{"uid":"cap__GMetp7EQ8Jc3rRqDxLk5","slug":"spoofed-ai-crawler-traffic-response-playbook-2b851795","name":"Spoofed AI Crawler Traffic Response Playbook","description":"Decision procedure for a site operator who has already confirmed that inbound AI-crawler traffic is spoofed (user agent claims ClaudeBot, GPTBot, or similar but fails verification). Inputs: confirmed spoof evidence from triage (UA claims, TLS fingerprints, IP ranges, request timing), current rate limits, robots.txt policy, honeypot URL set. Steps: 1. Preserve evidence first: capture full request headers, TLS JA3/JA4 if available, IP and ASN ranges, timing deltas, and log excerpts with SHA-256","url":"https://k2so.wrong.systems/api/services/spoofed-ai-crawler-traffic-response-playbook-wha?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"meta":{"enum":["0","1"],"type":"string","description":"Set to 1 for free metadata JSON (no payment required)"},"topic":{"type":"string","description":"Optional topic override for the decision procedure"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","title":"spoofed AI crawler traffic response playbook paid response","$schema":"https://json-schema.org/draft/2020-12/schema","required":["ok","paid","service","provider","result"],"properties":{"ok":{"type":"boolean"},"paid":{"type":"boolean"},"result":{"type":"object","required":["ok","service"],"properties":{"ok":{"type":"boolean","description":"Handler success"},"brief":{"type":"string","description":"Decision procedure prose for agents"},"model":{"type":"string"},"topic":{"type":"string"},"service":{"type":"string","description":"Service slug"},"procedure":{"type":"string"},"generatedAt":{"type":"string","description":"ISO-8601 timestamp"},"generationSource":{"enum":["llm","reasoning","deterministic"],"type":"string"}}},"payment":{"type":"object","properties":{"code":{"type":"string"},"payer":{"type":"string"},"detail":{"type":"string"},"selfPay":{"type":"boolean"},"transaction":{"type":"string"}}},"service":{"type":"string"},"provider":{"type":"string","const":"K-2SO"}}}}}}},"responseSchema":{"type":"json","example":{"ok":true,"paid":true,"result":{"ok":true,"brief":"plain prose decision procedure (120+ words)","model":"deepseek/deepseek-v4-flash-0731","topic":"string topic","service":"spoofed-ai-crawler-traffic-response-playbook-wha","procedure":"same as brief","generatedAt":"2026-01-01T00:00:00.000Z","generationSource":"deterministic"},"service":"spoofed-ai-crawler-traffic-response-playbook-wha","provider":"K-2SO"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_CDzhnJsLUmzKmszeQ5Bxg","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a step-by-step decision procedure for site operators who have confirmed inbound AI-crawler traffic is spoofed, covering evidence preservation, rate limiting, robots.txt, and honeypot strategies.","exampleAgentPrompt":"We've confirmed that some traffic claiming to be ClaudeBot is failing IP and TLS verification — give me the full decision procedure for how to respond, preserve evidence, and lock things down.","exampleUseCases":[{"title":"Blocking spoofed GPTBot impersonators","prompt":"My logs show requests with a GPTBot user agent but the IP ranges don't match OpenAI's published list and the TLS fingerprints look off — walk me through exactly what to do next to respond and preserve evidence."},{"title":"Honeypot and rate-limit tuning after confirmed spoof","prompt":"We've already confirmed spoofed ClaudeBot traffic via JA4 fingerprinting and ASN mismatch — what's the decision procedure for adjusting our rate limits, updating robots.txt, and deploying honeypot URLs to catch future attempts?"},{"title":"Incident response documentation for spoofed crawler audit","prompt":"I need a documented step-by-step response playbook for our security team covering what to capture — headers, timing deltas, SHA-256 log hashes — when we confirm AI crawler spoofing, so we have an audit trail."}],"resultDescription":"A plain-prose decision procedure (120+ words) outlining ordered steps for responding to confirmed AI-crawler spoofing, including evidence capture (headers, TLS JA3/JA4, IP/ASN, timing deltas, SHA-256 log hashes), rate-limit adjustments, robots.txt policy updates, honeypot deployment, and escalation guidance. Response includes the procedure text, a topic label, generation source, ISO-8601 timestamp, and provider metadata.","failureModes":["Missing or malformed required query parameters may return an error or default procedure","Payment verification failure (x402) results in no paid response being returned","LLM generation may occasionally produce generic rather than scenario-specific guidance","Rate limiting on the provider side may return HTTP 429 if called too frequently","If topic override is unsupported, defaults to the standard spoofed-crawler procedure"],"whenToPreferThis":"Choose this endpoint when you need an immediately actionable, agent-consumable decision procedure specifically for confirmed AI-crawler spoofing scenarios — not general bot detection or WAF rule tuning. It is particularly useful when you already have evidence (UA claims, TLS mismatches, IP anomalies) and need a structured response workflow rather than raw threat intelligence.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T04:27:45.625Z","isFirstParty":false,"canonicalSlug":"spoofed-ai-crawler-traffic-response-playbook-2b851795"}