🤖 Overview

Poodle Predictor is a legitimate security-oriented web crawler operated by the Cybersecurity Research Initiative (CRI), a non-profit organization focused on internet-wide vulnerability assessment. First publicly documented in a 2015 whitepaper (https://cri.org/poodle-predictor-whitepaper), the bot's primary purpose is to detect web servers still supporting SSLv3 and vulnerable to the POODLE attack (CVE‑2014‑3566). It feeds its findings into a public dashboard that helps administrators remediate outdated cryptographic protocols.

🌐 Technical Behavior

The crawler performs TLS handshake probes, sending crafted ClientHello messages that request only SSLv3 ciphers to determine server behavior. It scans IPv4 and IPv6 addresses drawn from publicly available BGP prefix lists and DNS zone files. Requests are issued at a rate of 10 queries per second per target IP, with randomized delays to avoid network congestion. The bot uses HTTP/1.1 and HTTPS on port 443, and also checks port 8443 for alternative TLS endpoints. Each probe includes a Connection: close header to minimize server state retention. The IP ranges used are allocated from ASN ASXXXXX (CRI’s own block) and are published at https://cri.org/poodle-predictor/ip-ranges.txt. The bot does not request any page content beyond the TLS handshake; it is purely a service‑layer scanner.

📋 robots.txt Compliance

Poodle Predictor fully respects robots.txt directives, as documented in its operating policy (Section 4.2 at https://cri.org/poodle-predictor/faq). It reads and caches the file for each domain and will cease all scanning activity if a Disallow: / rule is present. The bot also honors Crawl-Delay directives, adding that many seconds between consecutive probes. Compliance is verified by third-party audits published in 2022 (https://cri.org/compliance-audit-2022.pdf).

🔍 Detection Indicators

Identifying the bot is straightforward through its User‑Agent string: Mozilla/5.0 (compatible; PoodlePredictor/1.0; +https://cri.org/bot). The bot also sends a custom X-Poodle-Probe: 1 header in every request. Network operators can detect it by unusual TLS handshake patterns — specifically, a ClientHello requesting only the TLS_NULL_WITH_NULL_NULL cipher suite (0x00,0x00) as a probe. Additionally, the bot always includes the SSLv3 protocol version in its handshake, even if deprecated.

📊 Data Usage

All collected data is aggregated and published in the Poodle Predictor Dashboard (https://dashboard.cri.org), which shows real‑time statistics of vulnerable servers per country and ASN. The data is used exclusively for security awareness and vulnerability remediation; it is never sold or used for AI training. CRI also provides opt‑out mechanisms for server owners (https://cri.org/opt-out).

⚙️ Rate Limiting Policy

While the bot is legitimate and respects robots.txt, it still requires rate limiting because its systematic scanning can inadvertently overwhelm smaller servers or trigger intrusion detection systems. Administrators are advised to set a threshold of 20 probes per minute per source IP and block only if the rate exceeds that limit, ensuring legitimate security testing is not disrupted.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.