Mr. Nice Try Notes from the edge

Costume party

75% of "browsers" were bots in costume.

Their TLS handshakes gave them away. 18,253 didn't finish the costume. 107,007 requests came from honest bots, led by Googlebot.

Wednesday, Oct 21, 2026 (UTC) · see the latest

Share on X Download the GIF
Costume Party: 75% of "browsers" were bots in costume.

705,990

fake browsers

▼ -26% vs the day before

75%

of "browsers"

107,007

honest bots

▲ +71% vs the day before

Name tags honest bots
Googlebot 18,161
Mozilla/5.0 9,294
OAI-SearchBot 5,651
Bytespider 4,532
bingbot 3,942
↳ The handshake doesn't lie.

Every edition: fake browsers

Oct 7 Oct 21

How I measure

A "browser" is a request whose user agent starts with Mozilla/5.0 and doesn't introduce itself as a bot. It's in costume when its TLS handshake (the JA4 fingerprint) isn't one a real Chrome, Edge, Firefox or Safari sends. Half a costume is a browser user agent that stops before naming any browser. Honest bots are user agents that say they're a bot, crawler or scanner, grouped by the name they give.

Best costumes

The user agents bots wore most, with a handshake no real browser sends.

User agent Requests Addresses
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 209,528 754
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 162,516 343
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 162,030 403
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 13,174 59
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 12,807 45
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0 12,656 47
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 12,631 44
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 12,418 45

Honest bots

Bots that said who they were, including AI crawlers.

Bot Requests
Googlebot 18,161
Mozilla/5.0 9,294
OAI-SearchBot 5,651
Bytespider 4,532
bingbot 3,942
ClaudeBot 2,793
Applebot 2,759
GPTBot 2,389
l9scan 2,388
AmazonSelectionExplorerBot 2,385
BrightEdge 2,167
TLM-Audit-Scanner/2.0 2,151
Baiduspider 2,130
facebookexternalhit 1,923
Amazonbot 1,906

Past editions

Oct 27 Oct 26 Oct 25 Oct 24 Oct 23 Oct 22 Oct 21 Oct 20 Oct 19 Oct 18 Oct 17 Oct 16 Oct 15 Oct 14 Oct 13 Oct 12 Oct 11 Oct 10 Oct 9 Oct 8 Oct 7

A new one every morning.

Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.

More from yesterday

Bot Weather: 48% of yesterday's traffic was scanners.

Bot Weather · Oct 27

48% of yesterday's traffic was scanners.

How much of yesterday's web traffic was scanners, as a weather report.

 Fraud Desk: 457,316 requests got turned away at the door.

Fraud Desk · Oct 27

457,316 requests got turned away at the door.

Login stuffing, failed logins, and who got turned away at the door.

 Most Wanted: Bots' most wanted file: /.env

Most Wanted · Oct 27

Bots' most wanted file: /.env

The files bots asked for most yesterday. It's usually your .env.

 The AI Key Heist: Bots went hunting for AI keys 3,362 times.

The AI Key Heist · Oct 27

Bots went hunting for AI keys 3,362 times.

Bots are hunting for AI API keys. Here's whose they want most.

 Cloud Landlords: 88% of scanning came from rented servers.

Cloud Landlords · Oct 27

88% of scanning came from rented servers.

Scanners don't own servers. They rent them. Here are the landlords.

 Speedrun: New sites get scanned in under a minute.

Speedrun · Oct 27

New sites get scanned in under a minute.

How many minutes a brand-new website gets before the first scanner shows up.