Welcome to the AWS WAF Bot Control Demo

This demo showcases techniques for detecting bot traffic with AWS WAF Bot Control and deceiving bots through multiple layers of deception โ€” without ever blocking them.

Demo Overview

๐Ÿ•ท๏ธ

robots.txt Trap

Crawlers that ignore /robots.txt and access /private/* receive an AI-generated maze of fake pages, wasting their resources.

โฑ๏ธ

Forced Timeout (Demo 1)

Bots accessing /bot-demo-1 are routed to an unreachable ALB with 70% probability, draining their time and concurrency.

๐Ÿคซ

Silent Discard (Demo 2)

Comments from bots on /bot-demo-2 are silently discarded while the bot sees a success response, believing its spam worked.

๐Ÿค–

AI Crawler Trap (Demo 3)

Unverified AI crawlers receive a CloudFront-served fake pricing page with polluted data. Verified bots pass through normally.

Tech Stack

AWS WAF CloudFront Application Load Balancer Amazon Bedrock Node.js Express SQLite

Getting Started

Select a demo from the left menu to explore each Bot Control capability.

๐Ÿค– Bot Detection Info

AWS WAF Bot Control detected the following signals in this request:

  • Bot name: claudebot
  • Category: ai
  • Verified: unverified
  • JA4 fingerprint: t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3

Each demo uses this information to apply a different deception strategy.