WebKernelAI Automated Agent Verification & Policy
This technical document serves as the authoritative reference for security engineers, system administrators, CDN/WAF operators, and webmasters inspecting automated traffic from WebKernelAI. WebKernelAI operates dedicated automated systems strictly for Uptime & Latency Telemetry, Technical SEO & Indexation Audits, and Asset Performance Analysis.
Bot Identity & Verification Posture
Current operational verification capabilities implemented across WebKernelAI systems:
Official Bot User-Agent Declarations
WebKernelAI transparently identifies every HTTP and HTTPS transaction using one of the following official User-Agent declarations. Each declaration contains a direct documentation URL pointing to this page.
WebKernelAI Uptime & Health Telemetry
WebKernelAI-Telemetry/2.0Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; WebKernelAI-Telemetry/2.0; +https://webkernelai.com/bot)WebKernelAI Technical SEO & Audit Crawler
WebKernelAI-Bot/2.0Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 (compatible; WebKernelAI-Bot/2.0; +https://webkernelai.com/bot)WebKernelAI Image & Asset Auditor
WebKernelAI-ImageAuditor/1.0Mozilla/5.0 (compatible; WebKernelAI-ImageAuditor/1.0; +https://webkernelai.com/bot)How to Independently Verify a WebKernelAI Request
Because User-Agent headers can be spoofed by malicious third parties on the open internet, security analysts and webmasters should always independently corroborate source IPs against our official published feed.
Check User-Agent
Inspect your server access logs. Verify that the request header contains WebKernelAI-Telemetry, WebKernelAI-Bot, or WebKernelAI-ImageAuditor.
Validate Source IP
Query the live machine-readable JSON feed at /bot/ips.json. Confirm that the connecting client IP address is within the published CIDR blocks.
FCrDNS Verification
Query PTR for 187.127.159.178 (returns crawler.webkernelai.com), then query A record for crawler.webkernelai.com (returns 187.127.159.178).
Web Bot Auth (RFC 9421)
Validate outgoing Ed25519 signatures via our public JWKS key directory at /.well-known/http-message-signatures-directory.
# 1. Fetch current published crawler egress prefixes:
curl -s https://webkernelai.com/bot/ips.json | jq -r '.ipv4Prefixes[]'
# 2. Check if connecting IP matches the published pool:
# Example output: 187.127.159.178/32Published IP Egress Feed & Endpoint
WebKernelAI maintains a live JSON endpoint declaring our active crawler and telemetry egress IP ranges.
{
"schema_version": "2.0.0",
"name": "WebKernelAI Bot Verification & IP Range Feed",
"description": "Authoritative machine-readable IP ranges and verification metadata for WebKernelAI automated services...",
"operator": "WebKernelAI Inc.",
"documentation": "https://webkernelai.com/bot",
"contact": {
"abuse": "abuse@webkernelai.com",
"support": "support@webkernelai.com"
},
"last_updated": "2026-09-21",
"effective_date": "2026-09-21",
"taxonomy": {
"behaviors": [
"Monitoring & Operations",
"SEO Crawling & Auditing",
"Asset & Performance Analysis"
],
"operation_type": "Direct"
},
"prefixes": [
{ "ipv4Prefix": "187.127.159.178/32" }
],
"ipv4Prefixes": [
"187.127.159.178/32"
],
"ipv6Prefixes": []
}Crawl Behavior, Rate Limits & robots.txt Policies
WebKernelAI is engineered to minimize origin load, prevent infrastructure strain, and strictly respect origin directives.
Telemetry Frequency & Concurrency
- Uptime Probing Interval: 1 probe check every 3 minutes per configured target endpoint (~20 requests/hour per endpoint).
- Request Optimization: Probes deploy lightweight HTTP HEAD first; only falling back to GET if the origin returns 405 or 501.
- Timeout Budget: Fixed 15,000 ms (15s) socket timeout to prevent hung origin connections.
- Anti-False-Positive Filter: If an initial probe fails, two confirmation retries are scheduled with 5s and 10s progressive delays before declaring downtime.
Rate Limiting & Backoff Handling
- 429 (Too Many Requests): Crawlers detect 429 status codes and immediately halt crawl batches against the origin.
- 503 (Service Unavailable): Treated as origin strain; crawler suspends requests and backs off to protect server availability.
- Payload Size Capping: Crawler buffers are strictly capped at 2MB for HTML pages and 5MB for assets to prevent out-of-memory overhead.
- Redirect Budget: Maximum 5 redirect hops before aborting to terminate redirect loops cleanly.
robots.txt Compliance
WebKernelAI honors standard robots.txt crawl directives. Our technical SEO crawlers inspect /robots.txt on the audited origin before executing deep crawls. If a directive disallows User-agent: WebKernelAI-Bot or User-agent: *, our crawler terminates the scan on matching paths.
