Centocular's probes

If you found us in your logs: Centocular is an uptime and speed monitor, and these requests are its probes checking a site on behalf of whoever runs it - typically every minute or few, from a few regions. They read pages, and do what the monitor's owner set up: an API request, or a browser flow that clicks and types.

How they introduce themselves

To look for hacks shown only to search engines, the app's own server also asks for a monitored page every 6 hours as Google's crawler and as a phone visitor arriving from a Google search. Its User-Agent still says it's Centocular.

Where they check from

The shared regions' addresses - and the app's own server, which looks at a monitored page about once an hour for what a check can't see: its scripts and stylesheets, the pages it links to (up to 40, every 6 hours), signs of a hack, whether search engines may index it. A private location runs on its owner's own network, so its address is theirs.

Also as JSON, for automation: /probes.json

Letting them past bot protection

Bot protection (Cloudflare, Akamai, Imperva, DataDome and the like) often challenges requests from datacenters - which is where monitoring runs. Centocular recognises a challenge and reports it as blocked, not as the site being down, but it can't see the site through it. Two ways to let the probes through:

1. By key (recommended). Every check carries X-Centocular-Key with a key for that one site - and so does every look the app's own server takes at the site, never at anyone else's. The site's owner finds it in Centocular under Admin > Probes > Let our probes through, with a ready-made rule. In Cloudflare: Security > WAF > Custom rules > Create rule, paste the expression, choose Skip and tick the bot protections to skip. Each site's key is its own: one read elsewhere opens nothing of yours.
2. By address. Allow the addresses above in the firewall (in Cloudflare: Security > WAF > Tools > IP Access Rules > Allow). They can change when regions are added - the JSON above always has the current list.

Rate limits: a check every minute from each region is a handful of requests a minute. If a limit still catches them, allow them by key or address the same way, or run the monitor less often.