A list of known bad bots is useful on the day it is written and less useful every day after. Operators rename their tools, rotate addresses, and spin up new referrer spam. A stale list blocks yesterday’s traffic.
What goes on the list
- Bad user-agent strings used by scrapers and scanners.
- Spam referrers that pollute analytics.
- Malicious IP ranges.
- Fake crawlers that claim to be a search engine but aren’t.
- Ranges published by hosting and cloud providers.
Why freshness matters
Known-bad intelligence is cheap and fast: a lookup, not a model. That makes it a good first filter, but only while it is current. Refreshing on a daily schedule keeps it useful without slowing down requests, because the data is prepared ahead of time and read locally.
Don’t rely on it alone
A blocklist only knows what has already been seen. A new tool with a clean user agent passes straight through. That is why intelligence should be one signal among several, alongside behavior, browser integrity, and automation checks.
Skyfense refreshes its bad-bot intelligence daily and uses it in bot classification. See bot protection for how it combines with the rest.
Is this happening to your store?Lots of visits and carts, no sales: see how Skyfense fixes it →