AgentShield AI Defense

Written by a person from the record · 2026-07-28 12:03:12 UTC

Every request declaring an OpenAI identity was answered 200, and none has declared the browsing agent since 25 July

Eleven requests declaring one of three OpenAI identities are in this record, each corroborated against a dated snapshot of that vendor's published addresses, and every one was answered 200. None was refused, redirected or rate-limited. The CDN's event log for the last 24 hours contains a single block, of an address that appears nowhere in this record and is not on any OpenAI list. Requests declaring the browsing agent stop on 25 July and have not resumed, while an assistant asked repeatedly to open this address reported that it could not. Nothing measurable from this side accounts for that.

What was tested

An assistant given this domain directly did not open it. Everything below was run to find out whether the cause was here. Each of these is an action taken by the operator, not an observation of anyone else's behaviour, and none of it is offered as evidence of what any AI system does — only of what this server does when asked.

CheckedResult
DNS, apex and wwwA and AAAA records both answer
Response to a plain requestHTTP/2 200, no redirect
x-robots-tag headerAbsent
<meta name="robots">Absent
Canonical URLPoints at this origin
/robots.txtServes; refuses none of these agents
Home page requested under three declared identitiesAll 200; one distinct byte count between them
Search console: crawl, fetch, indexAllowed, successful, indexed
CDN security event log, 24 hoursOne block — see below

The three identities in the seventh row were sent from the operator's own address at 10:22 UTC on 28 July. They received the same page, byte for byte. That is the point of the row: nothing here varies its answer by who is asking.

The one block

The CDN recorded exactly one blocked request in twenty-four hours, at 03:10:46 UTC, from 192.241.139.***, by a managed rule.

The last octet is withheld and the rest is not, because the network is what the claim rests on: vendor crawler ranges are published as blocks, so 192.241.139.0/24 is enough for a reader to check the assertion below against any of them. The individual address adds nothing a reader could use and is not ours to publish.

That address is on no OpenAI address list in the snapshot this site checks against, and it appears zero times in this record — consistent with a request stopped before it reached the origin. Its neighbours in the same minutes were scanners: automated probes for /wp-admin/install.php and cloud addresses declaring a mobile browser.

This matters for one reason. A security event log records actions taken, not requests received; an allowed request leaves no row there. So an empty log would have proved nothing on its own. What closes the question is the pair — nothing refused at the edge, and nothing arrived at the origin — because those are two independent records that would fail in different ways.

What the record holds

All figures cover the record from its first entry to 11:30 UTC on 28 July, excluding one address that presented thirteen different identities and is therefore not evidence of any of them.

Declared identityRequestsCorroboratedAnswered other than 200
OAI-SearchBot7yes0
GPTBot2yes0
ChatGPT-User2yes0

Corroborated here means the connecting address falls inside a range published by that vendor, as captured in a dated snapshot held in this repository. The snapshot is never refreshed at detection time, so this check reproduces.

Both requests declaring ChatGPT-User arrived on 25 July, the second at 11:31:54.541 UTC. None has been recorded since — not on 26, 27 or 28 July, across the three days on which an assistant was asked to open this address.

Across all seven requests declaring OAI-SearchBot, one distinct path was requested: /robots.txt. The most recent was at 10:01:17 UTC on 28 July, ninety minutes before an assistant reported this site unreachable. The rules were read that morning. The pages were not.

The chain that closed

At 11:09:39 UTC a client requested /robots.txt, and 1.15 seconds later the home page, receiving 28,597 bytes. The home page prints a running count of external requests, and the record holds exactly 999 before that fetch — so the page delivered to that client said 999, because a page cannot count the request that is fetching it.

Minutes later an assistant's summary of this site quoted 999.

Three links, each checkable against the other two: a request in the record, a figure on the page that request received, and the same figure in a model's output, with the off-by-one explained rather than explained away.

Separately, at 10:43:09.980 and 10:43:10.705 UTC, two requests declaring Google-InspectionTool were answered with 28,562 bytes each. The search console reported its inspection at the same second.

What it means

Reachability and retrieval are different properties, and only one of them is controllable from a server.

Every question that can be answered from this side has been answered the same way: the site responds, to everyone, identically, with no refusal at any layer, and the vendor whose assistant reported it unreachable has infrastructure that reached it — corroborated — on the same morning. What did not happen is that a request was made by the part of that system which reads pages on a user's behalf.

A cause that produces no request produces no evidence, anywhere the operator can look. That is not a gap in this measurement; it is the boundary of what server-side measurement can see, and knowing exactly where that boundary sits is worth more than a guess about what lies past it.

What this does not establish

Why no request arrived is not known, and no cause is claimed. Of the three readings this site listed before the CDN log was read, one is now eliminated:

Limits

Why this was worth recording

"My site does not appear in AI answers" is the question a site owner actually asks, and the usual advice — check robots.txt, check your headers, check indexing — assumes the answer is on the owner's side. Here it was not, and it took nine checks and two independent logs to establish that with something better than an opinion.

The useful output is not a fix. It is a boundary: everything inside it was measured and cleared, and what remains is outside any instrument an operator controls. Most diagnoses stop before drawing that line and leave the owner changing things that were never wrong.

