Costume party
70% of "browsers" were bots in costume.
Their TLS handshakes gave them away. 13,101 didn't finish the costume. 67,667 requests came from honest bots, led by Mozilla/5.0.
Edition of Friday, Oct 30, 2026 (UTC) · see the latest · updated every 24 hours
563,842
fake browsers
▲ +21% vs the day before
70%
of "browsers"
67,667
honest bots
▲ +75% vs the day before
Every edition: fake browsers
How we measure
A "browser" is a request whose user agent starts with Mozilla/5.0 and doesn't introduce itself as a bot. It's in costume when its TLS handshake (the JA4 fingerprint) isn't one a real Chrome, Edge, Firefox or Safari sends. Half a costume is a browser user agent that stops before naming any browser. Honest bots are user agents that say they're a bot, crawler or scanner, grouped by the name they give.
Best costumes
The user agents bots wore most, with a handshake no real browser sends.
| User agent | Requests | Addresses |
|---|---|---|
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 105,175 | 386 |
| Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 104,416 | 309 |
| Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 99,994 | 391 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0 | 31,388 | 593 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 | 25,620 | 351 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 | 23,700 | 4,653 |
| Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Safari/537.36 | 17,036 | 2,636 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 | 10,271 | 57 |
Honest bots
Bots that said who they were, including AI crawlers.
| Bot | Requests |
|---|---|
| Mozilla/5.0 | 5,612 |
| Googlebot | 5,322 |
| bingbot | 4,871 |
| TLM-Audit-Scanner/2.0 | 4,439 |
| facebookexternalhit | 3,668 |
| OAI-SearchBot | 2,559 |
| Applebot | 1,790 |
| ClaudeBot | 1,718 |
| Baiduspider | 1,693 |
| CensysInspect | 1,524 |
| Bytespider | 1,521 |
| ApcosysBot | 1,499 |
| Hello | 1,472 |
| Amazonbot | 1,446 |
| GPTBot | 1,328 |
Past editions
More from the edge
Bot Weather · Nov 11
20% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Nov 11
32,669 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Nov 11
Bots' most wanted file: /download.php
The files bots asked for most yesterday. It's usually your .env.
The AI Key Heist · Nov 11
Bots went hunting for AI keys 789 times.
Bots are hunting for AI API keys. Here's whose they want most.
Cloud Landlords · Nov 11
81% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Nov 11
New sites get scanned in 1,245 minutes.
How many minutes a brand-new website gets before the first scanner shows up.
Want these bots off your site?
Put your domains behind the NiceTryBot edge. You'll see every request, tag the scanners, and send them to the gym while real people get on with their day.
See how it works