Bot Detection That Powers Your Entire Security Stack

# CloudFormation Template Excerpt
Resources:
  WebDecoyBotRules:
    Type: AWS::WAFv2::RuleGroup
    Properties:
      Name: webdecoy-bot-rules
      Scope: REGIONAL
      Capacity: 100
      Rules:
        - Name: BlockDatacenterActorsByJA4
          Priority: 1
          Action:
            Block: {}
          Statement:
            OrStatement:                 # one match per confirmed actor
              Statements:
                - ByteMatchStatement:
                    FieldToMatch:
                      JA4Fingerprint:    # match the JA4 identity, not an IP
                        FallbackBehavior: NO_MATCH
                    PositionalConstraint: EXACTLY
                    SearchString: t13d1516h2_8daaf6152771_b0da82dd1658
                    TextTransformations:
                      - Priority: 0
                        Type: NONE
                # ...auto-maintained by WebDecoy as new datacenter
                #    actors are confirmed: blocks every IP they use

sub vcl_recv {
  # Check WebDecoy edge dictionary for blocked IPs
  if (table.lookup(webdecoy_blocked_ips, client.ip)) {
    error 403 "Forbidden";
  }

  # Check bot score header from WebDecoy
  if (req.http.X-WebDecoy-Score) {
    if (std.atoi(req.http.X-WebDecoy-Score) > 80) {
      error 403 "Bot Detected";
    }
  }
}

sub vcl_log {
  # Stream detection events to WebDecoy
  if (req.http.X-Bot-Detected == "true") {
    log "syslog " req.service_id
        " webdecoy :: "
        client.ip " "
        req.url " "
        req.http.User-Agent;
  }
}