Bot Tags

Detection Dimension

Risk Level

Cloud Provider IP

1

The IP belongs to a cloud provider or hosting provider.

Medium

Threat-Intelligence Risk IP

2

The IP has exhibited DDoS/Web/Bot attack behavior within a recent period.

Medium

Proxy IP

3

The IP is a proxy IP.

Medium

Forged User-Agent

4

The User-Agent has a version mismatch or missing fields.

High

Outdated Browser or OS Version

5

The browser or OS version is significantly outdated, resulting in notably weaker security and user experience compared to current versions — in some cases, the site may not even function.

Medium

Client Type Mismatch with User-Agent

6

The client type declared in the request header does not match the client type declared in the User-Agent.

High

Browser Request Headers Severely Incomplete

7

The browser request headers are severely incomplete — for example, missing accept* headers.

Medium

Browser Request Headers Partially Incomplete

8

The browser request headers are partially incomplete — for example, missing Sec-Ch-Ua or Sec-Fetch-* headers.

Medium

Known Bot Tool/Library Fingerprint

9

The fingerprint matches a common automated crawler tool.

High

Abnormal Browser JA4 Fingerprint

10

The fingerprint does not match the actual client's JA4 fingerprint.

High

HTTP Library

30

A base library used in programs to make HTTP requests (such as Python's requests or urllib), which can be used to build automated scripts or crawlers.

High

Browser Automation Testing Tool

31

Includes tools like Selenium or Puppeteer, which simulate a real user operating a browser. They are commonly used for functional testing, but can also be abused for automated order fraud, mass registration, and similar activity.

High

Command-Line HTTP Request Tool

32

Includes tools like curl or wget, which can send HTTP requests directly from a terminal. They are commonly used for debugging or scripted calls, but can also be used for simple scraping or probing.

High

Scanning Tool

33

Includes tools like Nmap, Dirb, or Burp Suite, which are used to probe a target system's open ports, directories, or vulnerabilities. They are mostly used for security testing, but also commonly used by attackers.

High

Crawler Tool

34

Includes frameworks like Scrapy or BeautifulSoup, which are used to automatically scrape web content. They are legitimate for data collection, but high-frequency access or anti-crawling bypass attempts may be treated as malicious.

High

Proxy Tool

35

Includes proxy tools like Proxychains or Mitmproxy, which are used to relay or intercept network traffic. They can hide the real IP or analyze communication content, often used alongside other tools to bypass restrictions.

High

Fake Spider

36

A request impersonating a public crawler (such as Googlebot), using a forged User-Agent or other identifiers to evade anti-crawling measures. Typically used for covert scraping or attacks.

High

Abnormal Clustered Behavior

60

A large number of requests sharing the same or similar characteristics arrive within a short period, indicating abnormal clustering.

High