New actors

A user agent is a name the caller chooses, and names can be borrowed or invented. A name that first appears late in the window is worth a look.

When each user agent first appeared

The vertical axis counts total requests on a log scale. The horizontal axis is the day the string first appears. Points at the right edge arrived inside the last three days of the window.

Two clouds matter. The dense low band on the right is the rotator, with thousands of near-identical Chrome strings that each appear once or twice. The high points on the left are the named crawlers and their per-string volumes.

Arrivals in the last three days

Sorted by volume. A req/addr near 1 across many addresses is the fleet signature. A value above about 5 with few addresses is one client that reads the repositories.

The second fleet in the browser class

The largest browser-class user agents by address count. These strings carry real Chrome build numbers, one request per address, and a dozen different versions at once.

A real browser reports one version for weeks. These strings carry build numbers that pass any plausibility test, from 134.0.6998.45 to 125.0.6422.60, while the address counts still read as a fleet.

A name is not identity. The rotator changes its user agent every few thousand requests, so a new actor on this page means a new string. These tables show each string rather than a summary, because the shared prefix is the signal.