ZOOBOTA reserve of bots in the wild
Connecting…We observe, we do not attack
Observations / 24 h—
Look like browsers—
Recognised agents—
Requests to the trap—
Perimeter scans—
SSH attempts / 24 h—

Reserve map

…Do not feed the scanner — watch its route.
The Zoobot reserve: savanna, AI enclosure, pet zoo, SEO swamp, wild pit and trap. Uninvited guests knock on the gate from outside.
404 PERIMETERLooking for doors that do not exist
FIELD NOTES
AREA
LEGEND

How to read the map and the numbers

Marker
A client that visited the site in the last 24 hours. A newcomer walks the path to its habitat and settles there; a faded one has not visited for a long time (over 30 minutes); a flash means a brand-new request. The flag above it is the country by IP address. After a page refresh everyone stays where they are.
You and guests
The yellow “You” icon is you. Click a filter, a habitat sign or a spot on the map and it walks there. The blue ones are other visitors on the site right now. Click a guest to see their country, browser and where they are heading; there are no IPs or names.
Browser ✓
“Looks like Chrome” means the client only claimed to be a browser. “Browser Chrome ✓” means this page really ran in it and opened a live connection; scanners that pose as browsers do not do that.
Numbers
The number of events in the last 24 hours, not of people or unique bots. One bot can make dozens of requests.
SSH attempts
Failed logins to the server over SSH. Addresses and usernames are not shown — only the count.
Search
Search crawlers: Google, Bing, DuckDuckGo.
AI bots
Crawlers of AI companies: GPTBot, ClaudeBot, Perplexity.
SEO
SEO crawlers: Ahrefs, Semrush.
Friendly
Link previews in messengers: Telegram, Slack, Discord.
Wild tools
Tools without a disguise: curl, python, scripts.
Trapped
Those who went where robots.txt asks bots not to go.
404 scanners
Scanners that look for other people’s vulnerabilities: /.env, /wp-login.php, /.git.
Brute force
Series of failed logins from one address — password guessing.