SYSTEM LOGS
Technical analysis, security research, and network utility documentation.
Access Level: Public
Replay Attacks: Why a Valid Signature Is Not a Fresh Request
A valid signature proves who signed a request, not that it is new. How replay attacks work, how a nonce and expiry stop them, and what a site must check.
AI Crawler Verification: Is That Really ChatGPT in Your Logs?
A User-Agent proves nothing. How to tell real GPTBot, ChatGPT-User, ClaudeBot and PerplexityBot from fake AI bots: IP lists, reverse DNS and signatures.
Agent Verifier: See Your Signed Request the Way a Server Sees It
A signature either verifies or it does not, and nobody says which part broke. The Agent Verifier names the exact fault in a Web Bot Auth setup and the fix.
Web Bot Auth: How the Web Started Checking an Agent's ID
For thirty years a bot was whoever it claimed to be. Web Bot Auth replaces that promise with an Ed25519 signature. How the protocol works and what it proves.
One scan shows what your connection and browser give away.
Privacy & Trust Index →