This document contains all tags currently supported by Gatekeeper. To try it out, see our IP details demo.

Platforms

  • Google Cloud Platform (source): Visit originates from Google Cloud Platform. Visitor is likely to be a crawler.
  • IBM Cloud (source): Visit originages from IBM cloud. Visitor is likely to be a crawler.
  • Microsoft Azure (source): Visit originates from Microsoft Azure cloud. Visitor is likely to be a crawler.
  • Oracle Cloud (source): Visit originates from Oracle Cloud. Visitor is likely to be a crawler.

Search engine crawlers

  • Baiduspider (source): Visitor is verified Baiduspider crawler.
  • Bingbot (source): Visitor is verified Bingbot crawler.
  • Google crawler (source): Visitor is verified as one of Google's many crawlers.
  • Oracle Data Cloud Crawler (source): Visit is from Oracle's self-identified data crawler.
  • Yandex robot (source): Visitor is verified Yandex robot crawler.

General

  • abuse (source): Visitor has been flagged for spamming forums, registering fake accounts, polluting databases, etc.
  • Amazon Web Services (source): Visit originates from Amazon Web Services (AWS) cloud. Visitor is likely to be a crawler.
  • anonymizers (source): Visitor is hiding their true IP address using a proxy, VPN, Tor exit node, or other similar service.
  • attacks (source): Visting IP address has been recently used in some kind of attack, such as DDOS, brute force login attempts, unauthorized SSH, or other hacking attempt.
  • data center: Visit originates from an IP address controlled by a data center. While not necessarily malicious, these visitors are unlikely to be humans. Crawlers will often operate out of data centers since they provide a suitable environment (i.e., fast internet, stable power, etc.). See also data center and ISP. Our list of data centers and their associated IP address ranges is a work in progress. If you find an inaccuracy, please let us know.
  • data center and ISP: IP address of visit is controlled by an organization that provides both data center and ISP services. Some of the IP addresses will represent data centers and some might represent commercial or residential networks. These IP addresses are not included in data center. NOTE: this tag is subject to change.
  • desktop: Visit originates from a desktop device. This tag is based solely on the User-Agent header value and can be spoofed (e.g. a mobile browser might request content as if it were a desktop browser).
  • ISP: Visit originates from an IP address distributed by an Internet Service Provider (ISP). These IP addresses are often used for home or business internet connections. While many crawlers are run in data centers, some people will run crawlers from their workplace or home. Our list of ISPs and their associated IP address ranges is a work in progress. If you find an inaccuracy, please let us know.
  • malware (source): Visitor is associated with malware/ransomware distribution, fraud, and other illegal actvity.
  • mobile: Visit originates from a mobile device; generally a phone or tablet. This tag is based solely on the User-Agent header value and can be spoofed (e.g. a desktop browser might have an extension that allows the browser to pretend to be a mobile browser).
  • organizations (source): Visit originates from known bitcoin node or adserver.
  • self-identified bot: Visitor has self-identified as some kind of bot via the User-Agent header value. Some bots will try to disguise themselves as human visitors.
  • spam (source): Visitor has been flagged for recently sending spam emails, posting spam comments, or crawling for email addresses to send spam to.
  • unrouteable (source): Visitor is using an unregistered IP address. This generally indicates some sort of IP spoofing.