PetalBot is a published crawler name, and unrelated clients sometimes forge that same name while copying pages from sites.
A site that trusts the name alone can welcome scripted copying that has nothing to do with the original crawler.
How it works
Operators publish the name so sites can recognize one search crawler and decide how to treat it.
Once the name is public, other programs can present it, so the label stops being proof of identity.
Forged visits still consume bandwidth, fill logs, and may collect prices or catalog text at a pace no person would browse.
Allowing every request that carries the name therefore treats impostors and the real crawler as the same guest.
Concrete examples
- A shop log shows the crawler name on thousands of product fetches that do not match the published crawl pattern.
- A forum sees the name on rapid account pages even though the real crawler has no reason to open them.
- A content site notices the name rotating across many household addresses in a single hour.
Protective measures
- Treat the crawler name as a hint, and confirm behavior against the crawl pattern you expect from it.
- Apply the same request caps and proof of work gates to that name as you do to other automated clients.
- Alert when the name appears on checkout, login, or account routes that a search crawler should not need.
- Keep samples of suspicious visits so you can compare timing, paths, and addresses with a normal crawl.
How CDPCaptcha helps
A browser proof of work check makes visits that only borrow a crawler name spend computation before content is served.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.