Anomalies
Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (each check previews its top 50 rows — the per-check view holds up to 500).
Browser claim vs. tool fingerprint
A User-Agent claiming a mainstream browser, observed with a TLS ClientHello the JA4+ database identifies as a non-browser tool (curl, a C2 agent, a library). The TLS stack is far harder to forge convincingly than the User-Agent header.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like M… | User-Agent claims Safari | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 2062 | 2026-06-11 | 2026-08-06 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 … | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 81 | 2026-06-14 | 2026-06-14 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 76 | 2026-07-07 | 2026-09-09 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Linux; Android 11; vivo 1906; wv) A… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 65 | 2026-06-27 | 2026-08-03 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 47 | 2026-07-01 | 2026-09-02 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 34 | 2026-06-27 | 2026-08-03 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 26 | 2026-06-16 | 2026-09-14 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:… | User-Agent claims Firefox | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 11 | 2026-07-03 | 2026-08-31 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
visionheight.com/scan Mozilla/5.0 (Macintosh; In… | User-Agent claims visionheight.com | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 7 | 2026-06-25 | 2026-09-04 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleW… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Safari | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132… | User-Agent claims Firefox | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/H… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-17 | 2026-09-12 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133… | User-Agent claims Firefox | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac… | User-Agent claims Safari | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/… | User-Agent claims Firefox | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 5 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 5 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 5 | 2026-06-25 | 2026-06-25 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 5 | 2026-06-25 | 2026-06-25 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 5 | 2026-07-12 | 2026-08-31 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 4 | 2026-08-03 | 2026-08-03 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) A… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 3 | 2026-07-27 | 2026-07-27 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) … | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 3 | 2026-07-01 | 2026-07-01 |
Browser claim vs. measured captures
A User-Agent claiming a browser the catalog has measured, at a version inside the measured range, whose TLS fingerprint is consistent with none of this site's controlled captures of that browser. Where the check above leans on an external label, this one is grounded in measurement. The comparison is layered: a fingerprint differing from a capture only in handshake-variant extensions (session resumption, 0-RTT, session tickets, padding) counts as consistent and is not shown; a differing cipher list is the stronger lead (medium); matching ciphers with a differing extension or signature-algorithm set is weaker (low) — most often a field-trial, ECH, or build variant not yet captured. It sharpens as catalog coverage broadens.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen |
|---|---|---|---|---|---|---|---|
| No browser-vs-capture inconsistencies at high confidence in this window. | |||||||
OS claim vs. TCP stack
A User-Agent's claimed operating system against the initial TTL of its TCP SYN. An initial TTL of 64 is Unix-like (Linux, macOS, iOS, Android, BSD); 128 is Windows. A "Windows" User-Agent arriving on a TTL-64 stack — or vice versa — is inconsistent, subject to the proxy/NAT caveats above.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen |
|---|---|---|---|---|---|---|---|
| No OS-vs-TCP inconsistencies at high confidence in this window. | |||||||
Bot claim vs. operator-published verification
A User-Agent declaring a major bot — a search or AI crawler or a user-triggered fetcher — observed from an IP outside the ranges that operator publishes for it, or inside a different operator's ranges, and confirmed by no other channel the operator publishes. Unlike the checks above, this is not a wire-vs-claim contradiction: it is the self-declared identity against the operator's own published verification channels — its crawler IP list and, where the operator documents one, forward-confirmed reverse DNS; either channel alone identifies. An IP no channel vouches for, arriving under a bot's name, is almost always an impersonator — scrapers spoof crawlers to dodge rate limits and earn crawler treatment. One exception is worded on its rows: operators that publish only their network rather than crawler ranges (Meta) — an outside-network claim there is an unverified anomaly, not proof of spoofing, unless the IP sits inside another operator's published crawler range. Claims one channel confirms while the other denies are identified, listed as publication disagreements on the operator's page, not here; the fully consistent side appears as identified on the fingerprint page.
