Bot Disclosure
This page provides full technical disclosure about the Bram monitoring bot — including identity, behavior, request characteristics, and Web Bot Auth compliance — for use by infrastructure operators, Cloudflare bot verification, and security teams.
Quick Reference
Bot Name
Bram/1.0
Operator
Outbound IP
157.180.41.172
WBA Key Directory
Identity & Purpose
Bot type
Website & API health monitor — not a web crawler or indexer.
Operator
Modic — builders of Bram (askbram.com)
Contact
Bot info URL
Bram is a website and application health monitoring platform. Site owners and operators explicitly configure monitors for URLs they own or have permission to monitor. The bot visits only the URLs that the authenticated user has configured — it does not crawl, discover, or follow links.
Every request Bram makes is a deliberate health check triggered on behalf of the site owner. Bram does not index content, store page content beyond diagnostic failure captures, or use crawled data for any purpose other than generating the configured monitoring result.
User Agent
User-Agent header sent on all requests
Mozilla/5.0 (compatible; Bram/1.0; +https://askbram.com)
Pattern
Bram/1.0
Safe substring to match in WAF rules
Info URL (embedded)
https://askbram.com
RFC-compliant +URL pattern
Applied to
HTTP, HTML, and API checks. Browser checks use this UA inside Playwright's Chromium instance.
Note on browser checks: When running Playwright-based browser checks (full page render, E2E flows), the request is made by a real Chromium browser instance. The user agent above is explicitly set on the Chromium instance and will appear in access logs for browser check requests.
Origin IP Addresses
Current outbound IP
157.180.41.172
All check types originate from this single address.
Data center & verification
The outbound IP carries a PTR record resolving to an askbram.com hostname, enabling reverse-DNS verification.
Machine-readable IP lists
The current IP list is published in two formats for automated allowlist management. Both files carry a 1-hour cache TTL.
IP change policy: Bram currently runs from a single fixed IP. If the server IP changes, this page and the machine-readable IP lists above will be updated within 24 hours. Subscribe to the ips.json or ips.txt endpoints to stay current automatically.
Web Bot Auth Compliance
RFC 9421 HTTP Message Signatures · Ed25519 · Cloudflare Verified Bot program
Key Directory URL
https://app.askbram.com/.well-known/http-message-signatures-directory
Serves a JWKS containing Bram's Ed25519 public key, signed per WBA spec.
Signing algorithm
Headers sent on every signed request
Signature-Agent: "https://app.askbram.com/.well-known/http-message-signatures-directory"
Signature-Input: sig1=("@method" "@authority" "@path" "content-type" "signature-agent");tag="web-bot-auth";keyid="<JWK thumbprint>";created=<unix>;expires=<unix+300>
Signature: sig1=:<base64-encoded Ed25519 signature>:
WBA headers are applied after all user-configured headers and cannot be overridden by monitor configuration.
Verification flow for infrastructure operators
Signature-Agent header pointing to Bram's key directory.
https://app.askbram.com/.well-known/http-message-signatures-directory to retrieve the JWKS. The directory response is itself signed — verify it using the @authority of askbram.com.
Signature on the inbound request against the Signature-Input components.
expires has not passed. Bram sets a 300-second TTL on every signature.
Request Behavior & Rate Characteristics
User-Agent: Mozilla/5.0 (compatible; Bram/1.0; +https://askbram.com)
Signature-Agent: "https://app.askbram.com/.well-known/http-message-signatures-directory"
Signature-Input: sig1=(...);tag="web-bot-auth";...
Signature: sig1=:<Ed25519 signature>:
# Operator-configured custom headers may also be present (e.g. Authorization, Accept)
robots.txt Policy
Bram does not crawl or discover URLs. It visits only the specific URLs that an authenticated user has explicitly configured for monitoring. All monitored URLs are set up by the site owner or a party with the owner's permission.
Because monitors are owner-configured, a site owner would typically not block their own monitoring bot. However, Bram still fetches and respects robots.txt as a matter of policy — if a domain disallows Bram, checks will not be dispatched to that domain regardless of the monitor configuration.
Before dispatching any check to a domain, Bram fetches and caches the domain's robots.txt. If a Disallow rule matches the check URL for the Bram user agent, the check is skipped and reported as blocked rather than run.
To block Bram from a specific path or domain:
User-agent: Bram Disallow: /private/ # or to block entirely: Disallow: /
If you believe Bram is accessing your site without authorization, contact hello@askbram.com.
Data Handling & Privacy
Bram does not store, index, or process page content beyond the immediate check result. Response bodies are only retained on failure, for diagnostic purposes, and are accessible only to the monitor's owner.
All infrastructure, including the monitoring worker and database, runs on Hetzner servers in Finland. Monitoring data, check results, and diagnostic captures never leave EU data centers.
Check results, response captures, and screenshots are accessible only to the authenticated user who created the monitor. No result data is shared across accounts or used for any purpose other than the monitoring service itself.
Allowlisting Bram
Once Bram is listed in Cloudflare's Verified Bot program, traffic will automatically carry a verified bot signal and bypass Bot Fight Mode. Until then, create a WAF Skip rule:
(http.user_agent contains "Bram/1.0") or (ip.src eq 157.180.41.172)
Set the rule action to Skip → All remaining custom rules. Optionally also skip WAF managed rules if your site uses aggressive bot detection managed rulesets.
To exclude Bram from access log analysis, filter on the user agent or source IP:
# grep-based exclusion grep -v "Bram/1.0" /var/log/nginx/access.log # AWK exclusion for reports awk '!/Bram\/1\.0/' /var/log/nginx/access.log
Bram's minimum check interval is 60 seconds per URL for HTTP checks and 10 minutes for browser checks. A single monitor generates at most 1 request per minute to a given URL — well below typical rate limit thresholds.
If you run rate limiting at the IP level, add 157.180.41.172 to your allowlist. If you use user-agent-based rate limiting, exempt Bram/1.0.