Hi @aljuk, thanks for your question.
Wordfence uses various methods to detect if a visit should be classified as a bot or human. One of these methods includes a large list of IP blocklists, and the other is detecting for human-like activity on your site with Javascript. However, these are more likely to identify a human as a bot (if Javascript is turned off in their browser, or share part of a blocked IP range), rather than bots being mistakenly seen as humans.
Would you be able to show me an example of Live Traffic entries for one or a few of these suspected botnet visits using a service such as Snipboard so I can take a look for the visitor IP(s) cropping up in lists and databases? You can censor any information you don’t wish to make public such as the visited page URL with the drawing/crop tools on the site.
Thanks,
Peter.
