Add lazy IP enrichment and bot hints

internal/investigation/service.go

@@ -139,6 +139,9 @@ func (s *Service) Investigate(ctx context.Context, ip string, userAgents []strin
 		investigation.ReverseDNS = reverseDNSInfo
 		return investigation, nil
 	}
+	if hint := detectBotHint(userAgents); hint != nil {
+		investigation.Bot = hint
+	}
 
 	warnings := make([]string, 0, 2)
 	if reverseDNSInfo == nil {
@@ -599,6 +602,45 @@ func normalizeUserAgents(userAgents []string) []string {
 	return uniqueStrings(items)
 }
 
+func detectBotHint(userAgents []string) *model.BotMatch {
+	for _, userAgent := range userAgents {
+		name := extractBotHintName(userAgent)
+		if name == "" {
+			continue
+		}
+		return &model.BotMatch{
+			ProviderID: strings.ToLower(name),
+			Name:       name,
+			Icon:       "🤖",
+			Method:     "user_agent_hint",
+			Verified:   false,
+		}
+	}
+	return nil
+}
+
+func extractBotHintName(userAgent string) string {
+	parts := strings.FieldsFunc(userAgent, func(value rune) bool {
+		switch value {
+		case ' ', ';', '(', ')', ',', '\t':
+			return true
+		default:
+			return false
+		}
+	})
+	for _, part := range parts {
+		base := strings.TrimSpace(strings.SplitN(part, "/", 2)[0])
+		if base == "" {
+			continue
+		}
+		normalized := strings.ToLower(base)
+		if strings.Contains(normalized, "bot") || strings.Contains(normalized, "crawler") || strings.Contains(normalized, "spider") || strings.Contains(normalized, "slurp") || strings.Contains(normalized, "fetcher") || strings.Contains(normalized, "indexer") || strings.Contains(normalized, "preview") || strings.Contains(normalized, "externalhit") {
+			return base
+		}
+	}
+	return ""
+}
+
 func extractPrefix(payload map[string]any) string {
 	items, ok := payload["cidr0_cidrs"].([]any)
 	if !ok {