Costume party
95% of "browsers" were bots in costume.
Their TLS handshakes gave them away. 16,672 didn't finish the costume. 3,706 requests came from honest bots, led by ClaudeBot.
Thursday, Oct 8, 2026 (UTC)
27,099
fake browsers
▲ +14,238% vs the day before
95%
of "browsers"
3,706
honest bots
▲ +1,144% vs the day before
Every edition: fake browsers
How I measure
A "browser" is a request whose user agent starts with Mozilla/5.0 and doesn't introduce itself as a bot. It's in costume when its TLS handshake (the JA4 fingerprint) isn't one a real Chrome, Edge, Firefox or Safari sends. Half a costume is a browser user agent that stops before naming any browser. Honest bots are user agents that say they're a bot, crawler or scanner, grouped by the name they give.
Best costumes
The user agents bots wore most, with a handshake no real browser sends.
| User agent | Requests | Addresses |
|---|---|---|
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 16,446 | 979 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 2,311 | 29 |
| Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 1,728 | 15 |
| Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 1,713 | 16 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 | 1,477 | 1 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 | 353 | 1 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 | 287 | 3 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0 | 220 | 15 |
Honest bots
Bots that said who they were, including AI crawlers.
| Bot | Requests |
|---|---|
| ClaudeBot | 3,160 |
| Reflectionbot | 130 |
| Googlebot | 65 |
| CensysInspect | 55 |
| AgentTrustBot | 18 |
| Mozilla/5.0 | 17 |
| bingbot | 17 |
| PerplexityBot | 13 |
| YouBot | 12 |
| Amazonbot | 12 |
| CCBot | 12 |
| ChatGLM-Spider | 12 |
| perplexitybot | 12 |
| Claude-SearchBot | 12 |
| Bravebot | 11 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 8
77% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 8
29,885 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Oct 8
Bots' most wanted file: /.env
The files bots asked for most yesterday. It's usually your .env.
The AI Key Heist · Oct 8
Bots went hunting for AI keys 847 times.
Bots are hunting for AI API keys. Here's whose they want most.
Cloud Landlords · Oct 8
89% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 8
New sites get scanned in 171 minutes.
How many minutes a brand-new website gets before the first scanner shows up.