stylobot Signature Detail
← Dashboard / Signature Detail
FR

curl

Bot
Scraper
Policy: Allow
Probability
100 %
Confidence
100 %
Risk
VeryHigh
Threat
None
Hit Count
339
Last Seen
28d ago

Recent Detections (50)

Time Method Path Status Prob Conf Risk Action Time
20:55:33 GET /Assignment4/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:55:33 GET /Assignment4/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:55:31 GET /Assignment3/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:55:31 GET /Assignment3/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:55:20 GET /assets/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:55:20 GET /assets/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:55:15 GET /asset_img/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:55:15 GET /asset_img/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:55:11 GET /asdf.php 404 100 % 100 % VeryHigh Block 0.5ms
20:55:11 GET /asdf.php 404 100 % 100 % VeryHigh Allow 0.5ms
20:55:08 GET /Archipel/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:55:08 GET /Archipel/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:55:04 GET /apps/client/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:55:04 GET /apps/client/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:55:02 GET /apps/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:55:02 GET /apps/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:59 GET /application/.env.save 404 100 % 100 % VeryHigh Block 0.5ms
20:54:58 GET /application/.env.save 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:56 GET /application/.env.sample 404 100 % 100 % VeryHigh Block 0.5ms
20:54:56 GET /application/.env.sample 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:51 GET /app_nginx_static_path/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:54:51 GET /app_nginx_static_path/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:48 GET /app_dir/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:54:48 GET /app_dir/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:45 GET /app2-static/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:54:45 GET /app2-static/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:43 GET /app1-static/.env 404 100 % 100 % VeryHigh Block 0.7ms
20:54:43 GET /app1-static/.env 404 100 % 100 % VeryHigh Allow 0.7ms
20:54:40 GET /app/info.php 404 100 % 100 % VeryHigh Block 0.6ms
20:54:40 GET /app/info.php 404 100 % 100 % VeryHigh Allow 0.6ms
20:54:36 GET /app/info 404 100 % 100 % VeryHigh Block 1.7ms
20:54:36 GET /app/info 404 100 % 100 % VeryHigh Allow 1.7ms
20:54:32 GET /app/frontend/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:54:32 GET /app/frontend/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:29 GET /app/config/dev/.env 404 100 % 100 % VeryHigh Block 0.6ms
20:54:29 GET /app/config/dev/.env 404 100 % 100 % VeryHigh Allow 0.6ms
20:54:25 GET /app/config/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:54:25 GET /app/config/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:22 GET /app/code/community/Nosto/Tagging/.env 404 100 % 100 % VeryHigh Block 0.6ms
20:54:22 GET /app/code/community/Nosto/Tagging/.env 404 100 % 100 % VeryHigh Allow 0.7ms
20:54:20 GET /app/client/.env 404 100 % 100 % VeryHigh Block 0.5ms
20:54:20 GET /app/client/.env 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:16 GET /app//.env.back 404 100 % 100 % VeryHigh Block 0.5ms
20:54:16 GET /app//.env.back 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:14 GET /app/.env.save 404 100 % 100 % VeryHigh Block 0.5ms
20:54:14 GET /app/.env.save 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:11 GET /app/.env.sample 404 100 % 100 % VeryHigh Block 0.5ms
20:54:11 GET /app/.env.sample 404 100 % 100 % VeryHigh Allow 0.5ms
20:54:07 GET /app/.env.example 404 100 % 100 % VeryHigh Block 0.5ms
20:54:07 GET /app/.env.example 404 100 % 100 % VeryHigh Allow 0.5ms

Analysis

Suspicious automated client on /Assignment4/.env - caught by ua:d245b2801e017f4f; ip:185.177.72.0/24, No referrer on subsequent request; No cookies maintained ..., Heuristic model (early): 74 % bot likelihood (20 features)

Detection Signals

  • • ua:d245b2801e017f4f; ip:185.177.72.0/24
  • • No referrer on subsequent request; No cookies maintained across multiple requests
  • • Heuristic model (early): 74 % bot likelihood (20 features)
  • • Previously identified as bot (UserAgent seen 51 times)
  • • Tool UA (curl) with 1 browser-only header(s) — likely spoofed

Detector Contributions (10 detectors)

ReputationBias
+1.998
0.0ms
ua:d245b2801e017f4f; ip:185.177.72.0/24
Heuristic
+0.475
0.0ms
Heuristic model (early): 74 % bot likelihood (20 features)
FastPathReputation
+0.600
0.0ms
Previously identified as bot (UserAgent seen 51 times)
UserAgent
+0.550
0.0ms
Tool UA (curl) with 1 browser-only header(s) — likely spoofed
Behavioral
+0.400
0.0ms
No referrer on subsequent request; No cookies maintained across multiple requests
Ip
-0.250
0.0ms
IP appears normal: 185.177.72.xxx
Header
-0.150
0.0ms
Headers appear normal
Inconsistency
-0.100
0.0ms
No header/UA inconsistencies detected
VersionAge
-0.050
0.0ms
Browser/OS versions appear current
SecurityTool
+0.000
0.0ms
No security tools detected in User-Agent

Signal Intelligence

behavioral

anomaly True
rate_exceeded False

header

count 18
has_accept True
sec_fetch_dest
sec_fetch_mode
sec_fetch_site
has_proxy_headers True
has_accept_encoding True
has_accept_language True
is_websocket_upgrade False
sec_fetch_same_origin False

heuristic

confidence 0.4746068865096784
prediction bot
early_completed True

ip

is_ipv6 False
is_local False
is_datacenter False

reputation

ip.score 0.997555351991494
ip.state ConfirmedBad
can_abort True
bias_count 2
ip.support 50.83950617283955
bias_applied True
fastpath_hit True
useragent.score 1
useragent.state ConfirmedBad
fast_abort_active True
useragent.support 50.83950617283955
fastpath.useragent.score 1
fastpath.useragent.state ConfirmedBad
fastpath.useragent.support 50.83950617283955
fastpath.useragent.pattern_id ua:d245b2801e017f4f

request

protocol HTTP/1.1
accept_encoding gzip

ua

family curl
is_bot True
bot_name curl
bot_type Tool
family_version 8.7
Signature: GmtTT4hmLOvaRbwkWzCMpA | Processing: 0.5ms | Country: FR