Identifying malicious Arb bots vs. simple followers during a "Tipster Surge" any advice on real-time metrics?

I’ve been digging into some traffic and liquidity data over at Oncastudy regarding the "Tipster Effect." Basically, as soon as a high-impact tipster drops a pick, the odds for that specific market just tank instantly and liquidity evaporates.

It’s the usual suspect: a massive wave of manual followers and automated betting bots hitting the servers at the same time, causing a huge supply-demand imbalance. Most platforms defend themselves by setting volatility thresholds to pause the market or dynamically slashing betting limits to protect the house.

But here’s the tricky part: in that split second when the surge hits, how do you actually distinguish between a "dumb" follower (just following the tip) and a malicious arbitrage bot in real-time?

Are you guys looking at specific latency patterns, bet sizing consistency, or maybe account linkage signatures? I’m curious what kind of indicators you’d prioritize to filter out the high-risk arb bots without ruining the experience for regular users during these high-volatility windows.

Would love to hear some thoughts from anyone handling high-concurrency risk systems.