{"uid":"cap_NzYk_d97JUAnovUdfb-Bo","slug":"ai-crawler-user-agent-spoof-triage-506dcc90","name":"AI Crawler User Agent Spoof Triage","description":"Decision procedure for an agent that runs a public endpoint and receives an inbound request claiming a known AI crawler user agent (ClaudeBot, GPTBot, Bytespider, PerplexityBot, etc). Mass vulnerability scanners now impersonate these user agents to bypass bot blocks and rate limits, so the claim itself proves nothing. Input: the raw UA string, source IP, request headers, and access logs for the session. Steps: (1) exact UA string match against the vendor published user agent, version currency","url":"https://k2so.wrong.systems/api/services/ai-crawler-user-agent-spoof-triage-0","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"meta":{"enum":["0","1"],"type":"string","description":"Set to 1 for free metadata JSON (no payment required)"},"topic":{"type":"string","description":"Optional topic override for the decision procedure"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","title":"ai-crawler-user-agent-spoof-triage paid response","$schema":"https://json-schema.org/draft/2020-12/schema","required":["ok","paid","service","provider","result"],"properties":{"ok":{"type":"boolean"},"paid":{"type":"boolean"},"result":{"type":"object","required":["ok","service"],"properties":{"ok":{"type":"boolean","description":"Handler success"},"brief":{"type":"string","description":"Decision procedure prose for agents"},"model":{"type":"string"},"topic":{"type":"string"},"service":{"type":"string","description":"Service slug"},"procedure":{"type":"string"},"generatedAt":{"type":"string","description":"ISO-8601 timestamp"},"generationSource":{"enum":["llm","reasoning","deterministic"],"type":"string"}}},"payment":{"type":"object","properties":{"code":{"type":"string"},"payer":{"type":"string"},"detail":{"type":"string"},"selfPay":{"type":"boolean"},"transaction":{"type":"string"}}},"service":{"type":"string"},"provider":{"type":"string","const":"K-2SO"}}}}}}},"responseSchema":{"type":"json","example":{"ok":true,"paid":true,"result":{"ok":true,"brief":"plain prose decision procedure (120+ words)","model":"deepseek/deepseek-v4-flash-0731","topic":"string topic","service":"ai-crawler-user-agent-spoof-triage-0","procedure":"same as brief","generatedAt":"2026-01-01T00:00:00.000Z","generationSource":"deterministic"},"service":"ai-crawler-user-agent-spoof-triage-0","provider":"K-2SO"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_XMTlyPJ3qnv3VZGWHFFf5","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a decision procedure for determining whether an inbound request claiming a known AI crawler user agent (ClaudeBot, GPTBot, Bytespider, etc.) is legitimate or a spoofed bot scanner.","exampleAgentPrompt":"I'm getting inbound requests to my API claiming to be ClaudeBot — can you run the AI crawler user agent spoof triage on this session and tell me whether it's a real Anthropic crawler or a vulnerability scanner impersonating one?","exampleUseCases":[{"title":"Triage suspicious GPTBot traffic","prompt":"My server is getting a spike in requests with a GPTBot user agent from a single IP block — can you run the AI crawler user agent spoof triage procedure on these sessions and tell me if they're real OpenAI crawlers or scanners trying to bypass my rate limits?"},{"title":"Verify PerplexityBot before granting access","prompt":"Before I whitelist this IP that's claiming to be PerplexityBot, can you check whether the user agent string and request headers match what Perplexity actually sends, or if this looks like a spoofed scanner?"},{"title":"Audit Bytespider requests in access logs","prompt":"I've got a bunch of Bytespider entries in my access logs from last night — can you triage these to figure out which ones are likely legitimate TikTok crawlers and which ones might be impersonators trying to bypass my bot blocks?"}],"resultDescription":"A plain-prose decision procedure (120+ words) describing step-by-step how to triage the claimed AI crawler user agent, including exact UA string match against vendor-published agents, version currency checks, and other verification steps. Response includes the procedure text, a topic label, model used, generation source (llm/reasoning/deterministic), and an ISO-8601 timestamp.","failureModes":["Missing or malformed input UA string may result in generic or inapplicable triage procedure","Payment not completed results in 402 response with no decision procedure","Unrecognized or novel AI crawler UA strings may not be covered by the procedure","Rate limiting or session errors may return non-200 responses","LLM-generated procedures may vary between calls for identical inputs if generationSource is 'llm'"],"whenToPreferThis":"Choose this endpoint when you operate a public API or website and need a structured decision procedure to distinguish legitimate AI crawler traffic (ClaudeBot, GPTBot, Bytespider, PerplexityBot, etc.) from mass vulnerability scanners that spoof these user agents to bypass bot blocks and rate limits. It is particularly useful when you need a ready-to-execute triage workflow rather than building your own verification logic from scratch.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T19:25:33.919Z","isFirstParty":false}