Each scenario is a real scripted attack, fired from the lab's server-side runner at this host, through the wslproxy edge, at the same shop origin. A browser cannot pose as a bot (it may not set the User-Agent, drop cookies or forge headers), so the runner does it and reports what came back. Flip to the other host to compare.
| Attack | How it is caught | Requests | Impact | Verdict |
|---|
X-WSL-Bot-Class, -Score, -IVT, -Signals,
-Action) are exposed on the protected host for this demo; in production they go to the origin only.
The challenge is self-hosted (proof of work + automation check) — no third-party script, no external service.