Ison Search.
/

Crawler

That was our crawler.

IsonSearchBot builds the index behind Ison Search, a search engine run from Indonesia. It reads public pages to build the search index and support cited answers that link back to the original sources.

You are probably here because of this line in your access log:

203.0.113.7 - - [15/Sep/2026:07:14:22 +0700] "GET /artikel/2026 HTTP/1.1" 200 41822 "IsonSearchBot/1.0 (+https://search.isonai.com/bot)"

Control

Stop it

One line in robots.txt. It takes effect the next time we read the file.

User-agent: IsonSearchBot
Disallow: /

Already indexed? Email hello@epithre.com with the subject IsonSearch removal: [domain]. Removed within 24 hours, and the domain goes on a permanent exclusion list.

Verify

Check that it is really us

A User-Agent string is a claim, not proof — anyone can type ours. Match the source address of the request against the list we publish:

https://search.isonai.com/bot/ips.json

This JSON list contains every address IsonSearchBot crawls from that we hold ourselves. Shared mobile-network addresses are deliberately excluded, so an address outside the list alone does not prove impersonation. Some listed addresses also carry IsonAI-User, the separate agent that fetches a page when a person asks IsonAI about it; it has its own list, /bot/isonai-user.json, and a different User-Agent.

The stronger check is the signature. Every request carries a Web Bot Auth signature (Signature-Agent: "https://search.isonai.com") that verifies against our published key; a valid signature proves the request is ours, whatever address it comes from. Contact hello@epithre.com if you need to check a request.

Behaviour

What it does, and what it never does

RuleWhat we do
IdentityEvery request, including rendered pages, carries one user agent, IsonSearchBot/1.0 (+https://search.isonai.com/bot). We never present ourselves as a browser.
robots.txtHonored in full, per host, for the IsonSearchBot group (or *). Disallow, Crawl-delay and Sitemap are read and applied.
ChallengesWe never solve CAPTCHAs or other interactive challenges, and we never change our identity to get past a block.
Request ratePaced per site, not per crawler process, and adapted to your server: it starts at one request per second, speeds up only while responses stay fast and error-free, and never goes above two per second or one connection at a time. Slow answers, timeouts and 5xx slow it down; 429 and 403 drop it to the minimum and pause. Crawl-delay always wins (up to 30 seconds).
ScopeThe public web, with Indonesian sources given priority.
JavaScriptMost pages are fetched as static HTML. Pages that only show their text with JavaScript are rendered in a headless browser that identifies as IsonSearchBot and follows the same rules.
Never touchedNo forms submitted, no authentication attempted, nothing behind a paywall.
Content useCrawled pages build the search index and ground cited answers that link back to the original page. Content-quality classifiers help filter spam from the index.

Verification

Public keys and network addresses

We publish an Ed25519 public key in our Web Bot Auth key directory. Its HTTP response is signed with the matching private key, so reviewers can verify control of the published key.

Every request is signed with that key, including pages rendered in a headless browser, and Cloudflare lists IsonSearchBot as a verified bot.

Not every network we use lets us set our own reverse DNS name, so we publish dedicated addresses and signatures instead of relying on reverse DNS to prove our identity.

One node reaches the internet through a shared mobile network, and we deliberately leave that address out. Publishing it would ask you to allow a pool belonging to thousands of unrelated subscribers. Its requests are signed like every other, so they can still be verified.