| User-Agent | claims | from network | verification shows | confidence | seen | first seen | last seen | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla/5.0 (compatible; Applebot/0.1; +http://w… | Applebot | AS396982 Google LLC | Outside Applebot's published rangesThis User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 67 | 2026-07-18 | 2026-09-14 | ||||||
| Mozilla/5.0 (compatible; Applebot/0.1; +http://w… | Applebot | AS13335 Cloudflare, Inc. | Outside Applebot's published rangesThis User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 37 | 2026-07-11 | 2026-08-28 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | ClaudeBot | AS396982 Google LLC | Outside ClaudeBot's published rangesThis User-Agent claims ClaudeBot, but the connection's IP is outside the ranges ClaudeBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 27 | 2026-08-03 | 2026-09-15 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | Perplexity-User | AS396982 Google LLC | Outside Perplexity-User's published rangesThis User-Agent claims Perplexity-User, but the connection's IP is outside the ranges Perplexity-User publishes for its fetcher, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 26 | 2026-07-18 | 2026-09-15 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | GPTBot | AS396982 Google LLC | Outside GPTBot's published rangesThis User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 24 | 2026-08-03 | 2026-09-15 | ||||||
| Mozilla/5.0 (compatible; PerplexityBot/1.0; +htt… | PerplexityBot | AS396982 Google LLC | Outside PerplexityBot's published rangesThis User-Agent claims PerplexityBot, but the connection's IP is outside the ranges PerplexityBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 23 | 2026-08-03 | 2026-09-15 | ||||||
| Mozilla/5.0 (compatible; Amazonbot/0.1; +https:/… | Amazonbot | AS396982 Google LLC | Outside Amazonbot's published rangesThis User-Agent claims Amazonbot, but the connection's IP is outside the ranges Amazonbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 23 | 2026-07-18 | 2026-09-14 | ||||||
| Mozilla/5.0 (compatible; Perplexity-User/1.0; +h… | Perplexity-User | AS396982 Google LLC | Outside Perplexity-User's published rangesThis User-Agent claims Perplexity-User, but the connection's IP is outside the ranges Perplexity-User publishes for its fetcher, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 22 | 2026-08-25 | 2026-09-14 | ||||||
| Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +ht… | Amzn-SearchBot | AS396982 Google LLC | Outside Amzn-SearchBot's published rangesThis User-Agent claims Amzn-SearchBot, but the connection's IP is outside the ranges Amzn-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 19 | 2026-07-18 | 2026-09-14 | ||||||
| Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +htt… | OAI-SearchBot | AS396982 Google LLC | Outside OAI-SearchBot's published rangesThis User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 18 | 2026-08-03 | 2026-09-15 | ||||||
| Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudeb… | ClaudeBot | AS396982 Google LLC | Outside ClaudeBot's published rangesThis User-Agent claims ClaudeBot, but the connection's IP is outside the ranges ClaudeBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 15 | 2026-08-03 | 2026-09-15 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | Perplexity-User | AS396982 Google LLC | Outside Perplexity-User's published rangesThis User-Agent claims Perplexity-User, but the connection's IP is outside the ranges Perplexity-User publishes for its fetcher, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 15 | 2026-08-25 | 2026-09-14 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | Amazonbot | AS396982 Google LLC | Outside Amazonbot's published rangesThis User-Agent claims Amazonbot, but the connection's IP is outside the ranges Amazonbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 15 | 2026-08-25 | 2026-09-15 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | PerplexityBot | AS396982 Google LLC | Outside PerplexityBot's published rangesThis User-Agent claims PerplexityBot, but the connection's IP is outside the ranges PerplexityBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 14 | 2026-08-25 | 2026-09-15 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | OAI-SearchBot | AS396982 Google LLC | Outside OAI-SearchBot's published rangesThis User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 14 | 2026-08-25 | 2026-09-15 | ||||||
