mozilla/5.0 applewebkit/537.36 (khtml, like gecko) chrome/123.0.6312.86 safari/537.36 bitsightbot/1.0

[[TODO: MAP ONE SENTENCE SUMMARY]]

Category: [[TODO: MAP CATEGORY]] Avg 3.8 req/min Seen on 98 systems 927 observed requests 2 exact variants First seen August 4, 2026 Last seen October 19, 2026

[[TODO: MAP INTRODUCTION PARAGRAPH 1]]

[[TODO: MAP INTRODUCTION PARAGRAPH 2]]

What is mozilla/5.0 applewebkit/537.36 (khtml, like gecko) chrome/123.0.6312.86 safari/537.36 bitsightbot/1.0?

[[TODO: MAP DEFINITION SUMMARY]]

[[TODO: MAP SHORT REFERENCE SUMMARY]]

Analyst summary: [[TODO: MAP ANALYST REPORT SUMMARY]]
User-agent
mozilla/5.0 applewebkit/537.36 (khtml, like gecko) chrome/123.0.6312.86 safari/537.36 bitsightbot/1.0
Observed source IPs
0
Observed requests
927
Source networks
6
Exact variants
2
Latest hit count
1,292
Latest miss count
116
Latest 404 count
0
Unique paths
27
Related campaigns
[[TODO: MAP RELATED CAMPAIGN COUNT]]

Observed exact user-agent strings

mozilla/5.0 applewebkit/537.36 (khtml, like gecko) chrome/123.0.6312.86 safari/537.36 bitsightbot/1.0 First seen August 4, 2026 · Last seen October 19, 2026
mozilla applewebkit khtml like gecko chrome safari bitsightbot First seen August 10, 2026 · Last seen September 29, 2026

Behavior profile

[[TODO: MAP BEHAVIOR PROFILE INTRO]]

Category
[[TODO: MAP CATEGORY]]
Average request rate
3.8 requests per minute
HTTP and HTTPS support
[[TODO: MAP HTTP HTTPS SUPPORT]]
HTTP version support
[[TODO: MAP PROTOCOL SUPPORT SUMMARY]]
Redirect behavior
[[TODO: MAP REDIRECT BEHAVIOR]]
Robots.txt behavior
[[TODO: MAP ROBOTS TXT BEHAVIOR]]
Crawl-rate behavior
[[TODO: MAP CRAWL RATE BEHAVIOR]]
JavaScript execution
[[TODO: MAP JAVASCRIPT SUPPORT]]
Form submission activity
[[TODO: MAP FORM SUBMISSION ACTIVITY]]
Malformed URL requests
[[TODO: MAP MALFORMED URL BEHAVIOR]]
HTTP/1.0: [[TODO: MAP HTTP 1.0 SUPPORT]] HTTP/1.1: [[TODO: MAP HTTP 1.1 SUPPORT]] HTTP/2: [[TODO: MAP HTTP 2 SUPPORT]] HTTP/3: [[TODO: MAP HTTP 3 SUPPORT]] [[TODO: MAP HEADER ORDER FINGERPRINTED]]

Source distribution

[[TODO: MAP SOURCE DISTRIBUTION INTRO]]

Top countries

Country Networks Site sightings Share
Portugal 2 89 99.0%
United States 4 4 1.0%

Top ASNs

ASN Organization Networks Share
AS14618 [[TODO: MAP ASN ORGANIZATION]] 2 99.0%
AS13335 [[TODO: MAP ASN ORGANIZATION]] 4 1.0%

Top datacenters

Provider Type Snapshots Share

Representative source IPs

[[TODO: MAP REPRESENTATIVE IPS INTRO]]

HTTP fingerprint and request characteristics

[[TODO: MAP HTTP FINGERPRINT INTRO]]

Observed header order
[[TODO: MAP HTTP HEADER ORDER SUMMARY]]
Common headers sent
[[TODO: MAP COMMON HEADERS SUMMARY]]
TLS and HTTPS behavior
[[TODO: MAP TLS HTTPS SUMMARY]]
URL normalization behavior
[[TODO: MAP URL NORMALIZATION SUMMARY]]
Malformed request patterns
[[TODO: MAP MALFORMED REQUEST SUMMARY]]
[[TODO: MAP OBSERVED HTTP HEADERS]]

