Reflectionbot (impostor)

Its full user-agent string, exactly as it arrives at the gate:

This is not a real species. It is a costume: requests that use Reflectionbot's name but fail reverse-DNS or IP-range checks against Reflection AI's network.

Reflectionbot (impostor) does not read robots.txt, so a polite sign is wasted on it. Refuse it at your web server or firewall instead. User agents are easy to fake, so pair this with rate limiting.

# robots.txt will not stop Reflectionbot (impostor). Block it at the server.
# nginx
if ($http_user_agent ~* "Reflectionbot") {
    return 403;
}

The same thing on Apache:

# Apache (.htaccess)
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} Reflectionbot [NC]
RewriteRule .* - [F,L]

Claims to be Reflectionbot. Real Reflectionbot traffic comes from Reflection AI's own network; these visits came from:

Nothing on record in the last 30 days.

Networks and countries come from the visitor's IP address, looked up in a local copy of the DB-IP database. The addresses themselves are never stored.