Applebot

Its full user-agent string, exactly as it arrives at the gate:

To check a visitor really is Applebot, run a reverse DNS lookup on its IP address and confirm the hostname ends in .applebot.apple.com. Then run a forward lookup on that hostname and check it returns the same IP. Anything that fails is an impostor; the zoo checks every visit this way and files the failures in the Trap Room. Read Apple's documentation.

Add these two lines to the robots.txt file at the root of your site. Well-behaved crawlers read it before they crawl, so the change applies from Applebot's next visit. Nothing else on your site needs to change.

# Block Applebot from the whole site
User-agent: Applebot
Disallow: /

To stay in Siri and Spotlight but opt out of Apple AI training, block the Applebot-Extended token instead.

Or let it visit but keep it away from part of the site:

# Let it in, but keep it out of one room
User-agent: Applebot
Allow: /
Disallow: /members/

Requests that use Applebot's name but fail Apple's network check are filed separately, as impostors. These are the visits that passed, or that could not be checked at the time:

Networks and countries come from the visitor's IP address, looked up in a local copy of the DB-IP database. The addresses themselves are never stored.