Observed sample requests

[[TODO: MAP SAMPLE REQUESTS INTRO]]

POST
/wp-json/bitfire/v1/browser-verify?_fn=xhr&_bfa=v1.b1a94ab4394ab03fb76e2ba78ccee28e21642aebddd3c61a40618c9558802f5b.0682d6b4162303a38dab116963293347.1791713324&per=0&_bfg=%7B%22doing_wp_cron%2
Status pattern: HTTP 403
Seen 1 times, Last seen October 11, 2026
POST
/wp-json/bitfire/v1/browser-verify?_fn=challenge
Status pattern: HTTP 403
Seen 1 times, Last seen October 11, 2026
GET
/robots.txt
Status pattern: HTTP 200
Seen 11 times, Last seen October 11, 2026
GET
/wp-login.php
Status pattern: HTTP 403
Seen 5 times, Last seen October 10, 2026
GET
/wp-admin.php
Status pattern: HTTP 404
Seen 10 times, Last seen October 10, 2026
GET
/
Status pattern: HTTP 200
Seen 16 times, Last seen October 10, 2026
GET
/
Status pattern: HTTP 301
Seen 11 times, Last seen October 10, 2026
GET
/robots.txt
Status pattern: HTTP 403
Seen 12 times, Last seen September 19, 2026
POST
/wp-json/bitfire/v1/browser-verify?_fn=xhr&_bfa=96b4a188180d265ad39432e7.fnkbaegwixrv.1789833600&per=0&_bfg=%5B%5D
Status pattern: HTTP 200
Seen 1 times, Last seen September 19, 2026
POST
/wp-admin/admin-ajax.php?wp_statistics_hit=1&source_type=home&source_id=13&search_query=&signature=hex_value&action=wp_statistics_hit_record&referred=&page_uri=Lw%3D%3D
Status pattern: HTTP 200
Seen 2 times, Last seen September 8, 2026
GET
/?966bc6=ec9c17ac3f.js&ver=14.16.10
Status pattern: HTTP 200
Seen 2 times, Last seen September 8, 2026
GET
/wp-content/uploads/stock-ticker-custom.css
Status pattern: HTTP 404
Seen 24 times, Last seen August 20, 2026

Related campaigns and associations

[[TODO: MAP RELATED CAMPAIGNS INTRO]]

[[TODO: MAP RELATED CAMPAIGN NAME]]

[[TODO: MAP RELATED CAMPAIGN SUMMARY]]
Related IPs: [[TODO: MAP RELATED CAMPAIGN IP COUNT]], Systems seen: [[TODO: MAP RELATED CAMPAIGN SYSTEMS SEEN]]
Confidence: [[TODO: MAP RELATED CAMPAIGN CONFIDENCE]]

Detailed analyst report

[[TODO: MAP ANALYST REPORT PARAGRAPH 1]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 2]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 3]]

Frequently asked questions about mozilla/5.0 applewebkit/537.36 (khtml, like gecko) chrome/123.0.6312.86 safari/537.36 bitsightbot/1.0

What is mozilla/5.0 applewebkit/537.36 (khtml, like gecko) chrome/123.0.6312.86 safari/537.36 bitsightbot/1.0?

[[TODO: MAP FAQ WHAT IS ANSWER]]

Is mozilla/5.0 applewebkit/537.36 (khtml, like gecko) chrome/123.0.6312.86 safari/537.36 bitsightbot/1.0 considered malicious?

[[TODO: MAP FAQ MALICIOUS ANSWER]]

Does mozilla/5.0 applewebkit/537.36 (khtml, like gecko) chrome/123.0.6312.86 safari/537.36 bitsightbot/1.0 respect robots.txt and crawl-rate controls?

[[TODO: MAP FAQ ROBOTS ANSWER]]

What infrastructure is commonly associated with mozilla/5.0 applewebkit/537.36 (khtml, like gecko) chrome/123.0.6312.86 safari/537.36 bitsightbot/1.0?

[[TODO: MAP FAQ INFRASTRUCTURE ANSWER]]