googlemessages/20.2 facebookexternalhit/1.1 facebot twitterbot/1.0

[[TODO: MAP ONE SENTENCE SUMMARY]]

Category: [[TODO: MAP CATEGORY]] Avg 2.1 req/min Seen on 26 systems 291 observed requests 1 exact variants First seen August 3, 2026 Last seen October 18, 2026

[[TODO: MAP INTRODUCTION PARAGRAPH 1]]

[[TODO: MAP INTRODUCTION PARAGRAPH 2]]

What is googlemessages/20.2 facebookexternalhit/1.1 facebot twitterbot/1.0?

[[TODO: MAP DEFINITION SUMMARY]]

[[TODO: MAP SHORT REFERENCE SUMMARY]]

Analyst summary: [[TODO: MAP ANALYST REPORT SUMMARY]]
User-agent
googlemessages/20.2 facebookexternalhit/1.1 facebot twitterbot/1.0
Observed source IPs
0
Observed requests
291
Source networks
124
Exact variants
1
Latest hit count
83
Latest miss count
133
Latest 404 count
0
Unique paths
1
Related campaigns
[[TODO: MAP RELATED CAMPAIGN COUNT]]

Observed exact user-agent strings

googlemessages/20.2 facebookexternalhit/1.1 facebot twitterbot/1.0 First seen August 3, 2026 · Last seen October 18, 2026

Behavior profile

[[TODO: MAP BEHAVIOR PROFILE INTRO]]

Category
[[TODO: MAP CATEGORY]]
Average request rate
2.1 requests per minute
HTTP and HTTPS support
[[TODO: MAP HTTP HTTPS SUPPORT]]
HTTP version support
[[TODO: MAP PROTOCOL SUPPORT SUMMARY]]
Redirect behavior
[[TODO: MAP REDIRECT BEHAVIOR]]
Robots.txt behavior
[[TODO: MAP ROBOTS TXT BEHAVIOR]]
Crawl-rate behavior
[[TODO: MAP CRAWL RATE BEHAVIOR]]
JavaScript execution
[[TODO: MAP JAVASCRIPT SUPPORT]]
Form submission activity
[[TODO: MAP FORM SUBMISSION ACTIVITY]]
Malformed URL requests
[[TODO: MAP MALFORMED URL BEHAVIOR]]
HTTP/1.0: [[TODO: MAP HTTP 1.0 SUPPORT]] HTTP/1.1: [[TODO: MAP HTTP 1.1 SUPPORT]] HTTP/2: [[TODO: MAP HTTP 2 SUPPORT]] HTTP/3: [[TODO: MAP HTTP 3 SUPPORT]] [[TODO: MAP HEADER ORDER FINGERPRINTED]]

Source distribution

[[TODO: MAP SOURCE DISTRIBUTION INTRO]]

Top countries

Country Networks Site sightings Share
United States 88 92 82.5%
Denmark 4 4 5.2%
Poland 8 8 2.7%
United Kingdom 6 6 2.4%
Unknown 5 5 1.7%
Hungary 2 2 1.0%
Australia 2 2 1.0%
France 3 3 1.0%
Slovenia 2 2 0.7%
Romania 1 1 0.7%

Top ASNs

ASN Organization Networks Share
AS701 [[TODO: MAP ASN ORGANIZATION]] 17 18.6%
AS6167 [[TODO: MAP ASN ORGANIZATION]] 15 14.1%
AS21928 [[TODO: MAP ASN ORGANIZATION]] 14 13.7%
AS7018 [[TODO: MAP ASN ORGANIZATION]] 10 8.9%
AS7922 [[TODO: MAP ASN ORGANIZATION]] 6 8.2%
AS22773 [[TODO: MAP ASN ORGANIZATION]] 2 4.8%
AS3292 [[TODO: MAP ASN ORGANIZATION]] 2 3.1%
AS20115 [[TODO: MAP ASN ORGANIZATION]] 3 2.4%
AS11240 [[TODO: MAP ASN ORGANIZATION]] 2 1.4%
AS400164 [[TODO: MAP ASN ORGANIZATION]] 1 1.4%

Top datacenters

Provider Type Snapshots Share

Representative source IPs

[[TODO: MAP REPRESENTATIVE IPS INTRO]]