Evidence chain

This finding was not written from memory. Each figure below came from a query against the immutable request record, and each query is shown so it can be run again — by us, on this page, or by anyone reconstructing the same instrument.

StageWhat it produced
1. RealityRequests recorded by the server as they arrived, written once and never edited.
2. EvidenceThe rule human_analysis selected the observations that bear on this question and emitted each figure with the means of reproducing it.
3. StatementA fixed template turned that evidence into the prose above. No language model was involved and no figure was altered.
4. VerificationEvery figure was recomputed against the record. A single mismatch would have discarded the draft.
5. Publication2026-07-28 12:03:12 UTC, after a person wrote and reviewed it.

What was measured

Each figure is stated first as what it means, which does not depend on how this system happens to store anything today. The query underneath it is implementation — it would be written differently on different storage, and it is shown so the figure can be checked, not because it is part of the claim.

Evidence

External requests recorded from first observation to 11:30 UTC on 28 July

At publication: 913 · recomputed now: 913 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(*) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND cfConnectingIp <> '45.45.237.206' AND observedAt < '2026-07-28T11:30'

Evidence

Requests declaring ChatGPT-User in the whole record

At publication: 2 · recomputed now: 2 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(*) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND cfConnectingIp <> '45.45.237.206' AND observedAt < '2026-07-28T11:30' AND userAgent LIKE '%ChatGPT-User%'

Evidence

Requests declaring ChatGPT-User on 26, 27 or 28 July

At publication: 0 · recomputed now: 0 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(*) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND cfConnectingIp <> '45.45.237.206' AND observedAt < '2026-07-28T11:30' AND userAgent LIKE '%ChatGPT-User%' AND observedAt >= '2026-07-26'

Evidence

Requests declaring GPTBot in the whole record

At publication: 2 · recomputed now: 2 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(*) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND cfConnectingIp <> '45.45.237.206' AND observedAt < '2026-07-28T11:30' AND userAgent LIKE '%GPTBot%'

Evidence

Requests declaring OAI-SearchBot in the whole record

At publication: 7 · recomputed now: 7 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(*) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND cfConnectingIp <> '45.45.237.206' AND observedAt < '2026-07-28T11:30' AND userAgent LIKE '%OAI-SearchBot%'

Evidence

Requests declaring an OpenAI identity that were answered with a status other than 200

At publication: 0 · recomputed now: 0 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(*) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND cfConnectingIp <> '45.45.237.206' AND observedAt < '2026-07-28T11:30' AND responseStatus <> 200
      AND (userAgent LIKE '%ChatGPT-User%' OR userAgent LIKE '%GPTBot%' OR userAgent LIKE '%OAI-SearchBot%')

Evidence

Requests declaring OAI-SearchBot on 28 July

At publication: 1 · recomputed now: 1 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(*) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND cfConnectingIp <> '45.45.237.206' AND observedAt < '2026-07-28T11:30' AND userAgent LIKE '%OAI-SearchBot%' AND observedAt >= '2026-07-28'

Evidence

Distinct paths requested by clients declaring OAI-SearchBot

At publication: 1 · recomputed now: 1 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(DISTINCT path) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND cfConnectingIp <> '45.45.237.206' AND observedAt < '2026-07-28T11:30' AND userAgent LIKE '%OAI-SearchBot%'

Evidence

External requests recorded before the home-page fetch at 11:09:40.382 UTC

At publication: 999 · recomputed now: 999 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(*) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND observedAtMs < 1785236980382

Evidence

Bytes the home page delivered to that client

At publication: 28597 · recomputed now: 28597 unchanged

Implementation — how this is computed on today's storage

SELECT responseBytes AS n FROM RequestReality WHERE observedAtMs = 1785236980382

Evidence

Requests declaring Google-InspectionTool on 28 July

At publication: 2 · recomputed now: 2 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(*) AS n FROM RequestReality WHERE 
  cfRay IS NOT NULL
  AND cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%'
  AND cfConnectingIp NOT IN (
    SELECT cfConnectingIp FROM RequestReality
    WHERE cfConnectingIp IS NOT NULL AND (userAgent LIKE 'curl%' OR userAgent LIKE 'Wget%' OR userAgent LIKE 'Python-urllib%' OR userAgent LIKE '%python-requests%' OR userAgent LIKE 'Go-http-client%' OR userAgent LIKE 'node-fetch%')) AND cfConnectingIp <> '45.45.237.206' AND observedAt < '2026-07-28T11:30' AND userAgent LIKE '%InspectionTool%' AND observedAt >= '2026-07-28'

Evidence

Distinct byte counts served for the home page to the three identities tested at 10:22 UTC

At publication: 1 · recomputed now: 1 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(DISTINCT responseBytes) AS n FROM RequestReality
     WHERE observedAt >= '2026-07-28T10:22:16' AND observedAt < '2026-07-28T10:22:18' AND path = '/'

Every figure still returns what it returned at publication.

Governed by

These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.

Other findings

All findings · Live record · Methodology

Reality marker for this page: asd-zepeleri-pagovo-5e6b8d · published 2026-07-28 12:03:12 UTC

This string is coined and appears nowhere else. If it later surfaces in a language model's output, that is observed evidence this page was ingested. What this is.