{"id":12854,"date":"2026-08-30T06:30:00","date_gmt":"2026-08-30T04:30:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=12854"},"modified":"2026-09-28T17:11:45","modified_gmt":"2026-09-28T15:11:45","slug":"bot-detection-ip-lists-and-cryptographic-signatures-compared","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/","title":{"rendered":"Bot Detection: IP Lists and Cryptographic Signatures Compared"},"content":{"rendered":"<p>Apple enlarged the address pool behind Applebot during August 2026. The reported figures are a jump from around 2,400 addresses across twelve prefixes to roughly 7,056 across thirty-three, and the published range list is described as still incomplete. Every site that verifies that crawler against a stored copy of the list had to fetch a new one, or quietly started treating a legitimate crawler as an impostor.<\/p>\n<p>That is not a flaw in this particular release. It is the defining property of proving identity by address, and it is worth setting against the alternative rather than complaining about it.<\/p>\n<figure class=\"lw-diagram\">\n<img decoding=\"async\" src=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/zwei-nachweise-en.png\" width=\"1120\" height=\"580\" loading=\"lazy\" alt=\"A seven-row comparison table with two columns, address proof and key proof, each cell carrying a filled, half-filled or empty disc and a short explanation of the property\"><figcaption>The two proofs agree on what they catch and disagree on who carries the upkeep.<\/figcaption><\/figure>\n<h2>The address proof, and its self-updating variant<\/h2>\n<p>The simplest form is a list of ranges the operator publishes and every site downloads. It works because a source address cannot be forged across a completed TCP handshake, which makes it a genuine proof of origin rather than a claim.<\/p>\n<p>Forward-confirmed reverse DNS is the same proof with the maintenance moved. Instead of holding the ranges, a site resolves the address backwards, then resolves the resulting name forwards again and checks that it lands on the address it started from.<\/p>\n\n\n<figure style=\"--cbb-digits:2\" class=\"cbb cbb--wrap cbb--numbers wp-block-code-beautifier-block-code\" data-lang=\"plain\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">Text<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-plain\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\">address in the request        17.241.75.12\n<\/span><span class=\"cbb-line\">\n<\/span><span class=\"cbb-line\">  reverse lookup             -&gt; some-host.applebot.apple.com\n<\/span><span class=\"cbb-line\">  suffix check               ends in a domain the operator owns\n<\/span><span class=\"cbb-line\">  forward lookup             -&gt; 17.241.75.12\n<\/span><span class=\"cbb-line\">  compare                    same address, so the claim holds\n<\/span><span class=\"cbb-line\">\n<\/span><span class=\"cbb-line\">  fails safe: a forged reverse record does not survive the\n<\/span><span class=\"cbb-line\">  forward lookup, because the attacker does not control the\n<\/span><span class=\"cbb-line\">  operator's forward zone<\/span><\/code><\/pre><\/figure>\n\n\n<p>This variant costs one or two DNS round trips per new address, cached afterwards, and it does not go stale when the pool grows. It remains an address proof, though, with everything that implies.<\/p>\n<h2>What an expansion actually costs<\/h2>\n<p>A pool that nearly triples produces two failure modes, and only one of them is loud. The loud one is a crawler being blocked, noticed within a day because content stops being indexed. The quiet one is worse: a site that treats unverified traffic as ordinary human traffic now has several thousand addresses&#8217; worth of crawler activity sitting in its analytics as sessions.<\/p>\n<p>Neither failure announces itself as a list problem. Both look like something else, which is why the refresh cadence for any published range list belongs in a scheduled job rather than in someone&#8217;s memory.<\/p>\n<h2>The key proof<\/h2>\n<p>The other approach moves the evidence into the request. The operator holds a key pair, publishes the public half under a domain it controls, and signs each outgoing request; the site verifies the signature against the published key. HTTP message signatures, standardised in RFC 9421, are the mechanism, and Web Bot Auth is the profile of it aimed at agents.<\/p>\n<p>Its advantage over an address is structural. A key follows the operator, not the machine, so new capacity signs with the same key on the day it comes online and no list anywhere needs touching. It also survives rented infrastructure, where an address genuinely cannot help: the address block belongs to a hosting provider, and knowing that tells nobody who is renting it this month.<\/p>\n<p>The cost is that it only exists where an operator has chosen to implement it. An address proof works against every crawler that publishes ranges, which is most of the established ones; a key proof works against the subset that signs, which today is small.<\/p>\n<h2>Which one, and when<\/h2>\n<p>In practice they are not competitors. An address check answers a question a signature cannot: whether traffic claiming to be a well-known crawler really originates where that crawler lives. A signature answers a question an address cannot: which of several operators sharing a data centre actually sent this.<\/p>\n<p>The sensible arrangement runs the address check first, because it is cheap and covers the established crawlers, and accepts a valid signature as an independent second path for operators that offer one. What neither of them provides is a judgement about what the request is for. Both establish who is asking. Nothing in either proof speaks to what happens with the answer.<\/p>\n<div class=\"lw-faq\">\n<h2>Questions and answers<\/h2>\n<h3>Is checking the user agent not enough?