment being measured.

But that does not mean that 20%, 30% or 50% of every traffic campaign is bots.

There is no universal percentage.

There is also a major difference between:

bot traffic

and

real but commercially useless traffic.

For an affiliate marketer, both can produce the same financial result: wasted money.

The smartest approach is therefore not to obsess over a theoretical bot percentage.

Instead, measure the economics of every traffic source.

Track:

Cost → Visitors → Engagement → Affiliate Clicks → Conversions → Revenue → Profit

And then make the decision based on data.

A traffic source that sends 100,000 genuine humans but produces $50 in revenue isn't necessarily better than a source that sends 5,000 highly targeted visitors and produces $500.

In the end, the value of purchased traffic isn't determined by how many visitors you receive. It is determined by what those visitors actually do.

And that is why the most dangerous traffic isn't always the traffic that looks fake.

Sometimes the most expensive traffic is completely real — and completely useless.