Detected automatically by arrival_host · 2026-07-26 07:32:12 UTC
Machines are fetching this site through a second hostname of ours that we never published
Our server answers to two names. Everything this site publishes — robots.txt, the sitemap, llms.txt, the feed, every canonical tag — uses agentshieldaidefense.com and never www.agentshieldaidefense.com. Even so, 159 fetches arrived asking for www.agentshieldaidefense.com, 91 of them from machines that do not share our own browser language settings. They did not learn that name from us.
What was observed
Between 2026-07-25 10:44:54 and 2026-07-27 01:30:13 UTC. Both hostnames return 200 for every path and carry a canonical tag pointing at agentshieldaidefense.com; there is no redirect between them.
| Hostname | How many fetches |
|---|---|
agentshieldaidefense.com (canonical) | 435 |
www.agentshieldaidefense.com | 159 |
| How many fetches asked for www.agentshieldaidefense.com | 159 |
|---|---|
| How many of those came from a machine that does not share our browser language settings | 91 |
| How many fetches by a declared AI crawler asked for agentshieldaidefense.com | 59 |
| How many of those we caused ourselves, by asking a vendor to read a page | 4 |
| How many fetches by a declared AI crawler asked for any other hostname | 1 |
What it means
Every surface this site publishes is generated from a single origin and names agentshieldaidefense.com only. A client working from robots.txt, the sitemap, llms.txt, the feed or a canonical tag could not have learned any other name here. So the 91 requests above arrived carrying a name they got from somewhere else: DNS, a certificate transparency log, a scraped list, or a source we cannot see.
That is the part worth recording. The mirror-image figure — declared AI crawlers on the canonical name — is not evidence of anything, because the canonical name is the only one they could have been given. This finding first led on that figure, which was pointing it at its own control group.
4 of the 59 AI-crawler requests were caused by us, arriving inside windows in which we had asked a vendor to read a page here. That leaves 55 unprompted — too few to describe crawler behaviour, and stated here so the larger number is not read as one.
The two hostnames are deliberately still in place. A redirect is the ordinary advice and was the first thing considered; measuring first showed that no figure published here is computed per hostname, so nothing was being corrupted, and that a redirect would have made every future arrival identical and destroyed exactly the signal above. Duplicate content is already handled by canonical tags on both names.
Limits
- The declared user agent is unverified. Any client can send any string, so this describes a claim rather than a confirmed identity.
- Sample size. 55 unprompted AI-crawler requests, and 91 on the unpublished hostname, most of them one distributed retrieval. This describes what arrived here; it is not a result about crawlers in general.
- The language-profile subtraction is a narrowing, not an exclusion: those requests remain in every published total, and are described on the lab page. It is used here only so a claim about clients finding an unadvertised name does not rest on our own phone.
- Hostname is the Host header as received. It records the name a client asked for, not how it learned it. Every explanation offered above is an inference; the route is recorded nowhere.
- Absence of a redirect is a choice this project made, and it shapes what can be seen here. A site that redirects would produce none of these figures.
- One domain, observed continuously. Nothing here generalises to how this client behaves elsewhere.
Evidence chain
This finding was not written from memory. Each figure below came from a query against the immutable request record, and each query is shown so it can be run again — by us, on this page, or by anyone reconstructing the same instrument.
| Stage | What it produced |
|---|---|
| 1. Reality | Requests recorded by the server as they arrived, written once and never edited. |
| 2. Evidence | The rule arrival_host selected the observations that bear on this question and emitted each figure with the means of reproducing it. |
| 3. Statement | A fixed template turned that evidence into the prose above. No language model was involved and no figure was altered. |
| 4. Verification | Every figure was recomputed against the record. A single mismatch would have discarded the draft. |
| 5. Publication | 2026-07-26 07:32:12 UTC, after review by a person. |
What was measured
Each figure is stated first as what it means, which does not depend on how this system happens to store anything today. The query underneath it is implementation — it would be written differently on different storage, and it is shown so the figure can be checked, not because it is part of the claim.
