Tersign Prober
An automated HTTP client operated by Tersign (tersign.ai).
What it requests
It sends only HTTP GET requests. It requests endpoints that sell access with HTTP 402 payment terms, records the response status and any payment terms the response publishes, and checks the signatures on those terms.
It never pays, never sends a request body, and never submits a form or credentials. No response is used to train or fine-tune any AI model.
How it identifies itself
User-Agent: Tersign-Prober/1.0 (+https://prober.tersign.ai/)
robots.txt
Requests carrying this User-Agent obey robots.txt: apart from fetching /robots.txt itself, it requests a URL only if that origin's robots.txt allows it. The product token is Tersign-Prober. Every group with a user-agent line naming that token applies, merged; only where no group names it do the * groups apply.
- The most specific matching rule decides (the longest pattern), and
Allowwins a tie.*and a trailing$are supported; the path and the query are matched. - A robots.txt that answers 4xx allows everything; one that answers 5xx, or does not answer, means nothing on that origin is requested.
- A URL whose robots.txt rules are too costly to evaluate is not requested.
Crawl-delayis honoured between requests to the same origin, apart from the robots.txt fetch.- A fetched robots.txt is reused for at most 24 hours, so a change takes effect within a day.
To stop it on your site:
User-agent: Tersign-Prober Disallow: /
Signatures
HTTPS requests carrying this User-Agent also carry an HTTP Message Signature (RFC 9421): Ed25519, tag="web-bot-auth", a 60-second lifetime, covering @authority, signature-agent, @method and @path. A request whose signature cannot be made goes out without one. Plain-HTTP requests are never signed.
Signature-Agent: "https://prober.tersign.ai"
Public keys: https://prober.tersign.ai/.well-known/http-message-signatures-directory. Each key in that directory signs the response itself. To verify a request, take the key whose RFC 7638 thumbprint equals the signature's keyid and check the signature over the components listed in Signature-Input.
Keyids now published:
yG3C3rEp9cEk6xButh6DdpIvSzaigIjDvBjhb7SmCfE