User-Agent

Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)

first seen 2026-06-20 17:49 · last seen 2026-10-20 01:37 · JSON

Bot verification

This User-Agent declares a bot or user-triggered fetcher. Each connection's IP is checked at ingest against the verification channels the operator publishes — its crawler IP ranges and, where documented, forward-confirmed reverse DNS. A claim either channel confirms is verified; one confirmed by neither — outside the ranges, inside a different operator's, or failing the DNS check — is unverified. Meta publishes its network rather than crawler ranges, so its verified claims are network-confirmed and its unconfirmed misses are unverified claims, not proven spoofs. Telegram publishes network ranges rather than fetcher ranges, and its misses are treated the same way. bot-claim anomalies →

claims	verified	unverified	unverified rate
YandexBot	35	15	30.0%

Distinct clients per day (last 30 days, peak 13/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Browser / client	`YandexBot 3.0`
Device class	`bot`
Declared URL	`http://yandex.com/bots`
Note	`inferred from the self-declared string — a claim, not a measurement; compare with the wire fingerprints above`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d3112h1_e8f1e7e78f70_8d633dac7124` Match?Exact match in Thumbprint's published controlled catalog captures: curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.	184
`t13d3112h2_e8f1e7e78f70_8d633dac7124` Match?Exact match in Thumbprint's published controlled catalog captures: curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.	171
`t13d1011h1_61a7ad8aa9b6_3a8073edd8ef`	21
`t13d131000_f57a46bbacb6_e7c285222651` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.23.12.The fingerprint page shows the full measured match list. More on the catalog.	2
`t13d141000_cbb2034c60b8_e7c285222651` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.22.12.The fingerprint page shows the full measured match list. More on the catalog.	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nn060000_3e7ded867bc2_000000000000_000000000000`	155
`ge20nn040000_b221e026a664_000000000000_000000000000`	140
`ge20nn050000_95d177640a65_000000000000_000000000000`	24
`ge11nn050000_eb4e96aa336f_000000000000_000000000000`	21
`ge11nr040000_8b1ed2202073_000000000000_000000000000`	11
`ge11nn040000_8b1ed2202073_000000000000_000000000000`	10
`ge11nn060000_1bf4bdaf3068_000000000000_000000000000`	8
`ge20nn040000_31537f9be9e0_000000000000_000000000000`	7
`ge11nn030000_cd680697de12_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.5, powershell 7.6.4, +11 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`ge11nr030000_cd680697de12_000000000000_000000000000`	1

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`3:100;4:65536;2:0\|1048510465\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +8 more.The fingerprint page shows the full measured match list. More on the catalog.	171

TCP SYN (p0f)

fingerprint	co-occurrences
`4:45+19:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::0`	69
`4:41+23:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::0`	38
`4:40+24:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::0`	34
`4:39+25:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::0`	23
`4:44+20:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::0`	23
`4:43+21:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::0`	21
`4:45+19:0:1410:mss*30,8:mss,sok,ts,nop,ws,?254::0`	20
`4:37+27:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::0`	16
`4:41+23:0:1410:mss*30,8:mss,sok,ts,nop,ws,?254::0`	15
`4:47+17:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop:ecn:0`	14

TCP SYN (JA4T)

fingerprint	co-occurrences
`42300_2-4-8-1-3-34-1-1_1410_8`	247
`42300_2-4-8-1-3-254_1410_8`	55
`64240_2-4-8-1-3_1460_7`	18
`42340_2-4-8-1-3_1460_10`	4
`64620_2-4-8-1-3_1436_7`	2

Country

fingerprint	co-occurrences
`RU` · Russia	299
`TR` · Turkey	39
`KZ` · Kazakhstan	17
`US` · United States	13
`NL` · Netherlands	9
`CH` · Switzerland	2

Network (ASN)

fingerprint	co-occurrences
`AS13238` · YANDEX LLC	299
`AS212066` · Buyuk Reklam Cozumleri LLC	39
`AS207304` · Y. Izdeu men Jarnama LLP	17
`AS41608` · NextGenWebs, S.L.	9
`AS36352` · HostPapa	6
`AS399804` · Hostodo	4
`AS53667` · FranTech Solutions	2
`AS400529` · Infraly, LLC	2
`AS46475` · Limestone Networks, Inc.	1

TLS supported groups

fingerprint	co-occurrences
`001d,0017,001e,0019,0018`	11