• You: Bot 100.0% Low
    ← Dashboard / Signature Detail
    US

    Spoofed-Amazonbot

     · Amazonbot 0.1 Bot
    GoodBot
    Policy: rate-limit-search
    Probability
    100 %
    Confidence
    91 %
    Risk Profile
    VeryHigh
    Threat
    None
    Hit Count
    4
    Last Seen
    19s ago

    Analysis

    Spoofed-Amazonbot on /docs/cli-reference - caught by Known AI search bot: Amazonbot (Amazon), Known bot pattern: Amazonbot, Spoofed UA: claims to be Amazonbot but IP doesn't verify ...

    Detection Signals

    • ↑ Heuristic model (late): 99 % bot likelihood (297 features) 2.45
    • ↑ Known AI search bot: Amazonbot (Amazon) 1.90
    • ↑ Known bot pattern: Amazonbot 1.35
    • ↑ Spoofed UA: claims to be Amazonbot but IP doesn't verify via fcrdns 1.27
    • ↑ Heuristic model (early): 82 % bot likelihood (22 features) 1.27
    • ↑ Datacenter IP detected: Cloud Provider 0.72
    Network Locale Headers Tool Transport Session Quality
    Drift vs
    43.5%

    Fingerprint Profile

    TLS Version
    TLSv1.3
    HTTP Protocol
    HTTP/2
    Protocol Client
    TLS_AES_256_GCM_SHA384
    TCP OS Hint
    Unavailable
    Fingerprint Integrity
    Suspect
    UA Consistency
    Flagged
    Headless Indicator
    Low
    Datacenter IP
    Clean

    Browser modes same browser, different modes. One row per persisted mode

    Mode Observations Maturity Shift from baseline Last seen
    bot-raw 1194 1194 0.09 (priority, sec ch ua platform, ua family) 13:54:55
    navigation 83 83 0.37 (upgrade insecure requests, accept, ua family) 21:05:45
    signalr-negotiate 93 93 0.46 (priority, sec ch ua platform, ua family) 16:23:04
    sub-resource 138 138 0.41 (priority, sec ch ua platform, header case pattern) 17:23:27
    4 modes across 1508 observations. See composite browser-mode fingerprints.
    Endpoints Visited (4) Click to expand · stats unavailable
    # Path
    1 /docs/cli-reference
    2 /docs/feedback-feature
    3 /docs/gateway-mode-lifecycle
    4 /legal/dpa
    Raw Requests (4) Click to expand
    Time Method Path Status Prob Conf Risk Profile Action Time
    07:07:15 GET /docs/cli-reference 200 100 % 50 % VeryHigh rate-limit-search 110.2ms
    09:28:23 GET /docs/feedback-feature 200 100 % 50 % VeryHigh rate-limit-search 408.5ms
    18:52:42 GET /docs/gateway-mode-lifecycle 200 100 % 50 % VeryHigh rate-limit-search 208.3ms
    00:41:10 GET /legal/dpa 200 100 % 50 % VeryHigh rate-limit-search 231.3ms

    Bot Probability & Confidence History

    StyloBot Detection Overhead (ms)

    User Agent

    Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/[phone] Safari/537.36

    Detector Contributions (18 detectors)

    Detector Confidence Delta Timing (ms)
    HeuristicLate
    Heuristic model (late): 99 % bot likelihood (297 features)
    		 +0.982 0.6
    AiScraper
    Known AI search bot: Amazonbot (Amazon)
    		 +0.950 0.1
    UserAgent
    Known bot pattern: Amazonbot
    		 +0.900 1.0
    VerifiedBot
    Spoofed UA: claims to be Amazonbot but IP doesn't verify via fcrdns
    		 +0.850 95.6
    Heuristic
    Heuristic model (early): 82 % bot likelihood (22 features)
    		 +0.637 0.3
    Ip
    Datacenter IP detected: Cloud Provider
    		 +0.600 2.2
    Header
    Missing Accept header; Browser UA without Accept-Language; deployment norm is low language rate (22 % over 430 samples)
    		 +0.568 0.1
    Behavioral
    Request patterns appear normal
    		 -0.150 0.3
    TlsFingerprint
    TLS connection appears normal
    		 -0.150 0.0
    TcpIpFingerprint
    Missing connection reuse header (unusual for real browsers)
    		 +0.200 0.1
    Http2Fingerprint
    No HTTP/2 stream priority (browsers typically use this)
    		 +0.050 0.1
    AI
    AI analysis: borderline case, monitoring
    		 +0.000 9.5
    SecurityTool
    No security tools detected in User-Agent
    		 +0.000 0.1
    RequestHydrator
    Request signals hydrated to sink
    		 +0.000 0.0
    Http3Fingerprint
    Connection uses HTTP/2 (not HTTP/3)
    		 +0.000 0.1
    HeaderCorrelation
    Single signature per header profile
    		 +0.000 0.1
    TransportProtocol
    Transport protocol analysis complete
    		 +0.000 0.0
    FastPathReputation
    No known patterns in reputation cache
    		 +0.000 0.0

    Signal Intelligence

    h2

    protocol h2

    request

    protocol HTTP/2
    accept_encoding gzip, br

    risk

    justification Classified Scraper (probability 1.00, confidence 0.50)
    friendly_pin_trace not-applicable:botType=Scraper,yamlType=null,botName=Spoofed-Amazonbot

    tls

    cipher TLS_AES_256_GCM_SHA384
    Version TLSv1.3
    version TLSv1.3

    Policy applied

    Hit history

    No sessions recorded yet.

    Sessions are created when a visitor's activity gap exceeds 30 minutes.

    Effective policy
    Loading effective policy…
    ASP.NET Pack — Auth health
    JWKS health
    OK

    reachable

    Auth pipeline
    JWKS reachable
    License
    Licensed

    ASP.NET pack enabled

    OTel Mesh — Traces

    Fingerprint timeline

    8c442c124dab4de8a37ba33e2ed31a68 0 observations

    Span + log activity for this fingerprint, ordered by timestamp.

    No timeline observations

    OTel Mesh receiver online, but no observations seen for this fingerprint id (check W3C baggage propagation)

    Operator actions

    Operator actions

    Block/Allow writes a scoped policy rule for this fingerprint — a policy action, applied via the live policy pipe. It is never a skip-detection bypass.

    Signature: QuXY1l8tpnv_LXJJeoJaDA | Processing: 110ms | Country: US | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/[phone] Safari/537.36 | First seen: 2026-07-25 00:41:10 UTC

    Apply Bot Policy

    GET /path 
    
            
    
            

            
    
                
                    FOSS: restart required after config changes