• You: Bot 100.0% Low
    ← Dashboard / Signature Detail
    SG

    Bytespider

     · Bytespider / Android Bot
    AiBot
    Policy: rate-limit-ai
    Probability
    100 %
    Confidence
    96 %
    Risk Profile
    VeryHigh
    Threat
    None
    Hit Count
    14
    Last Seen
    24s ago

    Analysis

    Bytespider on /img/stylowall.svg - caught by Known AI training bot: Bytespider (ByteDance), Known bot pattern: Bytespider, Browser User-Agent from datacenter IP

    Detection Signals

    • ↑ Known AI training bot: Bytespider (ByteDance) 1.90
    • ↓ Heuristic model (early): 91 % human likelihood (18 features) 1.66
    • ↑ Known bot pattern: Bytespider 1.35
    • ↑ Browser User-Agent from datacenter IP 1.05
    • ↑ Heuristic model (late): 67 % bot likelihood (328 features) 0.86
    • ↑ Datacenter IP detected: Cloud Provider 0.72
    Network Locale Headers Tool Transport Session Quality
    Drifted
    Generic Adblocker → Bytespider
    Drift vs
    46.0%

    Fingerprint Profile

    TLS Version
    TLSv1.3
    HTTP Protocol
    HTTP/2
    Protocol Client
    TLS_AES_256_GCM_SHA384
    TCP OS Hint
    Unavailable
    Fingerprint Integrity
    Suspect
    UA Consistency
    Flagged
    Headless Indicator
    Low
    Datacenter IP
    Clean

    Browser modes same browser, different modes. One row per persisted mode

    Mode Observations Maturity Shift from baseline Last seen
    bot-raw 225 225 0.31 (priority, ua family, sec fetch pattern) 21:52:30
    sub-resource 506 506 0.14 (priority, referer host family, upgrade insecure requests) 01:43:49
    websocket-upgrade 82 82 0.35 (priority, cache control pragma, sec fetch pattern) 01:43:48
    signalr-negotiate 185 185 0.20 (custom header signature, x requested with, priority) 01:43:45
    navigation 214 214 0.31 (upgrade insecure requests, accept, header case pattern) 01:43:42
    5 modes across 1212 observations. See composite browser-mode fingerprints.
    Endpoints Visited (8) Click to expand · stats unavailable
    # Path
    1 /img/stylowall.svg
    2 /_content/Mostlylucid.BotDetection.UI/css/sb-components.css
    3 /_content/Mostlylucid.BotDetection.UI/img/stylowall.svg
    4 /_content/Mostlylucid.BotDetection.UI/bot-detection-details.css
    5 /_content/Mostlylucid.BotDetection.UI/vendor/css/boxicons.min.css
    6 /dist/assets/index.css
    7 /store
    8 /
    Raw Requests (14) Click to expand
    Time Method Path Status Prob Conf Risk Profile Action Time
    03:16:03 GET /img/stylowall.svg 304 100 % 50 % VeryHigh rate-limit-ai 13.5ms
    03:16:02 GET /_content/Mostlylucid.BotDetection.UI/css/sb-components.css 304 100 % 50 % VeryHigh rate-limit-ai 14.3ms
    03:16:02 GET /_content/Mostlylucid.BotDetection.UI/img/stylowall.svg 304 100 % 50 % VeryHigh rate-limit-ai 12.2ms
    03:16:02 GET /_content/Mostlylucid.BotDetection.UI/bot-detection-details.css 304 100 % 50 % VeryHigh rate-limit-ai 13.7ms
    03:16:01 GET /_content/Mostlylucid.BotDetection.UI/vendor/css/boxicons.min.css 304 100 % 50 % VeryHigh rate-limit-ai 13.3ms
    03:16:01 GET /dist/assets/index.css 304 100 % 50 % VeryHigh rate-limit-ai 13.0ms
    03:16:00 GET /store 200 100 % 50 % VeryHigh rate-limit-ai 14.8ms
    10:11:58 GET /_content/Mostlylucid.BotDetection.UI/img/stylowall.svg 200 100 % 50 % VeryHigh rate-limit-ai 13.7ms
    10:11:58 GET /img/stylowall.svg 200 100 % 50 % VeryHigh rate-limit-ai 31.6ms
    10:11:56 GET /_content/Mostlylucid.BotDetection.UI/bot-detection-details.css 200 100 % 50 % VeryHigh rate-limit-ai 15.3ms
    10:11:56 GET /_content/Mostlylucid.BotDetection.UI/vendor/css/boxicons.min.css 200 100 % 50 % VeryHigh rate-limit-ai 27.9ms
    10:11:56 GET /dist/assets/index.css 200 100 % 50 % VeryHigh rate-limit-ai 13.3ms
    10:11:56 GET /_content/Mostlylucid.BotDetection.UI/css/sb-components.css 200 100 % 50 % VeryHigh rate-limit-ai 15.0ms
    10:11:54 GET / 200 100 % 50 % VeryHigh rate-limit-ai 14.0ms

    Bot Probability & Confidence History

    StyloBot Detection Overhead (ms)

