# Synapse bot

The Synapse user-agent is associated with Apache Synapse, an open-source framework for web services integration, not a single bot. Its presence in your logs can indicate a variety of activities, from legitimate data integration by a business partner to unauthorized security probing by malicious actors. Due to its dual nature, traffic from this user-agent warrants careful evaluation based on its behavior.

Breadcrumb navigation

- [Privacy-focused, simple website analytics](https://plainsignal.com/)
- [Agents](https://plainsignal.com/agents "Agents, User-Agents, Crawlers, Browsers")
- [Synapse bot](https://plainsignal.com/agents/synapse-bot)


## What is the Synapse bot?

The Synapse bot user-agent is associated with Apache Synapse, an open-source mediation framework for web services. It is not a single bot but can represent several implementations. The user-agent `Mozilla/4.0 (compatible; Synapse)` is from the base framework. In enterprise environments, the WSO2 API Gateway, which uses Synapse, may replace original user-agents with `Synapse-PT-HttpComponents-NIO`. Microsoft's Azure Synapse Analytics also uses agents with 'Synapse' in the name for cloud data integration. The Apache Synapse library itself is a lightweight HTTP client that does not process dynamic content.


## Why is a Synapse bot crawling my site?

The reason a Synapse bot is on your site depends on the context. An Apache Synapse-based bot may be there for a legitimate data integration process or API interaction with a business partner. However, security researchers have noted that the Synapse user-agent is also used by malicious actors to mask reconnaissance and probing activities. If you are seeing unusual traffic patterns from this user-agent, particularly against non-API endpoints, it may warrant further investigation.


## What is the purpose of a Synapse bot?

The legitimate purpose of Apache Synapse is to facilitate communication between web services, acting as middleware for data exchange. For organizations using WSO2's API Gateway, it centralizes API management. Azure Synapse Analytics focuses on data integration in the Microsoft cloud. When used properly, these are valuable technologies. However, the same capabilities can be repurposed for unauthorized data collection or security probing by third parties.


## How do I block a Synapse bot?

Given that the Synapse user-agent can be associated with both legitimate and malicious activity, blocking it requires careful consideration. If you do not have any known API integrations with partners who might be using it, you can block it in your `robots.txt` file.

To block the bot, add the following lines to your `robots.txt` file:

```
User-agent: Synapse
Disallow: /
```

However, if the traffic is malicious, the operator may not respect `robots.txt`, and firewall-level blocking may be necessary.


## Related agents and operators


## Canonical

Human friendly, reader version of this article is available at [Synapse bot](https://plainsignal.com/agents/synapse-bot)

## Copyright

(c) 2025 [PlainSignal](https://plainsignal.com/ "Privacy-focused, simple website analytics")