X-ray for bots, scrapers and risky traffic
See the bots hiding in your traffic.
Scrapers, bots, AI agents and fraud now arrive through residential proxies, solve CAPTCHAs and look like real customers. Reputable sees what each visit really is, on every visit and across visits, and hands you a signed report to act on.
Works on any site. Add it directly or run it inside Cloudflare.
Signal streamSample- Likely people
- 36%
- Scrapers and bots
- 36%
- Residential proxies
- 21%
- AI agents
- 7%
- 14:02:250.79ChallengeStealth scraperHome broadband, US /search?q=…
- 14:02:230.09AllowLikely personMobile carrier, UK /
- 14:02:200.88Don't countClick fraudMobile carrier, VN /?gclid=…
- 14:02:180.02AllowVerified crawlerGPTBot, OpenAI /docs
- 14:02:150.86Require loginAI agentSolved CAPTCHA ·Cloud browser /signup
- 14:02:130.91BlockResidential proxySolved CAPTCHA ·Home broadband, BR /product/4410
Automated traffic is already in your numbers.
On most sites we see, bots drive 50–80% of traffic. They arrive through home internet connections and real browsers, and your analytics counts them as customers. Turn on the X-ray.
- Sessions
- 248,120
- Conversion rate
- 1.21%
- Paid clicks
- 18,400
- Analytics events
- 4.1M
- Likely people–
- Scrapers and bots–
- Residential proxies–
- AI agents–
- Datacenter and VPN–
One-and-done visits
104,000 visitors came once and never came back. Analytics counts them as new users.
Patterns across visits
Not visible. Each visit looks like a different person.
Built for what traditional bot tools miss.
The bots worth worrying about no longer look like bots. Blocklists, fingerprints and puzzles were built for a different kind of traffic. Reputable was built for this one.
Bots solve the puzzle.
Solver services and AI agents get through a CAPTCHA in seconds.
Reputable keeps scoring after the CAPTCHA. A solve by automation is flagged, not trusted.
Proxies borrow real homes.
Residential proxy networks send bots through millions of home internet addresses.
Reputable scores the visit, not the address. A clean home IP is not proof of a person.
The browser is real.
Stealth tools drive genuine Chrome. Fingerprint and user-agent checks pass.
Reputable weighs signals automation cannot rent, so a perfect fingerprint is not a free pass.
Decision models, not blocklists. Models built from real scraper, bot and proxy traffic return a likelihood and a confidence for every visit, so you act on evidence and not on a list.
“In a single seven day period, we observed over 550 individual threat groups utilizing IPIDEA exit nodes to obfuscate their activities.”— Google Threat Intelligence, Jan 2026
“The effectiveness of IP address blocklists has diminished… creating a growing need for connection-based and session-based access control.”— Trend Micro Research
“Traffic from ResProxies blends in with legitimate traffic… incredibly difficult to detect or block.”— Comcast Security Research
The traffic other tools wave through.
Each visit is labeled with what it most likely is, how sure we are, and what it claims to be.
Stealth scrapers
Real Chrome, clean fingerprints, and a new address on every request.
Residential proxies
Bots routed through real home internet addresses, so IP reputation sees a normal customer.
CAPTCHA solvers
Bots and solver services that pass the puzzle. A solved CAPTCHA no longer means a person.
Click fraud
Paid clicks from farms and proxies that burn budget and poison conversion data.
Account abuse
Fake signups, credential stuffing and trial abuse at your forms.
AI agents
Agentic browsers that read, click and fill forms like a person, at machine scale.
VPNs and datacenters
Hosted and anonymized traffic, labeled by network type and operator.
Crawler impostors
Scrapers that borrow the names of Googlebot, GPTBot and other known crawlers.
Agents that fight back.
Detection is half of it. Reputable's security agent reads your traffic and logs, finds the new patterns, and drafts the rules to stop them. You approve. It checks that each one worked.
Finds campaigns, not just visitors. A thousand one-and-done visits from a residential pool show up as one operation.
Drafts rules where you enforce. At Cloudflare, in your own code, in your analytics, or in Reputable's proxy.
Checks the result. Each rule is measured after it goes live, and every rule expires on its own.
Works without Cloudflare. On its own, rules run in your code or in Reputable's proxy in front of your app.
Investigation 2041
Opened by the security agent · today, 09:00 · sample
Two campaigns got past the CAPTCHA overnight. Yesterday's rule is working, so I drafted three more changes in the same shape.
