Behavioural classification

How the pointer, keys and scroll actually moved.

What this check is

While the page is open it watches its own interaction stream: pointer movement, clicks, key presses, scrolling, focus changes, and their timing. From that stream it computes a behaviour score between 0 and 1. Human input has a texture: acceleration, hesitation, overshoot, correction. Scripted input has a different one: straight lines, even timing, inhuman completeness, or none at all.

What Tells reads

Pointer, keyboard, scroll, focus and visibility events and their timing during the visit
The activity from the optional human check, when taken

How to read your result

Fail: A behaviour score under 0.25: the interaction stream reads as scripted or absent in a way real use does not.
Warning: A score from 0.25 to 0.5: borderline texture.
Pass: A score of 0.5 or better. A short, still visit scores lower than an active one; that is the measure working, not an accusation.

Why it matters

Behaviour is the signal automation budgets feel most. Faking a header is a line of code; faking eight hours of plausible human texture, at scale, without repeating yourself, is a research programme. Sites know this, which is why behaviour analysis sits behind so many challenges that appear only after a page or two of reading. It is also the least portable signal: it says how this session behaved, not what this browser is.

Where this matters most

Across the platforms Blowhorn works with, rated in the platform guide (H = matters a lot, M = contributes, L = no public evidence; tags mark vendor-stated, reported, or inferred evidence):

LinkedIn (H): burst actions, acceptance and response rates, and navigation speed drive restrictions [Reported]
X (H): velocity, follow and unfollow churn, and duplicate content are the core spam model [Vendor]
Reddit (M): posting cadence and account history drive shadowbans; input telemetry is not documented [Reported]
GitHub (M): bulk-activity patterns (mass following and starring, rapid creation) are the documented abuse model [Vendor]
Slack (M): Slack says it detects apps acting spammy and quiets them down [Vendor]
Bluesky (M): spam is defined as automated and bulk interaction patterns [Vendor]
Hacker News (M): voting rings, posting patterns and new-account behaviour drive shadowbans; account behaviour, not input telemetry [Vendor]

Everywhere else in the set this one rates Low.

In your report

Find it in the checks table on the tool page, with the detail in the Behaviour detail section. The same findings appear in the report JSON under verdict.reasons, and the agent guide explains how to read them programmatically.