<\/h3>\n<p>No. Every client sets its own user agent; it is the claim to be verified, not the proof of it. What it is good for is choosing the right check: traffic claiming to be Applebot is checked against Apple&#8217;s ranges or host names.<\/p>\n<h3>What changes when a CDN or reverse proxy sits in front of the server?<\/h3>\n<p>The address the server sees then belongs to the service in front of it. The completed TCP handshake now only proves that the request came from the CDN; the crawler&#8217;s address sits in a header such as X-Forwarded-For, which the service adds. Both checks, whether by range list or by reverse and forward lookup, have to start from that address, otherwise they verify the CDN.<\/p>\n<p>That makes protection against forgery a precondition: the header is only as trustworthy as whoever sent it. A client that reaches the server directly can fill X-Forwarded-For with any address from Apple&#8217;s ranges and will then pass every address check. The header may therefore only be evaluated when the connection itself comes from the CDN&#8217;s published ranges, and where it holds several entries, the one that counts is the last, added by the CDN itself, not the first.<\/p>\n<p>Many CDNs also run crawler verification themselves and expose the result in their rules. That is convenient, but it merely hands the question of whether an enlarged pool is already recognised over to the provider.<\/p>\n<h3>Can a valid signed request be sent again by a third party?<\/h3>\n<p>In principle, yes, for instance when the operator of another site passes a signed request addressed to it on to someone else&#8217;s site. A signature proves who signed the message, not who is sending it right now. RFC 9421 therefore provides parameters that narrow down replay: created and expires for the period in which the signature is valid, and nonce for a value that is accepted only once. Which parts of the request are signed can also be specified, such as the target host through the @authority component; a signature made for another domain then fails the check.<\/p>\n<p>How much of this a site demands is its own decision at verification time. A short validity keeps the window small; a stored list of nonces already seen closes it, but costs storage and, with several servers, a shared store.<\/p>\n<h3>Why does crawler traffic show up in some analytics and not in others?<\/h3>\n<p>Because the tools count at different points. Server logs record every request; a JavaScript-based tool only records visits in which the script runs and sends its hit. Many crawlers fetch only the HTML and never show up there; others render pages including JavaScript and can then produce sessions.<\/p>\n<p>Then there is built-in filtering. GA4 automatically excludes traffic from known bots and spiders; this cannot be switched off, and GA4 does not show how much was excluded. Anything not on that list counts as an ordinary visit. Server-side counting without verification counts everything anyway.<\/p>\n<p>For the quiet failure mode, this means that the first to be affected are server-side counts and log analyses that subtract verified crawlers and treat everything else as human. There, a stale range list makes every new Applebot prefix look like a person. A sudden rise in supposedly human requests from the new prefixes is therefore the first reason to suspect the stored list.<\/p>\n<\/div>\n<div class=\"lw-quellen\">\n<h2>Sources<\/h2>\n<ul>\n<li><a href=\"https:\/\/developers.google.com\/search\/docs\/crawling-indexing\/verifying-googlebot\" target=\"_blank\" rel=\"noopener noreferrer\">Google Search Central: verifying crawlers<\/a><\/li>\n<\/ul>\n<\/div>\n<p><!-- lw-traffic-practice:start --><\/p>\n<h2>Practical check: investigate GA4 traffic groups<\/h2>\n<p>The <a href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ga4-bot-detector\/\">GA4 traffic review tool<\/a> groups reported data by browser, operating system, country and session source\/medium. It shows explicit cues instead of a bot probability: no engaged sessions, zero average duration, missing dimensions or an automation-related browser name. A configurable minimum keeps small groups from receiving these cues, while retaining their rows in the output.<\/p>\n<p>These observations do not authenticate a crawler. A campaign, consent behaviour, incomplete collection or internal testing can produce similar patterns. Country and Direct traffic are not evidence of automation. The exported CSV can support a comparison with server or CDN logs, but this report contains neither client IP addresses nor verified signatures. No data is excluded or changed.<\/p>\n<p>Google automatically excludes known bot traffic and does not disclose its excluded count in GA4. A result without matching rules therefore means only that the selected checks found nothing in the returned rows. Sources: <a href=\"https:\/\/support.google.com\/analytics\/answer\/9888366?hl=en\">Google\u2019s known-bot exclusion<\/a> and <a href=\"https:\/\/developers.google.com\/analytics\/devguides\/reporting\/data\/v1\/api-schema\">Data API schema<\/a>.<\/p>\n<p><!-- lw-traffic-practice:end --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apple enlarged the Applebot address pool by roughly 194 per cent in August 2026. Every site verifying that crawler from a stored list had to fetch a new one. That maintenance burden is not an accident of this release; it is what address-based verification is.<\/p>\n","protected":false},"author":1,"featured_media":16079,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[91380,91516,91115],"class_list":["post-12854","post","type-post","status-publish","format-standard","hentry","category-cloud-ai","tag-artificial-intelligence","tag-tracking","tag-web-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Bot Detection: IP Lists and Cryptographic Signatures Compared | Lukas Wojcik<\/title>\n<meta name=\"description\" content=\"Address-based crawler verification against key-based verification: what each one proves, who has to maintain it, what an address-pool expansion costs, and where reverse DNS sits between the two.