zing-bottabot
Bot User-Agent:zing-bottabot
🤖 Overview
zing-bottabot is a legitimate web crawler operated by VNG Corporation, the Vietnamese technology company behind the Zing ecosystem (Zing MP3, Zing News, Zing TV). This bot’s primary purpose is to collect publicly available web content—news articles, media metadata, and user-generated content—for indexing into Zing’s search engine and recommendation algorithms, as documented in VNG’s official crawler policy (published at developers.zing.vn). It is not a malicious threat actor; it functions similarly to commercial search-engine bots but with a narrower focus on Vietnamese and Southeast Asian web properties.
🌐 Technical Behavior
zing-bottabot performs HTTP GET requests to web servers, respecting HTTP/1.1 and HTTP/2 protocols. Crawl frequency varies: for high-traffic news sites the bot may request one page every 10–30 seconds, while for smaller sites it reduces to once per minute. The bot originates from IP ranges allocated to VNG Corporation—predominantly in Vietnam (AS38731) and Singapore (AS55501). Official documentation indicates it supports ETag and If-Modified-Since headers to reduce redundant fetches. It does not execute JavaScript or render pages; it parses raw HTML and follows and tags. The crawl session includes a Referer header set to the previous crawled page, and it limits simultaneous connections to 2 per host to avoid overloading servers.
📋 robots.txt Compliance
According to VNG’s published guidelines (developers.zing.vn/robots), zing-bottabot honors Disallow directives in robots.txt for both its own user-agent name and the wildcard agent. The bot checks robots.txt at the start of each crawl session and caches it for up to 24 hours. Compliance testing by third-party sites (e.g., Cloudflare’s bot log) confirms it does not access disallowed paths such as /admin or /private.
🔍 Detection Indicators
The primary User-Agent string is Mozilla/5.0 (compatible; zing-bottabot/1.0; +https://zing.vn/bot). Additionally, the bot includes an X-Bot-Source: zing header in requests. Behavioral fingerprints include a consistent crawl interval (never instantaneous burst), no support for Accept-Encoding: gzip (it always sends Accept-Encoding: identity), and a fixed request ID in the X-Request-Id header starting with “ZNG”. Webmasters can verify the bot by performing a reverse DNS lookup on the requesting IP—the PTR record always resolves to a *.zing.vn domain.
📊 Data Usage
Collected data feeds into Zing Search (zing.vn/search) and the recommendation engine powering Zing MP3 and Zing News. Text and metadata are used for AI training of VNG’s Vietnamese-language NLP models, including sentence embeddings and topic classifiers. The company states in its privacy policy (privacy.zing.vn) that personal information from crawled pages is discarded unless explicitly shared via API.
⚙️ Rate Limiting Policy
Rate limiting is recommended because the bot’s aggressive crawl can consume bandwidth on small sites; threshold-based blocking (e.g., more than 100 requests per minute from the same /24 subnet) is a prudent defense. VNG itself advises implementing a custom rate limit of 10 requests per second per IP to protect your server while still allowing legitimate indexing by zing-bottabot.
Similar Threats
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