Evidence
hostnames that served external traffic
At publication: 2 · recomputed now: 5 window still open
Implementation — how this is computed on today's storage
SELECT COUNT(DISTINCT host) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND host IS NOT NULL
AND
cfConnectingIp IS NOT NULL
AND cfConnectingIp NOT LIKE '192.0.2.%'
AND cfConnectingIp NOT LIKE '198.51.100.%'
AND cfConnectingIp NOT LIKE '203.0.113.%'
AND cfConnectingIp NOT LIKE '10.%'
AND cfConnectingIp NOT LIKE '192.168.%'
AND cfConnectingIp NOT LIKE '127.%'
AND cfConnectingIp NOT LIKE '::1'
AND cfConnectingIp NOT LIKE 'fc%'
AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND
NOT EXISTS (
SELECT 1 FROM RequestReality c
WHERE c.siteId = RequestReality.siteId
AND c.cfConnectingIp = RequestReality.cfConnectingIp
AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
)Evidence
external requests on the hostname we never publish
At publication: 159 · recomputed now: 379 window still open
Implementation — how this is computed on today's storage
SELECT COUNT(*) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND host IS NOT NULL
AND
cfConnectingIp IS NOT NULL
AND cfConnectingIp NOT LIKE '192.0.2.%'
AND cfConnectingIp NOT LIKE '198.51.100.%'
AND cfConnectingIp NOT LIKE '203.0.113.%'
AND cfConnectingIp NOT LIKE '10.%'
AND cfConnectingIp NOT LIKE '192.168.%'
AND cfConnectingIp NOT LIKE '127.%'
AND cfConnectingIp NOT LIKE '::1'
AND cfConnectingIp NOT LIKE 'fc%'
AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND
NOT EXISTS (
SELECT 1 FROM RequestReality c
WHERE c.siteId = RequestReality.siteId
AND c.cfConnectingIp = RequestReality.cfConnectingIp
AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
) AND host <> ?Evidence
the same requests, excluding clients sharing our own browser language profile
At publication: 91 · recomputed now: 252 window still open
Implementation — how this is computed on today's storage
SELECT COUNT(*) FROM RequestReality
WHERE siteId = ? AND cfRay IS NOT NULL AND host IS NOT NULL
AND
cfConnectingIp IS NOT NULL
AND cfConnectingIp NOT LIKE '192.0.2.%'
AND cfConnectingIp NOT LIKE '198.51.100.%'
AND cfConnectingIp NOT LIKE '203.0.113.%'
AND cfConnectingIp NOT LIKE '10.%'
AND cfConnectingIp NOT LIKE '192.168.%'
AND cfConnectingIp NOT LIKE '127.%'
AND cfConnectingIp NOT LIKE '::1'
AND cfConnectingIp NOT LIKE 'fc%'
AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND
NOT EXISTS (
SELECT 1 FROM RequestReality c
WHERE c.siteId = RequestReality.siteId
AND c.cfConnectingIp = RequestReality.cfConnectingIp
AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
) AND host <> ? AND NOT (
acceptLanguage IS NOT NULL AND acceptLanguage <> '' AND acceptLanguage IN (
SELECT DISTINCT acceptLanguage FROM RequestReality
WHERE acceptLanguage IS NOT NULL AND acceptLanguage <> ''
AND NOT (cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%')))Evidence
requests declaring a known AI agent, on agentshieldaidefense.com
At publication: 59 · recomputed now: 215 window still open
Implementation — how this is computed on today's storage
SELECT COUNT(*) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND host IS NOT NULL
AND
cfConnectingIp IS NOT NULL
AND cfConnectingIp NOT LIKE '192.0.2.%'
AND cfConnectingIp NOT LIKE '198.51.100.%'
AND cfConnectingIp NOT LIKE '203.0.113.%'
AND cfConnectingIp NOT LIKE '10.%'
AND cfConnectingIp NOT LIKE '192.168.%'
AND cfConnectingIp NOT LIKE '127.%'
AND cfConnectingIp NOT LIKE '::1'
AND cfConnectingIp NOT LIKE 'fc%'
AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND
NOT EXISTS (
SELECT 1 FROM RequestReality c
WHERE c.siteId = RequestReality.siteId
AND c.cfConnectingIp = RequestReality.cfConnectingIp
AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
) AND host = ? AND (userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ?)Evidence
requests declaring a known AI agent, on any other hostname
At publication: 1 · recomputed now: 3 window still open
Implementation — how this is computed on today's storage
SELECT COUNT(*) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND host IS NOT NULL
AND
cfConnectingIp IS NOT NULL
AND cfConnectingIp NOT LIKE '192.0.2.%'
AND cfConnectingIp NOT LIKE '198.51.100.%'
AND cfConnectingIp NOT LIKE '203.0.113.%'
AND cfConnectingIp NOT LIKE '10.%'
AND cfConnectingIp NOT LIKE '192.168.%'
AND cfConnectingIp NOT LIKE '127.%'
AND cfConnectingIp NOT LIKE '::1'
AND cfConnectingIp NOT LIKE 'fc%'
AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND
NOT EXISTS (
SELECT 1 FROM RequestReality c
WHERE c.siteId = RequestReality.siteId
AND c.cfConnectingIp = RequestReality.cfConnectingIp
AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
) AND host <> ? AND (userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ?)5 figures have moved since publication. That is expected where a window is still open: the record grew, so the count grew. It means the sentence has aged, not that it was wrong. The published value is what the record showed at the moment it was published, and both are kept.
Governed by
- I. Reality is not interpretation — Reality ≠ Interpretation
- IV. Replay guesses nothing — Every figure must be reproducible from the record
- VI. The record is honest about its size — Sample size is stated; absence is reported as absence
These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.