Detected automatically by distributed_crawl · 2026-07-27 00:02:09 UTC

One user agent, 29 addresses, 20 paths — a retrieval spread thin enough to look like nothing

A single user agent string arrived from 29 distinct addresses in 2 countries over 44 hours. 28 of those addresses sent exactly one request. Between them they fetched 20 distinct paths.

What was observed

Between 2026-07-25 18:47:25 and 2026-07-27 14:44:34 UTC:

Declared agent	`Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)`
How many different addresses	29
How many of those addresses sent exactly one fetch	28 (97%)
How many different paths were fetched	20
How many countries those addresses resolved to	2
How many fetches in total	33

What it means

Every request here is unremarkable on its own. One address, one page, an ordinary browser string — nothing that any rate limit or per-address rule would react to. The pattern only exists when the requests are grouped by what they claimed to be rather than where they came from.

This is the blind spot in the other rule on this site. Automated enumeration groups by address and asks which client took many paths quickly; a retrieval arranged one request per address is precisely what that question cannot see. The two rules fail in opposite directions, and neither is a substitute for the other.

What the counts establish is coverage without concentration: a large share of this site's pages was fetched, and almost no address fetched more than one of them. What they do not establish is that one party arranged it. That inference is the obvious one, and it is still an inference.

Limits

The declared user agent is unverified. Any client can send any string, so this describes a claim rather than a confirmed identity.
Shared user agent strings are not evidence of a shared operator. A common mobile browser behind carrier NAT can produce many addresses sending one request each, from unrelated people, with no coordination at all.
Country is Cloudflare's geolocation of the connecting address. It describes where the address resolves, not where the client or its operator is.
The thresholds — how many addresses, how few requests each — are chosen parameters. A retrieval spread more thinly still falls below them and is not reported.
One domain, observed continuously. Nothing here generalises to how this client behaves elsewhere.

Evidence chain

This finding was not written from memory. Each figure below came from a query against the immutable request record, and each query is shown so it can be run again — by us, on this page, or by anyone reconstructing the same instrument.

Stage	What it produced
1. Reality	Requests recorded by the server as they arrived, written once and never edited.
2. Evidence	The rule `distributed_crawl` selected the observations that bear on this question and emitted each figure with the means of reproducing it.
3. Statement	A fixed template turned that evidence into the prose above. No language model was involved and no figure was altered.
4. Verification	Every figure was recomputed against the record. A single mismatch would have discarded the draft.
5. Publication	2026-07-27 00:02:09 UTC, after review by a person.

What was measured

Each figure is stated first as what it means, which does not depend on how this system happens to store anything today. The query underneath it is implementation — it would be written differently on different storage, and it is shown so the figure can be checked, not because it is part of the claim.

Evidence

distinct addresses presenting this exact user agent

At publication: 29 · recomputed now: 51 window still open

Implementation — how this is computed on today's storage

SELECT COUNT(DISTINCT cfConnectingIp) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND userAgent IS NOT NULL
    AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  ) AND userAgent = ?

Evidence

distinct paths fetched by them in aggregate

At publication: 20 · recomputed now: 29 window still open

Implementation — how this is computed on today's storage

SELECT COUNT(DISTINCT path) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND userAgent IS NOT NULL
    AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  ) AND userAgent = ?

Evidence

addresses that sent exactly one request

At publication: 28 · recomputed now: 48 window still open

Implementation — how this is computed on today's storage

SELECT COUNT(*) FROM (
             SELECT cfConnectingIp FROM RequestReality
             WHERE siteId = ? AND cfRay IS NOT NULL AND userAgent IS NOT NULL
    AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  ) AND userAgent = ?
             GROUP BY cfConnectingIp HAVING COUNT(*) = 1)

Evidence

distinct countries these addresses resolved to

At publication: 2 · recomputed now: 2 unchanged

Implementation — how this is computed on today's storage

SELECT COUNT(DISTINCT cfIpCountry) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND userAgent IS NOT NULL
    AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  ) AND userAgent = ?

3 figures have moved since publication. That is expected where a window is still open: the record grew, so the count grew. It means the sentence has aged, not that it was wrong. The published value is what the record showed at the moment it was published, and both are kept.

Governed by

I. Reality is not interpretation — Reality ≠ Interpretation
III. No layer validates itself — No layer validates itself with its own output
VI. The record is honest about its size — Sample size is stated; absence is reported as absence
VII. Observation is not surveillance — The unit of observation is a request, not a person

These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.

Other findings

All findings · Live record · Methodology