    User Agent

    Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; [email])

    Detector Contributions (34 detectors)

    Detector Confidence Delta Timing (ms)
    AiScraper
    Known AI training bot: Bytespider (ByteDance)
    		 +0.950 0.0
    Heuristic
    Heuristic model (early): 91 % human likelihood (18 features)
    		 -0.829 0.1
    UserAgent
    Known bot pattern: Bytespider
    		 +0.900 0.5
    Inconsistency
    Browser User-Agent from datacenter IP
    		 +0.700 0.1
    HeuristicLate
    Heuristic model (late): 67 % bot likelihood (328 features)
    		 +0.344 0.4
    Ip
    Datacenter IP detected: Cloud Provider
    		 +0.600 0.0
    Header
    Same-origin browser fetch - Sec-Fetch-Site attestation present
    		 -0.400 0.0
    BehavioralWaveform
    Request timing shows natural human variation; Normal browser multiplexing: high total traffic but only 0 page visits per minute (4 sub-resources loaded)
    		 -0.300 0.6
    VersionAge
    Ancient OS detected: Android 5 (extremely rare in legitimate traffic)
    		 +0.300 0.0
    Behavioral
    Request patterns appear normal
    		 -0.150 0.2
    CacheBehavior
    Normal cache behavior detected
    		 -0.150 0.1
    TlsFingerprint
    TLS connection appears normal
    		 -0.150 0.0
    TcpIpFingerprint
    Missing connection reuse header (unusual for real browsers)
    		 +0.200 0.0
    Http2Fingerprint
    No HTTP/2 stream priority (browsers typically use this)
    		 +0.050 0.0
    AI
    AI analysis: borderline case, monitoring
    		 +0.000 10.3
    Llm
    LLM detection disabled or unavailable
    		 +0.000 0.0
    Similarity
    No prior visitor signatures to compare against yet
    		 +0.000 0.0
    VerifiedBot
    No known bot UA pattern
    		 +0.000 0.0
    SecurityTool
    No security tools detected in User-Agent
    		 +0.000 0.1
    SessionVector
    Session tracking active (4 requests, 0 prior sessions)
    		 +0.000 0.3
    CookieBehavior
    No Set-Cookie headers observed
    		 +0.000 0.0
    ReputationBias
    No learned reputation patterns matched
    		 +0.000 0.1
    ClaimedIdentity
    UA already identified as known bot
    		 +0.000 0.0
    ContentSequence
    Sequence on track at position 6
    		 +0.000 0.1
    ProjectHoneypot
    Skipped: ProjectHoneypot is disabled in configuration
    		 +0.000 0.0
    ReactivePattern
    No prior error events to analyze
    		 +0.000 0.0
    RequestHydrator
    Request signals hydrated to sink
    		 +0.000 0.0
    Http3Fingerprint
    Connection uses HTTP/2 (not HTTP/3)
    		 +0.000 0.0
    ResponseBehavior
    Response coordinator not configured
    		 +0.000 0.0
    HeaderCorrelation
    Single signature per header profile
    		 +0.000 0.0
    ResourceWaterfall
    Insufficient document requests for analysis
    		 +0.000 0.1
    TransportProtocol
    Transport protocol analysis complete
    		 +0.000 0.0
    FastPathReputation
    No known patterns in reputation cache
    		 +0.000 0.0
    MultiLayerCorrelation
    Cross-signal consistency check complete (not enough data to compare)
    		 +0.000 0.2

    Signal Intelligence

    h2

    protocol h2

    referrer

    domain www.stylobot.net

    request

    protocol HTTP/2
    accept_encoding gzip, br

    risk

    justification Classified AiBot (probability 1.00, confidence 0.50)
    friendly_pin_trace not-applicable:botType=Unknown,yamlType=AiBot,botName=Bytespider

    tls

    cipher TLS_AES_256_GCM_SHA384
    Version TLSv1.3
    version TLSv1.3

    Policy applied

    Hit history

    No sessions recorded yet.

    Sessions are created when a visitor's activity gap exceeds 30 minutes.

    Effective policy
    Loading effective policy…
    ASP.NET Pack — Auth health
    JWKS health
    OK

    reachable

    Auth pipeline
    JWKS reachable
    License
    Licensed

    ASP.NET pack enabled

    OTel Mesh — Traces

    Fingerprint timeline

    fae533ac34d942548b830840427a31fb 0 observations

    Span + log activity for this fingerprint, ordered by timestamp.

    No timeline observations

    OTel Mesh receiver online, but no observations seen for this fingerprint id (check W3C baggage propagation)

    Operator actions

    Operator actions

    Block/Allow writes a scoped policy rule for this fingerprint — a policy action, applied via the live policy pipe. It is never a skip-detection bypass.

    Signature: dZT2QnA_xH12LAPClFMJog | Processing: 14ms | Country: SG | UA: Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; [email]) | First seen: 2026-07-17 10:11:54 UTC

    Apply Bot Policy

    GET /path 
    
            
    
            

            
    
                
                    FOSS: restart required after config changes