Last 30 days · demo.avagotya.com

Threat intel

Visits scored

2,034

every visit gets a 0–100 risk score

High-risk visits

330

16.2% of scored traffic

…of them paid clicks

147

these are the ones that cost money

Actor groups

coordinated sources linked together

Every visit, by verdict · per day

When the bad traffic shows up · UTC hour × weekday

Real customers follow your business hours. Automation doesn't sleep — a bright band at 3 a.m. is a schedule, not a shopper.

Why they were flagged · top reasons

Networks sending high-risk traffic

Countries

What kind of bot

AI agents that browse like people (ChatGPT, Perplexity Comet, Claude) are identified by their published tokens and are never billed. Crawlers that never run JavaScript don't reach a page tag; those need the edge collector.

Campaign exposure

Campaign	Paid clicks	High-risk	Share
Red Light – Broward	441	65	14.7%
Reckless – Miami-Dade	231	37	16.0%
Speeding – Palm Beach	201	34	16.9%
Live test	12	11	91.7%

Actor groups · sources that behave as one

CL-7F2Aclick id replay

devices

IPs

networks

Active 9/5/2026 – 9/13/2026. Evidence and a damages estimate are in the case file; we never name who is behind it.

CL-91C0datacenter fanout

devices

IPs

networks

Active 8/25/2026 – 9/2/2026. Evidence and a damages estimate are in the case file; we never name who is behind it.

CL-3B18headless cdp

devices

IPs

networks

Active 8/31/2026 – 9/11/2026. Evidence and a damages estimate are in the case file; we never name who is behind it.

CL-D4E7no pointer entropy

devices

IPs

networks

Active 9/8/2026 – 9/14/2026. Evidence and a damages estimate are in the case file; we never name who is behind it.