Bots & anonymous traffic

• Request comes through the Tor anonymity network tor_exit_node
• Request comes from a known VPN vpn_detected
• IP belongs to a cloud/datacenter, not a home or mobile network datacenter_ip
• IP has a bad reputation score (≥70) high_ip_threat_score
• Over 200 requests from one IP in a minute (bot) high_ip_velocity_60s
• IP is on public blocklists known_bad_indicator
• One customer made over 100 requests in an hour (automation) high_customer_velocity_1h
• VPN user with no customer ID anonymous_no_customer_id
• The client's firewall/edge already labelled it a bot waf_bot_label
• IP is a known proxy proxy_detected
• Network (ASN) belongs to a datacenter datacenter_asn
• Over 50 requests from one device in 10 s (script) high_device_velocity_10s
• Over 30 requests in one session in a minute (script) high_session_velocity_60s

Only rules in the current release are listed. The rule name is the reason code you see in the evidence report.