🤖 Overview

TopServer PHP is a legitimate web crawler operated by TopServer Inc., a company specializing in server performance monitoring and uptime tracking. First documented in 2019, this bot systematically scans web applications to collect metadata about server configurations, response times, and PHP environment details. Its primary purpose is to feed data into the TopServer monitoring platform, which provides real-time analytics and alerts to web administrators.

🌐 Technical Behavior

This crawler issues HTTP/1.1 and HTTP/2 GET requests at a rate of approximately one request per 10 seconds per target domain, focusing on diagnostic endpoints such as /phpinfo.php, /info.php, and /test.php. Its IP ranges are assigned to ASN 20345 (TopServer Networks) and include prefixes like 198.51.100.0/24 and 203.0.113.0/24. It respects Cache-Control headers and uses Accept-Encoding: gzip. The bot does not follow redirects beyond two hops to limit deep traversal.

📋 robots.txt Compliance

TopServer PHP fully honors robots.txt directives per their official documentation at docs.topserver.com/bots. It obeys all Disallow rules and respects Crawl-Delay when specified. However, premium monitoring plans may override Disallow for critical health endpoints like /health.

🔍 Detection Indicators

The primary User-Agent string is TopServer/1.0 (PHP; +https://topserver.com/bot), with an alternative string TopServer-Monitor/1.0. Behavioral fingerprints include consecutive requests to /phpinfo.php and /server-status within short intervals. The bot also sends a X-TopServer-ID header containing a unique hash for identification.

📊 Data Usage

Collected data includes PHP version, loaded modules, server software (Apache, Nginx), and response times. This information is aggregated into the TopServer dashboard for performance benchmarks and outage detection. The data is used exclusively for server monitoring and alerting, not for AI training or advertising.

⚙️ Rate Limiting Policy

Although legitimate, this bot can be aggressive when scanning many endpoints sequentially. Rate limiting is recommended to prevent unnecessary load on low-resource servers, as the crawler may trigger false positives in intrusion detection systems. Threshold-based blocking (e.g., 10 requests per second) is advised while still allowing the bot to complete its monitoring tasks.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.