PetalBot

What this client asked www.pathwren.workers.dev for, when, and what it got. Every number below is from this host's own server-side request log, 2026-09-08 22:41:30Z to 2026-09-09 02:55:28Z UTC.

Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (HTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)
Mozilla/5.0 (compatible;PetalBot;+https://webmaster.petalsearch.com/site/petalbot)
Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)

742 request(s) from 150 distinct address(es), 742 distinct path(s), first seen 2026-09-08 22:41:30Z, last seen 2026-09-09 02:55:28Z UTC. 2 separate visit(s), counting a gap of more than 30 minutes as a new one, median 218.5 minutes between them.

It describes itself, inside its own user-agent, as PetalBot. That is the client's own words, quoted; this page makes no claim about what it is for.

The crawler catalogue on this site has a record for it: /crawler/petalbot.html — what it is for, and what blocking it costs. This page is only what it did here.

The user-agent strings, exactly as they arrived

What it asked for, in the order it asked

First request to each path, oldest first, first 40 shown.

Everything it asked for

682 further paths are in the JSON.

What it asked for that did not exist

Nothing. Every path it asked for existed at the time it asked.

What it got, and what it sent

Status codes

200×742

Accept headers

text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8, text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Bytes served

9168157

Attributed to a channel

none — it arrived at a plain path

Our instrument classed it

crawler×742 — that is our classifier's label from the user-agent, not the operator's, and it has been wrong before.

How to verify it is really them

reverse DNS

From the crawler record at /crawler/petalbot.html, which cites https://aspiegel.com/petalbot — one source for both pages.

Ask this page a question, with one GET

A question about this page, answered by a call you can make right now — no key, no account, no JSON-RPC, nothing to assemble. The query string is already filled in with this page's own subject.

curl -s 'https://www.pathwren.workers.dev/tools/classify-ua?ua=Mozilla%2F5.0%20%28Linux%3B%20Android%207.0%3B%29%20AppleWebKit%2F537.36%20%28HTML%2C%20like%20Gecko%29%20Mobile%20Safari%2F537.36%20%28compatible%3B%20PetalBot%3B%2Bhttps%3A%2F%2Fwebmaster.petalsearch.com%2Fsite%2Fpetalbot%29&s=client-dossiers'

• /tools/classify-ua?ua=Mozilla%2F5.0%20%28Linux%3B%20Android%207.0%3B%29%20AppleWebKit%2F537.36%20%28HTML%2C%20like%20Gecko%29%20Mobile%20Safari%2F537.36%20%28compatible%3B%20PetalBot%3B%2Bhttps%3A%2F%2Fwebmaster.petalsearch.com%2Fsite%2Fpetalbot%29
  What is Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit…? This exact user-agent run through the catalogue: which crawler it is, who operates it, what the crawl is for, what blocking it costs — or an honest "not recognised" if it is nobody we know.

Every parameter above is a value the endpoint reads, not an address it visits: nothing is fetched on your behalf. Called without any parameter, each endpoint returns its own specification instead of an error. All of them.

What it publishes about you afterwards

Not observed. We have not seen this client publish a grade, a listing or a record about this host anywhere, and we make no claim that it does or does not.

Its own documentation

It names https://webmaster.petalsearch.com/site/petalbot in its own user-agent. That is the operator's own claim about itself; we neither endorse nor verify what is on it.

This page as data

curl -s https://www.pathwren.workers.dev/bot/petalbot.json
curl -s https://www.pathwren.workers.dev/data/observed-clients.json   # every client, one request

JSON · markdown · all clients seen here · index as JSON · check a crawler yourself, no key

Method, and what this page will not say

Rows come from a server-side log written before anything is served, so clients that run no JavaScript are counted exactly like browsers. The window is the whole life of the log, 2026-09-08 22:41:30Z to 2026-09-09 02:55:28Z UTC, and it is stated on every number because a count without a window is not a fact. Addresses are stored as salted hashes and counted, never printed. Our own checks send X-Self: 1 and are excluded, together with every request the analyst flagged as one of our own agents reaching for a URL through a model provider's fetch tool (the numbers are on the index). Nothing here is a claim about intent: where this page does not know something it says not observed.