h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

TransportProtocol 0 % Transport protocol analysis complete FastPathReputation 0 % No known patterns in reputation cache

ip.subnet=54.198.67 request.protocol=HTTP/1.1 risk.justification=Insufficient data for reliable risk assessment request.accept_encoding=gzip, br risk.friendly_pin_trace=not-applicable:botType=null,yamlType=null,botName=null

Ip -25 % IP appears normal: 43.153.36.xxx Header -18 % Headers appear normal AiScraper 0 % No AI scraper signals detected Heuristic -119 % Heuristic model (early): 80 % human likelihood (19 features) UserAgent -33 % User-Agent appears normal Behavioral -30 % Request patterns appear normal SecurityTool 0 % No security tools detected in User-Agent TlsFingerprint -45 % TLS connection appears normal ContentSequence 0 % Document hit — sequence reset at /legal/dpa Http2Fingerprint 0 % Using HTTP/1.1; environment norm is HTTP/1.1 (0 % HTTP/2 over 77 samples) Http3Fingerprint 0 % Connection uses HTTP/1.1 (not HTTP/3) TcpIpFingerprint 0 % Network fingerprint analysis complete (no anomalies detected) HeaderCorrelation 0 % Single signature per header profile TransportProtocol 0 % Transport protocol analysis complete FastPathReputation 0 % No known patterns in reputation cache

ip.subnet=43.153.36 ua.family=Safari ua.is_bot=False h2.is_http2=False h2.protocol=HTTP/1.1 h3.is_http3=False h3.protocol=HTTP/1.1 ip.is_local=False header.count=18 tls.is_https=True tls.available=True h2.behind_proxy=False request.protocol=HTTP/1.1 header.has_accept=True ua.family_version=13.0 behavioral.anomaly=False risk.justification=No significant indicators heuristic.confidence=0.5942753939407391 heuristic.prediction=human h2.population_samples=77 header.sec_fetch_dest= header.sec_fetch_mode= header.sec_fetch_site= tcp.connection_header=keep-alive request.accept_encoding=gzip, br risk.friendly_pin_trace=not-applicable:botType=null,yamlType=null,botName=null h2.population_http2_rate=0 header.has_proxy_headers=False heuristic.early_completed=True header.has_accept_encoding=True header.has_accept_language=True header.is_websocket_upgrade=False header.sec_fetch_same_origin=False header.is_service_worker_fetch=False

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

Ip -25 % IP appears normal: 2001:41d0:... Header -18 % Headers appear normal AiScraper 0 % No AI scraper signals detected Heuristic -37 % Heuristic model (early): 59 % human likelihood (18 features) UserAgent 135 % Known bot pattern: MJ12bot Behavioral -30 % Request patterns appear normal SecurityTool 0 % No security tools detected in User-Agent TlsFingerprint -45 % TLS connection appears normal ContentSequence 0 % Document hit — sequence reset at /dashboard/signature/7qUUokelw19YVAjPHlYVlw Http2Fingerprint 3 % Using HTTP/1.1 instead of HTTP/2 (HTTP/2 rate: 0 % over 3 samples) Http3Fingerprint 0 % Connection uses HTTP/1.1 (not HTTP/3) TcpIpFingerprint 0 % Network fingerprint analysis complete (no anomalies detected) HeaderCorrelation 0 % Single signature per header profile TransportProtocol 0 % Transport protocol analysis complete FastPathReputation 0 % No known patterns in reputation cache

ip.subnet=2001:41d0:0303 ua.family=MJ12bot ua.is_bot=True h2.is_http2=False h2.protocol=HTTP/1.1 h3.is_http3=False h3.protocol=HTTP/1.1 ip.is_local=False ua.bot_name=MJ12bot ua.bot_type=GoodBot header.count=15 tls.is_https=True tls.available=True h2.behind_proxy=False request.protocol=HTTP/1.1 header.has_accept=True ua.family_version= behavioral.anomaly=False risk.justification=probability 1.00 heuristic.confidence=0.18460891316395345 heuristic.prediction=human h2.population_samples=3 header.sec_fetch_dest= header.sec_fetch_mode= header.sec_fetch_site= tcp.connection_header=keep-alive request.accept_encoding=gzip, br risk.friendly_pin_trace=skipped:no_corroboration (UA claims MJ12bot as GoodBot; UA alone is not sufficient) h2.population_http2_rate=0 header.has_proxy_headers=False heuristic.early_completed=True header.has_accept_encoding=True header.has_accept_language=True header.is_websocket_upgrade=False header.sec_fetch_same_origin=False header.is_service_worker_fetch=False