| Mozilla/5.0 (compatible; GPTBot/1.2; +https://op… | GPTBot | AS396982 Google LLC | Outside GPTBot's published rangesThis User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 13 | 2026-08-25 | 2026-09-14 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | Applebot | AS396982 Google LLC | Outside Applebot's published rangesThis User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 12 | 2026-08-25 | 2026-09-14 | ||||||
| Mozilla/5.0 (compatible; Googlebot/2.1; +http://… | Googlebot | AS13335 Cloudflare, Inc. | Outside Googlebot's published rangesThis User-Agent claims Googlebot, but the connection's IP is outside the ranges Googlebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 11 | 2026-07-11 | 2026-09-02 | ||||||
| Mozilla/5.0 (compatible; GPTBot/1.4; +https://op… | GPTBot | AS396982 Google LLC | Outside GPTBot's published rangesThis User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 10 | 2026-08-25 | 2026-09-15 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | Amzn-SearchBot | AS396982 Google LLC | Outside Amzn-SearchBot's published rangesThis User-Agent claims Amzn-SearchBot, but the connection's IP is outside the ranges Amzn-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 10 | 2026-08-25 | 2026-09-15 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | OAI-SearchBot | AS396982 Google LLC | Outside OAI-SearchBot's published rangesThis User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 10 | 2026-08-30 | 2026-09-14 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | GPTBot | AS396982 Google LLC | Outside GPTBot's published rangesThis User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 9 | 2026-08-25 | 2026-09-14 | ||||||
| Mozilla/5.0 (compatible; Applebot/0.1; +http://w… | Applebot | AS41608 NextGenWebs, S.L. | Outside Applebot's published rangesThis User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 9 | 2026-07-04 | 2026-09-12 | ||||||
| Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +htt… | OAI-SearchBot | AS41608 NextGenWebs, S.L. | Outside OAI-SearchBot's published rangesThis User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 8 | 2026-07-04 | 2026-09-12 | ||||||
| Mozilla/5.0 (compatible; DuckDuckBot/1.1; +http:… | DuckDuckBot | AS41608 NextGenWebs, S.L. | Outside DuckDuckBot's published rangesThis User-Agent claims DuckDuckBot, but the connection's IP is outside the ranges DuckDuckBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 8 | 2026-07-04 | 2026-09-12 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | ChatGPT-User | AS396982 Google LLC | Outside ChatGPT-User's published rangesThis User-Agent claims ChatGPT-User, but the connection's IP is outside the ranges ChatGPT-User publishes for its fetcher, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 8 | 2026-07-18 | 2026-08-13 | ||||||
| Mozilla/5.0 (compatible; bingbot/2.0; +http://ww… | Bingbot | AS41608 NextGenWebs, S.L. | Outside Bingbot's published rangesThis User-Agent claims Bingbot, but the connection's IP is outside the ranges Bingbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 8 | 2026-07-04 | 2026-09-12 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | GPTBot | AS41608 NextGenWebs, S.L. | Outside GPTBot's published rangesThis User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 8 | 2026-07-04 | 2026-09-12 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | ClaudeBot | AS396982 Google LLC | Outside ClaudeBot's published rangesThis User-Agent claims ClaudeBot, but the connection's IP is outside the ranges ClaudeBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 7 | 2026-08-28 | 2026-09-07 | ||||||
| Mozilla/5.0 (compatible; YandexBot/3.0; +http://… | YandexBot | AS41608 NextGenWebs, S.L. | Reverse DNS check failedThis User-Agent claims YandexBot. No usable published-range snapshot covered the claim at ingest, and the reverse-DNS check the operator documents completed without confirming it — no PTR record, no name in the operator's rDNS space, or a name that failed forward confirmation. With no operator-published channel vouching for the IP, this is an impersonation signal.
