Claude
Used Fingerprint integration, used a tool
Total events
100
Datacenter
80
Residential proxy
15
ISP / direct
5
Bot type
- Webdriver63
- Headless Chrome18
- Puppeteer Stealth5
- AdsPower SunBrowser4
- Nodriver4
- Browser Automation Studio4
- Nodriver (unclassified)2
Country of origin
- US — Des Moines, IA63
- US — Ashburn, VA9
- France — Paris/Nantes5
- India — Patna4
A few things stand out:
One visitor dominates. Visitor zEAhZ8fx... accounts for 63 of the 100 events — all webdriver, all from a single Microsoft Azure IP in Des Moines. It’s clearly an automated test suite (the URLs match fingerprint.com flows like /playground, /personalization, /paywall, /sms-pumping) hitting your demo environment, not a real attack. Probably internal or partner testing that doesn’t bother suppressing bot detection.
The more interesting signals are the others. The residential proxy events are the ones worth watching:
- AdsPower SunBrowser + residential proxies (NetNut, DataImpulse) hitting fingerprint.com from French ISP IPs. Anti-detect browser paired with resi proxy is a classic account fraud pattern.
- Browser Automation Studio from India via PROXY.CC on Airtel IPs, landing on fingerprint.com. Someone testing their own tooling against your detection.
- Puppeteer Stealth out of Brazil with 711Proxy, coming in via a Google Ads click (the URL has full UTM params). That’s potentially click fraud.
Network type breakdown: 80% datacenter (mostly that Azure cluster), 15% residential proxy, 5% ISP/direct. If you strip the Azure test suite out, the residential proxy ratio jumps to ~75% of the remaining organic bad bot traffic.