Grok-User
Grok-User is BotScope's classification for live requests triggered by a question to Grok (xAI). Unlike other bots there is no unique user-agent string — Grok uses rotating Mac browser fingerprints and routes traffic through a residential proxy network.
BotScope identifies Grok-User traffic via its burst behaviour: many distinct IPs from multiple countries hit the same path within seconds — browser UA, no resource load, body > 20 kB. That pattern is the signature of a single Grok answer.
Limitation: This detection only runs during log upload, not in the live syslog stream (bursts arrive too fragmented across workers to be reliably correlated in memory). Upload your full access logs to make Grok-User visible.
Each detected burst is shown as one log entry in BotScope — the first IP, first timestamp and first UA of the burst. The IP is hashed via SHA-256 (privacy by default).