|
high | 7 | 2026-08-04 | 2026-09-12 | ||||||
| DuckAssistBot/1.1 (https://duckduckgo.com/duckas… | DuckAssistBot | AS396982 Google LLC | Outside DuckAssistBot's published rangesThis User-Agent claims DuckAssistBot, but the connection's IP is outside the ranges DuckAssistBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 7 | 2026-09-11 | 2026-09-15 | ||||||
| CCBot/2.0 (https://commoncrawl.org/faq/) | CCBot | AS41608 NextGenWebs, S.L. | Outside CCBot's published rangesThis User-Agent claims CCBot, but the connection's IP is outside the ranges CCBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 7 | 2026-07-04 | 2026-09-12 | ||||||
| Mozilla/5.0 (compatible; OAI-SearchBot/1.4; robo… | OAI-SearchBot | AS396982 Google LLC | Outside OAI-SearchBot's published rangesThis User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 7 | 2026-08-25 | 2026-09-14 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | PerplexityBot | AS396982 Google LLC | Outside PerplexityBot's published rangesThis User-Agent claims PerplexityBot, but the connection's IP is outside the ranges PerplexityBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 7 | 2026-07-18 | 2026-09-11 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | Applebot | AS396982 Google LLC | Outside Applebot's published rangesThis User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 7 | 2026-08-25 | 2026-09-14 | ||||||
| Mozilla/5.0 (compatible; Amazonbot/0.1; +https:/… | Amazonbot | AS36352 HostPapa | Outside Amazonbot's published rangesThis User-Agent claims Amazonbot, but the connection's IP is outside the ranges Amazonbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 7 | 2026-08-29 | 2026-08-29 | ||||||
| Mozilla/5.0 (compatible; Applebot/0.1; +http://w… | Applebot | AS36352 HostPapa | Outside Applebot's published rangesThis User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 6 | 2026-08-29 | 2026-08-29 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | GPTBot | AS36352 HostPapa | Outside GPTBot's published rangesThis User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 6 | 2026-08-29 | 2026-08-29 | ||||||
| Mozilla/5.0 (compatible; bingbot/2.0; +http://ww… | Bingbot | AS36352 HostPapa | Outside Bingbot's published rangesThis User-Agent claims Bingbot, but the connection's IP is outside the ranges Bingbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 6 | 2026-08-29 | 2026-08-29 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | GPTBot | AS396982 Google LLC | Outside GPTBot's published rangesThis User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 6 | 2026-08-29 | 2026-09-14 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | OAI-SearchBot | AS396982 Google LLC | Outside OAI-SearchBot's published rangesThis User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 6 | 2026-08-28 | 2026-09-15 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | OAI-SearchBot | AS396982 Google LLC | Outside OAI-SearchBot's published rangesThis User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 5 | 2026-09-13 | 2026-09-13 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | ChatGPT-User | AS13335 Cloudflare, Inc. | Outside ChatGPT-User's published rangesThis User-Agent claims ChatGPT-User, but the connection's IP is outside the ranges ChatGPT-User publishes for its fetcher, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 5 | 2026-07-31 | 2026-07-31 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | ChatGPT-User | AS396982 Google LLC | Outside ChatGPT-User's published rangesThis User-Agent claims ChatGPT-User, but the connection's IP is outside the ranges ChatGPT-User publishes for its fetcher, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 5 | 2026-08-03 | 2026-08-13 | ||||||
| Mozilla/5.0 (compatible; PerplexityBot/1.0; +htt… | PerplexityBot | AS399804 Hostodo | Outside PerplexityBot's published rangesThis User-Agent claims PerplexityBot, but the connection's IP is outside the ranges PerplexityBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 5 | 2026-07-07 | 2026-07-12 | ||||||
| Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +htt… | OAI-SearchBot | AS399804 Hostodo | Outside OAI-SearchBot's published rangesThis User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 5 | 2026-07-07 | 2026-07-12 | ||||||
| CCBot/2.0 (https://commoncrawl.org/faq/) | CCBot | AS396982 Google LLC | Outside CCBot's published rangesThis User-Agent claims CCBot, but the connection's IP is outside the ranges CCBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 5 | 2026-07-18 | 2026-09-13 | ||||||
| CCBot/2.0 (https://commoncrawl.org/faq/) | CCBot | AS399804 Hostodo | Outside CCBot's published rangesThis User-Agent claims CCBot, but the connection's IP is outside the ranges CCBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 5 | 2026-07-07 | 2026-07-12 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | Amzn-SearchBot | AS396982 Google LLC | Outside Amzn-SearchBot's published rangesThis User-Agent claims Amzn-SearchBot, but the connection's IP is outside the ranges Amzn-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 5 | 2026-08-28 | 2026-09-14 | ||||||
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck… | GPTBot | AS396982 Google LLC | Outside GPTBot's published rangesThis User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).
|
high | 5 | 2026-07-18 | 2026-09-13 |
showing 50 of 326 — view all →