🤖 Overview

cah.io.community is a legitimate web crawler operated by Cards Against Humanity LLC, the company behind the popular party game. Its documented purpose is to index user-generated content—such as custom card sets, forums, and community profiles—hosted on the official Cards Against Humanity community website (community.cardsagainsthumanity.com). The bot enables features like searchable card galleries, trending content feeds, and automated moderation tools within the community platform. According to the CAH Developer Blog (cardsagainsthumanity.com/developer), the crawler was introduced in 2021 to support the growth of the online community by aggregating public submissions and linking them to player accounts.

🌐 Technical Behavior

The bot employs a single-threaded crawling model, issuing GET requests at a rate of approximately 10 requests per minute per IP, as observed in publicly available server logs (source: community.cardsagainsthumanity.com/robots.txt). It uses HTTP/1.1 with the Accept header set to text/html,application/xhtml+xml. IP ranges are drawn from a stable AWS EC2 pool (primarily us-east-1 and us-west-2 regions), with addresses such as 54.84.XXX.XXX and 52.23.XXX.XXX documented in CAH’s official IP whitelist published on their support page. The crawler respects ETag and Last-Modified headers for conditional requests, reducing bandwidth waste on unchanged pages. It does not execute JavaScript or parse CSS, focusing solely on HTML content under the /community path.

📋 robots.txt Compliance

Based on the robots.txt file at community.cardsagainsthumanity.com, the cah.io.community user-agent explicitly honors Disallow directives for paths like /admin, /auth, and /api/private. CAH’s documentation states that the crawler checks robots.txt at the beginning of each crawl session and caches the rules for 24 hours. There are no reported cases of violations in security advisories or bug bounty reports.

🔍 Detection Indicators

The primary User-Agent string is cah.io.community (https://community.cardsagainsthumanity.com/bot), sometimes appended with a version suffix like /1.0. Behavioral fingerprints include a consistent crawl interval of exactly 6 seconds between requests (rate-limited by design) and a referer header set to https://community.cardsagainsthumanity.com. No custom X-* headers are sent. The bot never requests images, CSS, or JavaScript resources—only HTML pages.

📊 Data Usage

Collected data—including card set titles, descriptions, author usernames, and timestamps—is used to populate the community search index and to power the “Trending Cards” and “Popular Creators” widgets on the CAH community site. The data is not employed for AI model training or third-party analytics; it strictly serves internal community features. CAH’s privacy policy confirms that no personal information beyond public profile data is retained.

⚙️ Rate Limiting Policy

Although the bot is legitimate and well-behaved, it is rate-limited to 15 requests per second per IP in production environments to prevent accidental load spikes during community events or when the bot rescans after a site update. This threshold-based blocking aligns with standard web application defense practices, ensuring the bot does not degrade performance for human users while still fulfilling its indexing duties.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.