Costume party
89% of "browsers" were bots in costume.
Their TLS handshakes gave them away. 276,863 didn't finish the costume. 47,505 requests came from honest bots, led by Mozilla/5.0.
Sunday, Oct 18, 2026 (UTC) · see the latest
749,614
fake browsers
▲ +3.5% vs the day before
89%
of "browsers"
47,505
honest bots
▼ -33% vs the day before
Every edition: fake browsers
How I measure
A "browser" is a request whose user agent starts with Mozilla/5.0 and doesn't introduce itself as a bot. It's in costume when its TLS handshake (the JA4 fingerprint) isn't one a real Chrome, Edge, Firefox or Safari sends. Half a costume is a browser user agent that stops before naming any browser. Honest bots are user agents that say they're a bot, crawler or scanner, grouped by the name they give.
Best costumes
The user agents bots wore most, with a handshake no real browser sends.
| User agent | Requests | Addresses |
|---|---|---|
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | 269,958 | 777 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 140,609 | 348 |
| Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 123,818 | 327 |
| Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 115,257 | 329 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 | 11,508 | 70 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | 9,769 | 373 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 | 5,476 | 28 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 | 4,075 | 21 |
Honest bots
Bots that said who they were, including AI crawlers.
| Bot | Requests |
|---|---|
| Mozilla/5.0 | 5,058 |
| Bytespider | 3,169 |
| Hello | 3,126 |
| OAI-SearchBot | 2,856 |
| Googlebot | 2,400 |
| bingbot | 2,266 |
| Reflectionbot | 1,329 |
| l9scan | 1,178 |
| Amazonbot | 1,140 |
| Applebot | 1,131 |
| GPTBot | 1,110 |
| visionheight.com/scan | 1,057 |
| Baiduspider | 1,030 |
| facebookexternalhit | 926 |
| ClaudeBot | 909 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 27
48% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 27
457,316 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Oct 27
Bots' most wanted file: /.env
The files bots asked for most yesterday. It's usually your .env.
The AI Key Heist · Oct 27
Bots went hunting for AI keys 3,362 times.
Bots are hunting for AI API keys. Here's whose they want most.
Cloud Landlords · Oct 27
88% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 27
New sites get scanned in under a minute.
How many minutes a brand-new website gets before the first scanner shows up.