• You: Bot 100.0% Low
    ← Dashboard / Signature Detail
    US

    Unknown

     Bot
    SearchEngine
    Policy: rate-limit-search
    Probability
    99 %
    Confidence
    92 %
    Risk Profile
    VeryHigh
    Threat
    None
    Hit Count
    1
    Last Seen
    47s ago

    Analysis

    Unknown on / - caught by Very few headers (2), Missing Accept header, Request patterns appear normal

    Detection Signals

    • ↑ Heuristic model (late): 93 % bot likelihood (266 features) 2.16
    • ↑ Missing Accept header; Very few headers (2) 1.34
    • ↑ Heuristic model (early): 56 % bot likelihood (17 features) 0.26
    • ↓ IP appears normal: 205.210.31.xxx 0.15
    • ↓ Request patterns appear normal 0.15
    • ↓ TLS connection appears normal 0.15
    Network Locale Headers Tool Transport Session Quality
    Drifted
    Generic Adblocker → uBlock Origin
    Drift vs
    56.4%

    Fingerprint Profile

    TLS Version
    TLSv1.3
    HTTP Protocol
    HTTP/1.1
    Protocol Client
    TLS_AES_256_GCM_SHA384
    TCP OS Hint
    Unavailable
    Fingerprint Integrity
    Suspect
    UA Consistency
    Consistent
    Headless Indicator
    Low
    Datacenter IP
    Clean

    Browser modes same browser, different modes. One row per persisted mode

    Mode Observations Maturity Shift from baseline Last seen
    bot-raw 9338 9338 0.04 (ua family, referer host family, accept language primary) 21:34:03
    signalr-negotiate 199 199 0.38 (ua family, header order hash, referer host family) 19:38:46
    sub-resource 920 920 0.39 (ua family, header case pattern, referer host family) 19:38:39
    websocket-upgrade 13 13 0.41 (x requested with, header case pattern, header order hash) 12:29:16
    navigation 14 14 0.47 (upgrade insecure requests, custom header signature, header order hash) 12:11:32
    5 modes across 10484 observations. See composite browser-mode fingerprints.
    Endpoints Visited (1) Click to expand · stats unavailable
    # Path
    1 /
    Raw Requests (1) Click to expand
    Time Method Path Status Prob Conf Risk Profile Action Time
    18:10:28 GET / 200 90 % 68 % VeryHigh rate-limit-search 214.2ms

    User Agent

    Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity

    Detector Contributions (17 detectors)

    Detector Confidence Delta Timing (ms)
    HeuristicLate
    Heuristic model (late): 93 % bot likelihood (266 features)
    		 +0.866 0.2
    Header
    Missing Accept header; Very few headers (2)
    		 +1.342 0.2
    Heuristic
    Heuristic model (early): 56 % bot likelihood (17 features)
    		 +0.129 0.1
    Ip
    IP appears normal: 205.210.31.xxx
    		 -0.150 1.5
    Behavioral
    Request patterns appear normal
    		 -0.150 0.1
    TlsFingerprint
    TLS connection appears normal
    		 -0.150 0.0
    UserAgent
    No bot marker in User-Agent (weak human lean; UA is easily spoofed)
    		 -0.050 1.0
    AI
    AI analysis: borderline case, monitoring
    		 +0.000 10.2
    AiScraper
    No AI scraper signals detected
    		 +0.000 5.2
    VerifiedBot
    No known bot UA pattern
    		 +0.000 195.6
    SecurityTool
    No security tools detected in User-Agent
    		 +0.000 0.1
    RequestHydrator
    Request signals hydrated to sink
    		 +0.000 0.0
    Http2Fingerprint
    Using HTTP/1.1; environment norm is HTTP/1.1 (0 % HTTP/2 over 25 samples)
    		 +0.000 0.0
    Http3Fingerprint
    Connection uses HTTP/1.1 (not HTTP/3)
    		 +0.000 0.0
    TcpIpFingerprint
    Network fingerprint analysis complete (no anomalies detected)
    		 +0.000 0.0
    TransportProtocol
    Transport protocol analysis complete
    		 +0.000 0.0
    FastPathReputation
    No known patterns in reputation cache
    		 +0.000 0.0

    Signal Intelligence

    request

    protocol HTTP/1.1

    risk

    justification Classified Scraper (probability 0.90, confidence 0.68)
    friendly_pin_trace not-applicable:botType=Scraper,yamlType=null,botName=null

    tls

    cipher TLS_AES_256_GCM_SHA384
    Version TLSv1.3
    version TLSv1.3

    Policy applied

    Hit history

    No sessions recorded yet.

    Sessions are created when a visitor's activity gap exceeds 30 minutes.

    Effective policy
    Loading effective policy…
    ASP.NET Pack — Auth health
    JWKS health
    OK

    reachable

    Auth pipeline
    JWKS reachable
    License
    Licensed

    ASP.NET pack enabled

    OTel Mesh — Traces

    Fingerprint timeline

    32bb80482ffb48089559f74451ecff49 0 observations

    Span + log activity for this fingerprint, ordered by timestamp.

    No timeline observations

    OTel Mesh receiver online, but no observations seen for this fingerprint id (check W3C baggage propagation)

    Operator actions

    Operator actions

    Block/Allow writes a scoped policy rule for this fingerprint — a policy action, applied via the live policy pipe. It is never a skip-detection bypass.

    Signature: u8e2bJgZHkZ1g2bMXc83cA | Processing: 214ms | Country: US | UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity | First seen: 2026-07-25 18:10:28 UTC

    Apply Bot Policy

    GET /path 
    
            
    
            

            
    
                
                    FOSS: restart required after config changes