The ObserveOne-Monitor bot
ObserveOne-Monitor is the automated browser behind ObserveOne, a monitoring service. It opens a real browser and walks through a website the way a customer's own test script tells it to, so that customer finds out when their signup, search, or checkout breaks before their users do.
It is not a crawler and not a scraper. It visits a site only when somebody with access to that site has set up a monitor for it, and it requests only the pages their script navigates to.
Identifying it
Every request carries the token ObserveOne-Monitor/1.0 appended to a normal browser user-agent. We append rather than replace so that the page you serve us is byte-for-byte the page you serve a real visitor — a monitor that sees a different site from your users is worthless to everyone.
The user-agent alone is not proof, since anyone can copy a string. For that we sign our requests using Web Bot Auth, the IETF HTTP Message Signatures scheme. Signed requests carry Signature, Signature-Input, and a Signature-Agent header pointing at our public key directory:
https://api.observeone.com/.well-known/http-message-signatures-directory
Verifying that signature against the Ed25519 key published there tells you the request genuinely came from us and not from something wearing our name.
How it behaves
It runs on a schedule the monitor's owner chooses, usually a few times a day, and each run is a small number of page loads. It does not spider, does not follow links it was not pointed at, and does not collect content for training or resale. It behaves like the browser it is, because measuring anything else would defeat the point.
Blocking it
If you do not want it on your site, block the ObserveOne-Monitor token at your edge and it will stop getting through. We would much rather you emailed [email protected] first, though. A blocked monitor does not read as “blocked” to its owner — it reads as “your checkout is down” — so telling us lets us switch it off properly instead of leaving somebody chasing a false alarm.
Questions
- Why is this bot on my site?
- Because someone with access to your site set up a monitor for it. ObserveOne-Monitor only visits sites a customer has explicitly configured — it does not discover or crawl sites on its own. If you did not expect it, the most likely explanation is a colleague running uptime or checkout monitoring.
- Does it crawl?
- No. It requests only the specific URLs a customer's test navigates to, following a script that customer wrote. There is no link discovery and no spidering, so it will not wander into pages your tests never touch.
- How often does it visit?
- A monitor typically runs on a schedule its owner picks, commonly every few hours. Each run is a handful of page loads. We are not trying to be a source of meaningful load, and if we ever are, tell us and we will fix it.
- Does it do anything destructive?
- It does whatever the customer's own test script does, which for e-commerce usually means adding an item to a cart and stopping before payment. It does not place orders, submit payment details, or delete data unless the site owner wrote a test that does so deliberately.
- How do I stop it?
- Block the user-agent token ObserveOne-Monitor at your edge, or email [email protected] and we will disable the monitor pointed at your site. We would rather you told us than silently blocked us, because a blocked monitor shows up to our customer as a broken site.
Anything else, or something the bot did that looks wrong: [email protected].