WebMTR Scanner — Bot Documentation

• DNS resolution and network-path measurement (traceroute/MTR) to the target host.
• TLS handshake inspection (certificate validity, protocol).
• HTTP header fetch of the scanned URL, including its own redirect chain.
• Performance timing of the page fetch.
• One rendered-page screenshot of the scanned URL.
• Optional interception checks from our own lab infrastructure against the single scanned URL.
• Exposure-surface detection (e.g. common admin paths) — detection only: the agent checks whether a login page is served and never attempts authentication, brute force, or form submission.

• It is not a crawler. It never follows links beyond the scanned URL's own redirect chain and never discovers new URLs from page content.
• Never extracts, stores, or republishes page content.
• Never maintains sessions or cookies between scans; never submits forms or logs in.
• Never scans a target more than once per quiet window (typically ≥ 24 hours) regardless of demand.
• Skips heavy stages automatically when a target serves a WAF/challenge block page, and flags the report accordingly.

• Egress origins: three engines, each with published, reverse-resolvable IPs:

• Every engine IP carries matching forward and reverse DNS (the PTR resolves to the scans.aidentech.com hostname, and that hostname resolves back to the same IP — FCrDNS-consistent).
• Machine-readable list: https://aidentech.com/ips.json — the same origins, IPs, PTR hostnames, and UA patterns in JSON for automated verification.
• Request rate: a handful of requests per scan, always to the single scanned URL.

Prefix patterns for rule matching:

• WebMTR/1.0* — all WebMTR-tokened diagnostics traffic
• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/* — declared browser-class render stages
• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/* — performance measurement stage

All requests are additionally signed per the Web Bot Auth drafts (section below) — the signature, not the User-Agent, carries the verified identity.

The agent cryptographically signs its requests per the Web Bot Auth working-group drafts (draft-ietf-webbotauth-httpsig-protocol, alg="ed25519", tag="web-bot-auth"). Verifiers can validate signatures against our public key directory:

https://aidentech.com/.well-known/http-message-signatures-directory

• Key type: Ed25519 (OKP), single active key, RFC 8037 thumbprint key id published in the directory.
• Rotation policy: on rotation the directory is updated and the old key is removed the same day; key id changes with each rotation.
• Every request the agent emits is signed, from all engine origins.

• Allowlisting: on Cloudflare, signed requests can be verified via Bot Management (verified-bot / custom firewall rules on the signing identity). The User-Agent above works for simple rate-limit exceptions.
• Blocking or rate-limiting: the agent honors HTTP 403/429 responses by flagging the affected stages; repeated blocks disable heavy stages for that target automatically.
• Opt-out or questions: email info@aidentech.com — include the target hostname. We respond to operator requests promptly.