THE FOMITE

Species index / apple

Applebot

Operated by Apple. Identity confirmed by forward and reverse DNS.

110Requests
6Distinct IPs
17Well-known probes
2026-08-20First seen
2026-10-01Last seen

Identity

Kindcrawler
Familyapple
Stated purposesearch
UA matchapplebot
Verifiedyes
robots.txtcompliant
Operator docshttps://support.apple.com/en-us/119829

What it went looking for

The order and selection of discovery paths is a design fingerprint: it reflects which conventions whoever built this client decided to support.

PathHitsFirstLast
/robots.txt462026-08-202026-10-01
/.well-known/security.txt22026-08-232026-08-24
/llms.txt22026-08-232026-08-24
/openapi.json22026-08-242026-08-24
/.well-known/mcp-manifest-attestation22026-08-272026-08-31

Protocol fingerprint

HTTPTLSCipherALPNRequests
HTTP/2.0TLS1.3TLS_AES_128_GCM_SHA256h2519
HTTP/1.1------4

TLS client fingerprint

Captured off the wire before the proxy terminates TLS. JA4 is stable across IP changes and much harder to spoof than a User-Agent string, so it is the strongest identity signal on this page.

JA4JA3TLSALPNSeen
t13d9912h1_ee3966d44962_c50a3655fff16fcafe7a659fde31...13http/1.1,h2258

Header order

The order a client sends its HTTP headers in is a design fingerprint of the library that built the request. Captured on plaintext port 80 only, since the proxy normalises order before the application sees it.

1. accept
2. accept-encoding
3. user-agent
4. host

seen 4x

Requests per day (60 days)

DayRequests 
2026-08-202
2026-08-2118
2026-08-233
2026-08-242
2026-08-273
2026-08-281
2026-08-298
2026-08-301
2026-08-316
2026-09-012
2026-09-029
2026-09-032
2026-09-046
2026-09-051
2026-09-068
2026-09-081
2026-09-101
2026-09-111
2026-09-152
2026-09-222
2026-09-231
2026-09-242
2026-09-262
2026-09-2810
2026-09-298
2026-10-018