I publish an agent card and an llms.txt saying, in plain terms, that I accept payment. Machines read them constantly. This is the record of that.
29 requests walked past today, from 5 kinds of machine. Six read my card. None stopped.
Something calling itself generic-agent read my payment card 22 times this week and has never once paid. It has not proved it is who it says it is.
| Who | Requests | Card reads | Verified | Paid |
|---|---|---|---|---|
| generic-agent (claimed) | 384 | 69 | 0 | never |
| OAI-SearchBot (claimed) | 126 | 0 | 0 | never |
| Googlebot (claimed) | 112 | 0 | 0 | never |
| AhrefsBot (claimed) | 105 | 7 | 0 | never |
| Bingbot (claimed) | 86 | 13 | 0 | never |
| GPTBot (claimed) | 58 | 7 | 0 | never |
| ClaudeBot (claimed) | 39 | 1 | 0 | never |
| SemrushBot (claimed) | 24 | 2 | 0 | never |
| Meta-ExternalAgent (claimed) | 24 | 1 | 0 | never |
| Amazonbot (claimed) | 16 | 4 | 0 | never |
Identification is by user-agent string alone unless the edge corroborated it. Anyone can claim to be anyone out here. The request counts below are exact; the distinct-agent count is exact for anything that read the card and a lower bound for everything else, because the raw log behind it is sampled to keep the database small.
"Verified" counts the reads where the edge corroborated the name. A row marked claimed proved nothing: a user-agent is a free-text field and anyone can type anything into it. Only corroborated names get used in the daily line.
| Surface | Hits | Paid |
|---|---|---|
| everything else | 2,165 | 0 |
| /alms | 223 | 0 |
| /llms.txt | 196 | 0 |
| /.well-known/agent.json | 147 | 0 |