An intelligent bot management platform that detects and blocks
bots and automated attacks

BotManager does not judge whether something is a bot from a single piece of information; it analyzes many signals together. Beyond various access information, it comprehensively analyzes traces of automation-tool usage, user interaction, abnormally short dwell times, repetitive URL-access patterns, whether browser attributes have been manipulated, and more. It also analyzes request patterns by login ID, session ID, and IP to reveal the risk level and the basis for its judgment.

A WAF (Web Application Firewall) generally focuses on defending against attacks that target web application vulnerabilities or against known attack patterns. BotManager focuses on identifying and controlling bot and macro traffic that looks like normal web requests but uses automation tools, scripts, or abnormal behavioral patterns. So rather than being an interchangeable replacement that plays exactly the same role, a WAF and BotManager complement each other—one for web-attack defense and the other for identifying and controlling automated traffic.

Yes. BotManager can detect and control automated attacks such as automated scraping, macros, direct API calls, and credential stuffing according to policy. For scraping, it comprehensively analyzes patterns such as sequentially crawling URLs, the absence of user interaction, abnormal dwell times, and traces of Headless Browser or Stealth tool usage. In login areas, it identifies automated login attempts to respond to attacks such as credential stuffing. It also provides capabilities—using a Server-Side Agent along with dynamic URLs and obfuscation—to respond to direct API calls that bypass the browser and to automated data collection.

No. Rather than blocking all bot traffic uniformly, BotManager can classify it into categories such as malicious bots, suspicious bots, and good bots, and apply different policies to each type. Because allow, detect, and block policies can be set individually for each bot category, you can allow the automated traffic your service operations require while restricting automated traffic used for unauthorized scraping or abuse.