Ip -25 % IP appears normal: 190.120.255.xxx Header 0 % Browser UA without Accept-Language; deployment norm is low language rate (6 % over 114 samples) Intent 0 % Session intent: unknown (threat=0.05, band=None) AiScraper 0 % No AI scraper signals detected Heuristic 78 % Heuristic model (early): 70 % bot likelihood (22 features) UserAgent -33 % User-Agent appears normal Behavioral -30 % Request patterns appear normal VersionAge 48 % Chrome v68 is 66 versions behind (latest: 134) StreamAbuse 0 % Stream abuse check - non-streaming request SecurityTool 0 % No security tools detected in User-Agent HeuristicLate 250 % Heuristic model (late): 100 % bot likelihood (225 features) Inconsistency 150 % Browser User-Agent without Accept-Language header; Chrome User-Agent without Client Hints; Outdated browser version in User-Agent SessionVector 0 % Session tracking active (1 requests, 0 prior sessions) ReputationBias 7 % UA pattern Suspect (score=0.72, support=13) TlsFingerprint -45 % TLS connection appears normal ClaimedIdentity 0 % Chrome behavioral profile mismatch (consistency=0.33): missing Sec-Fetch headers (expected for this browser); no Accept-Language (browsers always send this); no text/html in Accept (expected for browser) ReactivePattern 0 % No prior error events to analyze Http2Fingerprint 0 % Using HTTP/1.1; environment norm is HTTP/1.1 (0 % HTTP/2 over 129 samples) Http3Fingerprint 0 % Connection uses HTTP/1.1 (not HTTP/3) TcpIpFingerprint 0 % Network fingerprint analysis complete (no anomalies detected) HeaderCorrelation 0 % Single signature per header profile TransportProtocol 0 % Transport protocol analysis complete BehavioralWaveform 0 % Behavioral waveform analysis complete (insufficient history) FastPathReputation 0 % No known patterns in reputation cache MultiLayerCorrelation 0 % Cross-signal consistency check complete (not enough data to compare)

ip.subnet=190.120.255 ua.family=Chrome ua.is_bot=False ip.is_ipv6=False h2.is_http2=False h2.protocol=HTTP/1.1 h3.is_http3=False h3.protocol=HTTP/1.1 ip.is_local=False header.count=14 tls.is_https=True tls.available=True h2.behind_proxy=False intent.analyzed=True intent.category=unknown ip.is_datacenter=False request.protocol=HTTP/1.1 header.has_accept=True ua.family_version=68.0 behavioral.anomaly=False intent.match_count=1 intent.threat_band=None risk.justification=probability 0.90 intent.threat_score=0.05 heuristic.confidence=0.39228688553328395 heuristic.prediction=bot h2.population_samples=129 header.sec_fetch_dest= header.sec_fetch_mode= header.sec_fetch_site= reputation.bias_count=1 tcp.connection_header=keep-alive intent.similarity_score=1.0000001192092896 reputation.bias_applied=True request.accept_encoding=gzip, br risk.friendly_pin_trace=not-applicable:botType=Scraper,yamlType=null,botName=null h2.population_http2_rate=0 header.has_proxy_headers=False heuristic.early_completed=True heuristic.late_confidence=0.9999990979787108 heuristic.late_prediction=bot header.has_accept_encoding=True header.has_accept_language=False reputation.useragent.score=0.7232543929114645 reputation.useragent.state=Suspect header.is_websocket_upgrade=False header.sec_fetch_same_origin=False reputation.useragent.support=13.20060389661698 header.is_service_worker_fetch=False header.population_accept_language_rate=0.06140350877192982

Ip -25 % IP appears normal: 170.106.180.xxx Header -18 % Headers appear normal AiScraper 0 % No AI scraper signals detected Heuristic -119 % Heuristic model (early): 80 % human likelihood (19 features) UserAgent -33 % User-Agent appears normal Behavioral -30 % Request patterns appear normal SecurityTool 0 % No security tools detected in User-Agent TlsFingerprint -45 % TLS connection appears normal ContentSequence 0 % Document hit — sequence reset at /privacy Http2Fingerprint 0 % Using HTTP/1.1; environment norm is HTTP/1.1 (0 % HTTP/2 over 76 samples) Http3Fingerprint 0 % Connection uses HTTP/1.1 (not HTTP/3) TcpIpFingerprint 0 % Network fingerprint analysis complete (no anomalies detected) HeaderCorrelation 0 % Single signature per header profile TransportProtocol 0 % Transport protocol analysis complete FastPathReputation 0 % No known patterns in reputation cache

