What does it take to characterize legit users also as bots