CMbot
Run by CM.com
How to detect CMbot
CMbot signs its requests, so you detect it by verifying the cryptographic signature on each request. A valid signature proves the request came from CM.com; a copied user agent without the signature does not.
- Detection method
- SignedThe agent signs its requests, so its identity is verified cryptographically.
- Signals that identify it
- CryptographicA signed request verified cryptographically
- BehavioralAutomated clicks, typing and page flow instead of a person's
Every signal Verisoul checks for CMbot
CMbot signs its requests, so we verify who it is cryptographically, then check the rest of the session.
- Used
Cryptographic
A signed request verified cryptographically
- Not used
Network
Not needed to identify it
- Not used
Device
Not needed to identify it
- Used
Behavioral
Automated clicks, typing and page flow instead of a person's
How often you'll see it
Very uncommon
Rare, brand new, or not seen on Verisoul traffic yet
Questions about CMbot
How do you detect CMbot?
CMbot signs its requests, so you detect it by verifying the cryptographic signature on each request. A valid signature proves the request came from CM.com; a copied user agent without the signature does not.
What is CMbot?
CMbot is an AI agent from CM.com that works in a browser and signs its requests.
Does CMbot identify itself?
Yes. CMbot signs its requests cryptographically, which is the strongest way an agent can identify itself.
Can a bot pretend to be CMbot?
Not convincingly. A bot can copy CMbot's user agent, but without CM.com signing keys its requests fail verification and it is not labeled CMbot.
How common is CMbot?
Very uncommon. Rare, brand new, or not seen on Verisoul traffic yet.
What does the Verisoul API return for CMbot?
Every session Verisoul identifies as CMbot carries an agent block with id "cmbot", name, provider, type "ai_agent", detection_method "signed" and the detection_signals used (cryptographic, behavioral). Build rules on the id, type and detection method.