ip.subnet=170.106.180 ua.family=Safari ua.is_bot=False h2.is_http2=False h2.protocol=HTTP/1.1 h3.is_http3=False h3.protocol=HTTP/1.1 ip.is_local=False header.count=18 tls.is_https=True tls.available=True h2.behind_proxy=False request.protocol=HTTP/1.1 header.has_accept=True ua.family_version=13.0 behavioral.anomaly=False risk.justification=No significant indicators heuristic.confidence=0.5949218765014582 heuristic.prediction=human h2.population_samples=76 header.sec_fetch_dest= header.sec_fetch_mode= header.sec_fetch_site= tcp.connection_header=keep-alive request.accept_encoding=gzip, br risk.friendly_pin_trace=not-applicable:botType=null,yamlType=null,botName=null h2.population_http2_rate=0 header.has_proxy_headers=False heuristic.early_completed=True header.has_accept_encoding=True header.has_accept_language=True header.is_websocket_upgrade=False header.sec_fetch_same_origin=False header.is_service_worker_fetch=False

referrer.domain=stylobot.net request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

Ip -25 % IP appears normal: 43.159.46.xxx Header -18 % Headers appear normal AiScraper 0 % No AI scraper signals detected Heuristic -117 % Heuristic model (early): 79 % human likelihood (19 features) UserAgent -33 % User-Agent appears normal Behavioral -30 % Request patterns appear normal SecurityTool 0 % No security tools detected in User-Agent TlsFingerprint -45 % TLS connection appears normal ContentSequence 0 % Document hit — sequence reset at /dashboard/entity/9e5950de177a416f Http2Fingerprint 0 % Using HTTP/1.1; environment norm is HTTP/1.1 (0 % HTTP/2 over 75 samples) Http3Fingerprint 0 % Connection uses HTTP/1.1 (not HTTP/3) TcpIpFingerprint 0 % Network fingerprint analysis complete (no anomalies detected) HeaderCorrelation 0 % Single signature per header profile TransportProtocol 0 % Transport protocol analysis complete FastPathReputation 0 % No known patterns in reputation cache

ip.subnet=43.159.46 ua.family=Safari ua.is_bot=False h2.is_http2=False h2.protocol=HTTP/1.1 h3.is_http3=False h3.protocol=HTTP/1.1 ip.is_local=False header.count=18 tls.is_https=True tls.available=True h2.behind_proxy=False request.protocol=HTTP/1.1 header.has_accept=True ua.family_version=13.0 behavioral.anomaly=False risk.justification=No significant indicators heuristic.confidence=0.5864580028862163 heuristic.prediction=human h2.population_samples=75 header.sec_fetch_dest= header.sec_fetch_mode= header.sec_fetch_site= tcp.connection_header=keep-alive request.accept_encoding=gzip, br risk.friendly_pin_trace=not-applicable:botType=null,yamlType=null,botName=null h2.population_http2_rate=0 header.has_proxy_headers=False heuristic.early_completed=True header.has_accept_encoding=True header.has_accept_language=True header.is_websocket_upgrade=False header.sec_fetch_same_origin=False header.is_service_worker_fetch=False

Ip -25 % IP appears normal: 119.155.194.xxx Header 0 % Browser UA without Accept-Language; deployment norm is low language rate (6 % over 113 samples) Intent 0 % Session intent: unknown (threat=0.05, band=None) AiScraper 0 % No AI scraper signals detected Heuristic 79 % Heuristic model (early): 70 % bot likelihood (22 features) UserAgent -33 % User-Agent appears normal Behavioral -30 % Request patterns appear normal VersionAge 48 % Chrome v89 is 45 versions behind (latest: 134) StreamAbuse 0 % Stream abuse check - non-streaming request SecurityTool 0 % No security tools detected in User-Agent HeuristicLate 250 % Heuristic model (late): 100 % bot likelihood (225 features) Inconsistency 150 % Browser User-Agent without Accept-Language header; Chrome User-Agent without Client Hints; Outdated browser version in User-Agent SessionVector 0 % Session tracking active (1 requests, 0 prior sessions) ReputationBias 7 % UA pattern Suspect (score=0.70, support=12) TlsFingerprint -45 % TLS connection appears normal ClaimedIdentity 0 % Chrome behavioral profile mismatch (consistency=0.33): missing Sec-Fetch headers (expected for this browser); no Accept-Language (browsers always send this); no text/html in Accept (expected for browser) ReactivePattern 0 % No prior error events to analyze Http2Fingerprint 0 % Using HTTP/1.1; environment norm is HTTP/1.1 (0 % HTTP/2 over 128 samples) Http3Fingerprint 0 % Connection uses HTTP/1.1 (not HTTP/3) TcpIpFingerprint 0 % Network fingerprint analysis complete (no anomalies detected) HeaderCorrelation 0 % Single signature per header profile TransportProtocol 0 % Transport protocol analysis complete BehavioralWaveform 0 % Behavioral waveform analysis complete (insufficient history) FastPathReputation 0 % No known patterns in reputation cache MultiLayerCorrelation 0 % Cross-signal consistency check complete (not enough data to compare)

