Not much time. Probably a couple days. We used maxmind proxy detection and FingerPrint.js. We also used source of traffic. Bots never come in on ads. They c

Not much time. Probably a couple days. We used maxmind proxy detection and FingerPrint.js. We also used source of traffic. Bots never come in on ads. They come in direct. Stuff we built at a neoBank to prevent credential stuff from password leaks was a lot more sophisticated. Couldn’t trust email based 2fa because people re-used passwords. We did invasive hashing of internal networks with webRTC and also pierced proxies with STUN. Along with using a commercial waf that did real time profiling.