Detect Bots, Suspicious Traffic, and Viewer Anomalies

Investigate abnormal traffic without blocking legitimate accessibility use.

Best for: Authorized producers, analysts, accessibility leads, organization owners, and support staff.

Before you start

Availability depends on role, event access, plan entitlements, retained source data, export/AI/statistics features, and privacy policy.

• Confirm exact organization, event, language, and reporting period.
• Verify requester, recipient, and retention/privacy authorization.
• Preserve raw source data before cleanup, editing, or deletion.

Step by step

1. Establish baseline. Audience, embeds, tests, shared displays.
2. Describe anomaly. Rate/referrer/ASN/region/reconnect.
3. Check operations. QR, embed refresh, outage, browser source.
4. Use multiple signals. Not one bot label.
5. Apply proportionate controls. Approved domain/access/rate rules.
6. Protect viewers. Validate assistive tech/shared networks.
7. Preserve redacted evidence. Time/event/pattern/control.
8. Escalate/review. Incident process; remove temporary controls.

What success looks like: The deliverable or analysis is correct for the intended scope, reviewed, reproducible, and protected according to policy.

Check your setup

• Anomaly explained/contained.
• Legitimate viewers retain access.
• Evidence/owner recorded.

Troubleshooting

Looping embed

Fix host reload.

Shared NAT

Do not treat as one attacker.

Metrics persist

Check freshness/other entries.

Security and operational notes

• Preserve accessibility.
• Do not publish network IDs.
• Authorized controls only.

Related guides

• Interpret Audience and Technical Analytics
• Embed Parameters, Allowed Domains, and Troubleshooting
• First-Response Troubleshooting

Documentation status: Draft for operational, privacy, and analytics review before publishing.