OK
reachable
Unknown
Human
Scraper
Policy:
Silent Throttle
Probability
0 %
Confidence
99 %
Risk Profile
VeryLow
Threat
None
Hit Count
23
Last Seen
8s ago
Drifted
Generic Adblocker
→
uBlock Origin
Drift vs
57.2%
Fingerprint Profile
TLS Version
Unavailable
HTTP Protocol
HTTP/1.1
Protocol Client
Unavailable
TCP OS Hint
Unavailable
Fingerprint Integrity
Consistent
UA Consistency
Suspect
Headless Indicator
Low
Datacenter IP
Clean
Browser modes same browser, different modes. One row per persisted mode
| Mode | Observations | Maturity | Shift from baseline | Last seen |
|---|---|---|---|---|
| bot-raw | 570 | 570 | 0.00 (header order hash, ua family, header case pattern) | 02:00:10 |
| signalr-negotiate | 3 | 3 | 0.36 (header order hash, ua family, header case pattern) | 20:13:20 |
2 modes across 573 observations. See composite browser-mode fingerprints.
Endpoints Visited (1) Click to expand · stats unavailable
| # | Path |
|---|---|
| 1 | /wp-admin/install.php |
Raw Requests (23) Click to expand
| Time | Method | Path | Status | Prob | Conf | Risk Profile | Action | Time |
|---|---|---|---|---|---|---|---|---|
| 01:32:56 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 36.1ms |
| 23:45:52 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 12.5ms |
| 22:07:07 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 36.7ms |
| 20:51:32 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 48.7ms |
| 19:07:00 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 45.2ms |
| 17:18:41 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 45.4ms |
| 15:39:47 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 42.1ms |
| 13:56:15 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | rate-limit-social | 39.3ms |
| 12:11:21 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | rate-limit-social | 36.8ms |
| 10:25:18 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | rate-limit-social | 48.1ms |
| 08:43:05 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 40.5ms |
| 06:59:00 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 27.4ms |
| 05:24:31 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | rate-limit-social | 26.5ms |
| 03:37:35 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 25.8ms |
| 01:46:22 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 36.9ms |
| 00:00:05 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 13.2ms |
| 22:23:46 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | rate-limit-social | 12.1ms |
| 22:23:36 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | rate-limit-social | 11.9ms |
| 22:23:05 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | rate-limit-social | 38.0ms |
| 20:43:13 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | rate-limit-social | 38.5ms |
| 19:01:03 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 48.3ms |
| 17:17:12 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 39.6ms |
| 15:32:56 | GET | /wp-admin/install.php | 200 | 90 % | 68 % | VeryHigh | Silent Throttle | 40.5ms |
Bot Probability & Confidence History
StyloBot Detection Overhead (ms)
User Agent
http://eeoo.app/wp-admin/install.php?step=1
Analysis
Unknown on /wp-admin/install... - caught by Honeypot path matched: /wp-admin/install.php [wordpress-a..., Tier 2 honeypot hit: /wp-admin/install.php matched /wp-admin, Datacenter IP detected: Cloud Provider
Detection Signals
- • Honeypot path matched: /wp-admin/install.php [wordpress-admin] [pack: wordpress-5.9]
- • Tier 2 honeypot hit: /wp-admin/install.php matched /wp-admin
- • Datacenter IP detected: Cloud Provider
- • Request patterns appear normal
- • Headers appear normal
Detector Contributions (21 detectors)
| Detector | Confidence Delta | Timing (ms) |
|---|---|---|
|
HeuristicLate
Heuristic model (late): 94 % bot likelihood (328 features)
|
+0.883 | 0.4 |
|
CveProbe
Honeypot path matched: /wp-admin/install.php [wordpress-admin] [pack: wordpress-5.9]
|
+0.900 | 0.0 |
|
HoneypotLink
Tier 2 honeypot hit: /wp-admin/install.php matched /wp-admin
|
+0.750 | 0.2 |
|
Ip
Datacenter IP detected: Cloud Provider
|
+0.600 | 2.2 |
|
Header
Headers appear normal
|
-0.150 | 0.1 |
|
UserAgent
User-Agent appears normal
|
-0.150 | 0.5 |
|
Behavioral
Request patterns appear normal
|
-0.150 | 0.2 |
|
Heuristic
Heuristic model (early): 52 % human likelihood (19 features)
|
-0.045 | 0.1 |
|
TlsFingerprint
Using HTTP instead of HTTPS (uncommon for modern browsers)
|
+0.050 | 0.0 |
|
AI
AI analysis: borderline case, monitoring
|
+0.000 | 10.2 |
|
AiScraper
No AI scraper signals detected
|
+0.000 | 0.0 |
|
VerifiedBot
No known bot UA pattern
|
+0.000 | 22.0 |
|
SecurityTool
No security tools detected in User-Agent
|
+0.000 | 0.0 |
|
ContentSequence
Document hit; sequence reset at /wp-admin/install.php
|
+0.000 | 0.1 |
|
RequestHydrator
Request signals hydrated to sink
|
+0.000 | 0.0 |
|
Http2Fingerprint
Using HTTP/1.1; environment norm is HTTP/1.1 (4 % HTTP/2 over 407 samples)
|
+0.000 | 0.1 |
|
Http3Fingerprint
Connection uses HTTP/1.1 (not HTTP/3)
|
+0.000 | 0.0 |
|
TcpIpFingerprint
Network fingerprint analysis complete (no anomalies detected)
|
+0.000 | 0.0 |
|
HeaderCorrelation
Single signature per header profile
|
+0.000 | 0.1 |
|
TransportProtocol
Transport protocol analysis complete
|
+0.000 | 0.0 |
|
FastPathReputation
No known patterns in reputation cache
|
+0.000 | 0.0 |
Signal Intelligence
request
protocol
HTTP/1.1
accept_encoding
gzip
risk
justification
Classified Scraper (probability 0.90, confidence 0.68)
friendly_pin_trace
not-applicable:botType=Scraper,yamlType=null,botName=null
Policy applied
Hit history
No sessions recorded yet.
Sessions are created when a visitor's activity gap exceeds 30 minutes.
Effective policy
Loading effective policy…
ASP.NET Pack — Auth events
JWKS reachable
Licensed
ASP.NET pack enabled
OTel Mesh — Traces
Fingerprint timeline
8a5d1160e2354ac1865cf33e4ce78dad
0 observations
Span + log activity for this fingerprint, ordered by timestamp.
No timeline observations
OTel Mesh receiver online, but no observations seen for this fingerprint id (check W3C baggage propagation)
Signature:
wYCTQtYEPLy-ZiXh6f8-EQ
|
Processing: 36ms
|
Country: US
|
UA: http://eeoo.app/wp-admin/install.php?step=1
|
First seen: 2026-07-13 15:32:56 UTC