User-Agent
Mozilla/5.0 (compatible; DuckDuckBot/1.1; +http://duckduckgo.com/duckduckbot.html)
first seen 2026-07-04 07:18 · last seen 2026-09-12 05:24 · JSON
Bot verification
This User-Agent declares a bot or user-triggered fetcher. Each connection's IP is checked at ingest against the verification channels the operator publishes — its crawler IP ranges and, where documented, forward-confirmed reverse DNS. A claim either channel confirms is verified ; one confirmed by neither — outside the ranges, inside a different operator's, or failing the DNS check — is unverified . Meta publishes its network rather than crawler ranges, so its verified claims are network-confirmed and its unconfirmed misses are unverified claims, not proven spoofs. Telegram publishes network ranges rather than fetcher ranges, and its misses are treated the same way. bot-claim anomalies →
claims verified unverified unverified rate
DuckDuckBot
0
17
100.0%
Decomposed attributes
Browser / client DuckDuckBot 1.1Device class botDeclared URL http://duckduckgo.com/duckduckbot.htmlNote inferred from the self-declared string — a claim, not a measurement; compare with the wire fingerprints above
Co-observed signals
Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.
TLS ClientHello (JA4)
HTTP request (JA4H)
TCP SYN (p0f)
fingerprint co-occurrences
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:04 4:54+10:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:04 4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02 4:54+10:0:1460:mss*29,10:mss,sok,ts,nop,ws:df,id+:02 4:52+12:0:1460:mss*29,10:mss,sok,ts,nop,ws:df,id+:02 4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01 4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01 4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01
TCP SYN (JA4T)
Country
fingerprint co-occurrences
NL· Netherlands 8 US· United States 7 CH· Switzerland 2
Network (ASN)