HTTP fingerprint and request characteristics

[[TODO: MAP HTTP FINGERPRINT INTRO]]

Observed header order
[[TODO: MAP HTTP HEADER ORDER SUMMARY]]
Common headers sent
[[TODO: MAP COMMON HEADERS SUMMARY]]
TLS and HTTPS behavior
[[TODO: MAP TLS HTTPS SUMMARY]]
URL normalization behavior
[[TODO: MAP URL NORMALIZATION SUMMARY]]
Malformed request patterns
[[TODO: MAP MALFORMED REQUEST SUMMARY]]
[[TODO: MAP OBSERVED HTTP HEADERS]]

Observed sample requests

[[TODO: MAP SAMPLE REQUESTS INTRO]]

GET
/
Status pattern: HTTP 200
Seen 1 times, Last seen September 19, 2026
GET
/
Status pattern: HTTP 403
Seen 2 times, Last seen August 30, 2026
GET
/contactus/
Status pattern: HTTP 200
Seen 1 times, Last seen August 10, 2026
POST
/wp-json/bitfire/v1/browser-verify?_fn=xhr&_bfa=4d287a256683914743012da4.z6vzkrpp9v_n.1786392000&per=0&_bfg=%5B%5D
Status pattern: HTTP 200
Seen 1 times, Last seen August 10, 2026
GET
/spine-pain/
Status pattern: HTTP 200
Seen 2 times, Last seen August 10, 2026
GET
/spine-pain/
Status pattern: HTTP 403
Seen 1 times, Last seen August 10, 2026
POST
/wp-json/pum/v1/analytics/?event=open&pid=271484&_cache=hex_value
Status pattern: HTTP 204
Seen 3 times, Last seen August 7, 2026
POST
/?wc-ajax=update_order_review&security=hex_value&payment_method=paypal&country=US&state=&postcode=&city=&address=&s_country=US&s_state=&s_postcode=&s_city=&s_address=&has_full_address=true&pos
Status pattern: HTTP 200
Seen 1 times, Last seen August 7, 2026
POST
/?wc-ajax=get_refreshed_fragments&time=hex_value
Status pattern: HTTP 200
Seen 1 times, Last seen August 7, 2026
GET
/cart/
Status pattern: HTTP 200
Seen 1 times, Last seen August 7, 2026
POST
/product/blaze-lte-pro-griddle/?quantity=1&add-to-cart=271180
Status pattern: HTTP 302
Seen 1 times, Last seen August 7, 2026
POST
/wp-json/bitfire/v1/browser-verify?_fn=xhr&_bfa=e4429c49949cc5e01cb039e7.m8nwr8izvva2.1786125600&per=0&_bfg=%5B%5D
Status pattern: HTTP 200
Seen 2 times, Last seen August 7, 2026

Related campaigns and associations

[[TODO: MAP RELATED CAMPAIGNS INTRO]]

[[TODO: MAP RELATED CAMPAIGN NAME]]

[[TODO: MAP RELATED CAMPAIGN SUMMARY]]
Related IPs: [[TODO: MAP RELATED CAMPAIGN IP COUNT]], Systems seen: [[TODO: MAP RELATED CAMPAIGN SYSTEMS SEEN]]
Confidence: [[TODO: MAP RELATED CAMPAIGN CONFIDENCE]]

Detailed analyst report

[[TODO: MAP ANALYST REPORT PARAGRAPH 1]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 2]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 3]]

Frequently asked questions about googlemessages/20.2 facebookexternalhit/1.1 facebot twitterbot/1.0

What is googlemessages/20.2 facebookexternalhit/1.1 facebot twitterbot/1.0?

[[TODO: MAP FAQ WHAT IS ANSWER]]

Is googlemessages/20.2 facebookexternalhit/1.1 facebot twitterbot/1.0 considered malicious?

[[TODO: MAP FAQ MALICIOUS ANSWER]]

Does googlemessages/20.2 facebookexternalhit/1.1 facebot twitterbot/1.0 respect robots.txt and crawl-rate controls?

[[TODO: MAP FAQ ROBOTS ANSWER]]

What infrastructure is commonly associated with googlemessages/20.2 facebookexternalhit/1.1 facebot twitterbot/1.0?

[[TODO: MAP FAQ INFRASTRUCTURE ANSWER]]