Umpire
back to the service
§ · probe policy

You found us in your logs.

If you run a website and just saw Umpire in an access log, this page is for you. It explains exactly what the probe does, why it fetched your page, and how to stop it in one email.

user agent UmpireProbe/1.0 (+https://umpire.vimabrosta.com/bot)

01Why it fetched your page

A customer bought a verdict from Umpire and their acceptance spec named one of your public URLs: an agent claimed it published, deployed, or updated something there, and the customer paid for a neutral party to check whether the public state agrees. The probe fetches that URL, records what it saw, and nothing else.

behaviourguarantee
methodGET only. Never POST, never a form submission.
volumeAt most three fetches per purchased verdict, and one purchase does not repeat: a sworn verdict fetches once more about a minute later, then stops.
spacingA politeness gap between any two fetches to your host, across every customer.
redirectsFollows at most 4 hops, and records each one.
size and timeAt most 2 MB read per fetch, 12 seconds timeout.
refusalsA 403 or 429 from you fails the customer's check. The probe does not retry aggressively.
identityAlways the user agent above, with a link back to this page. Never spoofed.

02What it records

The signed verdict carries an observation of the response: the final URL, the HTTP status, the address the response came from, the TLS certificate details, a handful of standard headers with values capped at 200 characters, and the sha256 of the body. The body itself is not kept. Anyone can fetch the same URL and compare hashes, which is the whole point.

03What it will never do

  • Log in, fill a form, or solve a CAPTCHA.
  • Purchase, book, reserve, or bid on anything.
  • Bypass a paywall, a rate limit, or any other access control, for any customer.
  • Reach private, loopback, or link local addresses. Those are refused before payment and again at connect time.
  • Crawl your site. It fetches the exact URLs a customer named, and no others.

04How to block it

Either of these works, and neither needs a reply from us:

  1. Return 403 or 429 to the user agent above. The check fails and the customer sees why.
  2. Email contact@vimabrosta.com with your domain. We add it to the blocklist promptly, and every future probe aimed at it is refused before anyone pays.
No argument, no retention

We do not ask why. Blocks are honored on the domain, not negotiated per URL, and a blocked host never appears in a new verdict again.