Detected automatically by identity_rotation · 2026-07-27 00:03:54 UTC

One address presented crawler identities belonging to 10 different companies

A single connecting address made 90 requests under 13 different crawler user agents, belonging to 10 separate companies, across 87 distinct paths. Crawlers operated by different companies do not share an address.

What was observed

Between 2026-07-26 22:09:10 and 2026-07-26 22:09:16 UTC — 6 seconds — one connecting address made 90 requests to 87 distinct paths, presenting 13 different crawler user agents.

Companies named: Google, OpenAI, Common Crawl, Microsoft, xAI, DeepSeek, Yandex, Baidu, Anthropic, Perplexity.

What it means

Each of these companies operates its crawler from its own network. One address presenting identities from 10 of them at once is not something their infrastructure produces — so at most one of these declarations can be accurate, and the rest are not.

7 of them can be checked against the operating company's own published list of crawler addresses, and this address is in none of those ranges: Googlebot, OAI-SearchBot, bingbot, ChatGPT-User, Google-CloudVertexBot, PerplexityBot, GPTBot. Checked against the lists as captured on 2026-07-26.

6 could not be checked at all, because the company operating them publishes no machine-readable list of its crawler addresses: CCBot, xAI-SearchBot, DeepSeekBot, YandexBot, Baiduspider, ClaudeBot. Nothing here counts against those declarations; they are simply unexamined.

What this does not establish: who sent the requests, what they were for, or whether one party or several arranged it. A request carries no field for intent, and this site does not infer one. The counts above are the entire finding.

Limits

• The address is what the CDN reported. It identifies a network endpoint for the duration of these requests, not a person or an organisation.
• A count of contradicted identities is not a count of attacks. It establishes that a declaration was unsupported by the operating company's own published list, and nothing beyond that.
• Published address lists change. Checked as captured on 2026-07-26; a company adding a range afterwards makes an older answer stale rather than wrong.
• An identity that could not be checked is not an identity found false. Several of these companies publish nothing to check against, and their absence from this count is theirs, not the client's.
• One domain, observed continuously. Nothing here generalises to how this client behaves elsewhere.

Evidence chain

This finding was not written from memory. Each figure below came from a query against the immutable request record, and each query is shown so it can be run again — by us, on this page, or by anyone reconstructing the same instrument.

What was measured

Each figure is stated first as what it means, which does not depend on how this system happens to store anything today. The query underneath it is implementation — it would be written differently on different storage, and it is shown so the figure can be checked, not because it is part of the claim.

SELECT COUNT(DISTINCT userAgent) FROM RequestReality
           WHERE siteId = ? AND cfConnectingIp = ? AND (userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ?)

SELECT COUNT(*) FROM RequestReality
           WHERE siteId = ? AND cfConnectingIp = ? AND (userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ?)

SELECT COUNT(DISTINCT path) FROM RequestReality
           WHERE siteId = ? AND cfConnectingIp = ? AND (userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ? OR userAgent LIKE ?)

Every figure still returns what it returned at publication.

Governed by

• I. Reality is not interpretation — Reality ≠ Interpretation
• IV. Replay guesses nothing — Every figure must be reproducible from the record

These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.

Other findings

• One address requested 28 distinct paths within 33 seconds
• One address requested 28 distinct paths within 29 seconds
• One address requested 28 distinct paths within 31 seconds
• One address requested 165 distinct paths within 17 seconds
• One address requested 31 distinct paths within 6 seconds

All findings · Live record · Methodology