> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/reference/bot-classification-reasons.md).

# Bot Classification Reasons

The Link11 Bot Management service observes and categorizes traffic sources using a wide range of algorithms and techniques. The outcome of this analysis is either:

* A classification of “Good”, meaning that the source is acting like a legitimate user and does not appear to be a malicious bot, or...
* A classification of “Bad”, meaning that Link11 cannot correlate the source's actions with the behaviors expected from users of the specific destination web application.

Below is a list of factors used by Link11 when determining the nature of clients (e.g., the sources/IPs sending traffic to the customer).

| Classification                      | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Notes                                                                                                                                                                                        |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Known Bot                           | Bots that Link11 knows about and considers legitimate                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                              |
| Verified IP                         | IP address is verified                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                                                                                                                                              |
| Bad Reputation                      | IP reputation of the source IP is bad                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                              |
| Bot Behavior                        | The behavior (number of requests, request speed, actions taken, etc.) of the client IP does not align with the behavior of typical users                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                              |
| Conspicuous Headers                 | <p>Header combinations that are uncommon for typical users. Any of the following will trigger this classification:<br><br><strong>Accept-Charset</strong> Header: not used by any modern browsers, and a good indication that traffic is from a bot.<br></p><p>Missing <strong>Accept</strong> header: browsers almost always send an <strong>Accept</strong> header and the absence of this header is a strong indicator of a bot.</p><p></p><p><strong>From</strong> Header: Modern browsers do not use the From header but bots often still do. Known Bots that do not send the <strong>From</strong> header may have been compromised or spoofed, and sources that send the <strong>From</strong> header may be unknown bots.</p> | The Conspicuous Header Classification Reason does not, by itself, conclusively identify bots. It is used in conjunction with other classifications to reinforce the decision made by Link11. |
| Constant Suffix                     | Clients that request the same file constantly over a period of time.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                                                                                                                                                                                              |
| Contains Spam Referrer              | Referrer information for the request contains a known spam host.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                              |
| High Request Frequency              | Requests are made by the client 20+ times faster than the average user of the web application at the time.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Clicking on the Classification Reason in the Bot Management Logs provides the request rate and the average at the time.                                                                      |
| Large Number of Requests            | A high volume of requests are made by the client.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                                                                                                                                              |
| Ignores Robot.txt                   | Clients that do not respect the robots.txt rules.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                                                                                                                                              |
| Invalid User Agent String           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                              |
| Missing User Agent                  | Clients sending requests with missing or “null” user agents are considered bots. Legitimate bots and users will almost always have a user agent present.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                              |
| Multiple Browser                    | Multiple browsers (or browser versions) are used by the same client within a short period of time.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                              |
| No Assets                           | Clients that do not request any web assets when making requests.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                              |
| Not HTTP Compliant                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                              |
| Vulnerability Probing               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                              |
| Permanent Activity                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                              |
| Possible Credential Stuffing Attack | Traffic from a client matches indicators for a Credential Stuffing attempt.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                              |
| Repetitive Requests                 | Requests made to the same one or two URLs repeatedly.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                              |
| Request Limit                       | Request rate from a client has exceeded the configured rate limit.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                              |
| Spoofed Bot                         | Traffic that contains the user agent of a known bot, but down not match the profile for the bot curated by Link11.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                              |
| Uncommon Request                    | Requests from a client that do not match the profiles developed by Link11 for the expected traffic to the web application (e.g., the requests  fall outside the expected timeframe, frequency, access patterns, etc.)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                              |
| Unusual Browser Version             | An old or uncommon browser version is used by the client.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |                                                                                                                                                                                              |
| Unusual Geo Location                | Requests from clients that are geographically located outside of the normal source countries that access this web application.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | The more concentrated the typical source traffic is for a given web application, the better this indicator works.                                                                            |

<br>