ip.subnet=119.155.194 ua.family=Chrome ua.is_bot=False ip.is_ipv6=False h2.is_http2=False h2.protocol=HTTP/1.1 h3.is_http3=False h3.protocol=HTTP/1.1 ip.is_local=False header.count=14 tls.is_https=True tls.available=True h2.behind_proxy=False intent.analyzed=True intent.category=unknown ip.is_datacenter=False request.protocol=HTTP/1.1 header.has_accept=True ua.family_version=89.0 behavioral.anomaly=False intent.match_count=1 intent.threat_band=None risk.justification=probability 0.90 intent.threat_score=0.05 heuristic.confidence=0.3937665560241068 heuristic.prediction=bot h2.population_samples=128 header.sec_fetch_dest= header.sec_fetch_mode= header.sec_fetch_site= reputation.bias_count=1 tcp.connection_header=keep-alive intent.similarity_score=1.0000001192092896 reputation.bias_applied=True request.accept_encoding=gzip, br risk.friendly_pin_trace=not-applicable:botType=Scraper,yamlType=null,botName=null h2.population_http2_rate=0 header.has_proxy_headers=False heuristic.early_completed=True heuristic.late_confidence=0.9999990758513986 heuristic.late_prediction=bot header.has_accept_encoding=True header.has_accept_language=False reputation.useragent.score=0.696665843380631 reputation.useragent.state=Suspect header.is_websocket_upgrade=False header.sec_fetch_same_origin=False reputation.useragent.support=12.324060686740438 header.is_service_worker_fetch=False header.population_accept_language_rate=0.061946902654867256

Ip -25 % IP appears normal: 1.12.70.xxx Header -18 % Headers appear normal AiScraper 0 % No AI scraper signals detected Heuristic -152 % Heuristic model (early): 88 % human likelihood (18 features) UserAgent -33 % User-Agent appears normal Behavioral -30 % Request patterns appear normal SecurityTool 0 % No security tools detected in User-Agent TlsFingerprint -45 % TLS connection appears normal ContentSequence 0 % Document hit — sequence reset at / Http2Fingerprint 0 % Using HTTP/1.1; environment norm is HTTP/1.1 (0 % HTTP/2 over 74 samples) Http3Fingerprint 0 % Connection uses HTTP/1.1 (not HTTP/3) TcpIpFingerprint 0 % Network fingerprint analysis complete (no anomalies detected) HeaderCorrelation 0 % Single signature per header profile TransportProtocol 0 % Transport protocol analysis complete FastPathReputation 0 % No known patterns in reputation cache

ip.subnet=1.12.70 ua.family=Safari ua.is_bot=False h2.is_http2=False h2.protocol=HTTP/1.1 h3.is_http3=False h3.protocol=HTTP/1.1 ip.is_local=False header.count=19 tls.is_https=True tls.available=True h2.behind_proxy=False referrer.domain=stylobot.net request.protocol=HTTP/1.1 header.has_accept=True ua.family_version=13.0 behavioral.anomaly=False risk.justification=No significant indicators heuristic.confidence=0.7600147629243992 heuristic.prediction=human h2.population_samples=74 header.sec_fetch_dest= header.sec_fetch_mode= header.sec_fetch_site= tcp.connection_header=keep-alive request.accept_encoding=gzip, br risk.friendly_pin_trace=not-applicable:botType=null,yamlType=null,botName=null h2.population_http2_rate=0 header.has_proxy_headers=False heuristic.early_completed=True header.has_accept_encoding=True header.has_accept_language=True header.is_websocket_upgrade=False header.sec_fetch_same_origin=False header.is_service_worker_fetch=False

