Crazy Egg
What is Crazy Egg?
Crazy Egg’s crawler bot is an automated agent used by the Crazy Egg analytics platform to fetch pages for snapshots (screenshots), heatmaps/scrollmaps, and A/B test variations. It typically honors robots.txt and is distinct from the client-side script that records user interactions.
Legitimate use cases
– UX and conversion optimization (heatmaps, scroll depth)
– Visual QA of page states and variants
– Pre-fetching pages for snapshot generation and reporting
– Auditing page performance and layout across templates
Illicit or fraud-related misuse (risks)
– User-agent spoofing as “Crazy Egg” to bypass naive bot filters
– Reconnaissance of site structure/content for scraping
– Analytics poisoning (fake page fetches skewing engagement metrics)
– Evasion of basic WAF rules and rate limits via impersonation
– Load generation to degrade availability or manipulate A/B outcomes
Why is Crazy Egg crawling my site?
Reason it’s crawling
– Your site loads its script (installed by you/partner/previous agency).
– Someone added your URL to their account, triggering verification/snapshots.
– It follows public links to capture page structure for analytics/testing.
Potential negative impacts
– Extra crawl traffic: CPU/bandwidth/CDN egress costs; cache churn.
– Log/WAF noise; false positives in bot/scraping detections.
– Skewed web analytics (inflated pageviews, A/B test traffic).
– Possible exposure of sensitive HTML/content in captured snapshots if masking not configured.
– Crawling of parameterized URLs may trigger non-idempotent GET endpoints.
– Strains limited-origin quotas/rate limits on APIs backing pages.
How to block Crazy Egg?
– robots.txt
– User-agent: CrazyEgg
– Disallow: /
– Low effort; only works if the bot honors robots.txt.
– User-Agent filtering
– Apache (.htaccess):
RewriteCond %{HTTP_USER_AGENT} "(?i)Crazys?Egg|CrazyEgg"
RewriteRule .* - [F]
– Nginx:
if ($http_user_agent ~* "Crazys?Egg|CrazyEgg") { return 403; }
– IP/ASN denylist
– Block Crazy Egg’s published IP ranges at your firewall or web server (e.g., nginx deny rules, iptables). Reduces application load.
– rDNS + FCrDNS validation
– Verify reverse DNS maps to a Crazy Egg domain and forward-confirmed DNS resolves back to the same IP; block mismatches to stop UA spoofing.
– JavaScript/cookie gate
– Serve full content only after a small JS sets a signed cookie/token; clients without JS/cookies (typical bots) receive 403 or a lightweight page.
Block and Manage Crazy Egg with DataDome
See which bots and AI agents bypass your defenses
Create your account to start analyzing and mitigating malicious bots and AI-drive threats in real-time