- Read traffic and server logs1.2M requests · 48 h
- Grouped one-visit sessions into campaigns2 found
- Checked yesterday's rulehits −94%
Residential proxy campaign
High · confidence 0.94
- Visitors
- 412
- Visits each
- 1
- Target
- /product/*
9 home ISPs in 31 countries, one shared pattern.
AI agent creating trial accounts
Medium · confidence 0.88
- Signups
- 40 / day
- CAPTCHA
- Solved
- Target
- /signup
Cloud browser, new address on every signup.
- CloudflareManaged challengeCampaign 2041 on /product/*24 h
- Your appRequire email checkLikely agents on /signup7 d
- AnalyticsWithhold eventsCampaign 204130 d
Works with the setup you already have.
You do not need Cloudflare. Add a script tag or one API call to any site, or put Reputable's proxy in front of your app. Already on Cloudflare? Run it in a Worker alongside your existing setup. It sees what IP reputation and browser fingerprints miss.
Residential proxies
IP and fingerprint scores: Often look like real customers
Reputable: Scored on every visit, with a likelihood
Bots that solve CAPTCHAs
IP and fingerprint scores: Pass once the puzzle is solved
Reputable: Flagged even after a solved CAPTCHA
What you get back
IP and fingerprint scores: A score or a challenge
Reputable: A signed report: proxy, automation, network, crawler identity
Who decides
IP and fingerprint scores: The vendor's rules
Reputable: Your thresholds, in your code or at your edge
Your analytics
IP and fingerprint scores: Bots still reach GA4 and your event bill
Reputable: Gate events before they are sent
One-and-done visits
IP and fingerprint scores: Each visit judged alone
Reputable: Linked into campaigns across visits
New attacks
IP and fingerprint scores: Wait for the vendor's next model
Reputable: Your security agent drafts new rules
Where it runs
IP and fingerprint scores: One vendor's edge
Reputable: On its own on any site, or in a Cloudflare Worker
Getting started
IP and fingerprint scores: Enterprise contract and a sales call
Reputable: Start free, self-serve
| Topic | IP reputation and fingerprint scores | Reputable |
|---|---|---|
| Residential proxies | Often look like real customers | Scored on every visit, with a likelihood |
| Bots that solve CAPTCHAs | Pass once the puzzle is solved | Flagged even after a solved CAPTCHA |
| What you get back | A score or a challenge | A signed report: proxy, automation, network, crawler identity |
| Who decides | The vendor's rules | Your thresholds, in your code or at your edge |
| Your analytics | Bots still reach GA4 and your event bill | Gate events before they are sent |
| One-and-done visits | Each visit judged alone | Linked into campaigns across visits |
| New attacks | Wait for the vendor's next model | Your security agent drafts new rules |
| Where it runs | One vendor's edge | On its own on any site, or in a Cloudflare Worker |
| Getting started | Enterprise contract and a sales call | Start free, self-serve |
Protect what bots pollute.
Start with the job: analytics you can trust, or pages and data that only the right visitors get. Both include the X-ray of every bot, crawler and agent on your site. On Cloudflare? Add Reputable for Cloudflare.
Script tag on any site
Reputable for Analytics
Analytics and ad spend you can trust.
Everything that loads over JavaScript, from GA4 and Google Tag Manager to Segment, Mixpanel, PostHog and your ad pixels, gets a signed read on the visit before it fires.
- Hold bot, scraper and agent events back before they reach your analytics bill
- Flag click fraud, so paid clicks from proxies are not counted
- Send automated traffic to its own segment instead of losing it
First report in about a minute.
Widget or API on any page
Reputable Gate
A smarter CAPTCHA that decides what renders.
Put it in front of sign-in, signup and checkout, or in front of data you do not want scraped: prices, inventory, proprietary records. It runs a Reputable check and returns a signed ticket with the evidence. Your code decides what the visitor gets.
- Render sensitive data only for visits under your cutoffs; ask the rest to sign in
- Automation, proxy and agent likelihood, network and crawler identity in every ticket
- Knows when automation solved the CAPTCHA, so a solve is not a pass
Your server verifies the ticket offline with our public keys.
If you run Cloudflare
Reputable for Cloudflare
Agents that keep your Cloudflare rules current.
A Worker inspects traffic at your edge. A security agent reviews it on a schedule, finds the new patterns, and drafts the Cloudflare rules to stop them. You approve each one.
- Adds proxy, scraper and agent detection to what Cloudflare already checks
- Drafts, applies and expires WAF rules, with your approval
- Works on every Cloudflare plan, including Free
Underneath: all of it runs on the Bot Signals API, which you can call directly from any backend. Need it on your own servers? IP Reputation runs self-hosted, with behavioral security analytics that stay in your infrastructure.