Ip 72 % Datacenter IP detected: Hetzner Header -18 % Headers appear normal AiScraper 0 % No AI scraper signals detected Heuristic -34 % Heuristic model (early): 59 % human likelihood (18 features) UserAgent 90 % Suspiciously short User-Agent (< 10 chars) Behavioral -30 % Request patterns appear normal SecurityTool 0 % No security tools detected in User-Agent TlsFingerprint -45 % TLS connection appears normal Http2Fingerprint 3 % Using HTTP/1.1 instead of HTTP/2 (HTTP/2 rate: 0 % over 1 samples) Http3Fingerprint 0 % Connection uses HTTP/1.1 (not HTTP/3) TcpIpFingerprint 0 % Network fingerprint analysis complete (no anomalies detected) HeaderCorrelation 0 % Single signature per header profile TransportProtocol 0 % Transport protocol analysis complete FastPathReputation 0 % No known patterns in reputation cache

ip.subnet=65.109.33 ua.family=Node.js ua.is_bot=True h2.is_http2=False h2.protocol=HTTP/1.1 h3.is_http3=False h3.protocol=HTTP/1.1 ip.is_local=False ua.bot_name= ua.bot_type=Unknown header.count=16 tls.is_https=True tls.available=True h2.behind_proxy=False request.protocol=HTTP/1.1 header.has_accept=True ua.family_version= behavioral.anomaly=False risk.justification=probability 1.00 heuristic.confidence=0.17080919554590723 heuristic.prediction=human h2.population_samples=1 header.sec_fetch_dest= header.sec_fetch_mode=cors header.sec_fetch_site= tcp.connection_header=keep-alive request.accept_encoding=gzip, br risk.friendly_pin_trace=not-applicable:botType=Unknown,yamlType=null,botName= h2.population_http2_rate=0 header.has_proxy_headers=False heuristic.early_completed=True header.has_accept_encoding=True header.has_accept_language=True header.is_websocket_upgrade=False header.sec_fetch_same_origin=False header.is_service_worker_fetch=False

Ip -25 % IP appears normal: 43.130.72.xxx Header -18 % Headers appear normal AiScraper 0 % No AI scraper signals detected Heuristic -117 % Heuristic model (early): 79 % human likelihood (19 features) UserAgent -33 % User-Agent appears normal Behavioral -30 % Request patterns appear normal SecurityTool 0 % No security tools detected in User-Agent TlsFingerprint -45 % TLS connection appears normal ContentSequence 0 % Document hit — sequence reset at /dashboard/signature/ivapIL71LYVLrc0Snw6N0Q Http2Fingerprint 0 % Using HTTP/1.1; environment norm is HTTP/1.1 (0 % HTTP/2 over 73 samples) Http3Fingerprint 0 % Connection uses HTTP/1.1 (not HTTP/3) TcpIpFingerprint 0 % Network fingerprint analysis complete (no anomalies detected) HeaderCorrelation 0 % Single signature per header profile TransportProtocol 0 % Transport protocol analysis complete FastPathReputation 0 % No known patterns in reputation cache

ip.subnet=43.130.72 ua.family=Safari ua.is_bot=False h2.is_http2=False h2.protocol=HTTP/1.1 h3.is_http3=False h3.protocol=HTTP/1.1 ip.is_local=False header.count=18 tls.is_https=True tls.available=True h2.behind_proxy=False request.protocol=HTTP/1.1 header.has_accept=True ua.family_version=13.0 behavioral.anomaly=False risk.justification=No significant indicators heuristic.confidence=0.5834978886945702 heuristic.prediction=human h2.population_samples=73 header.sec_fetch_dest= header.sec_fetch_mode= header.sec_fetch_site= tcp.connection_header=keep-alive request.accept_encoding=gzip, br risk.friendly_pin_trace=not-applicable:botType=null,yamlType=null,botName=null h2.population_http2_rate=0 header.has_proxy_headers=False heuristic.early_completed=True header.has_accept_encoding=True header.has_accept_language=True header.is_websocket_upgrade=False header.sec_fetch_same_origin=False header.is_service_worker_fetch=False

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 referrer.domain=stylobot.net request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

h2.protocol=h2 request.protocol=HTTP/2 request.accept_encoding=gzip, br

request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

referrer.domain=stylobot.net request.protocol=HTTP/1.1 request.accept_encoding=gzip, br

referrer.domain=stylobot.net request.protocol=HTTP/1.1 request.accept_encoding=gzip, br