First, retire the word "bot"

Three different things hide behind it, and they leak differently:

Tier 1 — automated accounts. Scripts. They leak automation: machine-even posting intervals, generated-name patterns (Firstname Lastname8123 cohorts), impossible hours held for weeks.

Tier 2 — cheap operated fakes. Real humans, fake accounts, paid per comment. This is the tier that actually floods commercial and political campaigns — and it defeats every automation signal, because the typing is human. What it cannot hide is coordination: the campaign brief synchronizes them. They arrive in bursts, they paraphrase the same talking point, they repeat themselves across posts, they reply to each other to lift the thread.

Tier 3 — professionally managed personas. Full histories, varied interests, natural language. Here is the honest limit: in engagement data alone, these are indistinguishable from real people by design. Anyone selling certainty about this tier is selling vibes.

The signals worth trusting (each with its evidence)

1. Timing bursts — many distinct accounts commenting on one post inside a tight window. Evidence: the timestamp cluster. One burst is an influencer share; recurring bursts with overlapping membership are a pattern.

2. Duplicate and near-duplicate text — identical or lightly-edited comments across accounts. Copy-paste with cosmetic edits clusters beautifully.

3. Talking-point convergence — distinct accounts using the same rare phrase inside a window. Softer than duplication, still leaky.

4. Cross-post repetition — one account, one text, many posts.

5. Machine-regular cadence — posting intervals too even for a human (needs several comments per account to mean anything).

6. Burst-only participation — accounts that exist in your data only inside bursts.

7. Mutual reply-chains — pairs boosting each other's comments to lift thread ranking.

The two disciplines that keep the analysis honest

Insufficient data is an answer. An account with one comment cannot be judged — not "probably fine," not "suspicious." Insufficient signal. Most accounts in most datasets land here, and saying so is what makes the rest of the analysis credible.

Signals describe behaviour, never persons. "This account's comments sit inside two bursts and a duplicate cluster" is evidence. "This account is a bot" is a guess wearing a costume — and a legal exposure if you put it in a client deliverable. Report patterns with evidence attached; let humans decide what to do about them.

The procedure

1. Deduplicate comments first (same comment arrives twice via URL variants).

2. Group by account; count; below threshold -> INSUFFICIENT SIGNAL, stop.

3. Detect bursts per post (window + distinct-account minimum).

4. Cluster normalized text (exact, then near-duplicate, then rare-phrase).

5. Check cadence regularity, cross-post repeats, reply-chain pairs.

6. Levels from accumulated evidence: NO SIGNALS / WEAK / MULTIPLE / STRONG.

7. Print into the deliverable: the coverage block, the evidence per flag,

   and what the method CANNOT detect (Tier 3). The limits are the credibility.

Disclosure: I build a tool that runs exactly this — the Engagement Authenticity Audit processes any Facebook comments export ($0.66 per 1,000 unique comments, deduplicated first; free demo with a planted burst you can watch it catch — and a single-comment account you can watch it refuse to judge). Its siblings: the free Page Identity Resolver and Page Compare. The procedure above works without any of them — that's rather the point.

Why your counts are wrong

Pull posts from any Facebook scraper and look at the page URLs. The same fish market shows up as:

https://www.facebook.com/HelensFreshMarket
https://m.facebook.com/helensfreshmarket/
https://www.facebook.com/profile.php?id=100077000000001
https://www.facebook.com/p/Helens-Fresh-Market-100077000000001/

Group by URL and you have four "pages," each with a quarter of the real engagement. Every downstream number — rankings, share-of-voice, averages — inherits the error. Post URLs have the same disease: the same post arrives with and without tracking parameters, from mobile and desktop hosts, and through share redirects.

The zoo, part 1: hosts

All of these serve the same content and must be folded together:

Rule 1: fold every host to www.facebook.com, force https, drop the trailing slash. Trivial, and it already collapses a third of the zoo.

The zoo, part 2: page-identity URLs

These are the formats that name a page (strongest evidence first):

Rule 2: extract identity by hierarchy — a numeric ID always outranks a slug. When both are observed for the same entity (a slug URL and a profile.php?id= URL that share posts or metadata), the numeric ID is the canonical key and the slug becomes an alias.

Rule 3: slugs are case-insensitive — case-fold before comparing. HelensFreshMarket and helensfreshmarket are the same page; a case-sensitive groupby splits them.

The zoo, part 3: post URLs

Rule 4: for deduplication, strip tracking parameters but keep identity parameters. Strip: ref, refid, fbclid, mibextid, rdid, utm_*, tn, comment_id, notif_id, notif_t, locale. Keep: story_fbid, id, fbid, v. The same post with and without ?ref=share&utm=x is one post; the same path with a different story_fbid is not.

The traps (where guessing corrupts datasets)

Trap 1 — display names are not identity. Two pages named "Caladan Bay Tours" can be genuinely different entities (rebrand, fan page, impersonator, franchise). Merging on display name is how datasets rot. The correct behavior is to report the collision as a possible-same-entity hint with the evidence, and let a human decide.

Trap 2 — /watch?v= links carry no page identity. The URL names a video, not a page. Attribute it to a page only if the row carries separate page metadata; otherwise it is honestly unresolvable.

Trap 3 — share links are opaque. /share/p/{token}/ is a server-side redirect; the token doesn't encode the destination. Offline, you cannot resolve it — flag it, don't guess it.

Trap 4 — renames. A page that changed its vanity slug between scrapes, and never exposed its numeric ID, looks like two pages. Without an ID observation there is no safe automatic merge; surface it, don't force it.

Trap 5 — pfbid tokens. Modern post IDs are opaque pseudonymized tokens. Treat them as exact-match strings only; never parse meaning out of them.

The procedure, end to end

for each row:
  1. fold host → www.facebook.com, https, strip trailing slash
  2. classify URL: page-identity form vs post form
  3. page identity:
       numeric ID present → key = fb:{numeric}
       else vanity slug   → key = fb:{casefold(slug)}
       else               → UNRESOLVED (keep the URL as evidence)
  4. post dedup key: canonical path + kept identity params
       (tracking params stripped)
  5. merge pages only when keys match
       same display name, different keys → report hint, do NOT merge

The principle underneath: an unresolved row with its evidence attached is useful; a silently guessed merge is poison. Every downstream consumer can act on "here are 3 rows I couldn't resolve, and why" — nobody can undo a wrong merge they never knew happened.

Disclosure: I maintain a small free tool that implements exactly this procedure (including the refusals) for any posts-scraper export — Facebook Page Identity Resolver & URL Deduplicator on Apify, with a 3-second no-signup demo. But the procedure above works fine without it — that's rather the point.