Evidence, not a checkbox.
Every check returns a signed report. Your code, or your edge, reads it and acts on your thresholds.
- What it is
- Residential, mobile, datacenter, VPN or relay, with the network operator.
- How likely
- A 0 to 100 proxy score and a plain likelihood: none, low, likely or high.
- Automation
- How likely the visit is automated or driven by an AI agent, and its name when it identifies itself.
- Why
- Separate reads for proxy relay, automation, agents and infrastructure, each with a confidence.
- Who it claims to be
- Known crawlers verified against their operator. Impostors flagged.
- CAPTCHA
- Whether a CAPTCHA was solved, so a solve by automation does not count as a pass.
- Proof
- Signed and short-lived. Your server verifies it offline.
Behind it, detection models weigh many network and behavioral signals per visit. We keep the method private, because the operators we catch read documentation too.
{
"proxyScore": 91,
"proxyLikelihood": "high",
"confidence": 0.93,
"networkRisk": {
"relay": { "likelihood": "high" },
"automation": { "likelihood": "likely" },
"infrastructure": { "likelihood": "low" },
"agent": { "likelihood": "likely" }
},
"captcha": { "solved": true },
"ipType": "residential",
"asnKind": "consumer_isp",
"country": "BR",
"verifiedBot": null
}One line in. A decision you control out.
Pick a step to see what it looks like.
- Add one line<scriptsrc="https://cdn.reputable.click/verify/v1/reputable.js"data-reputable-key="pk_live_…"async></script>✓ first signed report in about a minuteno CAPTCHA, no change for real visitors
Built for the traffic that costs you money.
Stop paying to count bots.
Bots, scrapers and agents inflate your sessions, your conversion funnel and your event bill. Let the visit happen, and use the signed report to decide whether GA4, Segment, Mixpanel or PostHog receives the event. Real visitors are counted. Automated traffic is held back or sent to its own segment, so the numbers you report are numbers you can trust.
Works with GTM and any dataLayer: fire analytics when reputable_omit_analytics is false.
Run the real check on yourself.
This runs the hosted check from your browser and shows the report it returns. Or flip through sample reports for a datacenter bot, a crawler impostor, an AI agent and a residential proxy. Nothing is stored.
Short answers.
How is this different from Cloudflare Bot Management?
Edge bot scores lean on IP reputation, browser fingerprints and challenges. Scrapers on residential proxies and bots that solve CAPTCHAs get past all three: the address is a real home, the browser is real, and the CAPTCHA gets solved. Reputable is built for that traffic. You get the evidence in a signed report and set your own thresholds. Run it in a Cloudflare Worker next to Cloudflare, or with no Cloudflare at all. There is no enterprise contract.
Do I need Cloudflare?
No. Reputable stands on its own: a script tag, a form widget, a redirect, one API call, or Reputable's proxy in front of your app. If you already run Cloudflare, it can also run there as a Worker.
Can you tell which AI agent it is?
When an agent identifies itself, yes. The report names it and says how: the operator's published network, a signed request, or a name in the user agent. ChatGPT agent, Google-Agent and the user-triggered fetchers from OpenAI, Anthropic, Perplexity and Mistral identify themselves. Many agents do not, including agents that run in a person's own browser. For those, the report gives an agent likelihood, not a name.
What is the security agent?
An AI analyst that works for you. On a schedule, or when you ask, it reads your traffic and logs, finds new patterns and campaigns, and drafts rules for Cloudflare, your own code, your analytics or Reputable's proxy. Nothing goes live until you approve it. It checks that each rule worked, and every rule expires on its own.
How do you detect them?
Detection models weigh many network and behavioral signals on every visit and return a likelihood with a confidence. We do not publish the full method, because the people who run these bots read documentation too.
Does it replace my CAPTCHA?
It can. The widget works like a CAPTCHA box, but most visitors never see a puzzle. A challenge appears only when your thresholds ask for one. If you keep your CAPTCHA, the report tells you when it was solved by automation.
Is this tracking my visitors?
No. Reputable is security tooling. It scores connections and the behavior of networks. It does not identify the person behind a visit.
Can I turn it off?
Yes. Remove the script tag. At the Cloudflare edge, one button turns all rules off and checks that they are gone.
Get started
Turn on the X-ray.
Sign in, paste one script tag, and see how much of your traffic is scrapers, bots, proxies and agents. No Cloudflare needed. Nothing changes for your visitors until you decide it should.
Free to start. Real customers never see a CAPTCHA wall. Or book a demo.