Detect if request comes from an antivirus

68 Views Asked by At

I'm building a service with API Gateway + Lambda that tracks email link clicks. The links inside the email lead to my endpoint, which gathers the click info and redirects to another URL. However, I'm detecting that in some cases, some software automatically clicks most of the links, probably to prevent phishing, and the usual suspect here is an antivirus. Since I'm targeting only real user clicks, I want to discard them, but didn't find anything weird in the request headers. How would you check that the request comes from a non user?

1

There are 1 best solutions below

1
Balaji On

In API Gateway settings, you can turn on CloudWatch logs to see all the request headers. Specifically, you can use $context and $input variables to log context variables like user-agent, source-ip or log all the headers.

If the bots are using exact same user-agent and set of headers, I do not see a way to distinguish them at API Gateway side.