What WebKernelAI Does NOT Do
Defensive, verified commitments backed directly by our platform architecture and operating policy:
Data Processing & Retention Policy
HTTP responses fetched during technical audits and uptime checks are processed in-memory for SEO analysis, security header inspection, and latency tracking. Diagnostic summaries are stored securely in customer audit reports and retained in accordance with our documented platform policies.
For complete details on customer data retention, encryption standards, and sub-processors, visit our Privacy Policy and Trust Center.
Cryptographic Web Bot Auth (RFC 9421 & Ed25519)
WebKernelAI implements asymmetric HTTP Message Signatures compliant with IETF drafts and Cloudflare's Web Bot Auth verification standard.
Our public JSON Web Key Set (JWKS) is served over HTTPS at the standardized path:https://webkernelai.com/.well-known/http-message-signatures-directory
Self-attested with mandatory Signature and Signature-Input headers over @authority per draft-meunier-http-message-signatures-directory-03.
Every outbound probe and crawl request attaches three deterministic cryptographic headers:
Signature-Agent(URI in double quotes)Signature-Input(tag="web-bot-auth")Signature(Ed25519 signature base)
Signature-Agent: "https://webkernelai.com/.well-known/http-message-signatures-directory"
Signature-Input: sig1=("@authority" "signature-agent");created=1790000000;expires=1790000120;keyid="LjeV_dGdzYB0MLfo8mdx4ArQi0gvG_2-O_ALtSGMe2A";alg="ed25519";tag="web-bot-auth"
Signature: sig1=:<ed25519-signature-bytes>:Cloudflare & Edge CDN WAF Configuration
Webmasters using Cloudflare, AWS WAF, Akamai, or Fastly can configure allowlists to ensure continuous uptime telemetry and seamless technical SEO audits.
WebKernelAI is an approved Cloudflare Verified Bot. If your Cloudflare WAF configuration has “Allow Verified Bots” enabled (default for most managed rulesets), WebKernelAI traffic is automatically recognized at edge and allowed without triggering Managed Challenges or CAPTCHAs.
Cloudflare operates multiple bot protection layers. Free & Pro plans utilize Bot Fight Mode (which runs challenge heuristics at edge). Business and Enterprise plans offer Super Bot Fight Mode and WAF Custom Rules. For optimal security, do not rely solely on User-Agent matching; combine source IP matching with User-Agent verification.
Recommended Cloudflare WAF Custom Rule (IP + User-Agent)
- Log in to your Cloudflare Dashboard and navigate to Security > WAF > Custom Rules.
- Click Create Rule and label it Allow WebKernelAI Telemetry & Audits.
- Under When incoming requests match..., click Edit expression and insert:
(ip.src eq 187.127.159.178 and (http.user_agent contains "WebKernelAI-Telemetry" or http.user_agent contains "WebKernelAI-Bot" or http.user_agent contains "WebKernelAI-ImageAuditor"))- Under Choose action, select Skip.
- Under WAF components to skip, check All remaining custom rules and Super Bot Fight Mode (if available on your plan).
- Click Deploy. WebKernelAI probes and audit crawlers will now reach your origin without triggering challenge interstitial pages.
How Webmasters Can Block or Control WebKernelAI
If you are a webmaster and do not wish for WebKernelAI to audit your site, we respect your administrative autonomy. You can disallow our crawler at the application or network level.
Method 1: robots.txt Disallow
Add to the root of your domain (/robots.txt) to prevent audit crawling:
User-agent: WebKernelAI-Bot Disallow: / User-agent: WebKernelAI-ImageAuditor Disallow: /
Method 2: Network / WAF Block
To block all traffic from our static egress IP at the network firewall level:
# Linux iptables block: iptables -A INPUT -s 187.127.159.178 -j DROP # Or block 187.127.159.178/32 in your cloud firewall
Abuse, Security & NOC Incident Response
If you observe traffic claiming to be WebKernelAI that originates from an unlisted IP address, generates unexpected volume, or causes origin issues, please report it immediately to our operations team.
- Observed client source IP address and port
- Exact timestamp with timezone (UTC preferred)
- Full User-Agent string from server access logs
- Target URL path and HTTP request method
- Summary of observed impact or anomaly
IP & Identity Change History
WebKernelAI documents changes to crawler egress pools and official identification strings to ensure webmaster firewall policies remain current.
| Effective Date | Version | Published CIDR Range | Change Description |
|---|---|---|---|
| 2026-09-21 | 2.0.0 | 187.127.159.178/32 | Current active static egress pool. Published official /bot/ips.json feed and comprehensive webmaster verification documentation. |