PhantomJS / Nightmare Bot
Collects data, operated by legacy. Headless browsers and drivers.
- Operator
- legacy
- Kind
- Automation tools
- Does
- Collects data
- Traffic
- Many customers’
- robots.txt
- No token
Identity
Names itself in its user agent only
- SignedSigns every request (Web Bot Auth): cryptographic proof.
- IP listPublishes the IP addresses it comes from.
- Reverse DNSIts IP addresses resolve to the operator’s domain.
- User agentNames itself in its user agent, which anyone can copy.
- HiddenLooks like a person’s browser: detected by behaviour.
How to recognise it
User agent
Contains
PhantomJS. Anyone can copy it, so it names the client without proving it.JavaScript globals
Leaves automation traces in the page’s JavaScript globals.
Details
- ID
legacy.headless- Category
- Bot
- Operator
- legacy
- Agent Card
- Not published: this agent doesn’t identify itself with an Agent Card.
- First seen
- 2026-09-28
Registrations
- Catalog Self
- Verified
- 2026-09-28
- Checked
- 2026-09-28
Reputation
Computed 2026-11-13
—No score yet
Confidence8%
A score shows from 30%
- Identity40% of the score19 / 100
0 verified sources
A verified Agent Card adds 25 points, 40 if it is signed.
- Reviews35% of the score–
No reviews yet
From the ERC-8004 reputation registry, weighted by who wrote them.
- Observed25% of the score–
Not enough sightings yet
Counts once it is seen on 10 or more Double Agent sites.
Change history
No card history: this agent doesn’t publish an Agent Card.
With Double Agent
Sessions from PhantomJS / Nightmare are labelled bot with agent_id: legacy.headless, and tagged in your analytics. Nothing is blocked unless you choose to.