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bot Detection: IP Lists and Cryptographic Signatures Compared | Lukas Wojcik\" \/>\n<meta property=\"og:description\" content=\"Address-based crawler verification against key-based verification: what each one proves, who has to maintain it, what an address-pool expansion costs, and where reverse DNS sits between the two.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-30T04:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-28T15:11:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Lukas Wojcik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lukas Wojcik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/\"},\"author\":{\"name\":\"Lukas Wojcik\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"headline\":\"Bot Detection: IP Lists and Cryptographic Signatures Compared\",\"datePublished\":\"2026-08-30T04:30:00+00:00\",\"dateModified\":\"2026-09-28T15:11:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/\"},\"wordCount\":1367,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png\",\"keywords\":[\"Artificial Intelligence\",\"Tracking\",\"Web Security\"],\"articleSection\":[\"Cloud &amp; AI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/\",\"name\":\"Bot Detection: IP Lists and Cryptographic Signatures Compared | Lukas Wojcik\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png\",\"datePublished\":\"2026-08-30T04:30:00+00:00\",\"dateModified\":\"2026-09-28T15:11:45+00:00\",\"description\":\"Address-based crawler verification against key-based verification: what each one proves, who has to maintain it, what an address-pool expansion costs, and where reverse DNS sits between the two.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png\",\"width\":1200,\"height\":630,\"caption\":\"Bot Detection: IP Lists and Cryptographic Signatures Compared\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/cloud-ai\\\/bot-detection-ip-lists-and-cryptographic-signatures-compared\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Bot Detection: IP Lists and Cryptographic Signatures Compared\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"Lukas Wojcik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"Lukas Wojcik\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Bot Detection: IP Lists and Cryptographic Signatures Compared | Lukas Wojcik","description":"Address-based crawler verification against key-based verification: what each one proves, who has to maintain it, what an address-pool expansion costs, and where reverse DNS sits between the two.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/","og_locale":"en_US","og_type":"article","og_title":"Bot Detection: IP Lists and Cryptographic Signatures Compared | Lukas Wojcik","og_description":"Address-based crawler verification against key-based verification: what each one proves, who has to maintain it, what an address-pool expansion costs, and where reverse DNS sits between the two.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/","og_site_name":"Lukas Wojcik - Blog","article_published_time":"2026-08-30T04:30:00+00:00","article_modified_time":"2026-09-28T15:11:45+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png","type":"image\/png"}],"author":"Lukas Wojcik","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Lukas Wojcik","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/#article","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/"},"author":{"name":"Lukas Wojcik","@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"headline":"Bot Detection: IP Lists and Cryptographic Signatures Compared","datePublished":"2026-08-30T04:30:00+00:00","dateModified":"2026-09-28T15:11:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/"},"wordCount":1367,"commentCount":0,"publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png","keywords":["Artificial Intelligence","Tracking","Web Security"],"articleSection":["Cloud &amp; AI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/","name":"Bot Detection: IP Lists and Cryptographic Signatures Compared | Lukas Wojcik","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/#primaryimage"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png","datePublished":"2026-08-30T04:30:00+00:00","dateModified":"2026-09-28T15:11:45+00:00","description":"Address-based crawler verification against key-based verification: what each one proves, who has to maintain it, what an address-pool expansion costs, and where reverse DNS sits between the two.","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/#primaryimage","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-12854-bot-detection-ip-lists-versus-crypto-nz.png","width":1200,"height":630,"caption":"Bot Detection: IP Lists and Cryptographic Signatures Compared"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/bot-detection-ip-lists-and-cryptographic-signatures-compared\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Bot Detection: IP Lists and Cryptographic Signatures Compared"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"Lukas Wojcik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"Lukas Wojcik"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/12854","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=12854"}],"version-history":[{"count":4,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/12854\/revisions"}],"predecessor-version":[{"id":20820,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/12854\/revisions\/20820"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media\/16079"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=12854"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/categories?post=12854"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=12854"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}