How botwatch detects malicious bots
botwatch.xyz is a cybersecurity research project. We run honeypots and watch how automated agents, crawlers, and threat actors behave across the web — then turn that behaviour into threat intelligence. Here's how.
Live aggregate figures from our sensors — counts only. We never publish individual IPs, captured payloads, or credentials.
Attack categories we're seeing
Honeypots & trap endpoints
We expose a network of decoy endpoints — fake admin panels, config files, and vulnerable-looking paths — that no legitimate user has any reason to touch. Any hit is a strong signal of automated scanning or malicious intent, and we capture the full request for analysis (headers, method, and the raw payload) with strict politeness and rate controls elsewhere on the site.
Behavioural machine-learning model
For every source IP we aggregate how it behaves — request volume and rate, path and user-agent diversity, error rates, method mix, and more — into a feature vector, and score it with a logistic-regression model that runs entirely in-house (no third-party service). Crucially it trains on behavioural features only, deliberately excluding the signals that define the label, so it learns to predict maliciousness before an IP trips an obvious signature. Every score comes with a plain-language explanation of why, and analysts can confirm or override any call — a human stays in the loop.
Payload & CVE signature analysis
Each request is scanned against a library of attack signatures — SQL injection, XSS, path traversal, command injection, SSRF, template injection, deserialization, and scanner fingerprints — plus a curated set of named, high-severity CVE exploit patterns (Log4Shell, Spring4Shell, Shellshock, and more). Matches are classified by intent (recon, injection, exploit, scanner) and severity, so we can see not just that an attack happened but what the attacker was trying to do.
Novel-payload & 0-day detection
Signatures only catch what we already know. So we also flag requests that look attack-shaped but match no known signature — obfuscated or high-entropy payloads, unusual encodings, injection-shaped structure, odd method/body combinations. These land in a review queue where an analyst can investigate genuinely novel techniques, including possible zero-day attempts.
Passive enrichment
We enrich the infrastructure behind an attack using passive, non-intrusive sources: DNS and reverse DNS, WHOIS/RDAP, TLS certificates, email authentication posture, hosting and network (ASN), and reputation data. Cross-referencing attackers against their networks and countries turns isolated events into a picture of where threats actually originate.
Our privacy stance
This is defensive research. We study attacker behaviour and payloads, never legitimate users. Successful logins are never recorded, real-user submissions are stripped, and captured request bodies are never exposed through any public interface — everything you see here is aggregate. Found a security issue? See our responsible-disclosure policy.